fix(panel): show whether a rule is in force, not just what was saved

With two catch-all rules both enabled in UCI and a WAN profile enabling one and disabling the other, the panel drew BOTH switches on while the engine ran only one chain. GET /api/config is right to return the raw model — that is the desired state the panel PUTs back — but Routing.tsx read the row state and the active count from it too, so the interface claimed a setting was in force when it was not. Same defect class as the Protected badge. /api/rules/reachability now carries the effective flag and, where the active profile changed the outcome, its name and direction. The annotation is a DIFF of ApplyProfileRuleOverrides output against desired state rather than a second reading of the profiles name lists, so profile logic is not duplicated and cannot drift — an unmigrated rule the profile is forbidden to enable produces no diff and gets no badge, with nothing here needing to know about LegacyDst. In the UI the two states stay separate: the switch remains the only carrier of desired state and still writes UCI, while the effective state drives the dimmed row, the badge, the banner and the header count. Mirroring the effective state into the switch would be worse than the original bug — the operator would be toggling someone elses control, and the profiles decision would be written back as their own choice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4PcWfrBRyg4eWN58axaGN
fix(logsink): collapse repeated lines instead of erasing the routers syslog
2026-07-25 21:35:06 +03:00 · 2026-07-25 21:35:06 +03:00 · 2026-07-25 21:35:06 +03:00 · 2026-07-25 21:35:06 +03:00 · 2026-07-25 20:08:58 +03:00 · 2026-07-25 18:46:21 +03:00
109 changed files with 10020 additions and 1701 deletions
@@ -1,36 +1,45 @@
-# Shater v0.2 — build the 4-package signed opkg feed and publish it as a rolling
-# Gitea release consumable as an `src/gz` feed.
+# Shater v0.2 — build the 4-package signed **apk** feed and publish it as
+# per-arch Gitea releases consumable as an apk repository.
 #
-# WHAT CHANGED FROM v0.1
-#   v0.1 shipped 3 packages: xrayctl (SDK-compiled Go) + shater-core +
-#   luci-app-shater (hand-packed data .ipk). v0.2 collapses the runtime into ONE
-#   forked binary and ships 4 packages, all built the canonical SDK way:
+# WHAT WE SHIP
+#   ONE forked binary plus its OpenWrt glue, 4 packages, all built the canonical
+#   SDK way:
 #     - shaterd          PREBUILT static-musl + SPA-embedded + UPX binary. Built
 #                        OUT OF TREE by scripts/build-shaterd.sh (Go + Node + UPX)
 #                        and staged into openwrt/shaterd/files/ BEFORE the SDK
 #                        build; the openwrt/shaterd package just $(INSTALL_BIN)s
-#                        the arch-matched artifact. (arch-specific .ipk)
+#                        the arch-matched artifact. (arch-specific .apk)
 #     - shater-core      data glue, PKGARCH=all
 #     - luci-app-shater  LuCI thin launcher, PKGARCH=all (uses feeds/luci/luci.mk)
 #     - byedpi           ciadpi, C cross-compiled from source by the SDK (arch-specific)
 #
 # TARGET HARDWARE / ARCH MATRIX
 #   x86_64             -> the QEMU testbed VM (generic x86-64).
-#   aarch64_cortex-a53 -> BOTH production routers (BPI-R3 + BPI-R4, mediatek/filogic).
+#   aarch64_cortex-a53 -> BOTH production routers (BPI-R3 mini + BPI-R4,
+#     mediatek/filogic), both on 25.12 with apk-tools 3.
 #     Only shaterd + byedpi are arch-specific; shater-core + luci-app-shater are
-#     PKGARCH=all, so one build of each covers every device. opkg filters by
-#     Architecture at install time, so a single combined feed URL serves all.
+#     PKGARCH=all, so one build of each covers every device — but the RELEASES
+#     are still per-arch (see the release-apk job for why).
 #
-# FEED SIGNING (opkg / usign — OpenWrt 24.10 is opkg, not apk; apk lands at 25.12)
-#   The feed index (Packages) is usign-signed with the SECRET key in the Gitea
-#   repo secret KEY_BUILD; routers verify it with the committed public key
-#   dist/shater-feed.pub (fingerprint 5ac4b177689cb8e0). Do NOT regenerate the
-#   key — that invalidates every deployed router's trust.
+# FORMAT: apk ONLY (25.12+)
+#   The fleet runs OpenWrt/ImmortalWrt 25.12, where opkg is replaced by Alpine
+#   apk (.apk files, binary packages.adb index, EC keys in /etc/apk/keys/). The
+#   old .ipk lane was removed in 2026-07 (docs-shater/DECISIONS.md D22): no
+#   device we serve has an opkg binary at all, so building and signing a second
+#   feed served nobody.
+#
+# FEED SIGNING (EC / apk)
+#   packages.adb is signed with the EC (prime256v1) SECRET key in the Gitea repo
+#   secret KEY_APK; routers verify it with the committed public key
+#   dist/shater-apk.pem (ci/gen-apk-key.sh). Do NOT regenerate the key — that
+#   invalidates every deployed router's trust.
 #
 # AUTO-RELEASE
-#   push a tag `vX.Y.Z` -> versioned release. workflow_dispatch / (optional) main
-#   -> rolling `latest` pre-release (always-fresh feed). Publish uses the Gitea
-#   API via curl (ci/gitea-release.sh) — no external action needed.
+#   push a tag `vX.Y.Z` -> versioned per-arch releases `apk-vX.Y.Z-<arch>`.
+#   workflow_dispatch -> rolling per-arch `apk-latest-<arch>` (always-fresh
+#   feed). Publish uses the Gitea API via curl (ci/gitea-release.sh) — no
+#   external action needed. NOTE: the apk release tags deliberately do NOT start
+#   with `v` so publishing them cannot re-trigger this workflow's `v*` filter.
 #
 # PACKAGE VERSIONING (bug B4)
 #   PKG_VERSION/PKG_RELEASE are NOT hand-written in the Makefiles any more. They
@@ -41,28 +50,13 @@
 #   exported via $GITHUB_ENV):
 #       tag `vX.Y.Z`         -> X.Y.Z-r1
 #       anything else        -> <nearest tag>-r<commits since it + 1>
-#   and hands them to the SDK builds as SHATER_PKG_VERSION/SHATER_PKG_RELEASE;
+#   and hands them to the SDK build as SHATER_PKG_VERSION/SHATER_PKG_RELEASE;
 #   $SHATER_VERSION (the same numbers, plus the short sha off-tag) is stamped
-#   into the binary's constant.Version. ci/sdk-build*.sh then ASSERT that the
-#   built .ipk/.apk really carry that version, so the failure can never be
-#   silent again. This is also why both build jobs check out with fetch-depth: 0
+#   into the binary's constant.Version. ci/sdk-build-apk.sh then ASSERTS that the
+#   built .apk really carry that version, so the failure can never be silent
+#   again. This is also why the build job checks out with fetch-depth: 0
 #   — `git describe` needs tags and ancestry. `byedpi` is excluded: it keeps
 #   upstream ByeDPI's own PKG_VERSION (see openwrt/byedpi/Makefile).
-#
-# APK LANE (25.12+, ADDITIVE — T2)
-#   The fleet is migrating to BananaWRT 25.12-mtk-vendor (= ImmortalWrt 25.12
-#   base), where opkg is replaced by Alpine apk (.apk, binary packages.adb
-#   index, EC keys in /etc/apk/keys/). The `build-apk` + `release-apk` jobs
-#   below build the SAME 4 packages through the ImmortalWrt 25.12 apk-SDK and
-#   publish PER-ARCH apk repos as releases `apk-latest-<arch>` (rolling) /
-#   `apk-<tag>-<arch>` (versioned). Per-arch because apk filenames carry no
-#   architecture (shaterd-0.2.0-r1.apk would collide across arches in one flat
-#   release) and apk fetches packages relative to the packages.adb URL.
-#   Signed with the EC key in the Gitea secret KEY_APK; trust anchor
-#   dist/shater-apk.pem (ci/gen-apk-key.sh). The usign/opkg lane above is
-#   UNCHANGED and keeps serving the 24.10 fleet. NOTE: the apk release tags
-#   deliberately do NOT start with `v` so publishing them cannot re-trigger
-#   this workflow's `v*` tag filter.

 # CACHING (T3 — fast CI)
 #   All caches use actions/cache pinned to v3.3.2: the LAST release speaking the
@@ -80,34 +74,33 @@
 #       (PKG_VERSION/PKG_HASH live there). Stale-safe: the buildroot verifies
 #       PKG_HASH on every dl/ file and re-downloads on mismatch, so restore-keys
 #       prefix fallback is allowed.
-#     - Go module + build cache — key = hash of go.sum; shared by all 4 build
+#     - Go module + build cache — key = hash of go.sum; shared by both build
 #       jobs (each builds both GOARCHes).
 #     - panel/node_modules — key = hash of panel/package-lock.json, exact-only
 #       (a lockfile change MUST miss); on hit build-shaterd.sh gets --fast.
-#     - apt .deb archives for the apk lane's debian:bookworm host-deps
-#       (.cache/apt) — key = hash of ci/sdk-build-apk.sh (the apt list is in it).
-#     - usign binary (.cache/tools) — static helper, fixed key.
+#     - apt .deb archives for the debian:bookworm host-deps of the apk SDK
+#       container (.cache/apt) — key = hash of ci/sdk-build-apk.sh (the apt list
+#       is in it).
 #     - SDK feeds/ git checkouts (.cache/feeds) — the single biggest recurring
 #       cost: `scripts/feeds update -a` cloned base+packages+luci+routing+
 #       telephony EVERY run (~7 min/job; github.com is ~1 MB/s from this
 #       runner — run 51 evidence). The feeds dir is symlinked into the SDK
 #       container from the workspace cache; `feeds update` on an existing clone
 #       is a fast fetch+checkout of the pinned revs. Correctness-safe: update
-#       always checks out feeds.conf's pins, and ci/sdk-build*.sh wipes the
+#       always checks out feeds.conf's pins, and ci/sdk-build-apk.sh wipes the
 #       cache + re-clones fresh if update ever fails on a cached checkout.
-#       Key = lane + SDK release (shared across the two arch jobs of a lane —
-#       same release pins identical feed revs; the sequential runner means the
-#       second arch restores what the first saved). restore-keys lets an SDK
-#       version bump start from the old clones (git fetch delta, not re-clone).
+#       Key = lane + SDK release (shared across the two arch jobs — the same
+#       release pins identical feed revs; the sequential runner means the second
+#       arch restores what the first saved). restore-keys lets an SDK version
+#       bump start from the old clones (git fetch delta, not re-clone).
 #   Act_runner facts this design leans on (verified in run 51 logs):
 #     - the cache backend works: restores/saves confirmed, hashFiles() works;
-#     - docker images (openwrt/sdk, debian:bookworm, runner-images) live on the
-#       PERSISTENT host daemon — "Image is up to date" each run, no re-download;
+#     - docker images (debian:bookworm, runner-images) live on the PERSISTENT
+#       host daemon — "Image is up to date" each run, no re-download;
 #     - each actions/cache SAVE is followed by an exact 3-minute act_runner
 #       stall (node process lingers; hit→no-save→no stall). Steady state saves
 #       nothing, so adding cache entries is fine, but keys that change every
 #       run (e.g. github.sha) would cost +3 min/entry/run — do NOT do that.
-
 name: release

 on:
@@ -125,148 +118,11 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  build:
-    name: ${{ matrix.arch }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64,             sdk: x86_64-24.10.4 }            # testbed VM (generic x86-64)
-          - { arch: aarch64_cortex-a53, sdk: mediatek-filogic-24.10.4 }  # BPI-R3 + BPI-R4 (mediatek/filogic)
-    steps:
-      # fetch-depth: 0 — the package version is DERIVED from the git tag
-      # (ci/version.sh: nearest `vX.Y.Z` + commits since it). The default
-      # shallow checkout has neither tags nor ancestry, so `git describe` would
-      # fail and every dispatch build would fall back to 0.0.0.
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # scripts/build-shaterd.sh builds the engine via a go.mod
-      # `replace => ./submodules/wireguard-go` (AmneziaWG fork), so that submodule
-      # must be present or `go build` dies with "no such file or directory".
-      # actions/checkout does not fetch submodules by default; init ONLY this one
-      # (clients/apple+android are large and unused here).
-      - name: Init wireguard-go submodule (awg)
-        run: git submodule update --init --depth 1 submodules/wireguard-go
-
-      # THE version step (bug B4). One computation, used by both the binary
-      # (constant.Version) and the three tag-versioned packages, exported to
-      # every later step of this job:
-      #   tag vX.Y.Z -> X.Y.Z-r1 ; off-tag -> <last tag>-r<commits+1>
-      - name: Compute version from git tag
-        run: bash ci/version.sh --env >> "$GITHUB_ENV"
-
-      # Toolchain for scripts/build-shaterd.sh: Go (daemon), Node (Vite SPA), UPX.
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod   # pins Go 1.24.7 (go.mod `go` line)
-          cache: false              # explicit actions/cache@v3.3.2 below (setup-go's
-                                    # built-in cache uses the new API act_runner lacks)
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'        # Vite 5 needs Node 18+; 20 LTS
-
-      # ---- caches (see the header comment for keys + version pin rationale) ----
-      - name: Cache Go modules + build cache
-        uses: actions/cache@v3.3.2
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: go-${{ hashFiles('go.sum') }}
-          restore-keys: |
-            go-
-
-      - name: Cache panel node_modules
-        id: npm-cache
-        uses: actions/cache@v3.3.2
-        with:
-          path: panel/node_modules
-          key: npm-${{ hashFiles('panel/package-lock.json') }}
-          # NO restore-keys: node_modules must exactly match the lockfile;
-          # on any lockfile change this misses and `npm ci` runs fresh.
-
-      - name: Cache SDK dl/ (package sources)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/dl
-          key: dl-${{ hashFiles('openwrt/*/Makefile') }}
-          restore-keys: |
-            dl-
-
-      # feeds git checkouts (see header): both 24.10.4 arch jobs share one entry
-      # (same release = same feeds.conf.default pins), so derive the release
-      # from the matrix sdk tag (x86_64-24.10.4 -> 24.10.4).
-      - name: Compute feeds cache key
-        id: feedskey
-        run: echo "ver=$(echo '${{ matrix.sdk }}' | sed 's/.*-//')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache SDK feeds checkouts
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/feeds
-          key: feeds-opkg-${{ steps.feedskey.outputs.ver }}
-          restore-keys: |
-            feeds-opkg-
-
-      - name: Cache CI tools (usign)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/tools
-          key: tools-usign-v1
-
-      - name: Install UPX
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq upx-ucl
-
-      # Build the SPA-embedded, static-musl, UPX'd shaterd for BOTH arches and
-      # stage dist/shaterd-<a>.upx into openwrt/shaterd/files/. MUST run before
-      # the SDK package build (the openwrt/shaterd package installs the staged
-      # artifact). $SHATER_VERSION (from the version step above) is stamped into
-      # constant.Version, so the binary and the package agree. On an exact
-      # node_modules cache hit, --fast skips the redundant `npm ci`.
-      - name: Build & stage shaterd artifact
-        env:
-          NPM_CACHE_HIT: ${{ steps.npm-cache.outputs.cache-hit }}
-        run: |
-          set -eu
-          FAST=""
-          if [ "${NPM_CACHE_HIT:-}" = "true" ]; then FAST="--fast"; fi
-          echo "shaterd version: $SHATER_VERSION / package ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE} (npm cache hit: ${NPM_CACHE_HIT:-false})"
-          bash scripts/build-shaterd.sh $FAST
-
-      # Compile the 4 packages through the arch-matched OpenWrt SDK and produce a
-      # signed per-arch opkg feed (Packages + Packages.gz + Packages.sig + .ipk).
-      # SHATER_PKG_VERSION/SHATER_PKG_RELEASE reach the package Makefiles through
-      # the SDK container; ci/sdk-build.sh asserts the .ipk really carry them.
-      - name: Build signed feed (SDK)
-        env:
-          KEY_BUILD: ${{ secrets.KEY_BUILD }}
-        run: bash ci/build-feed.sh "${{ matrix.arch }}" "${{ matrix.sdk }}" "out/${{ matrix.arch }}"
-
-      - name: Show feed
-        run: ls -l "out/${{ matrix.arch }}" && cat "out/${{ matrix.arch }}/Packages"
-
-      - name: Upload feed artifact
-        # v4 uses an artifact backend Gitea Actions does not implement
-        # (GHESNotSupportedError); v3 works on Gitea's act_runner.
-        uses: actions/upload-artifact@v3
-        with:
-          name: shater-${{ matrix.arch }}
-          path: out/${{ matrix.arch }}/*
-          if-no-files-found: error
-
  # ---------------------------------------------------------------------------
-  # APK lane (additive): the same 4 packages through the ImmortalWrt 25.12
-  # apk-SDK for the 25.12/apk fleet (BananaWRT 25.12-mtk-vendor routers + the
-  # future 25.12 VM). Produces a per-arch apk repo dir: *.apk + EC-signed
-  # packages.adb + shater-apk.pem. Artifact prefix `apkfeed-` (NOT `shater-`)
-  # so the opkg release job's `artifacts/shater-*` glob never picks these up.
+  # Build the 4 packages through the ImmortalWrt 25.12 apk-SDK for the 25.12/apk
+  # fleet (BPI-R3 mini on BananaWRT 25.12-mtk-vendor, BPI-R4 on OpenWrt 25.12,
+  # and the testbed VM). Produces a per-arch apk repo dir: *.apk + EC-signed
+  # packages.adb + shater-apk.pem, uploaded as the artifact `apkfeed-<arch>`.
  build-apk:
    name: apk ${{ matrix.arch }}
    runs-on: ubuntu-latest
@@ -281,8 +137,10 @@ jobs:
          - arch: aarch64_cortex-a53  # BPI-R3 mini (BananaWRT 25.12-mtk-vendor) + BPI-R4
            sdk_url: https://downloads.immortalwrt.org/releases/25.12.1/targets/mediatek/filogic/immortalwrt-sdk-25.12.1-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
    steps:
-      # fetch-depth: 0 — see the opkg lane: the package version comes from
-      # `git describe`, which needs tags + ancestry.
+      # fetch-depth: 0 — the package version is DERIVED from the git tag
+      # (ci/version.sh: nearest `vX.Y.Z` + commits since it). The default
+      # shallow checkout has neither tags nor ancestry, so `git describe` would
+      # fail and every dispatch build would fall back to 0.0.0.
      - name: Checkout
        uses: actions/checkout@v4
        with:
@@ -295,8 +153,10 @@ jobs:
      - name: Init wireguard-go submodule (awg)
        run: git submodule update --init --depth 1 submodules/wireguard-go

-      # Same single version computation as the opkg lane — both lanes MUST agree
-      # on the version, they package the identical tree.
+      # THE version step (bug B4). One computation, used by both the binary
+      # (constant.Version) and the three tag-versioned packages, exported to
+      # every later step of this job:
+      #   tag vX.Y.Z -> X.Y.Z-r1 ; off-tag -> <last tag>-r<commits+1>
      - name: Compute version from git tag
        run: bash ci/version.sh --env >> "$GITHUB_ENV"

@@ -373,11 +233,27 @@ jobs:
          restore-keys: |
            feeds-apk-

+      # D23 — the shipped tag set is a TRIMMED subset (scripts/router-tags.sh);
+      # everything else in CI builds with the full upstream set, so without this
+      # step the one combination we actually ship is never exercised. That is how
+      # `with_gvisor` was trimmed while `with_wireguard` stayed and every shipped
+      # binary answered a WireGuard node with "gVisor is not included in this
+      # build" (2026-07-25). The check runs the declared-feature/tag comparison
+      # and then constructs one node of every declared protocol through box.New
+      # UNDER THE SHIPPED TAGS. It runs before the artifact build so a tag trim
+      # that breaks a feature fails the release instead of shipping.
+      - name: Verify the shipped build-tag set (D23)
+        run: bash scripts/check-router-tags.sh
+
      - name: Install UPX
        run: sudo apt-get update -qq && sudo apt-get install -y -qq upx-ucl

-      # Same artifact-order contract as the opkg lane: the SPA-embedded shaterd
-      # binary is built OUT of the SDK and staged before the package build.
+      # Artifact-order contract: the SPA-embedded shaterd binary is built OUT of
+      # the SDK and staged into openwrt/shaterd/files/ BEFORE the package build
+      # (the openwrt/shaterd package only installs the staged artifact).
+      # $SHATER_VERSION (from the version step above) is stamped into
+      # constant.Version, so the binary and the package agree. On an exact
+      # node_modules cache hit, --fast skips the redundant `npm ci`.
      - name: Build & stage shaterd artifact
        env:
          NPM_CACHE_HIT: ${{ steps.npm-cache.outputs.cache-hit }}
@@ -409,117 +285,21 @@ jobs:
          if-no-files-found: error

  # ---------------------------------------------------------------------------
-  # Publish once both arches are built. Rolling `latest` on dispatch, a versioned
-  # release on a `vX.Y.Z` tag. Self-contained (curl -> Gitea API).
-  release:
-    name: release
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download all arch feeds
-        uses: actions/download-artifact@v3
-        with:
-          path: artifacts
-
-      - name: Assemble release assets
-        id: assets
-        run: |
-          set -eu
-          mkdir -p release
-          # For each downloaded arch feed: one ready-to-serve tarball + loose ipks.
-          for d in artifacts/shater-*; do
-            [ -d "$d" ] || continue
-            arch="${d#artifacts/shater-}"
-            tar -C "$d" -czf "release/shater-feed-${arch}.tar.gz" .
-            # loose .ipk for direct `opkg install <url>` (dedupe shared _all ipks by name)
-            for ipk in "$d"/*.ipk; do
-              [ -e "$ipk" ] || continue
-              cp -n "$ipk" "release/$(basename "$ipk")"
-            done
-          done
-          # ship the feed's public key so routers can verify (see docs-shater/INSTALL.md)
-          cp -f dist/shater-feed.pub release/shater-feed.pub
-          ls -l release
-          echo "count=$(ls release | wc -l)" >> "$GITHUB_OUTPUT"
-
-      # restore the prebuilt usign binary (skips apt + cmake + clone + build)
-      - name: Cache CI tools (usign)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/tools
-          key: tools-usign-v1
-
-      - name: Install usign (feed signer)
-        run: bash ci/install-usign.sh
-
-      - name: Build & sign combined opkg feed index
-        # One Packages/Packages.gz over ALL loose .ipk (every arch + arch=all),
-        # with basename Filenames. opkg filters by Architecture, so a single
-        # release URL serves every device: BPI routers pick aarch64_cortex-a53 +
-        # all, the x86 testbed picks x86_64 + all. Signed with KEY_BUILD so
-        # routers keep check_signature on. This is what makes the release directly
-        # consumable as an `src/gz` feed (see docs-shater/INSTALL.md).
-        env:
-          KEY_BUILD: ${{ secrets.KEY_BUILD }}
-        run: bash ci/make-index.sh release
-
-      - name: Determine release identity
-        id: rel
-        run: |
-          set -eu
-          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
-            echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
-            echo "name=shater ${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
-            echo "prerelease=false" >> "$GITHUB_OUTPUT"
-            echo "rolling=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=latest" >> "$GITHUB_OUTPUT"
-            echo "name=shater latest (main)" >> "$GITHUB_OUTPUT"
-            echo "prerelease=true" >> "$GITHUB_OUTPUT"
-            echo "rolling=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish Gitea release
-        env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN != '' && secrets.RELEASE_TOKEN || github.token }}
-          TAG: ${{ steps.rel.outputs.tag }}
-          NAME: ${{ steps.rel.outputs.name }}
-          PRERELEASE: ${{ steps.rel.outputs.prerelease }}
-          ROLLING: ${{ steps.rel.outputs.rolling }}
-          BODY: |
-            Automated build. Packages: shaterd + byedpi (per-arch), shater-core +
-            luci-app-shater (arch=all).
-            Targets: x86_64 (testbed) and aarch64_cortex-a53 (BPI-R3 + BPI-R4, mediatek/filogic).
-
-            ── Add as an opkg feed (recommended — then updating is one command) ──
-            This release is itself a SIGNED package feed; opkg filters by
-            architecture, so the same lines work on every device:
-              wget -O /etc/opkg/keys/5ac4b177689cb8e0 https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-              echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" >> /etc/opkg/customfeeds.conf
-              opkg update
-              opkg install luci-app-shater        # pulls shater-core + shaterd too
-            The public-key install is one-time; after it, `opkg update/upgrade`
-            verify the signature with check_signature left on. Full guide: docs-shater/INSTALL.md.
-
-            ── Update (name our packages — never a bare `opkg upgrade`) ──
-              opkg update
-              opkg upgrade shaterd shater-core luci-app-shater byedpi
-
-            ── Or install the loose .ipk directly / from the tarball feed ──
-              wget -O /tmp/f.tgz <this release>/shater-feed-aarch64_cortex-a53.tar.gz
-              mkdir -p /tmp/shater && tar -C /tmp/shater -xzf /tmp/f.tgz
-              opkg install /tmp/shater/luci-app-shater_*_all.ipk
-        run: bash ci/gitea-release.sh release/*
-
-  # ---------------------------------------------------------------------------
-  # Publish the apk lane: ONE release PER ARCH (apk package filenames carry no
-  # arch, and apk fetches `<name>-<ver>.apk` relative to the packages.adb URL —
-  # a flat multi-arch release would collide). Rolling `apk-latest-<arch>` on
-  # dispatch, `apk-<tag>-<arch>` on a version tag. The tags do NOT match the
-  # workflow's `v*` trigger, so publishing them cannot re-trigger the build.
+  # Publish: ONE release PER ARCH (apk package filenames carry no arch, and apk
+  # fetches `<name>-<ver>.apk` relative to the packages.adb URL — a flat
+  # multi-arch release would collide). Every run refreshes the ROLLING pointer
+  # `apk-latest-<arch>`; a `vX.Y.Z` tag run ALSO publishes the pinnable
+  # `apk-vX.Y.Z-<arch>`. The tags do NOT match the workflow's `v*` trigger, so
+  # publishing them cannot re-trigger the build.
+  #
+  # WHY THE ROLLING RELEASE IS PUBLISHED ON TAG RUNS TOO (fixed 2026-07-25):
+  # it used to be an either/or — `TAG=apk-latest-<arch>` on dispatch, ELSE
+  # `TAG=apk-<ver>-<arch>` — so once releases moved to tag pushes the rolling
+  # pointer was never written again. It froze at 0.2.0 (published 2026-07-24)
+  # while v0.2.9/v0.2.10 published fine, and every router whose
+  # /etc/apk/repositories.d/shater.list points at the rolling URL kept getting a
+  # successful, silent `apk update` with nothing new. Rolling is the whole point
+  # of that URL, so it is now written unconditionally and asserted afterwards.
  release-apk:
    name: release apk
    needs: build-apk
@@ -537,6 +317,9 @@ jobs:
        with:
          path: artifacts

+      # Identity of the VERSIONED release only. The rolling pointer is published
+      # on every run with fixed prerelease=true/rolling=true, so it needs nothing
+      # from here.
      - name: Determine release identity
        id: rel
        run: |
@@ -558,21 +341,39 @@ jobs:
          PRERELEASE: ${{ steps.rel.outputs.prerelease }}
          ROLLING: ${{ steps.rel.outputs.rolling }}
        run: |
-          set -eu
+          set -euo pipefail
          for d in artifacts/apkfeed-*; do
            [ -d "$d" ] || continue
            arch="${d#artifacts/apkfeed-}"
-            if [ "$VER" = latest ]; then TAG="apk-latest-$arch"; else TAG="apk-$VER-$arch"; fi
+            ROLL="apk-latest-$arch"
+
+            # The version we just built, read straight off the artifact
+            # (`shaterd-<ver>-r<rel>.apk`). NOT recomputed with ci/version.sh:
+            # this job checks out shallow, so it has no tags to describe from.
+            pkg=""
+            for a in "$d"/shaterd-*.apk; do
+              if [ -f "$a" ]; then pkg="$(basename "$a")"; fi
+            done
+            [ -n "$pkg" ] || { echo "[release-apk] ERROR: no shaterd-*.apk in $d"; exit 11; }
+            want="${pkg#shaterd-}"; want="${want%.apk}"
+            echo "[release-apk] arch=$arch built version=$want"
+
            BODY="Automated apk (OpenWrt/ImmortalWrt 25.12+) package repo for \`$arch\`.
          Packages: shaterd + byedpi (per-arch), shater-core + luci-app-shater (arch=all).
+          This build: \`$want\`.
          The index \`packages.adb\` is EC-signed; trust anchor \`shater-apk.pem\` (also in \`dist/\`).

-          ── Add as an apk repository ──
-            wget -O /etc/apk/keys/shater-apk.pem https://git.qomar.pw/omar/shater/releases/download/$TAG/shater-apk.pem
+          ── Add as an apk repository (rolling — install once, then just update) ──
+            wget -O /etc/apk/keys/shater-apk.pem https://git.qomar.pw/omar/shater/releases/download/$ROLL/shater-apk.pem
            echo \"https://git.qomar.pw/omar/shater/releases/download/apk-latest-\$(cat /etc/apk/arch)/packages.adb\" > /etc/apk/repositories.d/shater.list
            apk update
            apk add luci-app-shater      # pulls shater-core + shaterd too
            apk add byedpi               # optional: ByeDPI desync egress
+          \`apk-latest-<arch>\` is a MOVING pointer: every release run replaces its
+          assets, so the same repo line keeps serving the newest build. To pin a
+          version instead, point the repo line at
+          \`.../download/apk-vX.Y.Z-\$(cat /etc/apk/arch)/packages.adb\` — then the
+          file must be edited by hand for each upgrade.
          ── Update — ALWAYS name the packages, NEVER a bare \`apk upgrade\` ──
            apk update
            apk upgrade shaterd shater-core luci-app-shater byedpi
@@ -580,9 +381,55 @@ jobs:
          configured repo and can downgrade unrelated system packages; naming them
          upgrades only those (apk-tools 3: \"If list of packages is provided, only
          those packages are upgraded along with needed dependencies\").
-          Full guide: docs-shater/INSTALL.md §6. The opkg/24.10 feed lives in the \`latest\` release."
-            echo "[release-apk] publishing $TAG from $d"
-            TAG="$TAG" NAME="shater apk $VER ($arch)" BODY="$BODY" \
-              PRERELEASE="$PRERELEASE" ROLLING="$ROLLING" \
+          Full guide: docs-shater/INSTALL.md §5."
+
+            # 1) the pinnable versioned release (tag runs only)
+            if [ "$VER" != latest ]; then
+              echo "[release-apk] publishing apk-$VER-$arch from $d"
+              TAG="apk-$VER-$arch" NAME="shater apk $VER ($arch)" BODY="$BODY" \
+                PRERELEASE="$PRERELEASE" ROLLING="$ROLLING" \
+                bash ci/gitea-release.sh "$d"/*
+            fi
+
+            # 2) the rolling pointer — ALWAYS, tag run included. ci/gitea-release.sh
+            #    deletes the existing release before recreating it, so the old
+            #    version's assets are REPLACED, never accumulated (two versions of
+            #    one package in one index would let apk choose, not us).
+            echo "[release-apk] publishing $ROLL from $d"
+            TAG="$ROLL" NAME="shater apk latest ($arch)" BODY="$BODY" \
+              PRERELEASE=true ROLLING=true \
              bash ci/gitea-release.sh "$d"/*
+
+            # 3) ASSERT the rolling release really serves THIS build — same class
+            #    of check as ci/sdk-build-apk.sh's package-version assert, and for
+            #    the same reason: the previous failure mode was silent. Reads the
+            #    published release back over the API and requires our three
+            #    tag-versioned packages at $want, the index, the key — and NO
+            #    left-over package asset at any other version.
+            api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$ROLL"
+            got="$(curl -fsS -H "Authorization: token $TOKEN" "$api" \
+                   | tr '{},' '\n\n\n' \
+                   | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sort -u)" || {
+              echo "[release-apk] ERROR: cannot read back $ROLL from the API"; exit 12; }
+            echo "[release-apk] $ROLL assets: $(printf '%s ' $got)"
+            # here-string, NOT `printf | grep -q`: under `pipefail` the early
+            # exit of grep -q can SIGPIPE the writer and fail a passing check.
+            for f in "shaterd-$want.apk" "shater-core-$want.apk" \
+                     "luci-app-shater-$want.apk" packages.adb shater-apk.pem; do
+              grep -qxF "$f" <<<"$got" || {
+                echo "[release-apk] ERROR: $ROLL does not contain '$f' after publish."
+                echo "        A router pinned to the rolling URL would have silently"
+                echo "        stayed on its old version with a successful apk update."
+                exit 13; }
+            done
+            stale="$(grep -E '^(shaterd|shater-core|luci-app-shater)-.*\.apk$' <<<"$got" \
+                     | grep -vxF -e "shaterd-$want.apk" -e "shater-core-$want.apk" \
+                                 -e "luci-app-shater-$want.apk" || true)"
+            [ -z "$stale" ] || {
+              echo "[release-apk] ERROR: $ROLL still holds stale package assets:"
+              printf '          %s\n' $stale
+              echo "        Two versions of one package in one feed = apk picks by its"
+              echo "        own rules, not by our intent."
+              exit 14; }
+            echo "[release-apk] OK — $ROLL serves $want"
          done
@@ -63,7 +63,7 @@ nul
 /venv/
 /test/cache.db

-# feed artifacts (tracked public key dist/shater-feed.pub is force-added)
+# feed artifacts (the tracked apk trust anchor dist/shater-apk.pem is force-added)
 /dist/

 # local agent config (CLAUDE.md is deliberately tracked; .claude local settings are not)
@@ -49,29 +49,22 @@ Full list with MVP/T1/T2 tags — [`docs-shater/FEATURES.md`](docs-shater/FEATUR

 ## Install

-Two signed feeds. Pick by the router's OpenWrt version. Verbatim commands and the
-manual `.ipk`/`.apk` install are in [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
-
-**opkg (OpenWrt 24.10):**
+One signed **apk** feed (OpenWrt / ImmortalWrt / BananaWRT **25.12+**), one
+release per arch. Verbatim commands, the manual `.apk` install and the
+rolling-vs-pinned choice are in
+[`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).

 ```sh
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-opkg update && opkg install luci-app-shater   # -> shater-core -> shaterd
-```
-
-**apk (OpenWrt / ImmortalWrt / BananaWRT 25.12+):**
-
-```sh
-wget -O /etc/apk/keys/shater-apk.pem \
-  "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"
-echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb" \
-  > /etc/apk/repositories.d/shater.list
+wget -O /etc/apk/keys/shater-apk.pem   "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"
+echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb"   > /etc/apk/repositories.d/shater.list
 apk update && apk add luci-app-shater         # -> shater-core -> shaterd
 ```

+`apk-latest-<arch>` is a moving pointer refreshed by every release run — install
+once and `apk update && apk upgrade shaterd shater-core luci-app-shater byedpi`
+keeps the router current. Point the repo line at `apk-vX.Y.Z-<arch>` instead to
+pin a build; that file then has to be edited by hand for every upgrade.
+
 shater ships **inert** (globals off) so install never breaks connectivity. After
 configuring nodes/rules: `uci set shater.globals.enabled=1 && uci commit shater`,
 then `shaterd apply` and `shaterd confirm`.
@@ -91,16 +84,17 @@ into `openwrt/shaterd/files/`. Details in
 | `panel/` | Admin SPA (Vite + React + TS) and its Go server |
 | `openwrt/` | Packages: `shaterd`, `shater-core`, `luci-app-shater`, `byedpi` |
 | `docs-shater/` | Product documentation |
-| `scripts/`, `ci/`, `.gitea/workflows/` | Build script, feed/release scripts, CI |
+| `scripts/`, `ci/`, `.gitea/workflows/` | Build script, apk feed/release scripts, CI |
 | `SPECS/`, `docs-lx/` | Engine-fork constitution/specs and feature-config reference |
 | `docs/`, `mkdocs.yml` | **Upstream** sing-box docs (mkdocs) — kept as-is |
 | `adapter/ cmd/ dns/ route/ option/ protocol/ transport/ …` | sing-box-lx engine tree |

 ## CI, upstream & license

-CI (`.gitea/workflows/release.yml`) builds all 4 packages and publishes signed
-feeds: opkg (usign, key `5ac4b177689cb8e0`) and apk (EC key `shater-apk.pem`). A
-`vX.Y.Z` tag → versioned release; `workflow_dispatch` → rolling `latest`.
+CI (`.gitea/workflows/release.yml`) builds all 4 packages and publishes a signed
+per-arch apk repo (EC key `shater-apk.pem`). A `vX.Y.Z` tag → the pinnable
+`apk-vX.Y.Z-<arch>`; every run also refreshes the rolling `apk-latest-<arch>` and
+asserts over the API that it really serves the version just built.

 The engine is the **sing-box-lx** fork — a thin downstream of upstream sing-box that
 lives by **rebase, never merge**; its constitution is
@@ -10,7 +10,7 @@

 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue.svg)](LICENSE)
 ![targets: x86_64 · aarch64_cortex-a53](https://img.shields.io/badge/targets-x86__64%20%C2%B7%20aarch64__cortex--a53-brightgreen.svg)
-![feeds: opkg 24.10 · apk 25.12](https://img.shields.io/badge/feeds-opkg%2024.10%20%C2%B7%20apk%2025.12-orange.svg)
+![feed: apk 25.12+](https://img.shields.io/badge/feed-apk%2025.12%2B-orange.svg)

 ---

@@ -128,42 +128,15 @@ data-plane, DNS-flow, apply-flow) — в [`docs-shater/ARCHITECTURE.md`](docs-sh

 ## Установка

-shater поставляется двумя подписанными фидами. Выберите по версии OpenWrt на роутере:
-
- **OpenWrt 24.10** → фид **opkg** (`.ipk`, `Packages.gz`, ключ usign).
- **OpenWrt / ImmortalWrt / BananaWRT 25.12+** → фид **apk** (`.apk`, `packages.adb`,
-  EC-ключ).
+shater поставляется одним подписанным **apk-фидом** (OpenWrt / ImmortalWrt /
+BananaWRT **25.12+**: `.apk`, индекс `packages.adb`, EC-ключ в `/etc/apk/keys/`).
+Старый opkg-фид (`.ipk`, 24.10) снят — оба наших роутера на 25.12 с apk-tools 3,
+бинаря `opkg` там просто нет (`docs-shater/DECISIONS.md` D22).

 Пакеты ставятся по зависимостям: `shaterd` → `shater-core` → `luci-app-shater`
 (+ опциональный `byedpi`). `shaterd` подтягивается автоматически как зависимость.

-### Путь A — фид opkg (OpenWrt 24.10)
-
-```sh
-# 1) доверяем ключу фида — ИМЯ файла обязано равняться отпечатку usign-ключа.
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-
-# 2) добавляем фид (один URL обслуживает все арки).
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-
-# 3) обновляемся и ставим (shaterd подтянется как зависимость).
-opkg update
-opkg install luci-app-shater        # -> shater-core -> shaterd
-opkg install byedpi                 # опционально: ByeDPI desync-egress
-```
-
-Обновление — **только наши пакеты, никогда голый `opkg upgrade`** (без аргументов
-он тянет обновления и на системные пакеты, это классический способ окирпичить
-роутер):
-
-```sh
-opkg update
-opkg upgrade shaterd shater-core luci-app-shater byedpi
-```
-
-### Путь B — фид apk (OpenWrt / ImmortalWrt / BananaWRT 25.12+)
+### Фид apk

 `/etc/apk/arch` сам выбирает нужный per-arch релиз (apk-релизы раздельны по арке):

@@ -198,13 +171,22 @@ apk upgrade shaterd shater-core luci-app-shater byedpi
 only those packages are upgraded along with needed dependencies»*. Проверить
 установленные версии: `apk list -I shaterd shater-core luci-app-shater byedpi`.

+> **Роллинг или фиксация — это выбор URL в `shater.list`.** `apk-latest-<arch>`
+> — движущийся указатель: каждый релизный прогон заменяет его ассеты, поэтому
+> «поставил и забыл»: `apk update` сам видит новую сборку. `apk-vX.Y.Z-<arch>` —
+> фиксация на конкретной сборке: роутер не получит ничего нового, пока
+> `/etc/apk/repositories.d/shater.list` не отредактируют руками — на каждом
+> роутере и на каждый релиз. На `mini_router` сознательно прописан
+> версионированный URL, и ручная правка — его цена. Подробнее —
+> [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) §5.1.
+
 > Версии пакетов CI берёт из git-тега (`vX.Y.Z` → `X.Y.Z-r1`, сборка вне тега →
 > `X.Y.Z-r<коммитов+1>`), поэтому каждая новая сборка действительно видна
 > менеджеру пакетов как новая. Подробности — `docs-shater/INSTALL.md` §2.1.

-> Полные инструкции — раздельная установка из `.ipk`/`.apk` вручную, закрепление
-> версии (`vX.Y.Z` / `apk-vX.Y.Z-<arch>`), совместимость с BananaWRT
-> `25.12-mtk-vendor` — в [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
+> Полные инструкции — ручная установка из `.apk`, фиксация версии
+> (`apk-vX.Y.Z-<arch>`), совместимость с BananaWRT `25.12-mtk-vendor` — в
+> [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).

 ### Включение

@@ -258,8 +240,8 @@ arm64}` с musl-static набором тегов (`CGO_ENABLED=0 GOOS=linux`), s
 | `openwrt/` | Пакеты: `shaterd`, `shater-core`, `luci-app-shater`, `byedpi` |
 | `docs-shater/` | Документация продукта (см. таблицу ниже) |
 | `scripts/` | `build-shaterd.sh` — сборка ship-артефакта |
-| `ci/` | Скрипты сборки фидов и релизов (SDK, usign/EC, Gitea API) |
-| `.gitea/workflows/` | `release.yml` — CI: сборка пакетов + подписанные фиды opkg/apk |
+| `ci/` | Скрипты сборки apk-фида и релизов (SDK, EC-подпись, Gitea API) |
+| `.gitea/workflows/` | `release.yml` — CI: сборка пакетов + подписанный apk-фид |
 | `SPECS/` | Конституция форка движка и спеки (Spec Kit) |
 | `docs-lx/` | Справочник конфигурации фич движка (`lx-config.md`, `.ru.md`) |
 | `lx-test/`, `submodules/` | Примеры конфигов движка и submodule AmneziaWG-рантайма |
@@ -273,16 +255,17 @@ arm64}` с musl-static набором тегов (`CGO_ENABLED=0 GOOS=linux`), s
 CI на **Gitea Actions** (`.gitea/workflows/release.yml`) собирает все 4 пакета и
 публикует **подписанные фиды**:

- **opkg (24.10):** один комбинированный релиз, подписан usign-ключом (публичный
-  `dist/shater-feed.pub`, отпечаток `5ac4b177689cb8e0`; секрет — в Gitea-secret
-  `KEY_BUILD`).
- **apk (25.12+):** параллельная линия, **по релизу на арку**, подписан EC-ключом
-  (`dist/shater-apk.pem`; секрет — `KEY_APK`).
+- **apk (25.12+)** — единственный формат: **по релизу на арку**, индекс
+  `packages.adb` подписан EC-ключом (публичный `dist/shater-apk.pem`; секрет — в
+  Gitea-secret `KEY_APK`).

-Триггеры: push тега **`vX.Y.Z`** → версионный релиз; `workflow_dispatch` →
-плавающий `latest`/`apk-latest-<arch>` (всегда свежий фид). Публикация — через
-Gitea API (`ci/gitea-release.sh`). Ключи **никогда не перегенерируются** — это
-инвалидировало бы доверие на всех развёрнутых роутерах.
+Триггеры: push тега **`vX.Y.Z`** → версионный релиз `apk-vX.Y.Z-<arch>`;
+`workflow_dispatch` → только роллинг. Роллинг `apk-latest-<arch>` обновляется
+**на каждом прогоне**, включая теговый, и после публикации проверяется через API:
+в нём обязаны лежать наши три пакета ровно собранной версии и ни одного ассета
+другой версии. Публикация — через Gitea API (`ci/gitea-release.sh`). Ключ
+**никогда не перегенерируется** — это инвалидировало бы доверие на всех
+развёрнутых роутерах.

 ---

@@ -307,7 +290,7 @@ build-тегами и живущий **ребейзом на каждый upstre
 | Документ | О чём |
 |----------|-------|
 | [`docs-shater/CONTEXT.md`](docs-shater/CONTEXT.md) | **Начните здесь** — контекст проекта, история v0.1→v0.2, testbed/инфра |
-| [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) | Сборка ship-артефакта и установка обоих фидов (opkg/apk) |
+| [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) | Сборка ship-артефакта и установка apk-фида (роллинг/фиксация) |
 | [`docs-shater/ARCHITECTURE.md`](docs-shater/ARCHITECTURE.md) | One-binary дизайн, auth-handoff, data/DNS/apply-потоки (диаграммы) |
 | [`docs-shater/FEATURES.md`](docs-shater/FEATURES.md) | Полный список фич с тегами MVP/T1/T2 |
 | [`docs-shater/ROADMAP.md`](docs-shater/ROADMAP.md) | Фазовый план |
@@ -1,6 +1,6 @@
 #!/bin/sh
-# ci/build-feed-apk.sh — build the signed **apk** feed for ONE arch (the 25.12
-# lane — additive next to ci/build-feed.sh, which stays the opkg/24.10 lane).
+# ci/build-feed-apk.sh — build the signed **apk** feed for ONE arch (25.12+;
+# the only packaging lane shater has — see docs-shater/DECISIONS.md D22).
 #
 # Usage:  ci/build-feed-apk.sh <ARCH> <SDK_URL> <OUTDIR>
 #   e.g.  ci/build-feed-apk.sh aarch64_cortex-a53 \
@@ -10,14 +10,14 @@
 # This is the per-arch entrypoint the Gitea workflow's `build-apk` job calls.
 # It runs on the CI RUNNER and:
 #   1. asserts the prebuilt shaterd binary for this arch was already staged by
-#      scripts/build-shaterd.sh (same artifact-order contract as the opkg lane);
-#   2. drives a plain `debian:bookworm` container (workspace shared via
-#      `--volumes-from`, same trick as ci/build-feed.sh) that downloads the
-#      ImmortalWrt 25.12 apk-SDK tarball and runs ci/sdk-build-apk.sh in it:
-#      compile the 4 packages as .apk, then `apk mkndx --sign` the per-arch
-#      `packages.adb` index. Unlike the usign lane (index signed on the runner),
-#      apk indexing NEEDS the SDK's host `apk` tool, so index+sign happen inside
-#      the container.
+#      scripts/build-shaterd.sh (the artifact-order contract);
+#   2. drives a plain `debian:bookworm` container (the job's workspace volume is
+#      shared into it with `--volumes-from $(hostname)`; a bare `-v $PWD:...`
+#      points at a host path that does not exist under act_runner's DinD) that
+#      downloads the ImmortalWrt 25.12 apk-SDK tarball and runs
+#      ci/sdk-build-apk.sh in it: compile the 4 packages as .apk, then
+#      `apk mkndx --sign` the per-arch `packages.adb` index. Indexing NEEDS the
+#      SDK's host `apk` tool, so index+sign happen inside the container.
 #
 # Why the ImmortalWrt SDK (not openwrt/sdk images): the 25.12 fleet runs
 # BananaWRT 25.12-mtk-vendor = ImmortalWrt 25.12 base (target mediatek/filogic,
@@ -25,9 +25,9 @@
 # mediatek-filogic 25.12 tag — hence the official SDK tarball.
 #
 # Env:
-#   KEY_APK   EC (prime256v1) PRIVATE key PEM (Gitea repo secret — the apk analog
-#             of KEY_BUILD). If set, packages.adb carries an embedded signature
-#             verifiable by dist/shater-apk.pem (routers: /etc/apk/keys/).
+#   KEY_APK   EC (prime256v1) PRIVATE key PEM (Gitea repo secret). If set,
+#             packages.adb carries an embedded signature verifiable by
+#             dist/shater-apk.pem (routers: /etc/apk/keys/).
 #             If unset, an UNSIGNED index is produced (warning; not shippable —
 #             apk signatures are effectively mandatory).
 set -eu
@@ -56,10 +56,9 @@ fi
 chmod +x "$REPO"/ci/*.sh 2>/dev/null || true

 # --- 0.4) package version from the git tag ------------------------------------
-# Same contract as the opkg lane (ci/build-feed.sh): the workflow puts these in
-# the job env via `ci/version.sh --env >> $GITHUB_ENV`; recompute here when run
-# standalone. Passed into the container below and re-exported to the
-# unprivileged build user in ci/sdk-build-apk.sh.
+# The workflow puts these in the job env via `ci/version.sh --env >>
+# $GITHUB_ENV`; recompute here when run standalone. Passed into the container
+# below and re-exported to the unprivileged build user in ci/sdk-build-apk.sh.
 if [ -z "${SHATER_PKG_VERSION:-}" ] || [ -z "${SHATER_PKG_RELEASE:-}" ]; then
  eval "$(sh "$REPO/ci/version.sh" --env)"
 fi
@@ -73,7 +72,7 @@ echo "[apk-feed] package version: ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
 #         SDK; PKG_HASH still verifies every file, so stale = re-downloaded.
 #   apt/  debian:bookworm .deb archives for the host-deps install.
 # The nested container runs the build as an unprivileged user -> must be writable
-# (same reason as the chmod 0777 "$OUT" in ci/build-feed.sh).
+# (same reason as the chmod 0777 "$OUT" above).
 CACHE="$REPO/.cache"
 mkdir -p "$CACHE/sdk" "$CACHE/dl" "$CACHE/apt"
 chmod -R a+rwX "$CACHE/dl" "$CACHE/apt" 2>/dev/null || true
@@ -96,8 +95,8 @@ sh "$REPO/ci/fetch-sdk.sh" "$SDK_URL" "$SDK_TAR"

 # --- 1) SDK build + index + sign inside a debian container -------------------
 # `--volumes-from $(hostname)` shares THIS job container's workspace volume into
-# the nested container (see ci/build-feed.sh for why a bare -v does not work on
-# the act_runner DinD setup).
+# the nested container: a bare `-v $PWD:...` points at a host path that does not
+# exist under the act_runner DinD setup.
 echo "[apk-feed] SDK build arch=$ARCH (ImmortalWrt 25.12 apk-SDK)"
 docker pull -q debian:bookworm
 docker run --rm --volumes-from "$(hostname)" \
@@ -1,106 +0,0 @@
-#!/bin/sh
-# ci/build-feed.sh — build the signed opkg feed for ONE arch.
-#
-# Usage:  ci/build-feed.sh <ARCH> <SDK_DOCKER_TAG> <OUTDIR>
-#   e.g.  ci/build-feed.sh x86_64             x86_64-24.10.4          out/x86_64
-#         ci/build-feed.sh aarch64_cortex-a53 mediatek-filogic-24.10.4 out/aarch64_cortex-a53
-#
-# This is the reusable per-arch entrypoint the Gitea workflow calls. It runs on
-# the CI RUNNER and:
-#   1. asserts the prebuilt shaterd binary for this arch was already staged by
-#      scripts/build-shaterd.sh (into openwrt/shaterd/files/) — proving artifact
-#      order: SPA+shaterd build BEFORE the SDK package build;
-#   2. drives the arch-matched `openwrt/sdk` docker image to compile all 4
-#      packages (ci/sdk-build.sh) and collect their .ipk into OUTDIR;
-#   3. builds + usign-signs the opkg `Packages` index over OUTDIR
-#      (ci/install-usign.sh + ci/make-index.sh; signs iff $KEY_BUILD is set).
-#
-# Env:
-#   KEY_BUILD   usign SECRET key (Gitea repo secret). If set, the feed index is
-#               signed and verifiable by dist/shater-feed.pub (fp 5ac4b177689cb8e0).
-#               If unset, an UNSIGNED feed is produced (make-index warns).
-set -eu
-
-ARCH="${1:?arch required (x86_64 | aarch64_cortex-a53)}"
-SDK_TAG="${2:?sdk docker tag required (e.g. x86_64-24.10.4)}"
-OUT="${3:?output dir required}"
-
-REPO="$(cd "$(dirname "$0")/.." && pwd)"
-mkdir -p "$OUT"; OUT="$(cd "$OUT" && pwd)"
-# $OUT is created here as ROOT on the runner, but the nested `openwrt/sdk`
-# container runs as the unprivileged `buildbot` (uid 1000) — so it must be able
-# to write the collected .ipk into $OUT. World-writable is set HERE (a chmod
-# from inside the container, as buildbot, cannot fix a root-owned dir).
-chmod 0777 "$OUT"
-
-# --- 0) the prebuilt shaterd binary must already be staged for this arch ------
-case "$ARCH" in
-  x86_64)             sfx=amd64 ;;
-  aarch64_cortex-a53) sfx=arm64 ;;
-  *) echo "[feed] ERROR: unsupported ARCH '$ARCH'"; exit 2 ;;
-esac
-if [ ! -f "$REPO/openwrt/shaterd/files/shaterd-$sfx.upx" ]; then
-  echo "[feed] ERROR: openwrt/shaterd/files/shaterd-$sfx.upx not staged."
-  echo "        Run scripts/build-shaterd.sh BEFORE ci/build-feed.sh." >&2
-  exit 3
-fi
-
-chmod +x "$REPO"/ci/*.sh 2>/dev/null || true
-
-# --- 0.4) package version from the git tag ------------------------------------
-# The workflow normally puts these in the job env (ci/version.sh --env >>
-# $GITHUB_ENV); recompute here when this script is run standalone so a manual
-# `ci/build-feed.sh ...` produces the same versions as CI. They are handed to the
-# SDK container below and read by openwrt/*/Makefile (bug B4 — versions used to
-# be hand-written literals that nobody bumped, so v0.2.2…v0.2.6 all shipped as
-# 0.2.0-r3 and no router could ever see an update).
-if [ -z "${SHATER_PKG_VERSION:-}" ] || [ -z "${SHATER_PKG_RELEASE:-}" ]; then
-  eval "$(sh "$REPO/ci/version.sh" --env)"
-fi
-echo "[feed] package version: ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
-
-# --- 0.5) persistent dl/ (package source tarballs) ----------------------------
-# Workspace dir restored/saved by actions/cache in the workflow and shared into
-# the nested SDK container via --volumes-from; becomes CONFIG_DOWNLOAD_FOLDER
-# there (ci/sdk-build.sh). PKG_HASH still verifies every file, so a stale cache
-# can never produce a wrong build. Must be writable by the container's
-# unprivileged buildbot user (same reason as the $OUT chmod above).
-DL_DIR="$REPO/.cache/dl"
-mkdir -p "$DL_DIR"
-chmod -R a+rwX "$DL_DIR" 2>/dev/null || true
-
-# --- 0.6) persistent feeds/ git checkouts -------------------------------------
-# Workspace dir restored/saved by actions/cache (key: feeds-opkg-<release>) and
-# symlinked over the SDK's feeds/ inside the container (ci/sdk-build.sh), so
-# `scripts/feeds update -a` fetches deltas instead of re-cloning base+packages+
-# luci from scratch (~7 min/run on this runner's slow github.com link).
-# Top-level chmod only: the contents are created by the container's uid-1000
-# build user and restored with the same ownership (tar-as-root preserves it).
-FEEDS_CACHE="$REPO/.cache/feeds/opkg"
-mkdir -p "$FEEDS_CACHE"
-chmod a+rwX "$REPO/.cache" "$REPO/.cache/feeds" "$FEEDS_CACHE" 2>/dev/null || true
-
-# --- 1) SDK package build (4 packages) in the arch-matched SDK image ----------
-# We drive the `openwrt/sdk` docker image directly (not openwrt/gh-action-sdk):
-# on a self-hosted Gitea act_runner the marketplace action fetch can be
-# unavailable, and we need a CLEAN single-feed layout. `--volumes-from
-# $(hostname)` shares THIS job container's workspace volume into the nested SDK
-# container — a bare `-v $PWD:...` points at a host path that does not exist
-# under the act_runner DinD setup. (Requires the job to run inside a container,
-# which Gitea Actions does by default.)
-echo "[feed] SDK build arch=$ARCH image=openwrt/sdk:$SDK_TAG"
-docker pull "openwrt/sdk:$SDK_TAG"
-docker run --rm --volumes-from "$(hostname)" \
-  -e ARCH="$ARCH" -e REPO="$REPO" -e OUT="$OUT" -e DL_DIR="$DL_DIR" \
-  -e FEEDS_CACHE="$FEEDS_CACHE" \
-  -e SHATER_PKG_VERSION="$SHATER_PKG_VERSION" \
-  -e SHATER_PKG_RELEASE="$SHATER_PKG_RELEASE" \
-  "openwrt/sdk:$SDK_TAG" \
-  sh "$REPO/ci/sdk-build.sh"
-
-# --- 2) index + sign the per-arch feed (usign, KEY_BUILD passed through) -------
-sh "$REPO/ci/install-usign.sh"
-KEY_BUILD="${KEY_BUILD:-}" bash "$REPO/ci/make-index.sh" "$OUT"
-
-echo "[feed] done arch=$ARCH -> $OUT"
-ls -l "$OUT"
@@ -2,24 +2,21 @@
 # ci/gen-apk-key.sh — generate the Shater **apk** feed signing keypair (25.12 lane).
 #
 # apk (OpenWrt/ImmortalWrt 25.12+) verifies package indexes with EC keys
-# (prime256v1 PEM), NOT usign — the existing usign identity
-# (dist/shater-feed.pub, fp 5ac4b177689cb8e0) keeps signing the opkg/24.10 feed
-# and is NOT touched by this script. This generates a SEPARATE, second identity:
+# (prime256v1 PEM). This is the ONLY feed identity shater has since the opkg
+# lane was removed (D22) — the old usign key is history, not a second lane.
 #
 #   dist/shater-apk.key   EC PRIVATE key.  NEVER commit (dist/ is gitignored).
 #                         Paste its full PEM contents into the Gitea repo secret
-#                         KEY_APK (the apk analog of the usign secret KEY_BUILD).
-#                         Then delete the local file (or keep it in a password
-#                         manager as the offline backup — losing it means every
-#                         deployed router must re-trust a new key).
-#   dist/shater-apk.pem   PUBLIC key. Commit it next to shater-feed.pub:
+#                         KEY_APK. Then delete the local file (or keep it in a
+#                         password manager as the offline backup — losing it
+#                         means every deployed router must re-trust a new key).
+#   dist/shater-apk.pem   PUBLIC key. Commit it:
 #                             git add -f dist/shater-apk.pem
 #                         (-f because /dist/ is gitignored). Routers install it
 #                         as /etc/apk/keys/shater-apk.pem.
 #
 # Run ONCE. Refuses to overwrite: regenerating the key invalidates the trust of
-# every router that already installed shater-apk.pem (same rule as D7 for the
-# usign key).
+# every router that already installed shater-apk.pem (see D22).
 set -eu

 REPO="$(cd "$(dirname "$0")/.." && pwd)"
@@ -1,60 +0,0 @@
-#!/bin/bash
-# Make `usign` available on the CI runner so ci/make-index.sh can sign the opkg
-# feed index. The OpenWrt SDK ships usign, but the index/signing step runs on the
-# bare runner (outside the SDK container), so we build the tiny standalone tool
-# from source (no libubox — it is intentionally dependency-free so it can
-# bootstrap a build system). No-op if usign is already on PATH.
-#
-# Ported unchanged from Shater v0.1 (ci/install-usign.sh): usign is
-# format-agnostic and the signing story is identical for the v0.2 4-package feed.
-#
-# CI cache: a previously-built binary is reused from $USIGN_CACHE (default:
-# <repo>/.cache/tools — a workspace dir the workflow persists via actions/cache),
-# skipping the apt + cmake + clone + build (~1 min). After a fresh build the
-# binary is copied there so the NEXT run hits the cache. usign is a tiny static
-# helper with no versioned protocol — a stale cached binary cannot mis-sign.
-set -eu
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-TOOLS="${USIGN_CACHE:-$REPO_ROOT/.cache/tools}"
-
-# place <binary> — install onto PATH (system-wide if we can, else ~/bin)
-place() {
-  local SUDO=""; [ "$(id -u)" = 0 ] || SUDO="sudo"
-  if $SUDO install -m0755 "$1" /usr/local/bin/usign 2>/dev/null; then
-    :
-  else
-    mkdir -p "$HOME/bin"
-    install -m0755 "$1" "$HOME/bin/usign"
-    echo "$HOME/bin" >> "${GITHUB_PATH:-/dev/null}"
-    export PATH="$HOME/bin:$PATH"
-  fi
-}
-
-if command -v usign >/dev/null 2>&1; then
-  echo "[usign] already present: $(command -v usign)"
-  exit 0
-fi
-
-if [ -x "$TOOLS/usign" ]; then
-  place "$TOOLS/usign"
-  echo "[usign] restored from cache: $(command -v usign || echo "$HOME/bin/usign")"
-  exit 0
-fi
-
-SUDO=""; [ "$(id -u)" = 0 ] || SUDO="sudo"
-if ! command -v cmake >/dev/null 2>&1 || ! command -v cc >/dev/null 2>&1; then
-  $SUDO apt-get update -qq
-  $SUDO apt-get install -y -qq cmake gcc git
-fi
-
-tmp="$(mktemp -d)"
-# Canonical source; fall back to the GitHub mirror if git.openwrt.org is flaky.
-git clone --depth 1 https://git.openwrt.org/project/usign.git "$tmp/usign" \
-  || git clone --depth 1 https://github.com/openwrt/usign.git "$tmp/usign"
-( cd "$tmp/usign" && cmake -DCMAKE_BUILD_TYPE=Release . >/dev/null && make >/dev/null )
-
-place "$tmp/usign/usign"
-# seed the cache for the next run (best-effort)
-mkdir -p "$TOOLS" 2>/dev/null && install -m0755 "$tmp/usign/usign" "$TOOLS/usign" 2>/dev/null || true
-echo "[usign] built: $(command -v usign || echo "$HOME/bin/usign")"
@@ -1,39 +0,0 @@
-#!/bin/bash
-# Build the opkg feed index (Packages + Packages.gz) with SHA256 for a dir of
-# .ipk files, then optionally usign-sign it if $KEY_BUILD (the Gitea repo secret)
-# is set and usign is present. Arg $1 = feed dir.
-#
-# Ported from Shater v0.1 (ci/make-index.sh), unchanged. It is package-count and
-# package-name agnostic: it indexes whatever .ipk are in the dir, so it serves
-# BOTH the per-arch feed built by ci/build-feed.sh AND the combined release feed
-# assembled in the release job (shaterd + byedpi per-arch, shater-core +
-# luci-app-shater = _all). opkg filters by Architecture at install time, so one
-# combined URL serves every device.
-#
-# Feed format: opkg `src/gz` (.ipk + text Packages index, usign signature).
-# OpenWrt 24.10 (our SDK) still uses opkg; apk arrives at 25.12. The committed
-# trust anchor dist/shater-feed.pub is a usign (Ed25519) key, matching this.
-set -euo pipefail
-OUT="${1:?feed dir required}"; cd "$OUT"
-: > Packages
-for ipk in *.ipk; do
-  [ -e "$ipk" ] || continue
-  ctrl=$(tar -xzOf "$ipk" ./control.tar.gz | tar -xzO ./control)
-  sz=$(wc -c < "$ipk"); sha=$(sha256sum "$ipk" | cut -d' ' -f1)
-  printf '%s\n' "$ctrl" | sed '/^[[:space:]]*$/d' >> Packages
-  printf 'Filename: %s\nSize: %s\nSHA256sum: %s\n\n' "$ipk" "$sz" "$sha" >> Packages
-done
-gzip -kf Packages
-
-if [ -n "${KEY_BUILD:-}" ]; then
-  # Signing was requested — a missing/broken signer must FAIL the build, not
-  # silently ship an unsigned feed that routers with check_signature on reject.
-  command -v usign >/dev/null 2>&1 || { echo "[index] ERROR: KEY_BUILD set but usign not found" >&2; exit 1; }
-  umask 077; printf '%s\n' "$KEY_BUILD" > /tmp/usign.sec
-  usign -S -m Packages -s /tmp/usign.sec || { rm -f /tmp/usign.sec; echo "[index] ERROR: usign signing failed" >&2; exit 1; }
-  rm -f /tmp/usign.sec
-  echo "[index] signed -> Packages.sig ($(head -1 Packages.sig))"
-else
-  echo "[index] no KEY_BUILD -> UNSIGNED feed (opkg needs check_signature off, or set the secret)"
-fi
-echo "[index] contents:"; ls -l
@@ -10,7 +10,6 @@
 # the target fleet (BananaWRT 25.12-mtk-vendor = ImmortalWrt 25.12 base, its
 # distfeeds even point at downloads.immortalwrt.org/releases/25.12-SNAPSHOT) is
 # ImmortalWrt — so we extract the official ImmortalWrt SDK tarball ourselves.
-# Same --volumes-from workspace-sharing pattern as ci/sdk-build.sh (opkg lane).
 #
 # The OpenWrt buildsystem refuses to run as root, so the SDK build itself runs
 # as an unprivileged `build` user created here.
@@ -36,8 +35,8 @@ echo "[apk-sdk] package version: ${SHATER_PKG_VERSION:-<unset -> Makefile fallba
 test -f "$REPO/openwrt/shaterd/Makefile" || {
  echo "[apk-sdk] ERROR: feed not mounted ($REPO/openwrt/shaterd/Makefile missing)"; ls -la "$REPO" || true; exit 9; }

-# The prebuilt shaterd artifact must already be staged for this arch (same
-# contract as the opkg lane — scripts/build-shaterd.sh runs first).
+# The prebuilt shaterd artifact must already be staged for this arch
+# (artifact-order contract — scripts/build-shaterd.sh runs first).
 case "$ARCH" in
  x86_64)             sfx=amd64 ;;
  aarch64_cortex-a53) sfx=arm64 ;;
@@ -113,7 +112,7 @@ export HOME=/home/build
 cd "$SDKDIR"

 # Register this repo's openwrt/ as a src-link feed named `shater` (absolute
-# path required) — identical to the opkg lane (ci/sdk-build.sh).
+# path required).
 cp -f feeds.conf.default feeds.conf
 grep -q '^src-link shater ' feeds.conf || echo "src-link shater $REPO/openwrt" >> feeds.conf

@@ -1,143 +0,0 @@
-#!/bin/sh
-# Runs INSIDE an `openwrt/sdk:<target>-<ver>` container (CWD = SDK root
-# /builder). The job's workspace is shared into this container via
-# `docker run --volumes-from`, so the repo is visible at $REPO and output goes
-# to $OUT (a dir under the repo, hence also visible to the runner afterwards).
-#
-# Unlike Shater v0.1 (which compiled ONLY xrayctl in the SDK and hand-packed the
-# pure-data packages with tar), v0.2 builds ALL FOUR packages the canonical way,
-# via the SDK feed + `make package/<p>/compile`:
-#
-#   shaterd          prebuilt binary — Build/Compile only VALIDATES that
-#                    openwrt/shaterd/files/shaterd-<amd64|arm64>.upx was staged
-#                    by scripts/build-shaterd.sh on the runner BEFORE this ran.
-#                    (arch-specific .ipk: RSTRIP/STRIP disabled — packed ELF.)
-#   shater-core      PKGARCH=all data glue (procd init, sysctl, uci-defaults).
-#   luci-app-shater  PKGARCH=all LuCI thin launcher — its Makefile does
-#                    `include $(TOPDIR)/feeds/luci/luci.mk`, so the `luci` feed
-#                    MUST be updated first (that is what creates feeds/luci/luci.mk).
-#   byedpi           arch-specific C — the SDK cross-compiles ciadpi from the
-#                    upstream tarball (needs network for PKG_SOURCE_URL).
-#
-# Env (required): ARCH, REPO, OUT.
-set -eu
-ARCH="${ARCH:?ARCH env required}"
-REPO="${REPO:?REPO env required}"
-OUT="${OUT:?OUT env required}"
-mkdir -p "$OUT"
-
-echo "[sdk] arch=$ARCH repo=$REPO out=$OUT"
-# Package version, derived from the git tag by ci/version.sh and handed in by
-# ci/build-feed.sh. openwrt/{shaterd,shater-core,luci-app-shater}/Makefile read
-# these straight out of the environment ($(if $(SHATER_PKG_VERSION),...)); make
-# imports every environment variable as a variable, and it propagates through
-# `make package/<p>/compile`, the metadata dump and the sub-makes alike.
-# byedpi deliberately keeps its own upstream version (see its Makefile).
-echo "[sdk] package version: ${SHATER_PKG_VERSION:-<unset -> Makefile fallback>}-r${SHATER_PKG_RELEASE:-?}"
-test -f "$REPO/openwrt/shaterd/Makefile" || {
-  echo "[sdk] ERROR: feed not mounted ($REPO/openwrt/shaterd/Makefile missing)"; ls -la "$REPO" || true; exit 9; }
-
-# The prebuilt shaterd artifact must already be staged for this arch.
-case "$ARCH" in
-  x86_64)             sfx=amd64 ;;
-  aarch64_cortex-a53) sfx=arm64 ;;
-  *) echo "[sdk] ERROR: unsupported ARCH '$ARCH'"; exit 2 ;;
-esac
-test -f "$REPO/openwrt/shaterd/files/shaterd-$sfx.upx" || {
-  echo "[sdk] ERROR: openwrt/shaterd/files/shaterd-$sfx.upx not staged."
-  echo "        scripts/build-shaterd.sh must run on the runner before the SDK build."; exit 3; }
-
-# --- register this repo's openwrt/ as a src-link feed named `shater` ---------
-# src-link REQUIRES an absolute path; $REPO/openwrt is exactly a feed root (it
-# contains the 4 package dirs and nothing else that looks like a package).
-cp -f feeds.conf.default feeds.conf
-grep -q '^src-link shater ' feeds.conf || echo "src-link shater $REPO/openwrt" >> feeds.conf
-
-# Update metadata for ALL feeds: our `shater` feed + the SDK defaults (base,
-# luci, packages, routing, telephony). We need `luci` for feeds/luci/luci.mk and
-# `base`/`packages` for the runtime deps (kmod-nft-tproxy, kmod-nft-socket,
-# ip-full, rpcd, luci-base) to resolve.
-#
-# Persistent feeds checkouts: $FEEDS_CACHE (a workspace dir the runner restores
-# via actions/cache, shared into this container via --volumes-from) replaces
-# the SDK's ephemeral feeds/ dir, so `feeds update` git-fetches deltas instead
-# of re-cloning base+packages+luci every run (~7 min on the runner's slow
-# github.com link). Correctness-safe: update always checks out feeds.conf's
-# pinned revisions; if it ever fails on a cached checkout (e.g. a force-pushed
-# upstream), the cache is wiped and the update retried with fresh clones.
-if [ -n "${FEEDS_CACHE:-}" ] && mkdir -p "$FEEDS_CACHE" 2>/dev/null; then
-  rm -rf feeds
-  ln -s "$FEEDS_CACHE" feeds
-  echo "[sdk] feeds/ -> $FEEDS_CACHE (persistent cache)"
-fi
-echo "[sdk] feeds update -a"
-if ! ./scripts/feeds update -a; then
-  [ -L feeds ] || { echo "[sdk] ERROR: feeds update failed"; exit 8; }
-  echo "[sdk] WARNING: feeds update failed on cached checkouts — wiping cache, cloning fresh"
-  find "$FEEDS_CACHE" -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true
-  ./scripts/feeds update -a
-fi
-
-echo "[sdk] feeds install (prefer shater feed)"
-./scripts/feeds install -p shater shaterd shater-core byedpi luci-app-shater
-
-# Select our packages, then defconfig. `make package/<p>/compile` builds the
-# explicit target regardless, but selecting first makes deps visible to defconfig.
-for p in shaterd shater-core byedpi luci-app-shater; do
-  echo "CONFIG_PACKAGE_$p=m" >> .config
-done
-# Route source downloads through OpenWrt's fast CDN mirror FIRST — sourceware.org
-# (elfutils) and other upstreams intermittently stall mid-transfer, and curl's
-# --connect-timeout doesn't cover a stalled stream, so the SDK download hangs the
-# build. LOCALMIRROR is tried before each package's own PKG_SOURCE_URL. (lx CI)
-echo 'CONFIG_LOCALMIRROR="https://sources.cdn.openwrt.org"' >> .config
-# Persistent dl/ across runs: $DL_DIR is a workspace dir the runner restores via
-# actions/cache (see ci/build-feed.sh). Correctness-safe: the buildroot verifies
-# PKG_HASH on every file already in dl/ and re-downloads on mismatch, so a stale
-# cache can never leak a wrong source into the build.
-if [ -n "${DL_DIR:-}" ]; then
-  echo "CONFIG_DOWNLOAD_FOLDER=\"$DL_DIR\"" >> .config
-fi
-echo "[sdk] defconfig"
-make defconfig >/dev/null
-
-# --- compile the 4 packages --------------------------------------------------
-for p in shaterd shater-core byedpi luci-app-shater; do
-  echo "[sdk] === build $p ==="
-  make "package/$p/compile" V=s -j"$(nproc)"
-done
-
-# --- collect ONLY our 4 packages' .ipk (per-arch shaterd/byedpi + _all core/luci)
-# NOT `find bin -name '*.ipk'`: the openwrt/sdk image ships HUNDREDS of prebuilt
-# kmod/base .ipk under bin/, which a blanket copy would pull into the feed and
-# get signed under OUR key. Match each package's own `<name>_<ver>_<arch>.ipk`.
-found=0
-for p in shaterd shater-core byedpi luci-app-shater; do
-  for ipk in $(find bin -type f -name "${p}_*.ipk"); do
-    cp -f "$ipk" "$OUT/"; found=$((found+1))
-  done
-done
-[ "$found" -ge 4 ] || { echo "[sdk] ERROR: expected >=4 of OUR .ipk, collected $found"; echo "[sdk] (all .ipk under bin/:)"; find bin -type f -name '*.ipk' | head -20; exit 4; }
-
-# --- assert the tag-derived version actually reached the packages -------------
-# The whole point of B4 is that a WRONG-but-plausible version ships silently. The
-# env -> make hand-off has several layers (docker -e, make's env import, the
-# metadata dump), so verify the result instead of trusting it: every one of our
-# three tag-versioned packages must be named `<name>_<ver>-r<rel>_<arch>.ipk`.
-# byedpi is excluded on purpose — it keeps upstream ByeDPI's own version.
-if [ -n "${SHATER_PKG_VERSION:-}" ] && [ -n "${SHATER_PKG_RELEASE:-}" ]; then
-  want="${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
-  for p in shaterd shater-core luci-app-shater; do
-    ls "$OUT/${p}_${want}_"*.ipk >/dev/null 2>&1 || {
-      echo "[sdk] ERROR: $p was not built as version '$want'."
-      echo "        SHATER_PKG_VERSION/SHATER_PKG_RELEASE did not reach the package"
-      echo "        Makefile — the build would have shipped a stale version (bug B4)."
-      echo "[sdk] collected:"; ls -1 "$OUT" | sed 's/^/          /'
-      exit 12; }
-  done
-  echo "[sdk] version check OK — our 3 packages are $want"
-fi
-
-chmod -R a+rwX "$OUT" 2>/dev/null || true
-echo "[sdk] OK arch=$ARCH — collected $found of our .ipk:"
-ls -l "$OUT"
@@ -6,9 +6,9 @@
 # PKG_VERSION/PKG_RELEASE used to be hand-written literals in the four package
 # Makefiles, and nobody remembered to bump them: v0.2.2 … v0.2.6 all shipped as
 # `shaterd 0.2.0-r3` with DIFFERENT binaries inside (v0.2.6's ELF is 5 491 616 B
-# vs r2's 5 488 336 B). Since both opkg and apk offer an upgrade only when the
-# feed's version string differs from the installed one, `apk update` saw nothing
-# new and the routers could not be updated through the normal path at all.
+# vs r2's 5 488 336 B). Since apk offers an upgrade only when the feed's version
+# string differs from the installed one, `apk update` saw nothing new and the
+# routers could not be updated through the normal path at all.
 #
 # So the version is now DERIVED, in CI, from the git tag, and the package
 # Makefiles only carry a fallback for manual/offline builds.
@@ -21,14 +21,12 @@
 #    rolling `latest`)
 #   no tag / no git at all   -> PKG_VERSION=0.0.0   PKG_RELEASE=1  (+ warning)
 #
-# Both managers compare `<upstream>-r<rel>` the same way: the dotted upstream
-# part first (numerically, component by component), the `r<rel>` only as a
-# tie-break. Verified against the real tools, not from memory:
-#   apk-tools 3.0.3 (`apk version -t`) and apk-tools 2.14.6:
+# apk compares `<upstream>-r<rel>` as: the dotted upstream part first
+# (numerically, component by component), the `r<rel>` only as a tie-break.
+# Verified against the real tool, not from memory —
+# apk-tools 3.0.3 (`apk version -t`) and apk-tools 2.14.6:
 #       0.2.6-r1  > 0.2.0-r3      0.2.6-r12 > 0.2.6-r1
 #       0.2.7-r1  > 0.2.6-r12     0.0.0-r1  < 0.2.0-r3
-#   opkg 38eccbb1 from openwrt/rootfs:x86-64-24.10.4 (`opkg compare-versions`):
-#       identical results (opkg implements the Debian algorithm).
 # That is exactly the ordering this scheme needs:
 #   * a release always outranks every rolling build that preceded it
 #     (0.2.7-r1 > 0.2.6-rN for any N — the dotted part decides), and
@@ -1,2 +0,0 @@
-untrusted comment: shater feed signing key
-RWRaxLF3aJy44JbcxSFujtrFFEQ8lIsnTkd1K5TdjIhdlC2c0wa0fv4V
@@ -31,12 +31,11 @@ Do not delete it — we port proven pieces from it. What v0.1 has:
 - **`luci-app-shater`** — a custom "instrument panel" LuCI app (client-side JS +
  ucode/rpcd ubus backend): Overview with a live Signal Path, Simple/Advanced
  toggle, quick-start wizard, Nodes/Subs/Rules/DNS/Live/Profiles/Settings pages.
- **CI + signed opkg feed** on Gitea: builds per-arch, signs the feed index with
-  usign, publishes a rolling `latest` Gitea release consumable as `src/gz`. **Feed
-  signing key fingerprint `5ac4b177689cb8e0`**; public key `dist/shater-feed.pub`,
-  secret in the Gitea repo secret `KEY_BUILD`.
+- **CI + a signed package feed** on Gitea: builds per-arch, signs the feed index,
+  publishes a rolling `latest` Gitea release the router consumes as a feed.
+  (v0.1 shipped `.ipk` signed with a usign key — that lane is retired, D22.)
 - Verified end-to-end on the VM: real LAN client proxied, DNS anti-leak, honest
-  fail-closed, opkg install/upgrade from the signed feed.
+  fail-closed, install/upgrade from the signed feed.

 v0.1 is engine-locked to **xray-core**; its generator, share-link parser and
 `run.json` are xray-shaped.
@@ -91,7 +90,7 @@ We are rebasing onto a new engine and a new UI architecture. Full rationale in
 - **`shater` branch `v0.1`** = the standalone xray-based version (frozen, ported
  from).
 - Until Phase 1 merges the engine in, `main` is the docs-first overlay seed you
-  are reading now (LICENSE, README, `docs-shater/`, `dist/shater-feed.pub`).
+  are reading now (LICENSE, README, `docs-shater/`, the feed signing key).

 ## What to port from v0.1 (don't rewrite these ideas)

@@ -105,8 +104,8 @@ overlay, don't redo:
 - **Subscription fetch** (HAPP emulation, fingerprint reconcile, per-sub cache)
  and the flexible **ruleset/list** model — though sing-box has its own share-link
  parser and config schema we now target.
- **CI feed build + usign signing + Gitea release** (adapt to the single forked
-  binary; keep key `5ac4b177689cb8e0`).
+- **CI feed build + index signing + Gitea release** (adapted to the single forked
+  binary; the format is apk, signed with the EC key — D22).
 - The LuCI **design system** (the "instrument panel" identity) — reused for the
  mini-dashboard and as the panel's visual language.

@@ -122,9 +121,9 @@ filter/stats engine wired into sing-box's DNS.
  `https://github.com/SagerNet/sing-box`).
 - **CI:** Gitea Actions (act_runner + Docker). v0.1's workflow was removed from
  `main`; new CI is added when the v0.2 build exists.
- **Feed signing:** usign key `5ac4b177689cb8e0`; secret in repo secret
-  `KEY_BUILD`; public key `dist/shater-feed.pub` (kept so existing installs keep
-  verifying).
+- **Feed signing:** EC (prime256v1) key for the apk index; secret in the repo
+  secret `KEY_APK`; public key `dist/shater-apk.pem`, installed on routers as
+  `/etc/apk/keys/shater-apk.pem`. Never regenerate it (D22).
 - **Test VM:** OpenWrt 24.10.3 x86_64 in Docker (`docker ps --filter
  name=openwrt-vm`). SSH via the ssh-manager MCP server `local_openwrt`
  (localhost:2222, root/openwrt). LuCI at `http://127.0.0.1:8080` (root/openwrt),
@@ -64,11 +64,17 @@ sing-box is GPL-3.0; linking it makes the combined work GPL-3.0. Our own files m
 stay GPL-2.0-or-later (which permits the upgrade), but the project LICENSE is
 GPL-3.0 for clarity.

-## D7 — Keep the v0.1 feed signing identity
+## D7 — Keep the v0.1 feed signing identity  *(SUPERSEDED by D22)*
 The usign feed key `5ac4b177689cb8e0` (public key in `dist/shater-feed.pub`,
 secret in Gitea secret `KEY_BUILD`) carries over, so routers that already trust it
 keep verifying v0.2 packages. Do not regenerate it without a documented rotation.

+> **Superseded 2026-07-25 (D22).** The opkg feed this identity signed no longer
+> exists, so there is nothing left for the key to verify. It was never rotated or
+> compromised — it is simply unused. `dist/shater-feed.pub` was deleted from the
+> tree; the reasoning, and how to resurrect the identity if it is ever needed
+> again, is in D22.
+
 ## D8 — Preserve, don't destroy: v0.1 lives on its branch
 The reset moved the full working xray-based project to the `v0.1` branch and
 cleaned `main`. Nothing is lost; reusable logic (reliability layer, nft/routing,
@@ -95,6 +101,10 @@ runtime, forcing an ELF with `PT_INTERP=/lib64/ld-linux-x86-64.so.2` + `PT_DYNAM
  plane is tproxy/redirect (netplane); generate never emits a tun inbound, so
  the userspace gvisor netstack (~3.6 MB) is unreachable. If a tun inbound ever
  appears it falls back to the system stack — re-add the tag then.
+  **REVERTED 2026-07-25 — that reasoning was wrong and shipped a dead feature.**
+  gVisor is not only the tun stack: it is the netstack of the **WireGuard
+  endpoint**, which we do emit and do declare [MVP]. See D23; the tag is back and
+  is now held there by a test.
 - 2026-07-23: `with_clash_api` also dropped. The admin panel is shater's own
  web server and generate never emits a `clash_api` service; the desktop/CLI
  `LX_TAGS` keeps the tag for external dashboards.
@@ -424,3 +434,235 @@ on the next render.
 Consequence: all delay numbers are comparable (least ping ranks apples against
 apples), and group settings lose two footgun fields while Settings keeps the
 two that actually govern every check.
+
+## D21 — A rule's destination is a rule-set, and nothing else
+Decided 2026-07-25 (product owner). `config rule` carried THREE ways to say
+where traffic is going: `dst_domain` (an inline domain list), `dst_ip` (an inline
+CIDR list) and `dst_ruleset` (a reference to a `config ruleset`). Three
+mechanisms meant three sets of semantics to learn and keep straight, and the
+inline ones were the worse half of the trade: they are re-parsed per rule instead
+of being compiled once into a `.srs`, they cannot be shared between rules, and
+their matcher vocabulary had drifted from the rule-set one in a way nobody could
+see (below).
+
+**Decision: `dst_domain` and `dst_ip` are removed (schema v2). `dst_ruleset` is
+the only destination matcher.** `Src`, `dst_port` and `proto` are untouched —
+they are not lists of destinations and have no rule-set form.
+
+- **Rejected: keep the inline lists as a shorthand.** "One obvious way" is the
+  whole point; a shorthand that quietly means something different from the long
+  form (see the bare-entry trap) is worse than no shorthand.
+- **Rejected: promote inline lists to rule-sets lazily at generate time.** The
+  config on disk would then not say what the router does, and the panel would
+  have to render a list the user cannot find or edit.
+
+### The bare-entry trap, and how the migration handles it
+The two contexts already disagreed about exactly one spelling, silently:
+
+| entry              | in a rule (`dst_domain`) | in a rule-set (`entry`) | migrated to  |
+|--------------------|--------------------------|-------------------------|--------------|
+| `example.com`      | **exact host**           | **host + subdomains**   | `full:example.com` |
+| `full:example.com` | exact host               | exact host              | unchanged    |
+| `suffix:example.com` / `.example.com` | host + subdomains | host + subdomains | unchanged |
+| `keyword:ads`      | substring                | substring               | unchanged    |
+| `regexp:^ads\.`    | pattern                  | pattern *(added here)*  | unchanged    |
+| `geosite:x` / `geoip:x` | inert (engine field removed) | inert (unknown prefix) | unchanged |
+
+`shaterd migrate` (schema v1→v2, `shater/model/migrate.go`) creates one inline
+`config ruleset` per rule that still carries a legacy list — `rule-<rule name>`
+for domains, `rule-<rule name>-ip` for addresses — moves the entries across with
+the conversion above, appends the new name to `dst_ruleset`, and deletes the old
+option. It is idempotent, it resumes an interrupted run, and it never overwrites
+a hand-written rule-set that already owns the generated name (it picks
+`rule-<name>-2`). `regexp:` support was added to inline rule-sets in the same
+change precisely so the move can be lossless.
+
+`geosite:`/`geoip:` entries are copied VERBATIM rather than promoted to a
+`source=geosite` rule-set: those matchers have been inert since the engine
+dropped the route-rule geosite/geoip fields, and turning a dead matcher live
+during an upgrade would be a behaviour change, not a migration. The text is kept
+so the operator can see it and convert it deliberately.
+
+**One deliberate semantic change, called out:** a rule that used BOTH lists
+matched them with AND (an engine route rule ANDs its matcher fields), which is
+almost never what "these sites and these networks" meant. The two generated
+rule-sets are ORed, because `rule_set: [a, b]` matches when either matches. Such
+a rule matches more after the migration than before; it affects only configs that
+used both fields at once.
+
+That AND→OR change is about the ENGINE's TCP/UDP path, and it deliberately does
+**not** extend to the untunnelable-protocol plane (`shater/apply/untunnelable.go`,
+the ping / IPTV / VPN-passthrough policy in nftables). There, a v1
+`dst_domain + dst_ip` rule could never claim a packet that carries no domain, so
+the plan skipped it; reading the migrated form as OR would have made the address
+half suddenly decisive, and with `target=direct` that means an upgrade quietly
+sending previously-tunnelled ICMP out with the client's real source address. A
+rule whose rule-sets are known to match by NAME is therefore still skipped by that
+plan, and the skip is reported ("a routing rule matches by name … as well as by
+address"). Split the rule in two if you want the addresses decided there.
+
+### The vocabulary is about ENTRIES YOU TYPE, not about every list body
+The table above is the vocabulary of an **inline** rule-set's `entry` values (and
+of the DNS-filter/device lists, which share the classifier). The other two rule-set
+sources are not other spellings of it:
+
+| source                       | what it is                       | vocabulary |
+|------------------------------|----------------------------------|------------|
+| `inline`                     | entries you type                 | the table above |
+| `url` → `.srs` / `.json`     | a compiled rule-set, engine-owned | the engine's, not ours |
+| `url` → anything else        | a hosts / one-domain-per-line / AdBlock TEXT FILE | **none** — every line is a domain plus its subdomains |
+| `file`                       | a local `.srs` / `.json`          | the engine's, not ours |
+
+**Rejected: run text lists through the entry classifier too.** A published
+AdGuard/OISD list is full of colon-bearing tokens that are ordinary filter syntax
+(`##…:has(…)`, `$domain=`, absolute URLs); classifying them would either mis-import
+them or bury the operator under hundreds of "unrecognised prefix" warnings per
+list. The formats also disagree structurally — a hosts line carries several names,
+so the text parser works per token, while an entry is a whole line. And `regexp:`
+arriving from a third-party URL is a pattern compiled into the router's matcher and
+evaluated per query, which is a very different proposition from one the operator
+typed.
+
+So the difference stands and is paid for in diagnostics instead: a text list
+containing `full:` / `suffix:` / `keyword:` / `regexp:` is reported per list, on
+every generate, naming the entries and pointing at `source=inline` where they work
+(`warnListEntryVocabulary`, `shater/generate/ruleset.go`). The check tests only
+those four markers, never the general `word:` shape, so it fires on a human's
+mistake and stays quiet on published filter syntax.
+
+Consequence: one destination mechanism, one vocabulary, one place a list is
+edited; every list is compiled once and reused. The panel's rule editor drops its
+Domain(s) and IP/CIDR(s) fields; its destination control is a checkbox list of
+the rulesets that already exist, and nothing more. Creating and filling a list
+stays in the Rulesets panel — **rejected: a "create a list from here" shortcut in
+the rule editor**, because a second place to author a list is a second place for
+its semantics and its duplicate-name rules to drift, and the whole point of this
+decision was to stop having two.
+
+## D22 — One packaging lane: apk. The opkg/`.ipk` lane is deleted, not disabled
+Decided 2026-07-25 (product owner). CI built and published TWO signed feeds from
+every run: opkg/usign (`.ipk` + `Packages.gz`, OpenWrt 24.10) and apk/EC (`.apk` +
+`packages.adb`, OpenWrt/ImmortalWrt 25.12). The opkg half served nobody. Checked
+on the actual hardware, not inferred:
+
+| Device | Firmware | pkg arch | package manager |
+|---|---|---|---|
+| `mini_router` (BPi-R3 Mini) | ImmortalWrt 25.12.1 | `aarch64_cortex-a53` | apk-tools 3.0.5 |
+| `main_router` (BPi-R4)      | OpenWrt 25.12.0     | `aarch64_cortex-a53` | apk-tools 3.0.5 — **no `opkg` binary on the system at all** |
+
+**Decision: delete the opkg lane outright.** Removed: the `build` + `release`
+jobs from `.gitea/workflows/release.yml`; `ci/build-feed.sh`, `ci/sdk-build.sh`,
+`ci/make-index.sh`, `ci/install-usign.sh`; and the trust anchor
+`dist/shater-feed.pub`. The Gitea secret `KEY_BUILD` is now referenced by
+nothing and can be deleted from the repo settings. `ci/version.sh`,
+`ci/gitea-release.sh` and `ci/fetch-sdk.sh` are shared or apk-only and stay.
+
+- **Rejected: keep the lane but stop triggering it** (comment it out / gate it on
+  a dispatch input). Dead code in CI is worse than no code: it keeps a second SDK
+  matrix, a second signing key and a second feed layout alive in everyone's head
+  and in every future edit, and it silently rots because nothing runs it. The
+  24.10 SDK images it pins are themselves a frozen dependency.
+- **Rejected: keep `dist/shater-feed.pub` as a historical artifact.** A committed
+  trust anchor is an instruction — it invites someone to follow the old install
+  path for a feed that is no longer produced. Nothing is lost by removing it:
+  git history still holds the file, the SECRET half is untouched in `KEY_BUILD`,
+  and a usign secret key blob contains its own public half, so the identity can
+  be reconstructed if a 24.10 device ever has to be served again. Deleting the
+  file is reversible; a stale trust anchor pointing at an unmaintained feed is
+  the thing that quietly misleads.
+- **Not done: revoking or rotating the usign key.** There is no incident. It is
+  retired, not burned (D7).
+
+Consequence: one SDK, one key, one feed layout, one set of install instructions.
+It also makes the rolling release `apk-latest-<arch>` the *only* install path
+that does not require hand-editing a file per release — which is why the same
+change fixed it: publishing was an either/or (`apk-latest-<arch>` on dispatch,
+ELSE `apk-vX.Y.Z-<arch>` on a tag), so once releases moved to tag pushes the
+rolling pointer stopped being written and froze at `0.2.0` while v0.2.9/v0.2.10
+shipped — routers on the rolling URL got a successful, silent `apk update` with
+nothing new. `release-apk` now writes the rolling pointer on every run and
+asserts, by reading the published release back over the Gitea API, that it holds
+our three tag-versioned packages at exactly the version just built and no asset
+at any other version.
+
+
+## D23 — The router tag set is a checked contract, not a string literal
+`with_gvisor` was trimmed from the router set on 2026-07-23 (D9) as "unreachable
+code: we never emit a tun inbound". True about tun — and irrelevant, because
+gVisor is also the netstack of the **WireGuard endpoint**, which shater emits and
+FEATURES.md declares [MVP] (AmneziaWG is called *"a driving requirement"*). Every
+binary shipped between then and 2026-07-25 answered a configured WireGuard node
+with:
+
+```
+create instance: initialize endpoint[0]: create WireGuard device:
+gVisor is not included in this build, rebuild with -tags with_gvisor
+```
+
+`transport/wireguard/device_stack_stub.go` (`//go:build !with_gvisor`) returns
+`tun.ErrGVisorNotIncluded` from **both** device constructors, so
+`system_interface: true` is not an escape hatch either: WireGuard was 100% dead
+in the shipped artifact while the panel offered it, the parser accepted `wg://`,
+`awg://` and wg-quick `.conf` imports, and the owner had 7 WireGuard sections in
+UCI on a production router.
+
+- **Decision:** `with_gvisor` is part of the router tag set and stays there for
+  as long as we ship WireGuard. It costs **~2.8 MB raw / ~0.65 MB UPX per arch**
+  (measured 2026-07-25, both arches; `/overlay` on the production router is
+  6.9 GB with 205 MB used). A tag whose absence turns a declared feature into a
+  runtime error is not "dead weight" — it is the feature.
+
+### Why the bug was invisible, and what now makes it visible
+The defect was not a typo in a tag list. It was that **nothing connected the tag
+list to the feature list**, and the shipped tag combination was the one build
+configuration nothing exercised: the whole test suite compiles with the FULL
+upstream set (`with_gvisor` included), so `TestAmneziaWGEndpoint` passed happily
+while the artifact it was supposed to vouch for could not create a WireGuard
+device. Tests proved the code was right; they never proved the *build* was.
+
+Three pieces now hold it together:
+
+1. **One definition of the set** — `scripts/router-tags.sh` (`SHATER_ROUTER_TAGS`
+   + `SHATER_ROUTER_LDFLAGS`), sourced by `scripts/build-shaterd.sh` and by the
+   checker. The tag list used to live as a literal inside the build script, i.e.
+   in a file no test reads. A second copy is a second truth.
+2. **A declared-feature table** — `shater/buildtags`: every tag-gated capability
+   we promise, with the exact tags it needs *to run* and why (the code anchor).
+   `TestRouterTagSetCoversDeclaredFeatures` parses the shell file and fails if a
+   declared feature lost a tag. It needs no build tags, no Linux, no network and
+   no privileges, so it runs in every plain `go test ./...` — including on the
+   Windows dev host, where nothing else can see the shipped configuration.
+3. **A construction test under the shipped tags** —
+   `shater/generate.TestShippedTagSetConstructsDeclaredProtocols` drives one node
+   of every declared protocol (ss/vmess/trojan/vless ws-grpc-httpupgrade-quic-
+   xhttp/REALITY/uTLS-fp/hysteria2/tuic/**wg**/**awg**) through `box.New`+`Start`.
+   `scripts/check-router-tags.sh` runs it **with `SHATER_ROUTER_TAGS`**, and CI
+   runs that script (`.gitea/workflows/release.yml`) *before* the artifact is
+   built. In a router-tag-set run nothing may be skipped: a protocol that is not
+   compiled in fails the run instead of quietly disappearing from it.
+
+(2) catches a trim the moment it is made and names the feature it kills; (3)
+catches what a list comparison cannot — a tag that is present but insufficient.
+Neither is a substitute for the other. A new protocol in `shater/parse` +
+`shater/generate` means a new row in `buildtags.Features` and a new probe case;
+`TestEveryTagGatedFeatureIsProbed` fails until both exist.
+
+- **Rejected: "just add the tag".** The one-line fix restores WireGuard and
+  leaves the mechanism that hid it fully intact — the next size-driven trim is
+  equally invisible. The tag is the smallest part of this decision.
+- **Rejected: run the WHOLE test suite with the router tag set in CI.** It is the
+  obvious move and it does not work: parts of the suite legitimately depend on
+  upstream-only tags, and the run costs a second full compile of a 25 MB binary's
+  worth of packages on every release. A focused, unprivileged construction test
+  buys the same evidence for ~10 s and, unlike a full run, can be *required* to
+  skip nothing.
+- **Rejected: assert the tag set against upstream's `DEFAULT_BUILD_TAGS`.** That
+  makes any trim a failure, which turns the check into noise and re-litigates D9
+  on every upstream rebase. The contract is with our own feature list, not with
+  upstream's.
+- **Not done: dropping `with_lx_command`.** It is inert for `shaterd` — nothing
+  under `shater/` imports `sing-box/daemon` or `experimental/libbox`, and
+  `go list -deps ./shater/cmd/shaterd` links neither, so it costs zero bytes. It
+  stays only so the router set remains a subset of the lx desktop set. Noted
+  because "a tag that buys nothing" is the mirror image of this bug and should be
+  removed deliberately, not silently.
@@ -13,8 +13,12 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
 - **[MVP]** TPROXY transparent proxy for multiple LAN interfaces (TCP + UDP), SNI/
  Host/QUIC sniffing.
 - **[MVP]** First-match routing rules by source (IP/CIDR/MAC/interface/zone),
-  destination (domain/suffix/keyword/geosite), reusable domain/IP lists, port,
-  proto → target (outbound/selector/chain/direct/block) + egress.
+  destination, port, proto → target (outbound/selector/chain/direct/block) + egress.
+  A rule names its **destination through a rule-set only** — a reusable named list
+  (inline domains/CIDRs, a local or remote file, or a geosite/geoip category) that is
+  compiled once into a `.srs` and shared by every rule that references it. Domain
+  entries take `full:` (exact), `suffix:` / a leading dot (host + subdomains),
+  `keyword:` (substring) and `regexp:`; a bare entry means host + subdomains.
 - **[MVP]** Node groups with balancer/observatory (least-ping/failover/round-robin).
 - **[T1]** Multi-hop chains (L1→Ln); per-rule egress selection; egress via any
  interface/tunnel (e.g. an AmneziaWG tunnel).
@@ -89,8 +93,8 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
  SIM uplink → different egress); backup/restore; i18n (EN + RU).

 ## Ops & distribution
- **[MVP]** Single signed binary; signed opkg feed on Gitea (reuse key
-  `5ac4b177689cb8e0`); one-line install; `opkg upgrade`.
+- **[MVP]** Single signed binary; signed apk feed on Gitea (EC key
+  `dist/shater-apk.pem`); one-line install; named-package `apk upgrade`.
 - **[T1]** Upstream-rebase cadence (track sing-box-lx tags) with a smoke suite.
- **[T2]** apk (OpenWrt 25.x) packaging; multi-router fleet management; REST/gRPC
-  external API; Telegram bot.
+- **[T2]** Multi-router fleet management; REST/gRPC external API; Telegram bot.
+  (apk packaging landed and is now the only lane — D22.)
@@ -1,7 +1,7 @@
 # Shater v0.2 — Build & Install

 How to build the ship artifact (the SPA-embedded `shaterd` binary) and install
-the OpenWrt feed onto a router.
+the signed apk repo onto a router.

 ## 1. Build the `shaterd` binary

@@ -28,7 +28,7 @@ Arg / env:
 - `VERSION` — stamped into `constant.Version`. Resolution: positional arg →
  `$SHATER_VERSION` → `ci/version.sh --binary` → `v0.2.0-dev`. `ci/version.sh` is
  the **same** computation the package version comes from (§2.1), so the string
-  the panel shows always matches what `apk info shaterd` / `opkg status` report.
+  the panel shows always matches what `apk list -I shaterd` reports.
 - `--fast` — skip `npm ci` when `panel/node_modules` already exists.
 - `UPX=/path/to/upx` — override the UPX binary (default `upx` on `PATH`). UPX is
  cross-arch, so one host packs both the amd64 and aarch64 ELFs. (Note: UPX also
@@ -43,22 +43,44 @@ UPX="…/scratchpad/upx-4.2.4-win64/upx.exe" scripts/build-shaterd.sh v0.2.0 --f
 The `dist/*` and `openwrt/shaterd/files/shaterd-*.upx` outputs are gitignored —
 they are release artifacts, not source.

-Tag set (D9 — keep in sync with `docs-shater/DECISIONS.md`):
+Tag set (D9/D23) — defined in **one** place, `scripts/router-tags.sh`, which
+documents every tag and is sourced by the build:

 ```
-with_quic,with_wireguard,with_utls,
+with_gvisor,with_quic,with_wireguard,with_utls,
 badlinkname,tfogo_checklinkname0,with_xhttp,with_awg,with_lx_command
 ```

 We drop `with_purego,with_naive_outbound`: they pull cronet-go, which forces a
 glibc `PT_INTERP` even under `CGO_ENABLED=0`, making the binary unusable on musl.
-We drop `with_gvisor`: the shater data plane is tproxy/redirect and generate
-never emits a tun inbound, so the userspace gvisor netstack is unreachable code.
 We drop `with_clash_api`: the admin panel is shater's own web server and the
 generator never emits a `clash_api` service, so the Clash server is dead code.
 We drop `with_dhcp`: shater resolver types are `udp/tcp/doh/dot/local/fakeip`;
 a `dhcp://` DNS transport is never generated or registered.

+`with_gvisor` was dropped in 2026-07 as "unreachable — we emit no tun inbound"
+and **put back on 2026-07-25**: gVisor is also the netstack of the WireGuard
+endpoint, so without it every `wg://`/`awg://` node died at apply time with
+*"gVisor is not included in this build"* while the panel still offered the
+feature. It costs ~2.8 MB raw / ~0.65 MB UPX per arch. Full story: `DECISIONS.md`
+D23.
+
+### Changing the tag set
+
+Run the guard — it is what stands between a size trim and a silently dead
+feature, and CI runs it before the artifact is built:
+
+```sh
+scripts/check-router-tags.sh     # from Windows/macOS it re-execs itself in golang:1.26
+```
+
+It (1) fails if a feature declared in `FEATURES.md` lost a build tag it needs to
+run (`shater/buildtags`, no tags/OS/network required) and (2) constructs one node
+of every declared protocol through `box.New` **compiled with the shipped tag
+set** — nothing may be skipped in that run. Adding a protocol to
+`shater/parse`+`shater/generate` means adding a row to `buildtags.Features` and a
+probe case in `shater/generate/shipped_tags_linux_test.go`.
+
 ## 2. Packages

 Four OpenWrt packages live under `openwrt/`:
@@ -91,9 +113,9 @@ See `openwrt-package-build-ci` for SDK/feed mechanics.
 `PKG_VERSION`/`PKG_RELEASE` are **not** maintained by hand. They used to be, and
 nobody bumped them: **v0.2.2 … v0.2.6 all shipped as `shaterd 0.2.0-r3`** with
 different binaries inside (v0.2.6's ELF is 5 491 616 B against r2's 5 488 336 B).
-Both package managers offer an upgrade only when the feed's version string
-differs from the installed one, so `apk update` saw nothing new and the routers
-could not be updated through the normal path at all.
+apk offers an upgrade only when the feed's version string differs from the
+installed one, so `apk update` saw nothing new and the routers could not be
+updated through the normal path at all.

 `ci/version.sh` now derives them from `git describe`, once per CI job:

@@ -103,9 +125,8 @@ could not be updated through the normal path at all.
 | dispatch, 3 commits past `v0.2.7` | `0.2.7` | `4` | `v0.2.7-r4-g<sha>` |
 | no reachable tag / no git     | `0.0.0` | `1` | `v0.0.0-r1` |

-Ordering is what makes this safe, and both managers agree on it (checked with
-`apk version -t` on apk-tools 3.0.3 and `opkg compare-versions` on opkg
-38eccbb1): the dotted part decides first, `-rN` only breaks ties — so
+Ordering is what makes this safe (checked with `apk version -t` on apk-tools
+3.0.3): the dotted part decides first, `-rN` only breaks ties — so
 `0.2.7-r1 > 0.2.6-r12 > 0.2.6-r1 > 0.2.0-r3`. A release therefore always
 outranks every rolling build before it, rolling builds between two releases grow
 monotonically, and an untagged build (`0.0.0`) can never masquerade as an
@@ -113,8 +134,9 @@ upgrade.

 The value travels as `SHATER_PKG_VERSION`/`SHATER_PKG_RELEASE` in the SDK build
 environment; the Makefiles read it with a literal fallback for manual/offline
-builds. Both lanes then **assert** the produced `.ipk`/`.apk` really carries it,
-so a lost variable fails the build instead of shipping a stale version.
+builds. `ci/sdk-build-apk.sh` then **asserts** the produced `.apk` really carries
+it, so a lost variable fails the build instead of shipping a stale version. The
+release job asserts the same version again on the published rolling repo (§5.1).

 `byedpi` is deliberately excluded — `PKG_VERSION:=0.17.3` is *upstream ByeDPI's*
 version, which is what `PKG_HASH` pins and what tells you which ByeDPI is
@@ -124,21 +146,27 @@ when our packaging of it changes.

 ## 3. Install on a router

-Install order follows the deps (`shaterd` → `shater-core` → `luci-app-shater`):
+**The normal path is the signed apk repo — §5.** This section is the manual
+fallback (a router with no route to the Gitea host, or a hand-carried build).
+
+Install order follows the deps (`shaterd` → `shater-core` → `luci-app-shater`).
+apk filenames carry no architecture, so make sure you copied the `.apk` built for
+*this* router's arch (`cat /etc/apk/arch`):

 ```sh
 # <ver> = the release version, e.g. 0.2.7-r1 (§2.1 — it comes from the git tag)
-opkg install shaterd_<ver>_<arch>.ipk          # or: apk add shaterd   (25.12+)
-opkg install shater-core_<ver>_all.ipk
-opkg install luci-app-shater_<ver>_all.ipk
-opkg install byedpi_0.17.3-r1_<arch>.ipk       # optional: ByeDPI egress
+# --allow-untrusted: our member .apk are unsigned by design — trust lives in the
+# signed packages.adb index (§5), which a loose file install does not consult.
+apk add --allow-untrusted ./shaterd-<ver>.apk
+apk add --allow-untrusted ./shater-core-<ver>.apk
+apk add --allow-untrusted ./luci-app-shater-<ver>.apk
+apk add --allow-untrusted ./byedpi-0.17.3-r1.apk       # optional: ByeDPI egress
 ```

-Installing from a signed feed instead:
+From the repo instead (§5 sets it up once), deps pull the rest in:

 ```sh
-# add the feed (customfeeds.conf / apk repositories), then:
-opkg update && opkg install shater-core luci-app-shater   # shaterd pulled in as a dep
+apk update && apk add luci-app-shater      # -> shater-core -> shaterd
 ```

 ## 4. Enable
@@ -158,92 +186,55 @@ daemon (`shaterd run`), which owns the engine, the `inet shater` data plane, pol
 routing, in-process DNS, and the admin panel (default `:8088`). The LuCI app's
 "Open panel" button mints a single-use token and hands the browser off to the panel.

-## 5. Add the signed feed (recommended — then `opkg upgrade` just works)
+## 5. The signed apk repo (the normal install path)

-CI (`.gitea/workflows/release.yml`) publishes every build as a **rolling `latest`
-Gitea release** that is itself a signed opkg `src/gz` feed: the release holds the
-`.ipk` for all arches, a `Packages`/`Packages.gz` index, a usign `Packages.sig`,
-and the public key `shater-feed.pub`. opkg filters by `Architecture`, so the **same
-two lines work on every device** (x86 testbed picks `x86_64 + all`; the BPI routers
-pick `aarch64_cortex-a53 + all`).
+OpenWrt/ImmortalWrt **25.12** packages with Alpine's **apk**: `.apk` files, a
+binary `packages.adb` index, EC (prime256v1) keys in `/etc/apk/keys/`, and
+effectively mandatory signatures (unsigned needs `--allow-untrusted`). This is
+the only format shater publishes — the `.ipk`/opkg lane was removed in 2026-07
+(`DECISIONS.md` D22); every device we serve is on 25.12 with apk-tools 3.

-> **Format:** OpenWrt 24.10 (our SDK) uses **opkg** (`.ipk`, `Packages.gz`, usign),
-> so the feed is `src/gz` and the trust anchor is the usign key
-> `dist/shater-feed.pub` (fingerprint **`5ac4b177689cb8e0`**). apk only replaces
-> opkg at OpenWrt **25.12** — see §6.
-
-One-time setup on the router:
-
-```sh
-# 1) trust the feed key — the FILENAME must equal the usign key fingerprint.
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-
-# 2) add the feed (one URL serves every arch).
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-
-# 3) refresh + install (shaterd is pulled in as a dependency).
-opkg update
-opkg install luci-app-shater        # -> shater-core -> shaterd
-opkg install byedpi                 # optional: ByeDPI desync egress
-```
-
-With the key installed, opkg's default `check_signature 1` verifies the feed on
-every `opkg update`; no `--nocheck-signature` needed. A **tagged** release
-(`vX.Y.Z`) publishes the identical layout at
-`.../releases/download/vX.Y.Z` if you prefer to pin a version instead of tracking
-`latest`.
-
-### Updating
-
-Name the packages. **Never run a bare `opkg upgrade`** — with no arguments it
-tries to upgrade *every* installed package from *every* configured feed, which on
-OpenWrt means base/system packages on the overlay and is a well-known way to
-brick a router.
-
-```sh
-opkg update
-opkg upgrade shaterd shater-core luci-app-shater byedpi   # only our own packages
-```
-
-Drop `byedpi` from the list if you never installed it. An upgrade is offered only
-when the feed's `Version` differs from the installed one — that is exactly what
-bug B4 broke (v0.2.2…v0.2.6 all published as `0.2.0-r3`). Since then CI derives
-the version from the git tag on every build (§2.1), so there is nothing to bump
-by hand any more; check with:
-
-```sh
-opkg list-installed | grep -E 'shaterd|shater-core|luci-app-shater|byedpi'
-```
-
-## 6. apk feed (OpenWrt/ImmortalWrt 25.12+ — incl. BananaWRT 25.12-mtk-vendor)
-
-OpenWrt/ImmortalWrt **25.12** replaces opkg with Alpine's **apk**: `.apk` files,
-a binary `packages.adb` index, EC (prime256v1) keys in `/etc/apk/keys/`, and
-effectively mandatory signatures (unsigned needs `--allow-untrusted`). The
-package **Makefiles are unchanged** — the SDK release decides the format.
-
-CI builds this lane **in parallel** with the opkg feed (same manual triggers:
-`v*` tag push or `workflow_dispatch`): the `build-apk` jobs in
-`.gitea/workflows/release.yml` compile the same 4 packages through the official
-**ImmortalWrt 25.12 SDK** (tarballs from
+CI (`v*` tag push or `workflow_dispatch`) compiles the 4 packages through the
+official **ImmortalWrt 25.12 SDK** (tarballs from
 `downloads.immortalwrt.org/releases/25.12.1/targets/{x86/64,mediatek/filogic}/`)
-and publish **one release per arch** — rolling `apk-latest-x86_64` /
-`apk-latest-aarch64_cortex-a53`, or `apk-vX.Y.Z-<arch>` for a tagged version.
-Per-arch (unlike the combined opkg release) because apk filenames carry no
-architecture and packages are fetched relative to the `packages.adb` URL.
+and publishes **one release per arch**: the rolling `apk-latest-x86_64` /
+`apk-latest-aarch64_cortex-a53`, plus `apk-vX.Y.Z-<arch>` on a tag. Per-arch
+because apk filenames carry no architecture and packages are fetched *relative to
+the `packages.adb` URL*, so one flat multi-arch release would collide.

-> **Key:** apk cannot use the usign key. The apk trust anchor is the separate EC
-> public key **`dist/shater-apk.pem`** (generated once by `ci/gen-apk-key.sh`;
-> private half lives ONLY in the Gitea secret **`KEY_APK`**, the apk analog of
-> `KEY_BUILD`). Never regenerate either key — that invalidates every deployed
-> router's trust. The usign identity `shater-feed.pub` keeps signing the
-> opkg/24.10 feed, untouched.
+> **Key:** the trust anchor is the EC public key **`dist/shater-apk.pem`**
+> (generated once by `ci/gen-apk-key.sh`; the private half lives ONLY in the
+> Gitea secret **`KEY_APK`**). Never regenerate it — that invalidates every
+> deployed router's trust.

-One-time setup on a 25.12 router (BananaWRT `25.12-mtk-vendor` on the BPI-R3
-mini, BPI-R4 on 25.12, or the future 25.12 VM — `/etc/apk/arch` picks the right
-per-arch release automatically):
+### 5.1 Rolling or pinned — pick the repo URL deliberately
+
+The repo line names an **index file**, and which one you name is the whole
+update policy:
+
+| Repo line points at | Behaviour | Cost |
+|---|---|---|
+| `apk-latest-<arch>/packages.adb` (**rolling**) | Every release run REPLACES this release's assets, so `apk update && apk upgrade <our packages>` always sees the newest build. Install once, never touch the file again. | You get whatever CI published last; there is no per-router pin. |
+| `apk-vX.Y.Z-<arch>/packages.adb` (**pinned**) | The router stays on exactly that build. `apk update` will never offer a newer shater. | `/etc/apk/repositories.d/shater.list` must be edited **by hand on every upgrade**, on every router. |
+
+`mini_router` is deliberately on a **pinned** URL — a considered choice, and the
+hand-edit per release is its price. Use rolling unless you specifically want to
+freeze a device.
+
+> The rolling release used to go stale silently: publishing was an either/or, so
+> tag runs wrote only `apk-vX.Y.Z-<arch>` and `apk-latest-<arch>` was last
+> refreshed on 2026-07-24 at `0.2.0` while v0.2.9/v0.2.10 shipped. A router on
+> the rolling URL kept getting a successful `apk update` with nothing new. Fixed
+> 2026-07-25: `release-apk` writes the rolling pointer on **every** run and then
+> reads the release back over the Gitea API, asserting it holds our three
+> tag-versioned packages at exactly the version just built and **no** leftover
+> asset at another version (two versions of one package in one index would let
+> apk choose instead of us).
+
+### 5.2 One-time setup on the router
+
+BananaWRT `25.12-mtk-vendor` on the BPI-R3 mini, OpenWrt 25.12 on the BPI-R4, or
+the testbed VM — `/etc/apk/arch` picks the right per-arch release automatically:

 ```sh
 # 1) trust the apk feed key (any *.pem filename under /etc/apk/keys works).
@@ -251,6 +242,7 @@ wget -O /etc/apk/keys/shater-apk.pem \
  "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"

 # 2) add the repo — the line points at the packages.adb INDEX FILE itself.
+#    (rolling; for a pinned router put apk-vX.Y.Z-$(cat /etc/apk/arch) here — §5.1)
 echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb" \
  > /etc/apk/repositories.d/shater.list

@@ -260,7 +252,7 @@ apk add luci-app-shater        # -> shater-core -> shaterd
 apk add byedpi                 # optional: ByeDPI desync egress
 ```

-### Updating
+### 5.3 Updating

 **Never run a bare `apk upgrade`.** With no arguments apk reconciles *every*
 installed package against *every* configured repository at once; on a router
@@ -286,9 +278,8 @@ Drop `byedpi` from either list if you never installed it. Check what you are on
 with `apk list -I shaterd shater-core luci-app-shater byedpi` — the version reads
 `0.2.7-r1` (§2.1: `PKG_VERSION-rPKG_RELEASE`, derived from the git tag by CI, so
 every build really is a new version; before that fix v0.2.2…v0.2.6 all published
-as `0.2.0-r3` and `apk update` offered nothing). Pin a version instead of tracking
-rolling by pointing the repo line at
-`.../download/apk-vX.Y.Z-$(cat /etc/apk/arch)/packages.adb`.
+as `0.2.0-r3` and `apk update` offered nothing). Rolling vs pinned repo URL —
+§5.1.

 ### BananaWRT `25.12-mtk-vendor` compatibility

@@ -195,7 +195,7 @@ type Chain struct { Name string; Hops []string } // "group:<n>" | "node:<n>", L1
 type Egress struct { Name,Type,Interface,Target string } // interface|proxy|direct|block
 type Rule struct {
 	Name string; Enabled bool; Order int
-	Src []string; DstDomain,DstRuleset,DstIP []string; DstPort,Proto string
+	Src []string; DstRuleset []string; DstPort,Proto string // dst = ruleset only (v0.2 schema v2)
 	Target string // chain:|group:|node:|direct|block
 	Egress,Kill string
 	SchedEnabled bool; SchedDays []string; SchedStart,SchedEnd string; SchedUTCOffset int
@@ -257,8 +257,12 @@ Apply/rollback: `apSnapshot` (run→last-good, nft→last-good.nft, route marks)
 - `config node`: name, enabled, uri, mux, mux_concurrency, xudp_concurrency, xudp_udp443, sockopt_mark, tcp_fast_open, tcp_keepalive_idle.
 - `config group`: name, source, subscription, list node, strategy, include/exclude/filter_proto/filter_country, dedup, probe_url, probe_interval.
 - `config chain`: name, list hop.  `config egress`: name, type, interface, target.
- `config ruleset`: name, type(domain|ipcidr), source(inline|file|url), url, path, format, update_interval, list entry.
- `config rule`: name, enabled, order, list src/dst_domain/dst_ruleset/dst_ip, dst_port, proto, target, egress, kill, sched_enabled, list sched_day, sched_start/end/tz.
+- `config ruleset`: name, type(domain|ipcidr), source(inline|file|url|geosite|geoip), url, path, format, update_interval, list category, list entry.
+- `config rule`: name, enabled, order, list src, list dst_ruleset, dst_port, proto, target, egress, kill, sched_enabled, list sched_day, sched_start/end, sched_utc_offset.
+  v0.1 carried `dst_domain`/`dst_ip` on the rule itself; **schema v2 removed both** — a
+  destination is a `config ruleset` and nothing else. `shaterd migrate` folds each legacy
+  list into a generated `rule-<name>` (and `rule-<name>-ip`) inline ruleset; see
+  `DECISIONS.md` D21 for the entry-by-entry conversion table.
 - `config preset`: name, enabled, order, target.  `config profile`: name, enabled, priority, list match_iface, probe_url, probe_mode, sched_*, list enable_rule/disable_rule, default_target, default_egress.
 - `config resolver`: name, type, address, detour, pool.  `config dns_rule`: order, list match_domain/match_src, resolver.

@@ -6,7 +6,7 @@ OpenWrt). Лицо репозитория и быстрый старт — в к
 | Документ | О чём |
 |----------|-------|
 | [CONTEXT.md](CONTEXT.md) | **Начните здесь** — контекст проекта, история v0.1→v0.2, решения в кратце, testbed/инфра |
-| [INSTALL.md](INSTALL.md) | Сборка ship-артефакта (`shaterd`) и установка обоих фидов — opkg (24.10) и apk (25.12+) |
+| [INSTALL.md](INSTALL.md) | Сборка ship-артефакта (`shaterd`) и установка apk-фида (25.12+): роллинг или фиксация версии |
 | [ARCHITECTURE.md](ARCHITECTURE.md) | One-binary дизайн, auth-handoff LuCI→панель, data/DNS/apply-потоки (диаграммы) |
 | [FEATURES.md](FEATURES.md) | Полный список фич с тегами MVP/T1/T2 |
 | [ROADMAP.md](ROADMAP.md) | Фазовый план |
@@ -104,7 +104,7 @@ build new logic in the `shater/`, `panel/`, `openwrt/` overlay.

 ## Phase 8 — Ship it  ✅ DONE
 - Adapt CI to build/sign the single forked binary for both arches; publish the
-  signed opkg feed (reuse key `5ac4b177689cb8e0`); install/upgrade docs.
+  signed feed (apk since D22, EC key `dist/shater-apk.pem`); install/upgrade docs.
 - Set an upstream-rebase cadence (merge new sing-box-lx tags, run the smoke suite).

 ## Cross-cutting (every phase)
@@ -21,8 +21,8 @@ PKG_NAME:=byedpi
 # ci/version.sh). PKG_VERSION here is THIRD-PARTY UPSTREAM's version — it is what
 # PKG_SOURCE_URL/PKG_HASH pin, and what tells an operator which ByeDPI is
 # actually installed. Stamping our tag on it would be both a lie and a
-# regression: our tags are 0.2.x, and every version comparator (apk-tools 3 and
-# opkg alike, verified) reads 0.2.7 < 0.17.3 — component-wise numerically, 2 < 17
+# regression: our tags are 0.2.x, and the version comparator (apk-tools 3,
+# verified) reads 0.2.7 < 0.17.3 — component-wise numerically, 2 < 17
 # — so the "new" package would be a DOWNGRADE and routers would refuse it.
 # Bump PKG_RELEASE BY HAND when *our packaging* of it changes (init script, uci
 # defaults, build flags); bump PKG_VERSION+PKG_HASH when upstream releases.
@@ -62,7 +62,29 @@ config inbound
 #	list node 'my-node'
 #
 # A routing rule. target: chain:<n>|group:<n>|node:<n>|egress:<n>|direct|block.
-# Match on src / dst_domain / dst_ruleset / dst_ip / dst_port / proto.
+# Match on src / dst_ruleset / dst_port / proto. A rule with NO matcher at all is
+# the default route for everything that reached it.
+#
+# WHERE the traffic is going is named ONLY by dst_ruleset — one or more
+# `config ruleset` names; the rule matches when ANY of them matches. There is no
+# inline domain or address list on a rule (`dst_domain`/`dst_ip` were removed in
+# schema v2): a destination list is written once as a ruleset, compiled into a
+# .srs and shared by every rule that references it. `shaterd migrate` converts
+# older configs automatically, creating a `rule-<name>` ruleset per rule.
+#config ruleset
+#	option name 'blocked-video'
+#	option type 'domain'
+#	option source 'inline'
+#	list entry 'youtube.com'
+#	list entry 'suffix:googlevideo.com'
+#
+#config rule
+#	option name 'video-via-main'
+#	option enabled '1'
+#	option order '50'
+#	list dst_ruleset 'blocked-video'
+#	option target 'group:main'
+#
 #config rule
 #	option name 'all-via-main'
 #	option enabled '1'
@@ -83,11 +105,16 @@ config inbound
 #	option type 'direct'
 #	option dpi 'fragment'
 #
+#config ruleset
+#	option name 'youtube'
+#	option source 'geosite'
+#	list category 'youtube'
+#
 #config rule
 #	option name 'youtube-fragment'
 #	option enabled '1'
 #	option order '50'
-#	list dst_domain 'geosite:youtube'
+#	list dst_ruleset 'youtube'
 #	option target 'egress:frag'
 #
 # A DNS resolver (type: doh|dot|plain|local|fakeip). `detour` routes its queries
@@ -152,7 +152,21 @@ start_service() {

 	# Bring the UCI schema forward before the daemon reads it (idempotent;
 	# refuses a newer schema) so an upgraded package never applies a stale config.
-	"$PROG" migrate >/dev/null 2>&1
+	#
+	# THE FAILURE IS LOGGED, NOT SWALLOWED. This is the only place the schema
+	# migration runs at boot (`shaterd run`, the SIGHUP reconcile and the panel's
+	# config write all read UCI directly), so if it fails here it does not get
+	# retried until the next start. And it CAN fail for a mundane reason — a full
+	# /overlay makes `uci commit` fail — after which the config still carries the
+	# schema-v1 `dst_domain`/`dst_ip` options. The daemon holds every rule that
+	# still has them DISABLED and reports it, so nothing is silently misrouted, but
+	# rules the operator wrote are then not in force and the reason has to be
+	# visible somewhere. Hence: log the binary's own stderr, and start anyway —
+	# refusing to start would take the admin panel down with it, and the panel is
+	# the only way to fix the box.
+	local migrate_out
+	migrate_out=$("$PROG" migrate 2>&1) || _slog -p daemon.err \
+		"UCI schema migration FAILED: ${migrate_out:-no output from $PROG migrate}. Starting anyway; routing rules that still carry the removed dst_domain/dst_ip options stay DISABLED until this succeeds. Free space on /overlay and re-run '$PROG migrate', or restart the service."

 	procd_open_instance shater
 	# shaterd runs in the FOREGROUND under procd (must never daemonize). `run` is
@@ -38,9 +38,9 @@ PKG_NAME:=shaterd
 # VERSIONING — derived from the git tag, NOT hand-maintained here (bug B4).
 # ci/version.sh turns `git describe` into SHATER_PKG_VERSION/SHATER_PKG_RELEASE
 # (tag vX.Y.Z -> X.Y.Z + r1; off-tag -> last tag + r<commits+1>), and
-# ci/build-feed.sh / ci/build-feed-apk.sh export them into the SDK build env of
-# both lanes. Both lanes then ASSERT that the produced .ipk/.apk really carries
-# that version, so a lost env can never silently ship a stale one again.
+# ci/build-feed-apk.sh exports them into the SDK build env. ci/sdk-build-apk.sh
+# then ASSERTS that the produced .apk really carries that version, so a lost env
+# can never silently ship a stale one again.
 # The literals below are ONLY the manual/offline fallback (no CI, no git) — they
 # are not "the release version"; releases are named by the tag.
 PKG_VERSION:=$(if $(SHATER_PKG_VERSION),$(SHATER_PKG_VERSION),0.2.0)
@@ -104,8 +104,8 @@ define Package/shaterd/install
 	$(INSTALL_BIN) $(CURDIR)/files/$(SHATERD_BIN) $(1)/usr/bin/shaterd
 endef

-# This package ships ONLY the binary — no init script — so opkg's default
-# postinst never touches the running service. On `opkg upgrade shaterd` the new
+# This package ships ONLY the binary — no init script — so the package manager's
+# postinst never touches the running service. On `apk upgrade shaterd` the new
 # ELF lands at /usr/bin/shaterd while the OLD image keeps running from its
 # unlinked inode: the upgrade silently has no effect until the next reboot, and
 # meanwhile the new CLI (`shaterd reconcile`, `status`, `mint-token` — invoked by
@@ -8,7 +8,8 @@
    "dev": "vite",
    "build": "tsc --noEmit && vite build",
    "preview": "vite preview",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "node --test src/*.test.ts"
  },
  "dependencies": {
    "react": "^18.3.1",
@@ -405,3 +405,73 @@
  color: var(--dim);
  max-width: 74ch;
 }
+
+/* ---- inline rename (shared) ----
+   The pencil-in-the-row interaction: click the ✎ beside a name, type over it,
+   Enter commits / Esc cancels / blur commits. Lifted out of Devices.css when
+   Nodes grew the same affordance — one interaction, one set of rules, so the two
+   pages can never drift apart. `--locked` is the same control with the action
+   withheld: it stays visible and focusable-looking so a missing rename reads as
+   a stated rule, not a dead button. */
+.inline-rename {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 22px;
+  height: 22px;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: 5px;
+  background: none;
+  color: var(--faint);
+  font-size: 12px;
+  line-height: 1;
+  cursor: pointer;
+  transition: color 0.15s, background 0.15s, border-color 0.15s;
+}
+.inline-rename:hover:not(:disabled) {
+  color: var(--accent);
+  background: color-mix(in srgb, var(--accent) 12%, transparent);
+}
+.inline-rename:focus-visible {
+  color: var(--accent);
+  border-color: var(--accent);
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+.inline-rename:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+/* Withheld, not broken: keep the glyph readable and let the cursor say "there is
+   a reason" rather than dimming it into invisibility. */
+.inline-rename--locked {
+  opacity: 0.75;
+  cursor: help;
+}
+.inline-rename--locked:hover {
+  color: var(--dim);
+  background: none;
+}
+
+.inline-rename-input {
+  min-width: 0;
+  max-width: 24ch;
+  padding: 4px 8px;
+  border: 1px solid var(--accent);
+  border-radius: 6px;
+  background: var(--sink);
+  color: var(--ink);
+  font-size: 13px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  box-shadow: 0 1px 2px var(--shadow) inset;
+}
+.inline-rename-input:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+.inline-rename-input:disabled {
+  opacity: 0.55;
+}
@@ -51,6 +51,38 @@ export class ApiError extends Error {
 */
 export type Plane = 'full' | 'hold' | 'none'

+/**
+ * Where the router's traffic actually ENDS UP, decided by the daemon from the
+ * engine config it is running (apply.Status.traffic ← generate.TrafficOf).
+ *
+ *   tunnel  — the default route goes into a tunnel: everything not matched by a
+ *             more specific rule is proxied.
+ *   split   — the default leaves directly, but some rules do tunnel their traffic.
+ *   direct  — the default leaves directly and nothing is tunnelled at all.
+ *   blocked — the default is the fail-closed backstop: unmatched traffic is
+ *             dropped, not let out. Nothing leaks.
+ *
+ * `plane` DOES NOT ANSWER THIS and must never be read as if it did. `plane` says
+ * how much of the data plane is installed (nft table, policy routing, engine up);
+ * a router whose only rule is `default → direct` has all of it and sends the whole
+ * LAN out the plain WAN with its real address. That combination — plane "full",
+ * traffic "direct" — was live on a user's router under a green "Protected" LED.
+ */
+export type TrafficVerdict = 'tunnel' | 'split' | 'direct' | 'blocked'
+
+export interface Traffic {
+  // '' or absent ⇒ not known (daemon that predates this field, nothing applied
+  // yet, or the plane is on hold). NEVER treat unknown as 'tunnel'.
+  verdict?: TrafficVerdict | ''
+  // The outbound tag the engine's default route names, in the engine's own
+  // vocabulary ("direct", "block", a node/group tag). Diagnostic — wording is
+  // driven by `verdict`, never by parsing this.
+  default?: string
+  // How many of the engine's route rules send their matched traffic into a tunnel.
+  // Separates "some of your traffic is protected" from "none of it is".
+  tunnel_rules?: number
+}
+
 /**
 * One thing the last apply could not do. Deliberately fail-OPEN with a warning
 * rather than refusing the whole config (the alternative was taking the network
@@ -88,6 +120,10 @@ export interface Status {
  // How much of the data plane is installed. Absent on older daemons ⇒ unknown,
  // in which case the UI shows nothing rather than guessing "full".
  plane?: Plane
+  // Where the traffic actually goes under the running config. Absent on older
+  // daemons ⇒ unknown; see TrafficVerdict for why this is a separate question
+  // from `plane`.
+  traffic?: Traffic
  // Findings from the last apply. ALWAYS an array from the daemon (never null);
  // empty means the last apply was clean. Pre-sorted critical-first and capped at
  // 50, where a truncated list ends with an `info` entry saying "suppressed".
@@ -809,9 +845,17 @@ export interface Rule {
  Enabled: boolean
  Order: number
  Src?: string[] | null
-  DstDomain?: string[] | null
+  /**
+   * WHERE the traffic is going — the rule's only destination matcher. Each entry
+   * names a {@link Ruleset}; the rule matches when ANY of them matches.
+   *
+   * There is no inline domain or address list on a rule. `dst_domain`/`dst_ip`
+   * were removed in schema v2, and `shaterd migrate` folds every existing one
+   * into a generated `rule-<name>` ruleset, so a destination list is written and
+   * edited in exactly one place and compiled once into a .srs that every rule
+   * referencing it shares.
+   */
  DstRuleset?: string[] | null
-  DstIP?: string[] | null
  DstPort?: string
  /**
   * Narrow the rule to one transport or one sniffed application protocol. A
@@ -1218,6 +1262,17 @@ export interface RuleReach {
  shadowed_by_order?: number
  /** Operator-facing sentence; absent when `unreachable` is false. */
  reason?: string
+  /**
+   * Whether the rule is IN FORCE right now — `Rule.Enabled` after the active WAN
+   * profile's overrides. This is NOT `GET /api/config`'s `Enabled`: that one is
+   * the desired state the page PUTs back, and on a router with profiles the two
+   * legitimately disagree. Draw rows from this; keep the switch on the other.
+   */
+  effective_enabled: boolean
+  /** The active profile that CHANGED this rule's state; absent when none did. */
+  overridden_by?: string
+  /** Which way it went. Absent together with `overridden_by`. */
+  override?: 'enabled' | 'disabled'
 }

 /** GET /api/rules/reachability. `rules` is ALWAYS an array, one entry per rule in
@@ -1,4 +1,5 @@
-/* Buttons — mono, uppercase. .btn is ghost; .btn.primary is solid orange. */
+/* Buttons — mono, uppercase. .btn is ghost; .btn.primary is solid orange;
+ * .btn.crit is the solid-red destructive commit. */
 .btn {
  display: inline-block;
  padding: 7px 12px;
@@ -30,3 +31,16 @@
  color: #fff;
  filter: brightness(1.05);
 }
+
+/* Destructive commit. The fill is crit stepped a little toward black so white
+ * label text clears 4.5:1 in BOTH themes — the raw --crit is bright enough in
+ * dark mode to fall under it. Red here always means "this removes something". */
+.btn.crit {
+  border-color: transparent;
+  background: color-mix(in srgb, var(--crit) 88%, #000);
+  color: #fff;
+}
+.btn.crit:hover {
+  color: #fff;
+  filter: brightness(1.08);
+}
@@ -1,19 +1,27 @@
 import './Button.css'
+import { forwardRef } from 'react'
 import type { ButtonHTMLAttributes } from 'react'

 export interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
-  /** `primary` is the solid-orange call to action; `ghost` is the default. */
-  variant?: 'ghost' | 'primary'
+  /**
+   * `primary` is the solid-orange call to action; `crit` is the solid-red
+   * destructive commit (delete, remove) — semantic crit, never the accent;
+   * `ghost` is the default.
+   */
+  variant?: 'ghost' | 'primary' | 'crit'
 }

-export function Button({ variant = 'ghost', className, type, ...rest }: ButtonProps) {
+/** Ref-forwarding so a dialog can park focus on a specific button. */
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button(
+  { variant = 'ghost', className, type, ...rest },
+  ref,
+) {
  return (
    <button
+      ref={ref}
      type={type ?? 'button'}
-      className={['btn', variant === 'primary' ? 'primary' : '', className]
-        .filter(Boolean)
-        .join(' ')}
+      className={['btn', variant === 'ghost' ? '' : variant, className].filter(Boolean).join(' ')}
      {...rest}
    />
  )
-}
+})
@@ -0,0 +1,162 @@
+/* <ConfirmDialog> — the safety interlock plate.
+ *
+ * This replaces the browser's native confirm dialog, which a browser can mute for
+ * good ("prevent this page from creating additional dialogs"): after that it
+ * returns false with no dialog at all, so every delete button in the panel goes
+ * dead and silent with no way to recover short of a page reload. We draw the
+ * plate ourselves, so nothing can suppress it.
+ *
+ * Faceplate language: a small rack module lifted off the panel — corner screws
+ * (reused from Faceplate.css), an engraved label, a groove above the actions.
+ * Destructive intent is carried by the crit semantic, never by the orange accent:
+ * accent means "this control is active", crit means "this destroys something".
+ */
+
+/* The veil is a fixed dark wash in both themes — a light scrim over a light
+ * panel would not read as "the panel is out of reach". Follows the tokens.css
+ * pattern: light base, dark via media query, data-theme overrides win both ways. */
+.cfm-scrim {
+  --cfm-veil: rgba(33, 29, 21, 0.52);
+}
+@media (prefers-color-scheme: dark) {
+  .cfm-scrim {
+    --cfm-veil: rgba(0, 0, 0, 0.66);
+  }
+}
+:root[data-theme='light'] .cfm-scrim {
+  --cfm-veil: rgba(33, 29, 21, 0.52);
+}
+:root[data-theme='dark'] .cfm-scrim {
+  --cfm-veil: rgba(0, 0, 0, 0.66);
+}
+
+.cfm-scrim {
+  position: fixed;
+  inset: 0;
+  z-index: 200;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  /* Short viewports: the plate scrolls with the veil instead of being clipped. */
+  overflow-y: auto;
+  padding: calc(var(--u, 8px) * 2);
+  background: var(--cfm-veil);
+  animation: cfm-veil-in 0.14s ease-out;
+}
+
+.cfm-card {
+  position: relative;
+  width: min(32rem, 100%);
+  max-height: calc(100dvh - var(--u, 8px) * 4);
+  overflow-y: auto;
+  padding: calc(var(--u, 8px) * 3.25);
+  border: 1px solid var(--groove);
+  border-radius: 12px;
+  /* same brushed plate as <Faceplate>, one step brighter so it reads as lifted */
+  background:
+    repeating-linear-gradient(
+      90deg,
+      transparent 0 2px,
+      color-mix(in srgb, var(--edge) 30%, transparent) 2px 3px
+    ),
+    linear-gradient(180deg, var(--raised), color-mix(in srgb, var(--raised) 82%, var(--panel)));
+  box-shadow:
+    0 1px 0 var(--edge) inset,
+    0 30px 60px -22px var(--shadow),
+    0 4px 12px var(--shadow);
+  animation: cfm-card-in 0.18s cubic-bezier(0.2, 0.7, 0.3, 1);
+}
+.cfm-card:focus {
+  outline: none;
+}
+
+/* `still` is set from usePrefersReducedMotion — the plate appears, it never
+ * travels. (The global reduced-motion rule in tokens.css also neutralises the
+ * duration; this keeps the intent explicit at the component.) */
+.cfm-scrim.still,
+.cfm-scrim.still .cfm-card {
+  animation: none;
+}
+
+@keyframes cfm-veil-in {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+@keyframes cfm-card-in {
+  from {
+    opacity: 0;
+    transform: translateY(6px) scale(0.99);
+  }
+  to {
+    opacity: 1;
+    transform: none;
+  }
+}
+
+/* ---- header: engraved label + state LED ---- */
+.cfm-hd {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: calc(var(--u, 8px) * 1.5);
+}
+.cfm-label {
+  flex: 1;
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: var(--track-label-wide, 0.24em);
+  color: var(--dim);
+  text-transform: uppercase;
+}
+
+/* ---- copy ---- */
+.cfm-title {
+  margin: 0;
+  font-family: var(--font-mono);
+  font-weight: 700;
+  font-size: 17px;
+  line-height: 1.35;
+  color: var(--ink);
+  /* names can be long and unbroken — wrap rather than push the plate wide */
+  overflow-wrap: anywhere;
+}
+.cfm-body {
+  margin: calc(var(--u, 8px) * 1.5) 0 0;
+  max-width: 52ch;
+  font-family: var(--font-sans);
+  font-size: 13.5px;
+  line-height: 1.6;
+  color: var(--dim);
+  overflow-wrap: anywhere;
+}
+
+/* ---- action bar ---- */
+.cfm-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: calc(var(--u, 8px));
+  margin-top: calc(var(--u, 8px) * 3);
+  padding-top: calc(var(--u, 8px) * 2);
+  border-top: 1px solid var(--groove);
+}
+
+@media (max-width: 420px) {
+  .cfm-card {
+    padding: calc(var(--u, 8px) * 2.5);
+  }
+  .cfm-actions {
+    flex-wrap: wrap;
+  }
+  .cfm-actions .btn {
+    flex: 1 1 auto;
+    text-align: center;
+  }
+  /* screws crowd a small plate — drop them rather than collide with the copy */
+  .cfm-card > .screw {
+    display: none;
+  }
+}
@@ -0,0 +1,281 @@
+import './ConfirmDialog.css'
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useId,
+  useRef,
+  useState,
+} from 'react'
+import type { ReactNode } from 'react'
+import { createPortal } from 'react-dom'
+import { Button } from './Button'
+import { Led } from './Led'
+import { usePrefersReducedMotion } from './usePrefersReducedMotion'
+
+/**
+ * How the confirming button is painted.
+ *
+ *   crit    — the action destroys something. Semantic crit, never the accent.
+ *   neutral — the action is a normal commit the operator should read first
+ *             (a warning before saving); the accent's call-to-action is correct.
+ */
+export type ConfirmTone = 'crit' | 'neutral'
+
+export interface ConfirmOptions {
+  /** Engraved eyebrow, e.g. "DELETE RULE". Names the operation, not the object. */
+  label?: string
+  /** The question. One line, ends in "?". */
+  title: string
+  /** The consequence — what changes on the router if this goes through. */
+  body?: ReactNode
+  /** Verb on the confirming button. Defaults to "Delete". */
+  confirmLabel?: string
+  /** Verb on the dismissing button. Defaults to "Cancel". */
+  cancelLabel?: string
+  /** Defaults to `crit` — the overwhelmingly common case is a delete. */
+  tone?: ConfirmTone
+}
+
+export interface ConfirmDialogProps extends ConfirmOptions {
+  open: boolean
+  /** Called exactly once per dialog, with the operator's answer. */
+  onResolve: (confirmed: boolean) => void
+}
+
+const FOCUSABLE =
+  'button:not([disabled]), [href], input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])'
+
+/**
+ * The modal plate itself. Normally reached through `useConfirm()`; exported so a
+ * page that wants to own the open state can render it directly.
+ *
+ * Keyboard contract:
+ *   - focus moves to Cancel on open, so a reflex Enter dismisses, never deletes;
+ *   - Tab / Shift+Tab cycle inside the plate and cannot reach the page behind it;
+ *   - Esc answers "no";
+ *   - on close, focus returns to whatever opened the dialog.
+ */
+export function ConfirmDialog({
+  open,
+  onResolve,
+  label,
+  title,
+  body,
+  confirmLabel = 'Delete',
+  cancelLabel = 'Cancel',
+  tone = 'crit',
+}: ConfirmDialogProps) {
+  const titleId = useId()
+  const bodyId = useId()
+  const cardRef = useRef<HTMLDivElement>(null)
+  const cancelRef = useRef<HTMLButtonElement>(null)
+  const openerRef = useRef<HTMLElement | null>(null)
+  const reduced = usePrefersReducedMotion()
+
+  // Take the page out of the tab order, park focus on Cancel, and hand focus
+  // back to the opener when the plate goes away.
+  useEffect(() => {
+    if (!open) return
+    const opener = document.activeElement
+    openerRef.current = opener instanceof HTMLElement ? opener : null
+
+    const prevOverflow = document.body.style.overflow
+    document.body.style.overflow = 'hidden'
+
+    // Cancel is the resting place: an Enter or a Space meant for the page lands
+    // on "no". The destructive button is one Tab away, deliberately.
+    ;(cancelRef.current ?? cardRef.current)?.focus()
+
+    return () => {
+      document.body.style.overflow = prevOverflow
+      const back = openerRef.current
+      openerRef.current = null
+      if (back && document.contains(back)) back.focus()
+    }
+  }, [open])
+
+  // Esc answers no; Tab is caged. Capture phase so a page-level key handler
+  // never sees keys aimed at the dialog.
+  useEffect(() => {
+    if (!open) return
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        e.preventDefault()
+        e.stopPropagation()
+        onResolve(false)
+        return
+      }
+      if (e.key !== 'Tab') return
+      const card = cardRef.current
+      if (!card) return
+      const list = Array.from(card.querySelectorAll<HTMLElement>(FOCUSABLE))
+      if (list.length === 0) {
+        e.preventDefault()
+        card.focus()
+        return
+      }
+      const first = list[0]
+      const last = list[list.length - 1]
+      const active = document.activeElement as HTMLElement | null
+      if (!active || !card.contains(active)) {
+        e.preventDefault()
+        ;(e.shiftKey ? last : first).focus()
+      } else if (e.shiftKey && active === first) {
+        e.preventDefault()
+        last.focus()
+      } else if (!e.shiftKey && active === last) {
+        e.preventDefault()
+        first.focus()
+      }
+    }
+    document.addEventListener('keydown', onKey, true)
+    return () => document.removeEventListener('keydown', onKey, true)
+  }, [open, onResolve])
+
+  if (!open) return null
+
+  return createPortal(
+    <div
+      className={['cfm-scrim', reduced ? 'still' : ''].filter(Boolean).join(' ')}
+      // A click on the field around the plate means "not now". Mousedown (not
+      // click) so a text selection dragged out of the plate can't dismiss it.
+      onMouseDown={(e) => {
+        if (e.target === e.currentTarget) onResolve(false)
+      }}
+    >
+      <div
+        className={`cfm-card tone-${tone}`}
+        ref={cardRef}
+        tabIndex={-1}
+        role="alertdialog"
+        aria-modal="true"
+        aria-labelledby={titleId}
+        aria-describedby={body != null ? bodyId : undefined}
+      >
+        <i className="screw tl" aria-hidden="true" />
+        <i className="screw tr" aria-hidden="true" />
+        <i className="screw bl" aria-hidden="true" />
+        <i className="screw br" aria-hidden="true" />
+
+        {/* Lamp first, then the engraved label — the way a real panel reads, and
+            it keeps the LED off the corner screw. */}
+        <div className="cfm-hd">
+          <Led variant={tone === 'crit' ? 'crit' : 'amber'} />
+          <span className="cfm-label">{label ?? (tone === 'crit' ? 'Confirm delete' : 'Confirm')}</span>
+        </div>
+
+        <h2 className="cfm-title" id={titleId}>
+          {title}
+        </h2>
+        {body != null && (
+          <p className="cfm-body" id={bodyId}>
+            {body}
+          </p>
+        )}
+
+        <div className="cfm-actions">
+          <Button ref={cancelRef} onClick={() => onResolve(false)}>
+            {cancelLabel}
+          </Button>
+          <Button variant={tone === 'crit' ? 'crit' : 'primary'} onClick={() => onResolve(true)}>
+            {confirmLabel}
+          </Button>
+        </div>
+      </div>
+    </div>,
+    document.body,
+  )
+}
+
+// ---- provider + hook --------------------------------------------------------
+
+interface Request extends ConfirmOptions {
+  id: number
+  resolve: (v: boolean) => void
+}
+
+const ConfirmCtx = createContext<((o: ConfirmOptions) => Promise<boolean>) | null>(null)
+
+/**
+ * Mount once at the app root. Everything below can then ask a question and await
+ * the answer.
+ */
+export function ConfirmProvider({ children }: { children: ReactNode }) {
+  const [req, setReq] = useState<Request | null>(null)
+  const pending = useRef<Request | null>(null)
+  const seq = useRef(0)
+
+  const confirm = useCallback(
+    (opts: ConfirmOptions) =>
+      new Promise<boolean>((resolve) => {
+        // A second question while one is open answers the first with "no" rather
+        // than leaving its promise — and its caller — hanging forever.
+        pending.current?.resolve(false)
+        seq.current += 1
+        const next: Request = { ...opts, id: seq.current, resolve }
+        pending.current = next
+        setReq(next)
+      }),
+    [],
+  )
+
+  const settle = useCallback((confirmed: boolean) => {
+    const open = pending.current
+    pending.current = null
+    setReq(null)
+    open?.resolve(confirmed)
+  }, [])
+
+  // Teardown must not strand a caller mid-await.
+  useEffect(
+    () => () => {
+      pending.current?.resolve(false)
+      pending.current = null
+    },
+    [],
+  )
+
+  // A question belongs to the page that asked it. The provider outlives the
+  // hash router, so a navigation would otherwise leave a stale plate floating
+  // over a page it has nothing to do with — answer it "no" and clear it.
+  useEffect(() => {
+    const onNav = () => {
+      if (pending.current) settle(false)
+    }
+    window.addEventListener('hashchange', onNav)
+    return () => window.removeEventListener('hashchange', onNav)
+  }, [settle])
+
+  return (
+    <ConfirmCtx.Provider value={confirm}>
+      {children}
+      {req !== null && <ConfirmDialog key={req.id} open onResolve={settle} {...req} />}
+    </ConfirmCtx.Provider>
+  )
+}
+
+/**
+ * Ask the operator, get a definite answer:
+ *
+ *   const confirm = useConfirm()
+ *   if (!(await confirm({ title: 'Delete rule "x"?', body: '…' }))) return
+ *
+ * The returned function is stable, so it is safe in a useCallback dep list. It
+ * always settles — cancel, Esc, click-outside and teardown all resolve `false`;
+ * only the confirming button resolves `true`.
+ *
+ * Name it `confirm` at the call site on purpose: the local binding shadows the
+ * global one inside that component, so an accidental bare `confirm(...)` cannot
+ * reach the suppressible native dialog.
+ */
+export function useConfirm(): (o: ConfirmOptions) => Promise<boolean> {
+  const ctx = useContext(ConfirmCtx)
+  if (!ctx) {
+    // Loud on purpose. A fallback that quietly resolved false would rebuild the
+    // exact bug this component exists to kill.
+    throw new Error('useConfirm() needs <ConfirmProvider> above it (mounted in main.tsx)')
+  }
+  return ctx
+}
@@ -17,6 +17,8 @@ export { Button } from './Button'
 export type { ButtonProps } from './Button'
 export { Select } from './Select'
 export type { SelectProps, SelectOption } from './Select'
+export { ConfirmDialog, ConfirmProvider, useConfirm } from './ConfirmDialog'
+export type { ConfirmDialogProps, ConfirmOptions, ConfirmTone } from './ConfirmDialog'
 export { Clock } from './Clock'
 export { CatSuggest } from './CatSuggest'
 export { SrcPicker } from './SrcPicker'
@@ -2,12 +2,17 @@ import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 import './tokens.css'
 import { App } from './App'
+import { ConfirmProvider } from './components'

 const rootEl = document.getElementById('root')
 if (!rootEl) throw new Error('#root not found')

+// ConfirmProvider sits ABOVE <App> so it survives App's early returns (the
+// unauth / no-link plates) — useConfirm() can never find itself without a host.
 createRoot(rootEl).render(
  <StrictMode>
-    <App />
+    <ConfirmProvider>
+      <App />
+    </ConfirmProvider>
  </StrictMode>,
 )
@@ -6,7 +6,7 @@
 // state mutates in-memory so the Apply / Confirm / Rollback flow is exercisable.
 //
 // Type-only imports from api.ts (erased at build) keep this free of a runtime cycle.
-import type { ApplyResult, ChainHealth, ConnLogEntry, DiscoveredDevice, GroupHealth, GroupMemberHealth, GroupsHealth, GroupTestResult, GroupTestStart, GroupTestStatus, Interface, Model, QueryLogEntry, RuleReach, RulesReachability, RulesetCategories, RulesetCheck, RulesetStatus, Stats, StatsLogPage, StatsLogQuery, Status, StatusWarning } from './api'
+import type { ApplyResult, ChainHealth, ConnLogEntry, DiscoveredDevice, GroupHealth, GroupMemberHealth, GroupsHealth, GroupTestResult, GroupTestStart, GroupTestStatus, Interface, Model, Profile, QueryLogEntry, RuleReach, RulesReachability, RulesetCategories, RulesetCheck, RulesetStatus, Stats, StatsLogPage, StatsLogQuery, Status, StatusWarning, Traffic } from './api'

 let armed = false // a pending commit-confirm auto-rollback
 let hasLastGood = false // a predecessor config exists to roll back to (post-apply)
@@ -305,29 +305,75 @@ const RULESET_STATUS: RulesetStatus[] = [
 /** GET /api/rules/reachability. Mirrors the daemon's analysis over CONFIG.Rules:
 *  a rule with no conditions is the router's default, and the LAST such rule by
 *  Order wins — every earlier one can never apply. It reads the live CONFIG so
- *  edits made in `?mock` keep the badge honest. */
+ *  edits made in `?mock` keep the badge honest.
+ *
+ *  It also mirrors model.ResolveActiveProfile + ApplyProfileRuleOverrides, because
+ *  `effective_enabled` is the whole point of the endpoint: CONFIG's `mobile-uplink`
+ *  is active and both enables and disables rules, so `?mock` shows the same
+ *  desired-vs-effective split the field config does. */
 export async function getRulesReachability(): Promise<RulesReachability> {
  await wait(60)
  const rules = CONFIG.Rules ?? []
+
+  // A pin naming an existing, ENABLED profile wins outright. Otherwise auto-select:
+  // highest Priority among enabled profiles, ties by Name, skipping any with an
+  // iface condition (the WAN watcher owns those and expresses its verdict as the pin).
+  const profiles = CONFIG.Profiles ?? []
+  const pinned = String(CONFIG.Globals?.ActiveProfile ?? '').trim()
+  let prof: Profile | null = profiles.find((p) => p.Enabled && p.Name === pinned) ?? null
+  if (!prof) {
+    for (const p of profiles) {
+      if (!p.Enabled || (p.MatchIface ?? []).length > 0) continue
+      const pp = p.Priority ?? 0
+      const bp = prof?.Priority ?? 0
+      if (!prof || pp > bp || (pp === bp && p.Name < prof.Name)) prof = p
+    }
+  }
+  // Enable first, then Disable, so a name in both ends up disabled (Disable wins).
+  const effective = rules.map((r) => Boolean(r.Enabled))
+  if (prof) {
+    const force = (names: string[] | null | undefined, on: boolean) => {
+      for (const raw of names ?? []) {
+        const n = raw.trim()
+        rules.forEach((r, i) => {
+          if (r.Name === n) effective[i] = on
+        })
+      }
+    }
+    force(prof.EnableRules, true)
+    force(prof.DisableRules, false)
+  }
+  const activeProfile = prof
+
  const out: RuleReach[] = rules.map((r, index) => ({
    index,
    name: String(r.Name ?? ''),
    order: Number(r.Order ?? 0),
    unreachable: false,
    shadowed_by_index: -1,
+    effective_enabled: effective[index],
+    // Annotate only where the profile actually FLIPPED the outcome — a profile that
+    // disables an already-off rule has overridden nothing the operator can see.
+    ...(activeProfile && effective[index] !== Boolean(r.Enabled)
+      ? {
+          overridden_by: activeProfile.Name,
+          override: effective[index] ? ('enabled' as const) : ('disabled' as const),
+        }
+      : {}),
  }))
  const conditionless = (r: (typeof rules)[number]): boolean =>
    !(r.Src ?? []).length &&
-    !(r.DstDomain ?? []).length &&
    !(r.DstRuleset ?? []).length &&
-    !(r.DstIP ?? []).length &&
    !String(r.DstPort ?? '').trim() &&
    !String(r.Proto ?? '').trim()
  const target = (r: (typeof rules)[number]): string =>
    String(r.Target ?? '').trim() || (r.Egress ? `egress:${String(r.Egress).trim()}` : '')
  const defaults = rules
    .map((r, index) => ({ r, index }))
-    .filter(({ r }) => r.Enabled && conditionless(r) && target(r))
+    // The EFFECTIVE flag, not the configured one: a rule the active profile
+    // switched off is not in force and cannot retire anything (model's
+    // RuleReachability runs over the effective set for the same reason).
+    .filter(({ r, index }) => effective[index] && conditionless(r) && target(r))
    .sort((a, b) => Number(a.r.Order ?? 0) - Number(b.r.Order ?? 0) || a.index - b.index)
  const winner = defaults[defaults.length - 1]
  if (winner) {
@@ -407,6 +453,11 @@ export async function getRulesetCategories(source: string): Promise<RulesetCateg
 //   ?mock&warn=1     → a full warning set (critical + warning + info) on top
 //   ?mock&ks=open    → healthy plane but a FAIL-OPEN kill-switch, which is what
 //                      makes the untunnelable policy inert (F8 case 4)
+//   ?mock&traffic=…  → with the plane FULL, where the traffic actually ends up:
+//                      split | direct | blocked | blackout | unknown. `direct` is
+//                      the field case the readout used to call "Protected" (one
+//                      rule, `default → direct`); `unknown` is a daemon too old to
+//                      report. Default: tunnel.
 function mockPlane(): { plane: 'full' | 'hold' | 'none'; engine: boolean; killSwitch: string } {
  const q = typeof location === 'undefined' ? '' : location.search
  const params = new URLSearchParams(q)
@@ -418,6 +469,30 @@ function mockPlane(): { plane: 'full' | 'hold' | 'none'; engine: boolean; killSw
  return { plane: 'full', engine: true, killSwitch }
 }

+// The daemon's verdict on where traffic goes (apply.Status.traffic). Only
+// meaningful with the plane installed: with the engine down there is no running
+// config to judge, and the daemon reports the unknown/zero value — so do the same
+// here rather than leaving a stale "tunnel" behind a dead engine.
+function mockTraffic(plane: 'full' | 'hold' | 'none'): Traffic | undefined {
+  if (plane !== 'full') return { verdict: '', default: '', tunnel_rules: 0 }
+  const params = new URLSearchParams(typeof location === 'undefined' ? '' : location.search)
+  switch (params.get('traffic')) {
+    case 'split':
+      return { verdict: 'split', default: 'direct', tunnel_rules: 3 }
+    case 'direct':
+      return { verdict: 'direct', default: 'direct', tunnel_rules: 0 }
+    case 'blocked':
+      return { verdict: 'blocked', default: 'block', tunnel_rules: 2 }
+    case 'blackout':
+      return { verdict: 'blocked', default: 'block', tunnel_rules: 0 }
+    case 'unknown':
+      // A daemon that predates the field sends no `traffic` at all.
+      return undefined
+    default:
+      return { verdict: 'tunnel', default: 'auto', tunnel_rules: 1 }
+  }
+}
+
 const MOCK_WARNINGS: StatusWarning[] = [
  {
    severity: 'critical',
@@ -520,6 +595,7 @@ export async function getStatus(): Promise<Status> {
    can_rollback: armed || hasLastGood,
    engine_running: engine,
    plane,
+    traffic: mockTraffic(plane),
    warnings: mockWarnings(killSwitch),
    // Process uptime. Anchored to when this tab loaded plus a fixed head start, so
    // the reading ticks forward across polls exactly like the real daemon's does.
@@ -1,6 +1,6 @@
 import './DNS.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, CatSuggest, Led, SrcPicker, Toggle } from '../components'
+import { Button, CatSuggest, Led, SrcPicker, Toggle, useConfirm } from '../components'
 import { apply as apiApply, getConfig, putConfig, ApiError } from '../api'
 import type { Alert, DNSRule, Model, Resolver } from '../api'

@@ -220,6 +220,7 @@ function describeDetour(
 // ---- page ------------------------------------------------------------------

 export default function DNS() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<DNSModel | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)

@@ -422,15 +423,19 @@ export default function DNS() {
  )

  const removeBlocklist = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = blocklists[idx]
-      if (!window.confirm(`Delete blocklist “${target.Name}”? This removes it from the config.`))
-        return
+      const ok = await confirm({
+        label: 'Delete blocklist',
+        title: `Delete blocklist “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
      const next = blocklists.filter((_, i) => i !== idx)
      void save({ ...config, Blocklists: next }, `Deleted ${target.Name}`)
    },
-    [config, blocklists, save],
+    [config, blocklists, save, confirm],
  )

  // ---- allowlist mutations --------------------------------------------------
@@ -457,15 +462,19 @@ export default function DNS() {
  )

  const removeAllowlist = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = allowlists[idx]
-      if (!window.confirm(`Delete allowlist “${target.Name}”? This removes it from the config.`))
-        return
+      const ok = await confirm({
+        label: 'Delete allowlist',
+        title: `Delete allowlist “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
      const next = allowlists.filter((_, i) => i !== idx)
      void save({ ...config, Allowlists: next }, `Deleted ${target.Name}`)
    },
-    [config, allowlists, save],
+    [config, allowlists, save, confirm],
  )

  // ---- resolver mutations ---------------------------------------------------
@@ -492,11 +501,15 @@ export default function DNS() {
  )

  const removeResolver = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = resolvers[idx]
-      if (!window.confirm(`Delete resolver “${target.Name}”? This removes it from the config.`))
-        return
+      const ok = await confirm({
+        label: 'Delete resolver',
+        title: `Delete resolver “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
      const next = resolvers.filter((_, i) => i !== idx)
      // Don't leave default/fallback pointing at a resolver that no longer exists.
      const g = { ...config.Globals }
@@ -578,15 +591,19 @@ export default function DNS() {
  )

  const removeDNSRule = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = dnsRules[idx]
-      if (!window.confirm(`Delete this DNS rule? Matching queries fall back to the default resolver.`))
-        return
+      const ok = await confirm({
+        label: 'Delete DNS rule',
+        title: 'Delete this DNS rule?',
+        body: 'Matching queries fall back to the default resolver.',
+      })
+      if (!ok) return
      const next = dnsRules.filter((_, i) => i !== idx)
      void save({ ...config, DNSRules: next }, `Deleted DNS rule → ${target.Resolver}`)
    },
-    [config, dnsRules, save],
+    [config, dnsRules, save, confirm],
  )

  // ---- alert mutations ------------------------------------------------------
@@ -610,14 +627,19 @@ export default function DNS() {
  )

  const removeAlert = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = alerts[idx]
-      if (!window.confirm(`Delete alert “${target.Name}”? This removes it from the config.`)) return
+      const ok = await confirm({
+        label: 'Delete alert',
+        title: `Delete alert “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
      const next = alerts.filter((_, i) => i !== idx)
      void save({ ...config, Alerts: next }, `Deleted ${target.Name}`)
    },
-    [config, alerts, save],
+    [config, alerts, save, confirm],
  )

  const setAlertVia = useCallback(
@@ -138,57 +138,9 @@

 /* inline rename: a quiet pencil affordance beside the name, and the mono input
   it swaps to — in the same sink/groove tone as the domain editors. */
-.dev-rename {
-  flex: none;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 22px;
-  height: 22px;
-  padding: 0;
-  border: 1px solid transparent;
-  border-radius: 5px;
-  background: none;
-  color: var(--faint);
-  font-size: 12px;
-  line-height: 1;
-  cursor: pointer;
-  transition: color 0.15s, background 0.15s, border-color 0.15s;
-}
-.dev-rename:hover:not(:disabled) {
-  color: var(--accent);
-  background: color-mix(in srgb, var(--accent) 12%, transparent);
-}
-.dev-rename:focus-visible {
-  color: var(--accent);
-  border-color: var(--accent);
-  outline: 2px solid var(--accent);
-  outline-offset: 1px;
-}
-.dev-rename:disabled {
-  opacity: 0.5;
-  cursor: default;
-}
-.dev-name-input {
-  min-width: 0;
-  max-width: 24ch;
-  padding: 4px 8px;
-  border: 1px solid var(--accent);
-  border-radius: 6px;
-  background: var(--sink);
-  color: var(--ink);
-  font-size: 13px;
-  font-weight: 600;
-  letter-spacing: 0.01em;
-  box-shadow: 0 1px 2px var(--shadow) inset;
-}
-.dev-name-input:focus-visible {
-  outline: 2px solid var(--accent);
-  outline-offset: 1px;
-}
-.dev-name-input:disabled {
-  opacity: 0.55;
-}
+/* The pencil button and the name input now live in App.css as .inline-rename /
+   .inline-rename-input — Nodes grew the same affordance and the two pages must
+   not drift. */
 .dev-id-l2 {
  display: flex;
  align-items: center;
@@ -1,6 +1,6 @@
 import './Devices.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Module, Toggle } from '../components'
+import { Button, Led, Module, Toggle, useConfirm } from '../components'
 import type { LedVariant } from '../components'
 import { apply as apiApply, getConfig, getDevices, putConfig, ApiError } from '../api'
 import type { Device, DiscoveredDevice, Model } from '../api'
@@ -81,6 +81,7 @@ function networkLabel(row: DeviceRow): string {
 // ---- page ------------------------------------------------------------------

 export default function Devices() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)

@@ -251,17 +252,22 @@ export default function Devices() {
  const nameOf = (row: DeviceRow) => row.cfg?.Name || row.hostname || row.ip || 'device'

  const removeControl = useCallback(
-    (row: DeviceRow) => {
+    async (row: DeviceRow) => {
      if (!config) return
      const devs = asArray(config.Devices)
      const idx = matchDevice(devs, row.mac, row.ip)
      if (idx < 0) return
      const nm = devs[idx].Name || nameOf(row)
-      if (!window.confirm(`Stop managing “${nm}”? Its per-device rules are removed; it falls back to network defaults.`))
-        return
+      const ok = await confirm({
+        label: 'Stop managing device',
+        title: `Stop managing “${nm}”?`,
+        body: 'Its per-device rules are removed; it falls back to network defaults.',
+        confirmLabel: 'Stop managing',
+      })
+      if (!ok) return
      void save({ ...config, Devices: devs.filter((_, i) => i !== idx) }, `Removed control for ${nm}`)
    },
-    [config, save],
+    [config, save, confirm],
  )

  const loading = config === null && loadError === null && devices === null && devError === null
@@ -471,7 +477,7 @@ function DeviceCard({
            {renaming ? (
              <input
                ref={nameInput}
-                className="dev-name-input mono"
+                className="inline-rename-input mono"
                type="text"
                spellCheck={false}
                autoComplete="off"
@@ -497,7 +503,7 @@ function DeviceCard({
                </span>
                <button
                  type="button"
-                  className="dev-rename"
+                  className="inline-rename"
                  onClick={beginRename}
                  disabled={busy}
                  aria-label={`Rename ${name}`}
@@ -1,6 +1,6 @@
 import './Networks.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Select, Toggle } from '../components'
+import { Button, Led, Select, Toggle, useConfirm } from '../components'
 import { apply as apiApply, getConfig, putConfig, ApiError } from '../api'
 import type { Inbound, Interface, Model, Status } from '../api'
 import { isLanNetwork, isWanNetwork, useInterfaces } from '../srcOptions'
@@ -242,6 +242,7 @@ function computeWarnings(inbounds: Inbound[], ifaces: Interface[]): Warning[] {
 // ---- page ------------------------------------------------------------------

 export default function Networks({ status }: { status?: Status | null }) {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)
  const ifaces = useInterfaces()
@@ -392,23 +393,21 @@ export default function Networks({ status }: { status?: Status | null }) {
  )

  const removeInbound = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = inbounds[idx]
-      if (
-        !window.confirm(
-          `Delete inbound “${target.Name}”?${
-            intercepts(target)
-              ? ` ${target.Network || 'Its network'} stops going through the tunnel.`
-              : ''
-          }`,
-        )
-      )
-        return
+      const ok = await confirm({
+        label: 'Delete inbound',
+        title: `Delete inbound “${target.Name}”?`,
+        body: intercepts(target)
+          ? `${target.Network || 'Its network'} stops going through the tunnel.`
+          : undefined,
+      })
+      if (!ok) return
      const next = inbounds.filter((_, i) => i !== idx)
      void save({ ...config, Inbounds: next }, `Deleted ${target.Name}`)
    },
-    [config, inbounds, save],
+    [config, inbounds, save, confirm],
  )

  return (
@@ -727,3 +727,53 @@ select.fp-input {
    width: 9rem;
  }
 }
+
+/* ---- inline node rename ----
+   The pencil / input pair itself is shared (.inline-rename[-input] in App.css);
+   only the row-local sizing and the refusal message live here. A node name is
+   longer than a device name (it carries a protocol and a host), so the field is
+   given more room than the shared 24ch default. */
+.node-name-input {
+  max-width: 32ch;
+  font-family: var(--font-mono);
+  font-size: 12.5px;
+}
+/* Why a rename was refused, pinned under the row it was typed in. Semantic crit:
+   the name did not change, and that must not be mistaken for a saved edit. */
+.row-err {
+  margin: 2px 0 0;
+  font-size: 11.5px;
+  line-height: 1.45;
+  color: var(--crit);
+  max-width: 68ch;
+}
+/* Stated once per subscription bucket: the same rule the locked control in every
+   row carries, so the absent rename is explained before it is looked for. */
+.group-note {
+  margin: 0;
+  padding: 8px 12px;
+  border: 1px solid var(--groove);
+  border-top: 0;
+  background: color-mix(in srgb, var(--sink) 25%, transparent);
+  font-size: 11.5px;
+  line-height: 1.5;
+  color: var(--faint);
+}
+/* The optional name sits beside the link input on a wide row and drops onto its
+   own line when the row can no longer hold both. */
+.add-name {
+  flex: 0 1 22ch;
+  min-width: 12ch;
+}
+.add-row--conf .add-name {
+  flex: none;
+  align-self: stretch;
+}
+@media (max-width: 640px) {
+  .add-row {
+    flex-wrap: wrap;
+  }
+  .add-name {
+    flex: 1 1 100%;
+  }
+}
@@ -2,7 +2,7 @@ import './Nodes.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { ReactNode } from 'react'
 import type { LedVariant } from '../components'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import {
  apply as apiApply,
  getConfig,
@@ -158,6 +158,219 @@ function uniqueName(base: string, taken: Set<string>): string {
  return `${seed}-${i}`
 }

+// ---- node names are identity, not a caption --------------------------------
+//
+// A node's Name IS its sing-box outbound tag and the only thing every reference
+// to it spells: a rule target `node:<name>`, a chain hop, a manual group's member
+// list, a resolver detour, an alert delivery, a subscription fetch detour. Rename
+// the node alone and every one of those points at nothing — and an unresolved
+// target does NOT fall back to the default route, the daemon BLOCKS that traffic.
+// So the rename either carries every reference with it, or it is refused.
+
+/** Reserved outbound tags. A node called this is skipped by the generator entirely. */
+const RESERVED_TAGS = ['direct', 'block']
+
+/**
+ * Prefixes that `model.SplitTarget` reads as a KIND, not as part of a name. A
+ * name starting with one of them makes every bare reference to it ambiguous with
+ * a real `kind:name` reference, so it is refused rather than half-supported.
+ */
+const KIND_PREFIXES = ['node', 'group', 'egress', 'chain', 'direct', 'block']
+
+/** Names are rendered into a line-oriented `uci export`; control chars are stripped there. */
+function hasControlChar(s: string): boolean {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i)
+    if (c < 0x20 || c === 0x7f) return true
+  }
+  return false
+}
+
+/**
+ * Why `name` cannot be a node name here, or null if it can.
+ *
+ * Every rule mirrors something the daemon actually does with the name, not a
+ * house style: reserved tags make generate skip the node; a duplicate makes two
+ * outbounds share a tag and the manager silently keeps the last one; a group of
+ * the same name is dropped by buildGroups ("rename the group"); an
+ * `egress-<name>` collision takes over a real egress outbound; and a control
+ * character is rewritten to a space by sanitizeUCIValue on write, so the saved
+ * name would not be the one you typed.
+ */
+function nodeNameError(
+  raw: string,
+  m: Model | null,
+  self: string | null,
+): string | null {
+  const name = raw.trim()
+  if (!name) return 'A node needs a name.'
+  if (hasControlChar(name))
+    return 'Names can’t contain line breaks or control characters — they’re stripped when the config is written.'
+  if (RESERVED_TAGS.some((t) => t.toLowerCase() === name.toLowerCase()))
+    return `“${name}” is a reserved target name — a node called that is skipped by the engine. Pick another.`
+  const head = name.includes(':') ? name.slice(0, name.indexOf(':')).toLowerCase() : ''
+  if (head && KIND_PREFIXES.includes(head))
+    return `A name starting with “${head}:” reads as a ${head} reference everywhere it’s used. Pick another.`
+  if (!m) return null
+
+  const clash = asArray(m.Nodes).find((n) => n.Name === name && n.Name !== self)
+  if (clash)
+    return clash.FromSub
+      ? `“${name}” is already a node from subscription “${clash.FromSub}”. Two nodes with one name share a single outbound — pick another.`
+      : `“${name}” is already another node. Pick another.`
+  if (asArray(m.Groups).some((g) => g.Name === name))
+    return `A group is already named “${name}”. The engine drops the group when a node takes its name — pick another.`
+  const egressClash = asArray(m.Egresses).find((e) => `egress-${e.Name}` === name)
+  if (egressClash)
+    return `“${name}” is the outbound tag of egress “${egressClash.Name}”. Pick another.`
+  return null
+}
+
+/** One place a node name is written, as a short label for the rename summary. */
+interface NodeRefSite {
+  /** Which section — drives the "N rules, M groups" count. */
+  kind: 'rule' | 'group' | 'chain' | 'resolver' | 'alert' | 'subscription' | 'egress'
+  label: string
+}
+
+/** A target/detour string naming this node in its prefixed form (`node:<name>`). */
+const isNodeRef = (v: string | undefined | null, name: string): boolean =>
+  (v ?? '') === `node:${name}`
+
+/** …or in the bare form the engine also resolves (a group member, a bare hop/target). */
+const isBareRef = (v: string | undefined | null, name: string): boolean => (v ?? '') === name
+
+/**
+ * Every place `name` is written outside the node itself. Both spellings count:
+ * `resolveTarget` falls through to a bare node lookup, and a manual group's
+ * member list is bare by contract.
+ */
+function findNodeReferences(m: Model, name: string): NodeRefSite[] {
+  const out: NodeRefSite[] = []
+  for (const r of asArray(m.Rules)) {
+    if (isNodeRef(r.Target, name) || isBareRef(r.Target, name))
+      out.push({ kind: 'rule', label: `rule “${r.Name}” target` })
+  }
+  for (const g of asArray(m.Groups)) {
+    if (asArray(g.Nodes).some((n) => n === name))
+      out.push({ kind: 'group', label: `group “${g.Name}” member` })
+  }
+  for (const c of asArray(m.Chains)) {
+    if (asArray(c.Hops).some((h) => isNodeRef(h, name) || isBareRef(h, name)))
+      out.push({ kind: 'chain', label: `chain “${c.Name}” hop` })
+  }
+  for (const r of asArray(m.Resolvers)) {
+    if (isNodeRef(r.Detour, name)) out.push({ kind: 'resolver', label: `resolver “${r.Name}” DNS path` })
+  }
+  for (const a of asArray(m.Alerts)) {
+    if (isNodeRef(a.Via, name)) out.push({ kind: 'alert', label: `alert “${a.Name}” delivery` })
+  }
+  for (const s of asArray(m.Subscriptions)) {
+    if (isNodeRef(s.FetchDetour, name))
+      out.push({ kind: 'subscription', label: `subscription “${s.Name}” fetch` })
+  }
+  for (const e of asArray(m.Egresses)) {
+    if (isNodeRef(e.Target, name)) out.push({ kind: 'egress', label: `egress “${e.Name}” target` })
+  }
+  return out
+}
+
+/**
+ * What makes a rename impossible to carry rather than merely wide.
+ *
+ * A BARE reference is just a name; the engine resolves it node-first, then group.
+ * If something else already answers to the old name, we cannot tell which object
+ * a bare reference meant, and rewriting it would move a reference the operator
+ * never pointed at this node. That is a half-done cascade, so the rename is
+ * refused instead — with the collision named, so it can be fixed.
+ */
+function bareAmbiguity(m: Model, name: string): string | null {
+  const group = asArray(m.Groups).find((g) => g.Name === name)
+  if (!group) return null
+  const bare = [
+    ...asArray(m.Rules)
+      .filter((r) => isBareRef(r.Target, name))
+      .map((r) => `rule “${r.Name}”`),
+    ...asArray(m.Chains)
+      .filter((c) => asArray(c.Hops).some((h) => isBareRef(h, name)))
+      .map((c) => `chain “${c.Name}”`),
+  ]
+  if (bare.length === 0) return null
+  return `A group is also named “${name}”, and ${bare.join(', ')} point${bare.length === 1 ? 's' : ''} at that bare name — there is no way to tell which of the two is meant. Rename the group first, then this node.`
+}
+
+/**
+ * Rewrite every reference from `from` to `to`. Returns a NEW Model with only the
+ * touched sections replaced; the Nodes section is the caller's business.
+ *
+ * Bare references are rewritten too — that is the whole point for a manual
+ * group's member list — which is safe only because `bareAmbiguity` has already
+ * refused the one case where a bare name could mean something else.
+ */
+function renameNodeReferences(m: Model, from: string, to: string): Model {
+  if (from === to) return m
+  /** Prefixed-only sites (a detour is never spelled bare). */
+  const pfx = (v: string | undefined) => (isNodeRef(v, from) ? `node:${to}` : v)
+  /** Sites that accept either spelling — each is rewritten in the spelling it already uses. */
+  const either = (v: string | undefined) => {
+    if (isNodeRef(v, from)) return `node:${to}`
+    if (isBareRef(v, from)) return to
+    return v
+  }
+
+  const next: Model = { ...m }
+  if (m.Rules) next.Rules = m.Rules.map((r) => ({ ...r, Target: either(r.Target) }))
+  if (m.Groups)
+    next.Groups = m.Groups.map((g) => ({
+      ...g,
+      Nodes: g.Nodes ? g.Nodes.map((n) => (n === from ? to : n)) : g.Nodes,
+    }))
+  if (m.Chains)
+    next.Chains = m.Chains.map((c) => ({
+      ...c,
+      Hops: c.Hops ? c.Hops.map((h) => either(h) ?? h) : c.Hops,
+    }))
+  if (m.Resolvers) next.Resolvers = m.Resolvers.map((r) => ({ ...r, Detour: pfx(r.Detour) }))
+  if (m.Alerts) next.Alerts = m.Alerts.map((a) => ({ ...a, Via: pfx(a.Via) }))
+  if (m.Subscriptions)
+    next.Subscriptions = m.Subscriptions.map((s) => ({ ...s, FetchDetour: pfx(s.FetchDetour) }))
+  if (m.Egresses) next.Egresses = m.Egresses.map((e) => ({ ...e, Target: pfx(e.Target) }))
+  return next
+}
+
+/** "3 rules, 1 group and 2 chains" — what the rename is about to rewrite. */
+function refSummary(refs: NodeRefSite[]): string {
+  const plural: Record<NodeRefSite['kind'], [string, string]> = {
+    rule: ['rule', 'rules'],
+    group: ['group', 'groups'],
+    chain: ['chain', 'chains'],
+    resolver: ['resolver', 'resolvers'],
+    alert: ['alert', 'alerts'],
+    subscription: ['subscription', 'subscriptions'],
+    egress: ['egress', 'egresses'],
+  }
+  const order: NodeRefSite['kind'][] = [
+    'rule', 'group', 'chain', 'resolver', 'alert', 'subscription', 'egress',
+  ]
+  const parts = order
+    .map((k) => [k, refs.filter((r) => r.kind === k).length] as const)
+    .filter(([, n]) => n > 0)
+    .map(([k, n]) => `${n} ${plural[k][n === 1 ? 0 : 1]}`)
+  if (parts.length === 1) return parts[0]
+  return `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1]}`
+}
+
+/**
+ * The name a rename just committed to, waiting for its row to come back.
+ *
+ * A row is keyed by the node's NAME, so committing a rename unmounts the row and
+ * mounts a different one — carrying the focused element away with it. This baton
+ * survives that remount: the row that reappears under the new name claims it and
+ * puts the keyboard back on its own rename button, instead of dropping the user
+ * on <body> halfway down a list of 300 nodes.
+ */
+let pendingRenameFocus: string | null = null
+
 // A subscription with more than this many nodes starts collapsed so the list
 // doesn't become one endless scroll; an active search overrides it.
 const LARGE_GROUP = 20
@@ -289,6 +502,7 @@ function DetourSelect({
 // ---- page ------------------------------------------------------------------

 export default function Nodes() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)

@@ -385,6 +599,9 @@ export default function Nodes() {
  const [nodeInput, setNodeInput] = useState('')
  const [nodeErr, setNodeErr] = useState<string | null>(null)
  const [addMode, setAddMode] = useState<'link' | 'conf'>('link')
+  // Optional. Empty keeps the old behaviour (a name derived from the server
+  // address), so "paste a link, press Add" stays a two-step path.
+  const [nodeName, setNodeName] = useState('')
  const [importing, setImporting] = useState(false)

  // ---- node search + collapsible grouping -----------------------------------
@@ -445,8 +662,12 @@ export default function Nodes() {
      try {
        const { uri, name } = await importWg(conf)
        const taken = new Set(nodes.map((n) => n.Name))
+        // A typed name is used AS TYPED — uniqueName would silently turn a
+        // collision into "name-2", which is the confusion this field exists to
+        // end. It is validated instead, and a clash is refused out loud above.
+        const wanted = nodeName.trim()
        const node: NodeCfg = {
-          Name: uniqueName(name || 'wireguard', taken),
+          Name: wanted || uniqueName(name || 'wireguard', taken),
          Enabled: true,
          URI: uri,
          FromSub: '',
@@ -455,6 +676,7 @@ export default function Nodes() {
        const ok = await save({ ...config, Nodes: [...nodes, node] }, `Added ${node.Name}`)
        if (ok) {
          setNodeInput('')
+          setNodeName('')
          setAddMode('link')
        }
      } catch (e) {
@@ -463,11 +685,20 @@ export default function Nodes() {
        setImporting(false)
      }
    },
-    [config, nodes, save, flash],
+    [config, nodes, nodeName, save, flash],
  )

  const addNode = useCallback(async () => {
    if (!config) return
+    // The name is checked BEFORE the import round-trip, so a bad name costs
+    // nothing and the message lands in the form next to the field.
+    if (nodeName.trim()) {
+      const bad = nodeNameError(nodeName, config, null)
+      if (bad) {
+        setNodeErr(bad)
+        return
+      }
+    }
    // Auto-detect a pasted config, whichever input it landed in.
    if (nodeInput.includes(WG_MARKER)) {
      await addWgConf(nodeInput)
@@ -486,10 +717,20 @@ export default function Nodes() {
    const parsed = parseShareLink(uri)
    const taken = new Set(nodes.map((n) => n.Name))
    const base = parsed.suggested || `${parsed.proto.toLowerCase()}-${parsed.host}`.replace(/[^\w.:-]+/g, '-')
-    const node: NodeCfg = { Name: uniqueName(base, taken), Enabled: true, URI: uri, FromSub: '', Egress: '' }
+    const wanted = nodeName.trim()
+    const node: NodeCfg = {
+      Name: wanted || uniqueName(base, taken),
+      Enabled: true,
+      URI: uri,
+      FromSub: '',
+      Egress: '',
+    }
    const ok = await save({ ...config, Nodes: [...nodes, node] }, `Added ${node.Name}`)
-    if (ok) setNodeInput('')
-  }, [config, nodeInput, nodes, save, addMode, addWgConf])
+    if (ok) {
+      setNodeInput('')
+      setNodeName('')
+    }
+  }, [config, nodeInput, nodeName, nodes, save, addMode, addWgConf])

  const toggleNode = useCallback(
    (idx: number, on: boolean) => {
@@ -501,14 +742,88 @@ export default function Nodes() {
  )

  const removeNode = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = nodes[idx]
-      if (!window.confirm(`Delete node “${target.Name}”? This removes it from the config.`)) return
+      const ok = await confirm({
+        label: 'Delete node',
+        title: `Delete node “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
      const next = nodes.filter((_, i) => i !== idx)
      void save({ ...config, Nodes: next }, `Deleted ${target.Name}`)
    },
-    [config, nodes, save],
+    [config, nodes, save, confirm],
+  )
+
+  /**
+   * Rename a manual node, carrying every reference with it.
+   *
+   * The name is this node's identity: its outbound tag, and the exact string a
+   * rule target, a chain hop, a manual group's member list, a resolver detour, an
+   * alert delivery and a subscription fetch detour all spell. So the rename is one
+   * atomic save of the Nodes section AND every referencing section, or it does not
+   * happen at all:
+   *
+   *   - an invalid or colliding name is refused with the reason (`nodeNameError`);
+   *   - a name a GROUP also answers to, with bare references pointing at it, is
+   *     refused too — there is no way to know which object those meant, and
+   *     guessing would move a reference the operator never pointed here;
+   *   - anything else is shown exactly what it will rewrite, and only then saved.
+   *
+   * Errors surface through `onError` so they land in the row that was edited.
+   */
+  const renameNode = useCallback(
+    async (idx: number, raw: string, onError: (msg: string) => void): Promise<boolean> => {
+      if (!config) return false
+      const target = nodes[idx]
+      const from = target.Name
+      const to = raw.trim()
+      if (to === from) return true
+      // Subscription names come back from the feed on the next update; renaming
+      // one would be undone without warning, so this path is manual-only.
+      if (target.FromSub) {
+        onError(`“${from}” is named by subscription “${target.FromSub}” — the feed rewrites it on the next update.`)
+        return false
+      }
+      const bad = nodeNameError(to, config, from)
+      if (bad) {
+        onError(bad)
+        return false
+      }
+      const blocked = bareAmbiguity(config, from)
+      if (blocked) {
+        onError(blocked)
+        return false
+      }
+
+      const refs = findNodeReferences(config, from)
+      if (refs.length > 0) {
+        const shown = refs.slice(0, 4).map((r) => r.label)
+        const more = refs.length - shown.length
+        const ok = await confirm({
+          tone: 'neutral',
+          label: 'Rename node',
+          title: `Rename “${from}” to “${to}”?`,
+          body: `This also updates ${refSummary(refs)} that point at it — ${shown.join(', ')}${more > 0 ? `, and ${more} more` : ''}. They are saved together, so nothing is left pointing at the old name.`,
+          confirmLabel: 'Rename',
+        })
+        if (!ok) return false
+      }
+
+      // One PUT: the node and every reference move in the same write, so no
+      // intermediate state exists where a reference dangles.
+      const carried = renameNodeReferences(config, from, to)
+      const next = asArray(carried.Nodes).map((n, i) => (i === idx ? { ...n, Name: to } : n))
+      return save(
+        { ...carried, Nodes: next },
+        refs.length > 0
+          ? `Renamed to ${to} — updated ${refs.length} reference${refs.length === 1 ? '' : 's'}`
+          : `Renamed to ${to}`,
+      )
+    },
+    [config, nodes, save, confirm],
  )

  // Pin (or clear) one node's dial egress. Same optimistic save→apply path as
@@ -563,16 +878,20 @@ export default function Nodes() {
  )

  const removeSub = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
      if (!config) return
      const target = subs[idx]
      const hasCache = nodes.some((n) => n.FromSub === target.Name)
-      const extra = hasCache ? ' Its cached nodes stay until you next apply.' : ''
-      if (!window.confirm(`Delete subscription “${target.Name}”?${extra}`)) return
+      const ok = await confirm({
+        label: 'Delete subscription',
+        title: `Delete subscription “${target.Name}”?`,
+        body: hasCache ? 'Its cached nodes stay until you next apply.' : undefined,
+      })
+      if (!ok) return
      const next = subs.filter((_, i) => i !== idx)
      void save({ ...config, Subscriptions: next }, `Deleted ${target.Name}`)
    },
-    [config, subs, nodes, save],
+    [config, subs, nodes, save, confirm],
  )

  // Commit an options edit for one subscription. The editor hands back a fully
@@ -736,6 +1055,20 @@ export default function Nodes() {
                disabled={busy || importing || !config}
              />
            )}
+            <input
+              className="fp-input add-name"
+              type="text"
+              spellCheck={false}
+              autoComplete="off"
+              placeholder="Name (optional)"
+              aria-label="Node name — optional"
+              value={nodeName}
+              onChange={(e) => {
+                setNodeName(e.target.value)
+                if (nodeErr) setNodeErr(null)
+              }}
+              disabled={busy || importing || !config}
+            />
            <Button type="submit" variant="primary" disabled={busy || importing || !config}>
              {importing ? 'Importing…' : saving ? 'Saving…' : addMode === 'conf' ? 'Import' : 'Add node'}
            </Button>
@@ -743,7 +1076,8 @@ export default function Nodes() {
          <p className="add-hint">
            {addMode === 'conf'
              ? 'Paste a wg-quick / AmneziaWG .conf — it starts with [Interface].'
-              : 'vless://, ss://, trojan://, hysteria2://… A pasted [Interface] config is imported automatically.'}
+              : 'vless://, ss://, trojan://, hysteria2://… A pasted [Interface] config is imported automatically.'}{' '}
+            Leave the name empty and it’s taken from the server address; you can rename it later.
          </p>
        </div>
        {nodeErr && (
@@ -800,6 +1134,7 @@ export default function Nodes() {
                onToggle={() => toggleGroup(g)}
                onToggleNode={toggleNode}
                onRemoveNode={removeNode}
+                onRenameNode={renameNode}
                onSetEgress={setNodeEgress}
              />
            ))}
@@ -911,6 +1246,7 @@ function NodeGroup({
  onToggle,
  onToggleNode,
  onRemoveNode,
+  onRenameNode,
  onSetEgress,
 }: {
  group: NodeGroupData
@@ -920,6 +1256,7 @@ function NodeGroup({
  onToggle: () => void
  onToggleNode: (idx: number, on: boolean) => void
  onRemoveNode: (idx: number) => void
+  onRenameNode: (idx: number, name: string, onError: (msg: string) => void) => Promise<boolean>
  onSetEgress: (idx: number, egress: string) => Promise<boolean>
 }) {
  const panelId = `node-group-${group.key || 'manual'}`
@@ -940,6 +1277,12 @@ function NodeGroup({
          <span className="group-count mono">{count}</span>
        </button>
      </h3>
+      {open && group.key !== '' && (
+        <p className="group-note">
+          Names come from the subscription feed and are rewritten on every update, so nodes in this
+          list can’t be renamed here.
+        </p>
+      )}
      {open && (
        <ul id={panelId} className="rows-list group-rows">
          {group.items.map(({ node, idx }) => (
@@ -950,6 +1293,7 @@ function NodeGroup({
              egressNames={egressNames}
              onToggle={(on) => onToggleNode(idx, on)}
              onDelete={() => onRemoveNode(idx)}
+              onRename={(name, onError) => onRenameNode(idx, name, onError)}
              onSetEgress={(egress) => onSetEgress(idx, egress)}
            />
          ))}
@@ -965,6 +1309,7 @@ function NodeRow({
  egressNames,
  onToggle,
  onDelete,
+  onRename,
  onSetEgress,
 }: {
  node: NodeCfg
@@ -972,6 +1317,7 @@ function NodeRow({
  egressNames: string[]
  onToggle: (on: boolean) => void
  onDelete: () => void
+  onRename: (name: string, onError: (msg: string) => void) => Promise<boolean>
  onSetEgress: (egress: string) => Promise<boolean>
 }) {
  const { proto, host, hasCreds } = useMemo(() => parseShareLink(node.URI), [node.URI])
@@ -982,6 +1328,68 @@ function NodeRow({
  const [open, setOpen] = useState(false)
  const panelId = `node-egress-${node.FromSub || 'manual'}-${node.Name}`

+  // ---- inline rename (same interaction as a device row) ---------------------
+  // Enter commits, Esc cancels, blur commits; a ref-guard keeps Esc-then-blur
+  // from committing twice. Unlike a device, the commit can be REFUSED (a name
+  // collision, or references that can't be carried), so the input stays open
+  // with the reason under it instead of closing on a change that never happened.
+  const [renaming, setRenaming] = useState(false)
+  const [draft, setDraft] = useState(node.Name)
+  const [renameErr, setRenameErr] = useState<string | null>(null)
+  const nameInput = useRef<HTMLInputElement>(null)
+  const renameBtn = useRef<HTMLButtonElement>(null)
+  const finished = useRef(false)
+
+  const beginRename = () => {
+    setDraft(node.Name)
+    setRenameErr(null)
+    finished.current = false
+    setRenaming(true)
+  }
+  const finishRename = async (commit: boolean) => {
+    if (finished.current) return
+    finished.current = true
+    const nm = draft.trim()
+    if (!commit || !nm || nm === node.Name) {
+      setRenaming(false)
+      setRenameErr(null)
+      return
+    }
+    // Armed BEFORE the save: the renamed row remounts the moment the config
+    // state lands, which is before this await resolves. Arming afterwards would
+    // always miss it.
+    pendingRenameFocus = nm
+    const ok = await onRename(nm, (msg) => setRenameErr(msg))
+    if (ok) {
+      setRenaming(false)
+      setRenameErr(null)
+    } else {
+      if (pendingRenameFocus === nm) pendingRenameFocus = null
+      // Refused — hold the field open on the rejected text so it can be fixed.
+      finished.current = false
+      nameInput.current?.focus()
+    }
+  }
+
+  useEffect(() => {
+    if (renaming) {
+      nameInput.current?.focus()
+      nameInput.current?.select()
+    }
+  }, [renaming])
+
+  // Claim the baton if this row is the one the rename produced. The row remounts
+  // while the PUT is still in flight, so on that first pass the button is still
+  // disabled and focus() would be a silent no-op — the baton is held until the
+  // save settles and this effect re-runs with a focusable button.
+  useEffect(() => {
+    if (pendingRenameFocus !== node.Name) return
+    const btn = renameBtn.current
+    if (!btn || btn.disabled) return
+    pendingRenameFocus = null
+    btn.focus()
+  }, [node.Name, busy])
+
  return (
    <li className={`row-item node-row${open ? ' node-row--open' : ''}`}>
      <div className="row-head">
@@ -993,10 +1401,73 @@ function NodeRow({
        />
        <div className="row-main">
          <div className="row-line1">
-            <span className="row-name">{node.Name}</span>
+            {renaming ? (
+              <input
+                ref={nameInput}
+                className="inline-rename-input node-name-input mono"
+                type="text"
+                spellCheck={false}
+                autoComplete="off"
+                value={draft}
+                aria-label={`Rename node ${node.Name}`}
+                aria-invalid={renameErr ? true : undefined}
+                onChange={(e) => {
+                  setDraft(e.target.value)
+                  if (renameErr) setRenameErr(null)
+                }}
+                onBlur={() => void finishRename(true)}
+                onKeyDown={(e) => {
+                  if (e.key === 'Enter') {
+                    e.preventDefault()
+                    void finishRename(true)
+                  } else if (e.key === 'Escape') {
+                    e.preventDefault()
+                    void finishRename(false)
+                  }
+                }}
+                disabled={busy}
+              />
+            ) : (
+              <>
+                <span className="row-name" title={node.Name}>
+                  {node.Name}
+                </span>
+                {managed ? (
+                  // Not hidden — withheld, with the reason attached. A control
+                  // that quietly isn't there reads as a bug; this one states the
+                  // rule, and the same sentence is on the group header above.
+                  <button
+                    type="button"
+                    className="inline-rename inline-rename--locked"
+                    disabled
+                    aria-label={`Can’t rename ${node.Name} — its name comes from subscription “${node.FromSub}” and is rewritten on the next update`}
+                    title={`Named by subscription “${node.FromSub}” — the feed rewrites this name on the next update. Rename it in the subscription, or add the node manually.`}
+                  >
+                    🔒
+                  </button>
+                ) : (
+                  <button
+                    ref={renameBtn}
+                    type="button"
+                    className="inline-rename"
+                    onClick={beginRename}
+                    disabled={busy}
+                    aria-label={`Rename node ${node.Name}`}
+                    title="Rename"
+                  >
+                    ✎
+                  </button>
+                )}
+              </>
+            )}
            <span className="badge">{proto}</span>
            {node.Stale && <span className="badge badge--warn">stale</span>}
          </div>
+          {renameErr && (
+            <p className="row-err" role="alert">
+              {renameErr}
+            </p>
+          )}
          <div className="row-line2 mono">
            <span className="row-host">{host}</span>
            {hasCreds && (
@@ -341,7 +341,7 @@ export function Overview({
          led={{ variant: len(config?.Rules) ? 'on' : 'amber' }}
          rows={[
            { k: 'egresses', v: String(len(config?.Egresses)) },
-            { k: 'default', v: defaultTarget(config), hot: true },
+            { k: 'default', v: defaultTarget(status, config), hot: true },
          ]}
        />

@@ -563,12 +563,20 @@ const NAV_LABEL: Record<Route, string> = {
 // for the apply/rollback flow, where the individual flags are the actual
 // subject of the page.)

-function defaultTarget(config: Model | null): string {
-  const rules = config?.Rules ?? []
-  if (rules.length === 0) return '—'
-  // The highest Order enabled rule is the effective catch-all.
-  const enabled = rules.filter((r) => r.Enabled)
-  if (enabled.length === 0) return 'none'
-  const last = enabled.reduce((a, b) => (b.Order >= a.Order ? b : a))
-  return last.Target || last.Egress || last.Name
+/** Where everything not matched by a rule goes — the engine's route `final`.
+ *
+ *  Taken from the daemon (status.traffic.default), which reads it off the config
+ *  it is running. The guess this replaced was "the highest-Order enabled rule",
+ *  and that is not what the default is: a rule only becomes the default by having
+ *  NO conditions at all, whatever its Order (model.IsCatchAll), so a specific
+ *  high-Order rule was routinely printed here as the router's default. It also
+ *  described the config on disk rather than the one running, and could not see a
+ *  target that failed to resolve and fell back.
+ *
+ *  Falls back to the rule count only when the daemon has not reported — never to
+ *  a guess about where traffic goes. */
+function defaultTarget(status: Status | null, config: Model | null): string {
+  const d = status?.traffic?.default
+  if (d) return d
+  return len(config?.Rules) === 0 ? '—' : 'not reported'
 }
@@ -1,6 +1,6 @@
 import './Profiles.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import { apply as apiApply, getConfig, getInterfaces, putConfig, ApiError } from '../api'
 import type { Interface, Model, Profile } from '../api'

@@ -36,6 +36,7 @@ function namesOf(v: unknown): string[] {
 // ---- page ------------------------------------------------------------------

 export default function Profiles() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)

@@ -192,9 +193,14 @@ export default function Profiles() {
  )

  const deleteProfile = useCallback(
-    (name: string) => {
+    async (name: string) => {
      if (!config) return
-      if (!window.confirm(`Delete profile “${name}”? Its overrides stop applying.`)) return
+      const ok = await confirm({
+        label: 'Delete profile',
+        title: `Delete profile “${name}”?`,
+        body: 'Its overrides stop applying.',
+      })
+      if (!ok) return
      const next = profiles.filter((p) => p.Name !== name)
      const g =
        config.Globals.ActiveProfile === name
@@ -202,7 +208,7 @@ export default function Profiles() {
          : config.Globals
      void save({ ...config, Profiles: next, Globals: g }, `Deleted ${name}`)
    },
-    [config, profiles, save],
+    [config, profiles, save, confirm],
  )

  // ---- expansion (only one profile editor open at a time) -------------------
@@ -58,6 +58,45 @@
  color: var(--ink);
 }

+/* ---- active-profile banner ----
+ *
+ * Deliberately NOT the accent plate the save→apply bar wears above. Orange is
+ * "there is something for you to do" on this faceplate, and an active WAN profile
+ * is a standing condition, not a pending action. A quiet plate with an amber tag
+ * reads as "note the state" — and it is the SAME amber the overridden rows below
+ * carry, so the banner and its rows are visibly one story rather than two
+ * unrelated oddities. */
+.rt-prof-banner {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  margin: 0 0 calc(var(--u, 8px) * 2.5);
+  padding: 10px 14px;
+  border: 1px solid color-mix(in srgb, var(--amber) 35%, var(--groove));
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--amber) 7%, transparent);
+  font-family: var(--font-sans);
+  font-size: 12px;
+  line-height: 1.55;
+  color: var(--dim);
+}
+.rt-prof-banner strong {
+  color: var(--ink);
+  font-weight: 600;
+}
+.rt-prof-tag {
+  flex: none;
+  margin-top: 1px;
+  padding: 2px 7px;
+  border: 1px solid color-mix(in srgb, var(--amber) 55%, var(--groove));
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--amber) 12%, transparent);
+  font-size: 9px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  color: var(--amber);
+}
+
 /* ---- empty state ---- */
 .rt-empty {
  padding: calc(var(--u, 8px) * 4) 0 calc(var(--u, 8px) * 3);
@@ -289,6 +328,51 @@
  opacity: 0.62;
 }

+/* ---- a rule the active WAN profile overrides ----
+ *
+ * The row itself needs no new paint: an overridden-off rule already wears `.off`
+ * (it is off, whatever its switch says) and an overridden-on rule wears nothing
+ * (it is on). What was missing was never colour — it was the sentence naming who
+ * decided. So this is the per-row twin of the banner and borrows .rt-dead-note's
+ * type wholesale: same voice, same size, one <p> margin to reset. */
+/* The same pill as .rt-badge.dead, so the two override states read as one pair,
+ * but in accent — a rule the profile forces ON is active, and active is orange on
+ * this faceplate. The pill is also what keeps it from running into the plain
+ * "default route · final" badge beside it, where "final on · by profile" read as
+ * one phrase. */
+.rt-badge.prof-on {
+  padding: 1px 7px;
+  border: 1px solid var(--accent-soft);
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--accent) 10%, transparent);
+}
+
+.rt-prof-note {
+  margin: 0;
+}
+.rt-prof-note strong {
+  color: var(--ink);
+  font-weight: 600;
+}
+
+/* Switch + its legend. The caption shows ONLY while a profile overrides the rule,
+ * and it is what keeps the control honest: the plate says what the router is
+ * doing, this says the switch is about the saved setting. A legend under the
+ * control it names is the faceplate's own idiom. */
+.rt-switch {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 3px;
+}
+.rt-switch-note {
+  font-family: var(--font-mono);
+  font-size: 8.5px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+
 /* ---- target chip (styled like the artifact's group:auto mono chips) ---- */
 .rt-target {
  display: inline-flex;
@@ -396,9 +480,6 @@
  gap: 5px;
  min-width: 0;
 }
-.rt-field-wide {
-  grid-column: span 2;
-}
 .rt-flabel {
  font-family: var(--font-mono);
  font-size: 9px;
@@ -515,6 +596,8 @@ select.rt-input {
  border-color: var(--accent);
  box-shadow: 0 1px 0 var(--edge) inset, 0 0 0 1px var(--accent-soft);
 }
+/* "no matchers" flag in the plate foot — shared by BOTH rule forms (add and
+ * edit), so the same non-blocking warning reads identically in either. */
 .rt-edit-warn {
  font-family: var(--font-mono);
  font-size: 11.5px;
@@ -837,9 +920,6 @@ select.rt-input {
    justify-content: flex-start;
    align-self: start;
  }
-  .rt-field-wide {
-    grid-column: auto;
-  }
  .rt-rs-row {
    grid-template-columns: 1fr;
    row-gap: 10px;
@@ -1,7 +1,7 @@
 import './Routing.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
-import { Button, CatSuggest, SrcPicker, Toggle } from '../components'
+import { Button, CatSuggest, SrcPicker, Toggle, useConfirm } from '../components'
 import {
  apply as apiApply,
  getConfig,
@@ -22,9 +22,7 @@ import type { Model, Rule, RuleReach, Ruleset, RulesetStatus } from '../api'
 // ---------------------------------------------------------------------------
 type RRule = Rule & {
  Src?: string[] | null
-  DstDomain?: string[] | null
  DstRuleset?: string[] | null
-  DstIP?: string[] | null
  DstPort?: string
  Proto?: string
  Kill?: string
@@ -35,6 +33,29 @@ type RRule = Rule & {
  // Minutes east of UTC anchoring the schedule's wall-clock times; captured
  // from the editing browser on save (the router has no tzdata). 0 ⇒ UTC.
  SchedUTCOffset?: number
+  // The daemon's unmigrated-rule tripwire (model.Rule.LegacyDst), read-only here.
+  // Non-empty ⇒ the config STILL carries the schema-v1 `dst_domain`/`dst_ip` that
+  // schema v2 removed, i.e. `shaterd migrate` never ran or could not commit. Each
+  // element is the raw `<option>=<value>` text so the panel can quote what was
+  // found. The daemon holds such a rule disabled; the panel only reports it (it
+  // is never rendered back to UCI, so a config write from here drains it out).
+  // Field name is the Go one: model.Rule has no json tags.
+  LegacyDst?: string[] | null
+}
+
+/**
+ * Whether a rule is in force, kept strictly apart from whether it is switched on.
+ *
+ * `on` is the EFFECTIVE state — what the router is actually doing — and every mark
+ * on the row is drawn from it. `profile`/`dir` are set only when the active WAN
+ * profile is the reason the two differ, so the row can name who overrode the
+ * saved setting instead of leaving the operator to guess why a switch that reads
+ * "on" routes nothing.
+ */
+type RuleForce = {
+  on: boolean
+  profile: string | null
+  dir: 'enabled' | 'disabled' | null
 }

 /**
@@ -97,7 +118,6 @@ function ProtoOptions({ value }: { value: string }) {

 const len = (a: unknown[] | null | undefined): number => (a ? a.length : 0)
 const byOrder = (a: RRule, b: RRule): number => a.Order - b.Order
-const csv = (s: string): string[] => s.split(',').map((x) => x.trim()).filter(Boolean)

 // --- ruleset helpers --------------------------------------------------------
 // A `config ruleset` (api.ts Ruleset) is a named domain/ipcidr list a rule
@@ -213,18 +233,59 @@ function everyLabel(sec: number): string {
  return `every ${sec}s`
 }

-/** A rule with no matcher of any kind is the effective catch-all (route Final). */
+/** A rule with no matcher of any kind is the effective catch-all (route Final).
+ *  Mirrors model.IsCatchAll on the daemon side — the two must agree or the
+ *  "never applies" badge lands on a different row than the apply warning.
+ *
+ *  AN UNMIGRATED RULE IS NEVER A CATCH-ALL, and that is the first thing checked
+ *  here, exactly as on the Go side (model/reachability.go). When LegacyDst is
+ *  non-empty the rule's destination is still written in the schema-v1 options
+ *  the parser no longer reads, so its lack of matchers means "the destination is
+ *  unreadable", not "matches everything" — reading it the other way is precisely
+ *  what turned an uncommitted `shaterd migrate` into route Final for the whole
+ *  router. The daemon holds such a rule disabled and reports false here; if this
+ *  copy disagreed, the panel would paint the row "default route · final" while
+ *  the daemon routes nothing through it. */
 function isCatchAll(r: RRule): boolean {
+  if (len(r.LegacyDst) > 0) return false
  return (
    len(r.Src) === 0 &&
-    len(r.DstDomain) === 0 &&
    len(r.DstRuleset) === 0 &&
-    len(r.DstIP) === 0 &&
    !(r.DstPort && r.DstPort.trim()) &&
    !(r.Proto && r.Proto.trim())
  )
 }

+/** isCatchAll's twin for a form still being edited: the live fields of either
+ *  rule form with no matcher left in them.
+ *
+ *  Such a rule is not "matches all" in the ordinary sense — the engine emits it
+ *  as route.Final, and among several the LAST one in rule order owns it. So what
+ *  saving one actually does depends on what is last right now, and there are
+ *  three cases:
+ *    - no rules at all, or the last rule is a conditional one → the new rule
+ *      lands last and TAKES the default, silently retargeting every otherwise
+ *      unmatched flow (e.g. the whole LAN to `direct`, past the tunnel);
+ *    - the last rule is already a catch-all → nextOrder() deliberately inserts
+ *      the new one BEFORE it (and bumps the old one up), so the existing default
+ *      keeps route.Final and the new rule is dead on arrival — the daemon
+ *      reports it as shadowed and the row renders as such.
+ *  Both outcomes are worth a warning, and neither form knows which it will be
+ *  (the add form has no rule list), so the shared text says only what is certain:
+ *  the rule has no matchers. It is a legal configuration either way, so neither
+ *  form blocks it — they warn, from this one predicate, so the flag cannot drift
+ *  out of sync between add and edit. */
+function formHasNoMatchers(f: {
+  src: string[]
+  port: string
+  rulesets: string[]
+  proto: string
+}): boolean {
+  return (
+    f.src.length === 0 && f.port.trim() === '' && f.rulesets.length === 0 && f.proto.trim() === ''
+  )
+}
+
 /** Effective routing target for a rule (Target wins; a bare Egress is a target too). */
 function effectiveTarget(r: RRule): string {
  if (r.Target && r.Target.trim()) return r.Target.trim()
@@ -263,16 +324,19 @@ interface TargetGroups {
  nodes: TargetOpt[] // node:<n> (huge — rendered last)
 }

-// Free-text destination matchers offered by the ADD form. Domains are NOT one of
-// them (the user's call): domain matching goes through named rulesets — that's
-// what they exist for. 'none' = the rule matches by rulesets/source/proto alone.
-// (Legacy rules that already carry DstDomain stay editable in the edit form.)
-type MatchKind = 'none' | 'ip' | 'port'
+// The add form's fields. WHERE traffic is going is a ruleset choice and nothing
+// else — a rule has no inline domain or address list any more, so the old
+// Match-kind picker (rulesets / ip / port) collapsed into a plain Port field
+// beside the ruleset picker. The cost is real and accepted: routing a single
+// domain is no longer done here — you leave for the Rulesets panel, create the
+// list, fill it, and come back to check it. A "create a list from here" shortcut
+// was proposed and rejected (DECISIONS.md D21): a second place to author a list
+// is a second place for its entry semantics and duplicate-name rules to drift,
+// which is the exact thing D21 removed.
 interface AddForm {
  name: string
  src: string[]
-  matchKind: MatchKind
-  matchValue: string
+  port: string
  rulesets: string[]
  proto: string
  target: string
@@ -284,8 +348,7 @@ interface AddForm {
 const EMPTY_FORM: AddForm = {
  name: '',
  src: [],
-  matchKind: 'none',
-  matchValue: '',
+  port: '',
  rulesets: [],
  proto: '',
  target: 'direct',
@@ -318,6 +381,7 @@ const browserTZName = (): string => {
 }

 export default function Routing() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)
  const [actionError, setActionError] = useState<string | null>(null)
@@ -435,7 +499,7 @@ export default function Routing() {
  }, [config])

  /**
-   * The verdict for one rule, or null when it can fire.
+   * The daemon's verdict for one rule, or null when we have none that describes it.
   *
   * Verdicts are fetched separately from the config, so between an optimistic edit
   * and the refetch they can describe the PREVIOUS rule list. Re-checking the
@@ -443,18 +507,53 @@ export default function Routing() {
   * badge on a working rule: a mismatch means the verdict is not about this row,
   * and no badge is the honest answer.
   */
-  const shadowOf = useCallback(
-    (r: RRule): { by: string; byOrder: number; reason: string } | null => {
+  const verdictOf = useCallback(
+    (r: RRule): RuleReach | null => {
      const i = modelIndex.get(r)
      if (i === undefined) return null
      const v = reach.get(i)
-      if (!v || !v.unreachable || !v.shadowed_by) return null
-      if (v.name !== r.Name || v.order !== r.Order) return null
-      return { by: v.shadowed_by, byOrder: v.shadowed_by_order ?? 0, reason: v.reason ?? '' }
+      if (!v || v.name !== r.Name || v.order !== r.Order) return null
+      return v
    },
    [modelIndex, reach],
  )

+  const shadowOf = useCallback(
+    (r: RRule): { by: string; byOrder: number; reason: string } | null => {
+      const v = verdictOf(r)
+      if (!v || !v.unreachable || !v.shadowed_by) return null
+      return { by: v.shadowed_by, byOrder: v.shadowed_by_order ?? 0, reason: v.reason ?? '' }
+    },
+    [verdictOf],
+  )
+
+  /**
+   * Whether a rule is IN FORCE, and who decided that — the two states this page
+   * used to conflate.
+   *
+   * `Rule.Enabled` from /api/config is the DESIRED state: what the operator saved,
+   * what the switch edits, what gets PUT back. The active WAN profile can override
+   * it in either direction, and then the desired state is no longer what the router
+   * is doing. Drawing the row from `Enabled` is what let a config with two rules
+   * `enabled '1'` show two live switches while the engine ran one chain.
+   *
+   * With no verdict — an older daemon, a stopped one, or one still describing the
+   * previous config — the desired state is all we know, so the row falls back to it
+   * and claims no profile rather than inventing one. The `typeof` guard is for the
+   * older daemon specifically: it answers without `effective_enabled` at all, and
+   * reading `undefined` as false would gray out every rule on the page.
+   */
+  const forceOf = useCallback(
+    (r: RRule): RuleForce => {
+      const v = verdictOf(r)
+      if (!v || typeof v.effective_enabled !== 'boolean') {
+        return { on: !!r.Enabled, profile: null, dir: null }
+      }
+      return { on: v.effective_enabled, profile: v.overridden_by ?? null, dir: v.override ?? null }
+    },
+    [verdictOf],
+  )
+
  // Rulesets are named domain/IP lists rules match against (rule.DstRuleset).
  const rulesets = useMemo<Ruleset[]>(
    () => [...((config?.Rulesets as Ruleset[] | null | undefined) ?? [])],
@@ -555,13 +654,17 @@ export default function Routing() {
  // Delete the ruleset AND strip its name from any rule that referenced it, so no
  // rule is left pointing at a matcher that no longer exists (one atomic persist).
  const deleteRuleset = useCallback(
-    (name: string) => {
+    async (name: string) => {
      if (!config) return
      const used = rulesetUsage.get(name) ?? 0
-      const warn = used
-        ? `Delete ruleset "${name}"? It'll be removed from ${used} rule${used === 1 ? '' : 's'} that match it.`
-        : `Delete ruleset "${name}"?`
-      if (!window.confirm(warn)) return
+      const ok = await confirm({
+        label: 'Delete ruleset',
+        title: `Delete ruleset "${name}"?`,
+        body: used
+          ? `It'll be removed from ${used} rule${used === 1 ? '' : 's'} that match it.`
+          : undefined,
+      })
+      if (!ok) return
      const nextRulesets = rulesets.filter((r) => r.Name !== name)
      const nextRules = rules.map((r) => {
        const cur = r.DstRuleset ?? []
@@ -572,7 +675,7 @@ export default function Routing() {
        `ruleset ${name} deleted`,
      )
    },
-    [config, rules, rulesets, rulesetUsage, persist],
+    [config, rules, rulesets, rulesetUsage, persist, confirm],
  )

  const onToggle = useCallback(
@@ -612,17 +715,26 @@ export default function Routing() {
  )

  const onDelete = useCallback(
-    (name: string) => {
-      if (!window.confirm(`Delete rule "${name}"? Traffic it matched will fall through to the next rule.`)) return
+    async (name: string) => {
+      const ok = await confirm({
+        label: 'Delete rule',
+        title: `Delete rule "${name}"?`,
+        body: 'Traffic it matched will fall through to the next rule.',
+      })
+      if (!ok) return
      commitRules(
        rules.filter((r) => r.Name !== name),
        `${name} deleted`,
      )
    },
-    [rules, commitRules],
+    [rules, commitRules, confirm],
  )

  // Insert a new rule just above the catch-all (so a specific rule can actually match).
+  // isCatchAll() is false for an unmigrated rule, which is the right answer here too:
+  // such a rule is held disabled and owns no default route, so there is nothing to
+  // insert ahead of — the new rule simply goes last, where a rule with no matchers
+  // does become the default.
  const nextOrder = useCallback((): { order: number; bumpCatchAll?: { name: string; order: number } } => {
    if (rules.length === 0) return { order: 10 }
    const last = rules[rules.length - 1]
@@ -674,18 +786,15 @@ export default function Routing() {
        return
      }
      setFormError(null)
-      const mv = form.matchValue.trim()
      const rule: RRule = {
        Name: name,
        Enabled: true,
        Order: 0,
        Src: form.src,
-        // Domains are matched via rulesets only — the add form has no free-text
-        // domain matcher by design.
-        DstDomain: [],
+        // Destination = rulesets, always. Domains and addresses live in a
+        // `config ruleset` so one list serves every rule that needs it.
        DstRuleset: form.rulesets,
-        DstIP: form.matchKind === 'ip' ? csv(mv) : [],
-        DstPort: form.matchKind === 'port' ? mv : '',
+        DstPort: form.port.trim(),
        Proto: form.proto,
        Target: form.target,
        Egress: '',
@@ -756,7 +865,14 @@ export default function Routing() {
    )
  }

-  const enabledCount = rules.filter((r) => r.Enabled).length
+  // One force verdict per displayed rule, computed once and handed down — the row,
+  // the counter and the banner must all be reading the SAME answer.
+  const force = rules.map((r) => forceOf(r))
+  // EFFECTIVE, not configured. A counter that added up saved switches said "2 / 2
+  // active" for a config the router was running one rule of.
+  const enabledCount = force.filter((f) => f.on).length
+  const overridden = force.filter((f) => f.profile !== null)
+  const overrideProfile = overridden[0]?.profile ?? null

  return (
    <section className="page" aria-label="Routing rules">
@@ -765,12 +881,28 @@ export default function Routing() {
          Rules run top to bottom on the bus — the <strong>first match wins</strong>. Traffic that
          reaches the bottom follows the default route.
        </p>
-        <span className="rt-count mono" aria-label={`${enabledCount} of ${rules.length} rules active`}>
+        <span className="rt-count mono" aria-label={`${enabledCount} of ${rules.length} rules in force`}>
          {enabledCount}
-          <small> / {rules.length} active</small>
+          <small> / {rules.length} in force</small>
        </span>
      </div>

+      {/* Said once at the top, so the per-row badges below read as consequences of
+          one thing rather than as N unrelated oddities. Only shown when a profile
+          actually changed something: a router that uses no profiles, or one whose
+          profile agrees with every saved switch, gets no banner at all. */}
+      {overrideProfile && (
+        <p className="rt-prof-banner" role="status">
+          <span className="rt-prof-tag mono">profile</span>
+          <span>
+            <strong className="mono">{overrideProfile}</strong> is the active WAN profile and is
+            overriding {overridden.length === 1 ? '1 rule' : `${overridden.length} rules`} below. The
+            switches keep showing what you saved; the rows show what the router is running. Change
+            which rules a profile forces on the <strong>Profiles</strong> page.
+          </span>
+        </p>
+      )}
+
      {actionError && (
        <p className="page-error" role="alert">
          {actionError}
@@ -789,7 +921,7 @@ export default function Routing() {
      {rules.length === 0 ? (
        <div className="rt-empty">
          <p>No rules — all traffic follows the default route.</p>
-          <p className="rt-empty-sub">Add a rule below to steer a domain, address, or port.</p>
+          <p className="rt-empty-sub">Add a rule below to steer a destination list, source, or port.</p>
        </div>
      ) : (
        <ol className="rt-list" aria-label="Routing rules in first-match order">
@@ -818,6 +950,7 @@ export default function Routing() {
                busy={saving}
                editingOther={editingRule !== null}
                shadow={shadowOf(r)}
+                force={force[i]}
                onEdit={onEditRule}
                onToggle={onToggle}
                onMove={onMove}
@@ -868,6 +1001,7 @@ function RuleRow({
  busy,
  editingOther,
  shadow,
+  force,
  onEdit,
  onToggle,
  onMove,
@@ -880,6 +1014,9 @@ function RuleRow({
  editingOther: boolean
  /** Set when the daemon reports this rule can never fire; null when it can. */
  shadow: { by: string; byOrder: number; reason: string } | null
+  /** Whether the rule is IN FORCE, and which profile decided that (see RuleForce).
+   *  Every mark on this row comes from here; `rule.Enabled` drives only the switch. */
+  force: RuleForce
  onEdit: (name: string) => void
  onToggle: (name: string) => void
  onMove: (name: string, dir: 'up' | 'down') => void
@@ -895,17 +1032,26 @@ function RuleRow({
  // matched above" line): those are the claim that made two `default` rules
  // indistinguishable in the first place.
  const dead = shadow !== null
+  // The unmigrated-rule tripwire (see RRule.LegacyDst / model.IsCatchAll): this
+  // rule's destination is still in the removed schema-v1 options, so the daemon
+  // holds it disabled. It is NOT an ordinary disabled rule — nobody switched it
+  // off — so it gets the same "wired but not connected" amber treatment as a
+  // shadowed rule, plus a badge and a line saying what to run. isCatchAll()
+  // already refuses to call it the default, so `final` marks cannot land here.
+  const legacyDst = (rule.LegacyDst ?? []).filter(Boolean)
+  const unmigrated = legacyDst.length > 0
+  const inert = dead || unmigrated
  const isDefault = isCatchAll(rule) && !dead
  const target = effectiveTarget(rule)
  const tone = targetTone(target)
-  const cls = [
-    'rt-rule',
-    rule.Enabled ? '' : 'off',
-    isDefault ? 'final' : '',
-    dead ? 'dead' : '',
-  ]
+  // Dimmed by the EFFECTIVE state, never by the saved one. A rule the active
+  // profile switched off is not in force, and the row has to read that way even
+  // though its switch — which edits the saved setting — is still on.
+  const cls = ['rt-rule', force.on ? '' : 'off', isDefault ? 'final' : '', inert ? 'dead' : '']
    .filter(Boolean)
    .join(' ')
+  // What the switch says, spelled out, for the moment the two disagree.
+  const savedState = rule.Enabled ? 'on' : 'off'

  return (
    <li className={cls}>
@@ -919,7 +1065,7 @@ function RuleRow({
        >
          ▲
        </button>
-        <span className={isDefault ? 'rt-ord final' : dead ? 'rt-ord dead' : 'rt-ord'}>
+        <span className={isDefault ? 'rt-ord final' : inert ? 'rt-ord dead' : 'rt-ord'}>
          {isDefault ? '·' : rule.Order}
        </span>
        <button
@@ -937,10 +1083,26 @@ function RuleRow({
        <div className="rt-head">
          <span className="rt-name">{rule.Name}</span>
          {isDefault && <span className="rt-badge">default route · final</span>}
+          {unmigrated && <span className="rt-badge dead">held off · not migrated</span>}
          {dead && <span className="rt-badge dead">never applies</span>}
+          {/* Amber for the rule the profile switched OFF (warn semantics: wired but
+              not connected), accent for the one it switched ON — orange is the
+              faceplate's active state, and a force-enabled rule is exactly that. */}
+          {force.dir === 'disabled' && <span className="rt-badge dead">off · by profile</span>}
+          {force.dir === 'enabled' && <span className="rt-badge prof-on">on · by profile</span>}
        </div>
        <div className="rt-match">
-          {dead ? (
+          {unmigrated ? (
+            // Why the rule is off and what fixes it. Same voice as the shadow note:
+            // state, cause, one command. The daemon says the same thing through the
+            // apply warnings (model.ValidateRules); this puts it on the row it is about.
+            <span className="rt-dead-note">
+              Destination still written the old way (<span className="mono">{legacyDst.join(', ')}</span>
+              ) — this config was never migrated, so shaterd cannot read where this rule sends
+              traffic and holds it disabled. Run <span className="mono">shaterd migrate</span> on the
+              router to turn those entries into a ruleset, then enable the rule again.
+            </span>
+          ) : dead ? (
            // The badge says it never fires; this line says what beat it and what to
            // do. Visible text, not a tooltip — the operator has to be able to find
            // the other rule, and two rows can carry the same name.
@@ -955,6 +1117,22 @@ function RuleRow({
            <Matchers rule={rule} />
          )}
        </div>
+        {/* Added BELOW the matchers, not instead of them: the rule's conditions are
+            still worth reading — the operator is deciding whether to change the
+            profile or the rule.
+            Two clauses only. The banner at the top of the page already carries the
+            general explanation and the way to change it, and a profile that
+            overrides several rules would otherwise repeat that paragraph on every
+            one of them. What is left is the part only this row can say: whether it
+            is in force, and what its own switch is showing instead. */}
+        {force.profile && (
+          <p className="rt-dead-note rt-prof-note">
+            {force.dir === 'disabled' ? 'Not in force' : 'In force'} — profile{' '}
+            <strong className="mono">{force.profile}</strong> switches this rule{' '}
+            {force.dir === 'disabled' ? 'off' : 'on'}. The switch still reads{' '}
+            <strong>{savedState}</strong>: that is the saved setting.
+          </p>
+        )}
      </div>

      <div className={`rt-target ${tone}`} title={`target: ${target}`}>
@@ -974,12 +1152,40 @@ function RuleRow({
        >
          Edit
        </button>
-        <Toggle
-          pressed={rule.Enabled}
-          onChange={() => onToggle(rule.Name)}
-          label={`${rule.Enabled ? 'Disable' : 'Enable'} rule ${rule.Name}`}
-          disabled={frozen}
-        />
+        {/* An unmigrated rule cannot be switched on from here, and the switch says
+            so rather than pretending: the daemon holds it disabled, but a config
+            write from the panel DROPS the unreadable legacy options (render.go
+            emits neither), so enabling it here would save a live rule with no
+            destination left at all — the catch-all this tripwire exists to
+            prevent. `shaterd migrate` clears LegacyDst and the switch comes back. */}
+        {/* The switch edits the SAVED setting and nothing else, so it keeps showing
+            rule.Enabled even while the active profile forces the opposite. Mirroring
+            the effective state here would be worse than the bug it replaces: the
+            operator would flip a switch that was never theirs, and the PUT would
+            write the profile's decision into UCI as if they had chosen it. The row
+            above says what the router is doing; the "saved" caption says what this
+            control is for. */}
+        <span className="rt-switch">
+          <Toggle
+            pressed={rule.Enabled}
+            onChange={() => onToggle(rule.Name)}
+            label={
+              unmigrated
+                ? `Rule ${rule.Name} is held disabled until the config is migrated`
+                : force.profile
+                  ? `Saved setting for rule ${rule.Name} is ${savedState}; profile ${force.profile} is forcing it ${
+                      force.dir === 'disabled' ? 'off' : 'on'
+                    }. This switch changes the saved setting only.`
+                  : `${rule.Enabled ? 'Disable' : 'Enable'} rule ${rule.Name}`
+            }
+            disabled={frozen || unmigrated}
+          />
+          {force.profile && (
+            <span className="rt-switch-note" aria-hidden="true">
+              saved
+            </span>
+          )}
+        </span>
        <button
          type="button"
          className="rt-del"
@@ -1012,9 +1218,7 @@ function Matchers({ rule }: { rule: RRule }): ReactNode {
    )
  }
  listChip('src', rule.Src, 'src')
-  listChip('dns', rule.DstDomain, 'dom')
  listChip('ruleset', rule.DstRuleset, 'rs')
-  listChip('ip', rule.DstIP, 'ip')
  if (rule.DstPort && rule.DstPort.trim()) {
    chips.push(
      <span className="rt-chip" key="port">
@@ -1130,7 +1334,16 @@ function TargetOptions({ targets, current }: { targets: TargetGroups; current?:
  )
 }

-/** The dst_ruleset checkbox group. Renders nothing when no rulesets exist. */
+/**
+ * The destination picker: which rulesets this rule matches (dst_ruleset).
+ *
+ * Checkboxes and nothing else. This is the ONLY way a rule names a destination,
+ * so it renders even when the config has no lists yet — an empty picker that says
+ * where lists come from is the honest answer, and hiding it would leave the rule
+ * form with no destination control at all. Building and filling a list is the
+ * Rulesets panel's job, deliberately kept out of the rule editor so a list is
+ * created in exactly one place.
+ */
 function RulesetPicker({
  options,
  selected,
@@ -1142,24 +1355,26 @@ function RulesetPicker({
  busy: boolean
  onToggle: (name: string) => void
 }): ReactNode {
-  if (options.length === 0) return null
  return (
    <div className="rt-rsel">
-      <span className="rt-flabel">Match rulesets — dst_ruleset</span>
-      <div className="rt-rsel-opts" role="group" aria-label="Match these rulesets">
-        {options.map((n) => {
-          const on = selected.includes(n)
-          return (
-            <label key={n} className={on ? 'rt-rsel-opt on' : 'rt-rsel-opt'}>
-              <input type="checkbox" checked={on} onChange={() => onToggle(n)} disabled={busy} />
-              <span className="mono">{n}</span>
-            </label>
-          )
-        })}
-      </div>
+      <span className="rt-flabel">Destination — dst_ruleset</span>
+      {options.length > 0 && (
+        <div className="rt-rsel-opts" role="group" aria-label="Match these rulesets">
+          {options.map((n) => {
+            const on = selected.includes(n)
+            return (
+              <label key={n} className={on ? 'rt-rsel-opt on' : 'rt-rsel-opt'}>
+                <input type="checkbox" checked={on} onChange={() => onToggle(n)} disabled={busy} />
+                <span className="mono">{n}</span>
+              </label>
+            )
+          })}
+        </div>
+      )}
      <p className="rt-rsel-hint">
-        The rule also matches any traffic in the checked list(s). Combine with a domain, address, or
-        port, or use a ruleset on its own.
+        {options.length === 0
+          ? 'No rulesets yet. Add one under Rulesets below, then come back and check it here — a rule matches a destination through a ruleset only.'
+          : 'The rule matches traffic in ANY checked list. Narrow it further with a source, port or protocol.'}
      </p>
    </div>
  )
@@ -1285,7 +1500,14 @@ function AddRule({
    set('rulesets', form.rulesets.includes(n) ? form.rulesets.filter((x) => x !== n) : [...form.rulesets, n])
  const toggleDay = (d: string) =>
    set('schedDays', form.schedDays.includes(d) ? form.schedDays.filter((x) => x !== d) : [...form.schedDays, d])
-  const matchPlaceholder = form.matchKind === 'ip' ? '10.0.0.0/8, 100.64.0.0/10' : '443, 8080-8090'
+
+  // Same flag as the edit form, from the same predicate: no matcher = this rule
+  // asks to be route.Final. Whether it wins depends on what is last — it takes
+  // the default when there is no catch-all yet (or the last rule is conditional),
+  // and lands dead when there is one, because nextOrder() inserts ahead of it.
+  // Both are worth flagging, so the text states the fact and not the outcome.
+  // Shown, never blocking: a default route is a legal thing to write.
+  const noMatchers = formHasNoMatchers(form)

  return (
    <form className="rt-add" onSubmit={onSubmit} aria-label="Add a routing rule">
@@ -1318,32 +1540,17 @@ function AddRule({
        </label>

        <label className="rt-field">
-          <span className="rt-flabel">Match</span>
-          <select
+          <span className="rt-flabel">Port(s)</span>
+          <input
            className="rt-input mono"
-            value={form.matchKind}
-            onChange={(e) => set('matchKind', e.target.value as MatchKind)}
-          >
-            <option value="none">rulesets only</option>
-            <option value="ip">ip / cidr</option>
-            <option value="port">port</option>
-          </select>
+            value={form.port}
+            onChange={(e) => set('port', e.target.value)}
+            placeholder="443, 8080-8090"
+            autoComplete="off"
+            spellCheck={false}
+          />
        </label>

-        {form.matchKind !== 'none' && (
-          <label className="rt-field rt-field-wide">
-            <span className="rt-flabel">{form.matchKind === 'port' ? 'Port(s)' : 'Address(es)'}</span>
-            <input
-              className="rt-input mono"
-              value={form.matchValue}
-              onChange={(e) => set('matchValue', e.target.value)}
-              placeholder={matchPlaceholder}
-              autoComplete="off"
-              spellCheck={false}
-            />
-          </label>
-        )}
-
        <label className="rt-field">
          <span className="rt-flabel">Proto</span>
          <select
@@ -1390,6 +1597,9 @@ function AddRule({
        <Button type="submit" variant="primary" disabled={busy}>
          {busy ? 'Saving…' : 'Add rule'}
        </Button>
+        {noMatchers && !error && (
+          <span className="rt-edit-warn">no matchers — matches everything</span>
+        )}
        {error && (
          <span className="rt-add-error" role="alert">
            {error}
@@ -1401,11 +1611,11 @@ function AddRule({
 }

 // --- edit-a-rule plate (inline, replaces the row it edits) ------------------
-// Unlike AddRule, editing exposes all three destination matchers at once
-// (Domain(s) / IP-CIDR(s) / Port) rather than a single Match picker — a real rule
-// can carry several matcher kinds simultaneously and none may be silently dropped.
-// The full original rule is spread into the result on save, so Order / Enabled /
-// Kill / Egress (and anything else off-form) survive untouched.
+// Same fields as AddRule, on purpose: a rule carries exactly one destination
+// mechanism (rulesets) plus port/proto/source, so there is nothing an edit can
+// reveal that the add form hides. The full original rule is spread into the
+// result on save, so Order / Enabled / Kill / Egress (and anything else off-form)
+// survive untouched.
 function RuleEditForm({
  initial,
  names,
@@ -1425,8 +1635,6 @@ function RuleEditForm({
 }) {
  const [name, setName] = useState(initial.Name)
  const [src, setSrc] = useState<string[]>([...(initial.Src ?? [])])
-  const [domain, setDomain] = useState((initial.DstDomain ?? []).join(', '))
-  const [ip, setIp] = useState((initial.DstIP ?? []).join(', '))
  const [port, setPort] = useState(initial.DstPort ?? '')
  const [proto, setProto] = useState(initial.Proto ?? '')
  const [target, setTarget] = useState(effectiveTarget(initial))
@@ -1442,14 +1650,15 @@ function RuleEditForm({
  const toggleDay = (d: string) =>
    setSchedDays((cur) => (cur.includes(d) ? cur.filter((x) => x !== d) : [...cur, d]))

+  // This rule's destination may still be in the schema-v1 options (RRule.LegacyDst).
+  // The form cannot show or edit them — they are not fields any more — and saving
+  // writes the model back through render.go, which does not emit them. So a save
+  // here silently DISCARDS that destination. Say so before it happens; the fix is
+  // `shaterd migrate`, which converts them into a ruleset this form can check.
+  const legacyDst = (initial.LegacyDst ?? []).filter(Boolean)
+
  // A rule with no matcher of any kind is a catch-all — legal, but worth flagging.
-  const noMatchers =
-    src.length === 0 &&
-    csv(domain).length === 0 &&
-    csv(ip).length === 0 &&
-    port.trim() === '' &&
-    rulesets.length === 0 &&
-    proto.trim() === ''
+  const noMatchers = formHasNoMatchers({ src, port, rulesets, proto })

  const submit = (e: FormEvent) => {
    e.preventDefault()
@@ -1471,8 +1680,6 @@ function RuleEditForm({
      ...initial,
      Name: nm,
      Src: src,
-      DstDomain: csv(domain),
-      DstIP: csv(ip),
      DstPort: port.trim(),
      DstRuleset: rulesets,
      Proto: proto,
@@ -1491,7 +1698,15 @@ function RuleEditForm({
      <form className="rt-add rt-edit-form" onSubmit={submit} aria-label={`Edit rule ${initial.Name}`}>
        <div className="rt-add-hd">
          <span className="rt-add-title">Edit {initial.Name}</span>
-          <span className="rt-add-sub">Empty a field to drop that matcher. Save, then Apply.</span>
+          <span className="rt-add-sub">
+            Uncheck a list or clear a field to drop that matcher. Save, then Apply.
+          </span>
+          {legacyDst.length > 0 && (
+            <span className="rt-edit-warn">
+              not migrated — saving discards its old destination ({legacyDst.join(', ')}); run
+              shaterd migrate first
+            </span>
+          )}
        </div>

        <div className="rt-fields">
@@ -1521,37 +1736,6 @@ function RuleEditForm({
            />
          </label>

-          {/* Domains are matched via rulesets by design — this legacy field only
-              appears when the rule ALREADY carries free-text domains, so they
-              stay visible and clearable rather than silently preserved. */}
-          {(initial.DstDomain ?? []).length > 0 && (
-            <label className="rt-field rt-field-wide">
-              <span className="rt-flabel">Domain(s) — legacy</span>
-              <input
-                className="rt-input mono"
-                value={domain}
-                onChange={(e) => setDomain(e.target.value)}
-                placeholder="youtube.com, *.googlevideo.com"
-                autoComplete="off"
-                spellCheck={false}
-                disabled={busy}
-              />
-            </label>
-          )}
-
-          <label className="rt-field rt-field-wide">
-            <span className="rt-flabel">IP / CIDR(s)</span>
-            <input
-              className="rt-input mono"
-              value={ip}
-              onChange={(e) => setIp(e.target.value)}
-              placeholder="10.0.0.0/8, 100.64.0.0/10"
-              autoComplete="off"
-              spellCheck={false}
-              disabled={busy}
-            />
-          </label>
-
          <label className="rt-field">
            <span className="rt-flabel">Port(s)</span>
            <input
@@ -1,6 +1,6 @@
 import './Targets.css'
 import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import type { LedVariant } from '../components'
 import {
  apply as apiApply,
@@ -161,18 +161,18 @@ function renameReferences(m: Model, kind: RefKind, from: string, to: string): Mo
 }

 /**
- * The sentence a delete confirmation appends: what still points at this target,
- * and what happens to it. Empty list ⇒ an explicit "nothing references it", so
- * the operator can delete a stray with confidence instead of guessing.
+ * The body of a delete confirmation: what still points at this target, and what
+ * happens to it. Empty list ⇒ an explicit "nothing references it", so the
+ * operator can delete a stray with confidence instead of guessing.
 */
 function refWarning(refs: RefSite[]): string {
-  if (refs.length === 0) return ' Nothing references it.'
+  if (refs.length === 0) return 'Nothing references it.'
  const shown = refs.slice(0, 4).map((r) => r.label)
  const more = refs.length - shown.length
  const list = `${shown.join(', ')}${more > 0 ? `, and ${more} more` : ''}`
  return refs.length === 1
-    ? ` It is referenced by ${list}, whose traffic will be blocked (an unresolved target never falls through to the default route).`
-    : ` It is referenced by ${refs.length} places — ${list} — whose traffic will be blocked (an unresolved target never falls through to the default route).`
+    ? `It is referenced by ${list}, whose traffic will be blocked (an unresolved target never falls through to the default route).`
+    : `It is referenced by ${refs.length} places — ${list} — whose traffic will be blocked (an unresolved target never falls through to the default route).`
 }

 /**
@@ -457,6 +457,7 @@ interface Opt {
 // ---- page ------------------------------------------------------------------

 export default function Targets() {
+  const confirm = useConfirm()
  const [config, setConfig] = useState<Model | null>(null)
  const [loadError, setLoadError] = useState<string | null>(null)

@@ -787,13 +788,18 @@ export default function Targets() {
  )

  const removeGroup = useCallback(
-    (name: string) => {
+    async (name: string) => {
      if (!config) return
      const refs = findReferences(config, 'group', name)
-      if (!window.confirm(`Delete group “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete group',
+        title: `Delete group “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
      void save({ ...config, Groups: groups.filter((g) => g.Name !== name) }, `Deleted ${name}`)
    },
-    [config, groups, save],
+    [config, groups, save, confirm],
  )

  // ---- chain mutations ------------------------------------------------------
@@ -820,13 +826,18 @@ export default function Targets() {
  )

  const removeChain = useCallback(
-    (name: string) => {
+    async (name: string) => {
      if (!config) return
      const refs = findReferences(config, 'chain', name)
-      if (!window.confirm(`Delete chain “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete chain',
+        title: `Delete chain “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
      void save({ ...config, Chains: chains.filter((c) => c.Name !== name) }, `Deleted ${name}`)
    },
-    [config, chains, save],
+    [config, chains, save, confirm],
  )

  // ---- egress mutations -----------------------------------------------------
@@ -853,13 +864,18 @@ export default function Targets() {
  )

  const removeEgress = useCallback(
-    (name: string) => {
+    async (name: string) => {
      if (!config) return
      const refs = findReferences(config, 'egress', name)
-      if (!window.confirm(`Delete egress “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete egress',
+        title: `Delete egress “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
      void save({ ...config, Egresses: egresses.filter((e) => e.Name !== name) }, `Deleted ${name}`)
    },
-    [config, egresses, save],
+    [config, egresses, save, confirm],
  )

  const busy = saving || applying
@@ -0,0 +1,150 @@
+// protectionState — the one sentence the whole panel shows about "am I protected".
+//
+// Run with `npm test` (node's built-in test runner + native TypeScript stripping;
+// no test dependency is added to the SPA, which ships inside the daemon binary).
+//
+// The case this file was written for is "plane full, traffic direct": the exact
+// state of a live router — one enabled rule, `default → direct`, no groups, no
+// rule-sets — where every part of the data plane was installed and the readout
+// therefore said "Protected — traffic from your network is going through the
+// tunnel", under a green LED, while the whole LAN went out the plain WAN.
+//
+// planeState.ts has no runtime imports (both of its imports are `import type`),
+// so this runs against the real module with nothing stubbed.
+
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { protectionState } from './planeState.ts'
+import type { Status, Traffic } from './api.ts'
+
+/** A healthy, fully-installed router; `traffic` is what each case varies. */
+function status(over: Partial<Status> = {}): Status {
+  return {
+    running: true,
+    enabled: true,
+    active: true,
+    table: true,
+    hash: 'abc',
+    version: '1.11.0-shater',
+    kill_switch: 'closed',
+    engine_running: true,
+    plane: 'full',
+    warnings: [],
+    ...over,
+  }
+}
+
+function withTraffic(traffic: Traffic | undefined): Status {
+  return status({ traffic })
+}
+
+// --- the field case ---------------------------------------------------------
+
+test('plane full + default direct is NOT reported as protected', () => {
+  const s = protectionState(withTraffic({ verdict: 'direct', default: 'direct', tunnel_rules: 0 }))
+  assert.notEqual(s.headline, 'Protected')
+  assert.equal(s.variant, 'crit')
+  assert.equal(s.alarm, true)
+  // The claim that was false must not survive anywhere in the copy.
+  assert.doesNotMatch(s.detail, /going through the tunnel/)
+  // ...and the honest consequence must be stated, not implied.
+  assert.match(s.detail, /real address/)
+})
+
+// --- the other verdicts under a full plane ----------------------------------
+
+test('plane full + default into a tunnel is protected', () => {
+  const s = protectionState(withTraffic({ verdict: 'tunnel', default: 'auto', tunnel_rules: 1 }))
+  assert.equal(s.variant, 'on')
+  assert.equal(s.headline, 'Protected')
+  assert.equal(s.alarm, false)
+})
+
+test('plane full + direct default with tunnelling rules is split, not protected', () => {
+  const s = protectionState(withTraffic({ verdict: 'split', default: 'direct', tunnel_rules: 3 }))
+  assert.equal(s.variant, 'amber')
+  assert.notEqual(s.headline, 'Protected')
+  // Says how much is protected, and that the default is not.
+  assert.match(s.detail, /3 rules/)
+  assert.match(s.detail, /normal internet connection/)
+  // A working selective setup must not raise a banner on every other page.
+  assert.equal(s.alarm, false)
+})
+
+test('split names a single rule in the singular', () => {
+  const s = protectionState(withTraffic({ verdict: 'split', default: 'direct', tunnel_rules: 1 }))
+  assert.match(s.detail, /^One rule sends traffic/)
+})
+
+test('plane full + blocked default with rules leaks nothing and is never crit', () => {
+  const s = protectionState(withTraffic({ verdict: 'blocked', default: 'block', tunnel_rules: 2 }))
+  assert.equal(s.variant, 'amber')
+  assert.equal(s.alarm, false)
+  assert.match(s.detail, /nothing is leaving unprotected/)
+})
+
+test('plane full + blocked default with no rules says the network has no way out', () => {
+  const s = protectionState(withTraffic({ verdict: 'blocked', default: 'block', tunnel_rules: 0 }))
+  assert.equal(s.variant, 'amber')
+  assert.equal(s.alarm, true)
+  assert.doesNotMatch(s.detail, /going through the tunnel/)
+})
+
+test('plane full with no verdict claims nothing either way', () => {
+  for (const t of [undefined, { verdict: '' as const }]) {
+    const s = protectionState(withTraffic(t))
+    assert.notEqual(s.headline, 'Protected')
+    assert.equal(s.variant, 'amber')
+    assert.equal(s.alarm, false)
+  }
+})
+
+// --- the branches that were already correct ---------------------------------
+
+test('no status yet', () => {
+  const s = protectionState(null)
+  assert.equal(s.variant, 'off')
+  assert.equal(s.alarm, false)
+})
+
+test('service switched off is a deliberate state, not a fault', () => {
+  const s = protectionState(status({ enabled: false }))
+  assert.equal(s.variant, 'amber')
+  assert.equal(s.headline, 'Turned off')
+  assert.equal(s.alarm, false)
+})
+
+test('hold: the kill-switch caught it — protected, offline', () => {
+  const s = protectionState(status({ plane: 'hold', engine_running: false, active: false }))
+  assert.equal(s.variant, 'amber')
+  assert.equal(s.alarm, true)
+  assert.match(s.headline, /blocked/)
+})
+
+test('none + fail-closed is the leak, and it is crit', () => {
+  const s = protectionState(status({ plane: 'none', table: false, engine_running: false }))
+  assert.equal(s.variant, 'crit')
+  assert.equal(s.alarm, true)
+})
+
+test('none + fail-open is the operator’s documented choice, stated not alarmed at', () => {
+  const s = protectionState(
+    status({ plane: 'none', table: false, engine_running: false, kill_switch: 'open' }),
+  )
+  assert.equal(s.variant, 'amber')
+  assert.equal(s.alarm, true)
+})
+
+test('daemon too old to send `plane` keeps its own fallback', () => {
+  // Nothing here may depend on `traffic`: a daemon with no `plane` has no
+  // `traffic` either, and this branch reads what it can observe instead.
+  const { plane, ...noPlane } = status()
+  void plane
+  assert.equal(protectionState(noPlane as Status).headline, 'Protected')
+  assert.equal(protectionState({ ...noPlane, running: false } as Status).headline, 'Service stopped')
+  assert.equal(
+    protectionState({ ...noPlane, active: false } as Status).headline,
+    'Starting up',
+  )
+})
@@ -11,7 +11,7 @@
 // same router differently.

 import type { LedVariant } from './components'
-import type { Status } from './api'
+import type { Status, Traffic } from './api'

 export interface ProtectionState {
  variant: LedVariant
@@ -31,6 +31,24 @@ export interface ProtectionState {
 *   hold — the kill-switch caught it. Protected, but offline.
 *   none (fail-closed) — there is no protection at all. Online, and exposed.
 * Collapsing them would erase the only difference that matters.
+ *
+ * PLANE IS NOT THE WHOLE ANSWER, AND THAT USED TO BE A LIE. `plane: 'full'`
+ * returned "Protected — traffic from your network is going through the tunnel",
+ * which is a claim `plane` cannot support: it only says the nft table, the policy
+ * routing and the engine are all installed. Where the diverted packets go once the
+ * engine has them is decided by the engine's default route, and a router in the
+ * field ran with one rule — `default → direct`, no groups, no rule-sets. Fully
+ * installed plane, zero tunnel, whole LAN out the plain WAN with its real address,
+ * green LED, "Protected".
+ *
+ * So `full` now branches on `status.traffic`, the daemon's verdict on the config
+ * it is actually running (see api.ts TrafficVerdict). It is computed on the daemon
+ * because only the daemon knows what was GENERATED and STARTED: the panel's
+ * /api/config is desired state, which diverges from the running one whenever edits
+ * are unapplied or a rollback is pending, and re-deriving the default route from it
+ * would mean a second implementation of the generator's rule loop — schedules,
+ * shadowed catch-alls, targets that failed to resolve and fell back to direct —
+ * drifting against the first.
 */
 export function protectionState(status: Status | null): ProtectionState {
  if (!status) {
@@ -56,12 +74,7 @@ export function protectionState(status: Status | null): ProtectionState {

  switch (status.plane) {
    case 'full':
-      return {
-        variant: 'on',
-        headline: 'Protected',
-        detail: 'Traffic from your network is going through the tunnel.',
-        alarm: false,
-      }
+      return fullPlaneState(status.traffic)
    case 'hold':
      return {
        variant: 'amber',
@@ -112,3 +125,87 @@ export function protectionState(status: Status | null): ProtectionState {
    alarm: false,
  }
 }
+
+/**
+ * The plane is fully installed — now say where the traffic it carries ends up.
+ *
+ * Only `tunnel` earns "Protected". The other verdicts each describe a real router
+ * someone can be sitting in front of, and they are kept apart because the thing to
+ * DO about them differs:
+ *
+ *   split   — deliberate for most people who reach it, accidental for the rest
+ *             (a default rule that was never pointed anywhere). Amber, but no
+ *             alarm: raising a banner on every page of a working selective setup
+ *             is how a banner stops being read.
+ *   direct  — the engine is running and forwarding every connection out the plain
+ *             WAN. The traffic outcome is identical to `plane: 'none'` under a
+ *             closed kill-switch, so it gets the same weight: crit, and it
+ *             interrupts. The wording differs because the fix does — nothing
+ *             failed here, the routing simply says "direct".
+ *   blocked — the fail-closed default. Nothing is leaking, so this is never crit;
+ *             with no tunnelling rules at all it means the network has no way out
+ *             and someone should be told why.
+ *   unknown — an older daemon, or the seconds between this daemon starting and its
+ *             first apply. We do not know, so we do not claim. Saying "Protected"
+ *             here is the exact bug being removed.
+ */
+function fullPlaneState(traffic: Traffic | undefined): ProtectionState {
+  const tunnelRules = traffic?.tunnel_rules ?? 0
+
+  switch (traffic?.verdict) {
+    case 'tunnel':
+      return {
+        variant: 'on',
+        headline: 'Protected',
+        detail: 'Traffic from your network is going through the tunnel.',
+        alarm: false,
+      }
+    case 'split':
+      return {
+        variant: 'amber',
+        headline: 'Partly protected — the rest goes out directly',
+        detail: `${ruleCount(tunnelRules)} through the tunnel. Everything they don’t match leaves through your normal internet connection, with your real address.`,
+        alarm: false,
+      }
+    case 'direct':
+      return {
+        variant: 'crit',
+        headline: 'Not protected — nothing is going through the tunnel',
+        detail:
+          'The service is running, but your routing sends every connection straight out your normal internet connection, with your real address. On the Routing page, point the default rule at a group or a node.',
+        alarm: true,
+      }
+    case 'blocked':
+      return tunnelRules > 0
+        ? {
+            variant: 'amber',
+            headline: 'Partly protected — everything else is blocked',
+            detail: `${ruleCount(tunnelRules)} through the tunnel. Anything they don’t match is blocked instead of being let out, so nothing is leaving unprotected.`,
+            alarm: false,
+          }
+        : {
+            variant: 'amber',
+            headline: 'Nothing is getting out',
+            detail:
+              'No rule sends traffic anywhere, so every connection from your network is being blocked rather than let out unprotected. Add a default rule on the Routing page.',
+            alarm: true,
+          }
+    default:
+      return {
+        variant: 'amber',
+        headline: 'Checking where traffic goes',
+        detail:
+          'The router is up and handling your traffic. It hasn’t reported yet whether that traffic is going through the tunnel.',
+        alarm: false,
+      }
+  }
+}
+
+/** "One rule sends traffic" / "4 rules send traffic", so the detail lines above
+ *  can name a number the operator can go and count on the Routing page. Falls
+ *  back to the vague form only if the daemon sent a verdict without a count. */
+function ruleCount(n: number): string {
+  if (n <= 0) return 'Some traffic goes'
+  if (n === 1) return 'One rule sends traffic'
+  return `${n} rules send traffic`
+}
@@ -18,5 +18,10 @@
    "noFallthroughCasesInSwitch": true,
    "forceConsistentCasingInFileNames": true
  },
-  "include": ["src", "vite.config.ts"]
+  "include": ["src", "vite.config.ts"],
+  // *.test.ts runs under node's built-in test runner (`npm test`), which strips
+  // types rather than checking them. They are excluded here because they import
+  // node:test / node:assert, and the SPA deliberately carries no @types/node — it
+  // is embedded in the daemon binary, so every devDependency is weight on a router.
+  "exclude": ["src/**/*.test.ts"]
 }
@@ -18,9 +18,10 @@
 #      OpenWrt package can $(INSTALL_BIN) the arch-matched artifact.
 #   5. Prints a size table + a per-arch static check (ELF type / no PT_INTERP).
 #
-# Router build tag set = D9 (musl-static). We deliberately DROP with_purego and
-# with_naive_outbound: they pull cronet-go, which forces a glibc PT_INTERP even
-# with CGO_ENABLED=0, making the binary unusable on musl OpenWrt.
+# Router build tag set = D9/D23 (musl-static). It is DEFINED IN, and only in,
+# scripts/router-tags.sh (sourced below) — that file documents every tag and is
+# machine-checked against the declared feature list by shater/buildtags's test.
+# Run scripts/check-router-tags.sh after touching it.
 #
 # Usage:
 #   scripts/build-shaterd.sh [VERSION] [--fast]
@@ -82,16 +83,15 @@ fi
 [ -n "$VERSION" ] || VERSION="v0.2.0-dev"

 # --- config -----------------------------------------------------------------
-# D9 router tag set (musl-static). Keep in sync with docs-shater/DECISIONS.md D9.
-# No with_gvisor: the data plane is tproxy/redirect (netplane), generate never
-# emits a tun inbound, so the userspace gvisor stack was 3.6 MB of dead weight
-# (tun would fall back to the system stack anyway).
-# No with_clash_api: the panel is shater's own; generate never emits a clash_api
-# service ("the shater generator emits none of those" — shater/engine/engine.go).
-# No with_dhcp: shater resolvers are udp/tcp/doh/dot/local/fakeip — no "dhcp://"
-# DNS transport is ever generated, and the slim registry never registers it.
-ROUTER_TAGS="with_quic,with_wireguard,with_utls,badlinkname,tfogo_checklinkname0,with_xhttp,with_awg,with_lx_command"
-LDFLAGS="-X github.com/sagernet/sing-box/constant.Version=${VERSION} -checklinkname=0 -s -w -buildid="
+# D9/D23 router tag set (musl-static). The set itself lives in ONE place —
+# scripts/router-tags.sh — because it is also parsed by shater/buildtags's test,
+# which proves it still covers every feature docs-shater/FEATURES.md declares.
+# Do not re-inline it here: that split is exactly how `with_gvisor` went missing
+# while `with_wireguard` stayed (D23).
+# shellcheck source=router-tags.sh
+. "$SCRIPT_DIR/router-tags.sh"
+ROUTER_TAGS="$SHATER_ROUTER_TAGS"
+LDFLAGS="-X github.com/sagernet/sing-box/constant.Version=${VERSION} ${SHATER_ROUTER_LDFLAGS} -s -w -buildid="

 UPX_BIN="${UPX:-upx}"
 # UPX itself treats the environment variable UPX as extra command-line options, so
@@ -111,6 +111,20 @@ echo "  version : $VERSION"
 echo "  tags    : $ROUTER_TAGS"
 echo "  upx     : $UPX_BIN"
 echo "  go      : $(go version)"
+
+# --- gate: does this tag set still support what we declare? (D23) ------------
+# Cheap (one tiny tag-less package, no network, ~1 s) and it travels with the
+# BUILD rather than with a CI config, so an artifact produced by hand on a
+# developer's machine gets the same guarantee. The heavier half — actually
+# constructing every declared protocol under these tags — is
+# scripts/check-router-tags.sh, which CI runs before this script.
+if ! (cd "$REPO" && go test -count=1 ./shater/buildtags/ >/dev/null); then
+	echo >&2
+	echo "  ABORT: the router tag set no longer covers a declared feature." >&2
+	echo "         Details: go test ./shater/buildtags/" >&2
+	echo "         Full check: scripts/check-router-tags.sh" >&2
+	exit 1
+fi
 echo

 # --- step 1: build the SPA --------------------------------------------------
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#
+# check-router-tags.sh — prove the SHIPPED build-tag set still supports every
+# feature shater declares (D23).
+#
+# WHY (2026-07-25): the router tag set is a trimmed subset of upstream's, but the
+# test suite builds with the FULL upstream set — so the one combination we
+# actually ship was never exercised. `with_gvisor` got trimmed while
+# `with_wireguard` stayed, and every shipped binary answered a WireGuard node
+# with "gVisor is not included in this build". Compiling is not evidence.
+#
+# WHAT IT RUNS
+#   1. shater/buildtags, TAG-LESS — reads scripts/router-tags.sh and fails if a
+#      declared feature (buildtags.Features) lost a build tag it needs. Cheap,
+#      hostable anywhere, catches the trim at the moment it happens.
+#   2. shater/generate + shater/buildtags, WITH THE SHIPPED TAG SET on linux —
+#      constructs one node of every declared protocol through box.New+Start, and
+#      cross-checks that the tag detectors match the set the compiler was given.
+#      This is the half that catches "the tag is there but insufficient".
+#
+# The run is unprivileged (no tproxy inbound is built) and offline apart from Go
+# module downloads.
+#
+# Usage:
+#   scripts/check-router-tags.sh
+#
+# Env:
+#   SHATER_GO_IMAGE   docker image used to reach linux from a non-linux host
+#                     (default golang:1.26 — keep it >= go.mod's toolchain).
+#   SHATER_NO_DOCKER=1  fail instead of falling back to docker.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO"
+
+# shellcheck source=router-tags.sh
+. "$SCRIPT_DIR/router-tags.sh"
+
+echo "== router build-tag check =="
+echo "  tags   : $SHATER_ROUTER_TAGS"
+echo "  ldflags: $SHATER_ROUTER_LDFLAGS"
+echo
+
+# --- 1. static: does the set still cover the declared features? --------------
+# No tags, no OS constraint: this is the check that would have caught the outage
+# on the developer's own machine.
+echo "== [1/2] declared features vs. the shipped tag set (no tags needed) =="
+go test -count=1 ./shater/buildtags/
+echo
+
+# --- 2. behavioural: does the shipped combination actually construct? --------
+# The protocol-construction test is linux-only (box.New validates the loop-guard
+# routing_mark only there). From a non-linux host, re-exec this script inside a
+# golang container rather than silently skipping — a skipped guard is no guard.
+if [ "$(go env GOOS)" != "linux" ] && [ "${SHATER_TAGCHECK_IN_DOCKER:-0}" != "1" ]; then
+	if [ "${SHATER_NO_DOCKER:-0}" = "1" ] || ! command -v docker >/dev/null 2>&1; then
+		echo "  ERROR: step 2 needs linux (GOOS=$(go env GOOS)) and docker is unavailable/disabled." >&2
+		echo "         Run this script on the linux CI runner or the OpenWrt VM." >&2
+		exit 1
+	fi
+	image="${SHATER_GO_IMAGE:-golang:1.26}"
+	echo "== [2/2] re-exec on linux via docker ($image) =="
+	host_repo="$REPO"
+	command -v cygpath >/dev/null 2>&1 && host_repo="$(cygpath -w "$REPO")"
+	# Named volumes keep the module/build cache warm between runs; MSYS2_ARG_CONV_EXCL
+	# stops Git Bash from rewriting the container-side paths into windows ones.
+	MSYS2_ARG_CONV_EXCL='*' MSYS_NO_PATHCONV=1 docker run --rm \
+		-v "$host_repo":/src \
+		-v shater-tagcheck-gomod:/go/pkg/mod \
+		-v shater-tagcheck-gocache:/root/.cache/go-build \
+		-w /src \
+		-e SHATER_TAGCHECK_IN_DOCKER=1 \
+		"$image" bash scripts/check-router-tags.sh
+	exit $?
+fi
+
+echo "== [2/2] every declared protocol constructs under the SHIPPED tags =="
+out="$(mktemp)"
+trap 'rm -f "$out"' EXIT
+set +e
+SHATER_ROUTER_TAG_CHECK=1 go test -count=1 -v \
+	-tags "$SHATER_ROUTER_TAGS" -ldflags "$SHATER_ROUTER_LDFLAGS" \
+	-run 'TestShippedTagSetConstructsDeclaredProtocols|TestEveryTagGatedFeatureIsProbed' \
+	./shater/generate/ >"$out" 2>&1
+rc_gen=$?
+set -e
+sed 's/^/    /' "$out"
+
+set +e
+SHATER_ROUTER_TAG_CHECK=1 go test -count=1 -v \
+	-tags "$SHATER_ROUTER_TAGS" -ldflags "$SHATER_ROUTER_LDFLAGS" \
+	-run 'TestCompiledTagsMatchTheShippedSet' \
+	./shater/buildtags/ >"$out" 2>&1
+rc_tags=$?
+set -e
+sed 's/^/    /' "$out"
+
+if [ "$rc_gen" -ne 0 ] || [ "$rc_tags" -ne 0 ]; then
+	echo
+	echo "  FAILED: the tag set we SHIP cannot do what we declare." >&2
+	exit 1
+fi
+
+# A guard that silently runs nothing is worse than no guard: prove the tests were
+# actually compiled in and executed (build tags / file renames could exclude them).
+for want in TestShippedTagSetConstructsDeclaredProtocols TestCompiledTagsMatchTheShippedSet; do
+	if ! SHATER_ROUTER_TAG_CHECK=1 go test -count=1 -v \
+		-tags "$SHATER_ROUTER_TAGS" -ldflags "$SHATER_ROUTER_LDFLAGS" \
+		-run "$want" ./shater/generate/ ./shater/buildtags/ 2>&1 | grep -q -- "--- PASS: $want"; then
+		echo "  FAILED: $want did not run (build-tag/file-name drift?)" >&2
+		exit 1
+	fi
+done
+
+echo
+echo "== OK: the shipped tag set covers every declared feature, and every =="
+echo "==     declared protocol constructs through box.New under it.      =="
@@ -0,0 +1,78 @@
+# shellcheck shell=sh
+#
+# router-tags.sh — THE build-tag set of the shipped `shaterd` router binary.
+#
+# This file is DATA, not a program: it is `.`-sourced by
+#   - scripts/build-shaterd.sh     (the ship build)
+#   - scripts/check-router-tags.sh (the guard that proves the set is complete)
+# and it is PARSED by shater/buildtags/buildtags_test.go, which asserts that
+# every feature docs-shater/FEATURES.md declares supported has its build tags
+# present here. Change the set here and nowhere else.
+#
+# WHY A TRIMMED SET AT ALL (D9): upstream's DEFAULT_BUILD_TAGS registers the
+# whole sing-box zoo. We drop what shater/generate can never emit, because a
+# router binary pays for every tag twice — flash and (UPX unpacks into anonymous
+# pages) resident RAM. We do NOT drop what a declared feature needs to run.
+#
+# WHY THIS FILE EXISTS (the 2026-07-25 WireGuard outage): the set used to be a
+# string literal inside build-shaterd.sh, with nothing connecting it to the
+# feature list. `with_gvisor` was trimmed as "unreachable code" while
+# `with_wireguard` stayed — so every shipped binary answered a WireGuard node
+# with "gVisor is not included in this build". No test caught it: the test suite
+# builds with the FULL upstream tag set, so the SHIPPED combination was never
+# exercised. One file + one test now hold the two halves together (D23).
+#
+# ---- the set -----------------------------------------------------------------
+#   with_gvisor            userspace netstack. REQUIRED BY with_wireguard: both
+#                          transport/wireguard device constructors
+#                          (newStackDevice AND newSystemStackDevice) are stubs
+#                          returning tun.ErrGVisorNotIncluded without it, so
+#                          box.New dies at "create WireGuard device". Not
+#                          optional as long as we ship WireGuard/AmneziaWG.
+#   with_quic              hysteria2 + tuic outbounds, QUIC/HTTP3 DNS
+#                          transports, and the vless/vmess `type=quic` transport
+#                          (shater/registry/registry_quic.go).
+#   with_wireguard         registers the wireguard endpoint
+#                          (shater/registry/registry_wireguard.go).
+#   with_awg               AmneziaWG obfuscation params (jc/jmin/jmax, s1-s4,
+#                          h1-h4, i1-i5) actually reach the device
+#                          (transport/wireguard/device_awg.go). A driving
+#                          product requirement — FEATURES.md marks it [MVP].
+#   with_utls              uTLS fingerprints AND REALITY: common/tls/
+#                          reality_client.go is itself `//go:build with_utls`.
+#   with_xhttp             the XHTTP/SplitHTTP v2ray transport
+#                          (shater/parse emits type=xhttp).
+#   badlinkname            badtls fast path (common/badtls/*.go are
+#                          `go1.25 && badlinkname`). Needs -checklinkname=0 in
+#                          SHATER_ROUTER_LDFLAGS below or the LINK step fails.
+#   tfogo_checklinkname0   same deal for tfo-go's linkname use.
+#   with_lx_command        lx daemon command server. Inert for shaterd (nothing
+#                          under shater/ imports sing-box/daemon or libbox —
+#                          `go list -deps ./shater/cmd/shaterd` links neither),
+#                          kept only so the router set stays a subset of the lx
+#                          desktop set. Costs nothing; safe to drop later.
+#
+# Deliberately NOT here (each is unreachable for shater, not merely unused):
+#   with_purego,with_naive_outbound  cronet-go forces a glibc PT_INTERP even at
+#                                    CGO_ENABLED=0 -> will not run on musl (D9).
+#   with_clash_api                   the panel is shater's own web server;
+#                                    generate emits no clash_api service.
+#   with_dhcp                        resolver types are udp/tcp/doh/dot/local/
+#                                    fakeip; no dhcp:// transport is generated.
+#   with_tailscale,with_acme,with_ech,with_usbip,with_cloudflared,with_ocm,
+#   with_ccm,with_v2ray_api,with_reality_server
+#                                    nothing in shater/parse or shater/generate
+#                                    can produce them; hysteria2 `ech=` is
+#                                    refused with a warning in the parser.
+#
+# Adding a tag here is cheap. REMOVING one is a product decision: run
+# `scripts/check-router-tags.sh` — it fails if the set no longer covers a
+# declared feature, and it fails if the shipped combination cannot construct
+# every protocol through box.New.
+
+SHATER_ROUTER_TAGS="with_gvisor,with_quic,with_wireguard,with_utls,badlinkname,tfogo_checklinkname0,with_xhttp,with_awg,with_lx_command"
+
+# Linker flags the tag set REQUIRES (they are not optional trimming: `badlinkname`
+# without -checklinkname=0 fails at link time with
+# "invalid reference to crypto/tls.(*Conn).handlePostHandshakeMessage").
+SHATER_ROUTER_LDFLAGS="-checklinkname=0"
@@ -74,6 +74,19 @@ type Applier struct {
 	stateMu sync.RWMutex
 	holding bool

+	// traffic is WHERE THE TRAFFIC GOES under the config that is currently running:
+	// tunnelled, split, straight out, or blocked (see generate.TrafficOf). It is
+	// computed from the generated option.Options at the moment they are handed to
+	// the engine, so it describes what runs rather than what is on disk.
+	//
+	// Deliberately separate from `holding` and from Plane, which answer "how much of
+	// the data plane is installed". The panel used to read Plane == "full" as
+	// "protected" and said so under a green LED on a router whose only rule was
+	// `default -> direct`; the plane really was fully installed, and the whole LAN
+	// really was going out the plain WAN. Zero value = not known (no successful
+	// apply in this process yet), which is NOT the same as "tunnel".
+	traffic generate.Traffic // guarded by stateMu
+
 	// lastWarnings is the normalised warning set from the last SUCCESSFUL apply,
 	// published through Status so the panel can show fail-open degradations
 	// (a blocklist that did not load, a DoH host left reachable) instead of
@@ -514,6 +527,12 @@ func (a *Applier) applyLocked(m *model.Model) (bool, error) {
 	}
 	a.setHolding(false)
 	a.lastGood = m
+	// Publish where this config actually sends traffic, read off the very options
+	// the engine was just handed (a.eng.Apply above). The engine's hash fast-path
+	// may have skipped a swap, in which case these options are hash-equal to what is
+	// already running — either way they are the running config, which is the only
+	// config this verdict may describe.
+	a.setTraffic(generate.TrafficOf(opts))
 	// Publish the warnings of THIS successful apply, in one normalised set, and log
 	// them in one consistent format. Status carries them to the panel so a
 	// fail-open degradation is visible in the UI instead of only in logread.
@@ -557,6 +576,11 @@ func (a *Applier) applyLocked(m *model.Model) (bool, error) {
 // With the kill-switch OPEN nothing is installed — fail-open is the operator's
 // documented choice and this must not quietly override it.
 func (a *Applier) holdLocked(m *model.Model, cause error) {
+	// The engine is not carrying anything, so whatever the last running config did
+	// with traffic is no longer true of this router. Forget it either way — a stale
+	// "tunnel" verdict left behind by a config that is no longer running is the same
+	// reassuring lie in a different place.
+	a.setTraffic(generate.Traffic{})
 	if !killSwitchClosed(m.Globals) {
 		a.log.Warn("engine is down and kill_switch=open: LAN traffic is NOT protected (documented fail-open): ", cause)
 		return
@@ -640,6 +664,22 @@ func (a *Applier) setHolding(v bool) {
 	a.stateMu.Unlock()
 }

+// Traffic returns where the traffic of the CURRENTLY RUNNING config goes. The
+// zero value means no config of this process's is running (nothing applied yet,
+// or the plane was torn down / put on hold), and callers must render that as
+// "unknown", never as protected.
+func (a *Applier) Traffic() generate.Traffic {
+	a.stateMu.RLock()
+	defer a.stateMu.RUnlock()
+	return a.traffic
+}
+
+func (a *Applier) setTraffic(t generate.Traffic) {
+	a.stateMu.Lock()
+	a.traffic = t
+	a.stateMu.Unlock()
+}
+
 func (a *Applier) setWarnings(ws []Warning) {
 	a.stateMu.Lock()
 	a.lastWarnings = ws
@@ -723,6 +763,7 @@ func (a *Applier) Teardown() error {
 	a.lastGood = nil
 	a.lastNft = ""
 	a.setHolding(false)
+	a.setTraffic(generate.Traffic{})
 	a.setWarnings(nil)
 	// The plane is gone, so the logged set no longer describes anything. Forget it,
 	// and the next apply re-announces its warnings in full rather than staying
@@ -1003,6 +1044,20 @@ type Status struct {
 	//	         say so rather than looking healthy.
 	Plane string `json:"plane"`

+	// Traffic is WHERE THE TRAFFIC GOES under the running config — tunnelled, split,
+	// straight out, or blocked (see generate.Traffic).
+	//
+	// Plane does NOT answer this, and reading it as if it did is the defect this
+	// field exists for. Plane == "full" only means the table, the policy routing and
+	// the engine are all in place; a router whose one rule is `default -> direct` has
+	// all three and sends every packet out the plain WAN with its real address. The
+	// panel showed that as "Protected — traffic is going through the tunnel".
+	//
+	// Zero value (Verdict == "") means unknown: no successful apply has run in this
+	// daemon process yet, or the plane is on hold / torn down. A consumer must render
+	// that as unknown and never as protected.
+	Traffic generate.Traffic `json:"traffic"`
+
 	// Warnings is the normalised warning set from the last successful apply:
 	// everything that was skipped, degraded or left un-applied while the apply
 	// still succeeded. Always non-nil so the panel can map over it unconditionally.
@@ -1082,6 +1137,7 @@ func (a *Applier) Status() Status {
 		Hash:          a.eng.Hash(),
 		CanRollback:   a.canRollback(),
 		EngineRunning: a.eng.Running(),
+		Traffic:       a.Traffic(),
 		Warnings:      a.Warnings(),
 	}
 	s.StartedUnix, s.UptimeSeconds = processUptime(time.Now())
@@ -0,0 +1,47 @@
+package apply
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/sagernet/sing-box/shater/engine"
+	"github.com/sagernet/sing-box/shater/generate"
+	"github.com/sagernet/sing-box/shater/model"
+)
+
+// TestStatusReportsTraffic pins the wiring the panel's headline depends on.
+//
+// Plane says how much of the data plane is installed; it does NOT say where the
+// traffic goes, and reading it as if it did put "Protected — traffic is going
+// through the tunnel" on a router whose only rule was `default -> direct`. The
+// verdict that answers the real question travels in Status.Traffic, so it must
+// (a) start unknown, (b) surface what the last successful apply published, and
+// (c) go back to unknown the moment the engine stops carrying that config.
+func TestStatusReportsTraffic(t *testing.T) {
+	a := New(engine.New(), nil)
+
+	// A fresh applier has applied nothing, so it knows nothing. The zero value must
+	// NOT read as any verdict — least of all "tunnel".
+	if got := a.Status().Traffic; got.Verdict != "" {
+		t.Fatalf("fresh applier: Traffic.Verdict = %q, want \"\" (unknown)", got.Verdict)
+	}
+
+	a.setTraffic(generate.Traffic{Verdict: generate.VerdictTunnel, Default: "auto", TunnelRules: 2})
+	got := a.Status().Traffic
+	if got.Verdict != generate.VerdictTunnel || got.Default != "auto" || got.TunnelRules != 2 {
+		t.Fatalf("Status().Traffic = %+v, want the verdict the last apply published", got)
+	}
+
+	// The engine is down and the config it was running is no longer in force. A
+	// verdict left over from it would be the same reassuring lie, one layer down.
+	// (kill_switch=open takes holdLocked's early return, which is precisely the path
+	// that must still forget the verdict.)
+	g := model.DefaultGlobals()
+	g.KillSwitch = "open"
+	a.mu.Lock()
+	a.holdLocked(&model.Model{Globals: g}, errors.New("engine start failed"))
+	a.mu.Unlock()
+	if got := a.Status().Traffic; got.Verdict != "" {
+		t.Fatalf("after hold: Traffic.Verdict = %q, want \"\" (unknown) — the engine is not carrying that config", got.Verdict)
+	}
+}
@@ -20,6 +20,7 @@ import (
 	"net/netip"
 	"strings"

+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
 	"github.com/sagernet/sing-box/shater/model"
 	"github.com/sagernet/sing-box/shater/netplane"
@@ -30,6 +31,110 @@ import (
 // engine.RuleSetIPCIDRs).
 type ruleSetCIDRs func(tag string) ([]netip.Prefix, bool)

+// SCHEMA v2 MOVED A RULE'S DESTINATION OUT OF THE RULE, AND THIS FILE HAD TO FOLLOW.
+//
+// Until D21 a routing rule spelled its destination inline: `dst_domain` became
+// DefaultRule.Domain*, `dst_ip` became DefaultRule.IPCIDR. Both were visible right
+// on the rule, so matchesUntunnelable could read them off it and the ADDRESS half
+// could only ever be resolved through the engine for the rare geosite/geoip case.
+//
+// Since v2 a rule names a `config ruleset` and generate materialises it into
+// Route.RuleSet, so BOTH halves arrive by reference. That broke two things at once,
+// in opposite directions:
+//
+//   - DOMAINS WENT INVISIBLE. A v1 rule `dst_domain=[bank.ru] dst_ip=[10/8]` ANDed
+//     its matchers, so it could not match an ICMP packet (no domain in one) and this
+//     file skipped it. After migration the same rule reads `rule_set: [rule-x,
+//     rule-x-ip]`, whose two sets are ORed — so the address set alone would make the
+//     rule look applicable, and the plan would start emitting an ALLOW (target
+//     direct) or a DENY (target block) for 10/8 that the operator never asked for.
+//     The ALLOW is the dangerous half: it sends previously-tunnelled ICMP out with
+//     the client's real address, i.e. an upgrade silently opening a leak. So a rule
+//     whose rule-sets are KNOWN to carry domain matchers is treated exactly as its
+//     v1 form was: inapplicable to untunnelable traffic. (The OR is deliberate and
+//     documented in D21 for the ENGINE's TCP/UDP path; it does not follow that a
+//     leak-guard should widen itself during an upgrade without a word.)
+//   - ADDRESSES WENT ENGINE-ONLY. `rule-x-ip` is an INLINE rule-set: its prefixes
+//     are sitting right there in the generated options. Asking the engine for them
+//     — and, when the engine is not up, truncating the whole walk and denying
+//     everything — was needless. Inline sets are now read from the options, so an
+//     engine that has not started yet no longer costs the operator their ping.
+//
+// Both come from the same index, built once per plan: what the CONFIG ITSELF can
+// say about each rule-set. Remote/local sets stay the engine's business.
+
+// ruleSetFacts is what the generated options alone reveal about one rule-set.
+//
+// opaque means "not knowable from here" — a local/remote set (only the engine has
+// its contents) or an inline set with a rule shape this code does not model. An
+// opaque set is never used to conclude anything; it falls through to the engine
+// lookup exactly as before.
+type ruleSetFacts struct {
+	opaque    bool
+	hasDomain bool           // carries a matcher only a NAMED destination can satisfy
+	cidrs     []netip.Prefix // addresses, when they are knowable here
+}
+
+// indexRuleSets summarises every rule-set in the generated options by tag.
+func indexRuleSets(sets []option.RuleSet) map[string]ruleSetFacts {
+	out := make(map[string]ruleSetFacts, len(sets))
+	for _, rs := range sets {
+		var f ruleSetFacts
+		// option.RuleSet leaves Type empty for inline in some marshalled forms; the
+		// generator always sets it, and both spellings mean the same thing here.
+		if rs.Type != C.RuleSetTypeInline && rs.Type != "" {
+			f.opaque = true
+			out[rs.Tag] = f
+			continue
+		}
+		for _, hr := range rs.InlineOptions.Rules {
+			if hr.Type != C.RuleTypeDefault && hr.Type != "" {
+				// A logical headless rule, or a shape sing-box adds later. Never guessed
+				// at — the same rule the walk itself follows for a logical route rule.
+				f = ruleSetFacts{opaque: true}
+				break
+			}
+			d := hr.DefaultOptions
+			if headlessNeedsUnavailableMatcher(d) {
+				f.hasDomain = true
+			}
+			f.cidrs = append(f.cidrs, parsePrefixes(d.IPCIDR)...)
+		}
+		out[rs.Tag] = f
+	}
+	return out
+}
+
+// headlessNeedsUnavailableMatcher is matchesUntunnelable's predicate for the
+// HEADLESS rule shape a rule-set carries. It reports whether the rule demands
+// something a packet with no domain, no ports, no sniffed protocol and no process
+// identity cannot supply — in which case that rule-set cannot claim such a packet.
+//
+// The generator only ever emits domain matchers or ip_cidr into an inline routing
+// rule-set, so in practice this is the domain test; the rest is there so a future
+// matcher is refused rather than silently ignored.
+func headlessNeedsUnavailableMatcher(d option.DefaultHeadlessRule) bool {
+	switch {
+	case len(d.Domain) > 0, len(d.DomainSuffix) > 0, len(d.DomainKeyword) > 0,
+		len(d.DomainRegex) > 0, len(d.AdGuardDomain) > 0:
+		return true // no domain in an ICMP/ESP/GRE packet
+	case len(d.Port) > 0, len(d.PortRange) > 0, len(d.SourcePort) > 0, len(d.SourcePortRange) > 0:
+		return true
+	case len(d.Network) > 0, len(d.QueryType) > 0:
+		return true
+	case len(d.ProcessName) > 0, len(d.ProcessPath) > 0, len(d.ProcessPathRegex) > 0,
+		len(d.PackageName) > 0, len(d.PackageNameRegex) > 0:
+		return true
+	case len(d.WIFISSID) > 0, len(d.WIFIBSSID) > 0:
+		return true
+	case d.Invert:
+		// Same reasoning as the route-rule case: inverting flips every conservative
+		// assumption, so the set may only ever withhold, never grant.
+		return true
+	}
+	return false
+}
+
 // buildUntunnelablePlan reduces the resolved routing rules to the first-match
 // walk the nft forward chain can evaluate for a packet that has no domain, no
 // ports and no sniffable protocol.
@@ -57,6 +162,9 @@ func buildUntunnelablePlan(opts option.Options, lookup ruleSetCIDRs) *netplane.U
 		// No routing at all: nothing is provably direct.
 		return plan
 	}
+	// Since schema v2 a rule's destination lives in a rule-set, so the rule-sets
+	// have to be read alongside the rules. See the block above ruleSetFacts.
+	sets := indexRuleSets(opts.Route.RuleSet)

 	for _, r := range opts.Route.Rules {
 		if r.Type == "logical" {
@@ -78,7 +186,10 @@ func buildUntunnelablePlan(opts option.Options, lookup ruleSetCIDRs) *netplane.U
 		// and the destination logic never allowed anything. Its `protocol: dns`
 		// matcher makes it inapplicable to a packet with no stream to sniff, which
 		// is the correct and obvious reading once the checks are in this order.
-		if !matchesUntunnelable(d) {
+		if !matchesUntunnelable(d, sets) {
+			if note, ok := namedDestinationNote(d, sets); ok {
+				plan.Warnings = append(plan.Warnings, note)
+			}
 			continue // needs a domain/port/protocol: cannot apply to this traffic
 		}

@@ -96,21 +207,28 @@ func buildUntunnelablePlan(opts option.Options, lookup ruleSetCIDRs) *netplane.U
 		mt := netplane.UntunnelableMatch{Allow: verdict}

 		// Destination predicate: explicit ip_cidr plus every rule-set's addresses.
+		// An INLINE rule-set is answered straight out of the config — it is fully
+		// present there — so a rule whose lists are all inline no longer depends on
+		// the engine being up. Only local/remote sets still have to be asked for.
 		dst := parsePrefixes(d.IPCIDR)
-		resolvable := true
+		var unresolved string
 		for _, tag := range d.RuleSet {
+			if f, known := sets[tag]; known && !f.opaque {
+				dst = append(dst, f.cidrs...)
+				continue
+			}
 			prefixes, ok := lookup(tag)
 			if !ok {
-				resolvable = false
+				unresolved = tag
 				break
 			}
 			dst = append(dst, prefixes...)
 		}
-		if !resolvable {
+		if unresolved != "" {
 			plan.Warnings = append(plan.Warnings, fmt.Sprintf(
 				"list %q is not loaded yet, so ping/IPTV/VPN passthrough stays blocked for the "+
 					"addresses it covers (it resolves itself once the list downloads)",
-				strings.Join(d.RuleSet, ", ")))
+				unresolved))
 			return plan
 		}
 		hasDstMatcher := len(d.IPCIDR) > 0 || len(d.RuleSet) > 0
@@ -198,7 +316,20 @@ func classifyAction(a option.RuleAction) (isDirect bool, class int) {
 // Every matcher listed here is one the packet cannot satisfy, so a rule carrying
 // any of them is inapplicable rather than universally matching. Matchers ANDed
 // within a rule mean one unsatisfiable matcher makes the whole rule unsatisfiable.
-func matchesUntunnelable(d option.DefaultRule) bool {
+//
+// sets carries the same test for the matchers that are no longer written on the
+// rule: since schema v2 a destination is a rule-set reference, so a rule's domains
+// live in Route.RuleSet rather than in d.Domain*. A rule referencing a set that is
+// KNOWN to match by name is inapplicable here for exactly the reason a d.Domain
+// rule is — the packet has no name to match. Sets whose contents this code cannot
+// see (local/remote) say nothing either way; the address walk below already refuses
+// to conclude anything from them.
+func matchesUntunnelable(d option.DefaultRule, sets map[string]ruleSetFacts) bool {
+	for _, tag := range d.RuleSet {
+		if sets[tag].hasDomain {
+			return false
+		}
+	}
 	switch {
 	case len(d.Domain) > 0, len(d.DomainSuffix) > 0, len(d.DomainKeyword) > 0,
 		len(d.DomainRegex) > 0, len(d.Geosite) > 0:
@@ -229,6 +360,41 @@ func matchesUntunnelable(d option.DefaultRule) bool {
 	return true
 }

+// namedDestinationNote explains the one skip an operator can actually be
+// surprised by: a rule that names BOTH a domain list and an address list.
+//
+// A domain-only rule contributes nothing here and always has, so saying so would be
+// noise. A mixed rule is different — its addresses look like something this plan
+// could act on, and it is precisely the shape `shaterd migrate` produces from a v1
+// rule that carried dst_domain and dst_ip together. The rule is skipped so the
+// upgrade cannot quietly change what ping does (see the block above ruleSetFacts);
+// that decision is worth one line in the operator's warning list rather than none.
+//
+// ok=false when there is nothing surprising to report.
+func namedDestinationNote(d option.DefaultRule, sets map[string]ruleSetFacts) (string, bool) {
+	var named []string
+	addressed := len(d.IPCIDR) > 0
+	for _, tag := range d.RuleSet {
+		f, known := sets[tag]
+		if known && f.hasDomain {
+			named = append(named, tag)
+			continue
+		}
+		// An unknown/opaque set may well hold addresses; so may a knowable one.
+		if !known || f.opaque || len(f.cidrs) > 0 {
+			addressed = true
+		}
+	}
+	if len(named) == 0 || !addressed {
+		return "", false
+	}
+	return fmt.Sprintf(
+		"a routing rule matches by name (%s) as well as by address, and ping/IPTV/VPN-passthrough traffic "+
+			"carries no name — so that rule is left out of the ping/IPTV decision entirely and later rules "+
+			"decide those addresses. Split it into a name rule and an address rule if you want the addresses "+
+			"decided here", strings.Join(named, ", ")), true
+}
+
 // parsePrefixes converts CIDR/bare-address strings to prefixes, dropping anything
 // unparseable (it cannot be matched on, so it must not silently widen a set).
 func parsePrefixes(in []string) []netip.Prefix {
@@ -22,6 +22,16 @@ func tunnelModel() *model.Model {
 	return m
 }

+// pinnedIPSet declares the inline `type=ipcidr` rule-set a rule pins its
+// destination addresses with. Since schema v2 a routing rule has no dst_ip of its
+// own: addresses are a `config ruleset`, so the generated rule carries a rule_set
+// reference and the plan resolves the actual prefixes through the lookup below —
+// i.e. through the RUNNING engine in production (engine.RuleSetIPCIDRs), not out
+// of the config text. planFor's table stands in for that.
+func pinnedIPSet(name string, cidrs ...string) model.Ruleset {
+	return model.Ruleset{Name: name, Type: "ipcidr", Source: "inline", Entries: cidrs}
+}
+
 // planFor generates m and builds the untunnelable plan, resolving rule-set tags
 // from the supplied table. A tag absent from the table reports "not loaded".
 func planFor(t *testing.T, m *model.Model, sets map[string][]string) *netplane.UntunnelablePlan {
@@ -58,11 +68,12 @@ func renderPlan(t *testing.T, m *model.Model, plan *netplane.UntunnelablePlan) s
 // only 8.8.8.8 may be un-pingable and the rest of the internet must answer.
 func TestOnlyPinnedAddressIsTunnelled(t *testing.T) {
 	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{pinnedIPSet("pin", "8.8.8.8/32")}
 	m.Rules = []model.Rule{
-		{Name: "pin", Enabled: true, Order: 10, DstIP: []string{"8.8.8.8/32"}, Target: "group:auto"},
+		{Name: "pin", Enabled: true, Order: 10, DstRuleset: []string{"pin"}, Target: "group:auto"},
 		{Name: "rest", Enabled: true, Order: 99, Target: "direct"},
 	}
-	plan := planFor(t, m, nil)
+	plan := planFor(t, m, map[string][]string{"rs-pin": {"8.8.8.8/32"}})

 	if !plan.DefaultAllow {
 		t.Fatalf("a catch-all `direct` rule must make the default ALLOW; plan=%+v", plan)
@@ -221,14 +232,148 @@ func TestDomainRuleDoesNotAffectUntunnelable(t *testing.T) {
 	}
 }

-// TestBlockedRuleDenies: an explicitly blocked destination stays dropped.
-func TestBlockedRuleDenies(t *testing.T) {
+// --- schema v2: the destination moved into rule-sets, and so did the analysis ---
+
+// migratedRule reproduces exactly what `shaterd migrate` makes of a v1 rule that
+// carried BOTH lists: `dst_domain=[bank.ru] dst_ip=[203.0.113.0/24]` becomes two
+// inline rule-sets, `rule-x` and `rule-x-ip`, and the rule references both.
+func migratedRule(target string) *model.Model {
 	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{
+		{Name: "rule-x", Type: "domain", Source: "inline", Entries: []string{"full:bank.ru"}},
+		pinnedIPSet("rule-x-ip", "203.0.113.0/24"),
+	}
 	m.Rules = []model.Rule{
-		{Name: "bad", Enabled: true, Order: 10, DstIP: []string{"203.0.113.0/24"}, Target: "block"},
+		{Name: "x", Enabled: true, Order: 10,
+			DstRuleset: []string{"rule-x", "rule-x-ip"}, Target: target},
+		{Name: "dflt", Enabled: true, Order: 99, Target: "group:auto"},
+	}
+	return m
+}
+
+// TestMigratedDomainAndIPRuleStaysOutOfTheUntunnelablePlan is the upgrade
+// regression. In v1 the rule ANDed its domain and its addresses, so it could never
+// claim a packet that carries no domain and this plan skipped it. After the
+// migration the same rule reads `rule_set: [rule-x, rule-x-ip]`, and rule_set
+// entries are ORed — so the address set alone made the rule look applicable and the
+// plan started emitting a verdict for 203.0.113.0/24 that nobody asked for.
+//
+// With target=direct that verdict is an ALLOW, i.e. an upgrade quietly sending
+// previously-tunnelled ICMP out with the client's real source address. That is the
+// half that makes this a leak and not just a surprise, so it is checked first.
+func TestMigratedDomainAndIPRuleStaysOutOfTheUntunnelablePlan(t *testing.T) {
+	// Both engine states, because they fail differently: with the engine UP the old
+	// code emitted a live verdict for the addresses, and with it DOWN the same
+	// mistake hid behind the unresolvable-list truncation. Neither may happen.
+	for _, target := range []string{"direct", "block", "group:auto"} {
+		for _, engine := range []string{"up", "down"} {
+			t.Run(target+"/engine-"+engine, func(t *testing.T) {
+				m := migratedRule(target)
+				var loaded map[string][]string
+				if engine == "up" {
+					loaded = map[string][]string{"rs-rule-x": {}, "rs-rule-x-ip": {"203.0.113.0/24"}}
+				}
+				plan := planFor(t, m, loaded)
+
+				if len(plan.Matches) != 0 {
+					t.Fatalf("a rule that matches by NAME as well as by address must contribute no "+
+						"address step (it cannot match a packet that carries no name): %+v", plan.Matches)
+				}
+				if plan.DefaultAllow {
+					t.Errorf("the catch-all routes into the tunnel, so the default must still deny")
+				}
+				fwd := renderPlan(t, m, plan)
+				if strings.Contains(fwd, "203.0.113.0/24") {
+					t.Errorf("the migrated address list must not reach the data plane through the "+
+						"untunnelable policy:\n%s", fwd)
+				}
+			})
+		}
+	}
+}
+
+// TestMigratedDomainAndIPRuleSaysWhyItWasSkipped: skipping is the safe answer, but
+// a silently different ping after an upgrade is the complaint this whole change
+// exists to answer. The mixed rule — the exact shape migration produces — is named.
+func TestMigratedDomainAndIPRuleSaysWhyItWasSkipped(t *testing.T) {
+	plan := planFor(t, migratedRule("direct"), nil)
+	var seen bool
+	for _, w := range plan.Warnings {
+		if strings.Contains(w, "matches by name") && strings.Contains(w, "rs-rule-x") {
+			seen = true
+		}
+	}
+	if !seen {
+		t.Fatalf("the skip must be explained and the list named; warnings=%v", plan.Warnings)
+	}
+}
+
+// TestDomainOnlyRuleSetIsQuiet: a rule whose only destination is a NAME list has
+// always contributed nothing here and is not a surprise, so it must not produce a
+// note. Only the mixed shape is worth a line.
+func TestDomainOnlyRuleSetIsQuiet(t *testing.T) {
+	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{
+		{Name: "names", Type: "domain", Source: "inline", Entries: []string{"full:bank.ru"}},
+	}
+	m.Rules = []model.Rule{
+		{Name: "names", Enabled: true, Order: 10, DstRuleset: []string{"names"}, Target: "group:auto"},
 		{Name: "rest", Enabled: true, Order: 99, Target: "direct"},
 	}
 	plan := planFor(t, m, nil)
+	if !plan.DefaultAllow {
+		t.Errorf("a name-only rule must not withhold the catch-all allow; plan=%+v", plan)
+	}
+	for _, w := range plan.Warnings {
+		if strings.Contains(w, "matches by name") {
+			t.Errorf("a name-only rule is not a surprise and needs no note: %q", w)
+		}
+	}
+}
+
+// TestInlineRuleSetNeedsNoEngine: an inline rule-set's addresses are sitting in the
+// generated config. Asking the engine for them — and, while it is down, truncating
+// the whole walk so ping/IPTV/VPN passthrough dies everywhere — was a conservative
+// answer to a question that did not have to be asked. The verdict must now be the
+// same whether or not the engine is up.
+func TestInlineRuleSetNeedsNoEngine(t *testing.T) {
+	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{pinnedIPSet("pin", "8.8.8.8/32")}
+	m.Rules = []model.Rule{
+		{Name: "pin", Enabled: true, Order: 10, DstRuleset: []string{"pin"}, Target: "group:auto"},
+		{Name: "rest", Enabled: true, Order: 99, Target: "direct"},
+	}
+
+	down := planFor(t, m, nil)                                         // engine not up
+	up := planFor(t, m, map[string][]string{"rs-pin": {"8.8.8.8/32"}}) // engine up
+
+	for name, plan := range map[string]*netplane.UntunnelablePlan{"engine-down": down, "engine-up": up} {
+		if !plan.DefaultAllow {
+			t.Fatalf("%s: the catch-all direct must allow the rest of the internet; plan=%+v", name, plan)
+		}
+		if len(plan.Matches) != 1 || plan.Matches[0].Allow {
+			t.Fatalf("%s: the tunnelled address must produce one DENY step, got %+v", name, plan.Matches)
+		}
+		if got := plan.Matches[0].Dst4; len(got) != 1 || got[0] != "8.8.8.8/32" {
+			t.Fatalf("%s: step destinations = %v, want [8.8.8.8/32]", name, got)
+		}
+	}
+	for _, w := range down.Warnings {
+		if strings.Contains(w, "not loaded yet") {
+			t.Errorf("an inline list is never 'not loaded': %q", w)
+		}
+	}
+}
+
+// TestBlockedRuleDenies: an explicitly blocked destination stays dropped.
+func TestBlockedRuleDenies(t *testing.T) {
+	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{pinnedIPSet("bad", "203.0.113.0/24")}
+	m.Rules = []model.Rule{
+		{Name: "bad", Enabled: true, Order: 10, DstRuleset: []string{"bad"}, Target: "block"},
+		{Name: "rest", Enabled: true, Order: 99, Target: "direct"},
+	}
+	plan := planFor(t, m, map[string][]string{"rs-bad": {"203.0.113.0/24"}})
 	if len(plan.Matches) != 1 || plan.Matches[0].Allow {
 		t.Fatalf("a blocked destination must deny untunnelable traffic too: %+v", plan.Matches)
 	}
@@ -361,11 +506,12 @@ func TestPlanNeverAcceptsTCPOrUDP(t *testing.T) {
 			m := tunnelModel()
 			m.Globals.IPv6 = true
 			m.Globals.Untunnelable = policy
+			m.Rulesets = []model.Ruleset{pinnedIPSet("pin", "8.8.8.8/32")}
 			m.Rules = []model.Rule{
-				{Name: "pin", Enabled: true, Order: 10, DstIP: []string{"8.8.8.8/32"}, Target: "group:auto"},
+				{Name: "pin", Enabled: true, Order: 10, DstRuleset: []string{"pin"}, Target: "group:auto"},
 				{Name: "rest", Enabled: true, Order: 99, Target: "direct"},
 			}
-			fwd := renderPlan(t, m, planFor(t, m, nil))
+			fwd := renderPlan(t, m, planFor(t, m, map[string][]string{"rs-pin": {"8.8.8.8/32"}}))

 			// Only the lines the untunnelable policy emits are in scope: the tproxy
 			// diverts in prerouting legitimately match TCP/UDP, which is their job.
@@ -424,12 +570,13 @@ func TestLocalPlaneSurvivesEveryPlan(t *testing.T) {
 // only grant those clients, not everyone.
 func TestSourceScopedRuleNarrowsTheAllow(t *testing.T) {
 	m := tunnelModel()
+	m.Rulesets = []model.Ruleset{pinnedIPSet("lab", "198.51.100.0/24")}
 	m.Rules = []model.Rule{
 		{Name: "lab", Enabled: true, Order: 10, Src: []string{"192.168.9.0/24"},
-			DstIP: []string{"198.51.100.0/24"}, Target: "direct"},
+			DstRuleset: []string{"lab"}, Target: "direct"},
 		{Name: "dflt", Enabled: true, Order: 99, Target: "group:auto"},
 	}
-	plan := planFor(t, m, nil)
+	plan := planFor(t, m, map[string][]string{"rs-lab": {"198.51.100.0/24"}})
 	if len(plan.Matches) != 1 {
 		t.Fatalf("expected one step, got %+v", plan.Matches)
 	}
@@ -0,0 +1,206 @@
+// Package buildtags is the contract between what shater DECLARES it supports
+// and the build tags the shipped router binary is actually compiled with.
+//
+// # Why this package exists
+//
+// The router binary is built with a deliberately trimmed tag set (D9/D23,
+// scripts/router-tags.sh) — upstream's full set registers a zoo shater/generate
+// can never emit, and a router pays for every tag in flash and in RAM. Trimming
+// is right; trimming BLIND is not. On 2026-07-25 a production router answered a
+// configured WireGuard node with
+//
+//	create instance: initialize endpoint[0]: create WireGuard device:
+//	gVisor is not included in this build, rebuild with -tags with_gvisor
+//
+// because `with_gvisor` had been trimmed as "unreachable code" (true for the tun
+// inbound we never emit — false for the WireGuard endpoint we ship and declare
+// [MVP]) while `with_wireguard` stayed. Nothing caught it: the test suite builds
+// with the FULL upstream tag set, so the SHIPPED tag combination was, at that
+// point, the one configuration nothing in the repo ever exercised.
+//
+// # What holds it together now
+//
+//  1. Features below names each declared feature and the build tags it needs to
+//     RUN (not merely to compile). shater/buildtags's own test parses
+//     scripts/router-tags.sh and fails if the shipped set does not cover them —
+//     it needs no tags, no Linux and no network, so it runs in every plain
+//     `go test ./...`.
+//  2. shater/generate's TestShippedTagSetConstructsDeclaredProtocols drives one
+//     node of every declared protocol through box.New under whatever tags the
+//     test binary was built with, skipping only what is genuinely not compiled
+//     in. scripts/check-router-tags.sh runs it with the SHIPPED set, so the
+//     combination we ship is proven to construct, not merely to link.
+//
+// (1) catches a trimmed dependency the moment it is trimmed; (2) catches the
+// class of failure (1) cannot model — a tag that is present but insufficient.
+//
+// Adding a protocol to shater/parse + shater/generate means adding a row here.
+package buildtags
+
+import "sort"
+
+// Feature is one capability the product declares, together with the build tags
+// the binary must carry for it to work at runtime.
+type Feature struct {
+	// Name is the feature as a user would name it.
+	Name string
+	// Declared points at where we promise it (docs-shater/FEATURES.md section,
+	// or the generator/registry that emits it).
+	Declared string
+	// Tags are ALL build tags required for the feature to work — including
+	// transitive ones (with_awg alone is useless without with_wireguard, which
+	// is useless without with_gvisor). Listing them transitively is deliberate:
+	// the check must not depend on a dependency graph nobody maintains.
+	Tags []string
+	// Why explains what breaks without those tags, with the code anchor. It is
+	// printed by the failing test, so a future trimmer reads the reason instead
+	// of rediscovering it on a router.
+	Why string
+}
+
+// Features is the authoritative list. Only tag-GATED capabilities belong here:
+// tproxy, routing rules, rule-sets, the DNS filter, nft/policy routing and the
+// panel are compiled unconditionally and cannot be lost to a tag trim.
+var Features = []Feature{
+	{
+		Name:     "WireGuard nodes (wg:// / wireguard:// links, wg-quick .conf import)",
+		Declared: "FEATURES.md §Proxy engine — “VLESS, VMess, Trojan, Shadowsocks, WireGuard” [MVP]",
+		Tags:     []string{"with_wireguard", "with_gvisor"},
+		Why: "with_wireguard registers the endpoint (shater/registry/registry_wireguard.go); " +
+			"with_gvisor supplies the userspace netstack EVERY WireGuard device needs — without it " +
+			"transport/wireguard/device_stack_stub.go returns tun.ErrGVisorNotIncluded from BOTH " +
+			"newStackDevice and newSystemStackDevice, so box.New fails with " +
+			"\"create WireGuard device: gVisor is not included in this build\" and the node is dead. " +
+			"system_interface=true is not an escape hatch: it hits the same stub.",
+	},
+	{
+		Name:     "AmneziaWG obfuscation (awg:// links; jc/jmin/jmax, s1-s4, h1-h4, i1-i5)",
+		Declared: "FEATURES.md §Proxy engine — “AmneziaWG 2.0 … a driving requirement” [MVP]",
+		Tags:     []string{"with_awg", "with_wireguard", "with_gvisor"},
+		Why: "with_awg makes the AWG params reach the device (transport/wireguard/device_awg.go); " +
+			"without it they parse and are silently ignored (option/wireguard.go). It rides on the " +
+			"WireGuard endpoint, so it needs that feature's tags too.",
+	},
+	{
+		Name:     "Hysteria2 nodes (hysteria2:// / hy2://)",
+		Declared: "FEATURES.md §Proxy engine [T1]; shater/registry registerQUICOutbounds",
+		Tags:     []string{"with_quic"},
+		Why:      "hysteria2.RegisterOutbound is compiled only under with_quic (shater/registry/registry_quic.go); without it box.New rejects the outbound as an unknown type.",
+	},
+	{
+		Name:     "TUIC nodes (tuic://)",
+		Declared: "FEATURES.md §Proxy engine [T1]; shater/registry registerQUICOutbounds",
+		Tags:     []string{"with_quic"},
+		Why:      "tuic.RegisterOutbound is compiled only under with_quic (shater/registry/registry_quic.go).",
+	},
+	{
+		Name:     "VLESS/VMess over the QUIC v2ray transport (type=quic)",
+		Declared: "FEATURES.md §Proxy engine — “Transports: TCP/WS/gRPC/HTTPUpgrade/H2/QUIC” [MVP]",
+		Tags:     []string{"with_quic"},
+		Why:      "transport/v2rayquic registers its constructor from an init() blank-imported only under with_quic; without it NewQUICClient returns os.ErrInvalid at dial time.",
+	},
+	{
+		Name:     "QUIC / HTTP3 DNS transports (quic://, h3://)",
+		Declared: "shater/registry registerQUICTransports",
+		Tags:     []string{"with_quic"},
+		Why:      "dns/transport/quic is registered only under with_quic (shater/registry/registry_quic.go).",
+	},
+	{
+		Name:     "REALITY (vless security=reality, pbk/sid)",
+		Declared: "FEATURES.md §Proxy engine — “Reality/XTLS” [MVP]; shater/parse security=reality",
+		Tags:     []string{"with_utls"},
+		Why:      "the REALITY client lives in common/tls/reality_client.go, which is itself `//go:build with_utls`; without the tag a reality config is rejected by the TLS layer.",
+	},
+	{
+		Name:     "uTLS ClientHello fingerprints (fp=chrome/firefox/safari/…)",
+		Declared: "shater/generate/outbound.go TLS mapping (UTLS options)",
+		Tags:     []string{"with_utls"},
+		Why:      "common/tls/utls_client.go is `//go:build with_utls`; the stub (utls_stub.go) refuses a config that sets a fingerprint.",
+	},
+	{
+		Name:     "XHTTP / SplitHTTP transport (type=xhttp, type=splithttp)",
+		Declared: "FEATURES.md §Proxy engine [T1]; shater/parse/sharelink.go case \"xhttp\"",
+		Tags:     []string{"with_xhttp"},
+		Why:      "transport/v2rayxhttp registers the \"xhttp\" transport from an init() blank-imported only under with_xhttp (shater/registry/registry_xhttp.go); without it the transport type is unknown at box.New.",
+	},
+	{
+		Name:     "badtls fast path (zero-copy TLS read-wait / ktls, used by every TLS outbound)",
+		Declared: "common/badtls — linked unconditionally by the TLS client",
+		Tags:     []string{"badlinkname", "tfogo_checklinkname0"},
+		Why: "common/badtls/*.go are `go1.25 && badlinkname`; without the tag the package degrades to read_wait_stub.go. " +
+			"These two tags additionally REQUIRE -checklinkname=0 in the linker flags — the build fails at link time otherwise " +
+			"(\"invalid reference to crypto/tls.(*Conn).handlePostHandshakeMessage\"), which is why " +
+			"scripts/router-tags.sh carries SHATER_ROUTER_LDFLAGS next to the tag set.",
+	},
+}
+
+// RequiredTags is the union of every declared feature's tags, sorted.
+func RequiredTags() []string {
+	seen := map[string]bool{}
+	for _, f := range Features {
+		for _, t := range f.Tags {
+			seen[t] = true
+		}
+	}
+	return sortedKeys(seen)
+}
+
+// Compiled reports the shater-relevant build tags THIS binary was compiled with,
+// sorted. It is populated by the one-line tag_*.go twins in this package; a tag
+// with no file here is simply not tracked (and must not appear in Features).
+func Compiled() []string { return sortedKeys(compiled) }
+
+// Has reports whether this binary was compiled with tag.
+func Has(tag string) bool { return compiled[tag] }
+
+// MissingTags returns the tags f needs that this binary lacks, sorted. Empty
+// means the feature is fully compiled in.
+func MissingTags(f Feature) []string {
+	missing := map[string]bool{}
+	for _, t := range f.Tags {
+		if !compiled[t] {
+			missing[t] = true
+		}
+	}
+	return sortedKeys(missing)
+}
+
+// Tracked reports whether tag has a detector file (tag_*.go) in this package.
+// Features must only reference tracked tags — an untracked tag would silently
+// read as "not compiled" and turn a real check into a skip. TestFeatureTagsAreTracked
+// enforces that, and scripts/check-router-tags.sh additionally proves the
+// detectors match the tag set the compiler was actually handed.
+func Tracked(tag string) bool { return tracked[tag] }
+
+// TrackedTags is every tag this package can observe, i.e. exactly the tags with
+// a tag_*.go detector. Keep the two in sync — the check script fails loudly if
+// they drift.
+func TrackedTags() []string { return sortedKeys(tracked) }
+
+var tracked = map[string]bool{
+	"with_gvisor":          true,
+	"with_quic":            true,
+	"with_wireguard":       true,
+	"with_awg":             true,
+	"with_utls":            true,
+	"with_xhttp":           true,
+	"with_lx_command":      true,
+	"badlinkname":          true,
+	"tfogo_checklinkname0": true,
+}
+
+// compiled is filled by the tag_*.go detectors' init(). A tag with no detector
+// file compiled in is absent from the map, which reads as "not compiled".
+var compiled = map[string]bool{}
+
+// mark records that tag is compiled into this binary.
+func mark(tag string) { compiled[tag] = true }
+
+func sortedKeys(m map[string]bool) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
@@ -0,0 +1,175 @@
+package buildtags
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// repoFile reads a file relative to the repo root (this package sits at
+// <repo>/shater/buildtags).
+func repoFile(t *testing.T, rel string) string {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("..", "..", filepath.FromSlash(rel)))
+	if err != nil {
+		t.Fatalf("read %s: %v", rel, err)
+	}
+	return string(b)
+}
+
+// shVar pulls VAR="…" out of a POSIX sh fragment.
+func shVar(t *testing.T, script, name string) string {
+	t.Helper()
+	re := regexp.MustCompile(`(?m)^` + regexp.QuoteMeta(name) + `="([^"]*)"`)
+	m := re.FindStringSubmatch(script)
+	if m == nil {
+		t.Fatalf("scripts/router-tags.sh: %s=\"…\" not found (single line, double quotes)", name)
+	}
+	return m[1]
+}
+
+// routerTagSet returns the shipped tag set as a set, read from the ONE file that
+// defines it.
+func routerTagSet(t *testing.T) map[string]bool {
+	t.Helper()
+	set := map[string]bool{}
+	for _, tag := range strings.Split(shVar(t, repoFile(t, "scripts/router-tags.sh"), "SHATER_ROUTER_TAGS"), ",") {
+		if tag = strings.TrimSpace(tag); tag != "" {
+			set[tag] = true
+		}
+	}
+	if len(set) == 0 {
+		t.Fatal("SHATER_ROUTER_TAGS is empty")
+	}
+	return set
+}
+
+// TestRouterTagSetCoversDeclaredFeatures is THE guard the 2026-07-25 WireGuard
+// outage was missing (D23): it reads the tag set the router binary is actually
+// built with and fails if a feature we DECLARE supported has lost the build tag
+// it needs to run.
+//
+// It deliberately needs no build tags, no Linux, no privileges and no network,
+// so it runs in every plain `go test ./...` — including on the Windows dev host,
+// where nothing else can exercise the shipped configuration. The behavioural
+// half (does the shipped combination actually CONSTRUCT?) is
+// shater/generate.TestShippedTagSetConstructsDeclaredProtocols, run with this
+// same set by scripts/check-router-tags.sh.
+func TestRouterTagSetCoversDeclaredFeatures(t *testing.T) {
+	shipped := routerTagSet(t)
+
+	for _, f := range Features {
+		var missing []string
+		for _, tag := range f.Tags {
+			if !shipped[tag] {
+				missing = append(missing, tag)
+			}
+		}
+		if len(missing) > 0 {
+			t.Errorf("the shipped router binary would NOT support a feature we declare.\n"+
+				"  feature : %s\n"+
+				"  declared: %s\n"+
+				"  missing : %s  (not in SHATER_ROUTER_TAGS, scripts/router-tags.sh)\n"+
+				"  why     : %s\n"+
+				"Either add the tag back, or stop declaring the feature — those are the only two honest options.",
+				f.Name, f.Declared, strings.Join(missing, ", "), f.Why)
+		}
+	}
+}
+
+// TestFeatureTagsAreTracked keeps Features honest: every tag it names must have
+// a tag_*.go detector, or Compiled()/MissingTags() would report it absent even
+// when it is compiled in — and the behavioural test would silently SKIP the
+// feature instead of checking it. A false green is worse than a red.
+func TestFeatureTagsAreTracked(t *testing.T) {
+	for _, f := range Features {
+		for _, tag := range f.Tags {
+			if !Tracked(tag) {
+				t.Errorf("feature %q requires tag %q, which has no detector: add shater/buildtags/tag_%s.go and the entry in the tracked map", f.Name, tag, tag)
+			}
+		}
+	}
+}
+
+// TestTrackedTagsHaveDetectorFiles pairs the tracked map with the files on disk,
+// so a renamed/deleted detector cannot quietly make a tag read as absent.
+func TestTrackedTagsHaveDetectorFiles(t *testing.T) {
+	for _, tag := range TrackedTags() {
+		name := "tag_" + tag + ".go"
+		body, err := os.ReadFile(name)
+		if err != nil {
+			t.Errorf("tracked tag %q has no detector file %s: %v", tag, name, err)
+			continue
+		}
+		if !strings.Contains(string(body), "//go:build "+tag) || !strings.Contains(string(body), `mark("`+tag+`")`) {
+			t.Errorf("%s must be `//go:build %s` and call mark(%q)", name, tag, tag)
+		}
+	}
+	files, err := filepath.Glob("tag_*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range files {
+		tag := strings.TrimSuffix(strings.TrimPrefix(f, "tag_"), ".go")
+		if !Tracked(tag) {
+			t.Errorf("detector %s exists but %q is not in the tracked map", f, tag)
+		}
+	}
+}
+
+// TestBuildScriptUsesTheSharedTagSet stops the split that caused the outage from
+// coming back: the ship build must SOURCE scripts/router-tags.sh, not carry its
+// own copy of the tag list. A second copy is a second truth, and the second one
+// is the one nobody checks.
+func TestBuildScriptUsesTheSharedTagSet(t *testing.T) {
+	build := repoFile(t, "scripts/build-shaterd.sh")
+	if !strings.Contains(build, "router-tags.sh") {
+		t.Fatal("scripts/build-shaterd.sh must source scripts/router-tags.sh")
+	}
+	if regexp.MustCompile(`(?m)^\s*ROUTER_TAGS="with_`).MatchString(build) {
+		t.Fatal("scripts/build-shaterd.sh re-inlines a literal tag list; the set must come from scripts/router-tags.sh only")
+	}
+}
+
+// TestRouterLdflagsSatisfyTagRequirements: `badlinkname` is not self-contained —
+// the LINK step fails without -checklinkname=0. The flag therefore belongs to
+// the tag set, and lives beside it; assert the pair never separates.
+func TestRouterLdflagsSatisfyTagRequirements(t *testing.T) {
+	script := repoFile(t, "scripts/router-tags.sh")
+	ldflags := shVar(t, script, "SHATER_ROUTER_LDFLAGS")
+	if routerTagSet(t)["badlinkname"] && !strings.Contains(ldflags, "-checklinkname=0") {
+		t.Fatalf("SHATER_ROUTER_TAGS carries badlinkname but SHATER_ROUTER_LDFLAGS (%q) lacks -checklinkname=0: the build will fail at link time", ldflags)
+	}
+	if !strings.Contains(repoFile(t, "scripts/build-shaterd.sh"), "SHATER_ROUTER_LDFLAGS") {
+		t.Fatal("scripts/build-shaterd.sh must use $SHATER_ROUTER_LDFLAGS, not a hand-copied -checklinkname=0")
+	}
+}
+
+// TestCompiledTagsMatchTheShippedSet proves the DETECTORS are telling the truth:
+// when the test binary is compiled with exactly the shipped tag set, Compiled()
+// must equal that set (restricted to tracked tags). Without this, a typo'd or
+// deleted detector would make the behavioural test skip a protocol and pass.
+//
+// It only runs under scripts/check-router-tags.sh (which compiles with that very
+// set and exports SHATER_ROUTER_TAG_CHECK=1); a plain `go test ./...` compiles
+// with no tags at all, where the comparison is meaningless.
+func TestCompiledTagsMatchTheShippedSet(t *testing.T) {
+	if os.Getenv("SHATER_ROUTER_TAG_CHECK") != "1" {
+		t.Skip("not a router-tag-set run; use scripts/check-router-tags.sh")
+	}
+	var want []string
+	for tag := range routerTagSet(t) {
+		if Tracked(tag) {
+			want = append(want, tag)
+		}
+	}
+	sort.Strings(want)
+	got := Compiled()
+	if strings.Join(got, ",") != strings.Join(want, ",") {
+		t.Fatalf("compiled tags do not match the shipped set\n  compiled: %v\n  shipped : %v\n"+
+			"Either the build ran with the wrong -tags, or a tag_*.go detector is broken.", got, want)
+	}
+}
@@ -0,0 +1,7 @@
+//go:build badlinkname
+
+package buildtags
+
+// Detector for the badlinkname build tag — see buildtags.go. There is no !badlinkname twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("badlinkname") }
@@ -0,0 +1,7 @@
+//go:build tfogo_checklinkname0
+
+package buildtags
+
+// Detector for the tfogo_checklinkname0 build tag — see buildtags.go. There is no !tfogo_checklinkname0 twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("tfogo_checklinkname0") }
@@ -0,0 +1,7 @@
+//go:build with_awg
+
+package buildtags
+
+// Detector for the with_awg build tag — see buildtags.go. There is no !with_awg twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_awg") }
@@ -0,0 +1,7 @@
+//go:build with_gvisor
+
+package buildtags
+
+// Detector for the with_gvisor build tag — see buildtags.go. There is no !with_gvisor twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_gvisor") }
@@ -0,0 +1,7 @@
+//go:build with_lx_command
+
+package buildtags
+
+// Detector for the with_lx_command build tag — see buildtags.go. There is no !with_lx_command twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_lx_command") }
@@ -0,0 +1,7 @@
+//go:build with_quic
+
+package buildtags
+
+// Detector for the with_quic build tag — see buildtags.go. There is no !with_quic twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_quic") }
@@ -0,0 +1,7 @@
+//go:build with_utls
+
+package buildtags
+
+// Detector for the with_utls build tag — see buildtags.go. There is no !with_utls twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_utls") }
@@ -0,0 +1,7 @@
+//go:build with_wireguard
+
+package buildtags
+
+// Detector for the with_wireguard build tag — see buildtags.go. There is no !with_wireguard twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_wireguard") }
@@ -0,0 +1,7 @@
+//go:build with_xhttp
+
+package buildtags
+
+// Detector for the with_xhttp build tag — see buildtags.go. There is no !with_xhttp twin:
+// an absent detector means "not compiled in", which is exactly the truth.
+func init() { mark("with_xhttp") }
@@ -68,6 +68,12 @@ type nodeView struct {
 	// ParseError is the reason the engine will SKIP this node, verbatim from
 	// parse.ParseShareLink. Empty on every usable node.
 	ParseError string `json:"parse_error,omitempty"`
+	// ParseWarnings lists what the share link asked for that the engine cannot
+	// do (hysteria2 port hopping, tuic congestion control, …). The node IS
+	// usable — that is the difference from parse_error — but it does not behave
+	// exactly as its link describes, and that gap belongs on screen rather than
+	// in a code comment.
+	ParseWarnings []string `json:"parse_warnings,omitempty"`
 }

 // readModel is the model source. A package var so the tests can exercise the
@@ -111,6 +117,7 @@ func nodeViews(m *model.Model) []nodeView {
 			}
 			v.Server = p.Server
 			v.Port = p.Port
+			v.ParseWarnings = p.Warnings
 		} else if n.URI != "" {
 			v.ParseError = err.Error()
 		}
@@ -610,44 +610,60 @@ func splitDomainMarker(e string) (marker, value string, ok bool) {
 // reader can tell a deliberate difference from an oversight (R9.3). Verified
 // against the code on both sides, not against upstream docs — this is a fork.
 //
-//	marker      domain lists (this file)      routing rules (ruleMatchers, route.go)
+// There are now only TWO contexts, not three. A routing rule no longer classifies
+// domains at all: `dst_domain` was removed in schema v2 and a rule names its
+// destination through a `config ruleset`, so every domain entry in the system —
+// filter list, device list, inline rule-set — arrives at classifyDomainEntries
+// below. The one caller that adds something on top is inlineRulesetRule
+// (ruleset.go), which peels `regexp:` off first.
+//
+//	marker      DNS filter / device lists     inline rule-sets (inlineRulesetRule)
 //	----------  ----------------------------  --------------------------------------
 //	full:       yes — exact domain            yes — exact domain
 //	suffix:     yes — domain + subdomains     yes — domain + subdomains
 //	.example    SAME AS suffix: (dot stripped) SAME AS suffix: (dot stripped)
 //	keyword:    yes — substring               yes — substring
-//	(bare)      SUFFIX in filter/device/      EXACT domain
-//	            inline-ruleset lists
+//	(bare)      SUFFIX (domain + subdomains)  SUFFIX (domain + subdomains)
 //	regexp:     NO — warns                    yes — DomainRegex (pattern validated)
-//	geosite:    NO — warns                    NO — warns, rule matcher omitted
+//	geosite:    NO — warns                    NO — warns, entry dropped
 //
-// Two corrections this table used to get wrong, both of the "claimed a behaviour
-// that does not exist" kind:
+// A THIRD context exists and has NO row here on purpose: the body of a
+// `source=url` plain-text list. That is a hosts/one-domain-per-line FILE parsed by
+// parseDomainList (ruleset.go), not a list of typed entries, and it understands no
+// marker at all — every line is a domain plus its subdomains. An entry written in
+// the vocabulary above is dropped there (a domain cannot contain ":") and reported
+// per list by warnListEntryVocabulary. The long block above parseDomainList states
+// why unifying the two was rejected; do not read this table as covering it.
 //
-//   - `.example.com` was documented as "subdomains only" on both sides. It is not:
+// The bare-entry row is now the SAME on both sides, and that uniformity is the
+// point of schema v2 — a routing rule used to read a bare entry as an EXACT host
+// while every list read it as a suffix, a difference nothing in the UI showed.
+// model.migrate1to2 is what preserves the old meaning of existing configs: it
+// rewrites a rule's bare `dst_domain` entry as `full:` when it moves it into the
+// generated rule-set.
+//
+// Corrections this table used to get wrong, all of the "claimed a behaviour that
+// does not exist" kind:
+//
+//   - `.example.com` was documented as "subdomains only". It is not:
 //     classifyDomainEntries strips the dot, so it is a synonym of `suffix:` and
 //     matches the apex too. See the leading-dot branch above for why the synonym
 //     is kept rather than the distinction implemented.
 //   - `geosite:` was documented as a working routing matcher. It is not: the
-//     route-rule geosite field was REMOVED from this engine, so route.go warns and
-//     omits the matcher (a rule left with no other matcher is skipped entirely).
-//     Use a `config ruleset` with source=geosite.
+//     route-rule geosite field was REMOVED from this engine. Use a `config
+//     ruleset` with source=geosite and category chips.
 //
-// The two absences in the domain-list column are DELIBERATE, not gaps:
+// The two absences in the FILTER column are DELIBERATE, not gaps:
 //
-//   - regexp: an invalid regular expression is only detected when the rule is
-//     built, where it aborts box.New and takes the whole config down — the exact
-//     fail-open violation this audit spent its time removing. Supporting it here
-//     would require compiling and validating every pattern at generate time.
-//     Warning is the honest answer until that is done.
-//   - geosite: filter lists and rulesets already express geosite properly, via
+//   - regexp: an invalid regular expression aborts box.New and takes the whole
+//     config down, so it may only be accepted where every pattern is compiled and
+//     validated at generate time. Inline rule-sets do exactly that
+//     (peelDomainRegexes, ruleset.go), which is why the right-hand column says
+//     yes; the DNS-filter path has no such validation and warns instead.
+//   - geosite: filter lists and rule-sets already express geosite properly, via
 //     `source=geosite` plus category chips, which fetches the official compiled
 //     .srs. A `geosite:` entry inside an inline list would be a second, weaker
 //     path to the same feature.
-//
-// The BARE-entry difference is also deliberate and long-standing: a blocklist
-// entry is meant to cover subdomains, while a routing rule's bare entry is an
-// exact host. Both are documented at their call sites.

 // toASCIIDomain punycodes a unicode domain entry so it can match the punycoded
 // names that actually arrive in DNS queries. Lenient by design: an entry idna
@@ -185,7 +185,15 @@ func TestDNSFilterRemoteBlocklistHTTPClient(t *testing.T) {
 			{Name: "cf", Type: "doh", Address: "https://1.1.1.1/dns-query", Detour: "direct"},
 		},
 		Blocklists: []model.Blocklist{
-			{Name: "remote-ads", Enabled: true, Source: "url", URL: srv.URL, Response: "nxdomain", UpdateInterval: "24h"},
+			// The ".srs" suffix is LOAD-BEARING, not decoration: ruleSetURLIsEngineNative
+			// (ruleset.go) decides remote-vs-compiled-local by URL EXTENSION alone, and
+			// this test is about the REMOTE path — the engine fetching the compiled set
+			// itself through the direct outbound. httptest.NewServer's bare
+			// "http://127.0.0.1:<port>" has no extension, so it fell into the TEXT-list
+			// path instead: the list was downloaded by generate's own listFetcher, parsed
+			// as a hosts file and compiled into a LOCAL rule-set, which every assertion
+			// below then contradicted. Do not trim the suffix.
+			{Name: "remote-ads", Enabled: true, Source: "url", URL: srv.URL + "/blocklist.srs", Response: "nxdomain", UpdateInterval: "24h"},
 		},
 	}

@@ -289,8 +289,9 @@ func TestFailoverWarnsOnceAcrossChainCopy(t *testing.T) {
 	m := twoNodeGroupModel("failover")
 	m.Nodes = append(m.Nodes, model.Node{Name: "hop", Enabled: true, URI: ss("203.0.113.9")})
 	m.Chains = []model.Chain{{Name: "ch", Hops: []string{"node:hop", "group:g"}}}
+	m.Rulesets = []model.Ruleset{inlineDomainSet("ex", "example.com")}
 	m.Rules = []model.Rule{
-		{Name: "r", Enabled: true, DstDomain: []string{"example.com"}, Target: "chain:ch"},
+		{Name: "r", Enabled: true, DstRuleset: []string{"ex"}, Target: "chain:ch"},
 	}
 	_, warns, err := GenerateWithWarnings(m)
 	if err != nil {
@@ -310,6 +310,19 @@ func GenerateWithWarningsAt(m *model.Model, now time.Time) (option.Options, []st
 		Route:     route,
 		DNS:       dns,
 	}
+
+	// LAST, on the finished config: fold away duplicate WireGuard devices.
+	//
+	// A WG/AWG node may be materialised several times over — the always-emitted
+	// base endpoint (outbound.go), a per-chain hop copy and a chain group hop's
+	// per-member copy (chain.go) — and unlike a TCP proxy copy, each of those is a
+	// real device holding the SAME private key. A WireGuard peer keeps one session
+	// per key, so the copies evict each other and none of them passes traffic:
+	// every chain containing a WG node was dead for exactly this reason. Running
+	// on the assembled opts (rather than at each producer) is what makes the
+	// guarantee hold for all three paths and any future fourth. See wgdedup.go.
+	b.dedupWireGuardEndpoints(&opts)
+
 	return opts, b.warnings, nil
 }

@@ -506,16 +519,21 @@ func validPortRange(s string) bool {
 // the classifier actually drops.
 //
 // `suffix:` belongs here. The list used to omit it on the theory that suffix:/
-// regexp: are route-rule-only and are peeled off by ruleMatchers before the shared
-// classifier sees them. That is true of route.go — which handles a bare `suffix:`
-// in its own switch and warns there, so this list cannot double-report — but NOT
-// of the classifier itself: classifyDomainEntries has a `case "suffix"`, and every
-// other caller (devices.go, dnsfilter.go) reaches it directly. A lone `suffix:`
-// arriving that way was dropped by add()'s empty-value guard and reported by
-// nobody, which is the one outcome this pair of functions exists to prevent.
+// regexp: were route-rule-only and were peeled off before the shared classifier
+// saw them. classifyDomainEntries has a `case "suffix"`, and every caller
+// (devices.go, dnsfilter.go, inlineRulesetRule) reaches it directly, so a lone
+// `suffix:` was dropped by add()'s empty-value guard and reported by nobody —
+// the one outcome this pair of functions exists to prevent. (The route-rule half
+// of that old reasoning is gone entirely: `dst_domain` was removed in schema v2,
+// so route.go classifies no domains at all and there is no second warner to
+// double-report with.)
 //
-// `regexp:` is correctly absent: the classifier has no case for it, so a bare
-// `regexp:` is an UNRECOGNISED prefix and is reported by unrecognisedDomainPrefix.
+// `regexp:` is correctly absent, for two different reasons depending on the
+// caller. In a filter/device list the classifier has no case for it, so a bare
+// `regexp:` is an UNRECOGNISED prefix reported by unrecognisedDomainPrefix. In an
+// inline rule-set peelDomainRegexes (ruleset.go) strips every `regexp:` entry
+// BEFORE this predicate runs and reports a valueless one itself, so it can never
+// reach here either way.
 var domainMarkers = []string{"keyword:", "full:", "suffix:", "."}

 // isDomainMarkerOnly reports whether an entry is a bare classification marker
@@ -227,6 +227,12 @@ func TestAllReachableProtocols(t *testing.T) {
 			{Name: "vmess-ws", Enabled: true, URI: vmessLink},
 			{Name: "trojan1", Enabled: true, URI: "trojan://password@example.com:443?sni=example.com#trojan1"},
 			{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.5:8388#ss1"},
+			// QUIC protocols travel the same road: share-link -> parse.Proxy ->
+			// outbound -> box.New. Before parse grew these two branches the links
+			// were dropped at the parser and the outbounds below never existed.
+			{Name: "hy2-1", Enabled: true, URI: "hysteria2://secret@example.com:8443/?sni=example.com&alpn=h3#hy2-1"},
+			{Name: "hy2-alias", Enabled: true, URI: "hy2://secret@example.org#hy2-alias"},
+			{Name: "tuic1", Enabled: true, URI: "tuic://22222222-2222-2222-2222-222222222222:secret@example.com:443/?sni=example.com&alpn=h3&congestion_control=cubic&udp_relay_mode=native#tuic1"},
 		},
 	}
 	opts, warns, changed := applyAndClose(t, m)
@@ -236,16 +242,34 @@ func TestAllReachableProtocols(t *testing.T) {
 	if len(warns) != 0 {
 		t.Fatalf("unexpected warnings: %v", warns)
 	}
-	for _, tag := range []string{"vless-ws", "vless-grpc", "vmess-ws", "trojan1", "ss1"} {
+	for _, tag := range []string{"vless-ws", "vless-grpc", "vmess-ws", "trojan1", "ss1", "hy2-1", "hy2-alias", "tuic1"} {
 		if findOutbound(opts, tag) == nil {
 			t.Fatalf("outbound %q not emitted", tag)
 		}
 	}
+	// The hy2 alias link carries no port and no sni: parse must have supplied the
+	// scheme default (443) and the server name, or the node would dial nowhere.
+	if ob := findOutbound(opts, "hy2-alias"); ob != nil {
+		o, ok := ob.Options.(*option.Hysteria2OutboundOptions)
+		if !ok {
+			t.Fatalf("hy2-alias options type = %T", ob.Options)
+		}
+		if o.ServerPort != 443 {
+			t.Fatalf("hy2-alias port = %d, want the scheme default 443", o.ServerPort)
+		}
+		if o.TLS == nil || o.TLS.ServerName != "example.org" {
+			t.Fatalf("hy2-alias tls = %+v", o.TLS)
+		}
+		if o.TLS.UTLS != nil {
+			t.Fatalf("uTLS must never reach a QUIC outbound: %+v", o.TLS.UTLS)
+		}
+	}
 }

 // --- White-box: hysteria2 / tuic / shadowtls option mapping validates. -------
-// These protocols are not yet produced by parse.ParseShareLink, so we drive the
-// mapping directly with synthetic parse.Proxy values and validate via box.New.
+// shadowtls is not produced by parse.ParseShareLink (hysteria2 and tuic now
+// are, see TestAllReachableProtocols), so the mapping is driven directly with
+// synthetic parse.Proxy values and validated via box.New.

 func TestQUICAndShadowTLSMappingValidates(t *testing.T) {
 	b := newBuilder(&model.Model{Globals: model.DefaultGlobals()})
@@ -323,8 +347,9 @@ func TestEgressDPISpoofValidates(t *testing.T) {
 		Globals:  model.DefaultGlobals(),
 		Inbounds: []model.Inbound{{Name: "lan", Enabled: true, Type: "tproxy", TproxyPort: 12366, TCP: true, UDP: true}},
 		Egresses: []model.Egress{{Name: "spf", Type: "direct", DPI: "spoof"}},
+		Rulesets: []model.Ruleset{inlineDomainSet("blocked", "blocked.example")},
 		Rules: []model.Rule{
-			{Name: "spoof-rule", Enabled: true, Order: 10, DstDomain: []string{"blocked.example"}, Target: "egress:spf"},
+			{Name: "spoof-rule", Enabled: true, Order: 10, DstRuleset: []string{"blocked"}, Target: "egress:spf"},
 		},
 	}
 	opts, warns, changed := applyAndClose(t, m)
@@ -346,8 +371,9 @@ func TestByedpiEgressValidates(t *testing.T) {
 		Globals:  model.DefaultGlobals(),
 		Inbounds: []model.Inbound{{Name: "lan", Enabled: true, Type: "tproxy", TproxyPort: 12367, TCP: true, UDP: true}},
 		Egresses: []model.Egress{{Name: "bd", Type: "byedpi", Port: 1080}},
+		Rulesets: []model.Ruleset{inlineDomainSet("blocked", "blocked.example")},
 		Rules: []model.Rule{
-			{Name: "desync", Enabled: true, Order: 10, DstDomain: []string{"blocked.example"}, Target: "egress:bd"},
+			{Name: "desync", Enabled: true, Order: 10, DstRuleset: []string{"blocked"}, Target: "egress:bd"},
 		},
 	}
 	opts, warns, changed := applyAndClose(t, m)
@@ -21,9 +21,10 @@ func TestProfileAppliesCleanly(t *testing.T) {
 		Globals:  g,
 		Inbounds: []model.Inbound{{Name: "lan", Enabled: true, Type: "tproxy", TproxyPort: 12370, TCP: true, UDP: true}},
 		Nodes:    []model.Node{{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.5:8388#ss1"}},
+		Rulesets: []model.Ruleset{inlineDomainSet("ads", "ads.example")},
 		Rules: []model.Rule{
 			{Name: "lan-proxy", Enabled: true, Order: 10, Src: []string{"192.168.1.0/24"}, Target: "node:ss1"},
-			{Name: "adblock", Enabled: true, Order: 20, DstDomain: []string{"ads.example"}, Target: "block"},
+			{Name: "adblock", Enabled: true, Order: 20, DstRuleset: []string{"ads"}, Target: "block"},
 		},
 		Profiles: []model.Profile{
 			{Name: "home", Enabled: true, Priority: 1, DisableRules: []string{"adblock"}},
@@ -35,7 +36,7 @@ func TestProfileAppliesCleanly(t *testing.T) {
 		t.Fatalf("expected Apply changed==true (warnings: %v)", warns)
 	}
 	// Profile-disabled 'adblock' rule must be absent.
-	if opts.Route == nil || hasDomainRule(opts.Route, "ads.example") {
+	if opts.Route == nil || hasRulesetRule(opts.Route, "ads") {
 		t.Fatalf("profile-disabled rule 'adblock' should not be emitted")
 	}
 	// The lan-proxy rule still routes to ss1.
@@ -49,9 +49,13 @@ func TestNoProfilesUnchanged(t *testing.T) {
 	m := &model.Model{
 		Globals: model.DefaultGlobals(), // kill-switch closed => Final "block"
 		Nodes:   []model.Node{{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.5:8388#ss1"}},
+		Rulesets: []model.Ruleset{
+			inlineDomainSet("a", "a.example"),
+			inlineDomainSet("b", "b.example"),
+		},
 		Rules: []model.Rule{
-			{Name: "a", Enabled: true, Order: 10, DstDomain: []string{"a.example"}, Target: "direct"},
-			{Name: "b", Enabled: true, Order: 20, DstDomain: []string{"b.example"}, Target: "node:ss1"},
+			{Name: "a", Enabled: true, Order: 10, DstRuleset: []string{"a"}, Target: "direct"},
+			{Name: "b", Enabled: true, Order: 20, DstRuleset: []string{"b"}, Target: "node:ss1"},
 		},
 	}
 	rt, b := buildRouteAt(m, wed12UTC)
@@ -70,7 +74,7 @@ func TestNoProfilesUnchanged(t *testing.T) {
 	if len(rt.Rules) != 4 {
 		t.Fatalf("route rule count = %d, want 4 (sniff+hijack+2 user)", len(rt.Rules))
 	}
-	if !hasDomainRule(rt, "a.example") || !hasDomainRule(rt, "b.example") {
+	if !hasRulesetRule(rt, "a") || !hasRulesetRule(rt, "b") {
 		t.Fatalf("both user rules should survive unchanged")
 	}
 }
@@ -83,9 +87,13 @@ func TestActiveProfileDisablesRule(t *testing.T) {
 	m := &model.Model{
 		Globals: g,
 		Nodes:   []model.Node{{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.5:8388#ss1"}},
+		Rulesets: []model.Ruleset{
+			inlineDomainSet("blocked", "blocked.example"),
+			inlineDomainSet("keep", "keep.example"),
+		},
 		Rules: []model.Rule{
-			{Name: "blockme", Enabled: true, Order: 10, DstDomain: []string{"blocked.example"}, Target: "block"},
-			{Name: "keep", Enabled: true, Order: 20, DstDomain: []string{"keep.example"}, Target: "direct"},
+			{Name: "blockme", Enabled: true, Order: 10, DstRuleset: []string{"blocked"}, Target: "block"},
+			{Name: "keep", Enabled: true, Order: 20, DstRuleset: []string{"keep"}, Target: "direct"},
 		},
 		Profiles: []model.Profile{
 			// Manual pin: honored regardless of conditions. Disables "blockme".
@@ -94,10 +102,10 @@ func TestActiveProfileDisablesRule(t *testing.T) {
 	}
 	rt, b := buildRouteAt(m, wed12UTC)

-	if hasDomainRule(rt, "blocked.example") {
+	if hasRulesetRule(rt, "blocked") {
 		t.Fatalf("profile disabled rule 'blockme' but its matcher is still emitted")
 	}
-	if !hasDomainRule(rt, "keep.example") {
+	if !hasRulesetRule(rt, "keep") {
 		t.Fatalf("rule 'keep' should be untouched")
 	}
 	if rt.Final != tagBlock {
@@ -115,9 +123,13 @@ func TestActiveProfileDisablesRule(t *testing.T) {
 func TestAutoSelectHighestPriority(t *testing.T) {
 	m := &model.Model{
 		Globals: model.DefaultGlobals(),
+		Rulesets: []model.Ruleset{
+			inlineDomainSet("lo", "lo.example"),
+			inlineDomainSet("hi", "hi.example"),
+		},
 		Rules: []model.Rule{
-			{Name: "rLo", Enabled: true, Order: 10, DstDomain: []string{"lo.example"}, Target: "direct"},
-			{Name: "rHi", Enabled: true, Order: 20, DstDomain: []string{"hi.example"}, Target: "direct"},
+			{Name: "rLo", Enabled: true, Order: 10, DstRuleset: []string{"lo"}, Target: "direct"},
+			{Name: "rHi", Enabled: true, Order: 20, DstRuleset: []string{"hi"}, Target: "direct"},
 		},
 		Profiles: []model.Profile{
 			{Name: "lo", Enabled: true, Priority: 5, DisableRules: []string{"rLo"}},
@@ -125,10 +137,10 @@ func TestAutoSelectHighestPriority(t *testing.T) {
 		},
 	}
 	rt, _ := buildRouteAt(m, wed12UTC)
-	if hasDomainRule(rt, "hi.example") {
+	if hasRulesetRule(rt, "hi") {
 		t.Fatalf("the highest-priority profile must win and disable rHi")
 	}
-	if !hasDomainRule(rt, "lo.example") {
+	if !hasRulesetRule(rt, "lo") {
 		t.Fatalf("only the winning profile applies (rLo should survive)")
 	}
 }
@@ -142,9 +154,13 @@ func TestIfaceProfileSkippedByAutoButHonoredNamed(t *testing.T) {
 		g.ActiveProfile = active
 		return &model.Model{
 			Globals: g,
+			Rulesets: []model.Ruleset{
+				inlineDomainSet("hi", "hi.example"),
+				inlineDomainSet("if", "if.example"),
+			},
 			Rules: []model.Rule{
-				{Name: "rHi", Enabled: true, Order: 10, DstDomain: []string{"hi.example"}, Target: "direct"},
-				{Name: "rIf", Enabled: true, Order: 20, DstDomain: []string{"if.example"}, Target: "direct"},
+				{Name: "rHi", Enabled: true, Order: 10, DstRuleset: []string{"hi"}, Target: "direct"},
+				{Name: "rIf", Enabled: true, Order: 20, DstRuleset: []string{"if"}, Target: "direct"},
 			},
 			Profiles: []model.Profile{
 				{Name: "plain", Enabled: true, Priority: 10, DisableRules: []string{"rHi"}},
@@ -156,19 +172,19 @@ func TestIfaceProfileSkippedByAutoButHonoredNamed(t *testing.T) {

 	// Auto-select (no pin): iface profile skipped (the watcher owns it); 'plain' wins.
 	rt, _ := buildRouteAt(mk(""), wed12UTC)
-	if hasDomainRule(rt, "hi.example") {
+	if hasRulesetRule(rt, "hi") {
 		t.Fatalf("auto-select should apply 'plain' and disable rHi")
 	}
-	if !hasDomainRule(rt, "if.example") {
+	if !hasRulesetRule(rt, "if") {
 		t.Fatalf("iface profile 'wwan' must be skipped by auto-select (rIf should survive)")
 	}

 	// Named explicitly: iface profile honored regardless of its iface condition.
 	rt, _ = buildRouteAt(mk("wwan"), wed12UTC)
-	if hasDomainRule(rt, "if.example") {
+	if hasRulesetRule(rt, "if") {
 		t.Fatalf("explicitly named iface profile must be honored and disable rIf")
 	}
-	if !hasDomainRule(rt, "hi.example") {
+	if !hasRulesetRule(rt, "hi") {
 		t.Fatalf("only the named profile applies; rHi should survive")
 	}
 }
@@ -179,14 +195,15 @@ func TestUnknownActiveProfileFallsBackToAuto(t *testing.T) {
 	g := model.DefaultGlobals()
 	g.ActiveProfile = "ghost"
 	m := &model.Model{
-		Globals: g,
-		Rules:   []model.Rule{{Name: "rX", Enabled: true, Order: 10, DstDomain: []string{"x.example"}, Target: "direct"}},
+		Globals:  g,
+		Rulesets: []model.Ruleset{inlineDomainSet("x", "x.example")},
+		Rules:    []model.Rule{{Name: "rX", Enabled: true, Order: 10, DstRuleset: []string{"x"}, Target: "direct"}},
 		Profiles: []model.Profile{
 			{Name: "auto", Enabled: true, Priority: 1, DisableRules: []string{"rX"}},
 		},
 	}
 	rt, b := buildRouteAt(m, wed12UTC)
-	if hasDomainRule(rt, "x.example") {
+	if hasRulesetRule(rt, "x") {
 		t.Fatalf("fallback auto-select should apply 'auto' and disable rX")
 	}
 	if !hasWarning(b, "falling back to auto-select") {
@@ -208,16 +225,17 @@ func TestUnknownActiveProfileFallsBackToAuto(t *testing.T) {
 // suppress it or to warn about it.
 func TestPlainProfileIsSelectableAfterProbeRemoval(t *testing.T) {
 	m := &model.Model{
-		Globals: model.DefaultGlobals(),
+		Globals:  model.DefaultGlobals(),
+		Rulesets: []model.Ruleset{inlineDomainSet("hi", "hi.example")},
 		Rules: []model.Rule{
-			{Name: "rHi", Enabled: true, Order: 10, DstDomain: []string{"hi.example"}, Target: "direct"},
+			{Name: "rHi", Enabled: true, Order: 10, DstRuleset: []string{"hi"}, Target: "direct"},
 		},
 		Profiles: []model.Profile{
 			{Name: "plain", Enabled: true, Priority: 10, DisableRules: []string{"rHi"}},
 		},
 	}
 	rt, b := buildRouteAt(m, wed12UTC)
-	if hasDomainRule(rt, "hi.example") {
+	if hasRulesetRule(rt, "hi") {
 		t.Fatalf("a plain profile must apply and disable rHi")
 	}
 	// No leftover diagnostic: warning about an option the parser no longer reads
@@ -1,8 +1,6 @@
 package generate

 import (
-	"fmt"
-	"regexp"
 	"sort"
 	"strings"

@@ -321,114 +319,14 @@ func (b *builder) ruleMatchers(r model.Rule) (raw option.RawDefaultRule, matched
 		matched = true
 	}

-	// Destination domains. The route-rule-specific prefixes (geosite:/regexp:/
-	// suffix:) are peeled off here; everything else goes through the shared
-	// classifier in dnsfilter.go with bareIsSuffix=FALSE — a bare entry in a
-	// ROUTING rule is an exact domain, unlike the DNS/filter lists where it means
-	// "and all subdomains". classifyDomainEntries is also what drops marker-only
-	// entries ("." / "full:" / "keyword:"), which must never reach the engine:
-	// an empty domain/domain_suffix aborts box.New, and an empty domain_keyword
-	// is strings.Contains(host, "") — a silent match on EVERY host.
-	var explicitSuffix []string
-	var plain []string
-	for _, d := range r.DstDomain {
-		d = strings.TrimSpace(d)
-		if d == "" {
-			continue
-		}
-		switch {
-		case strings.HasPrefix(d, "geosite:"):
-			// A `geosite:` matcher is NOT emittable: the route-rule geosite field was
-			// removed in this engine and route/rule.NewDefaultRule hard-errors on it,
-			// which aborts box.New for the WHOLE config. Mirroring the geoip handling
-			// below, it is treated as inert: warned and omitted, so a legacy/UCI rule
-			// carrying one degrades to "this rule does nothing" instead of taking the
-			// entire tunnel down. Use a `config ruleset` with source=geosite instead.
-			b.warnf("rule %q: geosite matcher %q is removed from this engine — use a ruleset with source=geosite instead, omitted (inert)", r.Name, d)
-		case strings.HasPrefix(d, "regexp:"):
-			// route/rule.NewDomainRegexItem hard-errors on an uncompilable pattern and
-			// takes box.New with it; validate here and drop the bad one with a warning.
-			// A BARE "regexp:" compiles fine but matches every host — same silent
-			// match-all hazard as an empty keyword, so it is dropped too.
-			re := strings.TrimSpace(strings.TrimPrefix(d, "regexp:"))
-			if re == "" {
-				b.warnf("rule %q: %q is a bare matcher marker with no value, omitted (an empty regexp matches EVERY host)", r.Name, d)
-				break
-			}
-			if _, err := regexp.Compile(re); err != nil {
-				b.warnf("rule %q: domain regexp %q is invalid (%v), omitted", r.Name, re, err)
-				break
-			}
-			raw.DomainRegex = append(raw.DomainRegex, re)
-			matched = true
-		case strings.HasPrefix(d, "suffix:"):
-			// Label-aware suffix (apex + subdomains): sing-box domain_suffix stored
-			// in bare form matches both "example.com" and "*.example.com" (see
-			// sing/common/domain matcher). A leading-dot entry, by contrast, matches
-			// subdomains ONLY, so the explicit `suffix:` form is how presets/rules
-			// ask for apex-inclusive suffix matching.
-			if s := strings.TrimSpace(strings.TrimPrefix(d, "suffix:")); s != "" {
-				explicitSuffix = append(explicitSuffix, s)
-			} else {
-				b.warnf("rule %q: %q is a bare matcher marker with no value, omitted (an empty domain token aborts box.New)", r.Name, d)
-			}
-		default:
-			plain = append(plain, d)
-		}
-	}
-	domain, suffix, keyword := classifyDomainEntries(plain, false)
-	for _, d := range plain {
-		if isDomainMarkerOnly(d) {
-			b.warnf("rule %q: %q is a bare matcher marker with no value, omitted (an empty domain token aborts box.New; an empty keyword matches EVERY host)", r.Name, d)
-		}
-	}
-	// An unrecognised `word:` prefix is DROPPED by classifyDomainEntries (a domain
-	// cannot contain ":", so keeping it would load a provably unmatchable literal).
-	// It has to be reported here or the rule silently loses that destination — the
-	// v0.1/xray spelling `domain:example.com` is exactly what someone migrating
-	// writes, and it used to disappear without a trace. geosite:/regexp:/suffix:
-	// were already peeled off above, so `plain` carries only the shared markers.
-	b.warnUnrecognisedPrefixes(fmt.Sprintf("rule %q", r.Name), plain)
-	suffix = append(explicitSuffix, suffix...)
-	if len(domain) > 0 {
-		raw.Domain = badoption.Listable[string](domain)
-		matched = true
-	}
-	if len(suffix) > 0 {
-		raw.DomainSuffix = badoption.Listable[string](suffix)
-		matched = true
-	}
-	if len(keyword) > 0 {
-		raw.DomainKeyword = badoption.Listable[string](keyword)
-		matched = true
-	}
-	// Destination IPs. A `geoip:<code>` entry is NOT a CIDR: route-rule geoip was
-	// removed in this engine (box.New hard-errors on it), so — mirroring how the
-	// ruleset geoip source is handled — it is treated as inert: warned and omitted
-	// (never emitted as an ip_cidr, which would also abort box.New). This keeps a
-	// geoip-driven rule/preset (e.g. the ru-bypass pack) fail-open instead of fatal.
-	var ipcidr []string
-	for _, ip := range r.DstIP {
-		ip = strings.TrimSpace(ip)
-		if ip == "" {
-			continue
-		}
-		if strings.HasPrefix(strings.ToLower(ip), "geoip:") {
-			b.warnf("rule %q: geoip matcher %q is removed from this engine — use a ruleset with source=geoip instead, omitted (inert)", r.Name, ip)
-			continue
-		}
-		ipcidr = append(ipcidr, ip)
-	}
-	// Same fail-open validation as the source list: an unparseable ip_cidr aborts
-	// box.New for the whole config, so drop it with a warning instead.
-	ipcidr, badIP := validPrefixes(ipcidr)
-	for _, s := range badIP {
-		b.warnf("rule %q: destination %q is not a valid IP/CIDR, omitted", r.Name, s)
-	}
-	if len(ipcidr) > 0 {
-		raw.IPCIDR = badoption.Listable[string](ipcidr)
-		matched = true
-	}
+	// Destination: a rule's ONLY destination matcher is DstRuleset (schema v2).
+	// The inline `dst_domain` / `dst_ip` lists that used to be classified here are
+	// gone. A destination list is a `config ruleset` — compiled once into a .srs and
+	// shared by every rule that references it — so the prefix vocabulary
+	// (full:/suffix:/keyword:/regexp:, a leading dot) and the geosite/geoip sources
+	// live in exactly one place (generate/ruleset.go inlineRulesetRule). Existing
+	// configs were rewritten by model.migrate1to2, which preserves each entry's
+	// meaning 1:1.

 	// DstRuleset -> reference the rs-<name> rule-sets materialised by
 	// buildRoutingRuleSets. A dst_ruleset naming an UNDEFINED ruleset is warned +
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"

+	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"

 	"github.com/sagernet/sing-box/shater/model"
@@ -22,26 +23,45 @@ func killModel(kill string) *model.Model {
 	g := model.DefaultGlobals()
 	g.KillSwitch = "closed"
 	return &model.Model{
-		Globals: g,
-		Nodes:   []model.Node{{Name: "n1", Enabled: false, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#n1"}},
-		Groups:  []model.Group{{Name: "grp", Strategy: "leastping", Nodes: []string{"n1"}}},
+		Globals:  g,
+		Nodes:    []model.Node{{Name: "n1", Enabled: false, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#n1"}},
+		Groups:   []model.Group{{Name: "grp", Strategy: "leastping", Nodes: []string{"n1"}}},
+		Rulesets: []model.Ruleset{inlineDomainSet("social", "social.example")},
 		Rules: []model.Rule{
-			{Name: "social", Enabled: true, Order: 10, DstDomain: []string{"social.example"}, Target: "group:grp", Kill: kill},
+			{Name: "social", Enabled: true, Order: 10, DstRuleset: []string{"social"}, Target: "group:grp", Kill: kill},
 			{Name: "catch-tcp", Enabled: true, Order: 20, Proto: "tcp", Target: "direct"},
 		},
 	}
 }

-// domainRuleTarget returns the outbound the rule matching domain routes to.
-func domainRuleTarget(rt *option.RouteOptions, domain string) (string, bool) {
-	for _, r := range generalRules(rt) {
-		for _, d := range r.DefaultOptions.RawDefaultRule.Domain {
-			if d == domain {
-				return r.DefaultOptions.RuleAction.RouteOptions.Outbound, true
-			}
-		}
+// rulesetRuleTarget returns the outbound the rule referencing the rule-set named
+// name routes to. It is the post-schema-v2 replacement for looking a rule up by
+// its dst-domain matcher: a rule's destination is a rule_set reference now, so
+// the matcher that identifies it is the rs-<name> tag.
+func rulesetRuleTarget(rt *option.RouteOptions, name string) (string, bool) {
+	dr := findRouteRuleWithRuleSet(rt, routeRulesetTagPrefix+name)
+	if dr == nil {
+		return "", false
 	}
-	return "", false
+	return dr.RuleAction.RouteOptions.Outbound, true
+}
+
+// soleInlineRule returns the single default headless rule an inline rule-set is
+// expected to carry, failing the ASSERTION (rather than panicking on an index) when
+// the set turns out to be remote/local or to hold a different rule shape.
+func soleInlineRule(t *testing.T, rs option.RuleSet) option.DefaultHeadlessRule {
+	t.Helper()
+	if rs.Type != C.RuleSetTypeInline && rs.Type != "" {
+		t.Fatalf("rule-set %q is type %q, not inline — it has no rules in the config to inspect", rs.Tag, rs.Type)
+	}
+	if len(rs.InlineOptions.Rules) != 1 {
+		t.Fatalf("rule-set %q must carry exactly one headless rule, got %d", rs.Tag, len(rs.InlineOptions.Rules))
+	}
+	hr := rs.InlineOptions.Rules[0]
+	if hr.Type != C.RuleTypeDefault && hr.Type != "" {
+		t.Fatalf("rule-set %q carries a %q headless rule, not a default one", rs.Tag, hr.Type)
+	}
+	return hr.DefaultOptions
 }

 // TestRuleKillDefaultBlocks: kill="" / "default" is fail-closed — the rule is
@@ -54,7 +74,7 @@ func TestRuleKillDefaultBlocks(t *testing.T) {
 		if err != nil {
 			t.Fatalf("%q: Generate: %v", kill, err)
 		}
-		got, ok := domainRuleTarget(opts.Route, "social.example")
+		got, ok := rulesetRuleTarget(opts.Route, "social")
 		if !ok {
 			t.Fatalf("%q: rule must be emitted routing to block, but it was dropped", kill)
 		}
@@ -76,7 +96,7 @@ func TestRuleKillClosedBlocksHere(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Generate: %v", err)
 	}
-	got, ok := domainRuleTarget(opts.Route, "social.example")
+	got, ok := rulesetRuleTarget(opts.Route, "social")
 	if !ok {
 		t.Fatalf("kill=closed must still emit the rule (warnings %v)", warns)
 	}
@@ -103,7 +123,7 @@ func TestRuleKillOpenGoesDirect(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Generate: %v", err)
 	}
-	got, ok := domainRuleTarget(opts.Route, "social.example")
+	got, ok := rulesetRuleTarget(opts.Route, "social")
 	if !ok {
 		t.Fatalf("kill=open must still emit the rule (warnings %v)", warns)
 	}
@@ -122,7 +142,7 @@ func TestRuleKillUnknownBlocks(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Generate: %v", err)
 	}
-	got, ok := domainRuleTarget(opts.Route, "social.example")
+	got, ok := rulesetRuleTarget(opts.Route, "social")
 	if !ok || got != tagBlock {
 		t.Fatalf("unknown kill policy must block, got %q (ok=%v)", got, ok)
 	}
@@ -145,7 +165,7 @@ func TestRuleKillPreservesFailClosedInvariant(t *testing.T) {
 		if opts.Route.Final != tagBlock {
 			t.Fatalf("%q: Final = %q, want block", kill, opts.Route.Final)
 		}
-		if tgt, ok := domainRuleTarget(opts.Route, "social.example"); ok && tgt == tagDirect {
+		if tgt, ok := rulesetRuleTarget(opts.Route, "social"); ok && tgt == tagDirect {
 			t.Fatalf("%q: dead group leaked direct", kill)
 		}
 	}
@@ -158,17 +178,18 @@ func TestRuleKillOnlyAppliesToUnresolvedTargets(t *testing.T) {
 		g := model.DefaultGlobals()
 		g.KillSwitch = "closed"
 		m := &model.Model{
-			Globals: g,
-			Nodes:   []model.Node{{Name: "n1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#n1"}},
+			Globals:  g,
+			Nodes:    []model.Node{{Name: "n1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#n1"}},
+			Rulesets: []model.Ruleset{inlineDomainSet("social", "social.example")},
 			Rules: []model.Rule{
-				{Name: "ok", Enabled: true, Order: 10, DstDomain: []string{"social.example"}, Target: "node:n1", Kill: kill},
+				{Name: "ok", Enabled: true, Order: 10, DstRuleset: []string{"social"}, Target: "node:n1", Kill: kill},
 			},
 		}
 		opts, _, err := GenerateWithWarnings(m)
 		if err != nil {
 			t.Fatalf("%q: Generate: %v", kill, err)
 		}
-		got, ok := domainRuleTarget(opts.Route, "social.example")
+		got, ok := rulesetRuleTarget(opts.Route, "social")
 		if !ok || got != "n1" {
 			t.Fatalf("%q: healthy target must win, got %q (ok=%v)", kill, got, ok)
 		}
@@ -176,29 +197,54 @@ func TestRuleKillOnlyAppliesToUnresolvedTargets(t *testing.T) {
 }

 // --- R4: marker-only domain entries ------------------------------------------
+//
+// R4 moved with the destination list itself: a rule's domains are an inline
+// `config ruleset` now (schema v2), so the marker-only guard has to hold in
+// inlineRulesetRule rather than in ruleMatchers. The hazard is unchanged.

-// TestRuleMarkerOnlyDomainEntriesDropped: an entry that is nothing but its marker
-// must never reach the engine. An empty domain/domain_suffix makes NewDomainItem
-// return "empty item is not allowed" and aborts box.New (whole LAN down from one
-// stray "."); an empty domain_keyword is SILENT and matches every host.
-func TestRuleMarkerOnlyDomainEntriesDropped(t *testing.T) {
+// TestRulesetMarkerOnlyDomainEntriesDropped: an entry that is nothing but its
+// marker must never reach the engine. An empty domain/domain_suffix makes
+// NewDomainItem return "empty item is not allowed" and aborts box.New (whole LAN
+// down from one stray "."); an empty domain_keyword is SILENT and matches every
+// host. As the sole entry it also leaves the rule-set with nothing usable, so the
+// list is skipped and the rule referencing it is not emitted — never promoted to
+// "matches everything".
+func TestRulesetMarkerOnlyDomainEntriesDropped(t *testing.T) {
 	for _, entry := range []string{".", "full:", "keyword:", "suffix:", "regexp:", "  keyword:  "} {
-		rt, warns := genRules(t, model.Rule{
-			Name: "m", Enabled: true, Order: 10,
-			DstDomain: []string{entry}, Target: "node:n1",
-		})
-		for _, r := range rt.Rules {
-			raw := r.DefaultOptions.RawDefaultRule
-			for _, list := range [][]string{raw.Domain, raw.DomainSuffix, raw.DomainKeyword, raw.DomainRegex} {
-				for _, v := range list {
-					if strings.TrimSpace(v) == "" {
-						t.Fatalf("%q: emitted an EMPTY matcher token", entry)
+		rt, warns := genRulesWithSets(t,
+			[]model.Ruleset{inlineDomainSet("m", entry)},
+			model.Rule{Name: "m", Enabled: true, Order: 10, DstRuleset: []string{"m"}, Target: "node:n1"},
+		)
+		// Only an INLINE rule-set has its rules in the options at all; a remote or
+		// local one (a geosite chip, a compiled url list) carries a URL or a path and
+		// an empty InlineOptions. Indexing Rules[0] unconditionally turned any such
+		// fixture into an index-out-of-range PANIC instead of a failed assertion, so
+		// the shape is checked rather than assumed.
+		for _, rs := range rt.RuleSet {
+			if rs.Type != C.RuleSetTypeInline && rs.Type != "" {
+				continue
+			}
+			for i, hrule := range rs.InlineOptions.Rules {
+				if hrule.Type != C.RuleTypeDefault && hrule.Type != "" {
+					continue // a logical headless rule has no matcher lists of its own
+				}
+				hr := hrule.DefaultOptions
+				for name, list := range map[string][]string{
+					"domain": hr.Domain, "domain_suffix": hr.DomainSuffix,
+					"domain_keyword": hr.DomainKeyword, "domain_regex": hr.DomainRegex,
+				} {
+					for _, v := range list {
+						if strings.TrimSpace(v) == "" {
+							t.Fatalf("%q: rule-set %q rule %d emitted an EMPTY %s token (an empty domain aborts box.New; an empty keyword matches every host)",
+								entry, rs.Tag, i, name)
+						}
 					}
 				}
 			}
 		}
-		// Sole entry => nothing left to match on => the rule must be skipped, never
-		// silently promoted to "matches everything".
+		if _, ok := ruleSetByTag(rt, "rs-m"); ok {
+			t.Fatalf("%q: a marker-only list must not materialise a rule-set", entry)
+		}
 		if n := len(generalRules(rt)); n != 0 {
 			t.Fatalf("%q: marker-only sole entry must skip the rule, got %d rules", entry, n)
 		}
@@ -208,46 +254,55 @@ func TestRuleMarkerOnlyDomainEntriesDropped(t *testing.T) {
 	}
 }

-// TestRuleMarkerOnlyBesideRealEntriesKeepsTheRest: the real entries must survive
-// the marker-only ones.
-func TestRuleMarkerOnlyBesideRealEntriesKeepsTheRest(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "m", Enabled: true, Order: 10,
-		DstDomain: []string{".", "keyword:", "exact.example", "keyword:ads", ".sub.example", "suffix:apex.example"},
-		Target:    "node:n1",
-	})
-	gen := generalRules(rt)
-	if len(gen) != 1 {
-		t.Fatalf("want 1 rule, got %d (warnings %v)", len(gen), warns)
+// TestRulesetMarkerOnlyBesideRealEntriesKeepsTheRest: the real entries must
+// survive the marker-only ones.
+func TestRulesetMarkerOnlyBesideRealEntriesKeepsTheRest(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("m",
+			".", "keyword:", "full:exact.example", "keyword:ads", ".sub.example", "suffix:apex.example")},
+		model.Rule{Name: "m", Enabled: true, Order: 10, DstRuleset: []string{"m"}, Target: "node:n1"},
+	)
+	rs, ok := ruleSetByTag(rt, "rs-m")
+	if !ok {
+		t.Fatalf("the usable entries must keep the list alive (warnings %v)", warns)
 	}
-	raw := gen[0].DefaultOptions.RawDefaultRule
-	if len(raw.Domain) != 1 || raw.Domain[0] != "exact.example" {
-		t.Fatalf("domain = %v, want [exact.example] (bare entry in a ROUTING rule is exact)", raw.Domain)
+	hr := soleInlineRule(t, rs)
+	if len(hr.Domain) != 1 || hr.Domain[0] != "exact.example" {
+		t.Fatalf("domain = %v, want [exact.example]", hr.Domain)
 	}
-	if len(raw.DomainKeyword) != 1 || raw.DomainKeyword[0] != "ads" {
-		t.Fatalf("keyword = %v, want [ads]", raw.DomainKeyword)
+	if len(hr.DomainKeyword) != 1 || hr.DomainKeyword[0] != "ads" {
+		t.Fatalf("keyword = %v, want [ads]", hr.DomainKeyword)
 	}
-	if len(raw.DomainSuffix) != 2 {
-		t.Fatalf("suffix = %v, want both apex.example and sub.example", raw.DomainSuffix)
+	if len(hr.DomainSuffix) != 2 {
+		t.Fatalf("suffix = %v, want both apex.example and sub.example", hr.DomainSuffix)
+	}
+	if findRouteRuleWithRuleSet(rt, "rs-m") == nil {
+		t.Fatalf("the rule must be emitted referencing rs-m; rules=%+v", rt.Rules)
 	}
 }

-// TestRuleBareEntryIsExactDomain pins the routing convention (bare == exact),
-// which deliberately differs from the DNS/filter lists (bare == suffix).
-func TestRuleBareEntryIsExactDomain(t *testing.T) {
-	rt, _ := genRules(t, model.Rule{
-		Name: "b", Enabled: true, Order: 10,
-		DstDomain: []string{"example.com"}, Target: "node:n1",
-	})
-	gen := generalRules(rt)
-	if len(gen) != 1 {
-		t.Fatalf("want 1 rule, got %d", len(gen))
+// TestRulesetBareEntryIsDomainSuffix pins the convention a destination list now
+// follows — and it is the OPPOSITE of the one the old dst_domain used.
+//
+// A bare entry in a routing rule meant one EXACT domain; a bare entry in a
+// rule-set means the domain AND its subdomains (the DNS/filter/device convention,
+// classifyDomainEntries with bareIsSuffix=true). `full:` is how an exact match is
+// written now. model.migrate1to2 rewrites old dst_domain entries accordingly, so
+// this asymmetry is the thing that migration has to get right.
+func TestRulesetBareEntryIsDomainSuffix(t *testing.T) {
+	rt, _ := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("b", "example.com", "full:exact.example")},
+		model.Rule{Name: "b", Enabled: true, Order: 10, DstRuleset: []string{"b"}, Target: "node:n1"},
+	)
+	rs, ok := ruleSetByTag(rt, "rs-b")
+	if !ok {
+		t.Fatalf("rs-b not emitted; route=%+v", rt)
 	}
-	raw := gen[0].DefaultOptions.RawDefaultRule
-	if len(raw.Domain) != 1 || raw.Domain[0] != "example.com" {
-		t.Fatalf("bare entry must be an exact Domain, got domain=%v suffix=%v", raw.Domain, raw.DomainSuffix)
+	hr := soleInlineRule(t, rs)
+	if len(hr.DomainSuffix) != 1 || hr.DomainSuffix[0] != "example.com" {
+		t.Fatalf("bare entry must become a domain_suffix, got suffix=%v domain=%v", hr.DomainSuffix, hr.Domain)
 	}
-	if len(raw.DomainSuffix) != 0 {
-		t.Fatalf("bare entry must NOT become a suffix, got %v", raw.DomainSuffix)
+	if len(hr.Domain) != 1 || hr.Domain[0] != "exact.example" {
+		t.Fatalf("full: must be the exact form, got domain=%v", hr.Domain)
 	}
 }
@@ -18,10 +18,13 @@ import (
 )

 // TestMalformedMatchersStillApply drives ONE model carrying every previously
-// fatal matcher — a geosite: domain, a bad ip_cidr, a bad source cidr, an
+// fatal matcher — a geosite: entry, a bad ip_cidr, a bad source cidr, an
 // uncompilable regexp and a malformed port range — plus a healthy rule, through
 // engine.Apply. It must come up, the healthy rule must survive, and the
-// kill-switch backstop must stay closed.
+// kill-switch backstop must stay closed. The destination lists are inline
+// `config ruleset`s (schema v2), which is where the domain/IP guards live now;
+// a rule-set left with no usable entry is skipped, and so is the rule whose only
+// matcher it was.
 func TestMalformedMatchersStillApply(t *testing.T) {
 	g := model.DefaultGlobals()
 	g.KillSwitch = "closed"
@@ -29,13 +32,19 @@ func TestMalformedMatchersStillApply(t *testing.T) {
 		Globals:  g,
 		Inbounds: []model.Inbound{{Name: "lan", Enabled: true, Type: "tproxy", TproxyPort: 12395, TCP: true, UDP: true}},
 		Nodes:    []model.Node{{Name: "n1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#n1"}},
+		Rulesets: []model.Ruleset{
+			inlineDomainSet("geosite", "geosite:youtube"),
+			inlineIPSet("badip", "999.1.1.1/24"),
+			inlineDomainSet("badre", "regexp:*broken("),
+			inlineDomainSet("ok", "ok.example"),
+		},
 		Rules: []model.Rule{
-			{Name: "geosite", Enabled: true, Order: 1, DstDomain: []string{"geosite:youtube"}, Target: "node:n1"},
-			{Name: "badip", Enabled: true, Order: 2, DstIP: []string{"999.1.1.1/24"}, Target: "node:n1"},
+			{Name: "geosite", Enabled: true, Order: 1, DstRuleset: []string{"geosite"}, Target: "node:n1"},
+			{Name: "badip", Enabled: true, Order: 2, DstRuleset: []string{"badip"}, Target: "node:n1"},
 			{Name: "badsrc", Enabled: true, Order: 3, Src: []string{"192.168.0.0/99"}, Target: "node:n1"},
-			{Name: "badre", Enabled: true, Order: 4, DstDomain: []string{"regexp:*broken("}, Target: "node:n1"},
+			{Name: "badre", Enabled: true, Order: 4, DstRuleset: []string{"badre"}, Target: "node:n1"},
 			{Name: "badport", Enabled: true, Order: 5, DstPort: "a-b", Target: "node:n1"},
-			{Name: "healthy", Enabled: true, Order: 6, DstDomain: []string{"ok.example"}, DstPort: "443", Target: "node:n1"},
+			{Name: "healthy", Enabled: true, Order: 6, DstRuleset: []string{"ok"}, DstPort: "443", Target: "node:n1"},
 		},
 	}

@@ -46,14 +55,21 @@ func TestMalformedMatchersStillApply(t *testing.T) {
 	if opts.Route.Final != tagBlock {
 		t.Fatalf("Final = %q, want block", opts.Route.Final)
 	}
-	if !hasDomainRule(opts.Route, "ok.example") {
+	if !hasRulesetRule(opts.Route, "ok") {
 		t.Fatalf("the healthy rule must survive alongside the malformed ones")
 	}
 	if !hasRouteToOutbound(opts, "n1") {
 		t.Fatalf("expected a route rule to n1")
 	}
 	// Every malformed matcher reported itself rather than failing silently.
-	for _, want := range []string{"geosite matcher", "is not a valid IP/CIDR", "domain regexp", "is not a valid port/range"} {
+	for _, want := range []string{
+		"unrecognised prefix",       // geosite: in a domain list
+		"no usable entries",         // ...leaving that list empty
+		"bad ip_cidr entry",         // 999.1.1.1/24
+		"is not a valid IP/CIDR",    // the source cidr
+		"domain regexp",             // regexp:*broken(
+		"is not a valid port/range", // a-b
+	} {
 		if !routeWarnsHave(warns, want) {
 			t.Fatalf("missing diagnostic %q in %v", want, warns)
 		}
@@ -155,10 +171,15 @@ func TestRuleKillPoliciesApply(t *testing.T) {
 		Inbounds: []model.Inbound{{Name: "lan", Enabled: true, Type: "tproxy", TproxyPort: 12398, TCP: true, UDP: true}},
 		Nodes:    []model.Node{{Name: "dead", Enabled: false, URI: "ss://aes-256-gcm:secret@203.0.113.1:8388#dead"}},
 		Groups:   []model.Group{{Name: "grp", Strategy: "leastping", Nodes: []string{"dead"}}},
+		Rulesets: []model.Ruleset{
+			inlineDomainSet("k-closed", "closed.example"),
+			inlineDomainSet("k-open", "open.example"),
+			inlineDomainSet("k-default", "default.example"),
+		},
 		Rules: []model.Rule{
-			{Name: "k-closed", Enabled: true, Order: 1, DstDomain: []string{"closed.example"}, Target: "group:grp", Kill: "closed"},
-			{Name: "k-open", Enabled: true, Order: 2, DstDomain: []string{"open.example"}, Target: "group:grp", Kill: "open"},
-			{Name: "k-default", Enabled: true, Order: 3, DstDomain: []string{"default.example"}, Target: "group:grp"},
+			{Name: "k-closed", Enabled: true, Order: 1, DstRuleset: []string{"k-closed"}, Target: "group:grp", Kill: "closed"},
+			{Name: "k-open", Enabled: true, Order: 2, DstRuleset: []string{"k-open"}, Target: "group:grp", Kill: "open"},
+			{Name: "k-default", Enabled: true, Order: 3, DstRuleset: []string{"k-default"}, Target: "group:grp"},
 		},
 	}

@@ -166,13 +187,13 @@ func TestRuleKillPoliciesApply(t *testing.T) {
 	if !changed {
 		t.Fatalf("expected Apply changed==true (warnings: %v)", warns)
 	}
-	if got, ok := domainRuleTarget(opts.Route, "closed.example"); !ok || got != tagBlock {
+	if got, ok := rulesetRuleTarget(opts.Route, "k-closed"); !ok || got != tagBlock {
 		t.Fatalf("kill=closed must emit a rule routed to block, got %q (ok=%v)", got, ok)
 	}
-	if got, ok := domainRuleTarget(opts.Route, "open.example"); !ok || got != tagDirect {
+	if got, ok := rulesetRuleTarget(opts.Route, "k-open"); !ok || got != tagDirect {
 		t.Fatalf("kill=open must emit a rule routed to direct, got %q (ok=%v)", got, ok)
 	}
-	if got, ok := domainRuleTarget(opts.Route, "default.example"); !ok || got != tagBlock {
+	if got, ok := rulesetRuleTarget(opts.Route, "k-default"); !ok || got != tagBlock {
 		t.Fatalf("kill=default must emit a rule routed to block, got %q (ok=%v)", got, ok)
 	}
 	if opts.Route.Final != tagBlock {
@@ -45,6 +45,40 @@ func genRules(t *testing.T, rules ...model.Rule) (*option.RouteOptions, []string
 	return opts.Route, warns
 }

+// ruleModelWithSets is ruleModel plus the `config ruleset` definitions the rules'
+// DstRuleset entries point at. A rule's ONLY destination matcher is a rule-set
+// (schema v2), so every case below that just needs "some destination the engine
+// can match on" declares one here rather than writing an inline domain/IP list.
+func ruleModelWithSets(sets []model.Ruleset, rules ...model.Rule) *model.Model {
+	m := ruleModel(rules...)
+	m.Rulesets = sets
+	return m
+}
+
+// genRulesWithSets is genRules for a model that also carries rule-sets.
+func genRulesWithSets(t *testing.T, sets []model.Ruleset, rules ...model.Rule) (*option.RouteOptions, []string) {
+	t.Helper()
+	opts, warns, err := GenerateWithWarnings(ruleModelWithSets(sets, rules...))
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	return opts.Route, warns
+}
+
+// inlineDomainSet builds an inline DOMAIN `config ruleset`.
+//
+// Mind the convention the move to rule-sets brought with it: a BARE entry here is
+// a DomainSuffix (the apex AND its subdomains), whereas the routing rule's old
+// dst_domain read a bare entry as an EXACT domain. `full:` is the exact form.
+func inlineDomainSet(name string, entries ...string) model.Ruleset {
+	return model.Ruleset{Name: name, Type: "domain", Source: "inline", Entries: entries}
+}
+
+// inlineIPSet builds an inline IP-RANGE `config ruleset`.
+func inlineIPSet(name string, entries ...string) model.Ruleset {
+	return model.Ruleset{Name: name, Type: "ipcidr", Source: "inline", Entries: entries}
+}
+
 func routeWarnsHave(warns []string, substr string) bool {
 	for _, w := range warns {
 		if strings.Contains(w, substr) {
@@ -68,69 +102,117 @@ func generalRules(rt *option.RouteOptions) []option.Rule {

 // --- geosite: the landmine ---------------------------------------------------

-// TestGeositeMatcherIsInertNotFatal: route-rule `geosite` was REMOVED from this
-// engine — route/rule.NewDefaultRule returns "geosite database is deprecated ...
-// removed in sing-box 1.12.0" for a non-empty Geosite list, and that error aborts
-// box.New for the whole config. A `geosite:` entry must therefore be warned and
-// omitted (exactly like the geoip matcher below), never emitted.
-func TestGeositeMatcherIsInertNotFatal(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "geo", Enabled: true, Order: 10,
-		DstDomain: []string{"geosite:youtube"}, Target: "node:n1",
-	})
+// TestGeositeEntryInRulesetIsInertNotFatal: route-rule `geosite` was REMOVED from
+// this engine — route/rule.NewDefaultRule returns "geosite database is deprecated
+// ... removed in sing-box 1.12.0" for a non-empty Geosite list, and that error
+// aborts box.New for the whole config. Destinations now live in a `config
+// ruleset`, so a `geosite:` entry lands in an inline domain list, where it is an
+// unrecognised `word:` prefix: dropped by the classifier, reported, and — being
+// the list's only entry — leaving the rule-set with nothing to match, so it is
+// skipped and the rule that referenced it is not emitted either. Nothing about
+// that path may ever put a value in RawDefaultRule.Geosite. (`source=geosite` on
+// the ruleset itself is the working way to route a category; see
+// TestRoutingRuleSetGeositeCategory.)
+func TestGeositeEntryInRulesetIsInertNotFatal(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("geo", "geosite:youtube")},
+		model.Rule{Name: "geo", Enabled: true, Order: 10, DstRuleset: []string{"geo"}, Target: "node:n1"},
+	)
 	for _, r := range rt.Rules {
 		if len(r.DefaultOptions.RawDefaultRule.Geosite) > 0 {
 			t.Fatalf("geosite must never be emitted (aborts box.New), got %v", r.DefaultOptions.RawDefaultRule.Geosite)
 		}
 	}
-	if !routeWarnsHave(warns, "geosite matcher") {
-		t.Fatalf("expected an inert-geosite warning, got %v", warns)
+	if _, ok := ruleSetByTag(rt, "rs-geo"); ok {
+		t.Fatalf("a rule-set with no usable entry must not be emitted (an empty list would match everything)")
+	}
+	if findRouteRuleWithRuleSet(rt, "rs-geo") != nil {
+		t.Fatalf("no rule may reference the skipped rule-set")
+	}
+	if !routeWarnsHave(warns, "unrecognised prefix") {
+		t.Fatalf("expected an unrecognised-prefix warning for geosite:, got %v", warns)
+	}
+	if !routeWarnsHave(warns, "no usable entries") {
+		t.Fatalf("expected a no-usable-entries warning, got %v", warns)
 	}
 }

-// TestGeositeMixedWithRealDomainKeepsTheRest: a rule carrying BOTH a geosite entry
-// and a real domain keeps the real matcher and still routes — only the geosite
-// part is dropped.
+// TestGeositeMixedWithRealDomainKeepsTheRest: a rule-set carrying BOTH a geosite
+// entry and a real domain keeps the real matcher, and the rule referencing it
+// still routes — only the geosite entry is dropped.
 func TestGeositeMixedWithRealDomainKeepsTheRest(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "mixed", Enabled: true, Order: 10,
-		DstDomain: []string{"geosite:youtube", "example.com"}, Target: "node:n1",
-	})
-	gen := generalRules(rt)
-	if len(gen) != 1 {
-		t.Fatalf("want 1 general rule, got %d (warnings %v)", len(gen), warns)
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("mixed", "geosite:youtube", "full:example.com")},
+		model.Rule{Name: "mixed", Enabled: true, Order: 10, DstRuleset: []string{"mixed"}, Target: "node:n1"},
+	)
+	rs, ok := ruleSetByTag(rt, "rs-mixed")
+	if !ok {
+		t.Fatalf("rs-mixed must survive the geosite entry (warnings %v)", warns)
 	}
-	raw := gen[0].DefaultOptions.RawDefaultRule
-	if len(raw.Geosite) != 0 {
-		t.Fatalf("geosite leaked: %v", raw.Geosite)
+	hr := rs.InlineOptions.Rules[0].DefaultOptions
+	if len(hr.Domain) != 1 || hr.Domain[0] != "example.com" {
+		t.Fatalf("real domain matcher lost: %+v", hr)
 	}
-	if len(raw.Domain) != 1 || raw.Domain[0] != "example.com" {
-		t.Fatalf("real domain matcher lost: %+v", raw.Domain)
+	if len(hr.DomainSuffix)+len(hr.DomainKeyword)+len(hr.DomainRegex) != 0 {
+		t.Fatalf("geosite: must be dropped, not reinterpreted: %+v", hr)
 	}
-	if got := gen[0].DefaultOptions.RuleAction.RouteOptions.Outbound; got != "n1" {
+	dr := findRouteRuleWithRuleSet(rt, "rs-mixed")
+	if dr == nil {
+		t.Fatalf("the rule must be emitted referencing rs-mixed; rules=%+v", rt.Rules)
+	}
+	if got := dr.RuleAction.RouteOptions.Outbound; got != "n1" {
 		t.Fatalf("target = %q, want n1", got)
 	}
 }

+// TestGeoipEntryInRulesetIsInertNotFatal is the IP-side twin: model.migrate1to2
+// moves an old `dst_ip geoip:ru` verbatim into an inline type=ipcidr rule-set
+// (deliberately — see TestMigrate1to2KeepsGeoMarkersInert: it must not silently
+// become a working geoip source, because the operator never asked to download
+// anything). Here it is an unparseable prefix, so it must be dropped LOUDLY
+// rather than reach NewIPCIDRItem, which errors and aborts box.New.
+func TestGeoipEntryInRulesetIsInertNotFatal(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineIPSet("geo", "geoip:ru")},
+		model.Rule{Name: "geo", Enabled: true, Order: 10, DstRuleset: []string{"geo"}, Target: "node:n1"},
+	)
+	for _, r := range rt.Rules {
+		if len(r.DefaultOptions.RawDefaultRule.GeoIP) > 0 {
+			t.Fatalf("geoip must never be emitted, got %v", r.DefaultOptions.RawDefaultRule.GeoIP)
+		}
+	}
+	if _, ok := ruleSetByTag(rt, "rs-geo"); ok {
+		t.Fatalf("a list whose only entry is unparseable must not materialise")
+	}
+	if !routeWarnsHave(warns, `bad ip_cidr entry "geoip:ru"`) {
+		t.Fatalf("expected a bad-ip_cidr warning naming the entry, got %v", warns)
+	}
+}
+
 // --- malformed matchers that used to abort box.New ---------------------------

-// TestBadDstCIDRWarnsAndSkips: an unparseable ip_cidr makes
-// route/rule.NewIPCIDRItem error, which aborts box.New. It must be dropped.
-func TestBadDstCIDRWarnsAndSkips(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "bad", Enabled: true, Order: 10,
-		DstIP: []string{"999.1.1.1/24", "198.51.100.0/24"}, Target: "node:n1",
-	})
-	gen := generalRules(rt)
-	if len(gen) != 1 {
-		t.Fatalf("want 1 general rule, got %d", len(gen))
+// TestRulesetBadIPCIDREntryWarnsAndSkips: an unparseable ip_cidr makes
+// route/rule.NewIPCIDRItem error, which aborts box.New. Destination addresses are
+// an inline `type=ipcidr` rule-set now, so the guard lives in inlineRulesetRule:
+// the typo is dropped, the valid entry survives and the rule still routes.
+func TestRulesetBadIPCIDREntryWarnsAndSkips(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineIPSet("bad", "999.1.1.1/24", "198.51.100.0/24")},
+		model.Rule{Name: "bad", Enabled: true, Order: 10, DstRuleset: []string{"bad"}, Target: "node:n1"},
+	)
+	rs, ok := ruleSetByTag(rt, "rs-bad")
+	if !ok {
+		t.Fatalf("one bad entry must not take the whole list down (warnings %v)", warns)
 	}
-	raw := gen[0].DefaultOptions.RawDefaultRule
-	if len(raw.IPCIDR) != 1 || raw.IPCIDR[0] != "198.51.100.0/24" {
-		t.Fatalf("ip_cidr = %v, want only the valid entry", raw.IPCIDR)
+	got := rs.InlineOptions.Rules[0].DefaultOptions.IPCIDR
+	if len(got) != 1 || got[0] != "198.51.100.0/24" {
+		t.Fatalf("ip_cidr = %v, want only the valid entry", got)
 	}
-	if !routeWarnsHave(warns, `destination "999.1.1.1/24" is not a valid IP/CIDR`) {
-		t.Fatalf("expected a bad-destination warning, got %v", warns)
+	if !routeWarnsHave(warns, `bad ip_cidr entry "999.1.1.1/24"`) {
+		t.Fatalf("expected a bad-ip_cidr warning, got %v", warns)
+	}
+	if findRouteRuleWithRuleSet(rt, "rs-bad") == nil {
+		t.Fatalf("the rule must still be emitted referencing rs-bad; rules=%+v", rt.Rules)
 	}
 }

@@ -152,24 +234,30 @@ func TestBadSrcCIDRWarnsAndSkips(t *testing.T) {
 	}
 }

-// TestBadDomainRegexWarnsAndSkips: an uncompilable `regexp:` pattern makes
-// route/rule.NewDomainRegexItem error and abort box.New.
-func TestBadDomainRegexWarnsAndSkips(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "bad", Enabled: true, Order: 10,
-		DstDomain: []string{"regexp:*broken(", `regexp:^ok\.example$`}, Target: "node:n1",
-	})
-	gen := generalRules(rt)
-	if len(gen) != 1 {
-		t.Fatalf("want 1 general rule, got %d", len(gen))
+// TestRulesetBadDomainRegexWarnsAndSkips: an uncompilable `regexp:` pattern makes
+// route/rule.NewDomainRegexItem error and abort box.New. The pattern vocabulary
+// moved into the inline rule-set with the rest of the destination list, so the
+// validation moved with it (peelDomainRegexes): the broken pattern is dropped and
+// the compilable one survives.
+func TestRulesetBadDomainRegexWarnsAndSkips(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("bad", "regexp:*broken(", `regexp:^ok\.example$`)},
+		model.Rule{Name: "bad", Enabled: true, Order: 10, DstRuleset: []string{"bad"}, Target: "node:n1"},
+	)
+	rs, ok := ruleSetByTag(rt, "rs-bad")
+	if !ok {
+		t.Fatalf("one broken pattern must not take the whole list down (warnings %v)", warns)
 	}
-	got := gen[0].DefaultOptions.RawDefaultRule.DomainRegex
+	got := rs.InlineOptions.Rules[0].DefaultOptions.DomainRegex
 	if len(got) != 1 || got[0] != `^ok\.example$` {
 		t.Fatalf("domain_regex = %v, want only the compilable one", got)
 	}
 	if !routeWarnsHave(warns, "domain regexp") {
 		t.Fatalf("expected a bad-regexp warning, got %v", warns)
 	}
+	if findRouteRuleWithRuleSet(rt, "rs-bad") == nil {
+		t.Fatalf("the rule must still be emitted referencing rs-bad; rules=%+v", rt.Rules)
+	}
 }

 // TestBadPortRangeWarnsAndSkips: a malformed range reaches
@@ -911,10 +999,12 @@ func TestRuleProtoKnownValuesAreSilent(t *testing.T) {
 // that would break existing configs either open or closed), but the widening is
 // now reported with its consequence.
 func TestIfaceOnlySourceRuleIsNotSilentlyNetworkWide(t *testing.T) {
-	rt, warns := genRules(t, model.Rule{
-		Name: "guest", Enabled: true, Order: 10,
-		Src: []string{"iface:guest"}, DstDomain: []string{"youtube.com"}, Target: "block",
-	})
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("yt", "youtube.com")},
+		model.Rule{
+			Name: "guest", Enabled: true, Order: 10,
+			Src: []string{"iface:guest"}, DstRuleset: []string{"yt"}, Target: "block",
+		})
 	if !routeWarnsHave(warns, "applies to EVERY client") {
 		t.Fatalf("expected a rule-widening warning, got %v", warns)
 	}
@@ -930,11 +1020,13 @@ func TestIfaceOnlySourceRuleIsNotSilentlyNetworkWide(t *testing.T) {
 // TestMixedSourceRuleReportsTheDroppedHalf: with one usable IP source alongside
 // an unmatchable one, the rule narrows to the IP source only.
 func TestMixedSourceRuleReportsTheDroppedHalf(t *testing.T) {
-	_, warns := genRules(t, model.Rule{
-		Name: "mixed", Enabled: true, Order: 10,
-		Src:       []string{"iface:guest", "aa:bb:cc:dd:ee:ff", "192.168.5.0/24"},
-		DstDomain: []string{"youtube.com"}, Target: "block",
-	})
+	_, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("yt", "youtube.com")},
+		model.Rule{
+			Name: "mixed", Enabled: true, Order: 10,
+			Src:        []string{"iface:guest", "aa:bb:cc:dd:ee:ff", "192.168.5.0/24"},
+			DstRuleset: []string{"yt"}, Target: "block",
+		})
 	if !routeWarnsHave(warns, "could not be used") {
 		t.Fatalf("expected a dropped-source warning, got %v", warns)
 	}
@@ -1041,41 +1133,73 @@ func TestRuleTargetKindsResolve(t *testing.T) {
 	}
 }

-// TestRuleDomainUnrecognisedPrefixWarns: an unknown `word:` prefix is dropped by
-// the shared classifier (a domain cannot contain ":"), so the rule silently lost
-// that destination. `domain:example.com` is the v0.1/xray spelling a migrating
-// user writes, and it must not disappear without a trace.
-func TestRuleDomainUnrecognisedPrefixWarns(t *testing.T) {
+// TestRulesetDomainUnrecognisedPrefixWarns: an unknown `word:` prefix is dropped
+// by the shared classifier (a domain cannot contain ":"), so the list silently
+// lost that destination. `domain:example.com` is the v0.1/xray spelling a
+// migrating user writes, and it must not disappear without a trace — the more so
+// now that a destination list is ALWAYS a rule-set, i.e. the one place a typo can
+// hide.
+func TestRulesetDomainUnrecognisedPrefixWarns(t *testing.T) {
 	for _, entry := range []string{"domain:example.com", "regex:example.com", "ext:foo.dat:cn"} {
-		rt, warns := genRules(t, model.Rule{
-			Name: "mig", Enabled: true, Order: 10,
-			DstDomain: []string{entry, "keep.example"}, Target: "block",
-		})
+		rt, warns := genRulesWithSets(t,
+			[]model.Ruleset{inlineDomainSet("mig", entry, "keep.example")},
+			model.Rule{Name: "mig", Enabled: true, Order: 10, DstRuleset: []string{"mig"}, Target: "block"},
+		)
 		if !routeWarnsHave(warns, "unrecognised prefix") {
 			t.Fatalf("%q: expected an unrecognised-prefix warning, got %v", entry, warns)
 		}
-		gen := generalRules(rt)
-		if len(gen) != 1 {
-			t.Fatalf("%q: want 1 rule, got %d", entry, len(gen))
+		rs, ok := ruleSetByTag(rt, "rs-mig")
+		if !ok {
+			t.Fatalf("%q: the usable entry must keep the rule-set alive; warnings %v", entry, warns)
 		}
-		for _, d := range gen[0].DefaultOptions.RawDefaultRule.Domain {
-			if strings.Contains(d, ":") {
-				t.Fatalf("%q: a prefixed literal reached the matcher: %q", entry, d)
+		hr := rs.InlineOptions.Rules[0].DefaultOptions
+		for _, list := range [][]string{hr.Domain, hr.DomainSuffix, hr.DomainKeyword, hr.DomainRegex} {
+			for _, d := range list {
+				if strings.Contains(d, ":") {
+					t.Fatalf("%q: a prefixed literal reached the matcher: %q", entry, d)
+				}
 			}
 		}
+		if findRouteRuleWithRuleSet(rt, "rs-mig") == nil {
+			t.Fatalf("%q: the rule must still be emitted; rules=%+v", entry, rt.Rules)
+		}
 	}
 }

-// TestRuleDomainKnownPrefixesAreSilent guards the warning against false
-// positives on the vocabulary routing rules really support.
-func TestRuleDomainKnownPrefixesAreSilent(t *testing.T) {
-	_, warns := genRules(t, model.Rule{
-		Name: "ok", Enabled: true, Order: 10, Target: "block",
-		DstDomain: []string{"full:a.example", "suffix:b.example", "keyword:c", `regexp:^d\.`, ".e.example", "f.example"},
-	})
+// TestRulesetDomainKnownPrefixesAreSilent guards the warning against false
+// positives on the vocabulary an inline domain rule-set really supports.
+//
+// `regexp:` is the load-bearing case: the shared classifier has no branch for it,
+// so it WOULD be reported as an unknown prefix — inlineRulesetRule peels the
+// regexes off first (peelDomainRegexes) precisely so it is not. A regression there
+// would both warn about a working matcher and drop it.
+func TestRulesetDomainKnownPrefixesAreSilent(t *testing.T) {
+	rt, warns := genRulesWithSets(t,
+		[]model.Ruleset{inlineDomainSet("ok",
+			"full:a.example", "suffix:b.example", "keyword:c", `regexp:^d\.`, ".e.example", "f.example")},
+		model.Rule{Name: "ok", Enabled: true, Order: 10, DstRuleset: []string{"ok"}, Target: "block"},
+	)
 	if routeWarnsHave(warns, "unrecognised prefix") {
 		t.Fatalf("the supported prefixes must not warn: %v", warns)
 	}
+	rs, ok := ruleSetByTag(rt, "rs-ok")
+	if !ok {
+		t.Fatalf("rs-ok not emitted; warnings %v", warns)
+	}
+	hr := rs.InlineOptions.Rules[0].DefaultOptions
+	if len(hr.Domain) != 1 || hr.Domain[0] != "a.example" {
+		t.Fatalf("full: must be an exact Domain, got %v", hr.Domain)
+	}
+	if len(hr.DomainRegex) != 1 || hr.DomainRegex[0] != `^d\.` {
+		t.Fatalf("regexp: must survive as a domain_regex matcher, got %v", hr.DomainRegex)
+	}
+	// suffix:, the leading dot and the BARE entry all collapse to domain_suffix.
+	if len(hr.DomainSuffix) != 3 {
+		t.Fatalf("domain_suffix = %v, want b/e/f.example (bare entry is a suffix in a rule-set)", hr.DomainSuffix)
+	}
+	if len(hr.DomainKeyword) != 1 || hr.DomainKeyword[0] != "c" {
+		t.Fatalf("domain_keyword = %v, want [c]", hr.DomainKeyword)
+	}
 }

 // TestDeviceDomainUnrecognisedPrefixWarns is the same guarantee in the place it
@@ -25,6 +25,7 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
+	"regexp"
 	"runtime/debug"
 	"strings"
 	"sync"
@@ -500,6 +501,47 @@ func ruleSetURLIsEngineNative(rawURL string) (format string, native bool) {
 	}
 }

+// TWO WAYS TO WRITE A DESTINATION LIST, AND WHY THEY DO NOT SHARE A VOCABULARY.
+//
+// D21 promises "one destination mechanism, one vocabulary". The vocabulary half of
+// that promise is about the ENTRIES AN OPERATOR TYPES, and those live in exactly
+// one place: an inline `config ruleset` (inlineRulesetRule -> peelDomainRegexes +
+// classifyDomainEntries), where `full:` / `suffix:` / `keyword:` / `regexp:` / a
+// leading dot / a bare name all mean what docs-shater/DECISIONS.md D21 says.
+//
+// A `source=url` list that is not engine-native is NOT another spelling of that.
+// It is a FILE FORMAT — the hosts / plain-domain / AdBlock-ish text third parties
+// publish — and parseDomainList is a parser for that format, not for our entry
+// vocabulary. `source=file` is a third thing again: a compiled .srs or a rule-set
+// .json handed straight to the engine, which never sees shater's entry syntax at
+// all. (An earlier review read this as "the same list written two ways behaves
+// differently"; it is closer to "a typed list and a downloaded file are different
+// artifacts". The diagnostics below exist so an operator never has to guess which
+// one they are looking at.)
+//
+// Unifying them was considered and REJECTED, on three grounds:
+//
+//   - The formats collide. A real AdGuard/OISD list is full of colon-bearing lines
+//     that are not our markers at all (`example.com##.banner:has(...)`, `$domain=`
+//     options, absolute URL rules). Feeding those through the marker classifier
+//     would either mis-import them or, if we reported every `word:`-shaped token as
+//     an unknown prefix, drown the operator in hundreds of warnings per list — a
+//     louder dishonesty than the quiet one it replaces.
+//   - The shapes collide. A hosts line carries SEVERAL names ("127.0.0.1 a.com
+//     b.com"), so this parser works per TOKEN; the entry vocabulary works per LINE
+//     and allows a space after the marker ("keyword: ads"). There is no split rule
+//     that serves both.
+//   - `regexp:` from a URL is regex supplied by a third party, compiled into the
+//     router's matcher and evaluated per query on a 512 MB box. The inline path can
+//     accept it because the operator typed it; a downloaded list is not that.
+//
+// So the difference STAYS, and is paid for in diagnostics instead: a text list that
+// carries our marker vocabulary is reported per list (see listEntryMarker and
+// warnListEntryVocabulary), naming the entries and where they DO work. The check is
+// narrow on purpose — only the four markers D21 defines, never the general `word:`
+// shape — so it fires on an operator's mistake and stays silent on ordinary filter
+// syntax.
+//
 // parseDomainList extracts domains from the formats public blocklists ship in:
 //
 //   - HOSTS         "0.0.0.0 ads.example.com", "127.0.0.1 a.com b.com"
@@ -517,8 +559,12 @@ func ruleSetURLIsEngineNative(rawURL string) (format string, native bool) {
 // de-duplication map is kept — domain.NewMatcher already de-duplicates internally
 // while building the succinct set, so a second map would just double the largest
 // allocation in the pipeline. See listMaxDomains for the measured budget.
-func parseDomainList(content []byte) []string {
+//
+// The second return reports the inline-vocabulary entries seen on the way past, so
+// the caller can say so instead of dropping them without a word.
+func parseDomainList(content []byte) ([]string, listMarkerNote) {
 	out := make([]string, 0, 4096)
+	var note listMarkerNote
 	scanner := bufio.NewScanner(bytes.NewReader(content))
 	// Public lists are one domain per line; 64 KiB is far beyond any real line, and
 	// an over-long line is skipped rather than aborting the parse.
@@ -544,17 +590,123 @@ func parseDomainList(content []byte) []string {
 			// AdBlock-ish "||domain^" -> domain.
 			f = strings.TrimPrefix(f, "||")
 			f = strings.TrimSuffix(f, "^")
+			if _, isMarker := listEntryMarker(f); isMarker {
+				// normaliseListDomain would drop this silently (a domain cannot contain
+				// ":"). Record it so the caller can name it; it is the one class of junk
+				// in a text list that is provably an operator mistake rather than filter
+				// syntax we simply do not import.
+				note.record(f)
+				continue
+			}
 			d, ok := normaliseListDomain(f)
 			if !ok {
 				continue
 			}
 			out = append(out, d)
 			if len(out) >= listMaxDomains {
-				return out
+				return out, note
 			}
 		}
 	}
-	return out
+	return out, note
+}
+
+// listEntryVocabulary is EXACTLY the marker set an INLINE rule-set entry may use
+// (D21). It is deliberately NOT the general `word:` shape unrecognisedDomainPrefix
+// tests for: a published filter list legitimately contains hundreds of colon-
+// bearing tokens, and reporting those would make the diagnostic useless. These
+// four, by contrast, appear in a downloaded text list only when a human wrote them
+// there expecting shater to honour them.
+var listEntryVocabulary = []string{"full:", "suffix:", "keyword:", "regexp:"}
+
+// listEntryMarker reports whether a text-list token is written in the inline entry
+// vocabulary, and which marker it used.
+func listEntryMarker(token string) (string, bool) {
+	lower := strings.ToLower(strings.TrimSpace(token))
+	for _, m := range listEntryVocabulary {
+		if strings.HasPrefix(lower, m) {
+			return m, true
+		}
+	}
+	return "", false
+}
+
+// listMarkerSamples bounds how many offending entries a warning quotes. A list is
+// remote content: it must not be able to write an unbounded amount into our log.
+const listMarkerSamples = 5
+
+// listMarkerNote records the inline-vocabulary entries one plain-text list carried.
+type listMarkerNote struct {
+	Count   int
+	Samples []string
+}
+
+func (n *listMarkerNote) record(entry string) {
+	n.Count++
+	if len(n.Samples) < listMarkerSamples {
+		n.Samples = append(n.Samples, strings.TrimSpace(entry))
+	}
+}
+
+func (n listMarkerNote) empty() bool { return n.Count == 0 }
+
+// listMarkerMemo remembers, per list URL, what the last COMPILATION of that list
+// found. Without it the diagnostic would exist for exactly one reconcile — the one
+// that happened to refresh the artifact — and then vanish for a whole
+// update_interval, which is precisely the "reported to nobody" failure it is meant
+// to fix. Same shape (and same reasoning) as ruleSetProbeCache above; a refresh
+// that finds nothing clears the entry, so fixing the list silences it.
+var (
+	listMarkerMu   sync.Mutex
+	listMarkerMemo = map[string]listMarkerNote{}
+)
+
+func rememberListMarkers(url string, note listMarkerNote) {
+	listMarkerMu.Lock()
+	if note.empty() {
+		delete(listMarkerMemo, url)
+	} else {
+		listMarkerMemo[url] = note
+	}
+	listMarkerMu.Unlock()
+}
+
+func recallListMarkers(url string) listMarkerNote {
+	listMarkerMu.Lock()
+	defer listMarkerMu.Unlock()
+	return listMarkerMemo[url]
+}
+
+// resetListMarkerMemo clears the memo (tests).
+func resetListMarkerMemo() {
+	listMarkerMu.Lock()
+	listMarkerMemo = map[string]listMarkerNote{}
+	listMarkerMu.Unlock()
+}
+
+// warnListEntryVocabulary tells the operator that entries written in the INLINE
+// entry vocabulary were found in a downloaded TEXT list, where they mean nothing.
+// See the parseDomainList block above for why the two vocabularies are separate
+// and why saying so is the whole of the fix.
+func (b *builder) warnListEntryVocabulary(diag, url string) {
+	note := recallListMarkers(url)
+	if note.empty() {
+		return
+	}
+	b.warnf("%s: %q is a plain-text list (a hosts file or one domain per line), but %d of its entries are written in the "+
+		"inline rule-set vocabulary (e.g. %s) — a plain-text list has NO markers, so every line is read as a domain plus its "+
+		"subdomains and anything containing \":\" is dropped, because a domain name cannot contain one. Those entries match NOTHING. "+
+		"Put them in a rule-set with source=inline, which is the one place full:/suffix:/keyword:/regexp: are honoured.",
+		diag, url, note.Count, quoteList(note.Samples))
+}
+
+// quoteList renders sample entries for a diagnostic.
+func quoteList(in []string) string {
+	out := make([]string, 0, len(in))
+	for _, s := range in {
+		out = append(out, fmt.Sprintf("%q", s))
+	}
+	return strings.Join(out, ", ")
 }

 // hostsBoilerplate are the names every hosts file carries for its own bookkeeping.
@@ -675,6 +827,11 @@ func (b *builder) compiledListRuleSet(tag, url, updateInterval, diag string) (op
 		}
 	}

+	// Reported on EVERY generate, not only on the one that refreshed the artifact:
+	// an entry that matches nothing is exactly as wrong the day after it was
+	// compiled as the moment it was.
+	b.warnListEntryVocabulary(diag, url)
+
 	return option.RuleSet{
 		Type:         C.RuleSetTypeLocal,
 		Tag:          tag,
@@ -716,8 +873,11 @@ func (b *builder) refreshCompiledList(path, url, diag string) error {
 	if err != nil {
 		return err
 	}
-	domains := parseDomainList(body)
+	domains, markers := parseDomainList(body)
 	body = nil // release the source text before the matcher allocates
+	// Remember (or clear) what this compilation saw, so the diagnostic survives the
+	// reconciles that do no I/O at all. See warnListEntryVocabulary.
+	rememberListMarkers(url, markers)

 	if len(domains) == 0 {
 		return fmt.Errorf("no usable domains found at %s (fetched %s, but nothing in it parsed as a domain)", url, "the file")
@@ -1163,7 +1323,8 @@ func (b *builder) buildRoutingRuleSetRaw(rs model.Ruleset) ([]option.RuleSet, []
 // its Entries, keyed by Type: an ipcidr ruleset fills ip_cidr; a domain ruleset
 // (the default) is classified with inlineDomainRule — bare entry => DomainSuffix
 // (so subdomains match), full: => Domain, keyword: => DomainKeyword, . => suffix
-// — the same classification the DNS filter uses. ok=false when nothing usable.
+// — the same classification the DNS filter uses, plus `regexp:` (see
+// peelDomainRegexes). ok=false when nothing usable.
 func (b *builder) inlineRulesetRule(rs model.Ruleset) (option.DefaultHeadlessRule, bool) {
 	b.warnUnknownRuleSetType(fmt.Sprintf("ruleset %q", rs.Name), rs.Type)
 	if ruleSetTypeIsIPCIDR(rs.Type) {
@@ -1190,10 +1351,73 @@ func (b *builder) inlineRulesetRule(rs model.Ruleset) (option.DefaultHeadlessRul
 		return option.DefaultHeadlessRule{IPCIDR: badoption.Listable[string](cidrs)}, true
 	}
 	// "domain" (and empty, and anything unrecognised => domain, warned above).
+	// `regexp:` is peeled off first: it is a routing-rule matcher the DNS-filter
+	// classifier does not know, and it must not be reported as an unknown prefix.
+	diag := fmt.Sprintf("ruleset %q", rs.Name)
+	rest, regexes := b.peelDomainRegexes(diag, rs.Entries)
+	// R4, on the path every destination list now takes. classifyDomainEntries
+	// DROPS an entry that is nothing but its marker (".", "full:", "keyword:"),
+	// silently — and the silence is the dangerous half: an empty domain token
+	// aborts box.New for the whole config, and an empty keyword is
+	// strings.Contains(host, "") i.e. EVERY host. The drop is right; not saying so
+	// is not. (devices.go reports the same class for a device's own lists; the bare
+	// `regexp:` form is reported by peelDomainRegexes above, which is why it is
+	// peeled off before this loop and cannot be double-reported.)
+	for _, e := range rest {
+		if isDomainMarkerOnly(e) {
+			b.warnf("%s: entry %q is a bare matcher marker with no value, omitted (an empty domain token aborts box.New; an empty keyword would match EVERY host)", diag, strings.TrimSpace(e))
+		}
+	}
 	// Only the DOMAIN branch reports unknown `word:` prefixes — the ipcidr branch
 	// above is full of legitimate colons (IPv6) and must never be checked (R9.2).
-	b.warnUnrecognisedPrefixes(fmt.Sprintf("ruleset %q", rs.Name), rs.Entries)
-	return inlineDomainRule(rs.Entries)
+	b.warnUnrecognisedPrefixes(diag, rest)
+	hr, ok := inlineDomainRule(rest)
+	if len(regexes) > 0 {
+		hr.DomainRegex = badoption.Listable[string](regexes)
+		ok = true
+	}
+	return hr, ok
+}
+
+// peelDomainRegexes splits `regexp:<pattern>` entries out of a domain rule-set's
+// entry list, returning the remaining entries and the validated patterns.
+//
+// It exists because a destination list is now ALWAYS a rule-set (schema v2), so
+// every matcher a `dst_domain` used to express has to be expressible here —
+// including the regex form, which the shared DNS-filter classifier
+// (classifyDomainEntries) deliberately does not know about. Validation mirrors
+// what the routing rule did before the move, and for the same reason:
+// route/rule.NewDomainRegexItem returns an error for an uncompilable pattern and
+// that aborts box.New for the WHOLE config, so a bad pattern must degrade to a
+// warning. A BARE `regexp:` compiles fine but matches every host — the same
+// silent match-all hazard as an empty keyword — so it is dropped too.
+//
+// SCOPE: this is the INLINE entry path only, and deliberately so. A `source=url`
+// text list is a hosts/plain-domain FILE, parsed by parseDomainList, which has no
+// marker vocabulary at all — see the block above parseDomainList for why the two
+// are not unified and how an entry written in the wrong one is reported.
+func (b *builder) peelDomainRegexes(diag string, entries []string) (rest, regexes []string) {
+	for _, e := range entries {
+		e = strings.TrimSpace(e)
+		if e == "" {
+			continue
+		}
+		if !strings.HasPrefix(strings.ToLower(e), "regexp:") {
+			rest = append(rest, e)
+			continue
+		}
+		re := strings.TrimSpace(e[len("regexp:"):])
+		if re == "" {
+			b.warnf("%s: %q is a bare matcher marker with no value, omitted (an empty regexp matches EVERY host)", diag, e)
+			continue
+		}
+		if _, err := regexp.Compile(re); err != nil {
+			b.warnf("%s: domain regexp %q is invalid (%v), omitted", diag, re, err)
+			continue
+		}
+		regexes = append(regexes, re)
+	}
+	return rest, regexes
 }

 // Ruleset.Type — the two shapes a rule-set can match, and the accepted spellings.
@@ -33,6 +33,14 @@ func findRouteRuleWithRuleSet(rt *option.RouteOptions, tag string) *option.Defau
 	return nil
 }

+// hasRulesetRule reports whether any emitted route rule references the rule-set
+// named name (tag rs-<name>). Since schema v2 a rule's destination is ALWAYS a
+// rule-set reference, so this is how a test says "that rule was emitted" — the
+// former "does any rule carry this dst domain" question has no answer any more.
+func hasRulesetRule(rt *option.RouteOptions, name string) bool {
+	return findRouteRuleWithRuleSet(rt, routeRulesetTagPrefix+name) != nil
+}
+
 func ruleSetByTag(rt *option.RouteOptions, tag string) (option.RuleSet, bool) {
 	if rt == nil {
 		return option.RuleSet{}, false
@@ -117,6 +125,50 @@ func TestRoutingRuleSetInlineDomain(t *testing.T) {
 	}
 }

+// TestRoutingRuleSetInlineDomainRegex: `regexp:` is a matcher the shared domain
+// classifier does NOT know — it belongs to the routing plane, and it used to be
+// peeled off inside ruleMatchers, which no longer sees any domains at all. It
+// therefore had to move into the inline rule-set with the rest of the destination
+// vocabulary (peelDomainRegexes), or every migrated `regexp:` entry would have
+// been reported as an unknown prefix and silently dropped: a routing rule that
+// looks configured and matches nothing.
+func TestRoutingRuleSetInlineDomainRegex(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Rulesets: []model.Ruleset{
+			{Name: "ads", Type: "domain", Source: "inline", Entries: []string{`regexp:^ads\.`}},
+		},
+		Rules: []model.Rule{
+			{Name: "block-ads", Enabled: true, Order: 10, DstRuleset: []string{"ads"}, Target: "block"},
+		},
+	}
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if len(warns) != 0 {
+		t.Fatalf("a valid regexp: entry must not warn: %v", warns)
+	}
+	rs, ok := ruleSetByTag(opts.Route, "rs-ads")
+	if !ok {
+		t.Fatalf("a regexp-only rule-set must still materialise; route=%+v", opts.Route)
+	}
+	hr := rs.InlineOptions.Rules[0].DefaultOptions
+	if len(hr.DomainRegex) != 1 || hr.DomainRegex[0] != `^ads\.` {
+		t.Fatalf("domain_regex = %+v, want [^ads\\.]", hr.DomainRegex)
+	}
+	if len(hr.Domain)+len(hr.DomainSuffix)+len(hr.DomainKeyword)+len(hr.IPCIDR) != 0 {
+		t.Fatalf("the regexp entry must not leak into another matcher: %+v", hr)
+	}
+	dr := findRouteRuleWithRuleSet(opts.Route, "rs-ads")
+	if dr == nil {
+		t.Fatalf("no route rule references rs-ads; rules=%+v", opts.Route.Rules)
+	}
+	if dr.RuleAction.RouteOptions.Outbound != tagBlock {
+		t.Fatalf("route rule must route to %q, got %+v", tagBlock, dr.RuleAction)
+	}
+}
+
 // TestRoutingRuleSetInlineIPCIDR: an ipcidr ruleset fills ip_cidr (not domain*),
 // and the route rule references it.
 func TestRoutingRuleSetInlineIPCIDR(t *testing.T) {
@@ -1501,7 +1553,7 @@ func TestURLBlocklistNotRefetchedWhileFresh(t *testing.T) {
 // wildcards, IPs and bare labels can never match a domain query, so importing them
 // would be a silent dud (the R9 lesson applied to fetched content).
 func TestParseDomainListRejectsJunk(t *testing.T) {
-	got := parseDomainList([]byte(strings.Join([]string{
+	got, _ := parseDomainList([]byte(strings.Join([]string{
 		"good.example.com",
 		"*.wildcard.example",          // wildcard syntax
 		"/regex/",                     // regex rule
@@ -1532,12 +1584,12 @@ func TestParseDomainListRejectsJunk(t *testing.T) {

 // TestParseDomainListHostsEdgeCases covers the messy real-world shapes.
 func TestParseDomainListHostsEdgeCases(t *testing.T) {
-	got := parseDomainList([]byte(stevenBlackSample))
+	got, _ := parseDomainList([]byte(stevenBlackSample))
 	if len(got) != 5 {
 		t.Fatalf("expected 5 domains from the sample, got %d (%v)", len(got), got)
 	}
 	// Unicode is punycoded, matching what actually arrives in a DNS query.
-	uni := parseDomainList([]byte("0.0.0.0 реклама.рф\n"))
+	uni, _ := parseDomainList([]byte("0.0.0.0 реклама.рф\n"))
 	if len(uni) != 1 || !strings.HasPrefix(uni[0], "xn--") {
 		t.Fatalf("a unicode entry must be punycoded, got %v", uni)
 	}
@@ -0,0 +1,210 @@
+package generate
+
+// The destination-list vocabulary has TWO homes, not one, and the difference is
+// reported rather than silent.
+//
+// docs-shater/DECISIONS.md D21 defines one entry vocabulary — full: / suffix: /
+// keyword: / regexp: / a leading dot / a bare name — and it belongs to the entries
+// an operator TYPES, i.e. an inline `config ruleset`. A `source=url` list that is
+// not engine-native is a hosts/plain-domain FILE, parsed by parseDomainList, which
+// has no markers at all. See the block above parseDomainList (ruleset.go) for why
+// unifying the two was rejected.
+//
+// These tests pin the consequence that makes that acceptable: an entry written in
+// the inline vocabulary inside a text list is NAMED, on every generate, and the
+// check is narrow enough that an ordinary published filter list stays silent.
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sagernet/sing-box/shater/model"
+)
+
+// urlDomainSet builds a routing `config ruleset` fed from a plain-text URL.
+func urlDomainSet(name, url string) model.Ruleset {
+	return model.Ruleset{Name: name, Type: "domain", Source: "url", URL: url}
+}
+
+// textListModel routes one rule at a url-sourced destination list.
+func textListModel(url string) (sets []model.Ruleset, rule model.Rule) {
+	return []model.Ruleset{urlDomainSet("dest", url)},
+		model.Rule{Name: "dest", Enabled: true, Order: 10, DstRuleset: []string{"dest"}, Target: "node:n1"}
+}
+
+// TestTextListInlineVocabularyIsReported is the regression: `regexp:^ads\.` (and
+// every other inline marker) works in an inline rule-set and matches NOTHING in a
+// plain-text list, because normaliseListDomain drops anything containing ":". The
+// drop is correct — a domain name cannot contain a colon — but it used to happen
+// without a word, so the same string appeared to work in one spelling of "a list of
+// destinations" and to do nothing in the other, with no way to tell which.
+func TestTextListInlineVocabularyIsReported(t *testing.T) {
+	resetListMarkerMemo()
+	t.Cleanup(resetListMarkerMemo)
+	withListFetcher(t, func(string) ([]byte, error) {
+		return []byte(strings.Join([]string{
+			"# a list someone hand-wrote in the inline vocabulary",
+			"0.0.0.0 ads.example.com",
+			`regexp:^ads\.`,
+			"full:exact.example",
+			"keyword:track",
+			"suffix:apex.example",
+			"tracker.example.org",
+		}, "\n")), nil
+	})
+
+	sets, rule := textListModel("https://lists.example/dest.txt")
+	rt, warns := genRulesWithSets(t, sets, rule)
+
+	// The list itself still works — the plain entries are imported as usual.
+	if _, ok := ruleSetByTag(rt, "rs-dest"); !ok {
+		t.Fatalf("the plain entries must still compile into a rule-set; warnings=%v", warns)
+	}
+	if !hasRulesetRule(rt, "dest") {
+		t.Fatalf("the rule referencing the list must still be emitted; warnings=%v", warns)
+	}
+
+	// ...and the four entries that silently vanished are named.
+	if !routeWarnsHave(warns, "inline rule-set vocabulary") {
+		t.Fatalf("marker entries in a text list must be reported, got %v", warns)
+	}
+	// %q-escaped in the message, so match the stable head of the pattern.
+	if !routeWarnsHave(warns, `regexp:^ads`) {
+		t.Fatalf("the warning must quote the offending entry, got %v", warns)
+	}
+	if !routeWarnsHave(warns, "source=inline") {
+		t.Fatalf("the warning must say where those markers DO work, got %v", warns)
+	}
+	if !routeWarnsHave(warns, "4 of its entries") {
+		t.Fatalf("the warning must count every dropped marker entry (4), got %v", warns)
+	}
+}
+
+// TestTextListVocabularyWarningSurvivesAFreshArtifact: the parse that can see the
+// offending entries happens only when the artifact is refreshed, which is once per
+// update_interval. A diagnostic that existed for exactly that one reconcile and
+// then disappeared for a day would be no diagnostic at all, so the finding is
+// remembered per URL and re-reported on every generate.
+func TestTextListVocabularyWarningSurvivesAFreshArtifact(t *testing.T) {
+	resetListMarkerMemo()
+	t.Cleanup(resetListMarkerMemo)
+	var fetches int
+	withListFetcher(t, func(string) ([]byte, error) {
+		fetches++
+		return []byte("keyword:track\ngood.example.com\n"), nil
+	})
+
+	sets, rule := textListModel("https://lists.example/sticky.txt")
+	for pass := 1; pass <= 3; pass++ {
+		_, warns := genRulesWithSets(t, sets, rule)
+		if !routeWarnsHave(warns, "inline rule-set vocabulary") {
+			t.Fatalf("pass %d: the warning must persist while the list does; warnings=%v", pass, warns)
+		}
+	}
+	if fetches != 1 {
+		t.Fatalf("a fresh artifact must not be re-downloaded, fetched %d times", fetches)
+	}
+}
+
+// TestTextListVocabularyWarningClearsWhenTheListIsFixed: the memo is a finding
+// about the list, not a sticky flag. Once a refresh sees a clean list the warning
+// stops, or an operator who fixed the problem would never know they had.
+func TestTextListVocabularyWarningClearsWhenTheListIsFixed(t *testing.T) {
+	resetListMarkerMemo()
+	t.Cleanup(resetListMarkerMemo)
+	body := "keyword:track\ngood.example.com\n"
+	withListFetcher(t, func(string) ([]byte, error) { return []byte(body), nil })
+
+	sets, rule := textListModel("https://lists.example/fixed.txt")
+	if _, warns := genRulesWithSets(t, sets, rule); !routeWarnsHave(warns, "inline rule-set vocabulary") {
+		t.Fatalf("setup: the first pass must report the marker entry; warnings=%v", warns)
+	}
+	body = "good.example.com\nbetter.example.org\n"
+	// The artifact from the first pass is fresh, so force the refresh the operator's
+	// next update_interval would have done anyway.
+	resetListMarkerMemo()
+	listsDirOverride = t.TempDir()
+	if _, warns := genRulesWithSets(t, sets, rule); routeWarnsHave(warns, "inline rule-set vocabulary") {
+		t.Fatalf("a clean list must not keep warning; warnings=%v", warns)
+	}
+}
+
+// TestPublishedFilterListDoesNotTripTheVocabularyWarning is the other half of the
+// trade, and the reason the check tests only the four D21 markers instead of the
+// general `word:` shape unrecognisedDomainPrefix uses. A real AdGuard/OISD list is
+// full of colon-bearing tokens that are ordinary filter syntax; warning about those
+// would put hundreds of lines per list in front of the operator, which is a louder
+// dishonesty than the silence it replaced.
+func TestPublishedFilterListDoesNotTripTheVocabularyWarning(t *testing.T) {
+	resetListMarkerMemo()
+	t.Cleanup(resetListMarkerMemo)
+	withListFetcher(t, func(string) ([]byte, error) {
+		return []byte(strings.Join([]string{
+			"! Title: Example filter list",
+			"! Homepage: https://lists.example/",
+			"||ads.example.com^$third-party",
+			"example.com##.banner:has(> .ad)",
+			"https://tracker.example/pixel.gif",
+			"@@||allowed.example.net^",
+			"0.0.0.0 good.example.net",
+			"fe80::1 ip6-localhost",
+		}, "\n")), nil
+	})
+
+	sets, rule := textListModel("https://lists.example/adguard.txt")
+	rt, warns := genRulesWithSets(t, sets, rule)
+	if _, ok := ruleSetByTag(rt, "rs-dest"); !ok {
+		t.Fatalf("the list must still compile; warnings=%v", warns)
+	}
+	if routeWarnsHave(warns, "inline rule-set vocabulary") {
+		t.Fatalf("ordinary filter syntax must not be reported as a vocabulary mistake: %v", warns)
+	}
+}
+
+// TestParseDomainListReportsOnlyTheInlineMarkers pins the predicate itself, away
+// from the generate machinery: the four markers are recorded, everything else that
+// the parser refuses stays a silent format detail.
+func TestParseDomainListReportsOnlyTheInlineMarkers(t *testing.T) {
+	domains, note := parseDomainList([]byte(strings.Join([]string{
+		"0.0.0.0 kept.example.com",
+		"FULL:Exact.Example", // markers are case-insensitive, like splitDomainMarker
+		"regexp:^ads\\.",
+		"*.wildcard.example", // junk, but not a vocabulary mistake
+		"2001:db8::1",        // colons, but an address — never a marker
+		"nodot",
+	}, "\n")))
+
+	if len(domains) != 1 || domains[0] != "kept.example.com" {
+		t.Fatalf("imported domains = %v, want [kept.example.com]", domains)
+	}
+	if note.Count != 2 {
+		t.Fatalf("marker count = %d, want 2 (FULL: and regexp:); samples=%v", note.Count, note.Samples)
+	}
+	for _, want := range []string{"FULL:Exact.Example", `regexp:^ads\.`} {
+		var seen bool
+		for _, s := range note.Samples {
+			if s == want {
+				seen = true
+			}
+		}
+		if !seen {
+			t.Fatalf("sample %q missing from %v", want, note.Samples)
+		}
+	}
+}
+
+// TestTextListVocabularyWarningIsBounded: the body is remote content, so it must
+// not be able to write an unbounded amount into the operator's warning list.
+func TestTextListVocabularyWarningIsBounded(t *testing.T) {
+	var lines []string
+	for i := 0; i < 500; i++ {
+		lines = append(lines, "keyword:junk")
+	}
+	_, note := parseDomainList([]byte(strings.Join(lines, "\n")))
+	if note.Count != 500 {
+		t.Fatalf("count = %d, want the true total 500", note.Count)
+	}
+	if len(note.Samples) != listMarkerSamples {
+		t.Fatalf("quoted %d entries, want at most %d", len(note.Samples), listMarkerSamples)
+	}
+}
@@ -12,47 +12,36 @@ import (
 	"testing"
 	"time"

-	"github.com/sagernet/sing-box/option"
-
 	"github.com/sagernet/sing-box/shater/model"
 )

-// scheduledDomain is the distinctive dst-domain matcher used to detect whether a
-// scheduled rule survived into the generated route rules.
-const scheduledDomain = "sched.example"
+// scheduledSet is the distinctive destination rule-set used to detect whether a
+// scheduled rule survived into the generated route rules. Since schema v2 a
+// rule's destination is a rule-set reference, so this doubles as a check that
+// buildRoutingRuleSets honours the same schedule gate buildRoute does: outside
+// the window neither the rule nor its rs- rule-set may be emitted.
+const scheduledSet = "sched"

 // emittedAt reports whether the given scheduled rule is present in the route
 // rules when generate's clock is `now`.
 func emittedAt(now time.Time, r model.Rule) bool {
-	b := newBuilder(&model.Model{Globals: model.DefaultGlobals(), Rules: []model.Rule{r}})
+	b := newBuilder(&model.Model{
+		Globals:  model.DefaultGlobals(),
+		Rulesets: []model.Ruleset{{Name: scheduledSet, Type: "domain", Source: "inline", Entries: []string{"sched.example"}}},
+		Rules:    []model.Rule{r},
+	})
 	b.now = now
-	return hasDomainRule(b.buildRoute(), scheduledDomain)
+	return hasRulesetRule(b.buildRoute(), scheduledSet)
 }

-// hasDomainRule reports whether any route rule carries the given exact dst-domain
-// matcher.
-func hasDomainRule(rt *option.RouteOptions, domain string) bool {
-	if rt == nil {
-		return false
-	}
-	for _, r := range rt.Rules {
-		for _, d := range r.DefaultOptions.RawDefaultRule.Domain {
-			if d == domain {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// schedRule builds a scheduled dst-domain rule (target direct) from the schedule
-// fields. It always carries the scheduledDomain matcher so emittedAt can find it.
+// schedRule builds a scheduled destination rule (target direct) from the schedule
+// fields. It always references the scheduledSet rule-set so emittedAt can find it.
 func schedRule(days []string, start, end string) model.Rule {
 	return model.Rule{
 		Name:         "sched",
 		Enabled:      true,
 		Order:        10,
-		DstDomain:    []string{scheduledDomain},
+		DstRuleset:   []string{scheduledSet},
 		Target:       "direct",
 		SchedEnabled: true,
 		SchedDays:    days,
@@ -127,9 +116,13 @@ func TestScheduleAllDayWeekend(t *testing.T) {
 // warning instead.
 func TestScheduleInvalidTimeIsAlwaysOn(t *testing.T) {
 	rule := schedRule(nil, "9am", "17:00") // "9am" is not HH:MM
-	b := newBuilder(&model.Model{Globals: model.DefaultGlobals(), Rules: []model.Rule{rule}})
+	b := newBuilder(&model.Model{
+		Globals:  model.DefaultGlobals(),
+		Rulesets: []model.Ruleset{{Name: scheduledSet, Type: "domain", Source: "inline", Entries: []string{"sched.example"}}},
+		Rules:    []model.Rule{rule},
+	})
 	b.now = time.Date(2026, 7, 15, 3, 0, 0, 0, time.UTC) // 03:00 — would be OUTSIDE a 09–17 window
-	if !hasDomainRule(b.buildRoute(), scheduledDomain) {
+	if !hasRulesetRule(b.buildRoute(), scheduledSet) {
 		t.Errorf("invalid start time should fail OPEN (rule emitted always-on)")
 	}
 	if len(b.warnings) == 0 {
@@ -0,0 +1,236 @@
+//go:build linux
+
+// The behavioural half of the build-tag contract (D23).
+//
+// shater/buildtags's test proves, statically and on any host, that the shipped
+// tag set (scripts/router-tags.sh) still NAMES every tag a declared feature
+// needs. That is necessary but not sufficient: a tag can be present and still
+// insufficient, and a tag list is only a hypothesis until something is built
+// with it. This file is the experiment — one node of every declared protocol,
+// driven through engine.Apply (box.New + Start) under WHATEVER tags the test
+// binary was compiled with.
+//
+// Run it with the shipped set via scripts/check-router-tags.sh (CI does, before
+// the artifact is built). Then the two halves compose:
+//
+//	tag set covers the declared features   (buildtags test, tag-less)
+//	+ everything compiled in constructs    (this test, run WITH the shipped set)
+//	= the binary we ship supports what we say it does.
+//
+// The 2026-07-25 WireGuard outage — `with_gvisor` trimmed while `with_wireguard`
+// stayed, so every shipped binary died with "gVisor is not included in this
+// build" on the first WireGuard node — is caught here at "wg"/"awg", because
+// box.New initialises endpoints and the WireGuard device constructor is the
+// gVisor stub without the tag.
+package generate
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+
+	"github.com/sagernet/sing-box/shater/buildtags"
+	"github.com/sagernet/sing-box/shater/model"
+)
+
+// protoCase is one declared protocol, expressed the way a user would add it: a
+// share link. feature keys it to a row of buildtags.Features (substring match on
+// the feature name) — that row supplies the build tags the case needs. An empty
+// feature means "compiled in unconditionally".
+type protoCase struct {
+	tag      string
+	uri      string
+	feature  string
+	endpoint bool // arrives as an option.Endpoint, not an option.Outbound
+}
+
+func shippedProtoCases(t *testing.T) []protoCase {
+	t.Helper()
+	const uuid = "11111111-1111-1111-1111-111111111111"
+	// A vmess ws+tls link (same fixture the parse suite uses).
+	const vmessLink = "vmess://eyJ2IjoiMiIsInBzIjoidm1lc3MtdyIsImFkZCI6ImV4YW1wbGUubmV0IiwicG9ydCI6IjQ0MyIsImlkIjoiMzMzMzMzMzMtMzMzMy0zMzMzLTMzMzMtMzMzMzMzMzMzMzMzIiwiYWlkIjoiMCIsInNjeSI6ImF1dG8iLCJuZXQiOiJ3cyIsImhvc3QiOiJleGFtcGxlLm5ldCIsInBhdGgiOiIvd3MiLCJ0bHMiOiJ0bHMifQ=="
+
+	priv, pub := validKey(1), validKey(9)
+	wgURI := fmt.Sprintf(
+		"wireguard://%s@203.0.113.10:51820?publickey=%s&address=10.13.13.2/32&allowedips=0.0.0.0/0#wg",
+		url.QueryEscape(priv), url.QueryEscape(pub),
+	)
+	awgURI := fmt.Sprintf(
+		"awg://%s@203.0.113.11:51820?publickey=%s&address=10.13.13.3/32&allowedips=0.0.0.0/0&jc=4&jmin=40&jmax=70&s1=30&s2=40&h1=1111111111&h2=2222222222&h3=3333333333&h4=444444444#awg",
+		url.QueryEscape(priv), url.QueryEscape(pub),
+	)
+
+	return []protoCase{
+		// --- always compiled in -------------------------------------------
+		{tag: "ss", uri: "ss://aes-256-gcm:secret@203.0.113.5:8388#ss"},
+		{tag: "vmess-ws", uri: vmessLink},
+		{tag: "trojan", uri: "trojan://password@example.com:443?sni=example.com#trojan"},
+		{tag: "vless-ws", uri: "vless://" + uuid + "@example.com:443?type=ws&security=tls&path=/vl&host=cdn.example.com&sni=cdn.example.com#vless-ws"},
+		{tag: "vless-grpc", uri: "vless://" + uuid + "@example.com:443?type=grpc&security=tls&serviceName=gsvc&sni=example.com#vless-grpc"},
+		{tag: "vless-httpupgrade", uri: "vless://" + uuid + "@example.com:443?type=httpupgrade&security=tls&path=/hu&host=cdn.example.com&sni=cdn.example.com#vless-httpupgrade"},
+
+		// --- tag-gated ------------------------------------------------------
+		{tag: "vless-reality", feature: "REALITY",
+			uri: "vless://" + uuid + "@example.com:443?type=tcp&security=reality&pbk=" + url.QueryEscape("jNXHt1yRo0vDuchQlIP6Z0ZvjT3KtzVI-T4E7RoLJS0") + "&sid=0123456789abcdef&sni=example.com&fp=chrome&flow=xtls-rprx-vision#vless-reality"},
+		{tag: "vless-utls", feature: "uTLS ClientHello",
+			uri: "vless://" + uuid + "@example.com:443?type=ws&security=tls&path=/u&sni=example.com&fp=firefox#vless-utls"},
+		{tag: "vless-quic", feature: "QUIC v2ray transport",
+			uri: "vless://" + uuid + "@example.com:443?type=quic&security=tls&sni=example.com#vless-quic"},
+		{tag: "vless-xhttp", feature: "XHTTP",
+			uri: "vless://" + uuid + "@example.com:443?type=xhttp&security=tls&path=/xh&host=cdn.example.com&sni=cdn.example.com#vless-xhttp"},
+		{tag: "hy2", feature: "Hysteria2",
+			uri: "hysteria2://secret@example.com:8443/?sni=example.com&alpn=h3#hy2"},
+		{tag: "tuic", feature: "TUIC",
+			uri: "tuic://22222222-2222-2222-2222-222222222222:secret@example.com:443/?sni=example.com&alpn=h3&congestion_control=cubic&udp_relay_mode=native#tuic"},
+		{tag: "wg", feature: "WireGuard nodes", endpoint: true, uri: wgURI},
+		{tag: "awg", feature: "AmneziaWG", endpoint: true, uri: awgURI},
+	}
+}
+
+// featuresWithoutProbe are declared features this file cannot express as a node,
+// with the reason. Anything NOT listed here must be exercised by a protoCase —
+// TestEveryTagGatedFeatureIsProbed enforces that, so a new tag-gated feature
+// cannot be added without either a probe or a conscious exemption.
+var featuresWithoutProbe = map[string]string{
+	"QUIC / HTTP3 DNS transports (quic://, h3://)":                                  "shater's resolver types are udp/tcp/doh/dot/local/fakeip — the model cannot express a quic:// resolver; the tag is already proven by the hysteria2/tuic/quic-transport cases",
+	"badtls fast path (zero-copy TLS read-wait / ktls, used by every TLS outbound)": "a link-time/performance path, not a constructible config object; its absence is caught at link time (-checklinkname=0) and by the buildtags test",
+}
+
+// featureFor resolves a protoCase's feature key to its buildtags row.
+func featureFor(t *testing.T, key string) buildtags.Feature {
+	t.Helper()
+	for _, f := range buildtags.Features {
+		if strings.Contains(f.Name, key) {
+			return f
+		}
+	}
+	t.Fatalf("protoCase names feature %q, which is in no buildtags.Features row — keep the two lists linked", key)
+	return buildtags.Feature{}
+}
+
+// TestShippedTagSetConstructsDeclaredProtocols builds one node per declared
+// protocol and proves box.New+Start accepts every one of them under the tags
+// this binary was compiled with. Protocols whose tags are genuinely absent are
+// SKIPPED loudly (with the missing tags), never silently dropped — and the
+// shipped set is guaranteed to contain those tags by
+// shater/buildtags.TestRouterTagSetCoversDeclaredFeatures, so under
+// scripts/check-router-tags.sh nothing is skipped.
+func TestShippedTagSetConstructsDeclaredProtocols(t *testing.T) {
+	t.Logf("compiled build tags: %v", buildtags.Compiled())
+
+	var (
+		nodes   []model.Node
+		wantOut []string
+		wantEnd []string
+		skipped []string
+	)
+	for _, c := range shippedProtoCases(t) {
+		if c.feature != "" {
+			f := featureFor(t, c.feature)
+			if missing := buildtags.MissingTags(f); len(missing) > 0 {
+				skipped = append(skipped, fmt.Sprintf("%s (missing %s)", c.tag, strings.Join(missing, ",")))
+				continue
+			}
+		}
+		nodes = append(nodes, model.Node{Name: c.tag, Enabled: true, URI: c.uri})
+		if c.endpoint {
+			wantEnd = append(wantEnd, c.tag)
+		} else {
+			wantOut = append(wantOut, c.tag)
+		}
+	}
+	if len(skipped) > 0 {
+		// Under a plain `go test` (no tags) a protocol that is not compiled in
+		// cannot be constructed — skipping is the only honest thing to do, and
+		// shater/buildtags is what guards the tag list itself.
+		//
+		// Under scripts/check-router-tags.sh we were compiled with the SHIPPED
+		// set, which buildtags has already proven covers every declared feature.
+		// So a skip here means the two disagree — a trimmed tag, or a check run
+		// with the wrong -tags. Either way the run must be red, not "PASS (2
+		// protocols skipped)".
+		if os.Getenv("SHATER_ROUTER_TAG_CHECK") == "1" {
+			t.Fatalf("the SHIPPED tag set does not compile in %d declared protocol(s): %s\n"+
+				"Nothing may be skipped in a router-tag-set run — add the missing tags to scripts/router-tags.sh.",
+				len(skipped), strings.Join(skipped, "; "))
+		}
+		t.Logf("NOT compiled in, skipped: %s", strings.Join(skipped, "; "))
+	}
+
+	// No inbound on purpose: this test is about protocol construction, and a
+	// tproxy listener would demand CAP_NET_ADMIN from every runner. The tproxy
+	// path is covered by the rest of the suite.
+	m := &model.Model{Globals: model.DefaultGlobals(), Nodes: nodes}
+
+	opts, warns, changed := applyAndClose(t, m)
+	if !changed {
+		t.Fatalf("expected Apply changed==true (warnings: %v)", warns)
+	}
+	if len(warns) != 0 {
+		t.Fatalf("a declared protocol produced generator warnings — it is not fully supported: %v", warns)
+	}
+
+	for _, tag := range wantOut {
+		if findOutbound(opts, tag) == nil {
+			t.Errorf("outbound %q was not emitted (warnings: %v)", tag, warns)
+		}
+	}
+	for _, tag := range wantEnd {
+		var found *option.Endpoint
+		for i := range opts.Endpoints {
+			if opts.Endpoints[i].Tag == tag {
+				found = &opts.Endpoints[i]
+			}
+		}
+		if found == nil {
+			t.Errorf("endpoint %q was not emitted (warnings: %v)", tag, warns)
+			continue
+		}
+		if found.Type != C.TypeWireGuard {
+			t.Errorf("endpoint %q type = %s, want wireguard", tag, found.Type)
+		}
+	}
+
+	// AmneziaWG is the driving requirement: if it is compiled in, the obfuscation
+	// params must actually be on the endpoint, not parsed-and-dropped.
+	if buildtags.Has("with_awg") {
+		for i := range opts.Endpoints {
+			if opts.Endpoints[i].Tag != "awg" {
+				continue
+			}
+			wg, ok := opts.Endpoints[i].Options.(*option.WireGuardEndpointOptions)
+			if !ok {
+				t.Fatalf("awg endpoint options type = %T", opts.Endpoints[i].Options)
+			}
+			if !wg.AmneziaWGOptions.IsSet() || wg.Jc != 4 {
+				t.Errorf("AmneziaWG params did not reach the endpoint: %+v", wg.AmneziaWGOptions)
+			}
+		}
+	}
+}
+
+// TestEveryTagGatedFeatureIsProbed keeps this file from rotting: a feature added
+// to buildtags.Features must be constructed here, or explicitly exempted with a
+// reason. Otherwise the next trimmed tag is invisible again.
+func TestEveryTagGatedFeatureIsProbed(t *testing.T) {
+	probed := map[string]bool{}
+	for _, c := range shippedProtoCases(t) {
+		if c.feature != "" {
+			probed[featureFor(t, c.feature).Name] = true
+		}
+	}
+	for _, f := range buildtags.Features {
+		if probed[f.Name] {
+			continue
+		}
+		if _, ok := featuresWithoutProbe[f.Name]; ok {
+			continue
+		}
+		t.Errorf("declared feature %q has no protoCase and no featuresWithoutProbe exemption: add one, or the tag it needs can be trimmed unnoticed", f.Name)
+	}
+}
@@ -0,0 +1,252 @@
+package generate
+
+// Where the router's traffic actually ENDS UP, read off the engine config that
+// was generated for it.
+//
+// WHY THIS EXISTS. The panel's headline readout was derived from apply.Status's
+// `plane` field, and `plane` answers a different question than the one the
+// readout asked. `plane` says how much of the DATA PLANE is installed — is the
+// `inet shater` table loaded, is policy routing in place, is the engine up. It
+// says nothing about where the diverted packets go once the engine has them.
+//
+// A router in the field ran with a single enabled rule, `default -> direct`, no
+// groups and no rule-sets. Every piece of the plane was installed, so
+// plane == "full", so the panel said "Protected — traffic from your network is
+// going through the tunnel". There was no tunnel: route.Final was `direct` and
+// the whole LAN went out the plain WAN with its real address, under a green LED.
+// That is the product's worst defect class — a silent lie in the reassuring
+// direction — so the verdict below is computed from the thing that actually
+// decides the answer.
+//
+// THE SOURCE IS THE GENERATED CONFIG, NOT THE DESIRED STATE. TrafficOf reads
+// option.Options: route.Final, the emitted route rules, and the outbound table
+// they name. That is the config the engine was handed, so the verdict already
+// accounts for everything that happens between "what the operator wrote" and
+// "what runs": a schedule outside its window (the rule is simply not emitted), a
+// catch-all shadowed by a later one (only the winner reached Final), a rule whose
+// target did not resolve and fell back to direct/block (ruleKillFallback), a rule
+// with no engine-evaluable matcher (dropped with a warning). Re-deriving any of
+// that from *model.Model would be a second implementation of buildRoute, and the
+// two would drift — which is exactly the failure mode model/reachability.go was
+// written to stop.
+
+import (
+	"net/netip"
+	"strings"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+)
+
+// Traffic verdicts. Four states, because collapsing them is how the readout
+// started lying in the first place.
+const (
+	// VerdictTunnel — route.Final points into a tunnel, so everything that is not
+	// matched by a more specific rule is proxied.
+	VerdictTunnel = "tunnel"
+	// VerdictSplit — the default leaves the router directly, but at least one rule
+	// does send its traffic into a tunnel. Selective protection: legitimate and
+	// common, but NOT "protected".
+	VerdictSplit = "split"
+	// VerdictDirect — the default leaves directly and nothing is tunnelled at all.
+	// The engine is running and carrying traffic straight out. This is the field
+	// case above.
+	VerdictDirect = "direct"
+	// VerdictBlocked — the default is `block`, the kill-switch backstop: unmatched
+	// traffic is DROPPED, not let out. Nothing leaks; whether anything works at all
+	// depends on TunnelRules.
+	VerdictBlocked = "blocked"
+)
+
+// Traffic is the verdict for one generated engine config.
+//
+// The zero value (Verdict == "") means "not known" — no config has been
+// generated/applied by this daemon yet. A consumer must not read it as any of the
+// four verdicts; in particular it is NOT "tunnel".
+type Traffic struct {
+	// Verdict is one of the four constants above, or "" when unknown.
+	Verdict string `json:"verdict"`
+	// Default is the outbound tag route.Final names — the engine's own vocabulary
+	// ("direct", "block", a node/group tag, a chain's entry-hop tag). Published for
+	// `shaterd status` and debugging; the wording in the UI is driven by Verdict,
+	// not by parsing this.
+	Default string `json:"default"`
+	// TunnelRules counts the emitted route rules whose matched traffic goes into a
+	// tunnel. It is what separates "selective protection" from "none", and with
+	// VerdictBlocked it separates "only the listed traffic gets out" from "nothing
+	// gets out at all".
+	TunnelRules int `json:"tunnel_rules"`
+}
+
+// TrafficOf computes the verdict for a generated engine config.
+//
+// A nil Route yields the zero Traffic (unknown) rather than a guess: every config
+// this package produces has one, so a missing Route means the caller handed us
+// something we did not build.
+func TrafficOf(opts option.Options) Traffic {
+	if opts.Route == nil {
+		return Traffic{}
+	}
+	idx := indexOutbounds(opts)
+	final := opts.Route.Final
+	t := Traffic{Default: final}
+	for _, r := range opts.Route.Rules {
+		tag, ok := ruleRouteOutbound(r)
+		if !ok {
+			continue
+		}
+		if idx.tunnels(tag) {
+			t.TunnelRules++
+		}
+	}
+	switch {
+	case idx.tunnels(final):
+		t.Verdict = VerdictTunnel
+	case idx.kind[final] == kindBlock:
+		t.Verdict = VerdictBlocked
+	case t.TunnelRules > 0:
+		t.Verdict = VerdictSplit
+	default:
+		// Includes an unknown/empty Final: an unrecognised default is reported as the
+		// unprotected one. Erring toward the alarm is allowed here; erring toward
+		// reassurance is the bug.
+		t.Verdict = VerdictDirect
+	}
+	return t
+}
+
+// Outbound kinds, from the point of view of "does traffic that leaves through
+// this tag leave the router by some path other than the plain WAN".
+const (
+	kindDirect = iota // direct outbound, incl. every interface/plain egress
+	kindBlock         // block outbound
+	kindGroup         // selector/urltest: a tunnel iff one of its members is
+	kindProxy         // a real remote proxy outbound or endpoint
+)
+
+// outboundIndex maps every outbound/endpoint tag to its kind, plus the member
+// lists of the group outbounds so a group can be resolved to what it dials.
+type outboundIndex struct {
+	kind    map[string]int
+	members map[string][]string
+}
+
+func indexOutbounds(opts option.Options) outboundIndex {
+	idx := outboundIndex{
+		kind:    make(map[string]int, len(opts.Outbounds)+len(opts.Endpoints)),
+		members: make(map[string][]string),
+	}
+	for _, ob := range opts.Outbounds {
+		switch ob.Type {
+		case C.TypeDirect:
+			// Covers the baseline `direct` AND every interface/plain `egress-*`
+			// outbound: an egress picks WHICH uplink the packet leaves by, never
+			// whether it leaves in the clear.
+			idx.kind[ob.Tag] = kindDirect
+		case C.TypeBlock:
+			idx.kind[ob.Tag] = kindBlock
+		case C.TypeSelector:
+			idx.kind[ob.Tag] = kindGroup
+			if o, ok := ob.Options.(*option.SelectorOutboundOptions); ok && o != nil {
+				idx.members[ob.Tag] = o.Outbounds
+			}
+		case C.TypeURLTest:
+			idx.kind[ob.Tag] = kindGroup
+			if o, ok := ob.Options.(*option.URLTestOutboundOptions); ok && o != nil {
+				idx.members[ob.Tag] = o.Outbounds
+			}
+		default:
+			if dialsLoopback(ob.Options) {
+				// A proxy that dials this very router — the `byedpi` egress is a SOCKS5
+				// outbound to 127.0.0.1, where the local ciadpi desync helper listens.
+				// It reshapes the packets, which is worth having, but the connection
+				// still leaves over the plain WAN with this router's own address. Calling
+				// that "going through the tunnel" would be a smaller version of the same
+				// lie this file exists to remove.
+				idx.kind[ob.Tag] = kindDirect
+			} else {
+				idx.kind[ob.Tag] = kindProxy
+			}
+		}
+	}
+	// Endpoints share the outbound tag namespace and are all real tunnels today
+	// (wireguard / AmneziaWG).
+	for _, ep := range opts.Endpoints {
+		idx.kind[ep.Tag] = kindProxy
+	}
+	return idx
+}
+
+// tunnels reports whether traffic sent to tag leaves the router through a tunnel.
+// An unknown tag is NOT a tunnel: the honest answer to "we have never heard of
+// this outbound" is "we cannot claim it protects anything".
+func (idx outboundIndex) tunnels(tag string) bool {
+	return idx.tunnelsSeen(tag, make(map[string]bool, 4))
+}
+
+func (idx outboundIndex) tunnelsSeen(tag string, seen map[string]bool) bool {
+	if seen[tag] {
+		// A group cycle cannot survive box.New, but this function also runs against
+		// hand-built options in tests; refusing to recurse forever is free.
+		return false
+	}
+	seen[tag] = true
+	switch idx.kind[tag] {
+	case kindProxy:
+		return true
+	case kindGroup:
+		// A group is a tunnel when ANY member is one. A group of nodes is the normal
+		// case; a group that also holds `direct` still tunnels some of the time, and
+		// "sometimes tunnelled" must not be reported as "never".
+		for _, m := range idx.members[tag] {
+			if idx.tunnelsSeen(m, seen) {
+				return true
+			}
+		}
+		return false
+	default:
+		return false
+	}
+}
+
+// ruleRouteOutbound returns the outbound tag a route rule sends matched traffic
+// to, and false for every rule that routes nothing — the leading sniff and
+// hijack-dns rules, and the DoH-block reject rules.
+func ruleRouteOutbound(r option.Rule) (string, bool) {
+	var action option.RuleAction
+	switch r.Type {
+	case C.RuleTypeDefault:
+		action = r.DefaultOptions.RuleAction
+	case C.RuleTypeLogical:
+		action = r.LogicalOptions.RuleAction
+	default:
+		return "", false
+	}
+	if action.Action != C.RuleActionTypeRoute {
+		return "", false
+	}
+	tag := action.RouteOptions.Outbound
+	return tag, tag != ""
+}
+
+// dialsLoopback reports whether an outbound's server address is this machine.
+// Only the two protocols a local helper is ever wired as are inspected (SOCKS is
+// what `byedpi` emits; HTTP is here so the answer does not depend on which of the
+// two a future helper picks).
+func dialsLoopback(o any) bool {
+	var server string
+	switch v := o.(type) {
+	case *option.SOCKSOutboundOptions:
+		server = v.Server
+	case *option.HTTPOutboundOptions:
+		server = v.Server
+	default:
+		return false
+	}
+	server = strings.TrimSpace(server)
+	if strings.EqualFold(server, "localhost") {
+		return true
+	}
+	addr, err := netip.ParseAddr(server)
+	return err == nil && addr.IsLoopback()
+}
@@ -0,0 +1,233 @@
+// Where the traffic actually ends up (TrafficOf). These are pure option-struct
+// assertions over a generated config — no box.New — so they build everywhere.
+//
+// The case that matters most is TestTrafficProductionDefaultDirectIsNotProtected:
+// it is the config found on a live router (one enabled rule, `default -> direct`,
+// no groups, no rule-sets) that the panel painted green and called "Protected".
+package generate
+
+import (
+	"testing"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+
+	"github.com/sagernet/sing-box/shater/model"
+)
+
+// trafficOf generates m and returns the verdict, failing on a generate error.
+func trafficOf(t *testing.T, m *model.Model) Traffic {
+	t.Helper()
+	opts, _, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	return TrafficOf(opts)
+}
+
+// ssNode is a parseable shadowsocks node — enough for a real proxy outbound.
+func ssNode(name string) model.Node {
+	return model.Node{Name: name, Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.5:8388#" + name}
+}
+
+// --- the field case ---------------------------------------------------------
+
+// TestTrafficProductionDefaultDirectIsNotProtected is the regression for the
+// defect this file exists for. mini_router v0.2.10-r1 ran with exactly this
+// config: ONE enabled rule named `default`, order 100, target `direct`, zero
+// rule-sets and zero groups. Every part of the data plane was installed, so
+// status reported plane="full", and the panel's headline read
+// "Protected — traffic from your network is going through the tunnel".
+//
+// route.Final was `direct`. Nothing was tunnelled at all.
+func TestTrafficProductionDefaultDirectIsNotProtected(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Rules: []model.Rule{
+			{Name: "default", Enabled: true, Order: 100, Target: "direct"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q — a router whose only rule is `default -> direct` proxies nothing", got.Verdict, VerdictDirect)
+	}
+	if got.Default != tagDirect {
+		t.Errorf("Default = %q, want %q", got.Default, tagDirect)
+	}
+	if got.TunnelRules != 0 {
+		t.Errorf("TunnelRules = %d, want 0", got.TunnelRules)
+	}
+}
+
+// --- the three healthy-ish shapes -------------------------------------------
+
+// A catch-all pointing at a group: everything unmatched is proxied.
+func TestTrafficDefaultToGroupIsTunnel(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes:   []model.Node{ssNode("ss1")},
+		Groups:  []model.Group{{Name: "auto", Nodes: []string{"ss1"}}},
+		Rules: []model.Rule{
+			{Name: "default", Enabled: true, Order: 100, Target: "group:auto"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictTunnel {
+		t.Fatalf("Verdict = %q, want %q; default=%q", got.Verdict, VerdictTunnel, got.Default)
+	}
+}
+
+// A conditional rule into a group with a `direct` default: selective protection.
+// The default still leaves in the clear, and that is what must be said.
+func TestTrafficDirectDefaultWithProxyRuleIsSplit(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes:   []model.Node{ssNode("ss1")},
+		Groups:  []model.Group{{Name: "auto", Nodes: []string{"ss1"}}},
+		Rules: []model.Rule{
+			{Name: "lan-via-proxy", Enabled: true, Order: 10, Src: []string{"192.168.1.0/24"}, Target: "group:auto"},
+			{Name: "default", Enabled: true, Order: 100, Target: "direct"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictSplit {
+		t.Fatalf("Verdict = %q, want %q; default=%q rules=%d", got.Verdict, VerdictSplit, got.Default, got.TunnelRules)
+	}
+	if got.TunnelRules != 1 {
+		t.Errorf("TunnelRules = %d, want 1", got.TunnelRules)
+	}
+}
+
+// No catch-all rule at all with the kill-switch closed: Final is the fail-closed
+// backstop, so unmatched traffic is DROPPED. Nothing leaks — reporting this as
+// "going out directly" would be a lie in the other direction.
+func TestTrafficNoDefaultRuleIsBlocked(t *testing.T) {
+	m := &model.Model{Globals: model.DefaultGlobals()}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictBlocked {
+		t.Fatalf("Verdict = %q, want %q; default=%q", got.Verdict, VerdictBlocked, got.Default)
+	}
+	if got.TunnelRules != 0 {
+		t.Errorf("TunnelRules = %d, want 0", got.TunnelRules)
+	}
+}
+
+// Kill-switch open with no catch-all: Final is `direct`, so everything unmatched
+// leaves in the clear.
+func TestTrafficNoDefaultRuleOpenKillSwitchIsDirect(t *testing.T) {
+	g := model.DefaultGlobals()
+	g.KillSwitch = "open"
+	got := trafficOf(t, &model.Model{Globals: g})
+	if got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q; default=%q", got.Verdict, VerdictDirect, got.Default)
+	}
+}
+
+// --- the shapes only the GENERATED config can reveal ------------------------
+
+// Two condition-less rules: the LAST one owns route.Final (model.RuleReachability).
+// A `default -> group` at order 20 followed by a `default -> direct` at order 100
+// looks protected in the rule list and proxies nothing. Reading the model instead
+// of the generated config is how a verdict gets this wrong.
+func TestTrafficShadowedCatchAllFollowsTheWinner(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes:   []model.Node{ssNode("ss1")},
+		Groups:  []model.Group{{Name: "auto", Nodes: []string{"ss1"}}},
+		Rules: []model.Rule{
+			{Name: "default-proxy", Enabled: true, Order: 20, Target: "group:auto"},
+			{Name: "default", Enabled: true, Order: 100, Target: "direct"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q — the later condition-less rule owns Final", got.Verdict, VerdictDirect)
+	}
+}
+
+// An interface egress is a choice of UPLINK, never a tunnel: `default -> egress:wan2`
+// sends everything out a second WAN, in the clear.
+func TestTrafficEgressDefaultIsNotATunnel(t *testing.T) {
+	m := &model.Model{
+		Globals:  model.DefaultGlobals(),
+		Egresses: []model.Egress{{Name: "wan2", Type: "interface", Interface: "eth1"}},
+		Rules: []model.Rule{
+			{Name: "default", Enabled: true, Order: 100, Target: "egress:wan2"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q; default=%q", got.Verdict, VerdictDirect, got.Default)
+	}
+}
+
+// A byedpi egress is a SOCKS5 outbound to 127.0.0.1 — the local desync helper.
+// It reshapes the packets but the connection still leaves over the plain WAN with
+// this router's address, so it must not be reported as a tunnel.
+func TestTrafficByedpiEgressIsNotATunnel(t *testing.T) {
+	m := &model.Model{
+		Globals:  model.DefaultGlobals(),
+		Egresses: []model.Egress{{Name: "bd", Type: "byedpi", Port: 1080}},
+		Rules: []model.Rule{
+			{Name: "default", Enabled: true, Order: 100, Target: "egress:bd"},
+		},
+	}
+	got := trafficOf(t, m)
+	if got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q; default=%q", got.Verdict, VerdictDirect, got.Default)
+	}
+}
+
+// --- unit-level: the outbound index ------------------------------------------
+
+func TestTrafficOfNilRouteIsUnknown(t *testing.T) {
+	if got := (TrafficOf(option.Options{})); got.Verdict != "" {
+		t.Fatalf("Verdict = %q, want \"\" (unknown) for options we did not build", got.Verdict)
+	}
+}
+
+// A group is a tunnel when any member is, and only then. A selector holding
+// nothing but `direct` routes nothing anywhere special.
+func TestTrafficGroupMembershipDecidesTunnel(t *testing.T) {
+	base := []option.Outbound{
+		{Type: C.TypeDirect, Tag: tagDirect, Options: &option.DirectOutboundOptions{}},
+		{Type: C.TypeBlock, Tag: tagBlock, Options: &option.StubOptions{}},
+		{Type: C.TypeShadowsocks, Tag: "ss1", Options: &option.ShadowsocksOutboundOptions{}},
+	}
+	cases := []struct {
+		name    string
+		members []string
+		want    string
+	}{
+		{"proxy member", []string{"ss1", tagDirect}, VerdictTunnel},
+		{"direct only", []string{tagDirect}, VerdictDirect},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := option.Options{
+				Outbounds: append(append([]option.Outbound{}, base...), option.Outbound{
+					Type: C.TypeSelector, Tag: "grp",
+					Options: &option.SelectorOutboundOptions{Outbounds: tc.members},
+				}),
+				Route: &option.RouteOptions{Final: "grp"},
+			}
+			if got := TrafficOf(opts); got.Verdict != tc.want {
+				t.Fatalf("Verdict = %q, want %q", got.Verdict, tc.want)
+			}
+		})
+	}
+}
+
+// A group that references itself must not hang the status poll.
+func TestTrafficGroupCycleTerminates(t *testing.T) {
+	opts := option.Options{
+		Outbounds: []option.Outbound{
+			{Type: C.TypeSelector, Tag: "a", Options: &option.SelectorOutboundOptions{Outbounds: []string{"b"}}},
+			{Type: C.TypeSelector, Tag: "b", Options: &option.SelectorOutboundOptions{Outbounds: []string{"a"}}},
+		},
+		Route: &option.RouteOptions{Final: "a"},
+	}
+	if got := TrafficOf(opts); got.Verdict != VerdictDirect {
+		t.Fatalf("Verdict = %q, want %q for a cyclic group with no real member", got.Verdict, VerdictDirect)
+	}
+}
@@ -0,0 +1,596 @@
+package generate
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+
+	"github.com/sagernet/sing-box/shater/netplane"
+	"github.com/sagernet/sing-box/shater/parse"
+)
+
+// WireGuard endpoint de-duplication — one private key, one device.
+//
+// # The defect this exists to prevent
+//
+// Everywhere else in this package a node may be COPIED freely: a per-chain hop
+// copy (chain.go buildHopWrapper/rebuildNode) and a per-group egress copy
+// (group.go) are rebuilt fresh from the share-link so each can carry its own
+// Detour without aliasing the shared base outbound. For a vless/ss/trojan node
+// that is exactly right — a copy is just another TCP client, and two of them cost
+// two connections.
+//
+// For a WireGuard/AmneziaWG node it is NOT. Each emitted endpoint is a real
+// device holding the node's private key, and a WireGuard PEER keeps exactly ONE
+// session per public key: the peer's endpoint address is rewritten by whichever
+// device most recently authenticated. Two devices built from the same key
+// therefore evict each other continuously — with persistent keepalive on both,
+// the eviction loop never settles, and NEITHER of them passes traffic. Observed
+// on the box as two UDP sockets from shaterd to the same peer port, the server's
+// peer endpoint flapping between them, zero bytes through the tunnel and every
+// hop of the chain failing with "context deadline exceeded".
+//
+// The multiplier is that buildOutboundsAndEndpoints (outbound.go) emits the BASE
+// endpoint for every enabled node unconditionally — whether or not anything
+// references it. So a WG node used only as a chain hop always produced two
+// devices: the unused base one and the chain copy. That is not an exotic
+// configuration, it is what any chain containing a WG node looks like, which made
+// EVERY such chain permanently dead.
+//
+// # Why this is one pass over the assembled option.Options
+//
+// There are three independent code paths that can materialise a WG device (the
+// base node, a chain hop copy, a chain GROUP hop's per-member copy) and nothing
+// stops a fourth from being added. Deduplicating at each producer would have to
+// be remembered at each producer. Doing it once, on the finished option.Options,
+// catches all of them by construction and needs no cooperation from the callers:
+// whatever put a second device in the config, it is gone before the config
+// reaches box.New.
+//
+// # What is left alone
+//
+// Non-wireguard outbounds are untouched (their copies are legitimate), groups
+// keep their semantics, and a node that appears exactly once — the overwhelmingly
+// common case, including "used only inside a chain" — produces no warning at all.
+
+// wgDeviceKey returns the PHYSICAL DEVICE identity of an endpoint: two endpoints
+// with equal keys would be two devices fighting over one session at the peer.
+//
+// The identity is deliberately narrow — the private key plus the peer set (public
+// key + address:port), peers sorted so ordering cannot split a pair — because
+// collapsing too much is a routing change and collapsing too little leaves the
+// bug in place. Two nodes with DIFFERENT private keys are different devices at
+// the peer and must never be merged, however similar the rest of their config is;
+// two copies of the SAME key are the same device however different their MTU,
+// AllowedIPs or Detour happen to be.
+//
+// ok=false for anything that is not a wireguard endpoint, and for one with no
+// private key at all (it cannot be identified, and it would not come up anyway).
+func wgDeviceKey(ep option.Endpoint) (string, bool) {
+	if ep.Type != C.TypeWireGuard {
+		return "", false
+	}
+	wg, ok := ep.Options.(*option.WireGuardEndpointOptions)
+	if !ok {
+		return "", false
+	}
+	priv := strings.TrimSpace(wg.PrivateKey)
+	if priv == "" {
+		return "", false
+	}
+	peers := make([]string, 0, len(wg.Peers))
+	for _, p := range wg.Peers {
+		peers = append(peers, fmt.Sprintf("%s@%s:%d",
+			strings.TrimSpace(p.PublicKey), strings.TrimSpace(p.Address), p.Port))
+	}
+	sort.Strings(peers)
+	return priv + "|" + strings.Join(peers, ","), true
+}
+
+// wgPrivateKeyOf recovers the private-key half of a wgDeviceKey.
+func wgPrivateKeyOf(deviceKey string) string {
+	priv, _, _ := strings.Cut(deviceKey, "|")
+	return priv
+}
+
+// dedupWireGuardEndpoints enforces "one private key = at most one live device" on
+// the fully assembled config. Called from GenerateWithWarningsAt once opts is
+// complete (chain outbounds/endpoints folded in, route built), because only then
+// is every producer's output visible and the reachability walk meaningful.
+//
+// Per group of endpoints sharing a device identity:
+//
+//   - endpoints nothing can route to are DELETED, silently. This is the normal
+//     case (the always-emitted base endpoint of a node used only in a chain) and
+//     warning about it would train the operator to ignore the warning list.
+//   - if more than one REACHABLE copy remains, the config asks for something a
+//     single key cannot express — e.g. the same WG node entered over two different
+//     WANs in two chains, which is two devices by definition. The first copy in
+//     tag order is kept (deterministic across runs), the rest are deleted and every
+//     reference to them is rewritten to `block`, and each is reported as critical.
+//   - exactly one left: nothing to say.
+//
+// Deleting rather than merely re-pointing is essential: box.New starts EVERY
+// endpoint in the config regardless of whether anything routes to it, so a
+// duplicate left in the list would still bring its device up and still fight for
+// the session. Re-pointing alone would have fixed nothing.
+func (b *builder) dedupWireGuardEndpoints(opts *option.Options) {
+	if opts == nil || len(opts.Endpoints) < 2 {
+		return
+	}
+
+	tagsByKey := map[string][]string{}
+	var keyOrder []string
+	for i := range opts.Endpoints {
+		key, ok := wgDeviceKey(opts.Endpoints[i])
+		if !ok {
+			continue
+		}
+		if _, seen := tagsByKey[key]; !seen {
+			keyOrder = append(keyOrder, key)
+		}
+		tagsByKey[key] = append(tagsByKey[key], opts.Endpoints[i].Tag)
+	}
+	var dupKeys []string
+	for _, key := range keyOrder {
+		if len(tagsByKey[key]) > 1 {
+			dupKeys = append(dupKeys, key)
+		}
+	}
+	if len(dupKeys) == 0 {
+		return // the common case: no key is materialised twice, nothing to do
+	}
+
+	reachable := reachableOptionTags(opts, b.subscriptionDetourSeeds()...)
+	var names map[string]string // private key -> node name, built only if we must name one
+	drop := map[string]bool{}
+	for _, key := range dupKeys {
+		tags := append([]string(nil), tagsByKey[key]...)
+		sort.Strings(tags) // deterministic survivor, independent of emission order
+		var live []string
+		for _, tag := range tags {
+			if reachable[tag] {
+				live = append(live, tag)
+				continue
+			}
+			drop[tag] = true // dead weight: a device nothing routes to
+		}
+		if len(live) < 2 {
+			continue
+		}
+		if names == nil {
+			names = b.wgNodeNamesByKey()
+		}
+		name := names[wgPrivateKeyOf(key)]
+		if name == "" {
+			name = live[0] // unknown to the model (defensive): name it by its tag
+		}
+		keep := live[0]
+		for _, tag := range live[1:] {
+			drop[tag] = true
+			b.warnf("node %q: this WireGuard node is materialised twice in the engine config — as %q and as %q — and traffic can reach both. A WireGuard peer keeps ONE session per public key, so two devices built from one private key evict each other continuously and NEITHER tunnel passes traffic. Only %q is kept; everything that routed through %q is fail-closed (blocked) instead of leaving over the plain WAN. Give the second path its own WireGuard node (its own key), or route both paths through the same one",
+				name, keep, tag, keep, tag)
+		}
+	}
+	if len(drop) == 0 {
+		return
+	}
+
+	// Rewrite first, delete second: the rewrite must still see the tags it is
+	// replacing. Every dangling reference is pointed at `block`, never at `direct`
+	// — a consumer whose tunnel just disappeared must stop, not fall out onto the
+	// plain WAN with the router's real address.
+	retargetDroppedTags(opts, drop, tagBlock)
+	removeDroppedEndpoints(opts, drop)
+}
+
+// wgNodeNamesByKey maps a WireGuard private key back to the model node name that
+// carries it, so a warning can name the NODE the operator configured rather than
+// the generated tag of a copy ("chain-ewan-wg-subs-h2" means nothing on the Nodes
+// page). Built by re-parsing the share-links, which keeps this file self-contained:
+// no producer has to remember to register its copies here.
+//
+// Built lazily (only when a critical duplicate is actually reported) because a
+// subscription can hold hundreds of nodes and this parses all of them.
+// First-wins on a key shared by two nodes: they are the same device anyway, so
+// either name identifies it for the operator.
+func (b *builder) wgNodeNamesByKey() map[string]string {
+	names := map[string]string{}
+	for i := range b.m.Nodes {
+		n := b.m.Nodes[i]
+		if !n.Enabled {
+			continue
+		}
+		p, err := parse.ParseShareLink(n.URI)
+		if err != nil || p.WG == nil {
+			continue
+		}
+		key := strings.TrimSpace(p.WG.PrivateKey)
+		if key == "" {
+			continue
+		}
+		if _, seen := names[key]; !seen {
+			names[key] = n.Name
+		}
+	}
+	return names
+}
+
+// --- reachability over option structures ------------------------------------
+
+// optionNode is one outbound/endpoint reduced to what the reachability walk needs.
+type optionNode struct {
+	group   bool     // selector/urltest: routes through its members
+	members []string // group members (+ its default, if any)
+	detour  string   // ordinary outbound/endpoint: its DialerOptions.Detour
+}
+
+// reachableOptionTags is the option-layer twin of route.walkReachable
+// (route/reachability_lx.go): the set of outbound/endpoint tags traffic can
+// currently reach. That one walks live adapters inside a running box, which does
+// not exist yet at generate time, so the same question is answered over the
+// option structures.
+//
+// One deliberate difference: a group contributes ALL of its members, not just the
+// one it would select right now. The runtime walk can ask a selector what it has
+// chosen; here nothing has been chosen yet, and treating the unselected members as
+// unreachable would delete an endpoint the group is free to switch to a second
+// later. Over-approximating is the safe direction — the worst it costs is a
+// duplicate reported as critical instead of being removed silently.
+// extraSeeds are references that exist OUTSIDE option.Options — today the
+// subscription fetch detours (see subscriptionDetourSeeds). They are entry points
+// exactly like a route rule, so they are walked identically.
+func reachableOptionTags(opts *option.Options, extraSeeds ...string) map[string]bool {
+	graph := optionGraph(opts)
+	reachable := map[string]bool{}
+	for _, seed := range optionSeedTags(opts) {
+		walkOptionReachable(seed, graph, reachable)
+	}
+	for _, seed := range extraSeeds {
+		walkOptionReachable(seed, graph, reachable)
+	}
+	return reachable
+}
+
+// subscriptionDetourSeeds returns the outbound tags the SUBSCRIPTION fetcher dials
+// through — references that are just as real as a route rule's, but that live in
+// the model rather than in option.Options and so are invisible to the walk above.
+//
+// A subscription with fetch_via=proxy is pulled through the engine outbound named
+// by its fetch_detour: apply.UpdateSubscription (shater/apply/apply.go) hands that
+// string to engine.HTTPClient, which resolves it with engine.ViaToTag and looks the
+// tag up in the RUNNING box. So `fetch_detour=node:awg` is a direct, load-bearing
+// use of that node's BASE endpoint. Without this seed the base endpoint looked
+// unreferenced, was deleted as a duplicate of the node's chain copy, and updating
+// the subscription failed with "unknown outbound tag" — a working setup broken by
+// a pass that is supposed to fix one.
+//
+// Enabled is deliberately NOT consulted: UpdateSubscription looks a subscription up
+// by name and never checks it, so the panel can fetch a disabled one and the detour
+// must resolve when it does.
+//
+// Non-node forms come along for free rather than being filtered out: one mapping
+// (viaOutboundTag) covers them all, and seeding `egress-<x>` or a group tag costs
+// nothing — a tag that does not exist is ignored by the walk. Filtering would be
+// extra code that could only make the result less correct (a WG node that is a
+// member of a group used ONLY as a fetch detour would lose its endpoint).
+func (b *builder) subscriptionDetourSeeds() []string {
+	var seeds []string
+	for i := range b.m.Subscriptions {
+		sub := b.m.Subscriptions[i]
+		if !strings.EqualFold(strings.TrimSpace(sub.FetchVia), "proxy") {
+			continue // a direct fetch dials no outbound at all
+		}
+		seeds = append(seeds, viaOutboundTag(sub.FetchDetour))
+	}
+	return seeds
+}
+
+// viaOutboundTag mirrors engine.ViaToTag (shater/engine/httpclient.go) EXACTLY:
+// the shater `via` selector -> the box-internal outbound tag it names.
+//
+//	""/"direct"  -> "direct"
+//	"group:<X>"  -> "<X>"
+//	"node:<X>"   -> "<X>"
+//	"egress:<X>" -> "egress-<X>"
+//	"chain:<X>"  -> "<X>"
+//	"<X>"        -> "<X>"
+//
+// Duplicated rather than imported, following the same rule the engine side already
+// applies to the generator's tag formats (see engine/grouphealth_test.go copyTag):
+// shater/generate is the layer BELOW the runtime and must not pull the whole engine
+// in for one string function. TestViaOutboundTagMatchesEngine is the tripwire that
+// fails the moment the two drift apart.
+//
+// Note this is NOT b.resolveTarget: that one validates a target against the emitted
+// tag sets and MATERIALISES a chain as a side effect. This is a pure spelling of
+// what the runtime will look up, which is the only question the walk is asking.
+func viaOutboundTag(via string) string {
+	via = strings.TrimSpace(via)
+	if via == "" || strings.EqualFold(via, tagDirect) {
+		return tagDirect
+	}
+	for _, prefix := range []string{"group:", "node:", "chain:"} {
+		if rest, ok := cutPrefixFold(via, prefix); ok {
+			return strings.TrimSpace(rest)
+		}
+	}
+	if rest, ok := cutPrefixFold(via, "egress:"); ok {
+		return netplane.EgressOutboundTag(strings.TrimSpace(rest))
+	}
+	return via
+}
+
+// cutPrefixFold is strings.CutPrefix with a case-insensitive prefix match.
+func cutPrefixFold(s, prefix string) (string, bool) {
+	if len(s) >= len(prefix) && strings.EqualFold(s[:len(prefix)], prefix) {
+		return s[len(prefix):], true
+	}
+	return "", false
+}
+
+// optionGraph indexes every outbound/endpoint tag to its outgoing references.
+func optionGraph(opts *option.Options) map[string]optionNode {
+	graph := make(map[string]optionNode, len(opts.Outbounds)+len(opts.Endpoints))
+	for i := range opts.Outbounds {
+		ob := opts.Outbounds[i]
+		if members, def, ok := groupMembersOf(ob.Options); ok {
+			all := append([]string(nil), members...)
+			if def != "" {
+				all = append(all, def)
+			}
+			graph[ob.Tag] = optionNode{group: true, members: all}
+			continue
+		}
+		graph[ob.Tag] = optionNode{detour: dialerDetour(ob.Options)}
+	}
+	for i := range opts.Endpoints {
+		graph[opts.Endpoints[i].Tag] = optionNode{detour: dialerDetour(opts.Endpoints[i].Options)}
+	}
+	return graph
+}
+
+// optionSeedTags collects every tag traffic can ENTER the outbound graph at: the
+// route's Final (the kill-switch backstop), each route rule's routed/bypassed
+// outbound, each DNS server's detour, and the download detours of the remote
+// rule-sets / geo sources / clash external UI (those dial through an outbound too,
+// so a tag one of them names is in use even if no user traffic reaches it).
+func optionSeedTags(opts *option.Options) []string {
+	var seeds []string
+	if rt := opts.Route; rt != nil {
+		seeds = append(seeds, rt.Final)
+		for i := range rt.Rules {
+			seeds = append(seeds, ruleActionOutbound(rt.Rules[i]))
+		}
+		for i := range rt.RuleSet {
+			if rt.RuleSet[i].Type == C.RuleSetTypeRemote {
+				seeds = append(seeds, rt.RuleSet[i].RemoteOptions.DownloadDetour)
+			}
+		}
+		if rt.GeoIP != nil {
+			seeds = append(seeds, rt.GeoIP.DownloadDetour)
+		}
+		if rt.Geosite != nil {
+			seeds = append(seeds, rt.Geosite.DownloadDetour)
+		}
+	}
+	if opts.DNS != nil {
+		for i := range opts.DNS.Servers {
+			seeds = append(seeds, dialerDetour(opts.DNS.Servers[i].Options))
+		}
+	}
+	if opts.Experimental != nil && opts.Experimental.ClashAPI != nil {
+		seeds = append(seeds, opts.Experimental.ClashAPI.ExternalUIDownloadDetour)
+	}
+	return seeds
+}
+
+// walkOptionReachable marks tag reachable and descends into everything it routes
+// through, transitively. The visited set doubles as the cycle guard.
+func walkOptionReachable(tag string, graph map[string]optionNode, reachable map[string]bool) {
+	if tag == "" || reachable[tag] {
+		return
+	}
+	reachable[tag] = true
+	node, ok := graph[tag]
+	if !ok {
+		return // dangling reference; box.New reports it, this pass does not care
+	}
+	if node.group {
+		for _, member := range node.members {
+			walkOptionReachable(member, graph, reachable)
+		}
+		return
+	}
+	walkOptionReachable(node.detour, graph, reachable)
+}
+
+// ruleActionOutbound returns the outbound tag a route rule's action sends traffic
+// to, or "" for the actions that route nowhere (reject/sniff/dns/hijack-dns/…).
+// An empty Action is the route action (see option.RuleAction.UnmarshalJSON), so it
+// is read the same way.
+func ruleActionOutbound(rule option.Rule) string {
+	action := rule.DefaultOptions.RuleAction
+	if rule.Type == C.RuleTypeLogical {
+		action = rule.LogicalOptions.RuleAction
+	}
+	switch action.Action {
+	case C.RuleActionTypeRoute, "":
+		return action.RouteOptions.Outbound
+	case C.RuleActionTypeBypass:
+		return action.BypassOptions.Outbound
+	}
+	return ""
+}
+
+// --- rewriting + removal ----------------------------------------------------
+
+// dialerDetour reads DialerOptions.Detour off any typed options that carry a
+// dialer (every *OutboundOptions, WireGuardEndpointOptions and DNS server
+// transport embeds option.DialerOptions). "" for options that carry none.
+func dialerDetour(o any) string {
+	w, ok := o.(option.DialerOptionsWrapper)
+	if !ok {
+		return ""
+	}
+	return w.TakeDialerOptions().Detour
+}
+
+// groupMembersOf reports a group outbound's member list and its default member.
+// ok=false for anything that is not a selector/urltest.
+func groupMembersOf(o any) (members []string, def string, ok bool) {
+	switch g := o.(type) {
+	case *option.SelectorOutboundOptions:
+		return g.Outbounds, g.Default, true
+	case *option.URLTestOutboundOptions:
+		return g.Outbounds, "", true
+	}
+	return nil, "", false
+}
+
+// retargetDroppedTags repoints every reference to a dropped endpoint tag, so the
+// config stays internally consistent once the endpoint is gone. A dangling tag is
+// not merely untidy: box.New resolves group members and route targets eagerly and
+// refuses the whole config over one of them, which with the kill-switch closed is
+// the entire LAN offline.
+//
+// Detours, route targets and the route Final go to `to` (block) — the fail-closed
+// direction. Group MEMBER lists instead drop the tag and only fall back to a lone
+// block member when that empties the group: a group that still has other tunnels
+// to balance over should use them, and a block sitting in a urltest pool would
+// otherwise be probed and reported dead forever on the group health card.
+func retargetDroppedTags(opts *option.Options, drop map[string]bool, to string) {
+	for i := range opts.Outbounds {
+		if !retargetGroupMembers(opts.Outbounds[i].Options, drop, to) {
+			retargetDetour(opts.Outbounds[i].Options, drop, to)
+		}
+	}
+	for i := range opts.Endpoints {
+		retargetDetour(opts.Endpoints[i].Options, drop, to)
+	}
+	if opts.DNS != nil {
+		for i := range opts.DNS.Servers {
+			retargetDetour(opts.DNS.Servers[i].Options, drop, to)
+		}
+	}
+	if rt := opts.Route; rt != nil {
+		if drop[rt.Final] {
+			rt.Final = to
+		}
+		for i := range rt.Rules {
+			retargetRuleAction(&rt.Rules[i], drop, to)
+		}
+		for i := range rt.RuleSet {
+			if rt.RuleSet[i].Type == C.RuleSetTypeRemote && drop[rt.RuleSet[i].RemoteOptions.DownloadDetour] {
+				rt.RuleSet[i].RemoteOptions.DownloadDetour = to
+			}
+		}
+		if rt.GeoIP != nil && drop[rt.GeoIP.DownloadDetour] {
+			rt.GeoIP.DownloadDetour = to
+		}
+		if rt.Geosite != nil && drop[rt.Geosite.DownloadDetour] {
+			rt.Geosite.DownloadDetour = to
+		}
+	}
+	if opts.Experimental != nil && opts.Experimental.ClashAPI != nil &&
+		drop[opts.Experimental.ClashAPI.ExternalUIDownloadDetour] {
+		opts.Experimental.ClashAPI.ExternalUIDownloadDetour = to
+	}
+}
+
+// retargetRuleAction points a route rule whose target was dropped at `to`. It is
+// the write half of ruleActionOutbound and must stay in step with it: a rule the
+// seed walk counted as a reference is a rule this has to be able to repoint.
+func retargetRuleAction(rule *option.Rule, drop map[string]bool, to string) {
+	action := &rule.DefaultOptions.RuleAction
+	if rule.Type == C.RuleTypeLogical {
+		action = &rule.LogicalOptions.RuleAction
+	}
+	switch action.Action {
+	case C.RuleActionTypeRoute, "":
+		if drop[action.RouteOptions.Outbound] {
+			action.RouteOptions.Outbound = to
+		}
+	case C.RuleActionTypeBypass:
+		if drop[action.BypassOptions.Outbound] {
+			action.BypassOptions.Outbound = to
+		}
+	}
+}
+
+// retargetDetour points a dropped Detour at `to`, leaving any other value alone.
+func retargetDetour(o any, drop map[string]bool, to string) {
+	w, ok := o.(option.DialerOptionsWrapper)
+	if !ok {
+		return
+	}
+	d := w.TakeDialerOptions()
+	if !drop[d.Detour] {
+		return
+	}
+	d.Detour = to
+	w.ReplaceDialerOptions(d)
+}
+
+// retargetGroupMembers prunes dropped members from a group, reporting whether the
+// options were a group at all (so the caller knows not to look for a detour).
+// A selector whose Default was dropped falls back to an empty Default, which the
+// engine reads as "the first member" — always a member that still exists.
+func retargetGroupMembers(o any, drop map[string]bool, to string) bool {
+	switch g := o.(type) {
+	case *option.SelectorOutboundOptions:
+		g.Outbounds = pruneMembers(g.Outbounds, drop, to)
+		if drop[g.Default] {
+			g.Default = ""
+		}
+		return true
+	case *option.URLTestOutboundOptions:
+		g.Outbounds = pruneMembers(g.Outbounds, drop, to)
+		return true
+	}
+	return false
+}
+
+// pruneMembers removes dropped tags from a member list, substituting a single
+// fallback member when that would leave the group empty (an empty selector/urltest
+// is refused by box.New, and the fallback is `block` so the emptied group is
+// fail-closed rather than a hole).
+func pruneMembers(in []string, drop map[string]bool, fallback string) []string {
+	hit := false
+	for _, tag := range in {
+		if drop[tag] {
+			hit = true
+			break
+		}
+	}
+	if !hit {
+		return in
+	}
+	out := make([]string, 0, len(in))
+	for _, tag := range in {
+		if drop[tag] {
+			continue
+		}
+		out = append(out, tag)
+	}
+	if len(out) == 0 {
+		return []string{fallback}
+	}
+	return out
+}
+
+// removeDroppedEndpoints filters the dropped endpoints out of the config. This is
+// the step that actually stops the duplicate device from being created.
+func removeDroppedEndpoints(opts *option.Options, drop map[string]bool) {
+	kept := opts.Endpoints[:0]
+	for _, ep := range opts.Endpoints {
+		if drop[ep.Tag] {
+			continue
+		}
+		kept = append(kept, ep)
+	}
+	opts.Endpoints = kept
+}
@@ -0,0 +1,416 @@
+package generate
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+	"testing"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/option"
+
+	"github.com/sagernet/sing-box/shater/engine"
+	"github.com/sagernet/sing-box/shater/model"
+)
+
+// These tests pin the one invariant a WireGuard node cannot survive without: the
+// generated config must never contain two devices built from one private key. See
+// wgdedup.go for why (a peer keeps a single session per key, so two devices evict
+// each other and neither passes traffic).
+//
+// They are deliberately NOT Linux-gated: nothing here goes through box.New, so the
+// `routing_mark` platform restriction that gates generate_test.go does not apply.
+
+// wgDedupKey returns a valid 32-byte base64 WireGuard key seeded by fill. It is a
+// separate helper from generate_test.go's validKey on purpose: that file is
+// //go:build linux, and this suite must run on every dev platform.
+func wgDedupKey(fill byte) string {
+	b := make([]byte, 32)
+	for i := range b {
+		b[i] = fill + byte(i)
+	}
+	return base64.StdEncoding.EncodeToString(b)
+}
+
+// wgDedupURI builds a wireguard:// share-link for a node.
+func wgDedupURI(priv, pub, server string, port int) string {
+	return fmt.Sprintf("wireguard://%s@%s:%d?publickey=%s&address=10.13.13.2/32&allowedips=0.0.0.0/0",
+		url.QueryEscape(priv), server, port, url.QueryEscape(pub))
+}
+
+// endpointTags lists the emitted endpoint tags, sorted for stable comparison.
+func endpointTags(opts option.Options) []string {
+	out := make([]string, 0, len(opts.Endpoints))
+	for i := range opts.Endpoints {
+		out = append(out, opts.Endpoints[i].Tag)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// routeRuleOutbounds lists the outbound tag of every route rule that routes.
+func routeRuleOutbounds(rt *option.RouteOptions) []string {
+	if rt == nil {
+		return nil
+	}
+	var out []string
+	for i := range rt.Rules {
+		if tag := ruleActionOutbound(rt.Rules[i]); tag != "" {
+			out = append(out, tag)
+		}
+	}
+	return out
+}
+
+func warningsContaining(warns []string, needle string) []string {
+	var out []string
+	for _, w := range warns {
+		if strings.Contains(w, needle) {
+			out = append(out, w)
+		}
+	}
+	return out
+}
+
+// (а) A WG node used ONLY as a chain hop must leave exactly ONE wireguard
+// endpoint behind, and it must be the chain copy: the base endpoint that
+// buildOutboundsAndEndpoints emits for every enabled node is the second device
+// that killed the tunnel, and nothing routes to it. Silent — this is the normal
+// shape of any chain containing a WG node, not an operator error.
+//
+// (в) rides along here: the non-WG hop (ss1) keeps BOTH its base outbound and its
+// chain copy, because two TCP clients are not a conflict.
+func TestWGDedupChainOnlyNodeDropsBaseEndpoint(t *testing.T) {
+	priv, pub := wgDedupKey(1), wgDedupKey(9)
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wg1", Enabled: true, URI: wgDedupURI(priv, pub, "203.0.113.10", 51820)},
+			{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.2:8388#ss1"},
+		},
+		Chains: []model.Chain{
+			{Name: "c", Hops: []string{"node:wg1", "node:ss1"}},
+		},
+		Rules: []model.Rule{
+			{Name: "via-chain", Enabled: true, Order: 10, DstPort: "443", Target: "chain:c"},
+		},
+	}
+
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "chain-c-h1" {
+		t.Fatalf("endpoints = %v, want exactly [chain-c-h1] (base wg1 removed)", got)
+	}
+	if opts.Endpoints[0].Type != C.TypeWireGuard {
+		t.Fatalf("surviving endpoint type = %q, want %q", opts.Endpoints[0].Type, C.TypeWireGuard)
+	}
+	// The surviving copy must still be the chain's L1: dialled directly from the
+	// router (no detour), with h2 detouring into it.
+	if d := anyDetour(t, opts, "chain-c-h1"); d != "" {
+		t.Fatalf("chain-c-h1 detour = %q, want \"\" (L1 dials directly)", d)
+	}
+	if d := anyDetour(t, opts, "chain-c-h2"); d != "chain-c-h1" {
+		t.Fatalf("chain-c-h2 detour = %q, want chain-c-h1", d)
+	}
+	// (в) the non-WG node keeps its base outbound AND its chain copy.
+	if obByTag(opts, "ss1") == nil {
+		t.Fatalf("base outbound of the non-wireguard node was removed; outbounds=%v", outboundTags(opts))
+	}
+	if obByTag(opts, "chain-c-h2") == nil {
+		t.Fatalf("chain copy of the non-wireguard node missing; outbounds=%v", outboundTags(opts))
+	}
+	// Silent: nothing was misconfigured.
+	if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+		t.Fatalf("the ordinary chain case must not warn, got %v", got)
+	}
+}
+
+// (б) The same WG node entered over two DIFFERENT egresses in two chains asks for
+// two devices from one key, which the peer cannot give. One copy survives (first
+// in tag order, deterministic); the loser is deleted and its consumer is pointed
+// at `block` — never at direct, which would put that traffic on the plain WAN with
+// the router's real address. The operator is told, critically.
+func TestWGDedupTwoChainsDifferentEgressFailClosed(t *testing.T) {
+	priv, pub := wgDedupKey(2), wgDedupKey(7)
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wg1", Enabled: true, URI: wgDedupURI(priv, pub, "203.0.113.10", 51820)},
+		},
+		Egresses: []model.Egress{
+			{Name: "w1", Type: "interface", Interface: "eth0"},
+			{Name: "w2", Type: "interface", Interface: "eth1"},
+		},
+		Chains: []model.Chain{
+			{Name: "a", Hops: []string{"egress:w1", "node:wg1"}},
+			{Name: "b", Hops: []string{"egress:w2", "node:wg1"}},
+		},
+		Rules: []model.Rule{
+			{Name: "over-w1", Enabled: true, Order: 10, DstPort: "443", Target: "chain:a"},
+			{Name: "over-w2", Enabled: true, Order: 20, DstPort: "8443", Target: "chain:b"},
+		},
+	}
+
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "chain-a-h1" {
+		t.Fatalf("endpoints = %v, want exactly [chain-a-h1] (one device per key)", got)
+	}
+	// The survivor keeps its own entry egress; the loser's rule is fail-closed.
+	if d := anyDetour(t, opts, "chain-a-h1"); d != "egress-w1" {
+		t.Fatalf("chain-a-h1 detour = %q, want egress-w1", d)
+	}
+	targets := routeRuleOutbounds(opts.Route)
+	var sawKept, sawBlocked bool
+	for _, tag := range targets {
+		switch tag {
+		case "chain-a-h1":
+			sawKept = true
+		case tagBlock:
+			sawBlocked = true
+		case "chain-b-h1":
+			t.Fatalf("a rule still routes to the deleted copy chain-b-h1: %v", targets)
+		}
+	}
+	if !sawKept || !sawBlocked {
+		t.Fatalf("route targets = %v, want the survivor kept and the loser fail-closed to %q", targets, tagBlock)
+	}
+	// Critical, and it must name the node plus BOTH copies so the operator can act.
+	found := warningsContaining(warns, "materialised twice")
+	if len(found) != 1 {
+		t.Fatalf("want exactly one duplicate warning, got %v (all: %v)", found, warns)
+	}
+	w := found[0]
+	for _, want := range []string{`node "wg1"`, "chain-a-h1", "chain-b-h1", "fail-closed"} {
+		if !strings.Contains(w, want) {
+			t.Fatalf("warning must contain %q, got: %s", want, w)
+		}
+	}
+}
+
+// (г) Two DIFFERENT WireGuard nodes are two different devices at two different
+// peers and must never be folded together, however alike the rest of their config
+// is. Both chain copies survive; both base endpoints go.
+func TestWGDedupDistinctNodesNotCollapsed(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wgA", Enabled: true, URI: wgDedupURI(wgDedupKey(3), wgDedupKey(11), "203.0.113.10", 51820)},
+			{Name: "wgB", Enabled: true, URI: wgDedupURI(wgDedupKey(4), wgDedupKey(12), "203.0.113.11", 51820)},
+		},
+		Chains: []model.Chain{
+			{Name: "c", Hops: []string{"node:wgA", "node:wgB"}},
+		},
+		Rules: []model.Rule{
+			{Name: "via-chain", Enabled: true, Order: 10, DstPort: "443", Target: "chain:c"},
+		},
+	}
+
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	got := endpointTags(opts)
+	if len(got) != 2 || got[0] != "chain-c-h1" || got[1] != "chain-c-h2" {
+		t.Fatalf("endpoints = %v, want [chain-c-h1 chain-c-h2] (distinct keys kept apart)", got)
+	}
+	keys := map[string]bool{}
+	for i := range opts.Endpoints {
+		k, ok := wgDeviceKey(opts.Endpoints[i])
+		if !ok {
+			t.Fatalf("endpoint %q is not a keyed wireguard endpoint", opts.Endpoints[i].Tag)
+		}
+		keys[k] = true
+	}
+	if len(keys) != 2 {
+		t.Fatalf("expected two distinct device identities, got %d", len(keys))
+	}
+	if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+		t.Fatalf("distinct nodes must not warn, got %v", got)
+	}
+}
+
+// (д) A WG node a rule targets DIRECTLY, with no chain copy anywhere, has exactly
+// one device already. The pass must leave it completely alone — it only ever
+// removes a duplicate, never the last copy of a node.
+func TestWGDedupDirectlyTargetedBaseEndpointKept(t *testing.T) {
+	priv, pub := wgDedupKey(5), wgDedupKey(13)
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wg1", Enabled: true, URI: wgDedupURI(priv, pub, "203.0.113.10", 51820)},
+		},
+		Rules: []model.Rule{
+			{Name: "direct-to-node", Enabled: true, Order: 10, DstPort: "443", Target: "node:wg1"},
+		},
+	}
+
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "wg1" {
+		t.Fatalf("endpoints = %v, want exactly [wg1] (base endpoint untouched)", got)
+	}
+	if got := routeRuleOutbounds(opts.Route); len(got) != 1 || got[0] != "wg1" {
+		t.Fatalf("route targets = %v, want [wg1] (rule not rewritten)", got)
+	}
+	if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+		t.Fatalf("a singly-used node must not warn, got %v", got)
+	}
+}
+
+// --- subscription fetch_detour is a real reference ---------------------------
+
+// fetchDetourModel is the shared fixture for the three fetch_detour cases: one WG
+// node, optionally used as a chain hop, optionally named as a subscription's fetch
+// detour. Both switches independent, so the three combinations are exactly the
+// three outcomes the pass must produce.
+func fetchDetourModel(inChain bool, fetchDetour string) *model.Model {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wg1", Enabled: true, URI: wgDedupURI(wgDedupKey(21), wgDedupKey(31), "203.0.113.10", 51820)},
+			{Name: "ss1", Enabled: true, URI: "ss://aes-256-gcm:secret@203.0.113.2:8388#ss1"},
+		},
+	}
+	if inChain {
+		m.Chains = []model.Chain{{Name: "c", Hops: []string{"node:wg1", "node:ss1"}}}
+		m.Rules = []model.Rule{{Name: "via-chain", Enabled: true, Order: 10, DstPort: "443", Target: "chain:c"}}
+	} else {
+		m.Rules = []model.Rule{{Name: "via-ss", Enabled: true, Order: 10, DstPort: "443", Target: "node:ss1"}}
+	}
+	if fetchDetour != "" {
+		m.Subscriptions = []model.Subscription{{
+			Name: "sub0", Enabled: true, URL: "https://example.net/sub",
+			FetchVia: "proxy", FetchDetour: fetchDetour,
+		}}
+	}
+	return m
+}
+
+// Case 1 — node only in the chain, no fetch detour on it: the base endpoint is
+// genuinely unreferenced and goes, the chain works. (The pre-existing behaviour;
+// pinned here so the new seed cannot accidentally resurrect the base endpoint.)
+func TestWGDedupFetchDetourAbsentBaseStillDropped(t *testing.T) {
+	opts, warns, err := GenerateWithWarnings(fetchDetourModel(true, ""))
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "chain-c-h1" {
+		t.Fatalf("endpoints = %v, want exactly [chain-c-h1]", got)
+	}
+	if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+		t.Fatalf("must be silent, got %v", got)
+	}
+}
+
+// Case 2 — node in the chain AND named as a fetch detour: the config asks for the
+// node on two different dial paths, which one private key cannot provide. Both are
+// reachable, so one survives and the other is fail-closed with the critical
+// warning. Choosing silently for the operator is what we must NOT do.
+func TestWGDedupFetchDetourAndChainBothReachable(t *testing.T) {
+	opts, warns, err := GenerateWithWarnings(fetchDetourModel(true, "node:wg1"))
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	// Tag order decides: "chain-c-h1" < "wg1", so the chain copy is the survivor.
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "chain-c-h1" {
+		t.Fatalf("endpoints = %v, want exactly [chain-c-h1] (one device per key)", got)
+	}
+	found := warningsContaining(warns, "materialised twice")
+	if len(found) != 1 {
+		t.Fatalf("want exactly one duplicate warning, got %v (all: %v)", found, warns)
+	}
+	for _, want := range []string{`node "wg1"`, "chain-c-h1", `"wg1"`, "fail-closed"} {
+		if !strings.Contains(found[0], want) {
+			t.Fatalf("warning must contain %q, got: %s", want, found[0])
+		}
+	}
+}
+
+// Case 3 — node ONLY named as a fetch detour, no chain copy: a single device that
+// something really does dial. It must survive untouched, or updating the
+// subscription fails with "unknown outbound tag" — the regression this seed exists
+// to prevent.
+func TestWGDedupFetchDetourOnlyKeepsBaseEndpoint(t *testing.T) {
+	for _, via := range []string{"node:wg1", "wg1", "NODE:wg1", " node:wg1 "} {
+		t.Run(via, func(t *testing.T) {
+			opts, warns, err := GenerateWithWarnings(fetchDetourModel(false, via))
+			if err != nil {
+				t.Fatalf("Generate: %v", err)
+			}
+			if got := endpointTags(opts); len(got) != 1 || got[0] != "wg1" {
+				t.Fatalf("endpoints = %v, want exactly [wg1] (the fetch detour's target)", got)
+			}
+			if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+				t.Fatalf("a single device must not warn, got %v", got)
+			}
+		})
+	}
+}
+
+// A fetch_via=direct subscription dials no outbound at all, so its (ignored)
+// fetch_detour must NOT keep a duplicate alive.
+func TestWGDedupFetchDetourIgnoredWhenFetchViaDirect(t *testing.T) {
+	m := fetchDetourModel(true, "node:wg1")
+	m.Subscriptions[0].FetchVia = "direct"
+	opts, warns, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 1 || got[0] != "chain-c-h1" {
+		t.Fatalf("endpoints = %v, want exactly [chain-c-h1] (direct fetch is not a reference)", got)
+	}
+	if got := warningsContaining(warns, "materialised twice"); len(got) != 0 {
+		t.Fatalf("must be silent, got %v", got)
+	}
+}
+
+// TestViaOutboundTagMatchesEngine is the drift tripwire for the duplicated `via`
+// mapping. viaOutboundTag must agree with engine.ViaToTag on every form, because
+// the seed is only correct if it names the tag the RUNTIME will look up: if the
+// engine's mapping changes and this one does not, the pass starts deleting an
+// endpoint the subscription fetcher still dials.
+func TestViaOutboundTagMatchesEngine(t *testing.T) {
+	for _, via := range []string{
+		"", "   ", "direct", "DIRECT",
+		"node:wg1", "NODE:wg1", " node: wg1 ", "node:",
+		"group:auto", "Group:auto",
+		"egress:wan2", "EGRESS:wan2",
+		"chain:ewan", "Chain:ewan",
+		"wg1", " wg1 ", "weird:value",
+	} {
+		if got, want := viaOutboundTag(via), engine.ViaToTag(via); got != want {
+			t.Errorf("viaOutboundTag(%q) = %q, engine.ViaToTag = %q — the mappings have drifted", via, got, want)
+		}
+	}
+}
+
+// An UNREFERENCED WG node is still a single device and stays: this pass is about
+// duplicates, not about pruning unused config. (Guards the >1 precondition — an
+// over-eager version would delete it and silently change what a later `selector`
+// or a hand-written detour could reach.)
+func TestWGDedupUnreferencedSingleNodeKept(t *testing.T) {
+	m := &model.Model{
+		Globals: model.DefaultGlobals(),
+		Nodes: []model.Node{
+			{Name: "wg1", Enabled: true, URI: wgDedupURI(wgDedupKey(6), wgDedupKey(14), "203.0.113.10", 51820)},
+			{Name: "wg2", Enabled: true, URI: wgDedupURI(wgDedupKey(8), wgDedupKey(15), "203.0.113.11", 51820)},
+		},
+	}
+
+	opts, _, err := GenerateWithWarnings(m)
+	if err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	if got := endpointTags(opts); len(got) != 2 {
+		t.Fatalf("endpoints = %v, want both nodes kept", got)
+	}
+}
@@ -16,6 +16,11 @@
 //     answer "give me the last day" — the prefix is what makes the download
 //     ranges real. UTC only: the binary ships without tzdata, so any local-zone
 //     rendering would be a fiction.
+//   - collapses RUNS of the same message into "last message repeated N times"
+//     (see repeatKey / repeatWindow): a broken outbound makes the engine repeat
+//     one line hundreds of times a minute, which evicts the whole rest of the
+//     router's syslog ring buffer within minutes. Suppression applies to both
+//     halves identically; fatal/panic lines are never suppressed.
 //   - fans it out according to Config: to the REAL os.Stderr (procd relays fd2
 //     to syslog/logread) when ToSyslog, and to a size-capped, 2-segment rotated
 //     file when ToFile. Both off => the line is dropped — that IS the "fully
@@ -74,6 +79,22 @@ const (
 	// the log's own cap: the guard requires cap+floor available, so even a log
 	// that grows to its full cap leaves the rootfs this much headroom.
 	diskFloorBytes = 4 << 20
+
+	// repeatWindow bounds how long a run of identical messages may stay silent:
+	// once suppression starts, a "last message repeated N times" summary is
+	// emitted every window for as long as the run continues, and the counter
+	// restarts.
+	//
+	// Why 5s: the observed flood (a dead chain -> "WireGuard is not ready yet")
+	// runs at ~1 line/s, i.e. ~370 lines per 6 minutes, while the router's
+	// syslog ring holds ~760 lines total — one faulty outbound erases every
+	// other subsystem's history, including our own startup lines. A 5s window
+	// turns that into ~12 lines/min (~30x less) — small enough that the ring
+	// survives a long outage, short enough that an operator tailing `logread -f`
+	// sees the fault acknowledged within 5 seconds and keeps seeing it, so a
+	// standing problem never looks like a frozen log. A longer window (30-60s)
+	// would hide the ongoing-ness; a shorter one would not relieve the ring.
+	repeatWindow = 5 * time.Second
 )

 // FilePath returns the log-file location for the given persistence choice.
@@ -153,9 +174,17 @@ type Sink struct {
 	suspended bool      // persistent-path disk guard tripped
 	lastProbe time.Time // last disk-free probe

+	// repeat suppression (emitLocked / flushRepeatsLocked)
+	lastKey     string      // repeatKey of the last PRINTED line
+	hasLast     bool        // a lastKey exists (distinguishes "" from "unset")
+	repeats     int         // identical lines swallowed since the last summary
+	repeatTimer *time.Timer // armed while repeats > 0, fires flushRepeats
+	closed      bool        // Close ran: the timer must not write any more
+
 	// test seams
-	now  func() time.Time
-	free func(string) (uint64, bool)
+	now    func() time.Time
+	free   func(string) (uint64, bool)
+	window time.Duration // repeatWindow, overridable in tests
 }

 // New returns a Sink fanning to stderr (the daemon passes os.Stderr) under cfg.
@@ -172,6 +201,7 @@ func New(stderr io.Writer, cfg Config) *Sink {
 		stderr: stderr,
 		now:    time.Now,
 		free:   freeBytes,
+		window: repeatWindow,
 	}
 }

@@ -210,6 +240,10 @@ func (s *Sink) Reconfigure(cfg Config) {
 	if cfg == s.cfg {
 		return
 	}
+	// Settle any run in progress under the OLD configuration: its summary
+	// belongs to the destination the swallowed lines were headed for.
+	s.flushRepeatsLocked()
+	s.lastKey, s.hasLast = "", false
 	if cfg.path() != s.cfg.path() || !cfg.ToFile {
 		s.closeFileLocked()
 	}
@@ -222,8 +256,10 @@ func (s *Sink) Reconfigure(cfg Config) {
 	s.cfg = cfg
 }

-// Close flushes a pending partial line and closes the file segment. The sink
-// must not be written to afterwards.
+// Close flushes a pending partial line, emits the summary of a still-open run
+// of repeats (the last series must never be lost) and closes the file segment.
+// The sink must not be written to afterwards; a repeat timer that fires after
+// Close is a no-op.
 func (s *Sink) Close() error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -231,6 +267,8 @@ func (s *Sink) Close() error {
 		s.emitLocked(s.buf)
 		s.buf = nil
 	}
+	s.flushRepeatsLocked()
+	s.closed = true
 	if s.file != nil {
 		err := s.file.Close()
 		s.file = nil
@@ -242,12 +280,120 @@ func (s *Sink) Close() error {

 // --- internals (caller holds s.mu) -------------------------------------------

-// emitLocked stamps one complete line with the UTC wall clock and fans it out.
+// emitLocked runs one complete line through repeat suppression and, unless it
+// is swallowed as a repeat, hands it to writeLineLocked.
 func (s *Sink) emitLocked(line []byte) {
 	if !s.cfg.ToSyslog && !s.cfg.ToFile {
 		return // fully off: the line is dropped, nowhere else to go
 	}
 	line = bytes.TrimSuffix(line, []byte{'\r'})
+	key, exempt := repeatKey(line)
+	switch {
+	case exempt:
+		// fatal/panic: always printed, and never becomes the head of a run —
+		// a dying daemon must not have its last words counted instead of said.
+		s.flushRepeatsLocked()
+		s.lastKey, s.hasLast = "", false
+	case s.hasLast && key == s.lastKey:
+		s.repeats++
+		if s.repeatTimer == nil {
+			// Arm on the 0->1 transition: the run gets a summary within one
+			// window even if nothing else is ever logged.
+			w := s.window
+			if w <= 0 {
+				w = repeatWindow
+			}
+			s.repeatTimer = time.AfterFunc(w, s.flushRepeats)
+		}
+		return
+	default:
+		s.flushRepeatsLocked() // a different message ends the previous run
+		s.lastKey, s.hasLast = key, true
+	}
+	s.writeLineLocked(line)
+}
+
+// repeatKey reduces a raw producer line to the identity used for suppression,
+// and reports whether the line is EXEMPT from it.
+//
+// Both of the daemon's log producers (the control-plane formatter built in
+// cmd/shaterd/logsetup.go and the engine's own, both log.Formatter) render a
+// line as "<LEVEL>[<seconds since start>] <message>" — see log/format.go. The
+// bracketed uptime ticks every second, so comparing whole lines would suppress
+// nothing at all beyond a same-second burst; the key therefore drops exactly
+// that field and keeps everything else, LEVEL included (the same text at INFO
+// and at ERROR is not the same event).
+//
+// What the key deliberately does NOT drop is the per-connection "[id duration]"
+// group log.Formatter inserts for context-bound lines: those ids identify
+// distinct connections, and folding them together would turn "50 connections
+// failed" into one indistinguishable count. Such lines differ by id and simply
+// never form a run — which is correct, they are not repeats.
+//
+// ANSI colour is stripped first so the key is identical for the coloured
+// (terminal) and plain (procd) renderings of the same message.
+//
+// FATAL/PANIC are exempt: they are emitted at most a handful of times, they are
+// the reason the operator is reading the log, and a summary line is a worse
+// thing to find than a duplicate.
+func repeatKey(line []byte) (string, bool) {
+	b := stripANSI(line)
+	i := 0
+	for i < len(b) && b[i] >= 'A' && b[i] <= 'Z' {
+		i++
+	}
+	if i > 0 && i < len(b) && b[i] == '[' {
+		j := i + 1
+		for j < len(b) && b[j] >= '0' && b[j] <= '9' {
+			j++
+		}
+		if j > i+1 && j < len(b) && b[j] == ']' {
+			level := string(b[:i])
+			return level + string(b[j+1:]), level == "FATAL" || level == "PANIC"
+		}
+	}
+	// Anything not in the daemon's format (a foreign writer, a bare line):
+	// compare it whole.
+	return string(b), false
+}
+
+// flushRepeats is the repeat timer's callback: it closes a run that is still
+// open one window after suppression started, so a flood is reported while it
+// happens instead of only when it ends.
+func (s *Sink) flushRepeats() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.closed {
+		return
+	}
+	s.flushRepeatsLocked()
+}
+
+// flushRepeatsLocked disarms the timer and, if lines were swallowed, prints the
+// summary. lastKey is intentionally KEPT: an ongoing flood stays suppressed
+// after its periodic summary instead of printing one full line per window.
+func (s *Sink) flushRepeatsLocked() {
+	if s.repeatTimer != nil {
+		s.repeatTimer.Stop()
+		s.repeatTimer = nil
+	}
+	if s.repeats == 0 {
+		return
+	}
+	n := s.repeats
+	s.repeats = 0
+	unit := "times"
+	if n == 1 {
+		unit = "time"
+	}
+	s.writeLineLocked([]byte(fmt.Sprintf("last message repeated %d %s", n, unit)))
+}
+
+// writeLineLocked stamps one line with the UTC wall clock and fans it out.
+func (s *Sink) writeLineLocked(line []byte) {
+	if !s.cfg.ToSyslog && !s.cfg.ToFile {
+		return // fully off: the line is dropped, nowhere else to go
+	}
 	ts := s.now().UTC().Format(time.RFC3339)
 	if s.cfg.ToSyslog && s.stderr != nil {
 		out := make([]byte, 0, len(ts)+1+len(line)+1)
@@ -5,7 +5,10 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"

@@ -379,6 +382,302 @@ func TestReconfigureFileOffDeletesSegments(t *testing.T) {
 	}
 }

+// --- repeat suppression -------------------------------------------------------
+
+// syncBuffer is a bytes.Buffer safe for the concurrent access the repeat timer
+// goroutine and the test's reader make.
+type syncBuffer struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (s *syncBuffer) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuffer) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// engLine renders a line exactly as both of the daemon's log.Formatter
+// producers do: "<LEVEL>[<seconds since start>] <message>".
+func engLine(sec int, level, msg string) string {
+	return fmt.Sprintf("%s[%04d] %s\n", level, sec, msg)
+}
+
+// payloads strips the sink's RFC3339 prefix off every line of a rendered log.
+func payloads(t *testing.T, body string) []string {
+	t.Helper()
+	if body == "" {
+		return nil
+	}
+	var out []string
+	for _, line := range strings.Split(strings.TrimSuffix(body, "\n"), "\n") {
+		if _, ok := LineTime([]byte(line)); !ok {
+			t.Fatalf("line without RFC3339 prefix: %q", line)
+		}
+		out = append(out, line[strings.IndexByte(line, ' ')+1:])
+	}
+	return out
+}
+
+var repeatSummaryRe = regexp.MustCompile(`^last message repeated (\d+) times?$`)
+
+// summarySum returns how many suppressed lines the summaries in payloads
+// account for, and how many summary lines there were.
+func summarySum(t *testing.T, lines []string) (total, count int) {
+	t.Helper()
+	for _, l := range lines {
+		m := repeatSummaryRe.FindStringSubmatch(l)
+		if m == nil {
+			continue
+		}
+		n, err := strconv.Atoi(m[1])
+		if err != nil {
+			t.Fatalf("unparseable summary %q: %v", l, err)
+		}
+		total += n
+		count++
+	}
+	return total, count
+}
+
+// TestRepeatRunCollapsed: the production symptom — one broken chain repeating
+// the same message — leaves ONE copy of the line plus ONE summary carrying the
+// right count, in BOTH halves, and the next distinct message closes the run.
+// The uptime field of the producer's prefix differs on every line: that is
+// exactly what repeatKey must ignore.
+func TestRepeatRunCollapsed(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, true, 0)
+	s := New(&stderr, cfg)
+	s.window = time.Hour // no timer flush: this test is about run boundaries
+
+	const msg = "outbound/urltest[chain-ewan-wg-subs-h2]: WireGuard is not ready yet"
+	for sec := 1; sec <= 6; sec++ {
+		if _, err := s.Write([]byte(engLine(sec, "ERROR", msg))); err != nil {
+			t.Fatalf("Write: %v", err)
+		}
+	}
+	_, _ = s.Write([]byte(engLine(7, "INFO", "something else entirely")))
+	if err := s.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	for _, src := range []struct{ name, body string }{
+		{"file", readFile(t, cfg.Path)},
+		{"stderr", stderr.String()},
+	} {
+		got := payloads(t, src.body)
+		want := []string{
+			strings.TrimSuffix(engLine(1, "ERROR", msg), "\n"),
+			"last message repeated 5 times",
+			strings.TrimSuffix(engLine(7, "INFO", "something else entirely"), "\n"),
+		}
+		if len(got) != len(want) {
+			t.Fatalf("%s: got %d lines %q, want %d %q", src.name, len(got), got, len(want), want)
+		}
+		for i := range want {
+			if got[i] != want[i] {
+				t.Errorf("%s line %d = %q, want %q", src.name, i, got[i], want[i])
+			}
+		}
+	}
+}
+
+// TestRepeatAlternatingNotSuppressed: A B A B is four distinct events, not a
+// run — nothing may be swallowed and no summary may appear.
+func TestRepeatAlternatingNotSuppressed(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, true, 0)
+	s := New(&stderr, cfg)
+	s.window = time.Hour
+
+	for sec := 1; sec <= 4; sec++ {
+		msg := "alpha happened"
+		if sec%2 == 0 {
+			msg = "beta happened"
+		}
+		_, _ = s.Write([]byte(engLine(sec, "WARN", msg)))
+	}
+	_ = s.Close()
+
+	for _, src := range []struct{ name, body string }{
+		{"file", readFile(t, cfg.Path)},
+		{"stderr", stderr.String()},
+	} {
+		got := payloads(t, src.body)
+		if len(got) != 4 {
+			t.Fatalf("%s: got %d lines %q, want 4 (nothing suppressed)", src.name, len(got), got)
+		}
+		if _, n := summarySum(t, got); n != 0 {
+			t.Errorf("%s: %d summary lines for an alternating sequence: %q", src.name, n, got)
+		}
+		for i, want := range []string{"alpha", "beta", "alpha", "beta"} {
+			if !strings.Contains(got[i], want) {
+				t.Errorf("%s line %d = %q, want it to contain %q", src.name, i, got[i], want)
+			}
+		}
+	}
+}
+
+// TestRepeatLastRunSurvivesClose: a run still open at shutdown is summarised by
+// Close — the last series is never silently lost.
+func TestRepeatLastRunSurvivesClose(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, true, 0)
+	s := New(&stderr, cfg)
+	s.window = time.Hour
+
+	for sec := 1; sec <= 4; sec++ {
+		_, _ = s.Write([]byte(engLine(sec, "ERROR", "dying in a loop")))
+	}
+	if err := s.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	for _, src := range []struct{ name, body string }{
+		{"file", readFile(t, cfg.Path)},
+		{"stderr", stderr.String()},
+	} {
+		got := payloads(t, src.body)
+		if len(got) != 2 {
+			t.Fatalf("%s: got %q, want the line plus one summary", src.name, got)
+		}
+		if got[1] != "last message repeated 3 times" {
+			t.Errorf("%s: summary = %q, want %q", src.name, got[1], "last message repeated 3 times")
+		}
+	}
+
+	// A run of exactly two lines is summarised with correct grammar.
+	var stderr2 syncBuffer
+	cfg2 := fileCfg(t, true, false, 0)
+	s2 := New(&stderr2, cfg2)
+	s2.window = time.Hour
+	_, _ = s2.Write([]byte(engLine(1, "WARN", "twice only")))
+	_, _ = s2.Write([]byte(engLine(2, "WARN", "twice only")))
+	_ = s2.Close()
+	if got := payloads(t, stderr2.String()); len(got) != 2 || got[1] != "last message repeated 1 time" {
+		t.Errorf("two-line run rendered as %q, want the line plus %q", got, "last message repeated 1 time")
+	}
+}
+
+// TestRepeatFatalNeverSuppressed: fatal/panic lines are exempt — every copy is
+// printed, and they do not become the head of a run either.
+func TestRepeatFatalNeverSuppressed(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, true, 0)
+	s := New(&stderr, cfg)
+	s.window = time.Hour
+
+	for sec := 1; sec <= 3; sec++ {
+		_, _ = s.Write([]byte(engLine(sec, "FATAL", "engine is gone")))
+	}
+	for sec := 4; sec <= 6; sec++ {
+		_, _ = s.Write([]byte(engLine(sec, "PANIC", "engine is gone")))
+	}
+	_ = s.Close()
+
+	for _, src := range []struct{ name, body string }{
+		{"file", readFile(t, cfg.Path)},
+		{"stderr", stderr.String()},
+	} {
+		got := payloads(t, src.body)
+		if len(got) != 6 {
+			t.Fatalf("%s: got %d lines %q, want all 6 fatal/panic copies", src.name, len(got), got)
+		}
+		if _, n := summarySum(t, got); n != 0 {
+			t.Errorf("%s: fatal/panic run produced %d summaries: %q", src.name, n, got)
+		}
+	}
+}
+
+// TestRepeatWindowFlushesOngoingRun: a flood that never stops still reports
+// itself — the window timer emits a summary without any further input, and the
+// counter restarts (so the NEXT summary counts only the lines after it).
+func TestRepeatWindowFlushesOngoingRun(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, false, 0)
+	s := New(&stderr, cfg)
+	s.window = 20 * time.Millisecond
+
+	for sec := 1; sec <= 5; sec++ {
+		_, _ = s.Write([]byte(engLine(sec, "ERROR", "flooding")))
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for !strings.Contains(stderr.String(), "last message repeated") && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+	got := payloads(t, stderr.String())
+	if len(got) != 2 || got[1] != "last message repeated 4 times" {
+		t.Fatalf("timer flush produced %q, want the line plus %q", got, "last message repeated 4 times")
+	}
+
+	// The run continues: still suppressed, and the next summary counts afresh.
+	for sec := 6; sec <= 8; sec++ {
+		_, _ = s.Write([]byte(engLine(sec, "ERROR", "flooding")))
+	}
+	_ = s.Close()
+	got = payloads(t, stderr.String())
+	if len(got) != 3 || got[2] != "last message repeated 3 times" {
+		t.Fatalf("continued run produced %q, want a second summary %q", got, "last message repeated 3 times")
+	}
+}
+
+// TestRepeatConcurrentWritesKeepCount: the sink is written from every goroutine
+// of the engine. Under -race, a hammering of identical lines must not lose or
+// double-count anything: printed copies + summarised copies == lines written.
+func TestRepeatConcurrentWritesKeepCount(t *testing.T) {
+	var stderr syncBuffer
+	cfg := fileCfg(t, true, true, 0)
+	s := New(&stderr, cfg)
+	s.window = 20 * time.Millisecond // let the timer race the writers on purpose
+
+	const (
+		writers  = 8
+		perGo    = 100
+		expected = writers * perGo
+	)
+	var wg sync.WaitGroup
+	for g := 0; g < writers; g++ {
+		wg.Add(1)
+		go func(g int) {
+			defer wg.Done()
+			for i := 0; i < perGo; i++ {
+				_, _ = s.Write([]byte(engLine(g*perGo+i, "ERROR", "concurrent flood")))
+			}
+		}(g)
+	}
+	wg.Wait()
+	if err := s.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	for _, src := range []struct{ name, body string }{
+		{"file", readFile(t, cfg.Path)},
+		{"stderr", stderr.String()},
+	} {
+		got := payloads(t, src.body)
+		suppressed, summaries := summarySum(t, got)
+		printed := len(got) - summaries
+		if printed+suppressed != expected {
+			t.Errorf("%s: %d printed + %d suppressed = %d, want %d (lines: %q)",
+				src.name, printed, suppressed, printed+suppressed, expected, got)
+		}
+		if printed < 1 {
+			t.Errorf("%s: nothing printed at all — the first line must always show", src.name)
+		}
+		// Suppression really happened (the whole point).
+		if printed > expected/10 {
+			t.Errorf("%s: %d of %d lines printed — suppression did not engage", src.name, printed, expected)
+		}
+	}
+}
+
 // TestNewFileOffPurgesLeftovers: a sink CREATED with the file off (daemon boot
 // with the toggle already off) deletes segments left by a previous life.
 func TestNewFileOffPurgesLeftovers(t *testing.T) {
@@ -14,17 +14,40 @@ import (

 // CurrentSchemaVersion is the schema this build understands. Bump it when adding
 // a migration step below.
-const CurrentSchemaVersion = 1
+const CurrentSchemaVersion = 2

 // uciRunner abstracts uci get/set/delete/commit/import so migrations AND the
 // config-write path (WriteUCI) are unit-testable. Import feeds `uci export`-format
 // text to `uci import <pkg>` on stdin, replacing the package's staged sections.
+//
+// Export/Add/AddList exist for migrations that have to READ the config they are
+// rewriting and GROW it. migrate1to2 needs both: it reads options the current
+// Model no longer parses (`dst_domain`/`dst_ip` were removed from Rule) and adds
+// the `config ruleset` sections it folds them into. Add returns the generated
+// section id — the anonymous-index drift trap is real (`@ruleset[3]` means
+// something different after one more add), so every write goes through the id.
 type uciRunner interface {
 	Get(key string) (string, bool)
 	Set(key, val string) error
 	Delete(key string) error
 	Commit(pkg string) error
+	// Revert drops the package's STAGED (uncommitted) changes.
+	//
+	// A migration stages many writes and commits once, so a failure halfway
+	// through leaves a half-migration sitting in /tmp/.uci — and staged changes
+	// are not private to us: the next `uci commit shater` from ANY process (the
+	// panel saving one setting through WriteUCI, an operator at the shell) flushes
+	// them to disk, producing a config that is half v1 and half v2. Every error
+	// path in a migration must therefore revert before returning.
+	Revert(pkg string) error
 	Import(pkg, text string) error
+	// Export returns the package in `uci export` format. ok=false when the package
+	// does not exist (nothing to migrate), which is NOT an error.
+	Export(pkg string) (text string, ok bool)
+	// Add appends an anonymous `config <secType>` and returns its section id.
+	Add(pkg, secType string) (id string, err error)
+	// AddList appends one value to a list option (`uci add_list <key>=<val>`).
+	AddList(key, val string) error
 }

 type execUCI struct{}
@@ -39,6 +62,7 @@ func (execUCI) Get(k string) (string, bool) {
 func (execUCI) Set(k, v string) error { return exec.Command("uci", "set", k+"="+v).Run() }
 func (execUCI) Delete(k string) error { return exec.Command("uci", "-q", "delete", k).Run() }
 func (execUCI) Commit(p string) error { return exec.Command("uci", "commit", p).Run() }
+func (execUCI) Revert(p string) error { return exec.Command("uci", "revert", p).Run() }

 func (execUCI) Import(pkg, text string) error {
 	cmd := exec.Command("uci", "import", pkg)
@@ -46,6 +70,30 @@ func (execUCI) Import(pkg, text string) error {
 	return cmd.Run()
 }

+func (execUCI) Export(pkg string) (string, bool) {
+	out, err := exec.Command("uci", "-q", "export", pkg).Output()
+	if err != nil {
+		return "", false
+	}
+	return string(out), true
+}
+
+func (execUCI) Add(pkg, secType string) (string, error) {
+	out, err := exec.Command("uci", "add", pkg, secType).Output()
+	if err != nil {
+		return "", fmt.Errorf("uci add %s %s: %w", pkg, secType, err)
+	}
+	id := strings.TrimSpace(string(out))
+	if id == "" {
+		return "", fmt.Errorf("uci add %s %s: no section id returned", pkg, secType)
+	}
+	return id, nil
+}
+
+func (execUCI) AddList(k, v string) error {
+	return exec.Command("uci", "add_list", k+"="+v).Run()
+}
+
 // uci is the active runner (overridable in tests).
 var uci uciRunner = execUCI{}

@@ -56,6 +104,7 @@ type migration struct {

 var migrations = []migration{
 	{from: 0, to: 1, apply: migrate0to1},
+	{from: 1, to: 2, apply: migrate1to2},
 }

 func readSchemaVersion(u uciRunner) int {
@@ -75,9 +124,23 @@ func ensureGlobals(u uciRunner) {
 func setSchemaVersion(u uciRunner, v int) error {
 	ensureGlobals(u)
 	if err := u.Set("shater.globals.schema_version", strconv.Itoa(v)); err != nil {
-		return err
+		return staged(u, err)
 	}
-	return u.Commit("shater")
+	if err := u.Commit("shater"); err != nil {
+		return staged(u, err)
+	}
+	return nil
+}
+
+// staged discards the package's staged writes and returns err unchanged. It is
+// the one-liner every migration error path goes through: leaving a partial
+// migration staged lets somebody else's `uci commit shater` write it to disk (see
+// uciRunner.Revert). A failing revert cannot be reported on top of the original
+// failure without hiding it, so it is deliberately ignored — err is the one the
+// operator has to act on, and the revert is best-effort cleanup.
+func staged(u uciRunner, err error) error {
+	_ = u.Revert("shater")
+	return err
 }

 // Migrate runs pending migrations to CurrentSchemaVersion using the active runner.
@@ -121,5 +184,303 @@ func migrate0to1(u uciRunner) error {
 		}
 		_ = u.Delete("shater.globals.kill")
 	}
-	return u.Commit("shater")
+	if err := u.Commit("shater"); err != nil {
+		return staged(u, err)
+	}
+	return nil
+}
+
+// --- v1 -> v2: a rule's destination is a rule-set, never an inline list ------
+//
+// WHAT CHANGED. `config rule` lost `dst_domain` and `dst_ip`. A rule now names
+// its destination through `dst_ruleset` only, so there is ONE destination
+// mechanism, one matcher vocabulary, and one place a list is edited — and the
+// list is compiled once into a .srs that every referencing rule shares.
+//
+// WHAT THIS STEP DOES. For every rule that still carries one of the two options
+// it creates an inline `config ruleset` named `rule-<rule name>` (and
+// `rule-<rule name>-ip` for the address list, because a rule-set is EITHER a
+// domain list or an ip_cidr list), moves the entries into it, appends the new
+// name to the rule's `dst_ruleset`, and deletes the legacy option. Nothing is
+// dropped and nothing is guessed: a rule with both lists gets both rule-sets.
+//
+// ENTRY SEMANTICS ARE PRESERVED 1:1, and that needs one real conversion. The two
+// contexts disagree about exactly one form: a BARE domain is an EXACT match in a
+// routing rule (generate/route.go classified `dst_domain` with bareIsSuffix=false)
+// and a SUFFIX match inside a rule-set (inlineDomainRule, bareIsSuffix=true).
+// Copying `example.com` across verbatim would therefore silently widen the rule to
+// every subdomain, so a bare entry is rewritten as `full:example.com`. Every other
+// form already means the same thing on both sides and is copied byte-for-byte:
+// `full:`, `suffix:`, `keyword:`, `regexp:` (see generate.peelDomainRegexes, added
+// with this change so the regex form survives the move) and a leading dot, which
+// is a synonym of `suffix:` in both. `geosite:`/`geoip:` entries are copied
+// unchanged too: they are INERT in a routing rule on this engine (warned and
+// omitted — the route-rule geosite/geoip fields no longer exist), and an
+// unrecognised marker is equally inert inside a rule-set, so their meaning is
+// unchanged and the operator's text is not thrown away. Converting them into a
+// `source=geosite` rule-set would have made a dead matcher start routing traffic
+// during an upgrade — a behaviour change, not a migration.
+//
+// ONE DELIBERATE SEMANTIC IMPROVEMENT, stated out loud: a rule that carried BOTH
+// a domain list and an address list matched them with AND (an engine route rule
+// ANDs its matcher fields), which is almost never what "these sites and these
+// networks" was meant to say. The two generated rule-sets are ORed, because
+// `rule_set: [a, b]` matches when EITHER matches. Such a rule matches more after
+// the migration than before — it is called out here, in the docs, and it only
+// affects configs that used both fields at once.
+//
+// IDEMPOTENCE. The legacy options are deleted as the last step per rule, so a
+// second run finds nothing to do. A run interrupted between "create the rule-set"
+// and "delete the option" is also safe: a rule that ALREADY references a rule-set
+// of the expected name AND WHOSE ENTRIES ARE IN IT reuses it instead of creating
+// `rule-<name>-2` (see ensureMigratedRuleset — the entry check is what tells our
+// own half-finished work apart from an operator's hand-written list that happens
+// to carry the same name).
+//
+// A LEGACY OPTION IS DELETED ONLY WHEN ITS CONTENT HAS A NEW HOME. Deleting is
+// per-list and conditional on that list having produced (or confirmed) a
+// dst_ruleset reference. Unconditional deletion had a hole: a list whose values
+// are all blank (`list dst_domain '  '` — a space survives parseSections' empty
+// check but trims away in migrateDomainEntry) produced no rule-set, and deleting
+// it anyway left the rule with NO matchers at all, i.e. a catch-all that takes
+// over the router's default route. Keeping the option leaves the rule visibly
+// unmigrated instead, which ParseUCIExport holds disabled and ValidateRules
+// reports.
+//
+// ERRORS ABORT AND REVERT. Every write here is staged and committed once at the
+// end, so a failure that returned without reverting would leave a half-migration
+// in /tmp/.uci for the next `uci commit shater` (from the panel, say) to flush.
+// Every error path goes through staged(). Deletes are checked too: a delete that
+// silently failed left a legacy option in the config forever, because migrateWith
+// bumps schema_version to 2 on return and readSchemaVersion never asks for this
+// step again.
+func migrate1to2(u uciRunner) error {
+	text, ok := u.Export("shater")
+	if !ok || strings.TrimSpace(text) == "" {
+		return nil // no config yet (fresh install): nothing to migrate
+	}
+	secs, err := parseSections(text)
+	if err != nil {
+		return fmt.Errorf("read the current config: %w", err)
+	}
+
+	// Every rule-set name already in use -> its entries, so a generated name can
+	// never collide with a hand-written list (which would make `uci` hold two
+	// `config ruleset` blocks claiming the same name, and the generator drops one as
+	// a duplicate tag). The ENTRIES are carried, not just the name, because
+	// "reuse the existing list" is only correct when that list is the one a previous
+	// run of this migration created.
+	taken := map[string][]string{}
+	for _, s := range secs {
+		if s.Type == "ruleset" {
+			if n := firstNonEmpty(s.opt("name"), s.Name); n != "" {
+				taken[n] = s.list("entry")
+			}
+		}
+	}
+
+	ruleIdx := -1
+	for _, s := range secs {
+		if s.Type != "rule" {
+			continue
+		}
+		// Anonymous sections are addressed positionally and the index is PER TYPE, so
+		// it counts rules only. Appending `config ruleset` sections below cannot shift
+		// it (a new section goes to the end, and it is not a rule).
+		ruleIdx++
+
+		domains := s.list("dst_domain")
+		ips := s.list("dst_ip")
+		if len(domains) == 0 && len(ips) == 0 {
+			continue
+		}
+
+		rulePath := fmt.Sprintf("shater.@rule[%d]", ruleIdx)
+		base := rulesetBaseName(firstNonEmpty(s.opt("name"), s.Name), ruleIdx)
+		refs := s.list("dst_ruleset")
+
+		domainsDone, ipsDone := false, false
+		if len(domains) > 0 {
+			entries := make([]string, 0, len(domains))
+			for _, d := range domains {
+				if e := migrateDomainEntry(d); e != "" {
+					entries = append(entries, e)
+				}
+			}
+			domainsDone, err = ensureMigratedRuleset(u, rulePath, base, "domain", entries, refs, taken)
+			if err != nil {
+				return staged(u, err)
+			}
+		}
+		if len(ips) > 0 {
+			entries := make([]string, 0, len(ips))
+			for _, ip := range ips {
+				if v := strings.TrimSpace(ip); v != "" {
+					entries = append(entries, v)
+				}
+			}
+			ipsDone, err = ensureMigratedRuleset(u, rulePath, base+"-ip", "ipcidr", entries, refs, taken)
+			if err != nil {
+				return staged(u, err)
+			}
+		}
+
+		// Last, so an interrupted run still has the legacy list to redo the work from
+		// — and only for a list whose entries actually reached a rule-set.
+		if domainsDone {
+			if err := u.Delete(rulePath + ".dst_domain"); err != nil {
+				return staged(u, fmt.Errorf("drop the migrated dst_domain of rule %d: %w", ruleIdx, err))
+			}
+		}
+		if ipsDone {
+			if err := u.Delete(rulePath + ".dst_ip"); err != nil {
+				return staged(u, fmt.Errorf("drop the migrated dst_ip of rule %d: %w", ruleIdx, err))
+			}
+		}
+	}
+
+	if err := u.Commit("shater"); err != nil {
+		return staged(u, err)
+	}
+	return nil
+}
+
+// ensureMigratedRuleset creates the inline `config ruleset` holding entries and
+// points rulePath's dst_ruleset at it. want is the preferred name; a collision
+// with an existing list picks want-2, want-3, ... rsType is "domain" or "ipcidr".
+// taken maps every rule-set name already in the config to its entries, and is
+// updated with whatever this call adds.
+//
+// It reports whether the entries now have a home — which is what tells the caller
+// it may delete the legacy option they came from. false with a nil error means
+// "nothing was written and nothing may be deleted": the only such case is an
+// entry list that came out EMPTY (a legacy list of blanks). An empty inline
+// rule-set matches nothing and the generator would skip it, so creating one would
+// be pure noise — but the legacy option must then survive, or the rule is left
+// with no matchers at all and silently becomes the default route.
+//
+// RESUMING AN INTERRUPTED RUN, WITHOUT SWALLOWING A HAND-WRITTEN LIST. A rule
+// that already references a rule-set of the expected name is the signature of a
+// previous run that died between "create the rule-set" and "delete the option" —
+// but it is ALSO what an operator's own `config ruleset name='rule-ads'` plus a
+// rule referencing it looks like. Telling them apart takes one more question:
+// does that rule-set actually CONTAIN these entries? Our own leftover does, by
+// construction. The operator's list (a remote URL list, say) does not, and
+// treating it as "already migrated" threw the legacy entries away with no trace.
+// When the entries are not in it, this falls through to the ordinary collision
+// path and creates want-2, so the rule ends up referencing both lists — the two
+// references are ORed, so nothing the operator wrote stops matching.
+func ensureMigratedRuleset(u uciRunner, rulePath, want, rsType string, entries, existingRefs []string, taken map[string][]string) (bool, error) {
+	if len(entries) == 0 {
+		return false, nil
+	}
+	if have, ok := taken[want]; ok && containsString(existingRefs, want) && containsAll(have, entries) {
+		return true, nil // already migrated (interrupted run); nothing to add
+	}
+	name := want
+	for i := 2; ; i++ {
+		if _, clash := taken[name]; !clash {
+			break
+		}
+		name = fmt.Sprintf("%s-%d", want, i)
+	}
+	taken[name] = entries
+
+	id, err := u.Add("shater", "ruleset")
+	if err != nil {
+		return false, err
+	}
+	sec := "shater." + id
+	if err := u.Set(sec+".name", name); err != nil {
+		return false, err
+	}
+	if err := u.Set(sec+".type", rsType); err != nil {
+		return false, err
+	}
+	if err := u.Set(sec+".source", "inline"); err != nil {
+		return false, err
+	}
+	for _, e := range entries {
+		if err := u.AddList(sec+".entry", e); err != nil {
+			return false, err
+		}
+	}
+	if containsString(existingRefs, name) {
+		return true, nil
+	}
+	if err := u.AddList(rulePath+".dst_ruleset", name); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// rulesetBaseName builds `rule-<name>` from a rule's name, reduced to characters
+// that are safe in a rule-set name (it becomes an engine rule-set TAG, `rs-<name>`,
+// and a UCI option value). An unnamed rule falls back to its position so two of
+// them cannot produce the same base.
+func rulesetBaseName(ruleName string, idx int) string {
+	var b strings.Builder
+	prevDash := false
+	for _, r := range strings.TrimSpace(ruleName) {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '_', r == '.':
+			b.WriteRune(r)
+			prevDash = false
+		default:
+			if !prevDash && b.Len() > 0 {
+				b.WriteByte('-')
+				prevDash = true
+			}
+		}
+	}
+	slug := strings.Trim(b.String(), "-.")
+	if slug == "" {
+		slug = strconv.Itoa(idx)
+	}
+	return "rule-" + slug
+}
+
+// migrateDomainEntry rewrites ONE `dst_domain` entry into the rule-set spelling
+// with the same meaning. Only the bare form differs between the two contexts
+// (exact in a rule, suffix in a rule-set), so only it is rewritten; see the
+// migrate1to2 doc comment for the full table and the reasoning.
+func migrateDomainEntry(e string) string {
+	v := strings.TrimSpace(e)
+	if v == "" {
+		return ""
+	}
+	// A leading dot already means `suffix:` on both sides.
+	if strings.HasPrefix(v, ".") {
+		return v
+	}
+	// Any `word:` marker — recognised (full/suffix/keyword/regexp) or not
+	// (geosite/geoip/typos) — carries its meaning across unchanged. A domain label
+	// cannot contain a colon, so this cannot misfire on a real host name.
+	if strings.Contains(v, ":") {
+		return v
+	}
+	return "full:" + v
+}
+
+// containsString reports whether list holds want (trimmed comparison).
+func containsString(list []string, want string) bool {
+	for _, v := range list {
+		if strings.TrimSpace(v) == want {
+			return true
+		}
+	}
+	return false
+}
+
+// containsAll reports whether every entry in want is present in have. It answers
+// exactly one question — "is this rule-set the one a previous run of this
+// migration wrote?" — so it is a SUBSET test, not equality: a rule-set that also
+// holds entries the operator added by hand since is still ours to reuse.
+func containsAll(have, want []string) bool {
+	for _, w := range want {
+		if !containsString(have, strings.TrimSpace(w)) {
+			return false
+		}
+	}
+	return true
 }
@@ -1,53 +1,951 @@
 package model

-import "testing"
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+)

-// fakeUCI is an in-memory uciRunner for the migration + write tests (no router
-// needed). imported records the last `uci import` text so WriteUCI can be
-// asserted without a device.
+// fakeUCI is an in-memory stand-in for the `uci` CLI: enough of a section model
+// that a migration can EXPORT the config, rewrite it, and export it again and see
+// its own writes. That is what makes the idempotence assertions below real —
+// against a flat key/value map a second migration run would re-read the original
+// text and "prove" nothing.
+//
+// Addressing mirrors uci: `shater.globals.opt` (named section), `shater.@rule[2]`
+// (positional, index is PER TYPE), `shater.cfg001.opt` (the id `uci add` returns).
 type fakeUCI struct {
-	kv       map[string]string
+	secs     []*fakeSection
 	imported string
 	commits  int
+	reverts  int
 	deleted  []string
+	nextID   int
+	// missing makes Export report "no such package", the fresh-install case.
+	missing bool
 }

-func (f *fakeUCI) Get(k string) (string, bool) { v, ok := f.kv[k]; return v, ok }
-func (f *fakeUCI) Set(k, v string) error       { f.kv[k] = v; return nil }
-func (f *fakeUCI) Delete(k string) error       { f.deleted = append(f.deleted, k); delete(f.kv, k); return nil }
-func (f *fakeUCI) Commit(string) error         { f.commits++; return nil }
-func (f *fakeUCI) Import(pkg, text string) error { f.imported = text; return nil }
+type fakeSection struct {
+	id    string
+	typ   string
+	name  string // "" for an anonymous section
+	opts  map[string]string
+	oKeys []string // option order, so the rendered export is deterministic
+	lists map[string][]string
+	lKeys []string
+}
+
+// loadSections copies parsed sections into the fake, in a DETERMINISTIC order.
+//
+// uciSection carries its options and lists in maps, and Go randomises map
+// iteration, so feeding them to setOpt/addList in range order made oKeys/lKeys —
+// and therefore the rendered Export — differ run to run. That is not cosmetic
+// here: TestMigrateIdempotent and TestMigrate1to2IsIdempotent compare two export
+// strings, so a random key order turned them into coin flips that fail a few
+// percent of the time and look like a migration bug. Sorting by key restores the
+// determinism the oKeys/lKeys fields were added for.
+func (f *fakeUCI) loadSections(secs []uciSection) {
+	for _, s := range secs {
+		sec := f.newSection(s.Type, s.Name)
+		for _, k := range sortedKeys(s.Options) {
+			sec.setOpt(k, s.Options[k])
+		}
+		for _, k := range sortedKeys(s.Lists) {
+			for _, v := range s.Lists[k] {
+				sec.addList(k, v)
+			}
+		}
+	}
+}
+
+func sortedKeys[V any](m map[string]V) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func newFakeUCI(export string) *fakeUCI {
+	f := &fakeUCI{}
+	if strings.TrimSpace(export) == "" {
+		return f
+	}
+	secs, err := parseSections(export)
+	if err != nil {
+		panic("fakeUCI fixture: " + err.Error())
+	}
+	f.loadSections(secs)
+	return f
+}
+
+func (f *fakeUCI) newSection(typ, name string) *fakeSection {
+	sec := &fakeSection{
+		id:    fmt.Sprintf("cfg%03d", f.nextID),
+		typ:   typ,
+		name:  name,
+		opts:  map[string]string{},
+		lists: map[string][]string{},
+	}
+	f.nextID++
+	f.secs = append(f.secs, sec)
+	return sec
+}
+
+func (s *fakeSection) setOpt(k, v string) {
+	if _, seen := s.opts[k]; !seen {
+		s.oKeys = append(s.oKeys, k)
+	}
+	s.opts[k] = v
+}
+
+func (s *fakeSection) addList(k, v string) {
+	if _, seen := s.lists[k]; !seen {
+		s.lKeys = append(s.lKeys, k)
+	}
+	s.lists[k] = append(s.lists[k], v)
+}
+
+// resolve finds the section a `<pkg>.<sel>` selector names.
+func (f *fakeUCI) resolve(sel string) *fakeSection {
+	if strings.HasPrefix(sel, "@") && strings.HasSuffix(sel, "]") {
+		open := strings.IndexByte(sel, '[')
+		if open < 0 {
+			return nil
+		}
+		typ := sel[1:open]
+		idx, err := strconv.Atoi(sel[open+1 : len(sel)-1])
+		if err != nil {
+			return nil
+		}
+		n := 0
+		for _, s := range f.secs {
+			if s.typ != typ {
+				continue
+			}
+			if n == idx {
+				return s
+			}
+			n++
+		}
+		return nil
+	}
+	for _, s := range f.secs {
+		if s.name == sel || s.id == sel {
+			return s
+		}
+	}
+	return nil
+}
+
+// splitKey cuts "shater.@rule[0].dst_domain" into ("@rule[0]", "dst_domain").
+// A key with no option part yields opt == "".
+func splitKey(key string) (sel, opt string) {
+	rest := strings.TrimPrefix(key, "shater")
+	rest = strings.TrimPrefix(rest, ".")
+	if rest == "" {
+		return "", ""
+	}
+	// The selector may contain a dot only inside a name, which the fixtures never
+	// use, so a plain LastIndex is enough — except for `@type[i]`, where the index
+	// brackets hold no dots either.
+	if i := strings.LastIndexByte(rest, '.'); i >= 0 {
+		return rest[:i], rest[i+1:]
+	}
+	return rest, ""
+}
+
+func (f *fakeUCI) Get(k string) (string, bool) {
+	sel, opt := splitKey(k)
+	sec := f.resolve(sel)
+	if sec == nil {
+		return "", false
+	}
+	if opt == "" {
+		return sec.typ, true
+	}
+	v, ok := sec.opts[opt]
+	return v, ok
+}
+
+func (f *fakeUCI) Set(k, v string) error {
+	sel, opt := splitKey(k)
+	sec := f.resolve(sel)
+	if sec == nil {
+		if opt != "" {
+			return fmt.Errorf("uci set %s: no such section", k)
+		}
+		// `uci set shater.globals=globals` creates the named section.
+		f.newSection(v, sel)
+		return nil
+	}
+	if opt == "" {
+		sec.typ = v
+		return nil
+	}
+	sec.setOpt(opt, v)
+	return nil
+}
+
+func (f *fakeUCI) Delete(k string) error {
+	f.deleted = append(f.deleted, k)
+	if k == "shater" {
+		f.secs = nil
+		return nil
+	}
+	sel, opt := splitKey(k)
+	sec := f.resolve(sel)
+	if sec == nil {
+		return nil // `uci -q delete` on an absent key is a no-op
+	}
+	if opt == "" {
+		for i, s := range f.secs {
+			if s == sec {
+				f.secs = append(f.secs[:i], f.secs[i+1:]...)
+				break
+			}
+		}
+		return nil
+	}
+	delete(sec.opts, opt)
+	delete(sec.lists, opt)
+	return nil
+}
+
+func (f *fakeUCI) Commit(string) error { f.commits++; return nil }
+
+// Revert is COUNTED, not simulated: this fake applies every write immediately
+// (there is no staging area to roll back), so what a test can assert is that the
+// migration ASKED for a revert on its way out of a failure. That is the property
+// that matters — a real `uci` keeps the staged delta in /tmp/.uci until somebody
+// commits it, and the migration's job is to not leave it there.
+func (f *fakeUCI) Revert(string) error { f.reverts++; return nil }
+
+func (f *fakeUCI) Import(_, text string) error {
+	f.imported = text
+	secs, err := parseSections(text)
+	if err != nil {
+		return err
+	}
+	f.loadSections(secs)
+	return nil
+}
+
+func (f *fakeUCI) Export(string) (string, bool) {
+	if f.missing {
+		return "", false
+	}
+	var b strings.Builder
+	b.WriteString("package shater\n")
+	for _, s := range f.secs {
+		b.WriteString("\nconfig " + s.typ)
+		if s.name != "" {
+			b.WriteString(" '" + s.name + "'")
+		}
+		b.WriteString("\n")
+		for _, k := range s.oKeys {
+			if v, ok := s.opts[k]; ok {
+				b.WriteString("\toption " + k + " '" + v + "'\n")
+			}
+		}
+		for _, k := range s.lKeys {
+			for _, v := range s.lists[k] {
+				b.WriteString("\tlist " + k + " '" + v + "'\n")
+			}
+		}
+	}
+	return b.String(), true
+}
+
+func (f *fakeUCI) Add(_, secType string) (string, error) {
+	return f.newSection(secType, "").id, nil
+}
+
+func (f *fakeUCI) AddList(k, v string) error {
+	sel, opt := splitKey(k)
+	sec := f.resolve(sel)
+	if sec == nil {
+		return fmt.Errorf("uci add_list %s: no such section", k)
+	}
+	sec.addList(opt, v)
+	return nil
+}
+
+// ruleset returns the `config ruleset` section carrying option name == name.
+func (f *fakeUCI) ruleset(name string) *fakeSection {
+	for _, s := range f.secs {
+		if s.typ == "ruleset" && s.opts["name"] == name {
+			return s
+		}
+	}
+	return nil
+}
+
+// rule returns the n-th `config rule` section.
+func (f *fakeUCI) rule(idx int) *fakeSection { return f.resolve(fmt.Sprintf("@rule[%d]", idx)) }
+
+func (f *fakeUCI) rulesetNames() []string {
+	var out []string
+	for _, s := range f.secs {
+		if s.typ == "ruleset" {
+			out = append(out, s.opts["name"])
+		}
+	}
+	return out
+}
+
+func eqStrings(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}

 func TestMigrate0to1TransformsFixture(t *testing.T) {
-	f := &fakeUCI{kv: map[string]string{"shater.globals.kill": "open"}}
+	f := newFakeUCI("package shater\n\nconfig globals 'globals'\n\toption kill 'open'\n")
 	if err := migrateWith(f); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
-	if f.kv["shater.globals.kill_switch"] != "open" {
-		t.Fatalf("kill_switch = %q", f.kv["shater.globals.kill_switch"])
+	if v, _ := f.Get("shater.globals.kill_switch"); v != "open" {
+		t.Fatalf("kill_switch = %q", v)
 	}
-	if _, ok := f.kv["shater.globals.kill"]; ok {
+	if _, ok := f.Get("shater.globals.kill"); ok {
 		t.Fatal("legacy kill not removed")
 	}
-	if f.kv["shater.globals.schema_version"] != "1" {
-		t.Fatalf("schema_version = %q", f.kv["shater.globals.schema_version"])
+	if v, _ := f.Get("shater.globals.schema_version"); v != strconv.Itoa(CurrentSchemaVersion) {
+		t.Fatalf("schema_version = %q, want %d", v, CurrentSchemaVersion)
 	}
 }

 func TestMigrateIdempotent(t *testing.T) {
-	f := &fakeUCI{kv: map[string]string{"shater.globals.schema_version": "1"}}
-	before := len(f.kv)
+	f := newFakeUCI("package shater\n\nconfig globals 'globals'\n\toption schema_version '" +
+		strconv.Itoa(CurrentSchemaVersion) + "'\n")
+	before, _ := f.Export("shater")
 	if err := migrateWith(f); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
-	if len(f.kv) != before {
-		t.Fatal("idempotent migrate changed state")
+	after, _ := f.Export("shater")
+	if before != after {
+		t.Fatalf("idempotent migrate changed state:\n--- before\n%s\n--- after\n%s", before, after)
 	}
 }

 func TestMigrateRefusesNewer(t *testing.T) {
-	f := &fakeUCI{kv: map[string]string{"shater.globals.schema_version": "99"}}
+	f := newFakeUCI("package shater\n\nconfig globals 'globals'\n\toption schema_version '99'\n")
 	if err := migrateWith(f); err == nil {
 		t.Fatal("expected refusal of newer schema")
 	}
 }
+
+// --- v1 -> v2: dst_domain / dst_ip fold into generated rule-sets -------------
+
+// legacyConfig is the shape a v1 config has: rules matching destinations inline.
+// The `ru-direct` rule is copied verbatim from the live router this change was
+// written against (BananaWRT 25.12.1, shater 0.2.7-r1).
+const legacyConfig = `package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config rule
+	option name 'ru-direct'
+	option enabled '1'
+	option order '10'
+	list dst_domain 'suffix:ru'
+	list dst_domain 'suffix:yandex.net'
+	list dst_domain 'full:vk.com'
+	list dst_domain 'keyword:sberbank'
+	list dst_domain '.gosuslugi.ru'
+	list dst_domain 'plain.example'
+	option target 'direct'
+
+config rule
+	option name 'corp nets!'
+	option enabled '1'
+	option order '20'
+	list dst_ip '10.0.0.0/8'
+	list dst_ip '192.168.44.0/24'
+	option target 'group:corp'
+
+config rule
+	option name 'default'
+	option enabled '1'
+	option order '100'
+	option target 'direct'
+`
+
+func TestMigrate1to2FoldsDomainsIntoARuleset(t *testing.T) {
+	f := newFakeUCI(legacyConfig)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	rs := f.ruleset("rule-ru-direct")
+	if rs == nil {
+		t.Fatalf("no rule-ru-direct ruleset; got %v", f.rulesetNames())
+	}
+	if rs.opts["type"] != "domain" || rs.opts["source"] != "inline" {
+		t.Fatalf("ruleset type/source = %q/%q, want domain/inline", rs.opts["type"], rs.opts["source"])
+	}
+	// Every entry keeps its meaning. Only the BARE one is rewritten: bare means
+	// EXACT in a rule and SUFFIX in a rule-set, so it becomes `full:`.
+	want := []string{
+		"suffix:ru", "suffix:yandex.net", "full:vk.com",
+		"keyword:sberbank", ".gosuslugi.ru", "full:plain.example",
+	}
+	if !eqStrings(rs.lists["entry"], want) {
+		t.Fatalf("entries = %q\nwant     %q", rs.lists["entry"], want)
+	}
+
+	r0 := f.rule(0)
+	if !eqStrings(r0.lists["dst_ruleset"], []string{"rule-ru-direct"}) {
+		t.Fatalf("dst_ruleset = %q", r0.lists["dst_ruleset"])
+	}
+	if _, ok := r0.lists["dst_domain"]; ok {
+		t.Fatal("dst_domain survived the migration")
+	}
+	// Order and every other option are untouched.
+	if r0.opts["order"] != "10" || r0.opts["target"] != "direct" || r0.opts["name"] != "ru-direct" {
+		t.Fatalf("rule 0 mangled: %v", r0.opts)
+	}
+}
+
+func TestMigrate1to2FoldsCIDRsIntoAnIPRuleset(t *testing.T) {
+	f := newFakeUCI(legacyConfig)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	// The rule name is slugged: a rule-set name becomes an engine tag.
+	rs := f.ruleset("rule-corp-nets-ip")
+	if rs == nil {
+		t.Fatalf("no rule-corp-nets-ip ruleset; got %v", f.rulesetNames())
+	}
+	if rs.opts["type"] != "ipcidr" {
+		t.Fatalf("ruleset type = %q, want ipcidr", rs.opts["type"])
+	}
+	if !eqStrings(rs.lists["entry"], []string{"10.0.0.0/8", "192.168.44.0/24"}) {
+		t.Fatalf("entries = %q", rs.lists["entry"])
+	}
+	r1 := f.rule(1)
+	if !eqStrings(r1.lists["dst_ruleset"], []string{"rule-corp-nets-ip"}) {
+		t.Fatalf("dst_ruleset = %q", r1.lists["dst_ruleset"])
+	}
+	if _, ok := r1.lists["dst_ip"]; ok {
+		t.Fatal("dst_ip survived the migration")
+	}
+}
+
+// A rule with no destination at all stays a catch-all — the B1 reachability
+// analysis (model.RuleReachability) keys off exactly that, so the migration must
+// not hand it a rule-set it never asked for.
+func TestMigrate1to2LeavesCatchAllAlone(t *testing.T) {
+	f := newFakeUCI(legacyConfig)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	r2 := f.rule(2)
+	if len(r2.lists["dst_ruleset"]) != 0 {
+		t.Fatalf("catch-all gained a ruleset: %q", r2.lists["dst_ruleset"])
+	}
+	text, _ := f.Export("shater")
+	m, err := ParseUCIExport(text)
+	if err != nil {
+		t.Fatalf("parse migrated config: %v", err)
+	}
+	if len(m.Rules) != 3 {
+		t.Fatalf("rules = %d, want 3", len(m.Rules))
+	}
+	if !IsCatchAll(m.Rules[2]) {
+		t.Fatalf("rule %q stopped being a catch-all after the migration", m.Rules[2].Name)
+	}
+	for _, i := range []int{0, 1} {
+		if IsCatchAll(m.Rules[i]) {
+			t.Fatalf("rule %q became a catch-all — its destination was lost", m.Rules[i].Name)
+		}
+	}
+	reach := RuleReachability(m.Rules)
+	for i, v := range reach {
+		if v.Unreachable {
+			t.Fatalf("rule %d (%q) reported unreachable after the migration: %s", i, v.Name, v.Reason)
+		}
+	}
+}
+
+// Running the migration twice must not duplicate rule-sets or references. The
+// second run goes through migrate1to2 directly, because migrateWith is gated by
+// schema_version and would (correctly) do nothing at all.
+func TestMigrate1to2IsIdempotent(t *testing.T) {
+	f := newFakeUCI(legacyConfig)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	first, _ := f.Export("shater")
+
+	if err := migrate1to2(f); err != nil {
+		t.Fatalf("second migrate1to2: %v", err)
+	}
+	second, _ := f.Export("shater")
+	if first != second {
+		t.Fatalf("re-running the migration changed the config:\n--- first\n%s\n--- second\n%s", first, second)
+	}
+
+	// And a full migrateWith re-run (schema already at CurrentSchemaVersion) is a
+	// no-op too.
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("third migrate: %v", err)
+	}
+	third, _ := f.Export("shater")
+	if third != second {
+		t.Fatalf("re-running migrateWith changed the config:\n%s", third)
+	}
+}
+
+// An interrupted run — the rule-set was created and referenced, but the legacy
+// option was not deleted yet — must reuse the rule-set rather than make a second.
+func TestMigrate1to2ResumesAnInterruptedRun(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config ruleset
+	option name 'rule-half'
+	option type 'domain'
+	option source 'inline'
+	list entry 'full:a.example'
+
+config rule
+	option name 'half'
+	list dst_domain 'a.example'
+	list dst_ruleset 'rule-half'
+	option target 'direct'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	if names := f.rulesetNames(); !eqStrings(names, []string{"rule-half"}) {
+		t.Fatalf("rulesets = %q, want just rule-half", names)
+	}
+	r := f.rule(0)
+	if !eqStrings(r.lists["dst_ruleset"], []string{"rule-half"}) {
+		t.Fatalf("dst_ruleset = %q", r.lists["dst_ruleset"])
+	}
+	if _, ok := r.lists["dst_domain"]; ok {
+		t.Fatal("dst_domain survived")
+	}
+}
+
+// A hand-written rule-set already owning the generated name must not be
+// clobbered: two `config ruleset` blocks with one name collide on the engine tag
+// and one of them is dropped.
+func TestMigrate1to2AvoidsNameCollisions(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config ruleset
+	option name 'rule-ads'
+	option type 'domain'
+	option source 'url'
+	option url 'https://example.invalid/list.txt'
+
+config rule
+	option name 'ads'
+	list dst_domain 'ads.example'
+	option target 'block'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	names := f.rulesetNames()
+	if !eqStrings(names, []string{"rule-ads", "rule-ads-2"}) {
+		t.Fatalf("rulesets = %q, want rule-ads + rule-ads-2", names)
+	}
+	if got := f.ruleset("rule-ads").opts["source"]; got != "url" {
+		t.Fatalf("the hand-written list was overwritten (source = %q)", got)
+	}
+	if !eqStrings(f.rule(0).lists["dst_ruleset"], []string{"rule-ads-2"}) {
+		t.Fatalf("dst_ruleset = %q", f.rule(0).lists["dst_ruleset"])
+	}
+}
+
+// A hand-written rule-set the rule ALREADY references must not swallow the legacy
+// entries. `taken[want] && rule references want` alone reads an operator's own
+// `rule-ads` list as our own half-finished work from an interrupted run, and the
+// legacy `ads.example` was then dropped with nothing said. The entries have to
+// actually BE in that rule-set for it to count as ours.
+func TestMigrate1to2DoesNotFoldIntoAReferencedHandWrittenRuleset(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config ruleset
+	option name 'rule-ads'
+	option type 'domain'
+	option source 'url'
+	option url 'https://example.invalid/list.txt'
+
+config rule
+	option name 'ads'
+	list dst_domain 'ads.example'
+	list dst_ruleset 'rule-ads'
+	option target 'block'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	// The operator's list is untouched...
+	if got := f.ruleset("rule-ads").opts["source"]; got != "url" {
+		t.Fatalf("the hand-written list was overwritten (source = %q)", got)
+	}
+	if got := f.ruleset("rule-ads").lists["entry"]; len(got) != 0 {
+		t.Fatalf("entries were injected into the hand-written list: %q", got)
+	}
+	// ...and the legacy entry landed in a new list of its own.
+	rs := f.ruleset("rule-ads-2")
+	if rs == nil {
+		t.Fatalf("legacy entry was dropped; rulesets = %q", f.rulesetNames())
+	}
+	if !eqStrings(rs.lists["entry"], []string{"full:ads.example"}) {
+		t.Fatalf("entries = %q", rs.lists["entry"])
+	}
+	// Both references stand: rule_set is ORed, so the operator's list keeps
+	// matching everything it matched before.
+	if !eqStrings(f.rule(0).lists["dst_ruleset"], []string{"rule-ads", "rule-ads-2"}) {
+		t.Fatalf("dst_ruleset = %q", f.rule(0).lists["dst_ruleset"])
+	}
+	if _, ok := f.rule(0).lists["dst_domain"]; ok {
+		t.Fatal("dst_domain survived a completed migration")
+	}
+}
+
+// A legacy list whose values are all blank produces no rule-set — so the option
+// must NOT be deleted. Deleting it left the rule with zero matchers, which is the
+// spelling of a catch-all: a rule that previously matched nothing would have
+// become the router's default route. Keeping it leaves the rule visibly
+// unmigrated, which the parser then holds disabled.
+func TestMigrate1to2KeepsALegacyListThatMigratesToNothing(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config rule
+	option name 'blank'
+	list dst_domain '  '
+	option target 'direct'
+
+config rule
+	option name 'default'
+	option target 'block'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	if names := f.rulesetNames(); len(names) != 0 {
+		t.Fatalf("an empty rule-set was created: %q", names)
+	}
+	if got := f.rule(0).lists["dst_domain"]; !eqStrings(got, []string{"  "}) {
+		t.Fatalf("dst_domain = %q, want it left in place", got)
+	}
+
+	text, _ := f.Export("shater")
+	m, err := ParseUCIExport(text)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if IsCatchAll(m.Rules[0]) {
+		t.Fatal("a rule with an unmigrated dst_domain became a catch-all")
+	}
+	if m.Rules[0].Enabled {
+		t.Fatal("a rule with an unmigrated dst_domain stayed enabled")
+	}
+	// And it does not take the default route away from the rule that owns it.
+	if !IsCatchAll(m.Rules[1]) || !m.Rules[1].Enabled {
+		t.Fatal("the real catch-all was disturbed")
+	}
+}
+
+// An UNMIGRATED config (the migration never ran, or could not commit) must not
+// silently reroute the whole router. This is the failure the parser guard exists
+// for: `list dst_domain 'bank.ru'` + `option target 'direct'` used to parse as a
+// rule with no matchers at all, i.e. a catch-all, and generate points route Final
+// at the LAST catch-all — so one uncommitted `uci commit` sent every packet out
+// the plain WAN with the router's real address.
+func TestUnmigratedRuleIsNeverACatchAll(t *testing.T) {
+	const v1 = `package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config rule
+	option name 'bank'
+	option enabled '1'
+	option order '10'
+	list dst_domain 'bank.ru'
+	option target 'direct'
+
+config rule
+	option name 'ips'
+	option enabled '1'
+	option order '20'
+	list dst_ip '10.0.0.0/8'
+	option target 'group:corp'
+
+config rule
+	option name 'default'
+	option enabled '1'
+	option order '100'
+	option target 'group:auto'
+`
+	m, err := ParseUCIExport(v1)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if len(m.Rules) != 3 {
+		t.Fatalf("rules = %d, want 3", len(m.Rules))
+	}
+	for _, i := range []int{0, 1} {
+		r := m.Rules[i]
+		if len(r.LegacyDst) == 0 {
+			t.Fatalf("rule %q: the live legacy option went unnoticed", r.Name)
+		}
+		if IsCatchAll(r) {
+			t.Fatalf("rule %q became a catch-all — it would take over route Final", r.Name)
+		}
+		if r.Enabled {
+			t.Fatalf("rule %q stayed enabled with an unreadable destination", r.Name)
+		}
+	}
+	if m.Rules[0].LegacyDst[0] != "dst_domain=bank.ru" || m.Rules[1].LegacyDst[0] != "dst_ip=10.0.0.0/8" {
+		t.Fatalf("LegacyDst = %q / %q", m.Rules[0].LegacyDst, m.Rules[1].LegacyDst)
+	}
+	// The real default is untouched, and it is the only one.
+	if !IsCatchAll(m.Rules[2]) || !m.Rules[2].Enabled {
+		t.Fatal("the genuine catch-all was disturbed")
+	}
+
+	// The operator is told, through the ordinary config-warning channel.
+	warns := ValidateRules(m.Rules, nil)
+	if len(warns) != 2 {
+		t.Fatalf("warnings = %d (%v), want one per unmigrated rule", len(warns), warns)
+	}
+	for _, w := range warns {
+		if w.Section != "rule" || !strings.Contains(w.Message, "shaterd migrate") {
+			t.Fatalf("warning does not point at the fix: %+v", w)
+		}
+	}
+
+	// A profile may not hand such a rule its Enabled bit back either.
+	prof := &Profile{Name: "home", EnableRules: []string{"bank"}}
+	got, pwarns := ApplyProfileRuleOverrides(m.Rules, prof)
+	if got[0].Enabled {
+		t.Fatal("a profile re-enabled an unmigrated rule")
+	}
+	if len(pwarns) != 1 {
+		t.Fatalf("profile warnings = %v, want one refusal", pwarns)
+	}
+
+	// And after the migration the same config is fully live again.
+	f := newFakeUCI(v1)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	text, _ := f.Export("shater")
+	mm, err := ParseUCIExport(text)
+	if err != nil {
+		t.Fatalf("parse migrated: %v", err)
+	}
+	for i, r := range mm.Rules {
+		if len(r.LegacyDst) != 0 {
+			t.Fatalf("rule %d still flagged unmigrated: %q", i, r.LegacyDst)
+		}
+		if !r.Enabled {
+			t.Fatalf("rule %d stayed disabled after a successful migration", i)
+		}
+	}
+	if len(ValidateRules(mm.Rules, nil)) != 0 {
+		t.Fatalf("a migrated config still warns: %v", ValidateRules(mm.Rules, nil))
+	}
+}
+
+// failingUCI fails one named write, so the abort path can be observed.
+type failingUCI struct {
+	*fakeUCI
+	failAddList bool
+	failDelete  bool
+}
+
+var errFake = errors.New("uci: no space left on device")
+
+func (f *failingUCI) AddList(k, v string) error {
+	if f.failAddList {
+		return errFake
+	}
+	return f.fakeUCI.AddList(k, v)
+}
+
+func (f *failingUCI) Delete(k string) error {
+	if f.failDelete && strings.Contains(k, "dst_") {
+		return errFake
+	}
+	return f.fakeUCI.Delete(k)
+}
+
+// A failed write must abort the migration AND drop the staged half-migration.
+// Without the revert the partial rewrite sits in /tmp/.uci until the next
+// `uci commit shater` from any process (the panel saving one setting) flushes a
+// config that is half v1 and half v2 onto the disk.
+func TestMigrate1to2RevertsOnWriteFailure(t *testing.T) {
+	f := &failingUCI{fakeUCI: newFakeUCI(legacyConfig), failAddList: true}
+	err := migrateWith(f)
+	if err == nil {
+		t.Fatal("expected the failed write to abort the migration")
+	}
+	if f.reverts == 0 {
+		t.Fatal("the staged half-migration was left behind (no revert)")
+	}
+	if f.commits != 0 {
+		t.Fatalf("committed %d times despite the failure", f.commits)
+	}
+	if v, _ := f.Get("shater.globals.schema_version"); v != "1" {
+		t.Fatalf("schema_version = %q — a failed migration must not claim v2", v)
+	}
+}
+
+// A delete that fails must abort too. Swallowing it left the legacy option in the
+// config forever: migrateWith bumps schema_version to 2 on return, and the step
+// that would have removed it never runs again.
+func TestMigrate1to2FailsLoudlyWhenALegacyOptionCannotBeDeleted(t *testing.T) {
+	f := &failingUCI{fakeUCI: newFakeUCI(legacyConfig), failDelete: true}
+	if err := migrateWith(f); err == nil {
+		t.Fatal("a failed delete was swallowed")
+	}
+	if f.reverts == 0 {
+		t.Fatal("no revert after the failed delete")
+	}
+	if v, _ := f.Get("shater.globals.schema_version"); v == "2" {
+		t.Fatal("schema_version reached v2 with a legacy option still in the config")
+	}
+}
+
+// A rule carrying BOTH lists gets both rule-sets, and keeps every entry.
+func TestMigrate1to2SplitsMixedRuleIntoTwoRulesets(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config rule
+	option name 'mixed'
+	list dst_domain 'regexp:^ads\.'
+	list dst_ip '203.0.113.0/24'
+	option target 'block'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	dom := f.ruleset("rule-mixed")
+	ip := f.ruleset("rule-mixed-ip")
+	if dom == nil || ip == nil {
+		t.Fatalf("want rule-mixed + rule-mixed-ip, got %q", f.rulesetNames())
+	}
+	// `regexp:` crosses over untouched (generate.peelDomainRegexes reads it).
+	if !eqStrings(dom.lists["entry"], []string{`regexp:^ads\.`}) {
+		t.Fatalf("domain entries = %q", dom.lists["entry"])
+	}
+	if !eqStrings(ip.lists["entry"], []string{"203.0.113.0/24"}) {
+		t.Fatalf("ip entries = %q", ip.lists["entry"])
+	}
+	if !eqStrings(f.rule(0).lists["dst_ruleset"], []string{"rule-mixed", "rule-mixed-ip"}) {
+		t.Fatalf("dst_ruleset = %q", f.rule(0).lists["dst_ruleset"])
+	}
+}
+
+// An inert `geosite:` matcher is copied verbatim rather than promoted to a
+// source=geosite list: it matched nothing before the upgrade (the engine's
+// route-rule geosite field is gone) and must not start routing traffic because of
+// one. The text is kept so the operator can see and convert it.
+func TestMigrate1to2KeepsGeoMarkersInert(t *testing.T) {
+	f := newFakeUCI(`package shater
+
+config globals 'globals'
+	option schema_version '1'
+
+config rule
+	option name 'geo'
+	list dst_domain 'geosite:youtube'
+	list dst_ip 'geoip:ru'
+	option target 'direct'
+`)
+	if err := migrateWith(f); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	if got := f.ruleset("rule-geo").lists["entry"]; !eqStrings(got, []string{"geosite:youtube"}) {
+		t.Fatalf("domain entries = %q", got)
+	}
+	if got := f.ruleset("rule-geo-ip").lists["entry"]; !eqStrings(got, []string{"geoip:ru"}) {
+		t.Fatalf("ip entries = %q", got)
+	}
+	for _, s := range f.secs {
+		if s.typ == "ruleset" && s.opts["source"] != "inline" {
+			t.Fatalf("ruleset %q got source %q — a geo marker was promoted", s.opts["name"], s.opts["source"])
+		}
+	}
+}
+
+// A fresh install has no config to export; the migration must succeed silently
+// rather than refuse to boot.
+func TestMigrate1to2NoConfig(t *testing.T) {
+	f := &fakeUCI{missing: true}
+	if err := migrate1to2(f); err != nil {
+		t.Fatalf("migrate on an absent package: %v", err)
+	}
+}
+
+func TestRulesetBaseName(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"ru-direct", "rule-ru-direct"},
+		{"corp nets!", "rule-corp-nets"},
+		{"  spaced  name  ", "rule-spaced-name"},
+		{"Ünïcode", "rule-n-code"}, // non-ASCII is not tag-safe; dropped, leaving a separator
+		{"", "rule-7"},
+		{"!!!", "rule-7"},
+	}
+	for _, c := range cases {
+		if got := rulesetBaseName(c.in, 7); got != c.want {
+			t.Errorf("rulesetBaseName(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+func TestMigrateDomainEntry(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"example.com", "full:example.com"}, // bare: exact in a rule, suffix in a list
+		{"full:example.com", "full:example.com"},
+		{"suffix:example.com", "suffix:example.com"},
+		{"keyword:ads", "keyword:ads"},
+		{`regexp:^a\.b$`, `regexp:^a\.b$`},
+		{".example.com", ".example.com"},
+		{"geosite:youtube", "geosite:youtube"},
+		{"  spaced.example  ", "full:spaced.example"},
+		{"   ", ""},
+	}
+	for _, c := range cases {
+		if got := migrateDomainEntry(c.in); got != c.want {
+			t.Errorf("migrateDomainEntry(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
@@ -633,19 +633,52 @@ type Ruleset struct {
 }

 // Rule is a `config rule` (ordered, first-match).
+//
+// DESTINATION IS ALWAYS A RULE-SET. A rule names WHERE traffic is going only
+// through DstRuleset — there are no inline domain or IP lists on a rule any
+// more (`dst_domain` / `dst_ip` were removed in schema v2; migrate1to2 folds
+// every existing one into a generated `config ruleset` and rewrites the rule to
+// point at it). One destination mechanism means one set of matcher semantics to
+// learn, one place a list is edited, and a list that is compiled once into a
+// .srs and shared by every rule that references it instead of being re-parsed
+// per rule. Src (the CLIENT side), DstPort and Proto are unaffected: they are
+// not lists of destinations and have no rule-set form.
 type Rule struct {
 	Name       string
 	Enabled    bool
 	Order      int
 	Src        []string
-	DstDomain  []string
 	DstRuleset []string
-	DstIP      []string
 	DstPort    string
 	Proto      string
 	Target     string // chain:|group:|node:|direct|block
 	Egress     string

+	// LegacyDst is the UNMIGRATED-RULE TRIPWIRE, and it is a safety device, not a
+	// data field. It is non-empty exactly when the config STILL carries a
+	// schema-v1 `dst_domain`/`dst_ip` on this rule — i.e. migrate1to2 never ran,
+	// or ran and could not commit (a full /overlay is the documented way that
+	// happens). Each element is the raw `<option>=<value>` text, purely so the
+	// warning can quote what it found.
+	//
+	// WHY IT EXISTS. Nothing re-runs the migration on the paths that matter: the
+	// daemon's `run`, the SIGHUP reconcile and the panel's config write all load
+	// UCI directly. The parser no longer reads the two removed options, so an
+	// unmigrated `list dst_domain 'bank.ru'` + `option target 'direct'` parsed as
+	// a rule with NO matchers at all — a catch-all, which generate turns into
+	// route `Final`, which the LAST such rule wins. One un-committed migration
+	// therefore sent the WHOLE router's traffic out the plain WAN, silently.
+	//
+	// WHAT IT DOES. ParseUCIExport forces Enabled=false on such a rule (generate
+	// and the reachability analysis both skip disabled rules), IsCatchAll reports
+	// false for it whatever its matchers say (so it can never become the default
+	// route even if something re-enables it), ApplyProfileRuleOverrides refuses to
+	// enable it, and ValidateRules reports it through the normal apply-warning
+	// channel. It is never rendered back to UCI: render.go emits neither legacy
+	// option, so a panel write drains them out — with `enabled '0'` recorded, so
+	// the rule stays inert until an operator looks at it.
+	LegacyDst []string
+
 	// Kill is the per-rule policy for when the target cannot resolve at generate
 	// time (dead group, chain that would not assemble, missing egress/node). The
 	// rule is ALWAYS still emitted — its traffic never falls through to the
@@ -114,6 +114,22 @@ func ApplyProfileRuleOverrides(rules []Rule, prof *Profile) ([]Rule, []Warning)
 				continue
 			}
 			for _, i := range targets {
+				// A profile may switch a rule OFF freely, but it may not switch an
+				// UNMIGRATED one on: its destination matcher is unreadable (see
+				// Rule.LegacyDst), so enabling it would put a rule into force with
+				// fewer conditions than the operator wrote — in the worst case none
+				// at all, i.e. the router's default route.
+				if enabled && len(out[i].LegacyDst) > 0 {
+					warns = append(warns, Warning{
+						Section: "profile",
+						Name:    prof.Name,
+						Message: fmt.Sprintf("cannot enable rule %q: it still carries the "+
+							"removed dst_domain/dst_ip options, so its destination cannot be "+
+							"read and it stays disabled until the config is migrated "+
+							"(run `shaterd migrate`)", n),
+					})
+					continue
+				}
 				out[i].Enabled = enabled
 			}
 		}
@@ -40,16 +40,31 @@ import (
 	"strings"
 )

-// IsCatchAll reports whether a rule carries NO matcher of any kind (src, dst
-// domain/ip/ruleset, port, proto). Such a rule is the default egress: generate
-// points route `Final` at it rather than emitting a match-all rule.
+// IsCatchAll reports whether a rule carries NO matcher of any kind (src,
+// dst_ruleset, port, proto). Such a rule is the default egress: generate points
+// route `Final` at it rather than emitting a match-all rule.
+//
+// The destination side is now exactly one field — a rule names where traffic is
+// going through DstRuleset alone (schema v2; see model.Rule). A rule that was
+// catch-all before the migration is still catch-all after it, and a rule that
+// carried `dst_domain`/`dst_ip` is not, because the migration gives it a
+// DstRuleset in their place.
+//
+// AN UNMIGRATED RULE IS NEVER A CATCH-ALL. A rule that still carries a
+// schema-v1 `dst_domain`/`dst_ip` (Rule.LegacyDst) has a destination the parser
+// cannot read, so its lack of matchers here means "unreadable", not "everything".
+// Calling it a catch-all is what turned an uncommitted migration into route
+// `Final` for the whole router. ParseUCIExport already holds such a rule
+// disabled; this is the second lock, and it is the one that holds if anything
+// ever hands the rule back its Enabled bit.
 //
 // generate.isCatchAll and the panel's isCatchAll() are the same predicate; this
 // is the one the Go side shares.
 func IsCatchAll(r Rule) bool {
+	if len(r.LegacyDst) > 0 {
+		return false
+	}
 	return len(r.Src) == 0 &&
-		len(r.DstDomain) == 0 &&
-		len(r.DstIP) == 0 &&
 		len(r.DstRuleset) == 0 &&
 		strings.TrimSpace(r.DstPort) == "" &&
 		strings.TrimSpace(r.Proto) == ""
@@ -109,8 +124,36 @@ type RuleReach struct {
 	ShadowedByOrder int    `json:"shadowed_by_order,omitempty"`
 	// Reason is the operator-facing sentence; "" when Unreachable is false.
 	Reason string `json:"reason,omitempty"`
+
+	// EffectiveEnabled is whether the rule is IN FORCE right now — Rule.Enabled
+	// after the active WAN profile's enable/disable overrides. It is NOT the flag
+	// GET /api/config carries: that one is the desired state the panel PUTs back,
+	// and on a router with profiles the two legitimately disagree.
+	//
+	// This field exists because the panel had no way to tell them apart and so drew
+	// the desired state as if it were the truth: a config with `ewan-default` and
+	// `swan-default` both `enabled '1'` in UCI, under a profile that enables the
+	// first and disables the second, showed BOTH switches on while the engine ran
+	// only one chain. Same defect class as the two-`default` shadowing above — the
+	// interface claiming a setting is in force when it is not.
+	EffectiveEnabled bool `json:"effective_enabled"`
+	// OverriddenBy names the active profile that CHANGED this rule's state, and
+	// Override says which way it went: "enabled" or "disabled". Both are empty
+	// unless the profile actually flipped the outcome — a profile that disables a
+	// rule already switched off in UCI has overridden nothing the operator can see,
+	// and saying otherwise would put a profile's name on every row it merely
+	// mentions.
+	OverriddenBy string `json:"overridden_by,omitempty"`
+	Override     string `json:"override,omitempty"`
 }

+// Override directions carried by RuleReach.Override. Values are part of the
+// /api/rules/reachability contract; the panel switches on them.
+const (
+	RuleOverrideEnabled  = "enabled"
+	RuleOverrideDisabled = "disabled"
+)
+
 // RuleReachability returns one verdict per rule, in the INPUT slice's order.
 //
 // The input must already be the EFFECTIVE rule set — profile enable/disable
@@ -132,6 +175,10 @@ func RuleReachability(rules []Rule) []RuleReach {
 	for i := range rules {
 		out[i] = RuleReach{
 			Index: i, Name: rules[i].Name, Order: rules[i].Order, ShadowedByIndex: -1,
+			// The input IS the effective set (see the doc comment), so its Enabled flag
+			// is the effective one. Who overrode it — if anyone — is not knowable from
+			// this slice alone; Model.EffectiveRuleReachability fills that in.
+			EffectiveEnabled: rules[i].Enabled,
 		}
 	}

@@ -193,3 +240,46 @@ func (m *Model) EffectiveRules() ([]Rule, []Warning) {
 	rules, owarns := ApplyProfileRuleOverrides(m.Rules, prof)
 	return rules, append(warns, owarns...)
 }
+
+// EffectiveRuleReachability is RuleReachability over m's EFFECTIVE rules, with
+// each verdict annotated by the active profile's override. It returns one verdict
+// per rule in m.Rules, at the SAME index — ApplyProfileRuleOverrides returns a
+// same-length copy in the same order, and RuleReachability preserves its input's
+// order, so a client can zip the result with GET /api/config's `Rules`.
+//
+// The override annotation is a DIFF, not a second reading of the profile's name
+// lists: a verdict is marked only where the effective flag actually differs from
+// the desired-state one. That is deliberate on both counts —
+//
+//   - it cannot drift from ApplyProfileRuleOverrides, because it observes that
+//     function's output rather than re-deciding what it should have done (an
+//     unmigrated rule the profile is forbidden to enable, for instance, produces no
+//     diff and therefore no annotation, with nothing here having to know the rule);
+//   - and it answers the question the operator is actually asking, which is not
+//     "does the profile mention this rule" but "is this row's switch telling me the
+//     truth".
+func (m *Model) EffectiveRuleReachability() ([]RuleReach, []Warning) {
+	if m == nil {
+		return []RuleReach{}, nil
+	}
+	prof, warns := ResolveActiveProfile(m)
+	eff, owarns := ApplyProfileRuleOverrides(m.Rules, prof)
+	warns = append(warns, owarns...)
+
+	out := RuleReachability(eff)
+	if prof == nil {
+		return out, warns
+	}
+	for i := range out {
+		if i >= len(m.Rules) || m.Rules[i].Enabled == eff[i].Enabled {
+			continue
+		}
+		out[i].OverriddenBy = prof.Name
+		if eff[i].Enabled {
+			out[i].Override = RuleOverrideEnabled
+		} else {
+			out[i].Override = RuleOverrideDisabled
+		}
+	}
+	return out, warns
+}
@@ -216,8 +216,8 @@ func TestReachabilityUnsortedInputIsJudgedByOrder(t *testing.T) {
 func TestReachabilityMatcherKindsAreNotCatchAll(t *testing.T) {
 	conditional := []Rule{
 		{Name: "by-src", Enabled: true, Order: 10, Target: "direct", Src: []string{"192.168.1.0/24"}},
-		{Name: "by-domain", Enabled: true, Order: 11, Target: "direct", DstDomain: []string{"example.com"}},
-		{Name: "by-ip", Enabled: true, Order: 12, Target: "direct", DstIP: []string{"1.1.1.1/32"}},
+		// The destination side is one field now (schema v2): a domain list and an
+		// address list are both `config ruleset`s a rule points dst_ruleset at.
 		{Name: "by-ruleset", Enabled: true, Order: 13, Target: "direct", DstRuleset: []string{"ads"}},
 		{Name: "by-port", Enabled: true, Order: 14, Target: "direct", DstPort: "443"},
 		{Name: "by-proto", Enabled: true, Order: 15, Target: "direct", Proto: "quic"},
@@ -9,7 +9,9 @@ package model
 // the same uciRunner seam the migrations use).

 import (
+	"errors"
 	"fmt"
+	"reflect"
 	"strconv"
 	"strings"
 )
@@ -33,6 +35,14 @@ import (
 // ParseUCIExport already carries those defaults as concrete values, so the
 // panel's read→edit→write flow round-trips exactly. See render_test.go.
 //
+// Rule.LegacyDst IS emitted (as the `dst_domain`/`dst_ip` it names), because a
+// write over an unmigrated config must not erase the operator's lists. This
+// function is PURE and therefore trusts the Model it is given — so a Model whose
+// LegacyDst did not come from the config on disk would have it written to disk.
+// writeUCIWith is what guarantees the field's provenance (withDiskLegacyDst), and
+// it is the only non-test caller; any future caller that persists the result owes
+// the same guarantee.
+//
 // Subscription-cache nodes (FromSub != "") are NOT emitted at all: they live in
 // per-subscription JSON cache files (see subcache.go) and are folded back in by
 // ReadUCI's MergeSubCaches. Only manual nodes become `config node` sections, and
@@ -211,9 +221,12 @@ func RenderUCIExport(m *Model) string {
 		w.boolOpt("enabled", r.Enabled)
 		w.intOpt("order", r.Order)
 		w.listOpt("src", r.Src)
-		w.listOpt("dst_domain", r.DstDomain)
+		// dst_domain / dst_ip are never SYNTHESISED (they are not part of schema v2)
+		// — but they ARE written back when the rule still carries them, so a write
+		// that is allowed to proceed over an unmigrated config cannot erase them.
+		// See legacyDstOpts and guardUnmigratedConfig.
+		w.legacyDstOpts(r.LegacyDst)
 		w.listOpt("dst_ruleset", r.DstRuleset)
-		w.listOpt("dst_ip", r.DstIP)
 		w.strOpt("dst_port", r.DstPort)
 		w.strOpt("proto", r.Proto)
 		w.strOpt("target", r.Target)
@@ -376,6 +389,40 @@ func (w *uciWriter) listOpt(k string, vs []string) {
 	}
 }

+// legacyDstOpts re-emits the schema-v1 `dst_domain`/`dst_ip` a rule STILL carries
+// on disk (Rule.LegacyDst, `<option>=<value>` text produced by legacyDstEntries).
+//
+// This is preservation, not support. A write over an unmigrated config is only
+// ever allowed when it does not touch the rules at all (guardUnmigratedConfig) —
+// a subscription refresh writing quota counters, the profile watcher switching
+// the active profile. Those writers re-render the WHOLE package, so without this
+// the operator's destination lists would be erased by a cron job, which is the
+// same data loss the guard exists to prevent, just triggered from a different
+// place. Writing them back keeps the config exactly as unmigrated as it was, so
+// `shaterd migrate` can still do its job afterwards.
+//
+// Only the two known keys with a non-empty value are emitted: LegacyDst may be
+// filled by a client (the panel PUTs back the model it GETs), and this must not
+// become a way to inject arbitrary `list <anything>` lines into the config.
+func (w *uciWriter) legacyDstOpts(entries []string) {
+	for _, e := range entries {
+		i := strings.IndexByte(e, '=')
+		if i <= 0 {
+			continue
+		}
+		k, v := e[:i], e[i+1:]
+		if v == "" {
+			continue
+		}
+		for _, known := range legacyDstOptions {
+			if k == known {
+				fmt.Fprintf(&w.b, "\tlist %s %s\n", k, renderQuote(v))
+				break
+			}
+		}
+	}
+}
+
 // renderQuote single-quotes a value and escapes embedded single quotes the uci
 // way (`'\”`), mirroring uci.go's unquote.
 //
@@ -423,8 +470,170 @@ func WriteUCI(m *Model) error {
 	return writeUCIWith(uci, m)
 }

+// ErrUnmigratedConfig is what every config write fails with when the config ON
+// DISK still carries the schema-v1 rule destinations and the write would change
+// the rules. Callers match it with errors.Is to tell this refusal (a config the
+// operator can fix with one command) apart from a real I/O failure — the panel
+// answers 409 with the message rather than a bare 500.
+var ErrUnmigratedConfig = errors.New("config not migrated to schema v2")
+
+// CheckConfigWritable reports whether persisting m would be refused, WITHOUT
+// writing anything. It is the same check WriteUCI runs, exported so a caller that
+// does several writes in one request can find out before the first of them lands:
+// the panel's PUT /api/config writes the subscription node caches first, and
+// discovering the refusal only at the UCI step would leave those caches rewritten
+// for a request that was rejected.
+func CheckConfigWritable(m *Model) error {
+	disk, ok := diskRules(uci)
+	return guardUnmigratedConfig(disk, ok, m)
+}
+
+// diskRules returns the rules of the config CURRENTLY on disk, and whether they
+// could be read at all. ok=false covers a fresh install (no package) and an
+// export that will not parse — the two cases where there is nothing on disk to
+// protect and nothing to copy from.
+//
+// It is read ONCE per write and handed to both guardUnmigratedConfig and
+// withDiskLegacyDst: they answer two halves of the same question ("may this write
+// proceed?" / "what may it say about the legacy options?") and must not be able
+// to see different configs.
+func diskRules(u uciRunner) ([]Rule, bool) {
+	text, ok := u.Export("shater")
+	if !ok || strings.TrimSpace(text) == "" {
+		return nil, false
+	}
+	disk, err := ParseUCIExport(text)
+	if err != nil {
+		return nil, false
+	}
+	return disk.Rules, true
+}
+
+// withDiskLegacyDst returns m with every rule's LegacyDst forced to what the DISK
+// says, so the renderer can never be told about a legacy option that is not
+// really there. m is not modified: the rules are copied when (and only when)
+// something actually differs.
+//
+// WHY. LegacyDst is a safety device, and PUT /api/config decodes the whole Model
+// out of the request body — including this field. On a healthy, migrated config
+// the guard above returns early (there is nothing to protect), and the renderer
+// would then have written a fabricated `list dst_domain 'example.com'` straight
+// into /etc/config/shater. No traffic leak — everything downstream fails closed —
+// but an authenticated client could switch off any rule it named and lock the box
+// out of saving its config until someone ran `shaterd migrate`, and the warning
+// explaining it would have blamed a migration that never had anything to do with
+// it. Taking the value from disk removes the input entirely.
+//
+// In the branch where the disk DOES carry legacy options, the guard has already
+// established reflect.DeepEqual(disk.Rules, m.Rules), so the substitution is a
+// no-op there by construction — this is purely the sanitiser for everything else.
+// When the disk is unreadable there is nothing to preserve, so every LegacyDst is
+// cleared: a fabricated one must never be the reason an option appears on disk.
+func withDiskLegacyDst(disk []Rule, ok bool, m *Model) *Model {
+	if m == nil {
+		return m
+	}
+	want := func(i int) []string {
+		if !ok || i >= len(disk) {
+			return nil
+		}
+		return disk[i].LegacyDst
+	}
+	differs := false
+	for i := range m.Rules {
+		if !reflect.DeepEqual(m.Rules[i].LegacyDst, want(i)) {
+			differs = true
+			break
+		}
+	}
+	if !differs {
+		return m
+	}
+	out := *m
+	out.Rules = append([]Rule(nil), m.Rules...)
+	for i := range out.Rules {
+		out.Rules[i].LegacyDst = want(i)
+	}
+	return &out
+}
+
+// guardUnmigratedConfig refuses a write that would silently destroy schema-v1
+// rule destinations still present on disk.
+//
+// WHY IT READS THE DISK AND NOT THE MODEL. The Model handed to WriteUCI is not
+// trustworthy: PUT /api/config decodes one straight out of the request body, and
+// the body belongs to the client (an older panel build, curl, a script). A check
+// phrased as "refuse when m has LegacyDst" is defeated by simply omitting the
+// field — and that omission is precisely the dangerous request, because
+// RenderUCIExport would then write the rule with `enabled '1'` and NO destination
+// at all, which the next read parses as a catch-all and generate turns into route
+// `Final` for the entire router. Only the config already on disk can say whether
+// there is anything to protect, so that is what is consulted.
+//
+// WHAT IT ALLOWS. A write whose rules are IDENTICAL to the ones on disk goes
+// through, and legacyDstOpts writes the legacy options back with it. That keeps
+// the non-panel writers working on an unmigrated box — a subscription refresh
+// persisting quota counters and manual nodes (apply.refreshSubscription,
+// `shaterd sub update`) and the profile watcher switching globals.active_profile
+// — none of which has any business editing rules. They all build their Model with
+// ReadUCI, so their rules ARE the disk's, byte for byte, including the LegacyDst
+// the parser attached. Nothing about a migrated config changes: with no legacy
+// options on disk the function returns nil before comparing anything.
+//
+// An unreadable/unparseable export is treated as "nothing to protect" (ok=false
+// from diskRules). It cannot be distinguished from a fresh install here, and
+// refusing every write on a malformed file would leave the box unconfigurable
+// through its only UI.
+func guardUnmigratedConfig(disk []Rule, ok bool, m *Model) error {
+	if !ok {
+		return nil // fresh install / unreadable: no config to lose
+	}
+	var stuck []string
+	for i, r := range disk {
+		if len(r.LegacyDst) == 0 {
+			continue
+		}
+		if r.Name != "" {
+			stuck = append(stuck, strconv.Quote(r.Name))
+		} else {
+			stuck = append(stuck, "#"+strconv.Itoa(i))
+		}
+	}
+	if len(stuck) == 0 {
+		return nil // migrated (the normal case): nothing to guard
+	}
+	if m != nil && reflect.DeepEqual(disk, m.Rules) {
+		return nil // the rules are untouched; legacyDstOpts carries them across
+	}
+	return fmt.Errorf("%w: rule %s still carr%s the removed dst_domain/dst_ip "+
+		"options, and this config has no place to write them — saving would erase "+
+		"the destination lists and leave the rule matching nothing (or, worse, "+
+		"everything). The write was REFUSED and nothing on disk changed. Run "+
+		"`shaterd migrate` on the router to fold each list into a rule-set, then "+
+		"reload and save again.",
+		ErrUnmigratedConfig, strings.Join(stuck, ", "), plural(len(stuck), "ies", "y"))
+}
+
+// plural picks the suffix for a count (carries/carry).
+func plural(n int, one, many string) string {
+	if n == 1 {
+		return one
+	}
+	return many
+}
+
 func writeUCIWith(u uciRunner, m *Model) error {
-	text := RenderUCIExport(m)
+	// ONE read of the disk feeds both halves of the protection below.
+	disk, ok := diskRules(u)
+	// Refuse BEFORE the delete+import: writeUCIWith replaces the whole package, so
+	// by the time an import has run the legacy options are already gone.
+	if err := guardUnmigratedConfig(disk, ok, m); err != nil {
+		return err
+	}
+	// Render from the DISK's idea of which rules carry legacy options, never the
+	// caller's — RenderUCIExport is a pure function and will faithfully emit a
+	// `list dst_domain` for anything it is told about.
+	text := RenderUCIExport(withDiskLegacyDst(disk, ok, m))
 	var errs []string
 	// Clear the staged package first so `uci import` replaces rather than merges
 	// (import appends sections; without the delete a second write would duplicate
@@ -1,6 +1,7 @@
 package model

 import (
+	"errors"
 	"reflect"
 	"strings"
 	"testing"
@@ -84,8 +85,7 @@ func richModel() *Model {
 		}},
 		Rules: []Rule{{
 			Name: "pc", Enabled: true, Order: 10,
-			Src: []string{"192.168.1.1/32"}, DstDomain: []string{"geosite:telegram"},
-			DstRuleset: []string{"ads"}, DstIP: []string{"1.1.1.1/32"},
+			Src: []string{"192.168.1.1/32"}, DstRuleset: []string{"ads"},
 			DstPort: "443", Proto: "tcp,udp", Target: "chain:triple", Egress: "frag",
 			Kill: "default", SchedEnabled: true, SchedDays: []string{"mon", "tue"},
 			SchedStart: "08:00", SchedEnd: "22:00", SchedUTCOffset: 180,
@@ -384,7 +384,7 @@ func TestRenderSkipsSubCacheNodes(t *testing.T) {
 // and COMMITs — and the imported text re-parses to the original Model.
 func TestWriteUCIReplaces(t *testing.T) {
 	m := richModel()
-	f := &fakeUCI{kv: map[string]string{}}
+	f := newFakeUCI("")
 	if err := writeUCIWith(f, m); err != nil {
 		t.Fatalf("writeUCIWith: %v", err)
 	}
@@ -418,3 +418,210 @@ func TestWriteUCIReplaces(t *testing.T) {
 		t.Fatalf("second write duplicated sections: nodes=%d rules=%d", len(got2.Nodes), len(got2.Rules))
 	}
 }
+
+// --- write-path guard: an unmigrated config may not be overwritten ------------
+
+// unmigratedOnDisk is a v1 config as it sits on the router when `shaterd migrate`
+// never got to commit: two rules whose destination is still an inline list, plus
+// a subscription whose quota counters a refresh wants to update.
+const unmigratedOnDisk = `package shater
+
+config globals 'globals'
+	option enabled '1'
+	option schema_version '1'
+
+config subscription
+	option name 'qomar'
+	option url 'https://example.invalid/sub'
+
+config rule
+	option name 'bank'
+	option enabled '1'
+	list dst_domain 'bank.ru'
+	option target 'direct'
+
+config rule
+	option name 'default'
+	option enabled '1'
+	option target 'group:auto'
+`
+
+// A write that would change the rules of an unmigrated config is REFUSED, and the
+// on-disk config is byte-identical afterwards. Without this the renderer (which
+// emits no dst_domain/dst_ip) simply dropped the operator's lists on the first
+// save from the panel.
+func TestWriteUCIRefusesToOverwriteAnUnmigratedConfig(t *testing.T) {
+	f := newFakeUCI(unmigratedOnDisk)
+	before, _ := f.Export("shater")
+
+	m, err := ParseUCIExport(before)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	m.Rules[0].Order = 42 // any rule edit at all
+
+	err = writeUCIWith(f, m)
+	if err == nil {
+		t.Fatal("the write was allowed to erase the legacy destination lists")
+	}
+	if !errors.Is(err, ErrUnmigratedConfig) {
+		t.Fatalf("error is not ErrUnmigratedConfig: %v", err)
+	}
+	for _, want := range []string{`"bank"`, "dst_domain", "shaterd migrate", "REFUSED"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("message does not mention %q: %s", want, err)
+		}
+	}
+	if after, _ := f.Export("shater"); after != before {
+		t.Fatalf("the config on disk changed despite the refusal:\n--- before\n%s\n--- after\n%s", before, after)
+	}
+	if f.commits != 0 || len(f.deleted) != 0 {
+		t.Fatalf("the refused write still touched uci (commits=%d deleted=%v)", f.commits, f.deleted)
+	}
+}
+
+// The guard reads the DISK, not the submitted model — so a body that simply omits
+// LegacyDst and sets Enabled cannot get a destination-less rule written with
+// `enabled '1'`. That rule would parse back as a catch-all and become route Final
+// for the whole router, which is the leak the parser guard closes on the read
+// side and this closes on the write side.
+func TestWriteUCIRefusesACraftedModelWithoutLegacyDst(t *testing.T) {
+	f := newFakeUCI(unmigratedOnDisk)
+	before, _ := f.Export("shater")
+
+	// Exactly what a hand-rolled PUT (or an older panel build) sends: the rule is
+	// there, enabled, and the field that marks it unmigrated is gone.
+	crafted := &Model{
+		Globals: DefaultGlobals(),
+		Rules: []Rule{
+			{Name: "bank", Enabled: true, Target: "direct"},
+			{Name: "default", Enabled: true, Target: "group:auto"},
+		},
+	}
+	if err := writeUCIWith(f, crafted); !errors.Is(err, ErrUnmigratedConfig) {
+		t.Fatalf("crafted body was accepted (err = %v)", err)
+	}
+	after, _ := f.Export("shater")
+	if after != before {
+		t.Fatalf("disk changed:\n--- before\n%s\n--- after\n%s", before, after)
+	}
+	if strings.Contains(after, "config rule\n\toption name 'bank'\n\toption enabled '1'\n\toption target") {
+		t.Fatal("a destination-less enabled rule reached the disk")
+	}
+	// And re-reading the disk still yields the protected shape.
+	m, err := ParseUCIExport(after)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if IsCatchAll(m.Rules[0]) || m.Rules[0].Enabled {
+		t.Fatal("the unmigrated rule lost its protection")
+	}
+}
+
+// A writer that does NOT touch the rules keeps working on an unmigrated box, and
+// the legacy options survive the write. This is the subscription-refresh path
+// (apply.UpdateSubscription / `shaterd sub update`) and the profile watcher: they
+// build their model with ReadUCI, change a counter or globals.active_profile, and
+// re-render the WHOLE package — so a blanket refusal would break a cron job, and
+// a blanket allow would let that cron job erase the operator's lists.
+func TestWriteUCIPreservesLegacyDstOnANonRuleWrite(t *testing.T) {
+	f := newFakeUCI(unmigratedOnDisk)
+	text, _ := f.Export("shater")
+	m, err := ParseUCIExport(text)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	// Exactly what subscribe.StoreUserInfo does.
+	m.Subscriptions[0].UserDownload = 1 << 40
+	m.Subscriptions[0].UserInfoAt = 1700000000
+	m.Globals.ActiveProfile = "home"
+
+	if err := writeUCIWith(f, m); err != nil {
+		t.Fatalf("a non-rule write was refused: %v", err)
+	}
+
+	after, _ := f.Export("shater")
+	got, err := ParseUCIExport(after)
+	if err != nil {
+		t.Fatalf("re-parse: %v", err)
+	}
+	if got.Subscriptions[0].UserDownload != 1<<40 || got.Globals.ActiveProfile != "home" {
+		t.Fatalf("the write did not land: %+v / %q", got.Subscriptions[0], got.Globals.ActiveProfile)
+	}
+	if !eqStrings(got.Rules[0].LegacyDst, []string{"dst_domain=bank.ru"}) {
+		t.Fatalf("the legacy destination list was erased: %q", got.Rules[0].LegacyDst)
+	}
+	if got.Rules[0].Enabled || IsCatchAll(got.Rules[0]) {
+		t.Fatal("the rule lost its unmigrated protection across the write")
+	}
+	// The config is still exactly as unmigrated as it was, so `shaterd migrate`
+	// can still fold the list into a rule-set afterwards.
+	if err := migrate1to2(f); err != nil {
+		t.Fatalf("migrate after the write: %v", err)
+	}
+	if f.ruleset("rule-bank") == nil {
+		t.Fatalf("migration found nothing to fold; rulesets = %q", f.rulesetNames())
+	}
+}
+
+// A fabricated LegacyDst in the submitted model must never reach the disk. On a
+// MIGRATED config the guard has nothing to protect and returns early, so without
+// withDiskLegacyDst the renderer happily wrote the client's `list dst_domain`
+// into /etc/config/shater — and from there every downstream lock fired on a lie:
+// the rule the client named went (and stayed) disabled, further rule writes were
+// refused, and the warning blamed a migration that had never been involved.
+func TestWriteUCIIgnoresAFabricatedLegacyDst(t *testing.T) {
+	const migratedOnDisk = `package shater
+
+config globals 'globals'
+	option enabled '1'
+	option schema_version '2'
+
+config rule
+	option name 'bank'
+	option enabled '1'
+	list dst_ruleset 'rule-bank'
+	option target 'direct'
+`
+	f := newFakeUCI(migratedOnDisk)
+	text, _ := f.Export("shater")
+	m, err := ParseUCIExport(text)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if len(m.Rules[0].LegacyDst) != 0 {
+		t.Fatal("fixture is not migrated")
+	}
+	// Exactly what a crafted PUT body carries.
+	m.Rules[0].LegacyDst = []string{"dst_domain=example.com", "dst_ip=203.0.113.0/24"}
+
+	if err := writeUCIWith(f, m); err != nil {
+		t.Fatalf("writeUCIWith: %v", err)
+	}
+	after, _ := f.Export("shater")
+	for _, forbidden := range []string{"dst_domain", "dst_ip"} {
+		if strings.Contains(after, forbidden) {
+			t.Fatalf("a fabricated %s reached the disk:\n%s", forbidden, after)
+		}
+	}
+	got, err := ParseUCIExport(after)
+	if err != nil {
+		t.Fatalf("re-parse: %v", err)
+	}
+	if len(got.Rules[0].LegacyDst) != 0 {
+		t.Fatalf("rule came back unmigrated: %q", got.Rules[0].LegacyDst)
+	}
+	// Enabled is whatever was submitted — the fabrication must not have switched
+	// the rule off either.
+	if !got.Rules[0].Enabled {
+		t.Fatal("the fabricated field disabled a healthy rule")
+	}
+	// And the caller's model was not mutated behind its back.
+	if len(m.Rules[0].LegacyDst) != 2 {
+		t.Fatalf("writeUCIWith mutated the caller's model: %q", m.Rules[0].LegacyDst)
+	}
+	// The config is still writable: nothing latched.
+	if err := writeUCIWith(f, got); err != nil {
+		t.Fatalf("the config became unwritable: %v", err)
+	}
+}
@@ -74,6 +74,14 @@ func fullModel() *Model {
 	m.Nodes[0].FromSub = ""
 	m.Nodes[0].Fingerprint = ""
 	m.Nodes[0].Stale = false
+	// Rule.LegacyDst is exempt because it is not a field with a value of its own:
+	// each element is `<option>=<value>` naming one of exactly two removed options,
+	// and uciWriter.legacyDstOpts deliberately drops anything else so a client
+	// cannot inject arbitrary `list` lines through it. fillNonZero's generic
+	// "s-legacydst-1" is precisely such an anything-else, so it cannot round-trip
+	// by construction. The real round-trip (parse a legacy option -> render it back
+	// unchanged) is pinned by TestWriteUCIPreservesLegacyDstOnANonRuleWrite.
+	m.Rules[0].LegacyDst = nil
 	return m
 }

@@ -174,14 +174,39 @@ func ParseUCIExport(text string) (*Model, error) {
 				Entries:        s.list("entry"),
 			})
 		case "rule":
+			// dst_domain / dst_ip were REMOVED in schema v2: a rule's destination is
+			// a rule-set reference and nothing else, and migrate1to2 (migrate.go)
+			// folds any legacy inline list into a `config ruleset` and points
+			// dst_ruleset at it.
+			//
+			// The migration is NOT re-run on every load — it runs from the service
+			// init and from uci-defaults at package install (`shaterd migrate`), and
+			// from nowhere else: the daemon's `run`, the SIGHUP reconcile and the
+			// panel's config write all come straight here. So a config that still
+			// carries the options is a real, reachable state — an interrupted or
+			// uncommittable migration (a full /overlay is the documented way that
+			// happens), or a hand edit after a downgrade.
+			//
+			// Ignoring them there was NOT safe. A rule whose only matcher was
+			// `dst_domain` parsed as a rule with NO matchers, which IS the spelling
+			// of a catch-all: generate points route `Final` at it and the last such
+			// rule wins, so `dst_domain bank.ru` + `target direct` quietly became
+			// "send EVERYTHING out the plain WAN". legacyDstEntries detects the live
+			// options; a rule that has them is held DISABLED here and is reported by
+			// ValidateRules, and Rule.LegacyDst keeps IsCatchAll/profile overrides
+			// from resurrecting it. See the field's doc comment in model.go.
+			legacyDst := legacyDstEntries(s)
 			m.Rules = append(m.Rules, Rule{
-				Name:         firstNonEmpty(s.opt("name"), s.Name),
-				Enabled:      s.optBool("enabled", true),
+				Name: firstNonEmpty(s.opt("name"), s.Name),
+				// An unmigrated rule is never in force. Its destination matcher is
+				// unreadable, so every alternative — routing it without the matcher,
+				// or treating the absence as "matches everything" — states a policy
+				// the operator did not write.
+				Enabled:      s.optBool("enabled", true) && len(legacyDst) == 0,
 				Order:        parseInt(s.opt("order"), 0),
 				Src:          s.list("src"),
-				DstDomain:    s.list("dst_domain"),
+				LegacyDst:    legacyDst,
 				DstRuleset:   s.list("dst_ruleset"),
-				DstIP:        s.list("dst_ip"),
 				DstPort:      s.opt("dst_port"),
 				Proto:        s.opt("proto"),
 				Target:       s.opt("target"),
@@ -335,6 +360,40 @@ func applyGlobals(g *Globals, s uciSection) {
 	g.StatsDiskLimitMB = parseInt(s.opt("stats_disk_limit_mb"), g.StatsDiskLimitMB)
 }

+// legacyDstOptions are the `config rule` options schema v2 removed. Their mere
+// PRESENCE on a rule proves the config was not migrated (migrate1to2 deletes them
+// as its last step per rule, and only once the replacement rule-set reference is
+// in place).
+var legacyDstOptions = []string{"dst_domain", "dst_ip"}
+
+// legacyDstEntries returns the live schema-v1 destination entries of a rule
+// section as `<option>=<value>` text, or nil when there are none.
+//
+// PRESENCE, not content, is the test. A `list dst_domain '  '` is kept as an
+// entry even though it names no domain: the value is junk, but the OPTION being
+// there still means the migration did not process this rule, and dropping the
+// blank would hand the rule back its catch-all shape — the exact leak this
+// detection exists to stop. (A truly empty `list dst_domain ”` never reaches
+// here: parseSections drops empty list values, so the key is simply absent, and
+// such a rule had no destination under v1 either.)
+func legacyDstEntries(s uciSection) []string {
+	var out []string
+	for _, k := range legacyDstOptions {
+		vals, ok := s.Lists[k]
+		if !ok {
+			continue
+		}
+		if len(vals) == 0 {
+			out = append(out, k+"=")
+			continue
+		}
+		for _, v := range vals {
+			out = append(out, k+"="+v)
+		}
+	}
+	return out
+}
+
 // --- section accessors ---

 func (s uciSection) opt(k string) string { return s.Options[k] }
@@ -59,7 +59,7 @@ config rule
 	option enabled '1'
 	option order '10'
 	list src '192.168.11.14/32'
-	list dst_domain 'geosite:telegram'
+	list dst_ruleset 'ads'
 	option dst_port '443'
 	option proto 'tcp,udp'
 	option target 'chain:triple'
--- a/Show More
+++ b/Show More