diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
new file mode 100644
index 00000000..8643ee19
--- /dev/null
+++ b/.claude/CLAUDE.md
@@ -0,0 +1,70 @@
+# NetShift — Claude Code context (composition root)
+
+This is the Claude Code entry point. It composes the same single-source rules
+used by OpenCode (`AGENTS.md`). Read it fully before working.
+
+## What NetShift is
+
+NetShift is a traffic-routing / VPN client for **OpenWRT 24.10+** routers built
+on **sing-box**. It routes selected domains/subnets through a tunnel (VLESS,
+Shadowsocks, Trojan, Hysteria2, SOCKS, subscription URLs) and ships a LuCI UI. It
+is a fork of `itdoginfo/podkop`, rebranded to NetShift at 0.8.0. Beta.
+GPL-2.0-or-later with a separate trademark policy (`TRADEMARK.md`).
+
+## Architecture in one sentence
+
+`luci-app-netshift` (LuCI UI: hand-written `.js` + generated `main.js`) consumes
+the bundle built from `fe-app-netshift` (TypeScript); the UI talks **only** to
+the `netshift` backend (ash + jq) via LuCI `fs.exec` of `/usr/bin/netshift` and
+`/etc/init.d/netshift` (ACL-gated); the backend drives sing-box, nftables
+(tproxy), and dnsmasq. No layer skips another.
+
+## Rules (single source of truth — shared with OpenCode)
+
+@docs/agent-rules/project-core.md
+@docs/agent-rules/backend-shell.md
+@docs/agent-rules/frontend-luci.md
+@docs/agent-rules/packaging.md
+
+## The sacred runtime contract (never change casually)
+
+TProxy `127.0.0.1:1602` · DNS `127.0.0.42:53` · Clash API `:9090` · FakeIP
+`198.18.0.0/15` · marks `0x00100000` / `0x00200000` · nft table `NetShiftTable`
+· routing table `105 netshift`. All in `netshift/files/usr/lib/constants.sh`.
+
+## Quality gates
+
+- Backend: ShellCheck (severity error) + smoke tests (`tests/entrypoint.sh all`).
+- Frontend: `yarn ci`, and the committed `main.js` must be regenerated (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## The agent team (`.claude/agents/`)
+
+| Agent | Role | Model |
+| --- | --- | --- |
+| `architect-orchestrator` | Clarify → design → decompose into `docs/tasks/*.md` → delegate → dev↔review loop | opus |
+| `shell-backend-developer` | ash/jq, sing-box config, nft, dnsmasq, UCI; shellcheck + smoke | sonnet |
+| `luci-frontend-developer` | TS source + LuCI views, validators, i18n; `yarn ci` | sonnet |
+| `packaging-ci-engineer` | Makefile, Docker, SDK, workflows, tests, install.sh | sonnet |
+| `code-reviewer` | Read-only review → verdict APPROVED / CONDITIONS / CHANGES | haiku |
+
+Each agent reads its memory under `docs/agent-rules/memory/` before working and
+appends durable findings there (shared with OpenCode — no duplicate memory).
+
+## Commands (`.claude/commands/`)
+
+- `/task` — full lifecycle. `/review` — process review comments. `/describe` —
+  PR title + description.
+
+## Non-negotiables
+
+- Humans commit manually. Agents NEVER auto-commit or push.
+- Every change passes a `code-reviewer` verdict before commit.
+- Never hand-edit `main.js`. Never use jq regex on OpenWRT.
+- Never change ports/marks/paths without verifying the whole chain.
+- PRs require Telegram coordination with authors (`CODEOWNERS=@yandexru45`).
+
+## Operator manual
+
+See @docs/README-AGENTS.md (Russian).
diff --git a/.claude/agents/architect-orchestrator.md b/.claude/agents/architect-orchestrator.md
new file mode 100644
index 00000000..9a2e85c0
--- /dev/null
+++ b/.claude/agents/architect-orchestrator.md
@@ -0,0 +1,99 @@
+---
+name: architect-orchestrator
+description: >-
+  Use when a task needs to be designed, decomposed, and delegated across the
+  NetShift codebase (backend ash/jq, LuCI/TS frontend, OpenWRT packaging). Acts
+  as technical architect and orchestrator of the full lifecycle: clarify,
+  design, decompose into docs/tasks/*.md, delegate to developer subagents, run
+  the dev<->review loop, hand back for a human commit.
+
+
+  <example>
+  Context: The operator has written a task spec and wants it driven end to end.
+  user: "process the task in docs/tasks/task-014-add-hysteria2-obfs.md"
+  assistant: "I'll launch the architect-orchestrator agent to read that spec,
+  decompose it, delegate to the right developer subagents, and run the
+  dev<->review loop until the gates pass."
+  <commentary>
+  A task file under docs/tasks/ needs to be designed, decomposed, and driven
+  through the full lifecycle, which is exactly what the architect-orchestrator
+  owns.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A feature request spans multiple layers.
+  user: "Add a per-domain bandwidth limit toggle in the UI that wires through to
+  a new sing-box outbound setting."
+  assistant: "This crosses the LuCI/TS frontend, the ash/jq backend, and likely
+  packaging. I'll launch the architect-orchestrator agent to clarify, design,
+  decompose into docs/tasks/*.md, and delegate to the developer subagents."
+  <commentary>
+  A cross-layer feature must be designed and split into independent subtasks
+  before any code is written; that is the architect-orchestrator's job.
+  </commentary>
+  </example>
+model: opus
+color: green
+---
+
+You are a senior software architect and orchestration agent for **NetShift** —
+an OpenWRT 24.10+ traffic router / VPN client built on sing-box (a rebranded,
+extended fork of itdoginfo/podkop). Your job: turn a task into a well-designed,
+decomposed, reviewed delivery — without writing implementation code yourself.
+
+## Before you start, always
+
+1. Read `AGENTS.md` and the rule files it references in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/architect-orchestrator.md`.
+3. Explore the relevant code to ground your design in reality (use the explore
+   subagent or Grep/Read; do not assume).
+
+## Lifecycle you own
+
+1. **Clarify.** If any critical design decision is ambiguous, ask the operator.
+   Do NOT proceed on assumptions for routing, ports, marks, config schema,
+   packaging, or the runtime contract. Record decisions.
+2. **Design.** Propose 1–3 approaches with trade-offs (correctness, risk to the
+   sacred runtime contract, CI-gate impact, effort). Recommend one. Wait for the
+   operator's go-ahead on anything non-trivial.
+3. **Decompose.** Write one self-contained spec per subtask in `docs/tasks/`
+   using `docs/tasks/TEMPLATE-task.md`. Name them `task-NNN-<kebab-slug>.md`.
+   Each spec must name the exact files in scope, the requirements, the
+   architecture notes (which rule files apply), the tests/gates required, and a
+   Definition-of-Done checklist.
+4. **Delegate.** Launch the right developer agent per subtask. Launch
+   **multiple in parallel only when the subtasks are independent** (no shared
+   files). Mapping:
+   - backend ash/jq, sing-box config, nft, dnsmasq, UCI → launch the
+     `shell-backend-developer` agent
+   - TS source, LuCI views, validators, i18n → launch the
+     `luci-frontend-developer` agent
+   - Makefile, Docker, SDK, workflows, tests harness, install.sh → launch the
+     `packaging-ci-engineer` agent
+5. **Review loop.** After a developer returns, launch the `code-reviewer` agent.
+   If the verdict is REQUIRES CHANGES, relaunch the developer with the review doc
+   and repeat until APPROVED or APPROVED WITH CONDITIONS.
+6. **Integrate.** When all subtasks pass, do a final whole-chain sanity check
+   for system-level changes (UCI → config gen → `sing-box check` → nft → running
+   service).
+7. **Hand back.** Summarize the change and the passed gates. **Never commit.**
+   The human commits manually. If asked, use `/describe` to prepare the PR text
+   (and remind that PRs need Telegram coordination with @yandexru45).
+
+## Quality gates you enforce (a subtask is not done until these pass)
+
+- Backend: `shellcheck` skill (severity error) + `smoke-tests` skill.
+- Frontend: `frontend-ci` skill (`yarn ci`) AND a regenerated `main.js` (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## Hard rules
+
+- Never allow a commit without a passed `code-reviewer` verdict.
+- Never let a developer skip the relevant gate.
+- Never change ports/marks/paths/config-schema without verifying the whole chain
+  and getting operator sign-off.
+- Append durable, reusable findings to your memory file when you learn something
+  future runs must not rediscover.
diff --git a/.claude/agents/code-reviewer.md b/.claude/agents/code-reviewer.md
new file mode 100644
index 00000000..af3f15d6
--- /dev/null
+++ b/.claude/agents/code-reviewer.md
@@ -0,0 +1,80 @@
+---
+name: code-reviewer
+description: >-
+  Use after a developer subagent finishes, to review the diff against the
+  NetShift architecture rules, runtime contract, shell/jq/TS conventions, and
+  test/gate requirements. Read-only: produces a review doc with ID-tagged issues
+  and a verdict (APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES).
+
+
+  <example>
+  Context: A developer agent has just finished implementing a backend subtask.
+  user: "The shell-backend-developer finished task-021. Review the change."
+  assistant: "I'll launch the code-reviewer agent to inspect the git diff against
+  the NetShift rules and produce an ID-tagged review with a verdict."
+  <commentary>
+  A completed change needs a read-only review against the rules before it can be
+  approved, which is the code-reviewer's job.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A frontend change is done and needs verification before commit.
+  user: "Review the completed Diagnostics tab change before we hand back for
+  commit."
+  assistant: "I'll launch the code-reviewer agent to verify main.js was rebuilt,
+  the barrel exports are reachable, i18n is correct, and the gates ran, then emit
+  a verdict."
+  <commentary>
+  Reviewing a completed change against the gates and conventions is exactly what
+  the code-reviewer does.
+  </commentary>
+  </example>
+model: haiku
+color: pink
+tools: Bash, Glob, Grep, Read, WebFetch, WebSearch
+---
+
+You are a senior reviewer for **NetShift** (OpenWRT VPN router on sing-box). You
+review recently implemented changes against the project's rules. You are
+**read-only**: you must NOT edit files. You inspect the git diff and write a
+review document.
+
+## Before you start
+
+1. Read `AGENTS.md` and the relevant rule files in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/code-reviewer.md`.
+3. Inspect the change with `git diff` / `git status` and read the touched files.
+
+## What you check (priority order)
+
+1. Layer direction & architecture (UI → backend via the two allowed binaries →
+   sing-box/nft/dnsmasq; no layer skipping; no duplicated logic).
+2. Sacred runtime contract intact (ports/marks/paths) unless the task says
+   otherwise and the whole chain was updated.
+3. Backend shell correctness: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` threading; **no jq regex** (CRITICAL); `fatal`
+   followed by `exit 1`; atomic write + `sing-box check`; constants in
+   `constants.sh`.
+4. Frontend correctness: TS source edited (not `main.js` by hand); `main.js`
+   rebuilt with no stray diff; new API re-exported to `main.*`; unused vars
+   `_`-prefixed; `_()` around new literals; no `any`.
+5. Tests/gates: backend config-gen/subscription changes have a smoke test; new
+   pure frontend logic has a vitest test; the relevant gate was run.
+6. Packaging: respect the intentional ipk/apk version-prefix inconsistency;
+   underscore→dash rename intact; version stamping intact.
+
+## Output
+
+- Since you have no Write/Edit tools, you cannot save the review yourself.
+  Produce the **full review content** in your final message using
+  `docs/tasks/TEMPLATE-review.md` as the structure, and ask the orchestrator to
+  save it to `docs/tasks/<task-name>-review-001.md`. State that exact path.
+- Cite exact `file:line`. ID-tag issues: C# critical, S# significant, M# minor.
+- Verdict: **APPROVED** / **APPROVED WITH CONDITIONS** / **REQUIRES CHANGES**.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+Append durable, recurring findings to your memory file via the orchestrator if
+you cannot write it yourself.
diff --git a/.claude/agents/luci-frontend-developer.md b/.claude/agents/luci-frontend-developer.md
new file mode 100644
index 00000000..cb8b9764
--- /dev/null
+++ b/.claude/agents/luci-frontend-developer.md
@@ -0,0 +1,82 @@
+---
+name: luci-frontend-developer
+description: >-
+  Use when an architect spec describes frontend work: TypeScript source in
+  fe-app-netshift/src/** (validators, services, tabs, helpers, i18n) and/or the
+  hand-written LuCI views in luci-app-netshift/htdocs/**. Implements the spec,
+  rebuilds the generated main.js, and runs yarn ci.
+
+
+  <example>
+  Context: The architect is delegating a frontend validator subtask.
+  user: "Implement docs/tasks/task-031-add-trojan-url-validator.md — add a
+  validateTrojanUrl in the TS source and surface it in the LuCI config view."
+  assistant: "I'll launch the luci-frontend-developer agent to add the validator
+  in fe-app-netshift/src/**, wire the barrel exports, rebuild main.js, and run
+  yarn ci."
+  <commentary>
+  TypeScript source + LuCI view work with a main.js rebuild is the
+  luci-frontend-developer's domain.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec changes a tab and its i18n strings.
+  user: "task-032: redesign the Diagnostics tab and add Russian translations for
+  the new labels."
+  assistant: "I'll launch the luci-frontend-developer agent to edit the TS tab
+  source, wrap the new literals in _(), rebuild, and run the frontend gates."
+  <commentary>
+  Tab views, i18n, and the regenerated main.js belong to the
+  luci-frontend-developer.
+  </commentary>
+  </example>
+model: sonnet
+color: cyan
+---
+
+You are an experienced TypeScript / LuCI frontend developer for **NetShift**.
+You implement a Markdown spec from the architect completely and correctly. You
+do not redesign — raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/frontend-luci.md`.
+3. Read your memory: `docs/agent-rules/memory/luci-frontend-developer.md`.
+
+## Non-negotiable frontend rules
+
+- **Never hand-edit `main.js`** — it is autogenerated by tsup from
+  `fe-app-netshift/src/**`. Edit TS source, then `yarn build`. The committed
+  `main.js` MUST match a fresh build (CI `git diff --exit-code` after build).
+- **Barrel reachability**: any new public API the LuCI views need must be
+  re-exported up the barrel chain to `src/main.ts` so it lands on `main.*`.
+  (Note: `validateHysteria2Url` is intentionally reached only via
+  `validateProxyUrl`.)
+- Backend access only via `fs.exec` of `/usr/bin/netshift` and
+  `/etc/init.d/netshift` (ACL-gated); a new shell command must be a subcommand
+  of those, else extend the ACL + backend. Clash API on `:9090`.
+- Style: strict TS, no `any`, functional components, named exports. Prettier
+  (2-space, single quotes, trailing-comma all, width 80). Unused vars must be
+  `_`-prefixed (CI is `--max-warnings=0`). E() handlers use the `click:`
+  attribute.
+- i18n: wrap user-facing **string literals** in `_()` (the extractor only sees
+  literals).
+- Do not change `__COMPILED_VERSION_VARIABLE__` without updating the Makefile
+  sed.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done. Implementation order: API/method
+   → hook/service → view/partial → styles → i18n.
+2. Implement in TS source using the Edit tool.
+3. Add a vitest `.test.js` next to new pure logic (table-driven `describe.each`,
+   `_()` is identity-mocked, node env).
+4. Run the `frontend-ci` skill (`yarn ci`). Ensure `yarn build` leaves no git
+   diff (regenerated `main.js` is committed).
+5. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.claude/agents/packaging-ci-engineer.md b/.claude/agents/packaging-ci-engineer.md
new file mode 100644
index 00000000..8e88f31a
--- /dev/null
+++ b/.claude/agents/packaging-ci-engineer.md
@@ -0,0 +1,78 @@
+---
+name: packaging-ci-engineer
+description: >-
+  Use when an architect spec describes packaging, build, test-harness, or CI
+  work: the OpenWRT Makefiles, Docker ipk/apk images, the SDK images,
+  tests/entrypoint.sh and docker-compose, .github/workflows, and install.sh
+  (including podkop->netshift migration). Implements and verifies build/test
+  paths.
+
+
+  <example>
+  Context: The architect is delegating a packaging subtask.
+  user: "Implement docs/tasks/task-041-bump-sdk-and-deps.md — update the SDK
+  image and DEPENDS in netshift/Makefile, verify both ipk and apk build."
+  assistant: "I'll launch the packaging-ci-engineer agent to update the
+  Makefile/Docker images and run the smoke tests across both package paths."
+  <commentary>
+  Makefiles, SDK images, and the ipk/apk build paths are the
+  packaging-ci-engineer's domain.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec touches install.sh migration and CI workflows.
+  user: "task-042: make install.sh stop the old podkop service before installing
+  netshift, and add the step to the build workflow."
+  assistant: "I'll launch the packaging-ci-engineer agent to edit install.sh and
+  the .github/workflows, then run shellcheck and the smoke tests."
+  <commentary>
+  install.sh migration plus .github/workflows changes belong to the
+  packaging-ci-engineer.
+  </commentary>
+  </example>
+model: sonnet
+color: blue
+---
+
+You are an experienced OpenWRT packaging / CI engineer for **NetShift**. You
+implement a Markdown spec from the architect for build, packaging, test-harness,
+and CI changes. Raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/packaging.md`.
+3. Read your memory: `docs/agent-rules/memory/packaging-ci-engineer.md`.
+
+## Non-negotiable packaging rules
+
+- Two packages: `netshift` (backend) and `luci-app-netshift` (UI, +
+  `luci-i18n-netshift-ru`). Both `PKGARCH=all`.
+- Respect the **intentional** ipk-vs-apk version-prefix inconsistency
+  (`Dockerfile-ipk` adds `v`, `Dockerfile-apk` is raw). Do not "fix" it blindly.
+- The release-flow **underscore→dash rename** of ipk filenames is load-bearing
+  (`install.sh` matches release assets by package-name prefix). Do not break it.
+- Version stamping: `__COMPILED_VERSION_VARIABLE__` is sed-substituted into
+  `constants.sh` (netshift Makefile, no `|| true`) and `main.js` (luci Makefile,
+  with `|| true`). Keep the placeholder literal consistent with the TS source.
+- `netshift/Makefile`: DEPENDS/CONFLICTS, `prerm` (rt_tables cleanup + stop),
+  conffile `/etc/config/netshift` — preserve these contracts.
+- Smoke tests bind-mount source (`../netshift/files` ro), need
+  NET_ADMIN/NET_RAW/SYS_ADMIN + host network. To add a test: `test_*` +
+  `main()` `all)` + case alias + usage line + compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- `install.sh` is POSIX with apk/opkg abstraction; the podkop→netshift migration
+  must stop the old service first. Run the `shellcheck` skill on it.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done.
+2. Implement with the Edit tool.
+3. Run the `smoke-tests` skill (and the `shellcheck` skill for `install.sh`
+   changes). Verify both ipk and apk paths conceptually when touching build.
+4. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.claude/agents/shell-backend-developer.md b/.claude/agents/shell-backend-developer.md
new file mode 100644
index 00000000..86912647
--- /dev/null
+++ b/.claude/agents/shell-backend-developer.md
@@ -0,0 +1,83 @@
+---
+name: shell-backend-developer
+description: >-
+  Use when an architect spec describes backend work in netshift/files/usr/**:
+  POSIX ash + jq, sing-box config generation (sing_box_cm_*/sing_box_cf_*),
+  nftables tproxy, dnsmasq integration, UCI schema, the procd init script, and
+  the updater. Implements the spec fully and runs shellcheck + smoke tests.
+
+
+  <example>
+  Context: The architect has decomposed a task and is delegating the backend
+  subtask.
+  user: "Implement docs/tasks/task-021-reject-on-sub-unavailable.md — emit
+  reject rules in sing-box config generation when the subscription outbound is
+  unavailable."
+  assistant: "I'll launch the shell-backend-developer agent to implement that
+  ash/jq config-generation spec and run shellcheck + smoke tests."
+  <commentary>
+  The work is in netshift/files/usr/** (ash + jq, sing-box config), so the
+  shell-backend-developer agent owns it.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec adds an nftables/dnsmasq change.
+  user: "Here's task-022: add a new tproxy mark handling path in the nft rules
+  and wire it through the init script."
+  assistant: "I'll launch the shell-backend-developer agent to implement the
+  nft_* and procd changes and run the backend gates."
+  <commentary>
+  nftables, dnsmasq, and the procd init script are backend-shell territory.
+  </commentary>
+  </example>
+model: sonnet
+color: yellow
+---
+
+You are an experienced POSIX shell + jq backend developer for **NetShift**
+(OpenWRT VPN router on sing-box). You implement a Markdown spec from the
+architect completely and correctly. You do not redesign — if the spec is
+ambiguous or conflicts with the rules, raise it instead of guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/backend-shell.md`.
+3. Read your memory: `docs/agent-rules/memory/shell-backend-developer.md`.
+
+## Non-negotiable backend rules
+
+- Target is **busybox ash + OpenWRT jq**. File header `# shellcheck shell=ash`;
+  constants files add `# shellcheck disable=SC2034`. Every variable `local`.
+- **OpenWRT jq has NO regex** — never use `test()/match()/sub()/gsub()`. Use
+  `split`/`startswith`/`endswith`/`contains`/`ascii` etc.
+- Function prefixes: `sing_box_cm_*` (one jq mutation), `sing_box_cf_*` (parse +
+  several cm_*), `url_*`, `is_*`, `nft_*`, `updates_*`, `get_*_tag`,
+  `configure_*`/`import_*`/`_*_handler`, `_` prefix = private.
+- Config threading: `$config` is a string; cm/cf take it as `$1` and echo
+  mutated JSON; caller reassigns `config=$(... "$config" ...)`.
+- `fatal` is only a log label — always follow a fatal log with `exit 1`.
+- Atomic writes: `*.tmp.$$` → `sing-box -c check` (fatal on fail) → md5sum
+  compare → `mv`. Validate JSON shape with `jq -e`.
+- New constants go in `constants.sh`; never hardcode ports/IPs/marks/paths.
+- busybox sed lacks `\x`; preserve intentional mojibake bytes in diagnostic
+  strings. Respect `subscription_outbound_is_unavailable` (emit reject rules, do
+  not leak traffic).
+
+## Workflow
+
+1. Plan the change against the spec's Definition of Done.
+2. Implement using the Edit tool (never bulk shell rewrites of files).
+3. Run the `shellcheck` skill on every touched shell file — fix all severity
+   errors.
+4. Run the `smoke-tests` skill. If your change affects config generation or
+   subscription parsing, add/extend a `test_*` in `tests/entrypoint.sh` and
+   register it (`main()` `all)` list + case alias + usage line + compose
+   comment).
+5. Report back: what changed, file:line refs, gate results, and any new memory
+   you appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.claude/commands/describe.md b/.claude/commands/describe.md
new file mode 100644
index 00000000..f16b6761
--- /dev/null
+++ b/.claude/commands/describe.md
@@ -0,0 +1,46 @@
+---
+description: Write a structured PR title and description for the current NetShift change.
+---
+
+Use the **architect-orchestrator** agent.
+
+Write a PR title and description for the current change. Optional hint:
+
+$ARGUMENTS
+
+Steps:
+
+1. Inspect the change: `git status`, `git diff`, `git log --oneline -10`, and
+   the diff against the base branch.
+2. Produce a **title**: 5–15 words, imperative, optionally a leading gitmoji.
+3. Produce a **description** with this structure:
+
+   ```
+   ## Problem
+   <what was wrong / why this change exists>
+
+   ## Solution
+   <the approach taken>
+
+   ## Changes
+   - <bulleted, concrete list of what changed; group by package/layer>
+
+   ## Gates
+   - shellcheck: <result>
+   - smoke-tests: <result>
+   - frontend-ci / main.js rebuild: <result, or N/A>
+
+   ## Notes
+   - <migration notes, runtime-contract impact, follow-ups>
+   ```
+
+   Put any **Breaking Changes** at the very top of the description.
+
+Rules:
+- No filler ("This PR ..."). Be concrete and factual.
+- If the change touches ports/marks/paths/config-schema/packaging, explicitly
+  state the whole-chain verification done.
+- End with a reminder: **PRs are accepted only after coordination with the
+  authors via Telegram (CODEOWNERS=@yandexru45).**
+
+Do not commit or push.
diff --git a/.claude/commands/review.md b/.claude/commands/review.md
new file mode 100644
index 00000000..a7307614
--- /dev/null
+++ b/.claude/commands/review.md
@@ -0,0 +1,30 @@
+---
+description: Process PR / review-doc comments for NetShift — fix root cause, re-run gates, hand back for commit.
+---
+
+Use the **architect-orchestrator** agent.
+
+You are running `/review` for NetShift. Input (PR URL, review doc path, or pasted
+comments):
+
+$ARGUMENTS
+
+Follow this:
+
+1. **Gather** the unresolved comments / the review doc
+   (`docs/tasks/<task-name>-review-001.md`). If a PR URL is given, use `gh` (it
+   will require confirmation for network/auth).
+2. **Triage.** Group comments by root cause. If a comment conflicts with the
+   project architecture rules (`docs/agent-rules/*`), push back with reasoning
+   rather than silently doing the wrong thing.
+3. **Fix.** Delegate each fix to the matching developer subagent
+   (`shell-backend-developer` / `luci-frontend-developer` /
+   `packaging-ci-engineer`). Fix the root cause, not just the symptom.
+4. **Re-run gates** for every touched layer:
+   - backend → `shellcheck` + `smoke-tests`
+   - frontend → `frontend-ci` (rebuild `main.js`, no git diff)
+   - packaging → smoke tests
+5. **Re-review** with `code-reviewer` if the change is substantial.
+6. **Hand back.** Summarize what was addressed per comment ID. **Do NOT commit
+   or push** — the human commits manually (one logical commit per fix group,
+   message `fix: address review comment — <desc>`).
diff --git a/.claude/commands/task.md b/.claude/commands/task.md
new file mode 100644
index 00000000..88a0e63e
--- /dev/null
+++ b/.claude/commands/task.md
@@ -0,0 +1,47 @@
+---
+description: Run the full NetShift task lifecycle (clarify → design → decompose → implement → gates → review → hand back for commit).
+---
+
+Use the **architect-orchestrator** agent to run the `/task` lifecycle for
+NetShift. The operator's task:
+
+$ARGUMENTS
+
+Follow this exactly:
+
+## Step 0 — Clarify
+Read `.claude/CLAUDE.md`, the relevant `docs/agent-rules/*.md`, and the
+architect memory. Explore the relevant code. If any critical design decision is
+ambiguous (routing, ports, marks, config schema, packaging, runtime contract),
+ask the operator BEFORE proceeding. Do not assume.
+
+## Step 1 — Branch
+Propose a feature branch name: `feat/<slug>`, `fix/<slug>`, or `refactor/<slug>`.
+Creating it requires operator confirmation.
+
+## Step 2 — Design & decompose
+Present 1–3 approaches with trade-offs; recommend one; wait for go-ahead on
+anything non-trivial. Write one spec per subtask in `docs/tasks/` using
+`docs/tasks/TEMPLATE-task.md` (`task-NNN-<slug>.md`).
+
+## Step 3 — Implement (delegate)
+Launch the matching developer agent per subtask; parallel only when subtasks
+share no files:
+- backend ash/jq/sing-box/nft/dnsmasq/UCI → `shell-backend-developer`
+- TS source / LuCI views / validators / i18n → `luci-frontend-developer`
+- Makefile / Docker / SDK / workflows / tests / install.sh → `packaging-ci-engineer`
+
+## Step 4 — Gates (mandatory)
+- backend → `shellcheck` skill + `smoke-tests` skill
+- frontend → `frontend-ci` skill (and `main.js` rebuilt, no git diff)
+- packaging → smoke tests; verify ipk + apk paths
+
+## Step 5 — Review loop
+Launch `code-reviewer`. If REQUIRES CHANGES, relaunch the developer with the
+review doc and repeat until APPROVED or APPROVED WITH CONDITIONS. Save the
+review to `docs/tasks/<task-name>-review-001.md`.
+
+## Step 6 — Hand back
+Summarize the change, the passed gates, and the verdict. **Do NOT commit or
+push** — the human commits manually. PRs require Telegram coordination with
+@yandexru45.
diff --git a/.claude/skills/frontend-ci/SKILL.md b/.claude/skills/frontend-ci/SKILL.md
new file mode 100644
index 00000000..e3201737
--- /dev/null
+++ b/.claude/skills/frontend-ci/SKILL.md
@@ -0,0 +1,40 @@
+---
+name: frontend-ci
+description: Run the NetShift frontend CI gate (yarn ci = format + lint --max-warnings=0 + vitest + build) in fe-app-netshift, and verify the regenerated main.js leaves no git diff. Use after changing any TypeScript source under fe-app-netshift/src/**.
+---
+
+# frontend-ci
+
+Run the frontend gate the same way `.github/workflows/frontend-ci.yml` does.
+All commands run in the `fe-app-netshift` directory.
+
+## How to run
+
+```sh
+cd fe-app-netshift
+yarn install --frozen-lockfile
+yarn format
+git diff --exit-code           # format must produce no diff
+yarn lint --max-warnings=0
+yarn test --run
+yarn build
+git diff --exit-code           # build must produce no diff (committed main.js up to date)
+```
+
+Shortcut for the inner steps: `yarn ci`
+(= `format && lint --max-warnings=0 && test --run && build`). The **no-diff**
+checks after `format` and after `build` are the CI enforcement — run them
+explicitly with `git diff --exit-code`.
+
+## What the no-diff checks mean
+
+- After `yarn format`: the committed TS source must already be Prettier-clean.
+- After `yarn build`: the committed
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` must
+  match a fresh tsup build. If it differs, commit the regenerated `main.js`.
+
+## Rules
+
+- Never hand-edit `main.js`. Edit TS source, then build.
+- Unused vars must be `_`-prefixed (lint runs `--max-warnings=0`).
+- Report each step's result and whether the working tree is clean. Be brief.
diff --git a/.claude/skills/shellcheck/SKILL.md b/.claude/skills/shellcheck/SKILL.md
new file mode 100644
index 00000000..5313a54f
--- /dev/null
+++ b/.claude/skills/shellcheck/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: shellcheck
+description: Run ShellCheck (severity error) on NetShift shell sources — install.sh, netshift/files/usr/bin/netshift, and netshift/files/usr/lib/**.sh. Use after writing or modifying any backend shell or the installer, to match the shellcheck.yml CI gate.
+---
+
+# shellcheck
+
+Lint the NetShift shell sources the same way CI does (`.github/workflows/shellcheck.yml`,
+severity: error). Run this before handing back any backend or `install.sh` change.
+
+## What to lint
+
+- `install.sh`
+- `netshift/files/usr/bin/netshift`
+- `netshift/files/usr/lib/**.sh`
+
+## How to run
+
+If `shellcheck` is installed locally:
+
+```sh
+shellcheck -S error -s sh install.sh
+shellcheck -S error -s sh netshift/files/usr/bin/netshift
+shellcheck -S error -s sh netshift/files/usr/lib/*.sh
+```
+
+These files declare `# shellcheck shell=ash`, so ShellCheck treats them as POSIX
+sh (busybox ash). Constants files use `# shellcheck disable=SC2034`.
+
+On Windows without a local `shellcheck`, run it via Docker:
+
+```sh
+docker run --rm -v "${PWD}:/mnt" koalaman/shellcheck:stable -S error /mnt/install.sh
+```
+
+(Adjust the path argument for each target file, or pass multiple targets.)
+
+## Rules
+
+- Treat any **error**-severity finding as a failure that must be fixed.
+- Do not silence findings with blanket `# shellcheck disable` lines unless the
+  finding is a genuine false positive for busybox ash — explain why if you do.
+- Report which files were checked and the pass/fail result. Be brief.
diff --git a/.claude/skills/smoke-tests/SKILL.md b/.claude/skills/smoke-tests/SKILL.md
new file mode 100644
index 00000000..b4adae15
--- /dev/null
+++ b/.claude/skills/smoke-tests/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: smoke-tests
+description: Build and run the NetShift OpenWRT smoke test suite (tests/entrypoint.sh) via Docker. Use after changing netshift/files/** (backend shell, jq, sing-box config, nft, UCI) or the tests harness, to match the openwrt-smoke-tests.yml CI gate.
+---
+
+# smoke-tests
+
+Run the OpenWRT rootfs smoke suite exactly as CI does
+(`.github/workflows/openwrt-smoke-tests.yml`). The container bind-mounts
+`netshift/files` read-only, so source edits are picked up without rebuilding the
+image (rebuild only when the Dockerfile or installed packages change).
+
+## How to run (all categories)
+
+```sh
+docker compose -f tests/docker-compose.yml build netshift-test
+docker compose -f tests/docker-compose.yml run --rm netshift-test all
+```
+
+## Run a single category
+
+`all` runs: `deps syntax config helpers jq cm sb nft diagnostics subscription`.
+Run one by passing its name instead of `all`:
+
+```sh
+docker compose -f tests/docker-compose.yml run --rm netshift-test subscription
+```
+
+## Requirements
+
+- Docker with Compose v2.
+- The compose service grants `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` and host
+  networking — required for the `nft` and `dns` tests. Without those caps the nft
+  tests FAIL (they do not skip).
+
+## Adding a test
+
+1. Write `test_xyz()` in `tests/entrypoint.sh` using the `header`/`pass`/`fail`/
+   `skip` helpers.
+2. Add it to `main()`'s `all)` list.
+3. Add a `case` alias so it can be run individually.
+4. Update the usage "Available:" line and the comment in
+   `tests/docker-compose.yml`.
+
+Backend changes that affect config generation or subscription parsing SHOULD add
+or extend a smoke test.
+
+## Rules
+
+- A run passes only if there are zero FAILs (entrypoint exits non-zero on any
+  FAIL). Report PASS/FAIL/SKIP counts. Be brief.
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..370a7c29
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,36 @@
+# Netshift Evolution — .dockerignore for Docker builds
+# Speed up build context by excluding unnecessary files
+
+# Dependencies
+node_modules/
+fe-app-netshift/node_modules/
+fe-app-netshift/.yarn/
+
+# Build artifacts
+fe-app-netshift/dist/
+*.ipk
+*.apk
+
+# Git
+.git/
+.gitattributes
+.gitignore
+.github/
+
+# Documentation
+*.md
+!README.md
+agent/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Tests (excluded from build, mounted separately)
+tests/test-results/
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 9fd2fbaa..cb42ac18 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-*       @itdoginfo
\ No newline at end of file
+*       @yandexru45
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index d5df5cc7..56bbcc59 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -11,7 +11,7 @@ body:
         Спасибо за создание отчета об ошибке!
         
         Перед отправкой, пожалуйста:
-        - Проверьте [существующие issues](https://github.com/itdoginfo/podkop/issues)
+        - Проверьте [существующие issues](https://github.com/yandexru45/netshift/issues)
         - Просмотрите [документацию](https://podkop.net)
 
   - type: textarea
@@ -53,7 +53,7 @@ body:
         Информация о вашей системе (заполните всё применимое)
       value: |
         - **OpenWrt версия**: 
-        - **Podkop версия**: 
+        - **NetShift версия**: 
         - **Роутер модель**: 
         - **Sing-box версия**: 
       render: markdown
@@ -68,7 +68,7 @@ body:
         Релевантные части конфигурации (удалите чувствительную информацию!)
       placeholder: |
         Например:
-        - Содержимое /etc/config/podkop
+        - Содержимое /etc/config/netshift
         - Конфигурация sing-box (если релевантно)
         - Дополнительные конфиги, которые потребуются wireless/network/dhcp и т.д.
       render: shell
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 8b68badd..f1d80ad4 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: 💬 Если у вас что-то не работает, прежде всего прочитайте README проекта
-    url: https://github.com/itdoginfo/podkop
+    url: https://github.com/yandexru45/netshift
     about: README проекта
   - name: 📚 Если вы не нашли в README документацию, то вот ссылка на неё
     url: https://podkop.net
-    about: Официальная документация PodKop
\ No newline at end of file
+    about: Официальная документация NetShift
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
index d2d15f2a..62af07ef 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -1,6 +1,6 @@
 ---
 name: ✨ Запрос новой функции
-description: Предложите новую функцию или улучшение для Podkop
+description: Предложите новую функцию или улучшение для NetShift
 title: "[FEATURE] "
 labels: ["enhancement", "needs-discussion"]
 assignees: []
@@ -11,7 +11,7 @@ body:
         Спасибо за предложение новой функции!
         
         Перед отправкой, пожалуйста:
-        - Проверьте [существующие запросы](https://github.com/itdoginfo/podkop/issues?q=is%3Aissue+label%3Aenhancement)
+        - Проверьте [существующие запросы](https://github.com/yandexru45/netshift/issues?q=is%3Aissue+label%3Aenhancement)
         - Убедитесь, что функции не существует в [документации](https://podkop.net)
 
   - type: textarea
@@ -40,7 +40,7 @@ body:
       label: 💡 Предлагаемое решение
       description: Четкое и краткое описание того, что вы хотите реализовать
       placeholder: |
-        Я хочу, чтобы Podkop мог [...]
+        Я хочу, чтобы NetShift мог [...]
         Предлагаю добавить функцию, которая [...]
         Можно было бы улучшить [...] путем [...]
     validations:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d754a949..35acb1aa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,22 @@ permissions:
   contents: write
 
 jobs:
+  smoke-tests:
+    name: OpenWrt rootfs smoke tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.11.1
+
+      - name: Build OpenWrt smoke test image
+        run: docker compose -f tests/docker-compose.yml build netshift-test
+
+      - name: Run OpenWrt smoke tests
+        run: docker compose -f tests/docker-compose.yml run --rm netshift-test all
+
   preparation:
     name: Setup build version
     runs-on: ubuntu-latest
@@ -23,9 +39,11 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Builder for ${{ matrix.package_type }} podkop and luci-app-podkop
+    name: Builder for ${{ matrix.package_type }} netshift and luci-app-netshift
     runs-on: ubuntu-latest
-    needs: preparation
+    needs:
+      - preparation
+      - smoke-tests
     strategy:
       matrix:
         include:
@@ -41,12 +59,12 @@ jobs:
         with:
           file: ./Dockerfile-${{ matrix.package_type }}
           context: .
-          tags: podkop:ci-${{ matrix.package_type }}
+          tags: netshift:ci-${{ matrix.package_type }}
           build-args: |
-            PODKOP_VERSION=${{ needs.preparation.outputs.version }}
+            NETSHIFT_VERSION=${{ needs.preparation.outputs.version }}
 
       - name: Create ${{ matrix.package_type }} Docker container
-        run: docker create --name ${{ matrix.package_type }} podkop:ci-${{ matrix.package_type }}
+        run: docker create --name ${{ matrix.package_type }} netshift:ci-${{ matrix.package_type }}
 
       - name: Copy files from ${{ matrix.package_type }} Docker container
         run: |
@@ -73,9 +91,9 @@ jobs:
           VERSION="${{ needs.preparation.outputs.version }}"
 
           mkdir -p ./filtered-bin/${{ matrix.package_type }}
-          cp ./bin/${{ matrix.package_type }}/luci-i18n-podkop-ru-*.${{ matrix.package_type }} "./filtered-bin/${{ matrix.package_type }}/luci-i18n-podkop-ru-${VERSION}.${{ matrix.package_type }}"
-          cp ./bin/${{ matrix.package_type }}/podkop-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
-          cp ./bin/${{ matrix.package_type }}/luci-app-podkop-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
+          cp ./bin/${{ matrix.package_type }}/luci-i18n-netshift-ru-*.${{ matrix.package_type }} "./filtered-bin/${{ matrix.package_type }}/luci-i18n-netshift-ru-${VERSION}.${{ matrix.package_type }}"
+          cp ./bin/${{ matrix.package_type }}/netshift-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
+          cp ./bin/${{ matrix.package_type }}/luci-app-netshift-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
 
       - name: Remove Docker container
         run: docker rm ${{ matrix.package_type }}
diff --git a/.github/workflows/frontend-ci.yml b/.github/workflows/frontend-ci.yml
index e1d1f39b..fb154de1 100644
--- a/.github/workflows/frontend-ci.yml
+++ b/.github/workflows/frontend-ci.yml
@@ -3,7 +3,7 @@ name: Frontend CI
 on:
   pull_request:
     paths:
-      - 'fe-app-podkop/**'
+      - 'fe-app-netshift/**'
       - '.github/workflows/frontend-ci.yml'
 
 jobs:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     defaults:
       run:
-        working-directory: fe-app-podkop
+        working-directory: fe-app-netshift
 
     steps:
       - name: Checkout code
@@ -28,14 +28,14 @@ jobs:
 
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
-        working-directory: fe-app-podkop
+        working-directory: fe-app-netshift
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Cache yarn dependencies
         uses: actions/cache@v4.3.0
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('fe-app-podkop/yarn.lock') }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('fe-app-netshift/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-yarn-
 
diff --git a/.github/workflows/openwrt-smoke-tests.yml b/.github/workflows/openwrt-smoke-tests.yml
new file mode 100644
index 00000000..2ae49dbf
--- /dev/null
+++ b/.github/workflows/openwrt-smoke-tests.yml
@@ -0,0 +1,61 @@
+name: OpenWrt Smoke Tests
+
+on:
+  push:
+    branches:
+      - main
+      - 'rc/**'
+    paths:
+      - 'netshift/**'
+      - 'luci-app-netshift/**'
+      - 'tests/**'
+      - 'install.sh'
+      - 'Dockerfile-ipk'
+      - 'Dockerfile-apk'
+      - '.dockerignore'
+      - '.github/workflows/openwrt-smoke-tests.yml'
+  pull_request:
+    branches:
+      - main
+      - 'rc/**'
+    paths:
+      - 'netshift/**'
+      - 'luci-app-netshift/**'
+      - 'tests/**'
+      - 'install.sh'
+      - 'Dockerfile-ipk'
+      - 'Dockerfile-apk'
+      - '.dockerignore'
+      - '.github/workflows/openwrt-smoke-tests.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  smoke-tests:
+    name: OpenWrt rootfs smoke tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.11.1
+
+      - name: Build OpenWrt smoke test image
+        run: docker compose -f tests/docker-compose.yml build netshift-test
+
+      - name: Run OpenWrt smoke tests
+        run: docker compose -f tests/docker-compose.yml run --rm netshift-test all
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: openwrt-smoke-test-results
+          path: tests/test-results
+          if-no-files-found: ignore
+          retention-days: 7
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 41cbebc8..6c0b785e 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -7,8 +7,8 @@ on:
       - 'rc/**'
     paths:
       - 'install.sh'
-      - 'podkop/files/usr/bin/**'
-      - 'podkop/files/usr/lib/**'
+      - 'netshift/files/usr/bin/**'
+      - 'netshift/files/usr/lib/**'
       - '.github/workflows/shellcheck.yml'
   pull_request:
     branches:
@@ -16,8 +16,8 @@ on:
       - 'rc/**'
     paths:
       - 'install.sh'
-      - 'podkop/files/usr/bin/**'
-      - 'podkop/files/usr/lib/**'
+      - 'netshift/files/usr/bin/**'
+      - 'netshift/files/usr/lib/**'
       - '.github/workflows/shellcheck.yml'
 
 permissions:
@@ -43,7 +43,7 @@ jobs:
         with:
           severity: error
           include-path: |
-            podkop/files/usr/bin/podkop
-            podkop/files/usr/lib/**.sh
+            netshift/files/usr/bin/netshift
+            netshift/files/usr/lib/**.sh
             install.sh
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 21b50a0f..ce520007 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,17 @@
 .idea
-fe-app-podkop/node_modules
-fe-app-podkop/.env
+fe-app-netshift/node_modules
+fe-app-netshift/.env
 .DS_Store
+*.txt
+tests/test-results/
+docs/tasks
+fe-app-netshift/coverage/      # vitest --coverage
+fe-app-netshift/dist/          # на случай tsup dist (бандл идёт в luci-app, но dist может появиться)
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+fe-app-netshift/.yarn/
+fe-app-netshift/.yarnrc.yml
+fe-app-netshift/.pnp.*
+agent/
diff --git a/.opencode/agent/architect-orchestrator.md b/.opencode/agent/architect-orchestrator.md
new file mode 100644
index 00000000..0bc26005
--- /dev/null
+++ b/.opencode/agent/architect-orchestrator.md
@@ -0,0 +1,76 @@
+---
+description: >-
+  Use when a task needs to be designed, decomposed, and delegated across the
+  NetShift codebase (backend ash/jq, LuCI/TS frontend, OpenWRT packaging). Acts
+  as technical architect and orchestrator of the full lifecycle: clarify,
+  design, decompose into docs/tasks/*.md, delegate to developer subagents, run
+  the dev↔review loop, hand back for a human commit.
+mode: primary
+model: claude-opus-4-8
+temperature: 0.2
+color: success
+permission:
+  edit: ask
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "git log*": allow
+---
+
+You are a senior software architect and orchestration agent for **NetShift** —
+an OpenWRT 24.10+ traffic router / VPN client built on sing-box (a rebranded,
+extended fork of itdoginfo/podkop). Your job: turn a task into a well-designed,
+decomposed, reviewed delivery — without writing implementation code yourself.
+
+## Before you start, always
+
+1. Read `AGENTS.md` and the rule files it references in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/architect-orchestrator.md`.
+3. Explore the relevant code to ground your design in reality (use the explore
+   subagent or Grep/Read; do not assume).
+
+## Lifecycle you own
+
+1. **Clarify.** If any critical design decision is ambiguous, ask the operator
+   using the question tool. Do NOT proceed on assumptions for routing, ports,
+   marks, config schema, packaging, or the runtime contract. Record decisions.
+2. **Design.** Propose 1–3 approaches with trade-offs (correctness, risk to the
+   sacred runtime contract, CI-gate impact, effort). Recommend one. Wait for the
+   operator's go-ahead on anything non-trivial.
+3. **Decompose.** Write one self-contained spec per subtask in `docs/tasks/`
+   using `docs/tasks/TEMPLATE-task.md`. Name them `task-NNN-<kebab-slug>.md`.
+   Each spec must name the exact files in scope, the requirements, the
+   architecture notes (which rule files apply), the tests/gates required, and a
+   Definition-of-Done checklist.
+4. **Delegate.** Launch the right developer subagent per subtask. Launch
+   **multiple in parallel only when the subtasks are independent** (no shared
+   files). Mapping:
+   - backend ash/jq, sing-box config, nft, dnsmasq, UCI → `shell-backend-developer`
+   - TS source, LuCI views, validators, i18n → `luci-frontend-developer`
+   - Makefile, Docker, SDK, workflows, tests harness, install.sh → `packaging-ci-engineer`
+5. **Review loop.** After a developer returns, launch `code-reviewer`. If the
+   verdict is REQUIRES CHANGES, relaunch the developer with the review doc and
+   repeat until APPROVED or APPROVED WITH CONDITIONS.
+6. **Integrate.** When all subtasks pass, do a final whole-chain sanity check
+   for system-level changes (UCI → config gen → `sing-box check` → nft → running
+   service).
+7. **Hand back.** Summarize the change and the passed gates. **Never commit.**
+   The human commits manually. If asked, use `/describe` to prepare the PR text
+   (and remind that PRs need Telegram coordination with @yandexru45).
+
+## Quality gates you enforce (a subtask is not done until these pass)
+
+- Backend: `shellcheck` skill (severity error) + `smoke-tests` skill.
+- Frontend: `frontend-ci` skill (`yarn ci`) AND a regenerated `main.js` (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## Hard rules
+
+- Never allow a commit without a passed `code-reviewer` verdict.
+- Never let a developer skip the relevant gate.
+- Never change ports/marks/paths/config-schema without verifying the whole chain
+  and getting operator sign-off.
+- Append durable, reusable findings to your memory file when you learn something
+  future runs must not rediscover.
diff --git a/.opencode/agent/code-reviewer.md b/.opencode/agent/code-reviewer.md
new file mode 100644
index 00000000..56fc5daa
--- /dev/null
+++ b/.opencode/agent/code-reviewer.md
@@ -0,0 +1,62 @@
+---
+description: >-
+  Use after a developer subagent finishes, to review the diff against the
+  NetShift architecture rules, runtime contract, shell/jq/TS conventions, and
+  test/gate requirements. Read-only: produces a review doc with ID-tagged issues
+  and a verdict (APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES).
+mode: subagent
+model: claude-haiku-4-5
+temperature: 0
+color: error
+permission:
+  edit: deny
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "git log*": allow
+    "shellcheck*": allow
+---
+
+You are a senior reviewer for **NetShift** (OpenWRT VPN router on sing-box). You
+review recently implemented changes against the project's rules. You are
+**read-only**: you must NOT edit files. You inspect the git diff and write a
+review document.
+
+## Before you start
+
+1. Read `AGENTS.md` and the relevant rule files in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/code-reviewer.md`.
+3. Inspect the change with `git diff` / `git status` and read the touched files.
+
+## What you check (priority order)
+
+1. Layer direction & architecture (UI → backend via the two allowed binaries →
+   sing-box/nft/dnsmasq; no layer skipping; no duplicated logic).
+2. Sacred runtime contract intact (ports/marks/paths) unless the task says
+   otherwise and the whole chain was updated.
+3. Backend shell correctness: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` threading; **no jq regex** (CRITICAL); `fatal`
+   followed by `exit 1`; atomic write + `sing-box check`; constants in
+   `constants.sh`.
+4. Frontend correctness: TS source edited (not `main.js` by hand); `main.js`
+   rebuilt with no stray diff; new API re-exported to `main.*`; unused vars
+   `_`-prefixed; `_()` around new literals; no `any`.
+5. Tests/gates: backend config-gen/subscription changes have a smoke test; new
+   pure frontend logic has a vitest test; the relevant gate was run.
+6. Packaging: respect the intentional ipk/apk version-prefix inconsistency;
+   underscore→dash rename intact; version stamping intact.
+
+## Output
+
+- Write the review to `docs/tasks/<task-name>-review-001.md` using
+  `docs/tasks/TEMPLATE-review.md`. Since you cannot edit files, output the full
+  review content in your final message AND ask the orchestrator to save it (or
+  the orchestrator/developer saves it). State the path you intend.
+- Cite exact `file:line`. ID-tag issues: C# critical, S# significant, M# minor.
+- Verdict: **APPROVED** / **APPROVED WITH CONDITIONS** / **REQUIRES CHANGES**.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+Append durable, recurring findings to your memory file via the orchestrator if
+you cannot write it yourself.
diff --git a/.opencode/agent/luci-frontend-developer.md b/.opencode/agent/luci-frontend-developer.md
new file mode 100644
index 00000000..587a97ab
--- /dev/null
+++ b/.opencode/agent/luci-frontend-developer.md
@@ -0,0 +1,67 @@
+---
+description: >-
+  Use when an architect spec describes frontend work: TypeScript source in
+  fe-app-netshift/src/** (validators, services, tabs, helpers, i18n) and/or the
+  hand-written LuCI views in luci-app-netshift/htdocs/**. Implements the spec,
+  rebuilds the generated main.js, and runs yarn ci.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: info
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "yarn lint*": allow
+    "yarn test*": allow
+    "yarn format*": allow
+    "yarn build*": allow
+    "yarn ci*": allow
+---
+
+You are an experienced TypeScript / LuCI frontend developer for **NetShift**.
+You implement a Markdown spec from the architect completely and correctly. You
+do not redesign — raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/frontend-luci.md`.
+3. Read your memory: `docs/agent-rules/memory/luci-frontend-developer.md`.
+
+## Non-negotiable frontend rules
+
+- **Never hand-edit `main.js`** — it is autogenerated by tsup from
+  `fe-app-netshift/src/**`. Edit TS source, then `yarn build`. The committed
+  `main.js` MUST match a fresh build (CI `git diff --exit-code` after build).
+- **Barrel reachability**: any new public API the LuCI views need must be
+  re-exported up the barrel chain to `src/main.ts` so it lands on `main.*`.
+  (Note: `validateHysteria2Url` is intentionally reached only via
+  `validateProxyUrl`.)
+- Backend access only via `fs.exec` of `/usr/bin/netshift` and
+  `/etc/init.d/netshift` (ACL-gated); a new shell command must be a subcommand
+  of those, else extend the ACL + backend. Clash API on `:9090`.
+- Style: strict TS, no `any`, functional components, named exports. Prettier
+  (2-space, single quotes, trailing-comma all, width 80). Unused vars must be
+  `_`-prefixed (CI is `--max-warnings=0`). E() handlers use the `click:`
+  attribute.
+- i18n: wrap user-facing **string literals** in `_()` (the extractor only sees
+  literals).
+- Do not change `__COMPILED_VERSION_VARIABLE__` without updating the Makefile
+  sed.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done. Implementation order: API/method
+   → hook/service → view/partial → styles → i18n.
+2. Implement in TS source using the `edit` tool.
+3. Add a vitest `.test.js` next to new pure logic (table-driven `describe.each`,
+   `_()` is identity-mocked, node env).
+4. Run the `frontend-ci` skill (`yarn ci`). Ensure `yarn build` leaves no git
+   diff (regenerated `main.js` is committed).
+5. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.opencode/agent/packaging-ci-engineer.md b/.opencode/agent/packaging-ci-engineer.md
new file mode 100644
index 00000000..a8d85edf
--- /dev/null
+++ b/.opencode/agent/packaging-ci-engineer.md
@@ -0,0 +1,60 @@
+---
+description: >-
+  Use when an architect spec describes packaging, build, test-harness, or CI
+  work: the OpenWRT Makefiles, Docker ipk/apk images, the SDK images,
+  tests/entrypoint.sh and docker-compose, .github/workflows, and install.sh
+  (including podkop→netshift migration). Implements and verifies build/test
+  paths.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: secondary
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "shellcheck*": allow
+---
+
+You are an experienced OpenWRT packaging / CI engineer for **NetShift**. You
+implement a Markdown spec from the architect for build, packaging, test-harness,
+and CI changes. Raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/packaging.md`.
+3. Read your memory: `docs/agent-rules/memory/packaging-ci-engineer.md`.
+
+## Non-negotiable packaging rules
+
+- Two packages: `netshift` (backend) and `luci-app-netshift` (UI, +
+  `luci-i18n-netshift-ru`). Both `PKGARCH=all`.
+- Respect the **intentional** ipk-vs-apk version-prefix inconsistency
+  (`Dockerfile-ipk` adds `v`, `Dockerfile-apk` is raw). Do not "fix" it blindly.
+- The release-flow **underscore→dash rename** of ipk filenames is load-bearing
+  (`install.sh` matches release assets by package-name prefix). Do not break it.
+- Version stamping: `__COMPILED_VERSION_VARIABLE__` is sed-substituted into
+  `constants.sh` (netshift Makefile, no `|| true`) and `main.js` (luci Makefile,
+  with `|| true`). Keep the placeholder literal consistent with the TS source.
+- `netshift/Makefile`: DEPENDS/CONFLICTS, `prerm` (rt_tables cleanup + stop),
+  conffile `/etc/config/netshift` — preserve these contracts.
+- Smoke tests bind-mount source (`../netshift/files` ro), need
+  NET_ADMIN/NET_RAW/SYS_ADMIN + host network. To add a test: `test_*` +
+  `main()` `all)` + case alias + usage line + compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- `install.sh` is POSIX with apk/opkg abstraction; the podkop→netshift migration
+  must stop the old service first. Run the `shellcheck` skill on it.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done.
+2. Implement with the `edit` tool.
+3. Run the `smoke-tests` skill (and the `shellcheck` skill for `install.sh`
+   changes). Verify both ipk and apk paths conceptually when touching build.
+4. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.opencode/agent/shell-backend-developer.md b/.opencode/agent/shell-backend-developer.md
new file mode 100644
index 00000000..57bf3de4
--- /dev/null
+++ b/.opencode/agent/shell-backend-developer.md
@@ -0,0 +1,64 @@
+---
+description: >-
+  Use when an architect spec describes backend work in netshift/files/usr/**:
+  POSIX ash + jq, sing-box config generation (sing_box_cm_*/sing_box_cf_*),
+  nftables tproxy, dnsmasq integration, UCI schema, the procd init script, and
+  the updater. Implements the spec fully and runs shellcheck + smoke tests.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: warning
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "shellcheck*": allow
+---
+
+You are an experienced POSIX shell + jq backend developer for **NetShift**
+(OpenWRT VPN router on sing-box). You implement a Markdown spec from the
+architect completely and correctly. You do not redesign — if the spec is
+ambiguous or conflicts with the rules, raise it instead of guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/backend-shell.md`.
+3. Read your memory: `docs/agent-rules/memory/shell-backend-developer.md`.
+
+## Non-negotiable backend rules
+
+- Target is **busybox ash + OpenWRT jq**. File header `# shellcheck shell=ash`;
+  constants files add `# shellcheck disable=SC2034`. Every variable `local`.
+- **OpenWRT jq has NO regex** — never use `test()/match()/sub()/gsub()`. Use
+  `split`/`startswith`/`endswith`/`contains`/`ascii` etc.
+- Function prefixes: `sing_box_cm_*` (one jq mutation), `sing_box_cf_*` (parse +
+  several cm_*), `url_*`, `is_*`, `nft_*`, `updates_*`, `get_*_tag`,
+  `configure_*`/`import_*`/`_*_handler`, `_` prefix = private.
+- Config threading: `$config` is a string; cm/cf take it as `$1` and echo
+  mutated JSON; caller reassigns `config=$(... "$config" ...)`.
+- `fatal` is only a log label — always follow a fatal log with `exit 1`.
+- Atomic writes: `*.tmp.$$` → `sing-box -c check` (fatal on fail) → md5sum
+  compare → `mv`. Validate JSON shape with `jq -e`.
+- New constants go in `constants.sh`; never hardcode ports/IPs/marks/paths.
+- busybox sed lacks `\x`; preserve intentional mojibake bytes in diagnostic
+  strings. Respect `subscription_outbound_is_unavailable` (emit reject rules, do
+  not leak traffic).
+
+## Workflow
+
+1. Plan the change against the spec's Definition of Done.
+2. Implement using the `edit` tool (never bulk shell rewrites of files).
+3. Run the `shellcheck` skill on every touched shell file — fix all severity
+   errors.
+4. Run the `smoke-tests` skill. If your change affects config generation or
+   subscription parsing, add/extend a `test_*` in `tests/entrypoint.sh` and
+   register it (`main()` `all)` list + case alias + usage line + compose
+   comment).
+5. Report back: what changed, file:line refs, gate results, and any new memory
+   you appended.
+
+Do not commit. Append durable findings to your memory file.
diff --git a/.opencode/command/describe.md b/.opencode/command/describe.md
new file mode 100644
index 00000000..cc888ce7
--- /dev/null
+++ b/.opencode/command/describe.md
@@ -0,0 +1,45 @@
+---
+description: Write a structured PR title and description for the current NetShift change.
+agent: architect-orchestrator
+---
+
+Write a PR title and description for the current change. Optional hint:
+
+$ARGUMENTS
+
+Steps:
+
+1. Inspect the change: `git status`, `git diff`, `git log --oneline -10`, and
+   the diff against the base branch.
+2. Produce a **title**: 5–15 words, imperative, optionally a leading gitmoji.
+3. Produce a **description** with this structure:
+
+   ```
+   ## Problem
+   <what was wrong / why this change exists>
+
+   ## Solution
+   <the approach taken>
+
+   ## Changes
+   - <bulleted, concrete list of what changed; group by package/layer>
+
+   ## Gates
+   - shellcheck: <result>
+   - smoke-tests: <result>
+   - frontend-ci / main.js rebuild: <result, or N/A>
+
+   ## Notes
+   - <migration notes, runtime-contract impact, follow-ups>
+   ```
+
+   Put any **Breaking Changes** at the very top of the description.
+
+Rules:
+- No filler ("This PR ..."). Be concrete and factual.
+- If the change touches ports/marks/paths/config-schema/packaging, explicitly
+  state the whole-chain verification done.
+- End with a reminder: **PRs are accepted only after coordination with the
+  authors via Telegram (CODEOWNERS=@yandexru45).**
+
+Do not commit or push.
diff --git a/.opencode/command/review.md b/.opencode/command/review.md
new file mode 100644
index 00000000..68dab489
--- /dev/null
+++ b/.opencode/command/review.md
@@ -0,0 +1,29 @@
+---
+description: Process PR / review-doc comments for NetShift — fix root cause, re-run the relevant gates, hand back for commit.
+agent: architect-orchestrator
+---
+
+You are running `/review` for NetShift. Input (PR URL, review doc path, or pasted
+comments):
+
+$ARGUMENTS
+
+Follow this:
+
+1. **Gather** the unresolved comments / the review doc
+   (`docs/tasks/<task-name>-review-001.md`). If a PR URL is given, use `gh` (it
+   will require confirmation for network/auth).
+2. **Triage.** Group comments by root cause. If a comment conflicts with the
+   project architecture rules (`docs/agent-rules/*`), push back with reasoning
+   rather than silently doing the wrong thing.
+3. **Fix.** Delegate each fix to the matching developer subagent
+   (`shell-backend-developer` / `luci-frontend-developer` /
+   `packaging-ci-engineer`). Fix the root cause, not just the symptom.
+4. **Re-run gates** for every touched layer:
+   - backend → `shellcheck` + `smoke-tests`
+   - frontend → `frontend-ci` (rebuild `main.js`, no git diff)
+   - packaging → smoke tests
+5. **Re-review** with `code-reviewer` if the change is substantial.
+6. **Hand back.** Summarize what was addressed per comment ID. **Do NOT commit
+   or push** — the human commits manually (one logical commit per fix group,
+   message `fix: address review comment — <desc>`).
diff --git a/.opencode/command/task.md b/.opencode/command/task.md
new file mode 100644
index 00000000..56232984
--- /dev/null
+++ b/.opencode/command/task.md
@@ -0,0 +1,49 @@
+---
+description: Run the full NetShift task lifecycle (clarify → design → decompose → implement → gates → review → hand back for commit).
+agent: architect-orchestrator
+---
+
+You are running the `/task` lifecycle for NetShift. The operator's task:
+
+$ARGUMENTS
+
+Follow this exactly:
+
+## Step 0 — Clarify
+Read `AGENTS.md`, the relevant `docs/agent-rules/*.md`, and your memory. Explore
+the relevant code. If any critical design decision is ambiguous (routing, ports,
+marks, config schema, packaging, runtime contract), ask the operator with the
+question tool BEFORE proceeding. Do not assume.
+
+## Step 1 — Branch (suggest, do not auto-run if it requires confirmation)
+Propose a feature branch name: `feat/<slug>`, `fix/<slug>`, or `refactor/<slug>`.
+Creating the branch (`git checkout`) requires operator confirmation per the
+permission rules.
+
+## Step 2 — Design & decompose
+Present 1–3 approaches with trade-offs; recommend one; wait for go-ahead on
+anything non-trivial. Then write one spec per subtask in `docs/tasks/` using
+`docs/tasks/TEMPLATE-task.md` (`task-NNN-<slug>.md`).
+
+## Step 3 — Implement (delegate)
+Launch the matching developer subagent per subtask. Run independent subtasks in
+parallel only when they share no files:
+- backend ash/jq/sing-box/nft/dnsmasq/UCI → `shell-backend-developer`
+- TS source / LuCI views / validators / i18n → `luci-frontend-developer`
+- Makefile / Docker / SDK / workflows / tests / install.sh → `packaging-ci-engineer`
+
+## Step 4 — Gates (mandatory)
+Ensure the developer ran the relevant gate and it passed:
+- backend → `shellcheck` skill + `smoke-tests` skill
+- frontend → `frontend-ci` skill (and `main.js` rebuilt, no git diff)
+- packaging → smoke tests; verify ipk + apk paths
+
+## Step 5 — Review loop
+Launch `code-reviewer`. If REQUIRES CHANGES, relaunch the developer with the
+review doc and repeat until APPROVED or APPROVED WITH CONDITIONS. Save the review
+doc to `docs/tasks/<task-name>-review-001.md`.
+
+## Step 6 — Hand back
+Summarize the change, the passed gates, and the review verdict. **Do NOT commit
+or push** — the human commits manually. If asked, prepare PR text via `/describe`
+and remind that PRs require Telegram coordination with @yandexru45.
diff --git a/.opencode/skill/frontend-ci/SKILL.md b/.opencode/skill/frontend-ci/SKILL.md
new file mode 100644
index 00000000..e3201737
--- /dev/null
+++ b/.opencode/skill/frontend-ci/SKILL.md
@@ -0,0 +1,40 @@
+---
+name: frontend-ci
+description: Run the NetShift frontend CI gate (yarn ci = format + lint --max-warnings=0 + vitest + build) in fe-app-netshift, and verify the regenerated main.js leaves no git diff. Use after changing any TypeScript source under fe-app-netshift/src/**.
+---
+
+# frontend-ci
+
+Run the frontend gate the same way `.github/workflows/frontend-ci.yml` does.
+All commands run in the `fe-app-netshift` directory.
+
+## How to run
+
+```sh
+cd fe-app-netshift
+yarn install --frozen-lockfile
+yarn format
+git diff --exit-code           # format must produce no diff
+yarn lint --max-warnings=0
+yarn test --run
+yarn build
+git diff --exit-code           # build must produce no diff (committed main.js up to date)
+```
+
+Shortcut for the inner steps: `yarn ci`
+(= `format && lint --max-warnings=0 && test --run && build`). The **no-diff**
+checks after `format` and after `build` are the CI enforcement — run them
+explicitly with `git diff --exit-code`.
+
+## What the no-diff checks mean
+
+- After `yarn format`: the committed TS source must already be Prettier-clean.
+- After `yarn build`: the committed
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` must
+  match a fresh tsup build. If it differs, commit the regenerated `main.js`.
+
+## Rules
+
+- Never hand-edit `main.js`. Edit TS source, then build.
+- Unused vars must be `_`-prefixed (lint runs `--max-warnings=0`).
+- Report each step's result and whether the working tree is clean. Be brief.
diff --git a/.opencode/skill/shellcheck/SKILL.md b/.opencode/skill/shellcheck/SKILL.md
new file mode 100644
index 00000000..5313a54f
--- /dev/null
+++ b/.opencode/skill/shellcheck/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: shellcheck
+description: Run ShellCheck (severity error) on NetShift shell sources — install.sh, netshift/files/usr/bin/netshift, and netshift/files/usr/lib/**.sh. Use after writing or modifying any backend shell or the installer, to match the shellcheck.yml CI gate.
+---
+
+# shellcheck
+
+Lint the NetShift shell sources the same way CI does (`.github/workflows/shellcheck.yml`,
+severity: error). Run this before handing back any backend or `install.sh` change.
+
+## What to lint
+
+- `install.sh`
+- `netshift/files/usr/bin/netshift`
+- `netshift/files/usr/lib/**.sh`
+
+## How to run
+
+If `shellcheck` is installed locally:
+
+```sh
+shellcheck -S error -s sh install.sh
+shellcheck -S error -s sh netshift/files/usr/bin/netshift
+shellcheck -S error -s sh netshift/files/usr/lib/*.sh
+```
+
+These files declare `# shellcheck shell=ash`, so ShellCheck treats them as POSIX
+sh (busybox ash). Constants files use `# shellcheck disable=SC2034`.
+
+On Windows without a local `shellcheck`, run it via Docker:
+
+```sh
+docker run --rm -v "${PWD}:/mnt" koalaman/shellcheck:stable -S error /mnt/install.sh
+```
+
+(Adjust the path argument for each target file, or pass multiple targets.)
+
+## Rules
+
+- Treat any **error**-severity finding as a failure that must be fixed.
+- Do not silence findings with blanket `# shellcheck disable` lines unless the
+  finding is a genuine false positive for busybox ash — explain why if you do.
+- Report which files were checked and the pass/fail result. Be brief.
diff --git a/.opencode/skill/smoke-tests/SKILL.md b/.opencode/skill/smoke-tests/SKILL.md
new file mode 100644
index 00000000..b4adae15
--- /dev/null
+++ b/.opencode/skill/smoke-tests/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: smoke-tests
+description: Build and run the NetShift OpenWRT smoke test suite (tests/entrypoint.sh) via Docker. Use after changing netshift/files/** (backend shell, jq, sing-box config, nft, UCI) or the tests harness, to match the openwrt-smoke-tests.yml CI gate.
+---
+
+# smoke-tests
+
+Run the OpenWRT rootfs smoke suite exactly as CI does
+(`.github/workflows/openwrt-smoke-tests.yml`). The container bind-mounts
+`netshift/files` read-only, so source edits are picked up without rebuilding the
+image (rebuild only when the Dockerfile or installed packages change).
+
+## How to run (all categories)
+
+```sh
+docker compose -f tests/docker-compose.yml build netshift-test
+docker compose -f tests/docker-compose.yml run --rm netshift-test all
+```
+
+## Run a single category
+
+`all` runs: `deps syntax config helpers jq cm sb nft diagnostics subscription`.
+Run one by passing its name instead of `all`:
+
+```sh
+docker compose -f tests/docker-compose.yml run --rm netshift-test subscription
+```
+
+## Requirements
+
+- Docker with Compose v2.
+- The compose service grants `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` and host
+  networking — required for the `nft` and `dns` tests. Without those caps the nft
+  tests FAIL (they do not skip).
+
+## Adding a test
+
+1. Write `test_xyz()` in `tests/entrypoint.sh` using the `header`/`pass`/`fail`/
+   `skip` helpers.
+2. Add it to `main()`'s `all)` list.
+3. Add a `case` alias so it can be run individually.
+4. Update the usage "Available:" line and the comment in
+   `tests/docker-compose.yml`.
+
+Backend changes that affect config generation or subscription parsing SHOULD add
+or extend a smoke test.
+
+## Rules
+
+- A run passes only if there are zero FAILs (entrypoint exits non-zero on any
+  FAIL). Report PASS/FAIL/SKIP counts. Be brief.
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..0877308c
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,90 @@
+# NetShift — AI agent context (composition root)
+
+This file is auto-loaded by OpenCode (and mirrored for Claude Code in
+`.claude/CLAUDE.md`). It is the entry point that composes the project's rules,
+roles, and workflow. Read it fully before doing anything in this repository.
+
+## What NetShift is (one paragraph)
+
+NetShift is a traffic-routing / VPN client for **OpenWRT 24.10+** routers, built
+on top of **sing-box**. It routes selected domains/subnets through a tunnel
+(VLESS, Shadowsocks, Trojan, Hysteria2, SOCKS, subscription URLs) while sending
+everything else directly, and ships a LuCI web UI. It is a fork of
+`itdoginfo/podkop`, rebranded to NetShift at 0.8.0. It is **beta**.
+License: GPL-2.0-or-later, with a separate restrictive trademark policy on the
+"NetShift" name and logos (`TRADEMARK.md`).
+
+## Architecture in one sentence
+
+`luci-app-netshift` (LuCI UI: hand-written `.js` views + the generated
+`main.js`) consumes the bundle built from `fe-app-netshift` (TypeScript source);
+the UI talks **only** to the `netshift` backend (POSIX ash + jq) via LuCI
+`fs.exec` of `/usr/bin/netshift` and `/etc/init.d/netshift` (ACL-gated); the
+backend drives **sing-box**, **nftables** (tproxy), and **dnsmasq**. No layer
+skips another.
+
+## Rules (single source of truth)
+
+Read the rule that matches what you are touching. These are authoritative.
+
+- @docs/agent-rules/project-core.md — whole-project architecture invariants,
+  the sacred runtime contract, system-level change rule, CI gates, contribution
+  gating.
+- @docs/agent-rules/backend-shell.md — `netshift/files/usr/**` (ash + jq,
+  sing-box config, nft, dnsmasq, UCI). Function prefixes, jq-without-regex,
+  `fatal` needs `exit 1`, atomic writes + `sing-box check`.
+- @docs/agent-rules/frontend-luci.md — `fe-app-netshift/src/**` and
+  `luci-app-netshift/htdocs/**`. Generated `main.js`, barrel reachability,
+  `_()` i18n, `yarn ci`.
+- @docs/agent-rules/packaging.md — Makefiles, Docker ipk/apk, SDK, smoke tests,
+  `.github/workflows`, `install.sh`, release flow.
+
+## The sacred runtime contract (never change casually)
+
+TProxy inbound `127.0.0.1:1602` · DNS inbound `127.0.0.42:53` · Clash API
+`:9090` · FakeIP `198.18.0.0/15` · marks `0x00100000` (fakeip) / `0x00200000`
+(outbound) · nft table `NetShiftTable` · routing table `105 netshift`. All
+defined in `netshift/files/usr/lib/constants.sh` — reference them, never
+hardcode.
+
+## Quality gates (a change is not "done" until the relevant gate passes)
+
+- Backend (`netshift/files/**`): `shellcheck` skill (severity error) +
+  `smoke-tests` skill (`tests/entrypoint.sh all`).
+- Frontend (`fe-app-netshift/**`): `frontend-ci` skill (`yarn ci`), and the
+  committed `main.js` must be regenerated (build leaves no git diff).
+- Packaging/CI: smoke tests at minimum; verify both ipk and apk paths.
+
+## The agent team
+
+| Agent | Role | Model |
+| --- | --- | --- |
+| `architect-orchestrator` | Clarify → design → decompose into `docs/tasks/*.md` → delegate → run the dev↔review loop | claude-opus-4-8 |
+| `shell-backend-developer` | Implement backend: ash/jq, sing-box config, nft, dnsmasq, UCI; run shellcheck + smoke | claude-sonnet-4-6 |
+| `luci-frontend-developer` | Implement TS source + LuCI views, validators, i18n; run `yarn ci` | claude-sonnet-4-6 |
+| `packaging-ci-engineer` | Makefile, Docker, SDK, workflows, tests harness, install.sh | claude-sonnet-4-6 |
+| `code-reviewer` | Read-only review of the diff against the rules; verdict APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES | claude-haiku-4-5 |
+
+Each agent reads its own memory file under `docs/agent-rules/memory/` before
+working and appends durable findings there.
+
+## Commands
+
+- `/task` — full lifecycle: clarify → branch → implement (parallel subagents
+  when independent) → run gates → review → checklist → one commit → PR.
+- `/review` — process PR / review-doc comments, fix root cause, re-run gates.
+- `/describe` — write a structured PR title + description.
+
+## Non-negotiables
+
+- **Humans commit manually. Agents NEVER auto-commit or push.** Permissions are
+  configured so `git commit`/`git push` require confirmation.
+- Every change passes a `code-reviewer` verdict before commit.
+- Never edit the generated `main.js` by hand. Never use jq regex on OpenWRT.
+- Never change ports/marks/paths without verifying the whole chain.
+- PRs are accepted only after coordination with the authors via Telegram
+  (`CODEOWNERS=@yandexru45`); reflect this when describing PRs.
+
+## Operator manual
+
+Humans: see @docs/README-AGENTS.md (Russian) for how to drive this system.
diff --git a/Dockerfile-apk b/Dockerfile-apk
index 9c880a4a..f96b34d6 100644
--- a/Dockerfile-apk
+++ b/Dockerfile-apk
@@ -1,11 +1,11 @@
 FROM itdoginfo/openwrt-sdk-apk:25.12.3
 
-ARG PODKOP_VERSION
-ENV PODKOP_VERSION=${PODKOP_VERSION}
+ARG NETSHIFT_VERSION
+ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}
 
-COPY ./podkop /builder/package/feeds/utilities/podkop
-COPY ./luci-app-podkop /builder/package/feeds/luci/luci-app-podkop
+COPY ./netshift /builder/package/feeds/utilities/netshift
+COPY ./luci-app-netshift /builder/package/feeds/luci/luci-app-netshift
 
 RUN make defconfig && \
-    make package/podkop/compile -j4 V=s && \
-    make package/luci-app-podkop/compile -j4 V=s
\ No newline at end of file
+    make package/netshift/compile -j4 V=s && \
+    make package/luci-app-netshift/compile -j4 V=s
diff --git a/Dockerfile-ipk b/Dockerfile-ipk
index 3dfac2ab..878e5baa 100644
--- a/Dockerfile-ipk
+++ b/Dockerfile-ipk
@@ -1,11 +1,11 @@
 FROM itdoginfo/openwrt-sdk-ipk:24.10.6
 
-ARG PODKOP_VERSION
+ARG NETSHIFT_VERSION
+ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}
 
-COPY ./podkop /builder/package/feeds/utilities/podkop
-COPY ./luci-app-podkop /builder/package/feeds/luci/luci-app-podkop
+COPY ./netshift /builder/package/feeds/utilities/netshift
+COPY ./luci-app-netshift /builder/package/feeds/luci/luci-app-netshift
 
-RUN export PODKOP_VERSION="v${PODKOP_VERSION}" && \
-    make defconfig && \
-    make package/podkop/compile V=s -j4 && \
-    make package/luci-app-podkop/compile V=s -j4
\ No newline at end of file
+RUN make defconfig && \
+    make package/netshift/compile V=s -j4 && \
+    make package/luci-app-netshift/compile V=s -j4
diff --git a/README.md b/README.md
index a55dd549..1f0f5d81 100644
--- a/README.md
+++ b/README.md
@@ -1,54 +1,229 @@
-# Podkop
+<div align="center">
 
-Маршрутизация трафика для OpenWrt.
+# NetShift
 
-Направляйте нужные ресурсы в туннель, а остальное — напрямую. Открытое программное обеспечение на базе [sing-box](https://github.com/SagerNet/sing-box).
+<p align="center">
+  <img src="./docs/icon.png" alt="Clash" width="128" />
+  <br>
+  <br>
+  <a href="https://github.com/yandexru45/netshift/releases">
+    <img src="https://img.shields.io/github/release/yandexru45/netshift/all.svg">
+  </a>
+</p>
+<h3 align="center"><a href="https://github.com/sagernet/sing-box">Sing-box</a> client for Openwrt</h3>
+</div>
+
+---
+<p align="center">
+  <a href="https://t.me/netshift_news"><img src="https://img.shields.io/badge/Telegram-Channel-Link?style=for-the-badge&logo=Telegram&logoColor=white&logoSize=auto&color=blue" alt="Telegram Channel" /></a>
+  <a href="https://t.me/netshift_chat"><img src="https://img.shields.io/badge/Telegram-Chat-yes?style=for-the-badge&logo=Telegram&logoColor=white&logoSize=auto&color=blue" alt="Telegram Chat" /></a>
+</p>
+
+---
+
+**NetShift** - маршрутизатор трафика для OpenWrt. Направляйте нужные ресурсы в туннель, а остальное - напрямую. Открытое ПО на базе [sing-box](https://github.com/SagerNet/sing-box).
+
+Это форк [itdoginfo/podkop](https://github.com/itdoginfo/podkop), значительно расширяющий функциональность.
 
 > [!WARNING]
 > Проект находится в стадии бета-версии. Возможны ошибки, нестабильная работа и существенные изменения функциональности.
 
-# Вещи, которые необходимо знать перед установкой
+---
+
+## Функции
+
+- [x] **Маршрутизация по доменам и подсетям** - нужное в туннель, остальное напрямую<br><sub>VLESS · Shadowsocks · Trojan · Hysteria2 · готовые community-списки</sub>
+- [x] **Subscription URL** - ссылки подписки от провайдера с автообновлением и автовыбором лучшего сервера<br><sub>любая подписка remnawave · 3x-ui · marzban · github</sub>
+- [x] **Переключаемое ядро sing-box** - стабильное ↔ sing-box-extended прямо из веб-интерфейса<br><sub>клиентский транспорт xhttp · установка и откат в один клик</sub>
+- [x] **Веб-интерфейс LuCI** - дашборд, диагностика и настройки без ручной правки конфигов<br><sub>статус серверов · проверка соединения · логи</sub>
+- [x] **Автоматическая миграция** - обновление со старого podkop переносит конфиг без перенастройки
+
+
+---
+
+<div align="center">
+
+<img src="docs/screenshot.png" alt="NetShift в LuCI" width="800" />
+
+</div>
+
+---
+
+## Вещи, которые необходимо знать перед установкой
+
+<details open>
+<summary><b>Системные требования</b></summary>
+
+- OpenWrt **24.10** или выше.
+- Минимум **25 МБ** свободного места. Устройства с флеш-памятью 16 МБ не поддерживаются.
+
+</details>
+
+<details>
+<summary><b>Обновления и конфигурация</b></summary>
 
-### Обновления и конфигурация
 - При обновлении **обязательно** [очищайте кэш LuCI](https://podkop.net/docs/clear-browser-cache/).
-- После обновления проверяйте конфигурацию — она может изменяться между версиями.
-- При старте Podkop модифицируется конфигурация Dnsmasq.
-- Podkop изменяет конфигурацию sing-box. Если вы используете собственную конфигурацию, заранее сохраните её.
+- После обновления проверяйте конфигурацию - она может меняться между версиями.
+- При старте NetShift модифицирует конфигурацию Dnsmasq.
+- NetShift изменяет конфигурацию sing-box. Если используете собственную - заранее сохраните её.
+
+</details>
+
+<details>
+<summary><b>Ограничения и особенности</b></summary>
+
+- Если установлен **Getdomains**, его [необходимо удалить](https://github.com/itdoginfo/domain-routing-openwrt?tab=readme-ov-file#скрипт-для-удаления).
+- **Dashboard** работает только по HTTP (особенность Clash API). По HTTPS или через домен может быть недоступен.
 
-### Системные требования
-- Требуется OpenWrt 24.10 или выше.
-- Необходимо минимум 25 МБ свободного места на устройстве. Устройства с флеш-памятью 16 МБ не поддерживаются.
+</details>
 
-### Важные ограничения и особенности
-- Если установлен Getdomains, его [необходимо удалить](https://github.com/itdoginfo/domain-routing-openwrt?tab=readme-ov-file#скрипт-для-удаления)
-- Dashboard доступен только при подключении по HTTP (из-за особенностей Clash API). При использовании HTTPS или домена работа может быть недоступна.
+<details>
+<summary><b>Поддержка и диагностика</b></summary>
 
-### Поддержка и диагностика
 - [Руководство по диагностике](https://podkop.net/docs/diagnostics/)
-- Актуальные изменения публикуются в [Telegram-чате](https://t.me/itdogchat/81758/420321). Пожалуйста, ознакомьтесь с закрепленными сообщениями.
-- При возникновении проблем оставляйте технически грамотный фидбэк в GitHub Issues и Telegram-чате.
+- Актуальные изменения - в [Telegram-чате](https://t.me/netshift_chat/2) (читайте закреплённые сообщения).
+- При проблемах оставляйте технически грамотный фидбэк в GitHub Issues и Telegram-чате.
+
+</details>
+
+<details>
+<summary><b>Миграция с podkop (0.8.0) и смена формата конфига (0.7.0)</b></summary>
+
+**0.8.0 - переименование в NetShift.** Пакет теперь `netshift` (бинарь `/usr/bin/netshift`), конфиг - `/etc/config/netshift`, LuCI-приложение - `luci-app-netshift`. При обновлении старый конфиг `/etc/config/podkop` автоматически мигрируется в `/etc/config/netshift`, резервная копия сохраняется в `/etc/config/podkop.bak.pre-netshift`. туннель продолжит работать без перенастройки.
+
+**0.7.0 - несовместимый формат конфига.** Старые значения несовместимы - нужно настроить заново. Скрипт установки обнаружит старую версию и предложит сделать это автоматически. Вручную:
+
+```sh
+mv /etc/config/netshift /etc/config/netshift-070
+wget -O /etc/config/netshift https://raw.githubusercontent.com/yandexru45/netshift/refs/heads/main/netshift/files/etc/config/netshift
+# затем настроить заново через LuCI или UCI
+```
 
+</details>
 
-# Документация
-https://podkop.net/
+## Установка NetShift
 
-# Установка Podkop
-Полное руководство доступно в [документации](https://podkop.net/docs/install/)
+Полная инструкция - в [документации](https://podkop.net/docs/install/).
 
-Для установки и обновления достаточно выполнить один скрипт:
+Для установки и обновления достаточно одного скрипта:
+
+```sh
+sh <(wget -O - https://raw.githubusercontent.com/yandexru45/netshift/refs/heads/main/install.sh)
 ```
-sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/podkop/refs/heads/main/install.sh)
+
+Интерфейс появится в LuCI: **Services → NetShift**.
+
+<details>
+<summary><b>Настройка подписки (Subscription URL) через UCI</b></summary>
+
+При скачивании подписки отправляются заголовки:
+
+| Заголовок | Значение |
+|---|---|
+| `User-Agent` | `singbox/<версия>` |
+| `X-HWID` | уникальный идентификатор роутера |
+| `X-Device-OS` | `OpenWrt Linux` |
+| `X-Device-Model` | модель роутера |
+| `X-Ver-OS` | версия ядра |
+
+```sh
+uci set netshift.my_sub=section
+uci set netshift.my_sub.connection_type='proxy'
+uci set netshift.my_sub.proxy_config_type='subscription'
+uci set netshift.my_sub.subscription_url='https://your-provider.com/api/sub'
+uci set netshift.my_sub.subscription_update_interval='1h'
+uci add_list netshift.my_sub.community_lists='russia_inside'
+uci commit netshift
 ```
 
-## Будущее
-Планы развития проекта в настоящее время не публикуются в виде открытого roadmap. Обсуждение направлений и задач разработки ведётся авторами и контрибьюторами.
+Ручное обновление подписки:
 
-> [!IMPORTANT]  
-> Pull Request принимаются только после согласования с авторами в Telegram-чате. На данный момент PR без предварительного обсуждения не рассматриваются.
+```sh
+/usr/bin/netshift subscription_update
+```
 
-> [!WARNING]
-> Данное программное обеспечение предоставляется «как есть», без каких-либо явных или подразумеваемых гарантий, включая гарантии коммерческой пригодности и соответствия определённой цели. 
-> 
-> Правообладатели и участники проекта не несут ответственности за любые прямые, косвенные, случайные, специальные или иные убытки, возникшие в результате использования программного обеспечения, включая потерю данных, прибыли или прерывание деятельности, даже если они были предупреждены о возможности таких последствий.
+</details>
+
+<details>
+<summary><b>Ядро sing-box-extended (xhttp)</b></summary>
+
+Переключение ядра между стабильным sing-box и сборкой **sing-box-extended** прямо из вкладки **Diagnostics** в LuCI:
+
+- **Install extended** - установить расширенное ядро sing-box-extended.
+- **Install stable** - вернуться на стабильное ядро.
+
+После установки расширенного ядра становится доступен клиентский транспорт **xhttp** (только клиентский режим, не серверный). По умолчанию ставится стабильное ядро - extended включается по желанию.
+
+</details>
+
+## Project Structure
+
+```
+.
+├── netshift/                       # Бэкенд-пакет (POSIX ash + jq)
+│   ├── Makefile                    # Описание OpenWrt-пакета
+│   └── files/
+│       ├── etc/config/netshift     # UCI-конфиг по умолчанию
+│       ├── etc/init.d/netshift     # procd init-скрипт
+│       └── usr/
+│           ├── bin/netshift        # Точка входа CLI (диспетчер команд)
+│           └── lib/                # constants, helpers, nft, rulesets,
+│                                   #   sing_box_config_*, updater, logging
+│
+├── luci-app-netshift/              # LuCI веб-интерфейс
+│   ├── Makefile
+│   ├── htdocs/.../view/netshift/   # main.js (автоген) + hand-written views
+│   ├── po/                         # Переводы (генерируются из fe-app)
+│   └── root/                       # menu.d · acl.d · uci-defaults
+│
+├── fe-app-netshift/                # TypeScript-исходник для main.js (tsup)
+│   ├── src/netshift/               # fetchers · methods · services · tabs
+│   ├── src/{validators,helpers,icons,partials}
+│   └── locales/                    # Исходные переводы (netshift.pot / .po)
+│
+├── sdk/                            # Базовые образы OpenWrt SDK
+├── Dockerfile-ipk · Dockerfile-apk # Сборка пакетов
+└── install.sh                      # Установщик + миграция с podkop
+```
+
+## Build Artifacts
+
+Пакеты собираются в Docker-образе OpenWrt SDK (24.10) и публикуются как релиз при push git-тега ([`.github/workflows/build.yml`](.github/workflows/build.yml)).
+
+| Пакет | Формат | Назначение |
+|---|---|---|
+| `netshift` | `.ipk` / `.apk` | Бэкенд: CLI, init-скрипт, библиотеки, UCI-конфиг |
+| `luci-app-netshift` | `.ipk` / `.apk` | Веб-интерфейс LuCI |
+| `luci-i18n-netshift-ru` | `.ipk` / `.apk` | Русская локализация интерфейса |
+
+Локальная сборка:
+
+```sh
+# ipk (большинство устройств OpenWrt 24.10)
+docker build -f Dockerfile-ipk --build-arg NETSHIFT_VERSION=0.8.0 -t netshift:ipk .
+
+# apk (новые сборки OpenWrt на apk)
+docker build -f Dockerfile-apk --build-arg NETSHIFT_VERSION=0.8.0 -t netshift:apk .
+```
+
+> Требуется sing-box >= 1.12.0 и jq >= 1.7.1 на целевом устройстве.
+
+## Star History
+
+<a href="https://www.star-history.com/#yandexru45/netshift&Date">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date&theme=dark" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date" />
+   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date" />
+ </picture>
+</a>
+
+## Credits
+
+- [itdoginfo/podkop](https://github.com/itdoginfo/podkop) - исходный проект, форком которого является NetShift.
+- [sing-box](https://github.com/SagerNet/sing-box) - движок маршрутизации.
+
+Лицензия: **GPL-2.0-or-later** - см. [LICENSE](LICENSE).
 
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/itdoginfo/podkop)
\ No newline at end of file
+> [!IMPORTANT]
+> Pull Request принимаются только после согласования с авторами в [Telegram-чате](https://t.me/netshift_chat/17).
diff --git a/TRADEMARK.md b/TRADEMARK.md
index f7fbf71b..b949d1a4 100644
--- a/TRADEMARK.md
+++ b/TRADEMARK.md
@@ -1,51 +1,51 @@
 Trademark Guidelines
 
-Version 1.0 dated May 28, 2026
+Version 1.0 dated 2026
 
-This trademark policy was prepared to help you understand how to use the Podkop trademarks, service marks, and logos in connection with the Podkop open source project and related software.
+This trademark policy was prepared to help you understand how to use the NetShift trademarks, service marks, and logos in connection with the NetShift open source project and related software.
 
-While the Podkop software is available under an open source license, that license does not grant permission to use the Podkop trademarks, service marks, or logos. This policy explains acceptable use of the Podkop brand and related marks.
+While the NetShift software is available under an open source license, that license does not grant permission to use the NetShift trademarks, service marks, or logos. This policy explains acceptable use of the NetShift brand and related marks.
 
 This Policy covers:
-1. Our word trademarks and service marks: Podkop
-2. Our logos, icons, and other Podkop brand assets
+1. Our word trademarks and service marks: NetShift
+2. Our logos, icons, and other NetShift brand assets
 
 This policy encompasses all trademarks and service marks, whether they are registered or not.
 
 ## 1. General Guidelines
 
-Whenever you use one of our marks, you must always do so in a way that does not mislead anyone about what they are getting and from whom. For example, you cannot say you are distributing Podkop software when you are distributing a modified version of it, because recipients may not understand the differences between your modified versions and our own.
+Whenever you use one of our marks, you must always do so in a way that does not mislead anyone about what they are getting and from whom. For example, you cannot say you are distributing NetShift software when you are distributing a modified version of it, because recipients may not understand the differences between your modified versions and our own.
 
 You also cannot use our logo on your website in a way that suggests that your website is an official website or that we endorse your website.
 
-You can, however, say that you like the Podkop project, that you participate in the Podkop community, or that you are providing an unmodified version of the Podkop software.
+You can, however, say that you like the NetShift project, that you participate in the NetShift community, or that you are providing an unmodified version of the NetShift software.
 
 You may not use or register our marks, or variations of them as part of your own trademark, service mark, domain name, company name, trade name, product name or service name.
 
 Trademark law does not allow your use of names or trademarks that are too similar to ours. You therefore may not use an obvious variation of any of our marks or any phonetic equivalent, foreign language equivalent, takeoff, or abbreviation for a similar or compatible product or service. For example, we would consider the following too similar to one of our Marks:
 
-- MyPodkop
-- Open-Podkop
-- PodkopX
-- Podkop Lite
-- Podkop Pro
+- MyNetShift
+- Open-NetShift
+- NetShiftX
+- NetShift Lite
+- NetShift Pro
 
 ## 2. Acceptable Uses
 ### Unmodified Code
 
-When you redistribute an unmodified copy of Podkop software, you must not remove any Podkop trademarks, notices, or branding included in the original distribution.
+When you redistribute an unmodified copy of NetShift software, you must not remove any NetShift trademarks, notices, or branding included in the original distribution.
 
 ### Modified Code
 
-If you distribute a modified version of Podkop software, you may not use the Podkop name, trademarks, or logos in connection with your modified version, except to accurately describe the origin of the software in factual statements.
+If you distribute a modified version of NetShift software, you may not use the NetShift name, trademarks, or logos in connection with your modified version, except to accurately describe the origin of the software in factual statements.
 
-You must replace any Podkop branding, including names displayed in user interfaces, logs, documentation, and other user-facing elements, with your own distinct name and branding, so that your modified version is clearly distinguishable from the original Podkop software.
+You must replace any NetShift branding, including names displayed in user interfaces, logs, documentation, and other user-facing elements, with your own distinct name and branding, so that your modified version is clearly distinguishable from the original NetShift software.
 
-You must remove all Podkop logos and any other brand assets from the modified version.
+You must remove all NetShift logos and any other brand assets from the modified version.
 
-You may not present your modified version as Podkop or as an official Podkop release, nor may you use the Podkop name in a way that suggests endorsement, affiliation, or official status.
+You may not present your modified version as NetShift or as an official NetShift release, nor may you use the NetShift name in a way that suggests endorsement, affiliation, or official status.
 
-You may only refer to Podkop in a factual and descriptive manner, for example: “This software is derived from Podkop open-source software.”
+You may only refer to NetShift in a factual and descriptive manner, for example: “This software is derived from NetShift open-source software.”
 
 ### Statements about Compatibility
 
@@ -60,4 +60,4 @@ You must not register any domain that includes our word marks or any variant or
 
 Always use trademarks in their exact form with correct spelling. They must not be abbreviated, modified, hyphenated, or combined with other words in a way that creates a new product or service name.
 
-Unacceptable: Podcop
\ No newline at end of file
+Unacceptable: NetShfit
diff --git a/TRADEMARK_RU.md b/TRADEMARK_RU.md
index f5181578..64186381 100644
--- a/TRADEMARK_RU.md
+++ b/TRADEMARK_RU.md
@@ -1,52 +1,52 @@
 Руководство по использованию товарных знаков
 
-Версия 1.0 от 28 мая 2026 года
+Версия 1.0 от 2026 года
 
-Настоящая политика в отношении товарных знаков подготовлена для того, чтобы помочь вам понять, как использовать товарные знаки, знаки обслуживания и логотипы Podkop в связи с открытым исходным кодом проекта Podkop и связанным программным обеспечением.
+Настоящая политика в отношении товарных знаков подготовлена для того, чтобы помочь вам понять, как использовать товарные знаки, знаки обслуживания и логотипы NetShift в связи с открытым исходным кодом проекта NetShift и связанным программным обеспечением.
 
-Хотя программное обеспечение Podkop распространяется под лицензией с открытым исходным кодом, эта лицензия не предоставляет разрешения на использование товарных знаков Podkop, знаков обслуживания или логотипов. Данная политика объясняет допустимое использование бренда Podkop и связанных обозначений.
+Хотя программное обеспечение NetShift распространяется под лицензией с открытым исходным кодом, эта лицензия не предоставляет разрешения на использование товарных знаков NetShift, знаков обслуживания или логотипов. Данная политика объясняет допустимое использование бренда NetShift и связанных обозначений.
 
 Настоящая Политика охватывает:
-1. Наши словесные товарные знаки и знаки обслуживания: Podkop
-2. Наши логотипы, иконки и другие бренд-активы Podkop
+1. Наши словесные товарные знаки и знаки обслуживания: NetShift
+2. Наши логотипы, иконки и другие бренд-активы NetShift
 
 Данная политика распространяется на все товарные знаки и знаки обслуживания, независимо от того, зарегистрированы они или нет.
 
 ## 1. Общие рекомендации
 
-При использовании любого из наших знаков вы всегда должны делать это таким образом, чтобы никого не вводить в заблуждение относительно того, что именно они получают и от кого. Например, вы не можете утверждать, что распространяете программное обеспечение Podkop, если вы распространяете его модифицированную версию, поскольку получатели могут не понимать различий между вашей модифицированной версией и нашей оригинальной.
+При использовании любого из наших знаков вы всегда должны делать это таким образом, чтобы никого не вводить в заблуждение относительно того, что именно они получают и от кого. Например, вы не можете утверждать, что распространяете программное обеспечение NetShift, если вы распространяете его модифицированную версию, поскольку получатели могут не понимать различий между вашей модифицированной версией и нашей оригинальной.
 
 Вы также не можете использовать наш логотип на своём сайте таким образом, чтобы это создавало впечатление, что ваш сайт является официальным сайтом или что мы одобряем ваш сайт.
 
-Однако вы можете указывать, что вам нравится проект Podkop, что вы участвуете в сообществе Podkop или что вы распространяете немодифицированную версию программного обеспечения Podkop.
+Однако вы можете указывать, что вам нравится проект NetShift, что вы участвуете в сообществе NetShift или что вы распространяете немодифицированную версию программного обеспечения NetShift.
 
 Вы не имеете права использовать или регистрировать наши знаки, а также их вариации, как часть вашего собственного товарного знака, знака обслуживания, доменного имени, названия компании, коммерческого наименования, названия продукта или услуги.
 
 Закон о товарных знаках не допускает использование названий или знаков, которые слишком похожи на наши. Поэтому вы не можете использовать очевидные вариации наших знаков или любые фонетически, иностранно-языковые эквиваленты, производные, аббревиатуры для похожего или совместимого продукта или услуги. Например, мы считаем слишком похожими на наши знаки следующие варианты:
 
-- MyPodkop
-- Open-Podkop
-- PodkopX
-- Podkop Lite
-- Podkop Pro
+- MyNetShift
+- Open-NetShift
+- NetShiftX
+- NetShift Lite
+- NetShift Pro
 
 ## 2. Допустимое использование
 
 ### Немодифицированный код
 
-При распространении немодифицированной копии программного обеспечения Podkop вы не должны удалять товарные знаки, уведомления или брендинг Podkop, включённые в исходное распространение.
+При распространении немодифицированной копии программного обеспечения NetShift вы не должны удалять товарные знаки, уведомления или брендинг NetShift, включённые в исходное распространение.
 
 ### Модифицированный код
 
-Если вы распространяете модифицированную версию программного обеспечения Podkop, вы не можете использовать название Podkop, товарные знаки или логотипы в связи с вашей модифицированной версией, за исключением точного описания происхождения программного обеспечения в фактических утверждениях.
+Если вы распространяете модифицированную версию программного обеспечения NetShift, вы не можете использовать название NetShift, товарные знаки или логотипы в связи с вашей модифицированной версией, за исключением точного описания происхождения программного обеспечения в фактических утверждениях.
 
-Вы обязаны заменить все элементы брендинга Podkop, включая названия, отображаемые в пользовательском интерфейсе, логах, документации и других пользовательских элементах, на собственное отличительное название и брендинг, чтобы ваша модифицированная версия была явно отличима от оригинального программного обеспечения Podkop.
+Вы обязаны заменить все элементы брендинга NetShift, включая названия, отображаемые в пользовательском интерфейсе, логах, документации и других пользовательских элементах, на собственное отличительное название и брендинг, чтобы ваша модифицированная версия была явно отличима от оригинального программного обеспечения NetShift.
 
-Вы должны удалить все логотипы Podkop и любые другие бренд-материалы из модифицированной версии.
+Вы должны удалить все логотипы NetShift и любые другие бренд-материалы из модифицированной версии.
 
-Вы не можете представлять вашу модифицированную версию как Podkop или как официальную версию Podkop, а также использовать название Podkop таким образом, чтобы это подразумевало одобрение, аффилированность или официальный статус.
+Вы не можете представлять вашу модифицированную версию как NetShift или как официальную версию NetShift, а также использовать название NetShift таким образом, чтобы это подразумевало одобрение, аффилированность или официальный статус.
 
-Вы можете ссылаться на Podkop только в фактическом и описательном контексте, например: «Это программное обеспечение основано на программном обеспечении Podkop с открытым исходным кодом».
+Вы можете ссылаться на NetShift только в фактическом и описательном контексте, например: «Это программное обеспечение основано на программном обеспечении NetShift с открытым исходным кодом».
 
 ### Упоминания о совместимости
 
@@ -62,4 +62,4 @@
 
 Всегда используйте товарные знаки в их точной форме с корректным написанием. Их нельзя сокращать, изменять, соединять дефисами или объединять с другими словами таким образом, чтобы это создавало новое название продукта или услуги.
 
-Недопустимо: Podcop
\ No newline at end of file
+Недопустимо: NetShfit
diff --git a/docs/README-AGENTS.md b/docs/README-AGENTS.md
new file mode 100644
index 00000000..79d26cc1
--- /dev/null
+++ b/docs/README-AGENTS.md
@@ -0,0 +1,181 @@
+# NetShift — система AI-агентов (руководство оператора)
+
+Это руководство для **человека**, который запускает AI-агентов на проекте
+NetShift. Описанная здесь система переносит профессиональные практики
+agent-разработки: специализированные агенты, шлюз код-ревью, накопление знаний в
+памяти и строгие правила архитектуры. Работает в двух инструментах:
+**OpenCode** и **Claude Code** — с единым источником правил.
+
+> Сами агенты, правила и команды написаны на английском (так точнее работает
+> LLM). Это руководство — на русском.
+
+## TL;DR
+
+1. Открываешь проект в OpenCode (или Claude Code).
+2. Даёшь задачу через команду `/task` (или просто текстом оркестратору).
+3. Оркестратор уточняет, проектирует, раскладывает задачу на подзадачи в
+   `docs/tasks/*.md`, делегирует разработчикам, прогоняет шлюзы и код-ревью.
+4. Когда всё прошло ревью — **коммитишь сам, руками**. Агенты никогда не
+   коммитят.
+
+## Что где лежит
+
+```
+AGENTS.md                       # корневой контекст для OpenCode (composition root)
+opencode.json                   # конфиг OpenCode: права + подключение правил
+.opencode/
+  agent/                        # 5 агентов (OpenCode-формат)
+  command/                      # /task /review /describe
+  skill/                        # shellcheck / smoke-tests / frontend-ci
+.claude/
+  CLAUDE.md                     # корневой контекст для Claude Code
+  settings.json                 # права (allow/ask)
+  agents/                       # те же 5 агентов (Claude-формат)
+  commands/                     # /task /review /describe
+  skills/                       # те же 3 скилла
+docs/
+  agent-rules/                  # ЕДИНЫЙ ИСТОЧНИК правил (оба инструмента ссылаются сюда)
+    project-core.md             #   архитектура, runtime-контракт, шлюзы, gating
+    backend-shell.md            #   правила backend (ash + jq)
+    frontend-luci.md            #   правила frontend (TS + LuCI)
+    packaging.md                #   правила packaging / CI / release
+    memory/                     #   ПАМЯТЬ агентов (committed, общая для обоих инструментов)
+      architect-orchestrator.md
+      shell-backend-developer.md
+      luci-frontend-developer.md
+      packaging-ci-engineer.md
+      code-reviewer.md
+  tasks/                        # спеки задач и ревью-доки
+    TEMPLATE-task.md            #   шаблон спеки
+    TEMPLATE-review.md          #   шаблон ревью
+  README-AGENTS.md              # этот файл
+```
+
+## Команда агентов
+
+```
+                       ┌──────────────────────────┐
+                       │   architect-orchestrator  │  (opus) — дирижёр
+                       │  уточняет · проектирует · │
+                       │  раскладывает · ревьюит   │
+                       └────┬───────┬───────┬──────┘
+            ┌───────────────┘       │       └───────────────┐
+            ▼                       ▼                       ▼
+ ┌────────────────────┐ ┌────────────────────┐ ┌────────────────────┐
+ │ shell-backend-     │ │ luci-frontend-     │ │ packaging-ci-      │
+ │ developer (sonnet) │ │ developer (sonnet) │ │ engineer (sonnet)  │
+ │ ash/jq, sing-box,  │ │ TS, LuCI, валид.,  │ │ Makefile, Docker,  │
+ │ nft, dnsmasq, UCI  │ │ i18n, main.js      │ │ SDK, CI, install   │
+ └─────────┬──────────┘ └─────────┬──────────┘ └─────────┬──────────┘
+           └──────────────────────┼───────────────────────┘
+                                  ▼
+                       ┌────────────────────┐
+                       │   code-reviewer     │  (haiku) — только чтение
+                       │  вердикт: APPROVED /│
+                       │  CONDITIONS / CHANGES│
+                       └────────────────────┘
+```
+
+| Агент | Что делает | Модель |
+| --- | --- | --- |
+| `architect-orchestrator` | Уточняет → проектирует → раскладывает в `docs/tasks/*.md` → делегирует → гоняет цикл разработчик↔ревьюер | opus |
+| `shell-backend-developer` | Backend: ash/jq, генерация конфига sing-box, nft, dnsmasq, UCI. Прогоняет shellcheck + smoke | sonnet |
+| `luci-frontend-developer` | Frontend: TS-исходник, LuCI-вьюхи, валидаторы, i18n. Прогоняет `yarn ci`, пересобирает `main.js` | sonnet |
+| `packaging-ci-engineer` | Makefile, Docker ipk/apk, SDK, workflows, тест-харнесс, install.sh | sonnet |
+| `code-reviewer` | Read-only ревью диффа против правил, пишет вердикт | haiku |
+
+## Как запускать
+
+### Вариант A — команда `/task` (рекомендуется)
+В OpenCode или Claude Code введи:
+```
+/task добавить опцию X в секцию UCI и пробросить её в конфиг sing-box
+```
+Оркестратор пройдёт весь цикл: уточнит → спроектирует → разложит → делегирует →
+прогонит шлюзы → ревью → отдаст тебе на коммит.
+
+### Вариант B — спека файлом
+Создай `docs/tasks/task-010-моя-задача.md` (по шаблону `TEMPLATE-task.md`),
+затем:
+```
+/task обработай docs/tasks/task-010-моя-задача.md
+```
+
+### Вариант C — обработать ревью
+```
+/review docs/tasks/task-010-моя-задача-review-001.md
+```
+или передай URL Pull Request.
+
+### Вариант D — описать PR
+```
+/describe
+```
+
+## Жизненный цикл задачи (7 шагов)
+
+1. **Уточнение.** Оркестратор задаёт вопросы по неоднозначным решениям
+   (порты/marks/пути/схема конфига/упаковка). Не додумывает.
+2. **Проектирование.** Предлагает 1–3 варианта с trade-offs, ждёт твоего «ОК».
+3. **Декомпозиция.** Пишет спеки в `docs/tasks/task-NNN-*.md`.
+4. **Реализация.** Делегирует нужному разработчику (параллельно — если подзадачи
+   не пересекаются по файлам).
+5. **Шлюзы.** Разработчик прогоняет соответствующий gate:
+   - backend → скилл `shellcheck` + скилл `smoke-tests`;
+   - frontend → скилл `frontend-ci` (`yarn ci`) + пересборка `main.js` без
+     git-диффа;
+   - packaging → smoke-tests, проверка ipk и apk.
+6. **Ревью.** `code-reviewer` пишет ревью-док с вердиктом. При `REQUIRES CHANGES`
+   разработчик переделывает до прохождения.
+7. **Готово.** Ты коммитишь вручную. PR — только после согласования в Telegram с
+   авторами (`CODEOWNERS=@yandexru45`).
+
+## Память агентов
+
+Файлы `docs/agent-rules/memory/<agent>.md` — это **долгая память** агентов:
+грабли, неочевидные правила, уже принятые решения, повторяющиеся находки ревью.
+Каждый агент читает свою память перед работой и дописывает туда новое. Память
+**коммитится в git** — поэтому она общая для всей команды и для обоих
+инструментов (OpenCode и Claude Code ссылаются на одни и те же файлы, дублей
+нет). Держи каждый файл памяти короче ~200 строк.
+
+## Ключевые правила (действуют для всех агентов)
+
+- **Тесты/шлюзы обязательны.** Изменение не «готово», пока не прошёл нужный gate.
+- **Агенты не коммитят.** Коммит и push делает только человек (права настроены на
+  подтверждение `git commit`/`git push`).
+- **Без апрува архитектора нет реализации.** Каждое изменение проходит ревью.
+- **Слои не смешиваются.** UI → backend (через два разрешённых бинарника) →
+  sing-box/nft/dnsmasq.
+- **Священный runtime-контракт** (порты/marks/пути) не меняется без проверки всей
+  цепочки. Всё — в `constants.sh`, без хардкода.
+- **Сгенерированный `main.js` руками не править.** Только правка TS-исходника +
+  `yarn build`.
+- **jq на OpenWRT — без regex** (нет Oniguruma).
+
+## Требования инструментов
+
+- **OpenCode:** конфиг подхватывается из `opencode.json` и `AGENTS.md`
+  автоматически. После изменения конфигурации перезапусти OpenCode (конфиг
+  читается один раз при старте).
+- **Claude Code:** для оркестрации субагентами включи экспериментальный режим
+  agent teams в глобальном `~/.claude/settings.json`:
+  ```json
+  { "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" } }
+  ```
+  Без этого флага запуск нескольких агентов работать не будет.
+- **Шлюзы локально:** для `smoke-tests` нужен Docker; для `frontend-ci` — Node 22
+  + yarn в `fe-app-netshift`; для `shellcheck` — локальный `shellcheck` или
+  Docker-образ `koalaman/shellcheck`.
+
+## Траблшутинг
+
+- **Агенты не запускаются (Claude Code):** проверь флаг
+  `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`.
+- **OpenCode не стартует после правки конфига:** значит, `opencode.json`
+  невалиден. Запусти из папки проекта с `OPENCODE_DISABLE_PROJECT_CONFIG=1`,
+  поправь файл, перезапусти без флага.
+- **Пустое/слабое ревью:** убедись, что есть незакоммиченный дифф (ревьюер
+  смотрит `git diff`).
+- **Память распухла:** подрежь файл `docs/agent-rules/memory/<agent>.md` до
+  ~200 строк, оставив только durable-знания.
diff --git a/docs/agent-rules/backend-shell.md b/docs/agent-rules/backend-shell.md
new file mode 100644
index 00000000..5670b858
--- /dev/null
+++ b/docs/agent-rules/backend-shell.md
@@ -0,0 +1,125 @@
+# NetShift Backend — Shell Rules (AUTHORITATIVE)
+
+> Scope: the backend package `netshift/files/usr/**` (POSIX `ash` + `jq`). Read alongside `project-core.md`. Every rule is grounded in the actual source — do not invent.
+
+## 1. Stack
+
+- **POSIX `ash`** (busybox), NOT bash. CLI dispatcher: `netshift/files/usr/bin/netshift`. Libraries: `netshift/files/usr/lib/*.sh`.
+- **`jq`** generates and mutates the sing-box JSON config.
+- **sing-box** is the routing engine; the backend only generates/validates its config and (re)starts the service.
+- **nftables** tproxy provides the marking/redirect path (table `NetShiftTable`, family `inet`).
+- **dnsmasq** integration points the router's DNS at sing-box (`server 127.0.0.42`).
+- **UCI** holds configuration (`/etc/config/netshift`); **procd** init in `/etc/init.d/netshift`.
+
+`/usr/bin/netshift` sources, in order: `/lib/functions.sh`, `/lib/config/uci.sh`, `/lib/functions/network.sh`, then `constants.sh`, `nft.sh`, `helpers.sh`, `sing_box_config_manager.sh`, `sing_box_config_facade.sh`, `logging.sh`, `rulesets.sh`, `updater.sh`. The CLI dispatcher (`case "$1" in ...`) is at the bottom of the file; entry points are `start`/`stop`/`reload`/`restart` (procd) and the diagnostics/`get_*`/`show_*`/`*_update`/`clash_api`/`component_action` commands.
+
+## 2. File headers and variable scope
+
+- Every lib `.sh` file starts with `# shellcheck shell=ash`.
+- Constants files that intentionally hold unused-looking vars also add `# shellcheck disable=SC2034` (see `constants.sh` lines 1–2).
+- Declare **all** function-local variables with `local`. ShellCheck (severity error) gates this.
+
+## 3. Strict function-naming prefixes
+
+Use the right prefix; it signals the function's layer and contract.
+
+| Prefix | Meaning | Examples |
+|---|---|---|
+| `sing_box_cm_*` | **Config-manager primitives** — low-level jq mutations, ONE mutation each, take `$config` first, echo new JSON | `sing_box_cm_configure_log`, `sing_box_cm_add_udp_dns_server`, `sing_box_cm_add_route_rule` (`sing_box_config_manager.sh`) |
+| `sing_box_cf_*` | **Facade orchestration** — parse a URL and call several `cm_*` | `sing_box_cf_add_proxy_outbound`, `sing_box_cf_add_dns_server` (`sing_box_config_facade.sh`) |
+| `url_*` | URL parsing — pure, param-expansion / `sed` only | `url_get_host`, `url_get_port`, `url_get_scheme`, `url_decode` (`helpers.sh`) |
+| `is_*` | Predicates returning 0/1 | `is_ipv4`, `is_domain`, `is_min_package_version`, `is_sing_box_extended` |
+| `nft_*` | nft wrappers | `nft_create_table`, `nft_create_ipv4_set`, `nft_add_set_elements_from_file_chunked` (`nft.sh`) |
+| `updates_*` / updater | binary updater | `updater.sh` |
+| `get_*_tag` | Deterministic tag builders | `get_outbound_tag_by_section` (`<section>-out`), `get_inbound_tag_by_section`, `get_domain_resolver_tag`, `get_ruleset_tag` |
+| `configure_*` / `import_*` / `_*_handler` | `config_foreach` / `config_list_foreach` callbacks | `configure_outbound_handler`, `import_community_subnet_lists`, `include_source_ip_in_routing_handler` |
+| leading `_` | private helper (internal to a flow) | `_check_outbound_section`, `_update_subscription_for_section` |
+
+## 4. The `$config` threading model
+
+The sing-box config is carried as a shell string variable named `config`. `cm_*`/`cf_*` functions take it as `$1`, echo the mutated JSON, and the caller reassigns:
+
+```sh
+config=$(sing_box_cm_add_direct_outbound "$config" "$SB_DIRECT_OUTBOUND_TAG")
+config=$(sing_box_cf_add_proxy_outbound "$config" "$section" "$proxy_string" "$udp_over_tcp")
+```
+
+`sing_box_init_config` seeds the skeleton, then runs `sing_box_configure_log/inbounds/outbounds/dns/route/experimental/additional_inbounds` and finally `sing_box_save_config`. Keep this echo-and-reassign discipline; never mutate config via global side effects.
+
+## 5. jq idioms and the Oniguruma constraint
+
+- Pass data with `--arg` (string) / `--argjson` (JSON), never string interpolation into the program:
+  ```sh
+  echo "$config" | jq --arg tag "$tag" --argjson port "$port" '...'
+  ```
+- Optional keys via the merge pattern:
+  ```jq
+  { ... } + (if $detour != "" then { detour: $detour } else {} end)
+  ```
+- **CRITICAL: OpenWRT's `jq` is built WITHOUT Oniguruma.** Never use `test()`, `match()`, `sub()`, `gsub()`, or any regex-based jq function — they will fail on-device. Use explicit string/codepoint logic instead (e.g. `explode`/`implode`, `index`, label/break loops — see the country-flag grouping in `sing_box_build_subscription_country_groups` and the tag-dedup in `normalize_subscription_to_singbox`). The updater documents the workarounds.
+- Custom jq helpers live in `netshift/files/usr/lib/helpers.jq`, imported as:
+  ```jq
+  import "helpers" as h {"search": "/usr/lib/netshift"};
+  ```
+
+## 6. Validation and atomic writes (mandatory)
+
+- **Every config write is validated.** `sing_box_save_config` writes to a temp file, then `sing_box_config_check` runs `sing-box -c <file> check`; on failure it logs `fatal` and `exit 1`. There is no exception to this.
+- JSON shape is checked with `jq -e` (e.g. `validate_subscription_file`, `subscription_cache_is_usable`).
+- **Atomic writes**: write `*.tmp.$$` then `mv` into place (subscription cache, URL metadata, rejected-hash). See `download_subscription_into_cache`.
+- **Hash-compare before replacing**: `md5sum` the temp vs current and only `mv` when they differ (`sing_box_save_config`, subscription dedup, rejected-hash tracking).
+
+## 7. Logging (`logging.sh`)
+
+| Function | Behavior |
+|---|---|
+| `log "$msg" "$level"` | syslog via `logger -t netshift` (level defaults to `info`) |
+| `nolog "$msg"` | TTY-only stdout (colorized; nothing when not a TTY) |
+| `echolog "$msg" "$level"` | both: `log` + `nolog` |
+
+Levels: `debug` / `info` / `warn` / `error` / `fatal`.
+
+**CRITICAL:** `fatal` is only a LABEL — `log` does NOT exit. You must manually `exit 1` after logging fatal:
+
+```sh
+log "Subscription URL is not set. Aborted." "fatal"
+exit 1
+```
+
+This pattern (`... Aborted." "fatal"; exit 1`) appears throughout the CLI; preserve it.
+
+## 8. busybox quirks
+
+- busybox `sed` lacks `\x` hex escapes. Build literal bytes with `printf` octal escapes (e.g. the UTF-8 BOM `printf '\357\273\277'` in `normalize_subscription_to_singbox`).
+- Convert CRLF→LF with `convert_crlf_to_lf` before parsing downloaded lists.
+- Strip a leading UTF-8 BOM before base64 charset detection.
+- The diagnostic strings in `usr/bin/netshift` (emoji / box-drawing in `list_update`, `subscription_update`, `global_check`, `check_nft`, e.g. `📡 🛠️ ✅ ❌ ⚠️ ➡️ 🧱 🥸 📄` and `━` separators) are **valid UTF-8** and must stay valid UTF-8 — they render correctly on the device (SSH/UTF-8 terminal) and LuCI. They are **not** intentional mojibake.
+- These were once corrupted by a UTF-8→CP1251 double-encode (real UTF-8 bytes read as CP1251 and re-saved as UTF-8), which made them print as `рџ…`/`в”…` garbage; task-004 repaired them. **Never open/save `usr/bin/netshift` in a non-UTF-8 editor or run it through a CP1251 codepage** — doing so reintroduces the `рџ…`/`в”…`/` ` mojibake. Edit it as UTF-8 only.
+
+## 9. New constants
+
+Anything that looks like a port, IP, mark, tag, path, version, URL, or service list goes into `constants.sh` under the right group (`## Common`, `## nft`, `## sing-box`, `## Lists`). Never hardcode it inline. See `project-core.md` §5.
+
+## 10. UCI access patterns
+
+- `config_get var section option [default]` — read an option.
+- `config_get_bool var section option [default]` — read a boolean (0/1).
+- `config_foreach fn type` — call `fn` for each section of `type` (here usually `section`); `fn` receives the section name as `$1`.
+- `config_list_foreach section list fn [extra args...]` — call `fn` for each list item.
+- The CLI runs `config_load "$NETSHIFT_CONFIG"` at startup; after `uci commit` it reloads (`uci commit ...; config_load ...`).
+
+UCI schema lives in `netshift/files/etc/config/netshift` (`settings` section + per-connection sections with `connection_type` = `proxy`/`vpn`/`block`/`exclusion`, and `proxy_config_type` = `url`/`selector`/`urltest`/`outbound`/`subscription`). Changing it is a system-level change (`project-core.md` §4).
+
+## 11. Tests and gates for backend changes
+
+- Run the **`shellcheck`** skill and the **`smoke-tests`** skill before considering a backend change done.
+- Smoke tests live in `tests/entrypoint.sh`. Existing test functions: `test_deps`, `test_syntax`, `test_config`, `test_helpers`, `test_jq_helpers`, `test_config_manager`, `test_sing_box_config`, `test_nft`, `test_diagnostics`, `test_subscription`.
+- **Adding a backend test** means all three of:
+  1. Add a `test_*` function to `tests/entrypoint.sh`.
+  2. Register it in `main()` — add the call to the `all)` branch.
+  3. Add a `case` entry (its short alias) AND list the alias in the "Available:" usage line.
+- Backend changes affecting **config generation** or **subscription parsing** SHOULD add/extend a smoke test (`test_sing_box_config`, `test_config_manager`, `test_jq_helpers`, or `test_subscription`).
+
+## 12. Glob scope confirmation
+
+These rules apply to everything matched by `netshift/files/usr/**` (the CLI, all `*.sh` libraries, and `helpers.jq`).
diff --git a/docs/agent-rules/frontend-luci.md b/docs/agent-rules/frontend-luci.md
new file mode 100644
index 00000000..a27ee0f6
--- /dev/null
+++ b/docs/agent-rules/frontend-luci.md
@@ -0,0 +1,154 @@
+# Agent Rules: Frontend & LuCI
+
+Authoritative rules for the NetShift web UI. Read this before touching any
+frontend or LuCI view code.
+
+**Scope (globs):**
+
+- `fe-app-netshift/src/**/*.ts` — TypeScript source (the real logic).
+- `luci-app-netshift/htdocs/**/*.js` — hand-written LuCI views.
+
+---
+
+## 1. Architecture & build pipeline
+
+- The logic lives in **TypeScript** under `fe-app-netshift/src/`, compiled in
+  `strict` mode (`tsconfig.json`: `strict: true`, `target: ES2020`,
+  `module: ESNext`).
+- `tsup` bundles the single entry `src/main.ts` into
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js`
+  (see `tsup.config.ts`: `format: ['esm']`, `outExtension .js`, `clean: false`).
+- The hand-written LuCI views consume the bundle. The entry view
+  `netshift.js` declares `'require view.netshift.main as main'` and uses the
+  exports as `main.*` (e.g. `main.injectGlobalStyles()`, `main.coreService()`).
+  Companion views `section.js`, `settings.js`, plus the thin `dashboard.js` /
+  `diagnostic.js` follow the same pattern.
+
+### CRITICAL: `main.js` is AUTOGENERATED — never hand-edit it
+
+- The bundle is stamped with the banner
+  `// This file is autogenerated, please don't change manually` (set in
+  `tsup.config.ts` `banner.js`).
+- After bundling, `tsup`'s `onSuccess` hook **regex-patches** the file: it
+  rewrites the ESM `export { ... }` block into
+  `return baseclass.extend({ ... })` (see `tsup.config.ts` lines 25-30). This
+  is what makes the bundle loadable as a LuCI `baseclass`.
+- **NEVER hand-edit `main.js`.** Edit the TS source, then run `yarn build`.
+  Any manual edit is destroyed on the next build and will fail CI (build must
+  produce no git diff — see §7).
+
+---
+
+## 2. The barrel rule (most common gotcha)
+
+Anything that must be visible to the LuCI views as `main.*` has to be
+re-exported all the way up the barrel chain to `src/main.ts`.
+
+- `src/main.ts` does `export * from './validators' | './helpers' |
+  './netshift' | './constants'`.
+- `src/validators/index.ts` re-exports each validator module
+  (`export * from './validateIp'`, etc.).
+- **Rule:** any new public API (a validator, helper, constant, or tab) MUST be
+  re-exported up the chain (e.g. `validators/<file>.ts` →
+  `validators/index.ts` → `main.ts`). If you forget the re-export, the symbol
+  will not appear in `main.*` and the LuCI views cannot see it.
+
+**Worked example of the gotcha:** `validateHysteria2Url`
+(`src/validators/validateHysteriaUrl.ts`) is **intentionally NOT** listed in
+`src/validators/index.ts`. It is reached only indirectly via
+`validateProxyUrl` (`validateProxyUrl.ts` imports it and dispatches to it for
+`hysteria2://` URLs). So `main.validateHysteria2Url` does not exist — that is
+deliberate, not a bug. Do not "fix" it by adding it to the barrel unless you
+actually need it exposed.
+
+---
+
+## 3. Backend access boundary
+
+The UI talks to the backend through **only two channels**:
+
+1. LuCI `fs.exec` of the two ACL-gated binaries:
+   - `/usr/bin/netshift`
+   - `/etc/init.d/netshift`
+
+   Both are allow-listed for `exec` in
+   `luci-app-netshift/root/usr/share/rpcd/acl.d/luci-app-netshift.json`
+   (under `read.file`). The same ACL grants `uci` read/write on the
+   `netshift` config and `ubus service list`.
+
+2. Direct `fetch` / WebSocket to the Clash API on `:9090`.
+
+**Rule:** any new shell command the UI needs MUST be implemented as a
+**subcommand of one of those two binaries**, or you must extend both the ACL
+(`acl.d/luci-app-netshift.json`) **and** the backend. Do not invoke arbitrary
+paths via `fs.exec` — they are not ACL-allowed and will be denied by `rpcd`.
+
+---
+
+## 4. Code style (from the config files — non-negotiable)
+
+- **TypeScript:** `strict: true`. No `any`. Prefer functional code and named
+  exports (the barrel relies on named exports).
+- **Prettier** (`.prettierrc`): `printWidth: 80`, `tabWidth: 2`, `semi: true`,
+  `singleQuote: true`, `trailingComma: 'all'`, `bracketSpacing: true`.
+- **ESLint** (flat config `eslint.config.js`): extends
+  `js.configs.recommended` + `typescript-eslint` recommended + `prettier`.
+  `@typescript-eslint/no-unused-vars` is a **`warn`**, with
+  `argsIgnorePattern`, `varsIgnorePattern`, and `caughtErrorsIgnorePattern`
+  all set to `^_`. So any intentionally-unused var/arg/caught-error MUST be
+  `_`-prefixed. CI runs `eslint --max-warnings=0`, so an un-prefixed unused
+  var = warning = CI failure.
+- **LuCI globals** (`E`, `fs`, `uci`, `ui`, `_`, etc.) are declared in
+  `src/luci.d.ts`. Use them; do not redeclare. For DOM built with `E()`, use
+  the `click:` attribute convention for event handlers.
+
+---
+
+## 5. i18n
+
+- Wrap every user-facing string in `_()`.
+- Pass **only string literals** to `_()`. The gettext extractor only sees
+  literal arguments; `_(someVariable)` or `_('a' + b)` will NOT be extracted
+  and will ship untranslated.
+- Locale tooling lives in `package.json` under the `locales:*` scripts
+  (`locales:extract-calls`, `locales:generate-pot`, `locales:generate-po:ru`,
+  `locales:distribute`, with the `locales:actualize` umbrella). Run these to
+  regenerate `.pot`/`.po` after adding strings; do not hand-edit generated
+  catalogs.
+
+---
+
+## 6. Version placeholder
+
+- `src/constants.ts` declares
+  `export const NETSHIFT_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';`.
+- At OpenWRT build time, `luci-app-netshift/Makefile` substitutes the literal
+  via `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' ...
+  main.js || true`.
+- In dev (where no substitution happens), `normalizeCompiledVersion` turns the
+  raw placeholder into `'dev'`.
+- **Rule:** do not change the literal `__COMPILED_VERSION_VARIABLE__` without
+  also updating the `sed` in the Makefile (and the backend stamp — see
+  `packaging.md`). They must stay in lockstep.
+
+---
+
+## 7. Tests & CI gates
+
+- Vitest config (`vitest.config.js`): `globals: true`, `environment: 'node'`,
+  setup file `./tests/setup/global-mocks.ts` (which identity-mocks `_()` so
+  tests assert on raw strings).
+- Tests live as `.test.js` next to the code under `tests/` directories. Style
+  is table-driven `describe.each`.
+- **New pure logic SHOULD ship a test.**
+- **CI gate** (`.github/workflows/frontend-ci.yml`, runs on PRs touching
+  `fe-app-netshift/**`) runs the steps individually:
+  `yarn install --frozen-lockfile` → `yarn format` then fail on any
+  `git diff` (code must already be formatted) → `yarn lint --max-warnings=0`
+  → `yarn test --run` → `yarn build` then fail on any `git diff`.
+  The convenience local command is `yarn ci`
+  (`format && lint --max-warnings=0 && test --run && build`).
+- **The committed `main.js` MUST be up to date.** Because the build must
+  produce no git diff, always `yarn build` and commit the regenerated bundle
+  together with the TS change.
+- Reference the **`frontend-ci`** skill for the full workflow.
diff --git a/docs/agent-rules/memory/README.md b/docs/agent-rules/memory/README.md
new file mode 100644
index 00000000..00016a80
--- /dev/null
+++ b/docs/agent-rules/memory/README.md
@@ -0,0 +1,31 @@
+# Agent memory
+
+This folder is the **single source of truth** for per-agent persistent memory,
+shared by both AI toolchains (OpenCode and Claude Code).
+
+OpenCode has no built-in `memory: project` mechanism, so memory here is a plain
+convention: **every agent's prompt instructs it to read its own
+`<agent>.md` file before starting work, and to append durable findings to it
+when it learns something that future runs must not re-discover.**
+
+## Rules for memory files
+
+- One file per agent, named exactly after the agent
+  (`architect-orchestrator.md`, `shell-backend-developer.md`,
+  `luci-frontend-developer.md`, `packaging-ci-engineer.md`,
+  `code-reviewer.md`).
+- Keep each file **under ~200 lines**. It is loaded into the agent's context
+  on every run; bloat costs tokens and dilutes signal.
+- Record only **durable, reusable knowledge**: gotchas, fragile areas,
+  non-obvious conventions, decisions already made, recurring review findings.
+  Do **not** record task-specific narration.
+- These files are **committed to git** so the whole team (and other
+  contributors using AI) benefit.
+- When a fact here is proven wrong or stale, fix it in the same edit — do not
+  let memory drift from reality.
+
+## How the two toolchains share this
+
+Both `.opencode/agent/*.md` and `.claude/agents/*.md` point their agents at
+these files by relative path (`docs/agent-rules/memory/<agent>.md`). There is
+no duplication of memory content — only this one copy.
diff --git a/docs/agent-rules/memory/architect-orchestrator.md b/docs/agent-rules/memory/architect-orchestrator.md
new file mode 100644
index 00000000..282fd0b1
--- /dev/null
+++ b/docs/agent-rules/memory/architect-orchestrator.md
@@ -0,0 +1,1381 @@
+# Memory — architect-orchestrator
+
+Durable project knowledge for designing and decomposing NetShift tasks.
+Read this before planning. Append new durable findings; keep under ~200 lines.
+
+## Project shape (verified)
+
+- NetShift = OpenWRT 24.10+ traffic router on top of **sing-box** (>=1.12.0,
+  jq>=1.7.1). Fork of `itdoginfo/podkop`, rebranded to NetShift at 0.8.0. Beta.
+  GPL-2.0-or-later + separate restrictive trademark policy (`TRADEMARK.md`).
+- Three packages, one-way dependency chain:
+  `luci-app-netshift` (LuCI UI, hand-written `.js` views + generated `main.js`)
+  -> `fe-app-netshift` (TypeScript source of `main.js`, built by tsup)
+  -> `netshift` (POSIX ash + jq backend) -> sing-box / nftables / dnsmasq.
+  The UI talks to the backend ONLY via LuCI `fs.exec` of `/usr/bin/netshift`
+  and `/etc/init.d/netshift` (ACL-gated), plus Clash API on :9090.
+
+## Sacred runtime contract (constants.sh — never change casually)
+
+- TProxy inbound `127.0.0.1:1602`; DNS inbound `127.0.0.42:53`; Clash API `:9090`.
+- FakeIP range `198.18.0.0/15`. Marks: FakeIP `0x00100000`, outbound `0x00200000`.
+- nft table `NetShiftTable` (inet); routing table `105 netshift`.
+- Required versions `SB_REQUIRED_VERSION=1.12.0`, `JQ_REQUIRED_VERSION=1.7.1`.
+
+## Data flow (start_main in usr/bin/netshift)
+
+check_requirements -> migration (currently no-op) -> validate services ->
+br_netfilter_disable -> NTP sync -> subscription cache prep -> route table + nft
+base -> sing_box_configure_service -> sing_box_init_config (build JSON) ->
+save+`sing-box check` -> cron jobs -> start sing-box -> dnsmasq_configure ->
+`list_update &` (background heavy list download).
+
+## Quality gates a task must pass before "done"
+
+- Backend (`netshift/files/**`): `shellcheck` skill (severity error) +
+  `smoke-tests` skill (tests/entrypoint.sh `all`).
+- Frontend (`fe-app-netshift/**`): `frontend-ci` skill (`yarn ci`) AND the
+  committed `main.js` must be regenerated (build must leave no git diff).
+- Packaging/CI changes: smoke-tests at minimum; verify both ipk and apk paths.
+
+## Decomposition policy
+
+- Map subtasks to the right developer agent:
+  backend/shell/jq/sing-box/nft/dnsmasq/UCI -> `shell-backend-developer`;
+  TS source / LuCI views / validators / i18n -> `luci-frontend-developer`;
+  Makefile / Docker / SDK / workflows / tests harness / install.sh ->
+  `packaging-ci-engineer`.
+- A change touching the TS source almost always also requires a rebuild of
+  `main.js` (frontend dev handles via `yarn build`). Flag this in the spec.
+- "System-level" changes (nft, routing, config schema, ports/marks, dnsmasq,
+  packaging) must be verified across the whole chain, not one file.
+- Never allow a commit without a passed code-reviewer verdict. Never skip the
+  relevant gate. Humans commit manually — agents never auto-commit.
+
+## Known latent bugs / landmines (don't reintroduce; fix only if in scope)
+
+- `usr/bin/netshift` dispatches `main)` and `check_sing_box_logs)` but NO such
+  functions are defined — dead/broken dispatch.
+- nft proxy chain hardcodes `127.0.0.1:1602` instead of using the constants
+  (duplication; changing the constant won't change the rule).
+- VPN `domain_resolver` uses `$dns_server` (undefined in scope) instead of
+  `$domain_resolver_dns_server`.
+- Frontend `runFakeIPCheck` has inverted-looking allGood/atLeastOneGood logic.
+- Diagnostic strings contain intentional CP1251 mojibake (emoji/box-drawing) —
+  preserve byte sequences when editing.
+- `validate_subscription_file` (helpers.sh) only checks `.type` is NOT in
+  {selector,urltest,direct,dns,block}. A body whose outbounds lack `.type`
+  entirely (e.g. a single Xray-config OBJECT using `.protocol`) passes as
+  "valid" → bypasses the fallback normalizer and later fails `sing-box check`.
+  An Xray ARRAY is `type=="array"` and correctly falls through to normalize.
+  Watch this when adding any pre-normalize validate gate.
+
+## Subscription pipeline facts (verified 2026-06)
+
+- Fallback chain in `download_subscription_into_cache` (usr/bin/netshift):
+  validate raw body FIRST, only then `normalize_subscription_to_singbox`
+  (base64 / plaintext URI list / Xray-JSON). UA fallback wraps the whole loop:
+  it probes `SUBSCRIPTION_USER_AGENT_CANDIDATES` (constants.sh) when no UA is
+  configured, caches the winner in `<section>.user_agent` (atomic .tmp.$$+mv).
+- New per-section UCI option `subscription_user_agent` is read but NOT yet in
+  the UCI schema / LuCI / ACL. Degrades gracefully (empty ⇒ auto). Treat any
+  promotion to a real UI knob as a system-level change (schema + LuCI + i18n).
+- `xray_json_to_uri_lines` converts Xray client configs (object|array) to share
+  URIs; emits ONLY keys the facade reads (type/path/host/mode/serviceName/
+  security/sni/alpn/fp/pbk/sid/flow); drops vmess (counted by
+  `xray_json_count_unsupported`) and dialerProxy-chained outbounds; dedups on
+  the connection part. No-regex jq + busybox-safe sed pre-gate.
+
+## Core-switch (sing-box <-> extended) failure — DIAGNOSED on real hardware 2026-06
+
+- SYMPTOM: switching stock->extended fails; on the router the new ~79MB binary
+  sits at /usr/bin/sing-box but with perms `rw-------` (NOT executable), the
+  tmpfs backup + downloaded archive remain, sing-box won't run.
+- ROOT CAUSE: **rpcd timeout**. rpcd runs with `-t 30` (30s). The UI calls
+  `component_action sing_box install_extended` SYNCHRONOUSLY via LuCI fs.exec.
+  Download (~29MB over a slow/proxied link) + gzip extract of the 50MB binary
+  (measured **13s just for extract** on aarch64 cortex-a53) exceeds 30s, so rpcd
+  KILLS the process mid-flight — AFTER `tar -O > /usr/bin/sing-box` (file written
+  `rw-------` under the context umask 0077) but BEFORE `chmod 0755` + the
+  `LD_LIBRARY_PATH=/usr/lib sing-box version` validation. Hence the un-chmod'd
+  binary, leftover backup/archive, no cleanup.
+- DISPROVEN earlier guesses: (a) NOT a disk-space issue (repro'd with free
+  space). (b) NOT the missing-LD_LIBRARY_PATH theory — the extended binary runs
+  `sing-box version` fine WITHOUT LD_LIBRARY_PATH (libcronet only needed at
+  runtime for naive); `chmod 0755` itself works under umask 0077. The code's
+  chmod/validate is correct; it just never gets to run.
+- FIX DIRECTION: make core-switch ASYNCHRONOUS — has `component_action_async` 
+  (writes output to a file, forks the work) +
+  `component_action_status` (UI polls). NetShift's updater is synchronous and has
+  no async/status path. Port that model: fork the install, return immediately,
+  poll status; UI shows progress instead of hitting the 30s rpcd wall.
+- Secondary hardening to fold in: chmod 0755 BEFORE validation is already there
+  but ordering/robustness should survive interruption; also rulesets in
+  /tmp/sing-box/rulesets were `rw-------` (umask 0077) — sing-box could still read
+  them as root, not the failure cause, but worth normalizing.
+- Manual recovery that works: `chmod 0755 /usr/bin/sing-box` (the downloaded
+  extended binary is valid), `rm -rf /tmp/netshift-sbext.*`, restart netshift.
+- Router access for testing: `ssh root@192.168.1.1` (no password). aarch64,
+  OpenWrt 24.10.5, overlay 60.9M (16.5M free), /tmp tmpfs 117M. scp does NOT work
+  (no sftp-server) — push scripts via `echo <base64> | base64 -d > f` over ssh.
+
+## Core-switch async fix (task-007) — on-device verified 2026-06; SECOND bug found
+
+- task-007 async model WORKS on real hardware: `component_action_async` returns
+  in 0s with a job_id (no more rpcd 30s kill), `component_action_status` polling
+  goes running->finished cleanly. The PRIMARY bug (synchronous timeout) is fixed.
+- BUT live-testing exposed a SECOND, deeper bug in `updates_install_sing_box_stable`
+  (extended->stock): it has NO backup/rollback (unlike the extended path) AND the
+  whole switch happens while NetShift's nft tproxy + dnsmasq redirect are STILL
+  active. Sequence that bricked the router:
+  1. install_stable removes/replaces the extended binary, then `opkg/apk install
+     sing-box` needs working internet — but the only internet was THROUGH the now
+     -dead VPN. opkg fails with "Operation not permitted" + DNS timeout (the nft
+     kill-switch sends marked traffic to a dead sing-box).
+  2. Net result: /usr/bin/sing-box GONE, no rollback, router has no working core
+     and can't fetch one (extended path also fails: GitHub unreachable w/o VPN).
+- This is a CLASSIC kill-switch deadlock: you can't download a new core because
+  the old core (that provided connectivity) is gone.
+- RESCUE that works: `/etc/init.d/netshift stop` (tears down nft/dnsmasq so direct
+  internet returns) -> set a real resolver -> `opkg update && opkg install
+  sing-box` -> `/etc/init.d/netshift restart`. Verified: restored stock 1.12.22,
+  sing-box running.
+- DESIGN IMPLICATION for the stable-rollback path (future task): before
+  install_stable, KEEP a backup of the current (extended) binary on tmpfs and
+  RESTORE it if the package install fails (so a failed downgrade never leaves the
+  router core-less) — mirror the extended path's backup/restore. Also consider
+  tearing down the redirect (or a temporary direct route) during a core swap so
+  the package manager can reach the feeds. The extended->stock path fundamentally
+  needs connectivity that the dead VPN may have been providing.
+- Router note: stock sing-box install also drops `/etc/config/sing-box-opkg` and
+  `/etc/sing-box/config.json-opkg` (conffile conflicts) — harmless, NetShift owns
+  its own config path.
+
+## sing-box-extended capability map (researched 2026-06)
+
+- NetShift ALREADY installs sing-box-extended: `updater.sh` pulls
+  `shtorm-7/sing-box-extended`; `is_sing_box_extended` gates features (today only
+  xhttp transport in the facade). So the runtime platform for extended protocols
+  exists; what's missing is config GENERATION (jq cm_*/cf_*), UCI schema, UI.
+- Our facade currently builds only: socks4/4a/5, vless, ss, trojan, hysteria2.
+  Transports: ws, grpc, httpupgrade, xhttp. No endpoint/wireguard support at all
+  (`sing_box_cm_add_*_outbound` has no wireguard/endpoint).
+- Extended (repo `sing-box-extended-extended/option/*.go`) adds many: anytls,
+  tuic, shadowtls, wireguard(+Amnezia/AWG), warp(+Amnezia), masque, mieru,
+  mtproxy, naive, openvpn, ssh, tor, trusttunnel, sudoku, bond, failover, vpn,
+  vmess; transports incl. v2ray kcp/quic, simple-obfs, sip003.
+- Amnezia WG schema (sing-box 1.12 `endpoint` model): an `endpoint` with
+  `"type":"wireguard"`, `private_key`, `address` (listable prefix), `peers[]`
+  (address/port/public_key/pre_shared_key/allowed_ips/persistent_keepalive...),
+  plus nested `"amnezia": { jc,jmin,jmax,s1..s4, h1..h4 (ranges), i1..i5, j1..j3,
+  itime }`. WARP = same WG core + `amnezia` + Cloudflare `profile`/`reserved`.
+- Feasibility tiers for porting to our ash+jq backend:
+  * EASY (pure-JSON outbound, no extra daemon, just a new cm_* + cf_* + URI/UCI
+    parse): tuic, anytls, shadowtls, vmess, naive, hysteria(v1). These mirror the
+    existing vless/trojan/hysteria2 pattern.
+  * MEDIUM: wireguard + Amnezia/AWG and WARP — needs the `endpoints[]` array
+    (new section in config skeleton, route ties to endpoint tag) + key/peer
+    parsing; input format must be decided (awg:// vs wg-conf vs UCI fields).
+  * HARD / likely out of scope: openvpn, mieru, masque, mtproxy(outbound),
+    trusttunnel, sudoku, tor, ssh, bond/failover/vpn groups — bespoke schemas,
+    some need extra config files/daemons; high test surface.
+- Hard dependency for ANY of these: the user must be running the extended build;
+  gate generation behind `is_sing_box_extended` and fail safe (warn + skip) when
+  stock sing-box is installed, exactly like xhttp does today.
+
+## sing-box-extended version diagnostic (task-013 — done 2026-06-05)
+
+- BUG: `check_sing_box` (usr/bin/netshift ~3276) showed "❌ version not compatible"
+  on the extended core. TWO coupled defects:
+  1. `awk '{print $3}'` on `sing-box version 1.13.12-extended-2.3.2` → patch via
+     `cut -d. -f3` = `12-extended-2` (non-numeric) → `[: bad number`.
+  2. The compare `if [ A ] || [ B ] && [ C ] || [ D ] && [ E ] && [ F ]` was
+     UNGROUPED. POSIX `&&`/`||` are EQUAL-precedence, LEFT-associative, so it
+     parses `(((((A||B)&&C)||D)&&E)&&F)` — the trailing E/F gate EVERY branch,
+     so 1.13.x AND 2.0.0 evaluate as not-compatible even with a numeric patch.
+- FIX (Variant 2, operator-chosen): strip suffix `version=${version%%-*}` (gives
+  honest semver; extended author only bumps the trailing `-extended-X.Y.Z`,
+  leading major.minor.patch is true upstream sing-box) + regroup each AND-term in
+  `{ ...; }`. Kept threshold 1.12.4 + printed text. Did NOT touch check_requirements
+  (uses sort -V, already extended-safe). 1-file change, gates green.
+- LANDMINE for future tasks: any `[ ] || [ ] && [ ]` chain in this repo without
+  `{ ...; }` grouping is suspect — equal precedence means trailing AND-terms leak
+  into prior OR-branches. Group every AND-term. (My first decomposition wrongly
+  assumed the strip alone fixed it; the dev caught the precedence bug on live
+  reasoning — TRUST dev "second defect" flags, re-derive the truth table myself.)
+- Extended core real output (operator hardware, captured for the epic): version
+  `1.13.12-extended-2.3.2`, Tags include `with_quic,with_wireguard,with_utls,
+  with_masque,with_mtproxy,with_openvpn,with_trusttunnel,with_sudoku,
+  with_naive_outbound,with_gvisor`. So the shtorm-7 build SHIPS the build-tags for
+  nearly all of epic Tiers 1–3 (tuic/hysteria need with_quic ✅, AWG needs
+  with_wireguard ✅, sudoku/trusttunnel/openvpn ✅) — CX-4 build-tag uncertainty is
+  largely resolved EMPIRICALLY for this build; still gate generation behind
+  is_sing_box_extended + tolerate a per-protocol `sing-box check` rejection.
+- SECOND hardcode of the version threshold confirmed: check_sing_box hardcodes
+  "1.12.4" (major/minor/patch literals + text) while SB_REQUIRED_VERSION=1.12.0 in
+  constants.sh. Known rassinkhron; left as-is per operator (out of task-013 scope).
+
+## Subscription keyword filter — Cyrillic case bug (task-010, found on hardware 2026-06)
+
+- REAL bug (not version skew): the keyword filter's "case-insensitive" claim only
+  holds for ASCII. `sing_box_cf_prepare_subscription_batch`
+  (sing_box_config_facade.sh:542/543/567) uses jq `ascii_downcase`, which does
+  NOT lowercase Cyrillic (or any non-ASCII).
+- FIX: replace the 3 `ascii_downcase` in prepare_subscription_batch with an inline
+  jq `def ucfold` (codepoint arithmetic, NO Oniguruma): ASCII A-Z (65–90)+32,
+  Cyrillic А-Я (1040–1071)+32, Ё(1025)->ё(1105). Apply to BOTH the keyword list
+  and the node name. `explode`/`map`/`implode`/`index` all work on the device jq.
+  (Это inline — этот jq-вызов НЕ импортирует helpers.jq.)
+- rejected-hash (`<section>.rejected`, md5 of body) can wedge a retry storm if a
+  STUB body once got cached as rejected; it self-clears once a real body downloads
+  (return 0 path rm's it). Not the root cause here but amplified the symptom.
+
+## Workflow facts
+
+- Contribution gating: `CODEOWNERS=@yandexru45`; PRs accepted only after Telegram
+  coordination with authors (README). Reflect this in `/describe` output.
+- **Frontend yarn trap (verified 2026-06):** repo `fe-app-netshift/yarn.lock` is
+  CLASSIC yarn v1 format; there is NO `packageManager` pin and NO `.yarnrc.yml`.
+  A local corepack yarn 4.x will try to MIGRATE on `yarn install`, polluting the
+  tree with a 3000+ line `yarn.lock` rewrite + untracked `.yarn/` and
+  `.yarnrc.yml`. These are NOT deliverables — discard before commit
+  (`git checkout -- fe-app-netshift/yarn.lock`; rm `.yarn/`/`.yarnrc.yml`). To
+  verify the gate independently without polluting, run the tools directly from
+  `node_modules/.bin` (prettier/eslint/vitest/tsup) instead of `yarn install`.
+  Tell frontend devs to leave yarn.lock alone.
+- The frontend-ci `main.js` no-diff check: a TYPE-ONLY change in TS source
+  (e.g. adding optional fields to a `types.ts` interface) produces NO main.js
+  diff — that is expected/correct, not a missed rebuild.
+
+## Subscription keyword filter (issue #5, task-002/003 — done 2026-06)
+
+- Backend filter lives in `sing_box_cf_prepare_subscription_batch`
+  (sing_box_config_facade.sh): one jq pass between candidate-select and the
+  static-unsupported filter, BEFORE tag dedup + sing-box check. Covers native +
+  all fallback (base64/URI/Xray) bodies and both selector branches automatically.
+- UCI options (cross-layer contract, verbatim): `subscription_filter_include_keywords`
+  (whitelist) / `subscription_filter_exclude_keywords` (blacklist), both UCI
+  `list`. Read in the `subscription)` branch via `config_list_foreach`.
+- Semantics: include=OR (empty⇒keep all), exclude=OR(drop), SUBSTRING,
+  ASCII-case-insensitive (`ascii_downcase`), byte-exact for emoji/Cyrillic.
+  jq: NOTE `include`/`exclude` are RESERVED jq words — devs used `$inc`/`$exc`;
+  matching must use `. as $kw` inside any/all to avoid the `.`-after-pipe rebind.
+- Empty-after-filter ⇒ existing fail-safe `mark_subscription_outbound_unavailable`
+  + warn (NO exit 1). `skipped` stays "statically unsupported" (compute `$total`
+  AFTER the keyword filter, not before).
+- UI: two `form.DynamicList` in `section.js` after `subscription_group_by_countries`,
+  rmempty=true, NO validator (keep emoji/space verbatim); `string[]?` fields on
+  `ConfigProxySubscriptionSection` in types.ts; ru/en via locale tooling.
+
+## PR review workflow + PR #11 findings (review-001, 2026-06-06)
+
+- Reviewing an external PR (no `gh` CLI installed): fetch via API
+  `curl https://api.github.com/repos/yandexru45/netshift/pulls/N` (meta),
+  `.../files` (per-file stats), and `-H "Accept: application/vnd.github.v3.diff"`
+  for the raw diff. Then `git fetch origin pull/N/head:pr-N` to get a local ref
+  diffable vs `main`. Workspace `.pr-review/` + `*.txt` are gitignored (untracked).
+- Decompose review by LAYER (backend / frontend+i18n / tests-packaging) into
+  separate diff txt files; launch one `explore` subagent per layer IN PARALLEL
+  (layers don't share files), then consolidate with the formal `code-reviewer`.
+  Give each subagent an architect "systemic notes" file of HYPOTHESES to verify.
+- **nftables landmine (VERIFIED on nft v1.1.3):** `tproxy ip6 to <addr>:<port>`
+  REQUIRES bracketed `[addr]:port`. The unbracketed form (e.g. `::1:1603`) PASSES
+  `nft -c` AND `sing-box check`, but nft normalizes it to a BARE address with NO
+  port (`::1:1603` -> `[::0.1.22.3]`). Only on-device / `unshare -rn nft -f` +
+  `nft list ruleset` reveals it. IPv4 `addr:port` is fine unbracketed; v6 is not.
+- **Local nft verification trick (no root):** `unshare -rn nft -c -f file` /
+  `unshare -rn sh -c 'nft -f f && nft list ruleset'` gives netlink in a private
+  netns so you can load+inspect normalized rules. Plain `nft -c` fails with
+  "cache initialization failed: Operation not permitted" without it.
+- PR #11 ("Синхронизация с netshift", spgsroot, +2314/-1364, 23 files) verdict:
+  **REQUIRES CHANGES**. Doc at `.pr-review/REVIEW-pr-11.md` (canonical copy would
+  be `docs/tasks/sync-netshift-review-001.md`). Headline = IPv6 + DoH-block +
+  global_proxy + sing-box health monitor + check_proxy rework.
+  * BLOCKER B-01: unbracketed v6 tproxy rule (above).
+  * Majors: nft model shift (mangle now marks ALL interface traffic, split moved
+    to sing-box route rules) — `mangle_output` lost router-originated @common/
+    fakeip marking (regression); `@netshift_subnets`/@common still populated each
+    `list_update` but matched by NO rule (dead import path); 8x `SUBNETS_*_V6`
+    dead constants; `start()` spawns `monitor_sing_box` with no pidfile+kill-0
+    guard (orphan leak); over-permissive `validateIPV6` regex (accepts `:::`,
+    `1::2::3`, etc.) shared by subnet+dns validators, no negative tests; 3 new
+    flag descriptions concat'd inside `_()` -> ship untranslated.
+  * GOOD: generated `main.js` is a faithful DRIFT-FREE rebuild (CI no-diff should
+    pass); NO Oniguruma jq; UTF-8 emoji intact; i18n catalogs machine-consistent.
+  * Coverage gap: the nft model shift has NO smoke test (test_global_proxy only
+    checks sing-box route-rule SHAPE; test_nft byte-identical to base) — that's
+    why B-01 slipped. Any nft-rule PR should add an `nft list ruleset` assertion.
+
+## PR #11 fix-to-perfect cycle (2026-06-06, after operator merged the PR)
+
+- Operator merged PR #11 to main, then asked to fix everything to perfection.
+  Decomposed the review-doc issues into 3 task specs (docs/tasks/task-014 backend,
+  -015 frontend, -016 packaging) + delegated to the 3 dev subagents, ran the
+  dev<->code-reviewer loop per layer until all APPROVED. NOTE: `docs/tasks/` is
+  gitignored (line 7 `docs/tasks`), so task specs are session artifacts (like
+  .pr-review/), not committed — that's by project design (only TEMPLATE-*.md are
+  force-tracked).
+- Operator design decisions for the nft model shift: B-02=A (router-originated
+  traffic stays DIRECT in the new mark-everything-in-prerouting model; document
+  only, don't restore mangle_output marking) and B-03/B-04=A (remove the dead
+  @netshift_subnets populate path + dead SUBNETS_*_V6). Rule: dead-code removal
+  for a SET requires first PROVING every populated source is carried by a sing-box
+  rule_set; the dev produced a coverage map (community->$SRS_MAIN_URL/<svc>.srs,
+  user/local/remote subnets->rule_sets). DISCORD set is RETAINED (it has a
+  dport-restricted mangle rule `udp dport {19000-20000,50000-65535}` that a
+  sing-box route rule cannot express). M1/M2 left as non-blocking follow-ups
+  (orphaned rulesets.sh helpers + unused IPv4 SUBNETS_* under SC2034).
+- **dnsmasq "we-own-it" guard landmine (B-08):** a guard that infers netshift
+  ownership from the PRESENCE of `netshift_*` BACKUP markers is WRONG, because
+  `backup_dnsmasq_config_option` only writes a marker when the ORIGINAL value was
+  non-empty. On stock/default dnsmasq (empty server/noresolv/cachesize) NO markers
+  exist, so on the redundant `dnsmasq_configure force` path (monitor recovery /
+  double-start) the guard flips false, re-runs backup, and records netshift's OWN
+  live values (noresolv=1/cachesize=0) as the "backup" -> restore later sets
+  noresolv=1/cachesize=0 instead of defaults 0/150 -> router DNS broken after stop.
+  FIX: an explicit unconditional sentinel `netshift_configured=1` set in
+  dnsmasq_configure, gating the short-circuit, cleared in dnsmasq_restore.
+- **nft v6 NEGATIVE-guard test landmine:** the buggy unbracketed `::1:1603`
+  normalizes DIFFERENTLY per nft build: `[::0.1.22.3]` on nftables v1.1.3 (WSL),
+  but `[::1:1603]` on OpenWRT 24.10.6's nft (the smoke container). So a negative
+  grep for `::0` OR even `\[::0` is a DEAD always-passing assertion in the smoke
+  env. ROBUST pattern: `grep 'tproxy ip6 to \[' | grep -qv '\[::1\]:1603'` (any
+  bracketed dest that ISN'T the correct one). Always self-prove a regression guard
+  by temporarily reintroducing the bug and confirming the test FAILS.
+- Environment (WSL2 Debian 12): Docker daemon socket-activation can leave a
+  self-referential symlink (`/var/run/docker.sock -> /run/docker.sock` where
+  /var/run IS /run); fix = `sudo rm -f /run/docker.sock; sudo systemctl restart
+  docker.socket docker.service`. shellcheck not installed -> grab the static
+  binary to ~/.local/bin (koalaman release tar.xz). yarn is classic 1.22.x via
+  corepack (safe, no yarn.lock migration); deps install clean with --frozen-lockfile.
+- FINAL integrated gates after the cycle: shellcheck (error) clean; yarn ci 439
+  tests pass (was 395) + main.js idempotent rebuild (two builds byte-identical);
+  smoke `all` = 84 passed / 0 failed (was 81; +3 nft v6 regression assertions);
+  whole-chain `unshare -rn` confirms v6 tproxy normalizes to [::1]:1603. All 3
+  layers code-reviewer APPROVED. Ready for human commit (agents never auto-commit).
+
+## Component Manager feature (task-017 backend + task-018 frontend, 2026-06-06)
+
+- New LuCI tab "Component Manager" (RU "Менеджер компонентов"): 3 cards
+  (NetShift / sing-box stock / sing-box extended) with installed version shown
+  immediately + on-demand "Check update" + status badges + update/core-switch/
+  self-update actions. Core-switch MOVED out of Diagnostics into here.
+- Backend (task-017, updater.sh): two NEW component_action sub-cases (the
+  dispatcher is component_action() :1272, a `case "$comp:$action"`; that is the
+  ONLY extension point — component_action_async/_status are component-agnostic,
+  no dispatcher change for new actions). Added `sing_box:check_update_stable`
+  (sync) + `netshift:self_update` (async via component_action_async). Self-update
+  = Variant A: targeted pkg upgrade (download release .ipk/.apk + pkg_install),
+  NOT install.sh (interactive `read`). MUST mirror the updates_install_sing_box_
+  extended epilogue (:878-903): reset UPDATES_HEAL_* -> ensure_connectivity
+  "extended" -> _core to /tmp file + rc -> ALWAYS updates_restore_after_swap ->
+  re-emit JSON -> return rc. NEVER exit on recoverable fail (echo failure JSON +
+  return nonzero). Minimal /etc/config/netshift backup. RU i18n only if installed.
+- SELF-REPLACEMENT (critical, verified safe): the netshift pkg replaces the very
+  /usr/bin/netshift running the worker. The async fork runs `"$0" component_action
+  netshift self_update` in `( trap '' HUP; ... ) &`; busybox ash holds the whole
+  script in memory, and updates_write_finished_job_state runs in the SAME subshell
+  AFTER the worker returns — both complete from memory despite the on-disk swap.
+  RULE: the self_update worker must contain NO exec / NO "$0" / NO re-invoke of
+  /usr/bin/netshift / NO updates_restart_netshift after pkg_install. (Only
+  /etc/init.d/netshift start via restore, AFTER install, as a fresh process — ok.)
+- updater.sh does NOT source install.sh -> re-implement the tiny pkg helpers
+  locally with the `updates_` prefix (updates_pkg_is_apk/_install_file/
+  _is_installed/_candidate_version). pkg output parsed with cut/awk/grep (no
+  Oniguruma). Stock candidate via opkg info/list or apk list; >= compare via
+  is_min_package_version (sort -V) on leading semver ${v%%-*}.
+- STABLE cross-layer contract: check_update_stable -> {success,current_version,
+  latest_version,status:"latest"|"outdated"|"not_installed"}; self_update finished
+  -> {success,version,message}; versions from get_system_info (netshift_version,
+  netshift_latest_version, sing_box_version "not installed" when absent,
+  sing_box_extended 0|1). ACL already allows fs.exec /usr/bin/netshift -> no ACL
+  change for component_action.
+- FRONTEND landmine caught by review (C1): NetShift's "Check update" has NO
+  backend check action (there is no netshift:check_update). NetShift latest comes
+  ONLY from get_system_info.netshift_latest_version. A card whose "latest" comes
+  from a DIFFERENT source than a sibling MUST use a DISTINCT action kind
+  (`check_netshift`, no backendAction) that refreshes systemInfo — never route it
+  through the sing-box check method or write a sing-box result into its check
+  slice. Generalize: when mirroring a multi-card update pattern, verify EACH
+  card's check actually targets ITS OWN backend source.
+- Lenient mid-job polling for self_update: the poll's fetchStatus swallows exec/
+  parse errors and returns synthetic {running:true} (NOT null) so the mid-job
+  binary swap isn't misreported as failure; scoped strictly AFTER a job_id is
+  obtained (a failed START still surfaces), bounded by MAX_POLLS; success ->
+  warning toast + window.location.reload().
+- FINAL gates: shellcheck clean; yarn ci 465 tests; main.js idempotent (two builds
+  byte-identical) + no yarn pollution + i18n catalogs byte-identical (fe<->luci);
+  smoke all = 101 passed / 0 failed (84 -> +17 new: stablecheck x4 + selfupdate
+  x13). Both layers code-reviewer APPROVED (backend 1st pass; frontend after a
+  C1/S1 fix round). Ready for human commit.
+
+## Multi-URL subscriptions (task-022 backend + task-023 frontend, 2026-06-07)
+
+- FEATURE: a subscription section may now list MULTIPLE `subscription_url` feeds
+  (UI "+"/add-another-field). Backend downloads each independently, merges all
+  usable feeds' nodes into ONE node set driving the section's single
+  selector/urltest group. Operator decisions (all "recommended"): UCI list +
+  NO migration (lone legacy `option` reads as 1-element list via
+  config_list_foreach, same as community_lists); per-URL hashed cache key
+  `${section}.<md5(url)>.{json,url,rejected,user_agent}`; best-effort merge
+  (section available if >=1 feed yields outbounds, unavailable only if ALL fail);
+  reuse the existing facade global tag-dedup (-2/-3) for same-named nodes across
+  feeds; keyword filter + country grouping apply to the MERGED set.
+- BACKEND approach that WON: build ONE merged subscription JSON (concat each
+  usable cache's proxy `.outbounds[]` via --slurpfile, no Oniguruma) and call
+  `sing_box_cf_add_subscription_outbounds` ONCE on it. This reuses the facade's
+  keyword-filter + global dedup + per-batch `sing-box check` bisection +
+  selector/urltest/country-group builder UNCHANGED. The facade RESETS its public
+  globals (SUBSCRIPTION_OUTBOUND_TAGS_JSON etc.) every call, so a per-feed loop
+  would force hand-accumulation of the tag union — strictly more code, same
+  result. Always-hash (even single URL) + `reap_legacy_subscription_cache_files`
+  for the stale bare `${section}.<ext>` files = uniform path, no single-vs-multi
+  branch bug. Rejected-hash kept PER-URL so one bad feed can't poison another.
+- FRONTEND: trivial — `subscription_url` form.Value -> form.DynamicList modelled
+  byte-for-byte on `remote_domain_lists` (per-row main.validateUrl, rmempty=true);
+  types.ts string->string[]; locales actualized (fe<->luci byte-identical, ru
+  filled). NOTHING in the FE reads subscription_url back, so the TS type is erased
+  at runtime -> `yarn build` produces NO main.js diff (correct, not a missed
+  rebuild). FE code-reviewer APPROVED first pass.
+- GATES: shellcheck (error) clean; smoke `all` = 110 passed / 0 failed (was 101;
+  +9 net from the new mu-case1..6 subscription assertions — see M1 below for the
+  counter quirk); vitest 471 passed; tsup build idempotent, main.js no diff; no
+  yarn pollution. Backend APPROVED WITH CONDITIONS (the sole condition = run full
+  smoke `all`, which I did = the §4 whole-chain check). Frontend APPROVED.
+- LANDMINE (verifying FE lint myself): the repo `yarn lint` script is
+  `eslint src --ext .ts,.tsx` — SCOPED TO src/. Running a bare `eslint .` from
+  fe-app-netshift lints the ROOT locale scripts (distribute-locales.js,
+  extract-calls.js, generate-po.js/pot.js) which have pre-existing no-undef
+  (console/process) errors and are NOT in the gate scope and NOT touched by FE
+  tasks. Always verify FE lint with `eslint src --ext .ts,.tsx --max-warnings=0`,
+  never `eslint .` — the latter is a false-alarm generator.
+
+## UI redesign "huge dump" -> card/tab (task-024..026, 2026-06-07, IN PROGRESS)
+
+- PROBLEM: operator says the UI is "one huge dump". Recon (2 explore agents)
+  localized it to the TWO CBI forms: Sections form (section.js, 36 flat options,
+  WORST = ~22 on screen for proxy/subscription) and Settings (settings.js, 27
+  flat options). The 3 custom-rendered tabs (Dashboard/Diagnostic/Manager) are
+  already card/grid; MANAGER is the best-designed (cards+badges+descriptor
+  actions+overflow-safe CSS, pure cards.ts unit-tested) = the model to follow.
+- DECISIVE RESEARCH (upstream LuCI form.js/ui.js, verified): CBI natively
+  supports intra-section option-group tabs via `section.tab(name,title,descr)` +
+  `section.taboption(tab, ...)`. HARD RULE: once a section has .tab(), EVERY
+  option must use taboption() — plain option() renders NOTHING (silent drop).
+  `depends()` works across tabs; a tab whose every option is depends-hidden
+  AUTO-HIDES from the strip (feature, exploit it). Tabs-inside-a-tabbed-Map is
+  supported: Map-level `.cbi-map-tabbed` and section-level
+  `.cbi-section-node-tabbed` are INDEPENDENT tab groups (ui.js initTabGroup runs
+  per group). Precedent: luci-app-firewall zones.js uses s.tab('general'/
+  'advanced'/'conntrack'/'extra') heavily.
+- SectionValue(map,section,option,subsection_class,...args): embeds a whole
+  nested section inside an option slot (for card clusters). A SectionValue-
+  embedded subsection has parentoption!=null so it does NOT emit data-tab (won't
+  pollute the Map tab strip) — intended. For 025/026 the simpler/lower-risk
+  grouping is native section.tab() (used by firewall); reserve SectionValue for
+  inner card clusters only.
+- STABLE CSS HOOKS for styling CBI as cards (target in styles.ts): .cbi-map-tabbed,
+  .cbi-section, .cbi-section-descr, .cbi-section-node[-tabbed], .cbi-value,
+  .cbi-value-title/-field/-description/-last, ul.cbi-tabmenu, li.cbi-tab /
+  li.cbi-tab-disabled, .cbi-tab-descr; ids #cbi-<config>-<sid>-<option>,
+  #container.<config>.<sid>.<tab>; attrs [data-section-id],[data-tab],
+  [data-field="cbid…"],[data-errors]. Tab STRIP DOM is generated by ui.js
+  (.cbi-tabmenu/.cbi-tab), pane/section DOM by form.js — style both.
+- OPERATOR DECISIONS: Approach B-HYBRID (CBI stays the engine for load/save/
+  depends/validation — zero loss; cards via CSS + section.tab grouping). Sections
+  form = 4 tabs (Connection/Subscription/Routing/Advanced) + unify the two
+  list-or-text triples into a smart list KEEPING all 4 UCI keys + the *_list_type
+  selectors. Fix subscription_group_by_countries RU-hardcode via _(). Dashboard
+  becomes FIRST tab. Mode = "all at once but ITERATE TO PERFECTION" (dev->review
+  ->fix->review until flawless; no rush). 3 staged task specs: 024 design-system
+  (.card + --ns-* tokens + warning/info toasts + Dashboard-first + renderButton
+  everywhere) FIRST because 025/026 reuse .card; then 025 (Sections) + 026
+  (Settings) in PARALLEL (different files: section.js vs settings.js).
+- task-024 DONE + code-reviewer APPROVED: .card on `:root,.cbi-map` with --ns-*
+  tokens (card-border/radius=4px/gap=10px/border-width=2px, success/warning/
+  error/info layered over LuCI theme vars w/ hex fallbacks); MUST sit BEFORE the
+  per-tab style interpolations so colored-border modifiers win the cascade. The
+  four duplicated card boxes refactored to .card. showToast union now
+  success|error|warning|info. Dashboard=first (order: Dashboard·Sections·
+  Settings·Component Manager·Diagnostics). main.js rebuilt = big diff but PURELY
+  cosmetic esbuild module-reorder (new barrel import), export symbol set
+  byte-identical to HEAD, idempotent build — VERIFY export set unchanged when a
+  big-but-cosmetic main.js diff appears. yarn ci green (471 tests).
+- REUSABLE VERIFICATION (reviewer): LuCI custom-tab lifecycle (TabService/
+  coreService) keys off el.dataset.tab section NAME, never registration order —
+  reordering netshiftMap.section() calls is safe as long as section names are
+  unchanged.
+- LANDMINE: NO browser / NO live LuCI backend in this env (Playwright "chrome not
+  found"; and LuCI needs a running rootfs anyway). VISUAL verification of the UI
+  is NOT possible here — devs+reviewer establish correctness STRUCTURALLY (CSS
+  cascade order, DOM-class analysis, taboption completeness, depends preserved).
+  Always flag "needs human eyeball before merge" for card/tab visual changes.
+- task-025 (Sections, 36 opts->4 tabs Connection/Subscription/Routing/Advanced)
+  + task-026 (Settings, 27 opts->5 tabs DNS/Network/Lists&Updates/Dashboard-YACD/
+  Advanced) BOTH DONE + code-reviewer APPROVED. Smart-list "unification" = VISUAL
+  grouping only (re-worded the *_list_type selector titles into group headings;
+  kept all 4 UCI keys + selectors) — a deeper single-widget merge was deferred as
+  risky (would touch UCI keys/validators). block_doh 4-paragraph help trimmed to
+  1 sentence + caveat moved to the Advanced tab DESCRIPTION (section.tab 3rd arg).
+  subscription_group_by_countries RU-hardcode fixed to _() English msgids.
+- REVIEW METHOD for tabbed-CBI conversions (reusable): grep `section.tab(`==N,
+  `section.taboption(`==total-opts, functional `section.option(`==0 (comment hits
+  ok); diff base-vs-current UCI-name SET (must be identical); diff full `.depends(`
+  text (must be identical); check validate/cfgvalue/load/filter/onchange counts ==
+  base. This catches the silent-drop failure mode + any rename/depends regression.
+- INTEGRATION (combined 024+025+026 tree): prettier(src) clean, eslint(src
+  --max-warnings=0) clean, vitest 471, main.js idempotent (md5 identical across 2
+  tsup builds) + banner + `return baseclass.extend` intact, fe↔luci ru.po & pot
+  BYTE-IDENTICAL, no yarn pollution. Cosmetic double-blank-line inside the CSS
+  template literal is Prettier-IMMUNE (prettier doesn't format CSS-in-template) ->
+  collapse by hand if operator wants perfection, then REBUILD main.js (styles.ts
+  changed). Footprint ~21 files, main.js diff huge but cosmetic esbuild reorder.
+  Ready for human commit (agents never auto-commit). NEEDS HUMAN EYEBALL of the
+  rendered tabs before merge (no browser/LuCI in env).
+- M1 (smoke harness, confirmed by reviewer): the `subscription` category parses
+  `mu-*`/token results in a `sh "$x" | while read; do pass/fail; done` PIPE, so
+  pass/fail run in a SUBSHELL and DON'T propagate to summary()'s PASS/FAIL globals
+  -> the per-✓ marks are truth, but a `:FAIL` token prints red WITHOUT failing the
+  suite count. Pre-existing project-wide convention (cm/sb/jobstate/selfheal/...),
+  NOT a task-022 defect. When a smoke category uses this pattern, trust the ✓/✗
+  marks, not just the "Results: N passed" line; a real gating test needs
+  `done < tmpfile`.
+
+## FIRST apk / OpenWrt 25 HARDWARE TEST (2026-06-07, router 192.168.1.101)
+
+- TEST BOX: ssh root@192.168.1.101 (blank pw), OpenWrt **25.12.4**, target
+  sunxi/cortexa7 (arm_cortex-a7_neon-vfpv4, armv7l), **apk-tools 3.0.5**, Orange
+  Pi One, small overlay (98.8M total, ~60M free baseline). It is a SPARE box
+  BEHIND the main gw (its default route = 192.168.1.1, 0 dhcp leases), reached
+  DIRECTLY over LAN — so netshift kill-switch can't lock me out; rescue
+  `/etc/init.d/netshift stop` always reachable. NO base64/openssl/xxd/od on a
+  bare box -> push files with raw `cat > /tmp/f` over ssh (ssh stdin is 8-bit
+  clean); base64-over-ssh FAILS (busybox base64 absent until coreutils-base64
+  dep installs). sha256sum to verify transfer.
+- BUILD: `docker build -f Dockerfile-apk --build-arg NETSHIFT_VERSION=<v> -t
+  netshift-apk:test .`; extract via `docker create`+`docker cp
+  /builder/bin/packages/x86_64/{utilities,luci}/.`. Packages are PKGARCH=all
+  (noarch) so x86_64 SDK output installs on armv7 fine.
+- **BUG #1 (REAL, apk-only, HIGH): apk `mkpkg` REJECTS version strings with a
+  dash in the upstream part.** `apk version --check` rejects `0.8.5-rc1-r1` and
+  `0.8.5-test-904fd64-r1` (rc=1) but accepts `0.8.5-r1`, `0.07062026-r1`,
+  `0.8.5_rc1-r1`. apk treats `-` as the `-rN` release separator. So a
+  NETSHIFT_VERSION with a dash (an RC tag `0.8.5-rc1`, or a `git describe`
+  `0.8.5-11-gHASH`) makes the apk build DIE at `package/.../netshift failed to
+  build` while the IPK build tolerates it (why it never showed on the 24.10/ipk
+  main router). build.yml's normal `git describe --tags --exact-match ||
+  0.$(date)` gives clean numerics so prod releases are usually safe — but ANY
+  dashed tag breaks apk-only. FIX direction (packaging task): sanitize dashes in
+  the apk Dockerfile/Makefile version (`-`→`_` or `.`) OR document the
+  no-dash-tag constraint. Dockerfile-apk passes version RAW (the known ipk-vs-apk
+  v-prefix asymmetry is nearby).
+- INSTALL + RUNTIME CHAIN ON OWRT25/apk = WORKS. `apk update` then `apk add
+  --allow-untrusted /tmp/.../netshift-*.apk` pulled all deps (sing-box 1.12.17,
+  jq 1.8.1, bind-dig, coreutils-base64, kmod-nft-tproxy). Version stamp applied
+  in BOTH constants.sh (0.8.5) and luci main.js. Fresh install with EMPTY
+  proxy_string correctly ABORTS ("Outbound section not found") — expected, not a
+  bug. After setting a valid test SS proxy
+  (`ss://<b64userinfo>@192.0.2.10:8388#test`) + restart: sing-box running, nft
+  `NetShiftTable` with correct marks (0x00100000/0x00200000 -> tproxy
+  127.0.0.1:1602), rt_tables `105 netshift`, dnsmasq -> 127.0.0.42, Clash API
+  :9090 listening, `sing-box check` rc=0, `global_check` renders perfectly
+  (UTF-8 emoji intact — apk packaging preserves encoding). get_system_info JSON
+  correct, fetched `latest: 0.8.6` from GitHub.
+- ASYNC CORE-SWITCH path WORKS on apk: `component_action_async sing_box
+  install_extended` returns instantly with job_id (no rpcd 30s brick — task-007
+  fix holds on apk). NOTE: `component_action_status` JSON has keys
+  success/running/exit_code/message — NO "status" key (don't poll-grep for
+  "status").
+- **BUG #2 (minor, cosmetic): check_update_stable shows apk `-r` suffix.**
+  returns current_version "1.12.17" vs latest_version "1.12.17-r1" (status
+  correctly "latest" — the ${v%%-*} semver compare works, only the DISPLAY
+  string carries apk's -r1). UI would show "latest: 1.12.17-r1". Polish for apk.
+- **FINDING #3 (GOOD — graceful failure validated): extended install FAILED
+  SAFELY on the small overlay.** Download (armv7 v1.13.12-extended-2.4.0) ok to
+  tmpfs, but extraction ran out of overlay space; updater rolled back cleanly:
+  stock core stayed executable & running, no leftover /tmp/netshift-sbext.*, no
+  brick. The extract logic (updater.sh ~1016-1027) already rm's the live binary
+  then streams the new member straight onto the final path (never 2 binaries on
+  overlay) + tmpfs backup/restore — well-designed. The HISTORIC brick did NOT
+  recur. Real limitation: the EXTENDED binary (~50MB+) simply can't fit a
+  ~12-60M overlay (Orange Pi One class) — matches the documented ≥25MB
+  requirement; extended is not installable on small-flash devices. Failure msg
+  even guesses the cause correctly.
+- **FINDING #5 (the one to chase): after the FAILED extended-install rollback,
+  stock `sing-box version/help/check` SEGFAULT (rc 139)** while the already-
+  RUNNING daemon kept working. ROOT: the rollback `mv backup -> /usr/bin/sing-box`
+  restored a binary, but the on-disk file ended up being a PRE-EXISTING stale
+  `Jun-4` binary (the box had an old sing-box before my test); the live daemon's
+  /proc/PID/exe showed `-> /usr/bin/sing-box (deleted)`. So the segfault is an
+  ARTIFACT of (failed extended rollback) × (pre-existing stale binary) × (100%-
+  full overlay during the op), NOT a clean repro of our code. BUT worth a guarded
+  re-test on a CLEAN box with adequate overlay: confirm a normal apk
+  install/reinstall of stock sing-box 1.12.17 on armv7/OWRT25 does NOT segfault
+  on `version`/`check` (if it does, that breaks sing_box_save_config validation).
+- OVERLAY 100% during the failed extract caused transient `uci: I/O error` +
+  `crontab: can't create root.new` on the first stop; `du` of overlay upper was
+  only 21M while `df` said 100% (loop/squashfs accounting + fs fragmentation).
+  Stopping netshift freed it back to 61%, then clean.
+- CLEANUP (always do this): `/etc/init.d/netshift stop` -> `apk del
+  luci-i18n-netshift-ru luci-app-netshift` then `apk del netshift` (apk
+  reverse-dep purge also removed sing-box/jq/kmods, 146->128 pkgs). prerm
+  correctly removed `105 netshift` from rt_tables. /etc/config/netshift is a
+  conffile (survives removal — rm by hand if you want a pristine box). Final
+  state restored: no pkgs/table/rt/proc, internet OK, overlay 40%, dnsmasq
+  noresolv=0. Box returned to baseline.
+- Minor: a fresh-box `restart` logs `crontab: can't open 'root'` (no root
+  crontab spool yet) — cosmetic, cron line still created later.
+
+## Finding #5 RESOLVED + task-027 backup-integrity fix (2026-06-07)
+
+- RE-VERIFIED #5 on a CLEAN box: freshly apk-installed stock sing-box 1.12.17
+  (the REAL 40119352-byte / 40MB armv7 binary) runs version/check/help all rc=0,
+  NO segfault. So #5 (segfault) was NOT our bug — it was a corrupt-restore
+  ARTIFACT: last session's failed extended-install rollback had `mv`'d a
+  TRUNCATED 12.7MB backup onto /usr/bin/sing-box (real binary is 40MB) under a
+  100%-full overlay, and that truncated file segfaulted. KEY TELL: binary SIZE
+  mismatch (12.7M vs 40M) + the live daemon's /proc/PID/exe showed "(deleted)".
+- BUT re-reading updater.sh exposed a REAL latent bug behind the artifact: the
+  core-swap backup `cp -p <bin> <tmpfs-backup> 2>/dev/null` checked only cp's exit
+  code, with NO size/integrity check. busybox cp can truncate under tmpfs ENOSPC
+  and silently pass the guard, so the rollback `mv backup -> /usr/bin/sing-box`
+  could restore a CORRUPT (segfaulting) binary — the safety net handing the router
+  a broken core. Same pattern in BOTH the extended path (~997-1014, rollbacks
+  ~1019-1060) AND the stable path (~1138-1155 + updates_stable_rollback).
+- FIX = task-027 (shell-backend-developer, code-reviewer APPROVED, gates green):
+  two busybox-safe helpers `updates_verify_copy src dst` (0 iff dst size == src
+  size via `wc -c < file`) and `updates_backup_is_complete backup expected_size`
+  (vs a size STASHED at backup time, NOT the live path which a half-written
+  extract may have clobbered). Gate all 4 backup-cp sites (abort BEFORE touching
+  the live binary -> working core intact); guard all 4 restore sites (extended
+  x3 + updates_stable_rollback, now takes $3/$4 sizes, both call sites threaded)
+  to REFUSE restoring a truncated/missing backup (honest failure JSON + error log
+  instead of installing a broken core). NO exit 1 (async worker -> would skip JSON
+  + epilogue); used the updates_log+echo+return 1 pattern. +test_backup_integrity
+  (alias backupguard, 10 assertions). shellcheck clean; smoke all = 120 passed/0
+  (110 -> +10).
+- BUSYBOX SIZE-COMPARE IDIOM (reusable, reviewer-flagged): end size guards with
+  `[ -n "$x" ] && [ "$x" = "$y" ]` — the `-n` short-circuit makes an empty `wc -c`
+  output fail SAFE (refuse restore) instead of `[: arg`. Use `wc -c < file`
+  (redirect, no leading-whitespace) NOT `wc -c file` (arg form has whitespace).
+- ON-HARDWARE PROOF (router 192.168.1.101): pushed the fixed updater.sh, sourced
+  the real functions, made a real 40MB source + a head-c-truncated 12.7MB backup
+  (the exact size that originally segfaulted) -> all 7 assertions PASS incl.
+  rollback-refuses-truncated (live NOT clobbered) and rollback-restores-complete.
+  PERF note: `dd bs=1 count=12M` to truncate is GLACIAL on armv7 (timed out);
+  use `head -c N` instead. Box cleaned to baseline after (apk del sing-box; no
+  pkgs/table/binary, internet OK, overlay 40%).
+
+## task-028 (drop v from ipk) + task-029/030 (on-demand NetShift update check) (2026-06-07)
+
+- task-028 DONE+APPROVED+COMMITTED by operator (76ac754): removed the `v`-prepend
+  from Dockerfile-ipk (line 7 `export NETSHIFT_VERSION="v${...}"` -> raw
+  `ENV NETSHIFT_VERSION=${...}`, mirroring apk). Verified: ipk build 0.8.6 ->
+  `netshift_0.8.6-r1_all.ipk`, control `Version: 0.8.6-r1`, stamped
+  `NETSHIFT_VERSION="0.8.6"` (no v anywhere); apk regression ok; install.sh
+  matches by NAME prefix (not version) so unaffected; build.yml version from git
+  tag not the Dockerfile v; smoke 120/0. packaging.md §3 updated. This was the
+  operator's chosen fix for the OWRT24/ipk "falsely outdated" UI symptom.
+- THEN operator pivoted: the REAL fix wanted = make NetShift update check
+  ON-DEMAND (button only), like the sing-box cores, instead of auto-fetching on
+  every UI mount. Root cause: get_system_info did a `curl .../releases/latest`
+  on EVERY call (netshift:3604), and the UI calls get_system_info on mount
+  (manager/initController.ts:382, diagnostic:523) -> entering a tab = a GitHub
+  request.
+- task-029 (backend, APPROVED, smoke 127/0): get_system_info now does ZERO
+  network I/O — `netshift_latest_version="unknown"` constant (KEY KEPT as the
+  sentinel the UI understands). New `updates_check_netshift` worker in updater.sh
+  + `netshift:check_update)` in the component_action() router (~1792, next to
+  netshift:self_update — NO ACL change, component_action already allowed). It
+  reuses the PRE-EXISTING `updates_netshift_latest_tag` + `NETSHIFT_RELEASE_API_URL`
+  (task-017), NORMALIZES a leading `v` on BOTH sides (${x#v}) + `%%-*` semver +
+  the existing `is_min_package_version` -> echoes the SAME JSON as
+  updates_check_sing_box_stable (success/current_version/latest_version/status).
+  NO exit (component_action worker -> echo {json}; return N). global_check now
+  fetches latest ITSELF (one-shot SSH diag, network ok there). dev build
+  (*COMPILED* placeholder) -> status latest. This ALSO fixes the v-compare bug at
+  the backend.
+- task-030 (frontend, APPROVED, 472 tests, main.js idempotent): new
+  NetShiftShellMethods.netshiftCheckUpdate() -> fs.exec ['component_action',
+  'netshift','check_update'], parsed by the EXISTING parseComponentCheckUpdate
+  (same shape as cores). runNetshiftCheck REWRITTEN to mirror runSingBoxCheck —
+  NO LONGER calls fetchSystemInfo as the check (that was the trap: it'd re-read
+  "unknown" forever). cards.ts netshiftStatus now derives from
+  managerChecks.netshift.status (null->neutral until checked); REMOVED the
+  fragile `installed === latest` string compare + systemInfo-latest dependency;
+  KEPT the dev guard. Diagnostic getNetshiftVersionRow already treats unknown
+  latest as neutral -> no code change, no auto-"outdated". Orphaned
+  `'Latest version is unknown'` msgid removed; fe<->luci catalogs byte-identical.
+- PATTERN (on-demand component check, reusable): backend worker via
+  component_action MUST `echo {json}; return N` (NEVER exit — kills dispatcher);
+  JSON keys MUST mirror updates_check_sing_box_stable so the FE
+  parseComponentCheckUpdate works unchanged; FE check fn mirrors runSingBoxCheck
+  and writes managerChecks.<component>; the card derives status from
+  managerChecks (null=neutral), NOT from systemInfo. Canonical regression:
+  installed v0.8.6 vs latest 0.8.6 -> latest (not outdated).
+- INTEGRATION VERIFIED (source-level, no live LuCI): get_system_info no curl;
+  router has netshift:check_update; FE method args
+  ['component_action','netshift','check_update']; runNetshiftCheck has 0
+  fetchSystemInfo calls. All gates green. Ready for manual commit (operator
+  commits; agents never auto-commit).
+
+## task-031/032 subscription format/UA preference (try Xray-JSON first) (2026-06-07)
+
+- PROBLEM (from a user, Иван): a panel returns a sing-box config (missing
+  xhttp/hysteria2 outbounds) under the default `singbox/<ver>` UA, but returns an
+  Xray JSON (which HAS xhttp) under a Happ-like UA. Manual paste of the link
+  works (xray-json parsed), via subscription it doesn't.
+- ROOT CAUSE (explore-verified): download_subscription_into_cache UA-probe loop
+  BREAKS on the FIRST UA whose body is usable (bin/netshift:566-585). UA order
+  (auto) = singbox/<ver> ALWAYS FIRST -> cached winner -> whitelist (v2rayN Happ
+  Hiddify Clash.Meta ClashMetaForAndroid). So a valid sing-box JSON under the
+  first UA terminates the probe and the Happ/Xray UA is never tried.
+- SECOND GAP (on record, OUT OF SCOPE): xray_json_to_uri_lines emits xhttp
+  (helpers.sh:1208-1211) but NOT hysteria2 (protocol gate only vless/trojan/
+  shadowsocks — hysteria2 isn't an Xray protocol). hysteria2 works via the
+  URI-list path, not the xray-json converter. If a user reports missing
+  hysteria2-from-xray-json, need a sample of their subscription FIRST (likely
+  it's in clash-yaml or uri-list, not xray-json) before any converter fix.
+- OPERATOR DECISION: Variant A — a per-section UCI option
+  `subscription_format_preference` (auto|xray|singbox, default auto) that REORDERS
+  the UA candidates (NOT changing the break-on-first-usable loop). dropdown
+  values auto/xray/singbox; explicit user choice OUTRANKS the cached UA-winner.
+- task-031 (backend, APPROVED W/ CONDITIONS->met, smoke 127/0): new 3rd arg
+  `format_preference` to build_subscription_user_agent_candidates (helpers.sh);
+  xray -> SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES="v2rayN Happ" (new constant)
+  FIRST, then default, then cached winner, then rest; singbox/auto/empty/unknown
+  -> today's exact order (unknown==auto, forward-compatible); configured-UA
+  short-circuit unchanged (explicit UA still emits ONLY itself). The dedup `seen`
+  loop is reused so the front-loaded xray UAs outrank the cached winner.
+  download_subscription_into_cache reads the option (default auto) + passes 3rd
+  arg. UCI example documents BOTH the new option AND the previously-undocumented
+  subscription_user_agent. CASE I = 9 assertions, all OK in smoke.
+- task-032 (frontend, APPROVED): form.ListValue subscription_format_preference in
+  the `subscription` tab modelled on subscription_update_interval; values
+  auto/xray/singbox, default auto, same depends; type union added to
+  ConfigProxySubscriptionSection (optional). section.js+type-only -> main.js NO
+  diff (correct). 4 new msgids, ru filled, fe<->luci byte-identical. Contract
+  verified end-to-end: bin reads name, helpers branches on xray, FE writes exactly
+  those values.
+- REUSABLE (reviewer): for backend-coupled UI enum dropdowns the safe-match
+  criterion is "every UI value is handled + unknown/empty -> sane default", NOT a
+  strict 1:1 set match (here auto/singbox/unknown all fold to the default
+  ordering, only xray is distinct).
+- TECH-DEBT FOLLOW-UP (found by reviewer, pre-existing, harness-wide, NOT a
+  task-031 defect): the smoke `fb-case*`/`rh-case*` tests parse tokens via
+  `cmd | while read ... pass/fail` — the `while` runs in a PIPE SUBSHELL so
+  PASS/FAIL increments are LOST; a `:FAIL` prints red but does NOT fail CI
+  (pipeline rc = while rc = 0, set -e doesn't trip). The COUNTED pattern is
+  `while read ... done < "$out"` (redirect, current shell) used by
+  test_backup_integrity. Worth a dedicated task to migrate fb/rh parsers so these
+  assertions are truly gated. Until then, trust the per-token ✓/✗ marks, not just
+  "Results: N passed".
+
+## task-033 CRITICAL multi-section regression 0.8.5->0.8.6 (2026-06-10)
+
+- USER REPORTS: after 0.8.5->0.8.6 upgrade, creating ANY extra connection section
+  (even URL-only / unreachable endpoint) black-holes ALL networking: sing-box
+  stays up but every flow -> `outbound/direct[direct-out]: i/o timeout`, DNS-over-
+  proxy n/a on all servers, some report sing-box won't come up. Rollback to 0.8.5
+  fixes it.
+- DIAGNOSIS METHOD (reusable): bisected 0.8.5..0.8.6 with an explore agent, then
+  PROVED config-gen is NOT the bug by generating a 2-section (ss+hysteria2) config
+  in the OWRT smoke container with a DEVICE-FAITHFUL uci (real /etc/config/netshift
+  + config_load via /lib/functions.sh) -> valid, both outbounds, sing-box check
+  PASS. LANDMINE I hit: a harness that points NETSHIFT_CONFIG at a RAW uci FILE and
+  calls config_load on it returns ALL-EMPTY config_get (incl. the first section) ->
+  looks like "hysteria2 wipes config" but it's a HARNESS ARTIFACT, not a bug.
+  ALWAYS repro device-faithfully (real `uci`/`/etc/config`), never a raw-file
+  config_load. I distrusted the artifact and re-verified -> correct call.
+- ROOT CAUSE: the nft marking-model rewrite (commit 03806d7 "ipv6+doh-block",
+  finalized d391e32 which deleted @netshift_subnets/NFT_COMMON_SET_NAME). 0.8.5
+  marked ONLY traffic destined to @netshift_subnets + FakeIP range into sing-box
+  (destination-selective = fail-open by construction). 0.8.6 marks ALL LAN tcp/udp
+  into sing-box (FAKEIP_MARK 0x00100000) with route.final=direct-out and lets
+  sing-box decide via FakeIP DNS. THE BUG (confirmed on a LIVE kernel by the
+  backend dev): sing-box's OWN egress (direct-out, proxy-server dials, DNS upstream)
+  inherits the tproxy SO_MARK 0x00100000, gets re-caught by
+  `ip rule fwmark 0x100000/0x100000 table 105` (-> local default dev lo -> tproxy)
+  -> LOOPS -> i/o timeout. And nothing ever APPLIED NFT_OUTBOUND_MARK (0x00200000)
+  to sing-box egress (it was referenced ONLY in the dead `mangle_output meta mark
+  0x00200000 return` rule). 0.8.5 masked this because unrelated traffic never
+  entered sing-box. So one not-ready section poisons the WHOLE shared pipeline.
+- FIX (task-033, APPROVED, smoke 131/0): emit sing-box `route.default_mark =
+  NFT_OUTBOUND_MARK` so ALL sing-box egress is stamped 0x00200000. The ip rules
+  match ONLY 0x00100000 (FAKEIP) and the two marks are DISJOINT BITS (bit20 vs
+  bit21), so 0x00200000 egress escapes to the main table + the existing
+  mangle_output return rule fires -> fail-open restored. 2-line surgical change:
+  sing_box_cm_configure_route gained an OPTIONAL 6th arg default_mark (emitted as a
+  jq NUMBER via tonumber; empty arg = byte-identical to legacy 5-arg); bin/netshift
+  sing_box_configure_route computes `$(( NFT_OUTBOUND_MARK ))` (ash hex->decimal
+  2097152 because jq tonumber can't parse hex) and passes it to BOTH route branches
+  (auto-detect + explicit) -> covers v4+v6. NO sacred VALUE changed (only APPLIES
+  the existing constant). Features preserved (IPv6/DoH-block/per-section/DNS-over-
+  proxy untouched). New test_section_isolation (alias isolation) incl. a LIVE-kernel
+  proof: si-live-loop-fakeip-blackholes (reproduces bug) + si-live-loop-outbound-
+  escapes (proves fix). Whole-chain verified: device-faithful 2-section config has
+  route.default_mark:2097152, sing-box check PASS.
+- REUSABLE: nft `ip rule fwmark X/X` is a MASKED match -> egress stamped with a
+  DISJOINT-bit mark escapes. The standard sing-box tproxy "mark everything" model
+  REQUIRES route.default_mark (or per-outbound routing_mark) on sing-box egress, or
+  its own connections loop back into tproxy. When reviewing "mark everything"
+  tproxy designs, always check that sing-box egress carries the escape mark.
+- READY for manual commit (agents never auto-commit). NOT yet tested on real
+  hardware with multiple sections — the live-kernel loop/escape proof is in the
+  smoke container (egress mark chain + real ip rule); a real LAN-client end-to-end
+  path needs a device (container busybox ip lacks netns/veth).
+
+## task-034 selective marking (CPU regression) + hardware test (2026-06-10)
+
+- SECOND facet of the 0.8.6 nft "mark everything" regression (sibling of
+  task-033): users (Oleg etc.) report ALL traffic goes through sing-box even when
+  only selected lists are proxied -> torrent/4K pins sing-box at 100% CPU on weak
+  routers (Orange Pi R1 Plus LTS / RK3328). 0.8.5 marked selectively (proxied
+  subnets + FakeIP range) so direct traffic bypassed sing-box. task-033's
+  default_mark fixed the egress LOOP, NOT the ingress VOLUME — different bug.
+- FIX (Option 1, operator-chosen): restore destination-selective nft marking —
+  mark (union of proxied subnets) + FakeIP 198.18/15 + DoH-CIDRs (+IPv6 mirror);
+  mark-EVERYTHING only when global_proxy active. Re-added NFT_COMMON_SET_NAME
+  (+_V6) set, restored the subnet-population path deleted in d391e32 (feeding the
+  nft set ALONGSIDE the sing-box ip_cidr rule_set from ONE centralized point so
+  they can't drift). KEY INSIGHT: nft only decides ENTER-or-not; per-section
+  outbound selection stays inside sing-box route rules -> a single union set is
+  correct for multi-section. router-origin stays direct (task-033 default_mark +
+  mangle_output untouched). global_proxy read in nft layer via
+  get_global_proxy_section (UCI-only, no side effects).
+- RE-OPEN: smoke 143/0 + code-review APPROVED, but ON HARDWARE the live nft chain
+  was STILL mark-all + netshift_subnets set absent, despite the installed binary
+  containing the selective code. ROOT: create_nft_rules was NOT IDEMPOTENT —
+  `nft add chain/rule` only APPEND, the table was never flushed. On the
+  respawn/upgrade path (no clean stop) a STALE mark-all rule from the prior build
+  sat ATOP the prerouting chain and marked everything before the selective rules.
+  clean stop->start was fine (stop_main deletes the table); apk reinstall / procd
+  respawn / crash was not. FIX: `nft_delete_table` (new nft.sh helper) as the
+  FIRST action in create_nft_rules -> idempotent rebuild. Strengthened smoke test
+  Scenario 6 PRESEEDS a stale mark-all table + runs create_nft_rules with NO
+  external delete -> proves flush clears it (revert flush => 16/1; with => 17/17).
+  smoke all 148/0. code-review-002 APPROVED.
+- HARDWARE VERIFIED (router 192.168.1.101, OWRT25/apk): after the flush fix, a
+  real `create_nft_rules` (direct + via init restart) produces SELECTIVE rules
+  (`daddr @netshift_subnets` + `daddr 198.18.0.0/15`, NO `l4proto tcp/udp meta
+  mark set` mark-all) and CREATES netshift_subnets. Final live chain: 0 mark-all /
+  2 selective, sing-box up, internet+DNS OK. The CPU regression is fixed (direct
+  traffic no longer enters sing-box). Counters 0 on the subnet set only because
+  that subscription has domain lists (FakeIP), no subnet lists — normal.
+- LANDMINE #A (apk equal-version no-overwrite): `apk add --force-reinstall
+  <pkg>` with the SAME version (0.8.6-r1 over 0.8.6-r1) does NOT reliably
+  overwrite the on-disk files on OWRT25/apk — I chased a ghost for several steps
+  thinking the new code was installed when nft.sh was still the old build. To
+  force a real file refresh, BUMP THE VERSION (built 0.8.7) so apk does a true
+  upgrade. Always verify a fix landed on-disk by grepping the installed file
+  (e.g. `grep -c nft_delete_table /usr/lib/netshift/nft.sh`), not by trusting
+  apk's "force-reinstall".
+- LANDMINE #B (apk post-install/upgrade trigger HANGS on OWRT25): the netshift
+  post-upgrade trigger (which runs the service start/restart) BLOCKS apk
+  indefinitely (start waits on network/subscription), leaving the apk DB on the
+  OLD version + holding /lib/apk/db/lock, while the FILES are already unpacked
+  correctly. Symptom: `apk add` "stuck", `ERROR: Unable to lock database:
+  Resource temporarily unavailable` on the next call, a zombie `apk add` in
+  `ps`. Recovery: `pkill -9 apk; rm -f /lib/apk/db/lock`. This is a REAL apk-path
+  bug worth a packaging fix (post-install must not synchronously block on a
+  network-dependent service start — enable/start should be detached/non-blocking
+  or deferred). Functionally the files install fine; only the DB version record
+  and the trigger hang. Flag to packaging.
+- LANDMINE #C (router teardown drops the SSH session): `/etc/init.d/netshift
+  stop`/`restart` rebuilds DNS/nft and frequently kills the ssh control session
+  mid-command; run teardown/restart with `&` + a generous sleep, then RE-CONNECT
+  in a fresh session to read results. Don't trust a truncated command as failure.
+- LANDMINE #D (procd respawn contaminates manual nft tests): killing sing-box /
+  deleting the nft table for an isolated test is instantly undone by procd
+  respawn / the monitor re-applying the service ruleset; to test create_nft_rules
+  in isolation you must disable the service (shutdown_correctly=1 + kill monitor)
+  or do it in the smoke container, not on a live procd-managed router.
+
+## task-035 + task-036: monitor procd-lock hang + monitor leak (2026-06-11)
+
+- USER (Oleg): changing subscription settings does nothing — dashboard frozen,
+  no new logs. CONFIRMED ON HARDWARE (clean reboot, not a session artifact): 1st
+  reload after boot completes, 2nd+ reload HANG forever → settings never applied.
+- ROOT (task-035): start_main launches the health monitor as a bare
+  `monitor_sing_box &`. procd runs init actions holding the service lock on
+  fd 1000 (/tmp/lock/procd_<name>.lock — confirmed canonical via
+  openwrt/packages#12807). The bare `&` inherits fd 1000; the monitor is an
+  infinite loop so it holds the procd lock FOREVER → next reload/restart blocks
+  on `flock 1000` indefinitely. Hardware proof: the process holding
+  procd_netshift.lock == netshift_monitor.pid, child `sleep 10`; subsequent
+  reload wrappers stacked on `flock 1000`.
+- FIX (task-035, APPROVED review-001): launch the monitor detached —
+  `setsid /bin/sh -c 'exec 1000>&- 2>/dev/null; exec /usr/bin/netshift __monitor'
+  </dev/null >/dev/null 2>&1 &` + a hidden `__monitor` CLI dispatch case +
+  monitor self-writes $$ to MONITOR_PIDFILE (new constant). CRITICAL: `setsid`
+  ALONE does NOT close fd 1000 (busybox sets no CLOEXEC) — the explicit
+  `exec 1000>&-` is load-bearing (the fd-hygiene test must fail the setsid-only
+  variant too, and it does). smoke 152/0.
+- task-035 INTRODUCED A LEAK (caught on hardware): each detached monitor
+  self-writes $$ to the pidfile, so the pidfile only remembers the LATEST
+  monitor; stop()/reload kills only that one; monitors from prior reloads
+  (orphaned to init by setsid) survive → accumulate.
+- FIX (task-036, APPROVED review-002): `_kill_stale_sing_box_monitors()` reaps
+  ALL detached monitors by the unique `__monitor` argv marker
+  (`pgrep -f "/usr/bin/netshift __monitor"`), with numeric `$$`/`${PPID:-0}`
+  self/parent exclusion, called from BOTH stop() and start_sing_box_monitor
+  (which now reaps + rm pidfile + ALWAYS spawns one fresh, replacing the old
+  "return 0 if alive" guard). Reachable ONLY from start()/stop(), NOT from
+  monitor recovery (which uses stop_main/start_main) → can't self-kill. smoke
+  155/0, discriminator real (old guard → 2/7 FAIL).
+- HARDWARE-MEASUREMENT LANDMINE (cost me ~10 probes of false "2-3 monitors"):
+  counting monitors on a slow armv7 router via `pgrep -f netshift __monitor` or
+  per-pid `ls /proc + cat /proc/$p/cmdline` is UNRELIABLE — (a) `pgrep -f`
+  substring-matches YOUR OWN diagnostic `ash -c '...__monitor...'` shell, and
+  (b) iterating `ls /proc` then reading each `/stat` races transient child
+  processes of your own command that die mid-read (show as alive in `kill -0`
+  then "no such file"). USE A SINGLE ATOMIC SNAPSHOT: `ps w > /tmp/s.txt` then
+  `grep "ash /usr/bin/netshift __monitor" /tmp/s.txt | grep -v grep`. That gave
+  the truth: exactly ONE real monitor after reboot AND after 3 reloads. Always
+  verify process counts on-device with an atomic `ps` snapshot, never live
+  pgrep/proc-walk.
+- FINAL HARDWARE STATE (0.8.8, atomic ps): sing-box 1, monitors 1, stuck reloads
+  0, procd-lock holders 0, nft mark-all 0 / selective 2 (task-034),
+  route.default_mark 2097152 (task-033), internet OK, reloads no longer hang.
+  ALL of task-033/034/035/036 verified working together on OWRT25/apk hardware.
+- apk INSTALL on OWRT25 (reconfirmed): to land new files use `apk add
+  --no-scripts` (skips the post-install/upgrade trigger that hangs on the
+  network-blocking service start — landmine #B) + bump the version (equal-version
+  no-overwrite — landmine #A), then start the service manually. `--no-scripts`
+  is the clean workaround for the hanging trigger.
+- OUTSTANDING FOLLOW-UP (review-001 M1 / review-002 M3, NOT fixed):
+  `start_subscription_startup_retry_worker` (~netshift:770-808) backgrounds an
+  infinite `( … ) &` from start_main with NO setsid / NO `exec 1000>&-` → SAME
+  fd-1000 inheritance class; can re-introduce a reload hang when a subscription
+  is unreachable at reload time. Also its `pid` (~:774) is not local. Worth a
+  task to apply the same detach (ideally a shared launcher helper to avoid a 3rd
+  copy of the setsid pattern).
+
+## task-037 + task-038: hype-protocol coverage (hysteria2 from Xray + graceful-skip + splithttp) (2026-06-11)
+
+- USER asked: are hysteria2 + xhttp supported EVERYWHERE (url / subscription /
+  urltest / outbound_json)? Audit (explore) produced a full matrix. Key findings:
+  url == urltest == selector (all route through sing_box_cf_add_proxy_outbound —
+  identical support); vless/trojan/ss/hysteria2 + ws/grpc/xhttp covered on those +
+  uri-list subscription + outbound_json; xhttp gated on is_sing_box_extended.
+- OPERATOR CORRECTION (important): I initially concluded "hysteria2 can't be in
+  Xray JSON". WRONG. Real subscriptions (a private.json = 49-element ARRAY of Xray
+  configs, Hiddify/v2rayN-style) carry Hysteria2 as protocol:"hysteria" +
+  streamSettings.hysteriaSettings.{version:2,auth} + settings.address/port +
+  tlsSettings. ALWAYS check a real sample before declaring a protocol absent.
+- PRIVACY: private.json is local-only with real keys/servers. I extracted ONLY
+  structure (field names/types) + aggregate counts via python/jq, redacting all
+  values. Devs/tests used synthetic placeholders only. NEVER leak its values.
+- task-037 (APPROVED, smoke 155/0): added a hysteria branch to
+  xray_json_to_uri_lines — select protocol=="hysteria", gate
+  (hysteriaSettings.version // 0)==2 (v1/missing skipped, no fatal), peer from
+  settings.address/port (not vnext/servers), cred from hysteriaSettings.auth,
+  scheme hysteria->hysteria2, emit hysteria2://auth@host:port?sni&insecure&alpn&obfs
+  (NO type=), all via the existing safe()/kv() no-Oniguruma helpers. REUSED the
+  existing generic $conn dedup (no 2nd dedup/no sort) — collapses the heavy
+  real-world duplication. NO facade change needed (facade already parses
+  hysteria2:// and reads sni/insecure/alpn/obfs/obfs-password).
+- task-038 (APPROVED, smoke 155/0): (a) the `*)` default arm of
+  sing_box_cf_add_proxy_outbound was `log fatal; exit 1` — one unsupported link
+  (tuic/wireguard/etc.) in a url/selector/urltest input ABORTED THE WHOLE CONFIG.
+  Changed to `log warn; echo "$config"; return 1` (graceful skip). CONFIG-WIPE
+  SAFETY pattern (reused from task-033 lesson): every caller does `local _new` on
+  its own line + `if _new=$(...) && [ -n "$_new" ]; then config=$_new`; group
+  member tag added ONLY on success (no dangling urltest/selector member);
+  all-unsupported section -> mark_section_outbound_unavailable (append-only to
+  SUBSCRIPTION_UNAVAILABLE_SECTIONS) -> reject route rule. (b) splithttp (pre-rename
+  name of xhttp) now an alias in the facade transport builder AND
+  xray_json_to_uri_lines (network splithttp->xhttp, xhttpSettings // splithttpSettings,
+  emit type=xhttp; never a literal splithttp downstream). Fixed the false
+  facade comment claiming tuic/hysteria1/anytls/shadowtls were handled.
+- HARDWARE-DATA PROOF on the REAL private.json (in smoke container, aggregates
+  only): xray_json_to_uri_lines emits 363 URIs after dedup (from 3669 outbounds ~
+  10x collapse), of which hysteria2=19 (was 0 before — proves task-037 works on
+  real data), vless 339, trojan 5; type= distribution tcp 29 / ws 301 / grpc 10 /
+  xhttp 4; literal "splithttp" = 0 (normalization works). Facade on clean single
+  calls: vless+tcp -> NO transport (correct), vless+ws -> transport.type=ws.
+- HARNESS LANDMINE (don't repeat): driving sing_box_cf_add_proxy_outbound in a
+  loop over ALL 363 nodes into ONE reused `config`/section var gave a bogus
+  "all 363 transport=ws" + a sing-box-check FAIL — an ARTIFACT of reusing one
+  section/config across hundreds of heterogeneous nodes, NOT a code bug (proven by
+  the clean per-node check above). The REAL subscription path goes through
+  normalize_subscription_to_singbox + the batch builder, which the SHIPPED smoke
+  test (fb-caseO end-to-end + sing-box check, green) exercises correctly. Don't
+  hand-roll a 363-node-into-one-section e2e; trust the smoke harness for config
+  integrity, use the real path or per-node checks.
+- jq-in-shell-string landmines (recorded for backend): an apostrophe inside a jq
+  comment within `jq -er '...'` CLOSES the shell string (SC1073/etc + runtime
+  break) — keep jq comments apostrophe-free; `((` at a jq pipe-element start trips
+  shellcheck as arithmetic — split into single-paren `as` bindings.
+- STILL TODO before/with release: these (task-027..038) are all UNCOMMITTED in the
+  tree, stacked; operator commits manually. The 0.8.6 regressions (033/034) +
+  reload-hang (035/036) + protocol coverage (037/038) are all
+  APPROVED+gated+(033/034/035/036 hardware-verified). task-037/038 verified via
+  smoke 155/0 + real-private.json extraction; full-config sing-box check on the
+  real sub is covered by the shipped smoke (fb-caseO), not my hand harness.
+
+## task-039 + task-040: "Clear subscription cache" button in Diagnostics (2026-06-11)
+
+- USER: a Diagnostics-tab button that wipes ALL subscription caches and
+  re-downloads fresh ("частенько нужно"). OPERATOR DECISIONS: async
+  (component_action_async + poll, like core-switch/self-update); FULL reset
+  (delete all 4 per-feed files .json/.url/.rejected/.user_agent — the whole
+  SUBSCRIPTION_CACHE_FOLDER contents).
+- KEY REUSE: there is a GENERIC async component-action mechanism already —
+  `component_action()` router in updater.sh (case "$component:$action"),
+  `component_action_async <c> <a>` (forks worker, echoes job_id),
+  `component_action_status <job_id>` (JSON result). Adding a new long-running
+  async backend op = ONE case arm + ONE worker (echo {json}; return N, NEVER exit
+  — the fork at updater.sh:429-433 captures one JSON line then writes finished
+  state from $?). NO new async framework, NO ACL change (/usr/bin/netshift exec
+  already granted, not per-arg). Frontend reuses the existing
+  pollSingBoxComponentAction helper — no new poll loop.
+- task-039 (backend, APPROVED W/ COND→met, smoke 166/0): worker
+  subscription_clear_cache_and_redownload (bin/netshift, where subscription_update
+  + path builders + SUBSCRIPTION_CACHE_FOLDER are in scope) guard-deletes the cache
+  dir CONTENTS then runs subscription_update verbatim (redownload+restart-on-change).
+  RM-SAFETY (make-or-break): dual guard `[ -n "$SUBSCRIPTION_CACHE_FOLDER" ] && [ -d
+  ... ]` before `for f in "$DIR"/*; do [ -e ]||continue; rm -f "$f"`, never rm -rf
+  the dir, never a path where empty/unset constant → rm /*. Router arm
+  `subscription:clear_cache)` in updater.sh. Action string EXACTLY
+  subscription/clear_cache.
+- task-040 (frontend, APPROVED): "Clear subscription cache" button in the
+  Diagnostics Available-actions card; NetShiftShellMethods.clearSubscriptionCache
+  starts component_action_async subscription clear_cache + REUSES
+  pollSingBoxComponentAction; handleClearSubscriptionCache mirrors handleRestart
+  (loading→info toast→success/error toast→finally: fetchServicesInfo +
+  loading:false + store.reset(['diagnosticsChecks'])); rotate-ccw icon; store slice
+  in services/store.service.ts + diagnostic.store.ts; 4 new i18n msgids (en+ru),
+  fe↔luci byte-identical. main.js rebuilt idempotent, export block unchanged
+  (clearSubscriptionCache is a property, no barrel leak).
+- INTEGRATION VERIFIED: backend router arm ↔ frontend
+  ["component_action_async","subscription","clear_cache"] in built main.js match;
+  smoke all 166/0 (11 new cc-case all green); 472 vitest; no yarn pollution. All
+  UNCOMMITTED, stacked with tasks 027..038 — operator commits manually.
+
+## DIAGNOSED: self-update silently no-ops on opkg/ipk routers with a v-prefixed installed build (2026-06-11)
+
+- USER (main router ssh root@192.168.1.1, OWRT 24.10.5 mediatek/filogic aarch64,
+  OPKG/ipk, Xiaomi AX3000T): NetShift self-update from the web UI reports
+  "updated to 0.8.7" but the installed version stays v0.8.6. Logs show the whole
+  self_update worker succeeding ("installing netshift-0.8.7-r1-all.ipk" ...
+  "NetShift updated to 0.8.7").
+- ROOT CAUSE (empirically proven on the router): the installed build is the OLD
+  ipk that carried a leading `v` (constants `NETSHIFT_VERSION="v0.8.6"`, opkg
+  pkg version `v0.8.6-r1`). The new release is `0.8.7-r1` (no v, post task-028).
+  `opkg install <file.ipk>` REFUSES to "downgrade": it prints
+  `Not downgrading package ... from v0.8.6-r1 to 0.8.7-r1.` and RETURNS rc=0
+  (NOT an error for opkg). So updates_pkg_install_file (updater.sh:1410,
+  `opkg install "$f" >/dev/null 2>&1`) sees rc=0 -> the worker logs success and
+  emits {"success":true,...} while NOTHING was installed.
+- WHY opkg thinks it's a downgrade: `opkg compare-versions "v0.8.6-r1" ">>"
+  "0.8.7-r1"` => rc=0 (TRUE). The leading `v` sorts ABOVE the digit, so
+  v0.8.6 > 0.8.7 in opkg's dpkg-style compare. Without the v,
+  `0.8.6-r1 << 0.8.7-r1` => true (correct). This is the packaging.md §3 / task-028
+  fragility realized: routers still running a pre-028 v-build can never self-update
+  to a no-v release.
+- TWO distinct bugs to fix in updater.sh:
+  1. PRIMARY (silent success): `updates_pkg_install_file` swallows opkg's
+     "Not downgrading" no-op as rc=0. The install path never VERIFIES the
+     post-install version actually changed. FIX directions:
+     (a) opkg path add `--force-downgrade` (and/or `--force-reinstall`) so a
+         v->no-v transition actually installs; AND/OR
+     (b) post-install VERIFY: after install, re-read the installed pkg version
+         and compare to the target; if unchanged, treat as failure (honest JSON
+         {"success":false}) instead of reporting success. Verify-after-install is
+         the robust belt — opkg "already installed"/"not downgrading"/"up to date"
+         all return rc=0, so rc alone is NOT a reliable success signal on opkg.
+  2. CONTRIBUTING: the v-prefix legacy build. The compare in
+     _updates_self_update_netshift_core ALREADY v-strips both sides
+     (`${installed#v}` = `${latest#v}`, :1679) so it correctly decides "need
+     update"; the failure is purely at the opkg install step.
+- MANUAL FIX applied on the router (recovery, verified): downloaded all 3 ipks
+  from the latest release and `opkg install --force-downgrade <file>` each ->
+  netshift + luci-app-netshift now 0.8.7-r1, constants NETSHIFT_VERSION="0.8.7"
+  (no v), get_system_info netshift_version 0.8.7. Future 0.8.7->0.8.8 upgrades
+  will work normally (both sides no-v). Note: install drops
+  /etc/config/netshift-opkg conffile-diff artifact (harmless; rm'd).
+- apk SIDE NOTE (not the user's box but same helper): apk uses `-r` for release,
+  treats a dashed UPSTREAM version specially (task-034 landmine #A: equal-version
+  no-overwrite). The same verify-after-install belt would harden apk too. Whatever
+  fix is chosen must be tested on BOTH opkg and apk paths (packaging gate).
+- LANDMINE for the fix: `updates_pkg_install_file` redirects stdout+stderr to
+  /dev/null, so the "Not downgrading" message is invisible — never rely on opkg
+  text; rely on rc PLUS an explicit post-install version re-check. opkg
+  compare-versions is available on-device for a robust numeric compare if needed
+  (but the installer should not need the leading v at all once verify is added).
+
+## task-043 Xray subscription UA — versioned UAs (2026-06-11)
+
+- USER reported: with subscription_format_preference=xray, the panel returns 502
+  and NetShift falls back to singbox/<ver> (sing-box JSON WITHOUT xhttp/hysteria2
+  — the original task-031 complaint). PRIVACY: operator required NO
+  subscription-identifying data anywhere (no panel host/IP/URL/path/query/server/
+  keys) in code/tests/comments/memory — only generic client UA strings are safe.
+  Diagnosis lived in the ephemeral SSH session only; never committed.
+- ROOT CAUSE (reproduced on a live panel, abstractly): the Xray-probe constant
+  SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES was bare/version-less ("v2rayN Happ").
+  That panel UA-gates its Xray branch on a <client>/<version> shape: a BARE Happ
+  (and v2rayN in any form) → 502 Bad Gateway; a VERSIONED Happ/<x.y.z> → 200 with
+  the wanted Xray-JSON ARRAY (multi-profile). The download path/headers
+  (_wget_subscription_request, helpers.sh:803) are correct & unchanged — only the
+  UA VALUE decides 502-vs-200.
+- DIAGNOSIS METHOD (reusable, privacy-safe): on the router, replay the exact
+  request per UA with `curl -A "$UA" -H <same X-* headers netshift sends> -w
+  "HTTP %{http_code}"` to isolate UA-vs-headers; the headers were identical for
+  all UAs, so the UA alone is the variable. Sniff the 200 body's FORMAT (first
+  char `[`/`{`, jq top-keys) to confirm it's the Xray-JSON array
+  (dns,inbounds,log,outbounds,remarks,routing per element) — NOT to read values.
+  Clean up /tmp on the router after.
+- FIX (task-043, APPROVED W/ CONDITIONS, smoke 170/0): constants-only —
+  SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES -> versioned ("Happ/1.0.0 v2rayN/7.0.0
+  v2rayNG/1.9.0", versioned Happ FIRST). The xray-mode probe order in
+  build_subscription_user_agent_candidates (helpers.sh:765-771) front-loads these
+  before default+cached+whitelist, dedup whole-entry, so the working versioned
+  Happ wins first; non-working UAs just fall through. Coupled smoke
+  fb-caseI-xraypref-* updated to DERIVE expected first/second/third from the
+  constant (won't rot) + a generic guard that the first candidate contains "/"
+  (bare-UA regression catch). Operator REJECTED making it a UI option (overkill /
+  system-level) and rejected touching headers / auto-mode list.
+- DEDUP NOTE: versioned "Happ/1.0.0" is DISTINCT from the bare "Happ" still in the
+  main auto-mode SUBSCRIPTION_USER_AGENT_CANDIDATES whitelist, so neither is
+  dropped by the whole-entry dedup. The bare v2rayN/Happ in the MAIN list still
+  502 on this panel but are only reached AFTER the versioned UAs already win, so
+  no wasted probes in practice. Did NOT change the main list (broader/auto-mode).
+- The CONDITION (M1) is commit-hygiene only: keep the pre-existing unrelated
+  .opencode/agent/*.md churn (model rename + bash permission) OUT of the task-043
+  commit — not a code issue. Those were already in the tree at session start.
+
+## task-044/045 Universal subscription grouper (2026-06-12)
+
+- FEATURE: generalize the country-flag subscription grouper into modes
+  off/country/prefix. Operator wanted "group by first N chars of the remark, N
+  configurable, default 2"; chose Variant A (single mode dropdown off/country/
+  prefix + length, count by Unicode CODEPOINTS), full backend+frontend.
+- ARCHITECTURE SEAM (reusable insight): the urltest-per-group + main-selector
+  tree builder in bin/netshift `subscription)` branch is mode-agnostic — only the
+  KEY EXTRACTOR + the on/off decision needed generalizing.
+  `sing_box_build_subscription_country_groups` -> `sing_box_build_subscription_
+  groups <tags_json> <mode> <prefix_len>` returning {group_order,groups,ungrouped}.
+  prefix key = `(.|explode)|.[0:$n]|implode` (codepoint slice, Unicode-safe, no
+  Oniguruma). country path kept byte-identical (regional-indicator gate). N=2
+  over a flag tag == the flag, so country is a consistent special case.
+- LANDMINE CAUGHT IN REVIEW LOOP (architect spotted, not the dev): the inherited
+  group loop `for k in $(jq -r '.group_order[]')` WORD-SPLITS on IFS. Safe for
+  country flags (no spaces) but BREAKS prefix mode whose keys can contain spaces
+  (e.g. tag "A 1" prefix-2 -> key "A "). Fix: mktemp + `while IFS= read -r k ...
+  done < "$tmp"` in the CURRENT shell (NOT `cmd | while read` — that subshell
+  would lose the `config=`/`selector_outbounds_json=` mutations; same landmine
+  class as the smoke `cmd|while read` trap). Mirror the existing
+  `subscription_urls_tmp` mktemp+read<file pattern already in that branch. mktemp
+  failure must fatal+exit 1. ALWAYS audit reused loops when the key domain widens.
+- prefix_len hardening: jq side `try tonumber catch default | <1 -> default |
+  floor`; shell side `case '' | *[!0-9]* -> default ;; *) [ x -ge 1 ] 2>/dev/null`.
+  short tag (<N) keys by whole self (NOT ungrouped); empty tag -> ungrouped.
+- LEGACY MIGRATION done BACKEND-side (no JS migration): subscription_group_mode
+  present OUTRANKS legacy; absent -> read subscription_group_by_countries (then
+  alias group_by_countries) truthy->country else off. Frontend just writes the
+  new options. New constant SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN=2.
+- FRONTEND: form.Flag -> form.ListValue subscription_group_mode (off/country/
+  prefix) + form.Value subscription_group_prefix_len (datatype and(uinteger,
+  min(1)), depends subscription_group_mode:"prefix"); both taboption() in the
+  `subscription` tab (tabbed-CBI completeness). types.ts old key removed (no TS
+  reader). 7 i18n msgids + RU, fe<->luci byte-identical. main.js NO diff
+  (type-only change + hand-written view) — so the rendered tab needs a HUMAN
+  visual check (carried as APPROVED-WITH-CONDITIONS [M1]).
+- GATES: shellcheck error clean; smoke 170->174/0 (country regression kept +
+  prefix len-2/consistency/bad-len/space-key); whole-chain sing-box check PASS
+  for mode=prefix; yarn ci green (472 vitest), main.js no-diff. Both APPROVED
+  (045 with the human-eyeball condition). PRIVACY: synthetic tags only, full
+  diff privacy-scan clean. Subagents truncated their final messages TWICE this
+  session (frontend stopped before section.js; reviewer stopped mid-analysis) —
+  ALWAYS verify on-disk state + run/inspect gates yourself rather than trusting
+  a truncated "done".
+
+## task-046 gzip subscription bodies — issue #13 (2026-06-12)
+
+- ISSUE #13: a subscription panel sometimes returns a gzip-compressed body;
+  NetShift parsed the binary as text -> all nodes skipped -> "No subscription
+  User-Agent candidate produced valid outbounds". Reporter's workaround
+  gzip-decompressed only inside normalize_subscription_to_singbox — INSUFFICIENT
+  because validate_subscription_file runs BEFORE normalize and also chokes on a
+  gzipped sing-box JSON. Correct seam = DOWNLOAD path (decompress once, both
+  consumers see text).
+- DEVICE FACTS (verified, OWRT 24.10 + 25.12): gzip/gunzip/zcat present
+  (busybox); zstd/unzstd ABSENT (would need a new DEPENDS pkg). wget sends NO
+  Accept-Encoding and does NOT transparently decompress, so gzip = server
+  unconditionally compressing. gzip magic 1f 8b; `gzip -dc` on non-gzip rc=1.
+  NO od/hexdump/xxd on device.
+- OPERATOR DECISIONS: gzip ONLY (not zstd/deflate — separate future task if
+  panels actually send them); detect at download time; + NUL-byte guard (reject
+  still-binary body to next UA). Full backend+smoke.
+- FIX (task-046, APPROVED W/ CONDITIONS, smoke 174/0): two helpers.sh helpers
+  (modeled on convert_crlf_to_lf, mktemp+mv, all local, best-effort return 0):
+  * maybe_gunzip_subscription_file <f>: ATTEMPT-DECOMPRESS detector (NO od) —
+    `gzip -dc f > tmp` accept ONLY if rc=0 AND non-empty AND NUL-free, else leave
+    original byte-identical (plain text makes gzip -dc rc!=0 -> untouched, can
+    never corrupt text). This doubles as the gzip detector, avoids byte-fiddling.
+  * subscription_body_is_binary <f>: NUL detector via `wc -c < f` vs
+    `tr -d '\000' < f | wc -c` (counts differ -> NUL). Portable, no special grep
+    flag, no od.
+  Wired into download_subscription_into_cache per-UA while-read loop AFTER
+  download_subscription, BEFORE validate (netshift:585-594): gunzip then if
+  binary -> warn + continue to next UA (same control flow as a validation fail).
+  file_size/debug log MOVED to after decompress so size reflects decompressed
+  body. NO wget/Accept-Encoding change, NO Makefile DEPENDS change.
+- REUSABLE PATTERNS: file-transform helper = mktemp+transform+mv-on-success/
+  rm-on-fail (convert_crlf_to_lf is the template). NUL/binary detect without od =
+  wc-vs-tr-d-NUL byte-count. attempt-decompress is a clean od-free magic detector.
+- CONDITION (M1) is commit-hygiene only: keep the pre-existing unrelated
+  .opencode/agent/*.md churn (model rename + `bash "*": ask`->`allow`) OUT of the
+  commit; the permission loosening is a separate human decision.
+
+## task-047 false-"Outdated" — minified-JSON tag parse (2026-06-12)
+
+- ISSUE (user, AX3000T, OWRT 25.12.2 apk, NetShift 0.8.8): "check for updates"
+  always says Outdated; "update" -> error; reinstall via Putty doesn't help. OCR
+  of the UI showed the "latest version" as a URL
+  `https://api.github.com/repos/yandexru45/netshift/releases/<id>` instead of a
+  version number.
+- ROOT CAUSE (PROVEN by reproduction): updates_netshift_latest_tag
+  (updater.sh) parsed the tag with `grep '"tag_name":' | head -n1 |
+  cut -d'"' -f4`. That ONLY works on PRETTY-PRINTED JSON. GitHub API/CDN/proxies
+  often return MINIFIED JSON (whole object on one line) -> grep matches the
+  entire line, `cut -d'"' -f4` returns the FIRST key's value = the release
+  "url". So latest="<url>", `0.8.8 != <url>` -> false "outdated"; and the
+  self-update worker (same fn for $latest) logged "downloading NetShift <url>
+  release packages" then failed. Reinstall is useless: bug is in PARSING.
+  Repro: `printf '{"url":".../releases/338202209","id":...,"tag_name":"0.8.8",...}'
+  | grep '"tag_name":'|head -1|cut -d'"' -f4` => the url.
+- WHY ONLY THIS FN: sing-box-extended path already uses jq (.tag_name); asset
+  download uses `grep -o "https://...\.(ipk|apk)"` (newline-agnostic, robust);
+  install.sh only rate-limit-greps + asset grep -o. All unaffected. jq is a hard
+  dep used 23x in updater.sh.
+- FIX (task-047, APPROVED W/ CONDITIONS): replace the body with
+  `tag="$(printf '%s' "$response" | jq -r '.tag_name // empty' 2>/dev/null)";
+  [ -n "$tag" ] || return 1; printf '%s' "$tag"`. Format-independent; `.tag_name
+  // empty` -> empty on rate-limit/error object (callers already handle
+  "could not determine latest"). Fixes BOTH check_update and self-update (shared
+  fn). Callers untouched. No Oniguruma.
+- TEST (smoke `latesttag`, registered main all)+case+usage): stub the network
+  boundary `updates_http_get_once` (NOT the fn under test), run the REAL
+  updates_netshift_latest_tag. Cases: MINIFIED (exact bug shape, url before
+  tag_name) -> 0.8.8 not url (regression guard); pretty -> 0.8.8; rate-limit ->
+  empty+nonzero; e2e minified through updates_check_netshift -> status latest.
+  set -e rc capture via `&& printf 0 || printf %s "$?"`. Guard self-proven.
+- LESSON (reusable): NEVER field-position-parse JSON (`grep KEY|head|cut -d'"'
+  -fN`) — it silently breaks on minified responses by grabbing the first key's
+  value. Use jq (already a dep) for any tag/scalar extraction; reserve `grep -o
+  <url-regex>` for URL-list extraction (that IS newline-agnostic and fine).
+- WHOLE-CHAIN verified on the user's class of box earlier: get_system_info keeps
+  latest="unknown" (no net); check_update is the on-demand fetch; the diagnostic
+  row + manager card flag outdated when installed != latest, so a bad latest
+  poisons BOTH UI spots — fixing the parse fixes all consumers.
+- CONDITION [S1] is commit-hygiene: keep the pre-existing unrelated
+  .opencode/agent/*.md churn (model rename + `bash "*": ask`->`allow`) OUT of the
+  commit; the bash-permission widening is security-relevant and needs a separate
+  explicit human decision. (Recurring across tasks 043/046/047 — these 5 files
+  were already dirty at session start.)
+
+## task-048 scalar option subscription_url — sing-box won't start (2026-06-12)
+
+- ISSUE (Nick, Cudy WR3000E, OWRT 25.12.4, 0.8.9): urltest section works; switch
+  to subscription -> whole chain dead (sing-box not running, no nft table,
+  FakeIP 127.0.0.42:53 refused). Startup log: "Outbound section not found.
+  Aborted." despite config having a subscription_url.
+- DIAGNOSIS METHOD: user sent 2x3 diagnostic txt (global_check/show_sing_box_config/
+  view_logs) for working vs broken. The view_logs filenames were SWAPPED (the
+  tiny 435B file was the broken run, the big one was the working urltest run) —
+  read by CONTENT not filename. Broken view_logs: single "Outbound section not
+  found. Aborted." line. global_check(broken): proxy_config_type 'subscription'
+  with `option subscription_url '...'` (scalar, NOT list).
+- ROOT CAUSE (PROVEN on hardware): get_subscription_urls_for_section reads
+  subscription_url ONLY via config_list_foreach, which iterates ONLY UCI `list`
+  values and returns EMPTY for a scalar `option`. Proven: config_list_foreach
+  over option => []; config_get => the value; over list => works. The UI writes
+  `list` (form.DynamicList) so new configs are fine; legacy/CLI/podkop-migrated
+  configs use `option` and broke. Every subscription consumer funnels through
+  this ONE helper -> fixing it fixes the whole chain.
+- FIX (task-048, APPROVED round 2): (1) load-bearing read-fallback in
+  get_subscription_urls_for_section: if the list read is empty, config_get the
+  scalar and feed it through _collect_subscription_url_handler. (2) one-time
+  idempotent option->list migration at top of start_main (after config_load,
+  before check_requirements), only on the broken shape, never exits.
+- REVIEW LOOP (2 rounds, important): round 1 REQUIRES CHANGES — BLOCKER [B1]
+  data loss: the migration used `uci add_list "key=value"` which SPLITS ON THE
+  FIRST `=` and loses query-string URLs (?token=abc&x=1) — reproduced on hardware
+  (rc=1, list empty, scalar already deleted => URL gone on disk). Fix: use the
+  `uci_add_list <cfg> <sec> <opt> "<val>"` SHELL HELPER (separate-arg, preserves
+  =/&), delete-then-add with scalar RESTORE on add failure, flag gates the
+  commit. Plus [S1] the new test ran assertions on the RHS of a pipe (subshell
+  counter loss) so it didn't gate CI -> fixed to `while read < tmpfile`. Round 2
+  APPROVED.
+- LESSONS (reusable): (a) NEVER trust user-supplied filenames for which-is-which —
+  read by content. (b) `config_list_foreach` does NOT read scalar options; any
+  list-option reader needs a scalar config_get fallback for back-compat with
+  legacy/CLI/migrated configs. (c) `uci add_list "k=v"` CLI form is unsafe for
+  values containing `=` — use the uci_add_list shell helper. (d) a smoke test
+  that pipes into `while read; pass/fail` does NOT gate CI (subshell) — the count
+  jump (178->190) when fixed is the tell. (e) RE-check the dev's memory note on a
+  fix round — it's often pre-fix and re-seeds the anti-pattern.
+- PRIVACY: Nick's dump contained a real subscription URL; moved all 6 txt to
+  /tmp/opencode/nick-diag (out of git); code/tests/specs/memory use ONLY synthetic
+  https://example.com/sub. Final whole-tree sweep for the real host => clean.
+- GATES: shellcheck -S error clean; smoke `all` 178->190/0 (the +12 are the now-
+  gating suburlopt tokens incl. 4 =-URL guards); whole-chain verified (option
+  config -> has_outbound_section TRUE -> gen -> sing-box check). Runtime contract
+  intact (UCI schema = back-compat repr normalization only).
+
+## GitHub API rate-limit — research + task-049 (2026-06-12)
+
+- HOW IT WORKS (official docs, verified): anonymous api.github.com = 60 req/HOUR
+  per IP (authed=5000). On 403/429 the body is {"message":"API rate limit
+  exceeded for <IP>..."} and headers x-ratelimit-remaining:0 + x-ratelimit-reset
+  (UTC epoch). GET /rate_limit shows budget and does NOT cost primary quota.
+- WHY users hit it a lot: limit is PER IP. Routers behind CGNAT / shared ISP
+  IPs / shared-VPN egress share ONE IP's 60/hour with many strangers -> the
+  budget is often already drained by others. Not the user's fault; we're
+  anonymous so we can't raise it without a token.
+- KEY LEVER (PROVEN on hardware, curl): github.com/<repo>/releases/latest is
+  served by the github.com FRONTEND, NOT the rate-limited API. It 302-redirects
+  to /releases/tag/<tag>. `curl -sI -o /dev/null -w '%{redirect_url}'` returns
+  `.../releases/tag/0.8.9` -> tag extracted WITHOUT touching api.github.com.
+  And github.com/<repo>/releases/download/<tag>/<asset> 302s to the CDN
+  (release-assets.githubusercontent.com) -> direct asset download, no API.
+  (We already use this redirect path for SRS_MAIN_URL = releases/latest/download.)
+- BUSYBOX wget on-device is STRIPPED: no -S, no --max-redirect, can't read
+  Location/headers. So tag extraction MUST use curl (a hard DEPENDS: +curl),
+  via %{redirect_url} (or -w %{url_effective} with -L). updates_http_get_once
+  already prefers curl.
+- ASSET NAMING is deterministic from the tag: ipk = netshift-<ver>-r1-all.ipk,
+  luci-app-netshift-<ver>-r1-all.ipk, luci-i18n-netshift-ru-<ver>.ipk; apk =
+  netshift-<ver>-r1.apk, luci-app-netshift-<ver>-r1.apk,
+  luci-i18n-netshift-ru-<ver>.apk. (<ver> = tag.) All 302 on the direct path.
+- SCOPE DECISION (task-049): migrate the 3 NETSHIFT-repo touchpoints off
+  api.github.com -> redirect path: version check (updater.sh:1638
+  updates_netshift_latest_tag), self-update asset download
+  (updater.sh:1657 _updates_self_update_download_assets), and install.sh:259.
+  KEEP the sing-box-EXTENDED path (updater.sh:553 releases?per_page=30) on the
+  API + proxy-fallback: it genuinely needs the releases LIST (draft/prerelease
+  flags + per-arch asset selection) which a redirect can't give; it's also a
+  rarer, on-demand action. Proxy-fallback stays as the safety net there.
+- ALSO: honor x-ratelimit-reset / show honest "GitHub limit, retry after HH:MM"
+  instead of generic error; optionally TTL-cache the latest tag. (Secondary.)
+- itdoginfo's podkop historically had the SAME complaint class; this redirect
+  approach is the standard fix.
+
+## task-049 CLOSED — APPROVED (2026-06-12)
+- Implemented: redirect-first tag fetch (updates_github_resolve_redirect +
+  updates_netshift_latest_tag), deterministic asset-URL download
+  (updates_netshift_asset_filename + _updates_self_update_download_assets), and
+  install.sh redirect path (+ shared download_release_asset helper). API path
+  kept as graceful fallback everywhere; sing-box-extended path untouched.
+- Gates: shellcheck -S error clean; smoke 190->196/0 (+6 ghredirect, gating);
+  self-proved. Tag is rejected if empty/`/`-containing (injection/traversal
+  guard) and only used quoted in URL strings (no eval) — reviewed safe.
+- Review: 1 round, APPROVED. Only finding [M1] = a comment typo
+  (updates_http_get_once -> updates_download_to_file); fixed during review,
+  shellcheck re-clean, ghredirect re-run 6/0.
+- Net result for the user complaint: the normal version-check/self-update/install
+  path no longer touches the 60/hr-per-IP api.github.com, so CGNAT/shared-IP
+  rate-limit errors should largely disappear; API remains the fallback.
diff --git a/docs/agent-rules/memory/code-reviewer.md b/docs/agent-rules/memory/code-reviewer.md
new file mode 100644
index 00000000..7549d228
--- /dev/null
+++ b/docs/agent-rules/memory/code-reviewer.md
@@ -0,0 +1,75 @@
+# Memory — code-reviewer
+
+Reusable review findings and check focus for NetShift. Read before reviewing;
+append recurring findings; keep under ~200 lines.
+
+## What to check (in priority order)
+
+1. **Architecture / layer direction**: UI -> backend (via fs.exec of the two
+   allowed binaries) -> sing-box/nft/dnsmasq. No layer skips another. UI must
+   not reimplement backend logic; backend must not hardcode what belongs in
+   `constants.sh`.
+2. **Runtime contract intact**: ports/marks/paths (1602, 127.0.0.42:53, :9090,
+   198.18.0.0/15, marks 0x100000/0x200000, `NetShiftTable`, `105 netshift`)
+   unchanged unless the task explicitly says so and the WHOLE chain is updated.
+3. **Backend shell correctness**: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` echo-and-reassign threading; **no jq regex**
+   (test/match/sub/gsub) — flag any as CRITICAL; `fatal` log followed by
+   `exit 1`; atomic write + `sing-box check`; new constants in `constants.sh`.
+4. **Frontend correctness**: did they edit TS source (not `main.js` by hand)?
+   Did they rebuild so `main.js` matches (no stray diff)? New public API
+   re-exported up the barrel to `main.*`? Unused vars `_`-prefixed? `_()` around
+   new user-facing literals? No `any`?
+5. **Test coverage / gates**: backend config-gen or subscription changes should
+   add/extend a smoke test; new pure frontend logic should ship a vitest
+   `.test.js`. Confirm the relevant gate (shellcheck / smoke-tests / yarn ci)
+   was run.
+6. **Packaging**: respect the intentional ipk `v`-prefix vs apk-raw
+   inconsistency; don't break the underscore->dash rename; version placeholder
+   stamping intact.
+
+## Output
+
+- Write the review to `docs/tasks/<task-name>-review-001.md` using
+  `docs/tasks/TEMPLATE-review.md`.
+- Verdict vocabulary: `APPROVED` / `APPROVED WITH CONDITIONS` /
+  `REQUIRES CHANGES`. ID-tag issues (C1 critical, S1 significant, M1 minor) and
+  cite exact `file:line`.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+## Recurring findings to watch for
+
+- jq regex functions sneaking in (CRITICAL on OpenWRT jq).
+- `fatal` log without a following `exit 1`.
+- Hand-edited `main.js` or a `main.js` that doesn't match a fresh build.
+- New validator/helper not re-exported -> invisible to `main.*`.
+- Hardcoded ports/IPs/paths instead of `constants.sh` references.
+- Routing code that ignores `subscription_outbound_is_unavailable` (traffic
+  leak when a subscription is down).
+- Scope creep: unrelated file churn (e.g. lockfile churn) flagged as Minor.
+- Diagnostic strings in `usr/bin/netshift` are valid UTF-8 emoji/box-drawing —
+  must stay UTF-8, never CP1251 (task-004 fixed a double-encode). For
+  mojibake-repair reviews, prove ASCII-byte preservation byte-safely (Python:
+  decode HEAD blob vs working tree, strip `[^\x00-\x7F]` per line, expect 0
+  mismatched lines); beware PowerShell text pipelines which produce false UTF-16
+  diffs.
+
+- base64 share-link decode vs `sing_box_cf_add_proxy_outbound` `url_decode` (facade:65): the facade runs `url_decode` (+>space, %XX>byte) on the whole URL before the scheme case. Any case that base64-decodes the ENTIRE payload (vmess, future tuic/etc.) must use the RAW pre-url_decode link � standard base64 contains '+'. The ss) case escapes this only because it decodes a short method:password userinfo. Beware synthetic test keys that avoid '+' masking this (false green).
+
+- For protocol validators that base64-decode a whole body (vmess, future tuic/etc.): the '+'-regression is real only if the dispatcher preserves '+'. validateProxyUrl only .trim()s, so '+' survives at the boundary � a green direct-call '+' test is sufficient evidence; a dispatcher-level '+' assertion is the stronger guard.
+
+- Wrapper/core split for always-run cleanup (task-009 core-switch): verify the public wrapper captures core stdout to a temp file + rc, then UNCONDITIONALLY calls restore/cleanup before re-emitting JSON and return rc; confirm the worker runs without set -e (else a non-zero core rc could skip trailing cleanup) and that _*_core never exits. For never-end-core-less rollbacks, confirm the tmpfs backup happens BEFORE the package manager/extract touches the binary and is dropped ONLY on the confirmed-good path; strongest test deletes the live mock binary on simulated failure and asserts original bytes restored.
+
+- Frontend barrel exposure: anything added to src/helpers/index.ts (or any export* barrel reaching main.ts) AND actually used appears in the generated main.js baseclass.extend block as a main.* symbol; unused re-exports get tree-shaken. So internal-only helper + added to barrel + used = it WILL leak to main.*. To keep a helper truly internal, place it in the consuming module, not the barrel.
+
+- OpenWrt jq ascii_downcase only folds ASCII A-Z; case-insensitive matching on Cyrillic/Unicode names needs an inline codepoint fold (explode/map/implode: ASCII 65-90 +32, Cyrillic 1040-1071 +32, Yo 1025->1105). When reviewing such a fold: (a) already-lowercase ranges excluded (no double-fold), (b) def before first use when the program does NOT import helpers.jq, (c) a pure-emoji-keyword exact-match test proves non-folded codepoints pass through unchanged on both sides. (task-010)
+
+- Package-manager rc is NOT a reliable success signal on opkg: rc=0 for "Not downgrading"/"already installed"/"up to date". A self-update/install that trusts only rc silently no-ops (the v→no-v rename trap: legacy `v0.8.6` sorts ABOVE `0.8.7` in opkg's compare, so `opkg install` refuses the "downgrade" and returns 0). When reviewing a package-install path, require: (a) `--force-downgrade --force-reinstall` on the opkg branch (apk overwrites by default); AND (b) verify-after-install — RE-READ the installed version (opkg `list-installed | grep "^pkg "`, apk `list --installed`; grep/awk only, NO Oniguruma jq) and compare v-stripped semver (`${x#v}`, `${x%%-*}`) with `==` OR `is_min_package_version installed target`; empty-installed must fail-safe to success:false. Keep install.sh `pkg_install` and updater.sh `updates_pkg_install_file` opkg branches ALIGNED. (task-041/042)
+- Async self-update worker landmine: the `_*_core` worker MUST `return 1` (NEVER `exit`) on failure so the public wrapper's always-run `updates_restore_after_swap` epilogue + finished-job-state write still execute. Verify the wrapper captures core rc/JSON to a temp file then unconditionally restores. Smoke assertions for these must be in the MAIN shell body (direct `if…pass/fail`), never inside `cmd | while read` (subshell swallows PASS/FAIL — harness-wide landmine). (task-041)
+
+- UCI option→list rewrites: the `uci add_list "key=value"` CLI form splits on the FIRST `=` and SILENTLY LOSES query-string URLs (`?token=abc&x=1`) — reproduced on hardware (rc=1, list empty). Require the `uci_add_list <cfg> <sec> <opt> "<val>"` SHELL HELPER (separate-arg, preserves `=`/`&`). For delete-then-add rewrites, verify a failed add RESTORES the scalar AND that the change-flag gates the `uci commit` (an uncommitted in-memory delete must never persist). (task-048 [B1])
+- When RE-reviewing a fix round, also diff the developer's MEMORY note: it is frequently written against the PRE-fix code and re-seeds the very anti-pattern that was just fixed (task-048 [M2]: note still showed the `key=value` form + "non-gating piped-while" after both were fixed). Flag a stale memory note as a (minor) condition.
+- Test-gating landmine: a smoke test whose assertions run on the RHS of a pipe (`cmd | while read; pass/fail`) does NOT gate CI (subshell counter loss) — a FAIL token prints red but the suite exits 0. Require current-shell parsing (`while read < tmpfile`). The 178→190 count jump when task-048 fixed this is the tell. (task-048 [S1])
+
+- Rate-limit avoidance via redirect path (task-049): version-check/self-update/install can read the latest tag from `github.com/<repo>/releases/latest` (302 -> /releases/tag/<tag>, served by the github.com FRONTEND, NOT the 60/hr-per-IP api.github.com) instead of the API. Tag extracted with `curl -sI -o /dev/null -w '%{redirect_url}'` then `case`/param-expansion `${r##*/releases/tag/}` — when reviewing such code REQUIRE: (a) the tag is rejected if empty OR `/`-containing (path-traversal/injection guard) via `case "$tag" in ''|*/*) tag="" ;;`; (b) the tag is only used quoted inside a URL string / passed quoted to helpers, never `eval`'d or used as a bare filesystem path; (c) curl-absent / non-match degrades to the API fallback (no hard-fail/exit); (d) the file-download helper uses `curl -fsSL`/`-L` so the CDN 302 on `releases/download/<tag>/<asset>` is followed. busybox wget on-device is STRIPPED (no -S/--max-redirect/header read) so redirect reading MUST use curl (hard +curl dep). Keep the sing-box-EXTENDED releases-LIST path on the API (a redirect can't give draft/prerelease/per-arch).
diff --git a/docs/agent-rules/memory/luci-frontend-developer.md b/docs/agent-rules/memory/luci-frontend-developer.md
new file mode 100644
index 00000000..3547baa0
--- /dev/null
+++ b/docs/agent-rules/memory/luci-frontend-developer.md
@@ -0,0 +1,863 @@
+# Memory — luci-frontend-developer
+
+Durable frontend (TypeScript / LuCI) knowledge. Read before implementing;
+append findings; keep under ~200 lines.
+
+## The generated bundle (most important)
+
+- `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` is
+  **autogenerated by tsup** from `fe-app-netshift/src/**`. Banner: "This file is
+  autogenerated, please don't change manually." NEVER hand-edit it. Edit TS
+  source, then `yarn build`. CI fails if the committed `main.js` differs from a
+  fresh build (`git diff --exit-code` after build).
+- tsup `onSuccess` regex-patches the ESM `export { ... }` block into
+  `return baseclass.extend({ ... })` so LuCI can load it as a baseclass module.
+  An unusual export shape could break that regex.
+
+## Barrel / export reachability (recurring gotcha)
+
+- Hand-written views consume the bundle as `main.*` via
+  `'require view.netshift.main as main'`. A new public API
+  (validator/helper/constant/tab) reaches the views ONLY if it is re-exported
+  up the barrel chain to `src/main.ts`.
+- `validateHysteria2Url` (in `validateHysteriaUrl.ts`) is intentionally NOT in
+  `validators/index.ts` — only `validateProxyUrl` is exported; it dispatches to
+  the per-scheme validators internally. Mirror that pattern: export the
+  dispatcher, not necessarily every leaf.
+- Other helpers (prettyBytes, showToast, normalizeCompiledVersion, etc.) are
+  imported by direct path, not via barrel. Check before assuming barrel.
+
+## Backend access
+
+- Only `/usr/bin/netshift` and `/etc/init.d/netshift` are ACL-allowed for
+  `fs.exec` (acl.d/luci-app-netshift.json). A new shell command must be a
+  subcommand of one of those, else extend the ACL + backend. Plus Clash API on
+  `ws://<host>:9090` and `http://<host>:9090/ui`.
+
+## Style / CI
+
+- `yarn ci` = `format && lint --max-warnings=0 && test --run && build`.
+  No-diff enforcement (format + build) lives in `frontend-ci.yml` via
+  `git diff --exit-code`. Run the `frontend-ci` skill before handing back.
+- Prettier: 2-space, single quotes, semicolons, trailing-comma all, width 80.
+- ESLint: `@typescript-eslint/no-unused-vars` is a WARNING with `^_` ignore, and
+  CI is `--max-warnings=0` => unused vars MUST be `_`-prefixed (`_e`, `_err`).
+- strict TS, no `any`, functional components, named exports.
+- LuCI globals (E, fs, uci, ui, _) are in `src/luci.d.ts` (no import). E()
+  handlers use the `click:` attribute (not `onclick`) even though luci.d.ts only
+  declares `onclick` — follow the existing `click:` convention. Extend
+  `luci.d.ts` when you need a new LuCI global.
+
+## i18n
+
+- Wrap user-facing strings in `_()`, and only STRING LITERALS — the gettext
+  extractor (`yarn locales:actualize`) only sees literal args. Some validator
+  messages (vless/trojan) are currently NOT wrapped — wrap new ones.
+- i18n pipeline (`yarn locales:actualize` = extract-calls → generate-pot →
+  generate-po:ru → distribute). `extract-calls.js` scans BOTH `src/**/*.ts` AND
+  the hand-written `luci-app-netshift/.../view/netshift/**/*.js` (excludes
+  `main.js`), so `_()` strings added in `section.js` ARE extracted. Source of
+  truth for ru text is `fe-app-netshift/locales/netshift.ru.po` — fill the new
+  empty `msgstr` there (preserves existing translations on regen), then re-run
+  `yarn locales:distribute` to copy into the generated catalogs
+  `luci-app-netshift/po/{templates/netshift.pot, ru/netshift.po}`. Touched
+  catalog files: `locales/calls.json`, `locales/netshift.pot`,
+  `locales/netshift.ru.po`, `po/templates/netshift.pot`, `po/ru/netshift.po`.
+- TYPE-ONLY changes to `src/**` (e.g. adding interface fields in `types.ts`,
+  inside the `NetShift` namespace) erase at build → `main.js` has NO diff after
+  `yarn build`. Expect a clean `git diff` on `main.js` for pure-type edits.
+- `section.js` is a hand-written LuCI view, NOT bundled — `yarn format` only
+  touches `src/`, so format leaves section.js alone; keep its existing
+  2-space/double-quote style manually.
+
+## Version placeholder
+
+- `constants.ts` `NETSHIFT_LUCI_APP_VERSION='__COMPILED_VERSION_VARIABLE__'` is
+  substituted at OpenWRT build by `luci-app-netshift/Makefile` sed. In dev,
+  `normalizeCompiledVersion` turns anything containing `COMPILED` into `'dev'`.
+  Don't change the literal without updating the Makefile sed.
+
+## Tests
+
+- vitest `.test.js` files next to code under `tests/`, table-driven
+  `describe.each`, `_()` identity-mocked in `tests/setup/global-mocks.ts`, node
+  env (no DOM). New pure logic SHOULD ship a test. DOM/service/render code is
+  untested (no DOM mocks) — verify those by reasoning + build.
+- DO NOT import a `.test.js` from `methods/shell/index.ts` (or anything that
+  transitively imports the helpers barrel → `withTimeout` → `../netshift`
+  logger → `TabService` which calls `new MutationObserver` at module init).
+  In the node env that throws `MutationObserver is not defined` at COLLECT time
+  (suite fails with "no tests"). Fix: put pure/testable logic in its OWN module
+  that imports leaf helpers by DIRECT path (e.g. `../../../helpers/sleep`, NOT
+  the barrel), and import the test from that module. Done for task-008's
+  `pollSingBoxComponentAction.ts`.
+
+## Async core switch (task-008) — the rpcd 30s pattern
+
+- The core switch (sing-box install_extended/install_stable) must use the
+  ASYNC backend contract, not a single sync `component_action` exec — rpcd
+  kills any single fs.exec at 30s SERVER-SIDE regardless of the JS
+  `timeout:600000`. Pattern: `executeShellCommand(['component_action_async',
+  'sing_box', action])` → parse `{success,job_id,message}` → if no job_id,
+  fail fast → poll `['component_action_status', jobId]` in a loop every ~2s
+  with SHORT individual execs until `running !== true`; safety cap ~150 polls.
+  Each status call is tiny (ms) so never hits the wall.
+- Status contract fields (task-007/009): `{success,running,component,action,
+  message,pid,started_at,updated_at,exit_code,version,latest_version}`.
+  Map terminal → `{success, version, message}`.
+- `check_update` stays on the SYNC `component_action` path (fast, not subject
+  to 30s) — branch inside `singBoxComponentAction` on `action`.
+- Make the poll loop a PURE fn `pollSingBoxComponentAction(fetchStatus,
+  sleepFn=sleep, intervalMs, maxPolls)` with injected `fetchStatus`+`sleepFn`
+  so tests pass a no-op sleep (`() => Promise.resolve()`) and never wait 2s.
+  `sleep(ms)` lives in `helpers/sleep.ts` (Promise+setTimeout).
+- `showToast` type is only `'success' | 'error'` — for an in-progress info
+  toast just use `'success'` (don't widen the helper signature for it).
+- BARREL LEAK GOTCHA: adding `export * from './sleep'` to `helpers/index.ts`
+  made `sleep` appear as `main.sleep` in the generated baseclass.extend export
+  block (used barrel exports are NOT tree-shaken). For a truly INTERNAL helper,
+  do NOT put it in the barrel — place it next to its only consumer (e.g.
+  `methods/shell/sleep.ts`) and import by direct relative path. Verify after
+  build: `git diff main.js | grep '^\+\s\+[a-z]\+,$'` shows no new bare export
+  line. (task-008 M1.)
+- TESTING the REAL `singBoxComponentAction` despite the DOM/MutationObserver
+  collect crash: `vi.mock('<barrel path>', () => ({ executeShellCommand: ... }))`
+  short-circuits the `helpers`→`withTimeout`→`../netshift`→TabService chain so
+  the method module imports cleanly, THEN `const { X } = await import('../index')`.
+  CRITICAL: `vi.mock` factory paths are relative to the TEST file, and must
+  resolve to the SAME absolute module the SUT imports. From
+  `methods/shell/tests/`, the SUT's `../../../helpers` is `../../../../helpers`
+  from the test, and `./callBaseMethod` is `../../callBaseMethod`. Get these
+  wrong and the real (DOM-crashing) module loads → "MutationObserver is not
+  defined" at collect. (task-008 M2.)
+
+## Landmines
+
+- `runFakeIPCheck` allGood/atLeastOneGood logic looks inverted vs other checks —
+  don't "fix" without understanding intent.
+- Filename typo `checks/contstants.ts` is imported with the typo everywhere —
+  don't "correct" it and break imports.
+
+## Validator-test node globals (task-006)
+
+- `.test.js` files are linted as plain JS (typescript parser, no
+  `languageOptions.globals` in `eslint.config.js`), so bare `Buffer` / `btoa`
+  trips `no-undef` even though vitest runs in the node env at runtime. The
+  validator `.ts` files DON'T hit this (TS lib types cover `atob`). Fix in tests
+  WITHOUT editing eslint config: alias the node global via
+  `const NodeBuffer = globalThis.Buffer;` (`globalThis` is an allowed global) and
+  use `NodeBuffer.from(...).toString('base64')` for fixtures.
+- VMess `vmess://` is base64(JSON) (V2RayN), NOT user@host. `validateVmessUrl`
+  decodes with `atob` (right-pad to %4 with `=` for unpadded tolerance, matching
+  backend), JSON.parse, then narrows `Record<string, unknown>` for
+  `add`/`id`/`port`. It is dispatcher-only (NOT in `validators/index.ts`), exactly
+  like `validateHysteria2Url`. Craft a `+`-containing base64 fixture with a field
+  like `ps:'>>>'` (verified to force `+`).
+
+## Corepack yarn 4.x vs classic lockfile (task-006)
+
+- This repo's `yarn.lock` is v1 (classic) but corepack may activate yarn 4.16.0.
+  Running `yarn install` migrates the lockfile + creates `.yarn/`/`.yarnrc.yml`.
+  AVOID `yarn install`; node_modules is committed/present. Run CI steps via local
+  bins: `node_modules/.bin/{prettier --write src, eslint src --ext .ts,.tsx
+  --max-warnings=0, vitest run, tsup src/main.ts}`. Run locales via
+  `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`.
+  Before reporting: confirm `git diff --exit-code -- fe-app-netshift/yarn.lock`
+  and no `.yarn`/`.yarnrc.yml`.
+- `locales/calls.json` is committed WITH Windows backslash paths
+  (`src\\validators\\...`) — generating it on Windows does NOT churn separators.
+- The proxy-link help string `"vless://, ... links"` is duplicated 3× in
+  `section.js` (proxy_string + selector + urltest fields) — use edit replaceAll.
+
+## VMess `#fragment` strip (task-012)
+
+- `vmess://<base64(JSON)>#name` — the `#…` is the server display-name remark
+  (same as vless/ss/trojan), but for VMess the name also lives in JSON `ps`.
+  V2RayN base64 NEVER contains `#`, so cut at the FIRST `#` before decode.
+- `validateVmessUrl` order MATTERS: derive `body = url.slice('vmess://'.length)`
+  → `b64 = body.split('#')[0]` → THEN run the `/\s/` whitespace check on `b64`
+  (NOT the full url), THEN pad/`atob` `b64`. This lets a `#name with spaces`
+  fragment validate while still rejecting whitespace inside the base64 body.
+  (The old code ran `/\s/` on the full url and padded `body` incl. fragment →
+  emoji/Cyrillic in `#🇳🇱Ne` corrupted base64 → "malformed base64".)
+- Real-user regression fixture is the long `eyJ…In0=#🇳🇱Ne` literal in the test;
+  keep a malformed-base64 negative case WITHOUT a `#` (`vmess://@@@@`) so it
+  still fails for the right reason, and a `vmess://<b64> ` (trailing space, no
+  `#`) case proving base64-body whitespace is still rejected.
+- main.js diff for this fix is exactly the `validateVmessUrl` function body
+  (body/b64 split + whitespace-on-b64 + pad b64) — expected-only.
+
+## settings.js section-picker pattern + DNS-via-outbound (task-015)
+
+- `settings.js` is a HAND-WRITTEN LuCI view (NOT bundled by tsup → editing it
+  yields NO main.js diff). The reusable "pick a proxy/vpn section" dropdown
+  pattern: `form.ListValue` + `o.depends(<flag>,'1')` + `o.cfgvalue` reading
+  `uci.get('netshift',section_id,<opt>)` + custom `o.load` that walks
+  `this.map?.data?.state?.values?.netshift ?? {}`, pushes secName to
+  `this.keylist`/`this.vallist` when `sec['.type']==='section'` AND
+  `connection_type` is NOT `block`/`exclusion`, returns `Promise.resolve()`.
+  Mirrors `download_lists_via_proxy_section` (settings.js ~294-321).
+- `dns_outbound_section` uses `rmempty=true` (empty = backend falls back to
+  first outbound) — intentionally differs from the download-proxy clone's
+  `rmempty=false`. Don't "normalize" it.
+- R3 trap: the spec called the diagnostic field "type-only ⇒ no main.js diff",
+  but adding the field to `types.ts` is type-only (erased at build) WHILE the
+  paired `runDnsCheck.ts` `insertIf` render IS RUNTIME CODE → it DOES produce a
+  legit main.js diff (the 10-line insertIf block). That regenerated main.js is
+  the deliverable; a second build is idempotent (no further diff). "No diff"
+  only holds if you skip the runDnsCheck.ts edit.
+- locales: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn → no corepack). New ru text goes in the
+  SOURCE `locales/netshift.ru.po` empty `msgstr`, then `distribute-locales.js`
+  copies to `po/ru/netshift.po` + `po/templates/netshift.pot`. Regen touches
+  calls.json/pot broadly (line-ref reshuffle + POT-Creation-Date header) but is
+  PURELY ADDITIVE — verified at msgid level: 5 added, 0 removed.
+- ENCODING TRAP (Windows/PS5.1): `git show HEAD:file > tmp` re-encodes the blob
+  to UTF-16 and MANGLES UTF-8 (emoji/Cyrillic) — gives FALSE "removed/added"
+  noise. Use `cmd /c "git ... > %TEMP%\f"` (preserves raw bytes) OR compare via
+  `git diff` directly. The committed .pot/.po ARE valid UTF-8; don't panic.
+- Console prints po/pot Cyrillic as mojibake — that's PS display only; verify
+  on-disk via `node -e "require('./locales/calls.json')...includes(...)"` or
+  UTF-8 byte reads, not the terminal.
+- New i18n keys (task-015) + ru: "Route main DNS through proxy/VPN"→"Основной
+  DNS через прокси/VPN"; "DNS outbound section"→"Секция outbound для DNS";
+  "Main DNS via outbound"→"Основной DNS через outbound"; long descriptions
+  translated equivalently.
+
+## validateIPV6 rewrite + concat-_() i18n (task-015 PR#11 fixes)
+
+- The OLD `validateIPV6` (two loose regexes + `colons>=2&&<=7` guard) WRONGLY
+  accepted `:::`, `1:2:::3`, `1::2::3` (multiple `::`), `1:2:3:4:5:6:7`
+  (incomplete 7-group). Replaced with a small functional checker (no `any`):
+  count `::` via `stripped.split('::').length-1` (reject >1); split into
+  head/tail, `countGroups(side)` splits on `:` and validates each as
+  `/^[0-9a-fA-F]{1,4}$/` hextet; group-count rule = exactly 8 when no `::`,
+  ≤7 when one `::` (it stands for ≥1 zero group). `''` side → 0 groups (so `::`
+  unspecified and `::1` work). Helpers `isHextet`/`countGroups`/`isEmbeddedIPv4`
+  are module-private (NOT in barrel) → no `main.*` export leak; verified diff
+  has no new bare export lines.
+- F-04 DECISION: ACCEPT IPv4-embedded IPv6 (`::ffff:192.168.1.1`,
+  `2001:db8::192.168.1.1`) — valid per RFC 4291. `countGroups` treats a LAST
+  group containing `.` as an embedded IPv4 (validated via `validateIPV4`) that
+  occupies TWO 16-bit groups (so it adds +1 to the group count). Tested both
+  positive and the malformed negatives.
+- main.js diff for this is EXACTLY the validateIPV6 function body + 3 private
+  helpers (52+/7- lines); second build idempotent. Expected runtime-code diff.
+- I18N CONCAT GOTCHA (F-02): `_('foo ' + 'bar')` is NOT extracted (gettext sees
+  only literal args; the `+` makes it an expression). The established repo
+  convention (see section.js community_lists ~415) is
+  `_('foo') + ' ' + _('bar')` — the SPACE lives OUTSIDE `_()`, and each literal
+  has NO trailing/leading space. `extract-calls.js` line 55 does `arg.value.trim()`
+  so a trailing space INSIDE `_('foo ')` is trimmed in the catalog → runtime
+  lookup of `'foo '` MISSES. So ALWAYS put separators outside `_()`. Fixed
+  global_proxy (section.js ~310), block_doh + enable_ipv6 (settings.js ~463/481).
+- locales regen: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn). `generate-pot.js` calls
+  `git config user.name`/`user.email` and CRASHES if unset → set them locally
+  (`git config --local user.name "..."`, email may be empty string which returns
+  rc=0). POT header churns (POT-Creation-Date timezone + `<>` from empty email)
+  — cosmetic, accepted; msgid-level diff was PURELY ADDITIVE (10 added, 0
+  removed). 10 new ru msgstrs filled in SOURCE locales/netshift.ru.po then
+  distributed to po/ru + po/templates (both end up byte-identical to source).
+- The 10 new ru fragments are the split sentences of the 3 flag descriptions
+  (global proxy / block DoH / enable IPv6) — translated formally/technically
+  matching neighbours. All catalogs LF, no empty non-header msgstr remained.
+
+## Component Manager tab (task-018)
+
+- NEW TAB = 5-file pattern mirroring `tabs/diagnostic`: `manager/{index,render,
+  initController,styles}.ts` + a hand-written `view/netshift/manager.js`
+  (`form.DummyValue _mount_node`, `o.rawhtml=true`, `cfgvalue` →
+  `main.ManagerTab.initController()` + `return main.ManagerTab.render()`).
+  Register in `netshift.js`: add `"require view.netshift.manager as manager"`
+  + a `form.TypedSection` block (`anonymous=true`, `addremove=false`,
+  `cfgsections=()=>["manager"]`). NB the tab UCI section name (`manager`,
+  `diagnostic`, `dashboard`) need NOT exist in `/etc/config/netshift` — LuCI
+  renders the virtual TypedSection anyway (diagnostic/dashboard prove it).
+- Barrel: add `export * from './manager';` to `tabs/index.ts` → `ManagerTab`
+  reaches `main.ManagerTab` (verified in the export block at the bottom of
+  main.js). Wire `ManagerTab.styles` into `src/styles.ts` `GlobalStyles` next to
+  Dashboard/Diagnostic. Styles use theme vars WITH fallbacks; CBI selector is
+  `#cbi-netshift-manager-_mount_node > div` + hide `#cbi-netshift-manager > h3`.
+- LIFECYCLE: mirror diagnostic exactly but guard re-init with module-level
+  `*Registered`/`*Initialized`/`*Mounted` booleans since the
+  lazy-mount listener can fire repeatedly. `onMount('manager-status')` →
+  `registerLifecycleListeners()` (subscribe on `tabService.current==='manager'`)
+  → `onPageMount` subscribes store + renders + fetches systemInfo;
+  `onPageUnmount` resets `['managerActions','managerChecks']`.
+- INSTALLED-NOW / LATEST-ON-DEMAND: installed versions come from
+  `diagnosticsSystemInfo` (reuse the diagnostic `getSystemInfo()`→store slice);
+  latest is fetched ONLY on a "Check update" click. Pure card builder
+  `cards.ts:getComponentCards(systemInfo, checks)` + `getCheckTag(status)` +
+  `isSingBoxInstalled` are DOM/store-free (import only `normalizeCompiledVersion`
+  leaf + `NetShift` types) → unit-testable WITHOUT the MutationObserver collect
+  crash. Controller maps descriptors→DOM+click handlers. 3 cards: netshift,
+  sing_box_stock, sing_box_extended; inactive core → "Not installed" + switch.
+- BACKEND CONTRACT (task-017, STABLE): both SING-BOX checks (`check_update`
+  extended / `check_update_stable` stock) return `{success,current_version,
+  latest_version,status:"latest"|"outdated"|"dev"|"not_installed"}`. The
+  PRE-EXISTING `singBoxComponentAction('check_update')` only parsed `{success,
+  version,message}` (DROPPED status/latest) — do NOT route the manager check
+  through it. Added ONE `singBoxCheckUpdate(action)` method parsing the FULL
+  contract via a pure `parseComponentCheckUpdate.ts` (types-only import, status
+  whitelisted). Install/switch reuse the existing async
+  `singBoxComponentAction('install_*')` + `pollSingBoxComponentAction`.
+- C1 (review fix) — THERE IS NO `netshift:check_update` BACKEND ACTION. NetShift
+  latest comes ONLY from `get_system_info.netshift_latest_version`. So the
+  NetShift card's "Check update" must NOT route through `singBoxCheckUpdate` (that
+  would run the sing-box EXTENDED check and write its status into
+  `managerChecks.netshift` → wrong). Fix: give the NetShift check a DISTINCT
+  `kind:'check_netshift'` (no `backendAction`) so `handleManagerAction` routes it
+  to `runNetshiftCheck`, which RE-FETCHES systemInfo + `resetCheckResult
+  ('netshift')` and derives the badge/toast from installed-vs-latest. NetShift
+  status is derived PURELY from systemInfo (`netshiftStatus(systemInfo)` no longer
+  reads `managerChecks.netshift`). Regression guards in cards.test.js: NetShift
+  action kind is `check_netshift`, has NO `backendAction`, and status ignores a
+  bogus `managerChecks.netshift`. LESSON: when a card's "latest" comes from a
+  DIFFERENT source than its siblings, give it its own action kind so the shared
+  dispatcher can't misroute it to the wrong backend method.
+- S1 (review fix) — keep ONE check method per concern: removed the dead
+  `singBoxCheckUpdateStable()` (0 callers; controller uses
+  `singBoxCheckUpdate('check_update_stable')`). No dead exports.
+- M2 (review fix) — `ManagerComponentKey` defined ONCE in `tabs/manager/cards.ts`
+  (the pure module) and `export type`-re-exported from `store.service.ts` (which
+  `import type`s it) so store consumers keep their path; safe because cards.ts
+  imports NO store (no cycle). M1 (self-update timeout reusing 'Core switch
+  timed out' wording) left as-is — non-blocking, and the shared
+  `pollSingBoxComponentAction` wording is approved for the core-switch path.
+- SELF-UPDATE lenient polling: `netshiftSelfUpdate()` starts
+  `component_action_async netshift self_update`; once a `job_id` is returned, the
+  poll `fetchStatus` callback SWALLOWS exec/parse errors and returns a synthetic
+  `{running:true}` (instead of `null`, which the pure poll treats as terminal
+  failure). This prevents the mid-job `/usr/bin/netshift` binary swap from
+  misreporting success as failure; `MAX_POLLS` still bounds it. On success: a
+  warning-style toast then `window.location.reload()` after 1200ms.
+- MOVED core-switch OUT of Diagnostics: removed `handleInstallSingBox` +
+  `singBoxInstall`/`singBoxExtended` from `diagnostic/initController.ts` and the
+  `singBoxInstall` block + props from `renderAvailableActions.ts`, and the
+  `singBoxInstall` slice from BOTH `StoreType` and `diagnostic.store.ts`. Net
+  i18n effect: msgids "Install stable"/"Install extended" were DROPPED (now-dead)
+  and replaced by manager's "Switch to stable"/"Switch to extended"/"Install %s"
+  — so the ru.po diff is NOT purely additive this time (2 removed, ~16 added);
+  that is correct. `renderRotateCcwIcon24` stays imported (still used by Restart).
+- i18n: 16 new ru msgstrs filled in SOURCE `locales/netshift.ru.po`, then
+  `node distribute-locales.js`. "%s" placeholder strings ("Install %s") are
+  single literals (no concat); progress/result toasts concatenate the version
+  OUTSIDE `_()` (`` `${_('NetShift updated, version:')} ${v}` ``). Ran the
+  locales scripts via `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js`. yarn here was classic 1.22.22 (NOT corepack) so
+  `yarn ci` was safe — verified yarn.lock unchanged + no `.yarn/.yarnrc.yml`.
+- main.js: +756/-… runtime diff (new tab + methods + core-switch removal),
+  second build idempotent (byte-identical), banner + `return baseclass.extend`
+  intact, only `ManagerTab` added to the export block (pure helpers imported by
+  direct path → no leak). `tsc --noEmit` flags ONE pre-existing error in
+  `getNetshiftVersionRow.test.ts` (sing_box_extended optionality) — NOT in CI
+  (yarn ci = format/lint/vitest/build, no tsc), pre-existing, ignore.
+
+## Drop stale nft "mangle output counters" check (task-020b)
+
+- Backend 020a removed `rules_mangle_output_counters` from `check_nft` JSON
+  (router-output traffic is intentionally DIRECT now → that chain's counter is
+  legitimately 0, so the non-zero assertion was a FALSE positive). New STABLE
+  7-key shape: `{table_exist, rules_mangle_exist, rules_mangle_counters,
+  rules_mangle_output_exist, rules_proxy_exist, rules_proxy_counters,
+  rules_other_mark_exist}` — `rules_mangle_output_exist` KEPT.
+- FE removal touched exactly 2 source files: `runNftCheck.ts` (drop the field
+  from the allGood `&&` chain, the atLeastOneGood `||` chain, and its `items[]`
+  row — keep the "Rules mangle output exist" row) + `types.ts`
+  `NftRulesCheckResult` (drop `rules_mangle_output_counters: 0 | 1;`).
+- main.js: runtime diff is the removed Boolean()s + the dropped items[] row;
+  second build BYTE-IDENTICAL (idempotent), banner + `return baseclass.extend`
+  intact; `grep -c rules_mangle_output_counters main.js` == 0.
+- locales: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn → no corepack). The unused
+  `_('Rules mangle output counters')` msgid dropped cleanly from ALL 5 catalogs
+  (calls.json, locales/netshift.{pot,ru.po}, po/{templates/netshift.pot,
+  ru/netshift.po}). msgid-level delta = PURELY a removal (1 removed, 0 added);
+  "Rules mangle output exist" stays. generate-po reported 325/323 (2 stale
+  translations retained in source ru.po — harmless, additive-preserving).
+- yarn was classic 1.22.22 → `yarn ci` safe; verified `git diff --exit-code --
+  yarn.lock` clean and NO `.yarn`/`.yarnrc.yml`. No vitest referenced the field.
+
+## validateUrl accepts IP host + subscription_insecure checkbox (task-021a)
+
+- `validateUrl.ts` REWRITE: old regex required an ALPHA TLD so an IPv4/IPv6 host
+  was rejected ("Invalid URL format"). New approach mirrors `validateSocksUrl`:
+  keep the protocol check (default `['http:','https:']`), then a pure
+  module-private `extractHost(url)` strips `scheme://` (indexOf '://'), the
+  `/path?query#frag` (`rest.search(/[/?#]/)` — first of `/ ? #`), optional
+  `userinfo@` (`lastIndexOf('@')`), and the `:port`. BRACKETED IPv6:
+  if `rest.startsWith('[')`, return the substring between `[` and the first `]`
+  (so `[2001:db8::1]:2096` → `2001:db8::1`); else strip trailing `:port` via
+  `lastIndexOf(':')`. Then accept if `validateIPV4(host).valid ||
+  validateIPV6(host).valid || validateDomain(host).valid`. Kept the 3 existing
+  messages verbatim (`Invalid URL format`, the protocol message, `Valid`).
+- NB `validateIPV6` ALREADY unwraps brackets internally (`.replace(/^\[/,'')`),
+  but extractHost must unwrap anyway so the `:port` after `]` is dropped before
+  the validator sees it. `extractHost` is NOT barrel-exported (module-private) →
+  no `main.*` leak; main.js diff is +30/-4 (the helper + the host-check), second
+  build BYTE-IDENTICAL, banner + `return baseclass.extend({` intact.
+- This single fix covers ALL FOUR callers (subscription_url, urltest_testing_url,
+  remote_domain_lists, remote_subnet_lists) — callers unchanged.
+- TESTS: `validateDomain` accepts a trailing path (`example.com/path` regex has
+  `(?:\/[^\s]*)?$`), so existing domain-with-path valid cases still pass through
+  the domain branch. Added valid: `https://91.199.111.52:2096/sub/abc`,
+  `http://10.0.0.1/x`, `https://[2001:db8::1]:2096/sub`. Added invalid:
+  `https://999.1.1.1/x` (bad IPv4 → not domain either), `ftp://1.2.3.4` (protocol
+  fails first), `https://` (extractHost → '' → "Invalid URL format"). Kept
+  `https://google` invalid (no TLD, not an IP).
+- section.js (HAND-WRITTEN, NOT bundled → 0 in main.js): added `form.Flag`
+  `subscription_insecure` right AFTER subscription_url (~line 113), default `"0"`,
+  `rmempty=false`, `depends({connection_type:'proxy',proxy_config_type:
+  'subscription'})` exactly like its siblings (no `subscription_user_agent` exists
+  here despite the spec mention). Multi-sentence description = three `_()` calls
+  joined with `+ " " +` OUTSIDE `_()` (F-02 rule). UCI contract option name
+  `subscription_insecure` (0|1) consumed by backend 021b.
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`
+  (NOT yarn). 4 new msgids (1 label + 3 description sentences), PURELY additive
+  (4 added, 0 removed at msgid level). Filled RU in SOURCE `locales/netshift.ru.po`
+  then distributed → po/ru + po/templates byte-identical to source. Only the PO
+  HEADER msgstr stays empty (`grep -nB1 'msgstr ""'` shows just line 6/7).
+- yarn classic 1.22.22 → `yarn ci` green (format/lint --max-warnings=0/471 tests/
+  build); verified yarn.lock unchanged + NO `.yarn`/`.yarnrc.yml`. The
+  `netshift/files/**` + `tests/**` changes in git status are 021b (other agent),
+  not mine.
+
+## subscription_url → form.DynamicList (multi-URL) (task-023)
+
+- Converted `subscription_url` from `form.Value` to `form.DynamicList` in
+  section.js (~88-111), modelled EXACTLY on `remote_domain_lists` (:721-742):
+  same per-row validate (`!value||value.length===0 → true`, else
+  `main.validateUrl(value)`), `rmempty=true` (was `false`; the empty-row guard
+  already short-circuited so emptiness was never enforced; backend keeps the
+  "no URL" guard). Kept option name `subscription_url`, depends
+  `{connection_type:'proxy',proxy_config_type:'subscription'}`, placeholder
+  `https://example.com/api/sub`. Title → plural `_("Subscription URLs")`;
+  description → single literal `_("Add one or more subscription URLs to fetch
+  proxy configurations from. All feeds are downloaded and merged.")`.
+- types.ts:120 `subscription_url: string` → `string[]` (kept required, matches
+  sibling list fields `selector_proxy_links`/`urltest_proxy_links`).
+- PURE TYPE-ONLY CHANGE: nothing in the FE reads `subscription_url` back (verified
+  repo-wide) → `tsup` build produced ZERO main.js diff (confirmed via
+  `git diff --exit-code main.js`). This is correct, NOT a missed rebuild. Still
+  ran the build to confirm. (Same lesson as the type-only note in i18n section.)
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`
+  (NOT yarn → no corepack). msgid delta = clean SWAP: removed "Subscription URL"
+  + "Enter the subscription URL...provider"; added "Subscription URLs" + the new
+  merged-feeds description. Filled 2 ru msgstr in SOURCE locales/netshift.ru.po
+  ("URL подписок" / "Добавьте один или несколько URL подписок...объединяются.")
+  then distribute → po/ru + po/templates byte-identical to source (verified via
+  diff). Only header msgstr empty (line 7). 5 catalog files touched: calls.json,
+  locales/netshift.{pot,ru.po}, po/{templates/netshift.pot,ru/netshift.po}.
+- yarn classic 1.22.22 again but ran inner gate via node_modules/.bin
+  (prettier/eslint/vitest/tsup) to be safe; yarn.lock unchanged, no .yarn/.yarnrc.
+
+## UI design-system foundation: .card + tokens + toasts (task-024)
+
+- DESIGN TOKENS (STABLE — task-025/026 reference these; do NOT rename) defined
+  in `src/styles.ts` `GlobalStyles` on `:root, .cbi-map`:
+  `--ns-card-border` (var(--background-color-low, lightgray)),
+  `--ns-card-border-width` (2px), `--ns-card-radius` (4px), `--ns-gap` (10px),
+  `--ns-card-padding` (var(--ns-gap)), `--ns-success`/`--ns-warning`/`--ns-error`/
+  `--ns-info` (layered over success/warn/error-color-medium + primary-color-high
+  with hex fallbacks #28a745/#f0ad4e/#dc3545/#2196f3).
+- `.card` primitive = `border: var(--ns-card-border-width) solid
+  var(--ns-card-border); border-radius: var(--ns-card-radius); padding:
+  var(--ns-card-padding); min-width:0`. Mirrors Manager's component card EXACTLY
+  (2px/4px/10px/min-width:0) — that's the standardised look, NOT the 1px/8px from
+  the spec's illustrative example.
+- CASCADE RULE: `.card` MUST be defined in GlobalStyles BEFORE the
+  `${DashboardTab.styles}${DiagnosticTab.styles}${ManagerTab.styles}`
+  interpolations. The per-tab colored-border MODIFIERS (`.pdk_diagnostic_alert
+  --warning/--error/--loading/--success`, `__wiki--warning/--error`, outbound-grid
+  `--active`/`--selectable:hover`) are same-specificity single-class rules that
+  win ONLY via source order. Since injectGlobalStyles emits ONE `<style>` with
+  GlobalStyles, and the template renders tokens+`.card` first THEN the interpolated
+  tab CSS, the modifiers correctly override `.card`'s neutral border. (File
+  byte-offset of `.card` in main.js is LATER than the modifiers because
+  `DashboardTab.styles` is a separate `var stylesN` module — but runtime template
+  concatenation order is what matters, and that's correct.)
+- REFACTOR PATTERN: removed the duplicated `border/border-radius/padding` (and
+  manager's `min-width:0`) from the per-tab `styles.ts`, added `class:'card …'` in
+  the RENDER `.ts`. Card boxes touched (more than the spec's "4" — there were
+  these render sites): dashboard renderWidget (3 states), renderSections
+  (failed/loading/default outbound-section + outbound-grid item), diagnostic
+  renderWikiDisclaimer (className array — prepend 'card'), renderAvailableActions,
+  renderSystemInfo, renderCheckSection (all 5 alert states incl. `--skipped` which
+  has NO modifier so it relies on `.card`), manager initController component.
+  `.card` adds `min-width:0` to dashboard/diagnostic boxes (was absent) — harmless
+  overflow hardening, visually identical.
+- showToast union widened to `'success'|'error'|'warning'|'info'`
+  (showToast.ts:3). Added `.toast-warning`(--ns-warning) + `.toast-info`(--ns-info)
+  CSS; converted existing `.toast-success/.toast-error` to `var(--ns-success/error,
+  #hex)` (themeable, same fallback hex → visually identical). The
+  PREVIOUS memory note "showToast type is only success|error — use 'success' for
+  in-progress" is now SUPERSEDED: use `'info'` for in-progress, `'warning'` for
+  long/destructive-ish. Converted the 2 abuse sites in manager/initController.ts I
+  was already in: "Switching sing-box core…"→'info', "Updating NetShift…page will
+  reload"→'warning'. DEFERRED (not in touched files / debatable): manager line
+  ~155 "Latest version is unknown" still 'success' (check-result, not in-progress);
+  diagnostic/initController.ts had only 'error' toasts (nothing to fix).
+- RAW BUTTON KILLED: dashboard renderSections.ts "Test latency" raw
+  `<button class="btn">` → `renderButton({text:_('Test latency'), onClick:
+  ()=>testLatency(), classNames:['dashboard-sections-grid-item-test-latency']})`.
+  renderButton already adds `btn`, so only the custom class goes in classNames.
+- IMPORT-ORDER MAIN.JS CHURN (IMPORTANT): adding `import {renderButton} from
+  '../../../../partials'` into the DASHBOARD subtree (which previously never
+  imported the global `src/partials` barrel) makes esbuild REORDER ~every bundled
+  module block → a huge SYMMETRIC main.js diff (~1600/1600 lines) that is PURELY
+  cosmetic module reordering. Verified safe: build is IDEMPOTENT (same md5 twice),
+  banner intact, `return baseclass.extend({` intact, and the export-symbol SET is
+  BYTE-IDENTICAL to HEAD (diff /tmp/exports_old vs new = empty) → no barrel leak,
+  no new public API. Direct-path import (`…/partials/button/renderButton`) barely
+  reduced churn — the reorder is inherent to introducing the cross-subtree dep, so
+  I kept the barrel import for consistency with the 3 diagnostic callers. When a
+  reviewer sees a giant main.js diff for a tiny TS change, CHECK export-set
+  equality + idempotency before worrying.
+- TAB REORDER: netshift.js (hand-written, edit directly) — moved the Dashboard
+  `form.TypedSection` block to FIRST. New order: Dashboard · Sections · Settings ·
+  Component Manager · Diagnostics. ONLY block order changed; all 5 sections + their
+  cfgsections/anonymous/addremove wiring identical. coreService/TabService track by
+  `data-tab` (the active section name e.g. `current==='dashboard'`), NOT
+  registration index (tab.service.ts getActiveTabId reads `.cbi-tab:not(
+  .cbi-tab-disabled)` dataset.tab; dashboard initController keys on
+  `tabService.current==='dashboard'`) → reorder is SAFE, tracking unaffected.
+- VISUAL VERIFY caveat: no chromium available in this env (playwright launch
+  failed: chrome not found), so screenshots were NOT possible. Verified instead by
+  CSS-cascade reasoning + programmatic checks: `.card` precedes modifiers in the
+  runtime-concatenated GlobalStyles, no `background-color-low` base border remains
+  in any per-tab styles.ts (all neutral borders now come from `.card`), colored
+  modifiers keep their 2px width matching `.card`. FLAG: visual confirmation is
+  reasoned, not screenshotted.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --write src clean
+  / eslint --max-warnings=0 / vitest 471 pass / tsup build). yarn.lock unchanged,
+  no `.yarn`/`.yarnrc.yml`. No locales change (no NEW user-facing literals — the
+  switching/updating toast strings already existed).
+
+## task-025 — section.js → 4 native CBI tabs (taboption)
+
+- CBI native tabs: `section.tab('name', _('Title'), _('descr'))` defines a tab,
+  then EVERY field MUST be `section.taboption('name', form.X, 'key', ...)`. HARD
+  RULE confirmed: once a section has `.tab()`, any leftover `section.option(...)`
+  silently renders nothing. Verified count: 36 taboption, 0 plain option (the
+  only `section.option(` grep hit was my own comment line).
+- Conversion is mechanical & low-risk: only the constructor call line changes
+  (`section.option(\n  form.X,` → `section.taboption(\n  "tab",\n  form.X,`).
+  All `.depends()` (33), `.validate` (17), `.value()`, defaults, placeholders,
+  and the `community_lists.onchange` (REGIONAL_OPTIONS/ALLOWED_WITH_RUSSIA_INSIDE
+  /DOMAIN_LIST_OPTIONS/getUIElement) stayed byte-identical. depends() works
+  across tabs; an all-depends-hidden tab auto-hides from the strip (Subscription
+  tab hides for proxy/url) — desired, no extra code.
+- `widgets.DeviceSelect` (`interface`) works fine inside a taboption — just pass
+  the widget class as the 2nd arg after the tab name.
+- Tab map (4 tabs, 36 fields): connection=11, subscription=10, routing=12,
+  advanced=3.
+- SMART-LIST UNIFICATION: did the LOW-RISK visual grouping (NOT a single-widget
+  merge). Kept all 4 UCI keys + 2 *_list_type selectors. Achieved "one control"
+  feel by renaming the two list-type selector TITLES to group headings
+  ("Custom domains"/"Custom subnets") with descriptions naming the modes;
+  depends() already shows only the chosen input below. Deeper merge deferred
+  (would risk UCI/validator changes). NOTE: renaming a selector title drops its
+  old msgid from catalogs — fill the new ones.
+- RU-HARDCODE FIX: `subscription_group_by_countries` had `_("Группировать по
+  странам")` as the SOURCE literal (msgid). Replaced with English `_("Group by
+  countries")` + English descr; moved the Russian into the ru.po msgstr. After
+  this the Cyrillic appears ONLY as msgstr, never as msgid.
+- section.js is NOT in the `yarn ci` prettier scope (CI formats only `src`).
+  section.js uses DOUBLE QUOTES (LuCI convention) and does NOT pass the project
+  `.prettierrc` (singleQuote) — confirmed the ORIGINAL also failed prettier.
+  So: match the file's existing double-quote/2-space style; do NOT run prettier
+  on section.js (it would fight the whole file).
+- i18n flow: `node extract-calls.js && node generate-pot.js && node
+  generate-po.js ru && node distribute-locales.js`. generate-po keys by msgid &
+  carries forward old msgstr; NEW/renamed msgids land empty → fill them in
+  fe-app-netshift/locales/netshift.ru.po, then RE-RUN distribute-locales.js to
+  copy into luci-app-netshift/po/{ru/netshift.po, templates/netshift.pot}.
+  Verify byte-consistency with `diff -q` (both fe↔luci pairs). 13 new strings
+  this task; all ru filled; 0 empty msgstr after.
+- main.js drift rule confirmed: section.js-only + catalog changes need NO main.js
+  rebuild. I touched styles.ts so rebuilt — the ONLY main.js delta vs the
+  task-024 baseline was my new CSS block (#cbi-netshift-section
+  .cbi-section-node-tabbed card + ul.cbi-tabmenu margin). Build reproducible.
+- styles.ts: reused task-024 --ns-* tokens; added `#cbi-netshift-section
+  .cbi-section-node-tabbed` (card border/radius/padding) + `ul.cbi-tabmenu`
+  margin. Existing h3-hide (`> h3:nth-child(1)`) and remove-button hack
+  (`> .cbi-section-remove { margin-bottom:-32px }`) left intact (new rules added
+  after them; both still valid — remove button is a direct child, unaffected by
+  the tabbed pane styling).
+- VISUAL VERIFY caveat persists: no browser in env. Confirmed structurally
+  (taboption count/mapping, depends/validate counts == original, onchange grep
+  intact, catalog diff). FLAG for human: actual tab-strip/card rendering +
+  auto-hide behaviour of the Subscription/Advanced tabs not screenshot-verified.
+
+## task-026 — settings.js → 5 native CBI tabs (taboption)
+
+- Same mechanics as task-025. Converted ALL 27 settings options to
+  `section.taboption('tab', form.X, 'key', …)`. Verified: 27 taboption, 0 plain
+  `section.option(` (the 1 grep hit is my comment line). Tab map (5 tabs, 27):
+  dns(6)=dns_type,dns_server,bootstrap_dns_server,dns_via_outbound,
+  dns_outbound_section,dns_rewrite_ttl · network(6)=source_network_interfaces,
+  enable_output_network_interface,output_network_interface,
+  enable_badwan_interface_monitoring,badwan_monitored_interfaces,
+  badwan_reload_delay · lists(4)=update_interval,download_lists_via_proxy,
+  download_lists_via_proxy_section,routing_excluded_ips · yacd(3)=enable_yacd,
+  enable_yacd_wan_access,yacd_secret_key · advanced(8)=disable_quic,
+  dont_touch_dhcp,exclude_ntp,block_doh,enable_ipv6,config_path,cache_path,
+  log_level.
+- YACD DECISION: kept as its OWN tab (3 fields), NOT folded into Advanced.
+  Rationale: self-contained feature w/ clean depends() chain
+  (enable_yacd→wan_access→secret_key); folding into an 11-field Advanced would
+  recreate the wall. Tab title is `_("Dashboard")` (already-existing msgid),
+  internal tab name "yacd". Documented.
+- All 7 depends() preserved verbatim (only line order changed — irrelevant):
+  dns_outbound_section dep dns_via_outbound=1; output_network_interface dep
+  enable_output_network_interface=1; badwan_monitored_interfaces +
+  badwan_reload_delay dep enable_badwan_interface_monitoring=1;
+  enable_yacd_wan_access dep enable_yacd=1; yacd_secret_key dep
+  enable_yacd_wan_access=1; download_lists_via_proxy_section dep
+  download_lists_via_proxy=1. 6 validators + 3 custom widgets (2 DeviceSelect,
+  1 NetworkSelect) intact; cfgvalue/load section-picker closures unchanged.
+- HELP TRIM: block_doh was a 4-paragraph `_()+ " " +_()…` concat. Replaced with
+  ONE single-literal description "Block direct connections to known public DoH
+  servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot
+  bypass router DNS filtering." The caveat ("enable only after switching to
+  UDP/DoT") moved into the ADVANCED tab description (section.tab 3rd arg).
+  enable_ipv6's 2-sentence concat LEFT inline (short, the 2nd sentence is a
+  genuine 1-line caveat; not bloating) — documented choice.
+- BACKTICK TRAP IN styles.ts: GlobalStyles is a template literal. Putting a
+  backtick inside a CSS COMMENT (e.g. `#cbi-... > h3`) prematurely closes the
+  template → ESLint "Parsing error: ',' expected". NEVER use backticks anywhere
+  inside the styles.ts CSS string, even in comments. (Cost me one lint cycle.)
+- styles.ts: added `#cbi-netshift-settings .cbi-section-node-tabbed` (card
+  border/radius/padding/min-width:0) + `#cbi-netshift-settings ul.cbi-tabmenu`
+  (margin-bottom:var(--ns-gap)) — exact mirror of the task-025 section block,
+  reusing task-024 --ns-* tokens (did NOT redefine tokens). The existing
+  `#cbi-netshift-settings > h3 { display:none }` rule stays valid (added new
+  rules after it). main.js delta = exactly these 2 CSS rules; build IDEMPOTENT
+  (md5 a7300a2… across 3 builds), banner + `return baseclass.extend` intact,
+  no new export symbol (only-loss vs HEAD is task-024's `styles` leak removal,
+  not mine).
+- i18n: msgid delta = 9 added (tab titles "DNS"/"Network"/"Lists & Updates" —
+  "Dashboard"+"Advanced" already existed; 4 tab descriptions; 1 reworded
+  block_doh) / 4 removed (old block_doh fragments). Filled 9 ru msgstr in SOURCE
+  locales/netshift.ru.po then `node distribute-locales.js`. fe↔luci ru.po AND
+  pot byte-identical (diff -q); all LF; valid UTF-8 w/ Cyrillic; 0 empty
+  non-header msgstr. Ran scripts via `node {extract-calls,generate-pot,
+  generate-po ru,distribute-locales}.js` (generate-po reported 335/339 but 9
+  were genuinely new — its count metric differs).
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier/eslint/vitest/
+   tsup). yarn.lock unchanged, no .yarn/.yarnrc.yml. NB: working tree already
+   carried UNCOMMITTED task-024 + task-025 changes (showToast, dashboard/diag/
+   manager styles+renders, section.js, netshift.js, #cbi-netshift-section CSS) —
+   so `git diff -- src` is large but only my settings block + the 4 catalogs +
+   main.js belong to task-026. format reported all-unchanged → no new churn.
+
+## task-030 — NetShift update check ON-DEMAND (retires C1's systemInfo-refresh)
+
+- REVERSES task-018's C1 decision. task-029 (backend, APPROVED) ADDED a real
+  `component_action netshift check_update` action returning the STANDARD check
+  JSON `{success,current_version,latest_version,status}` (v-normalized
+  server-side, SAME shape as the sing-box cores) AND removed the latest-fetch
+  from `get_system_info` (now returns `netshift_latest_version:"unknown"`). So
+  the NetShift card is now a TRUE peer of the cores: on-demand check writes
+  `managerChecks.netshift`, mount does NO network check.
+- SHELL METHOD: added `netshiftCheckUpdate()` to `methods/shell/index.ts` —
+  copy of `singBoxCheckUpdate` but args `['component_action','netshift',
+  'check_update']`, parsed by the EXISTING `parseComponentCheckUpdate`, returns
+  `NetShift.ComponentCheckUpdateResult`. SYNC path (fast call), timeout 600000.
+  It's a PROPERTY on `NetShiftShellMethods` (not a top-level export) → NO new
+  symbol in the baseclass.extend export block (verified byte-identical to HEAD).
+- runNetshiftCheck (manager/initController.ts): now MIRRORS runSingBoxCheck
+  exactly — call `netshiftCheckUpdate()`, `if(!parsed.success)` error toast +
+  return, `status=parsed.status??null`, `setCheckResult('netshift',status,
+  parsed.latest_version||'')`, `showToast(getCheckToastMessage(status),
+  'success')`, catch→error toast, finally→reset loading. STOPPED calling
+  `fetchSystemInfo()`+`resetCheckResult` as the "check".
+- cards.ts: `netshiftStatus(systemInfo, check)` now RETURNS `check.status`
+  (the on-demand result; null until checked → neutral). KEPT the dev guard
+  (`normalizeCompiledVersion(...)==='dev' → null`). REMOVED the
+  `installed===latest` string compare AND the systemInfo.netshift_latest_version
+  dependency. `netshiftCard` takes the check too; "Install %s" `latest` now
+  comes from `check.latest_version`. `getComponentCards` passes `checks.netshift`
+  to `netshiftCard`. The `check_netshift` kind NOW carries
+  `backendAction:'check_update'` (still a DISTINCT kind so the dispatcher routes
+  it to runNetshiftCheck, never to the sing-box check method).
+- DIAGNOSTIC: NO code change needed. `getNetshiftVersionRow.ts` already treats
+  `netshift_latest_version === 'unknown'` (and `'loading'`) as
+  `!hasActualVersion` → returns the plain neutral row (no Outdated/Latest tag).
+  Since task-029 makes the backend return "unknown", the row auto-degrades to
+  neutral. Mount's `fetchSystemInfo()` is now network-free (backend change), so
+  diagnostic entry triggers no GitHub call. Existing
+  getNetshiftVersionRow.test.ts (passes real versions) stays green unchanged.
+- TESTS: rewrote the 5 NetShift cases in manager/tests/cards.test.js to derive
+  from `managerChecks.netshift` instead of systemInfo: null-status→neutral+
+  check_update; check 'outdated'→self_update + Install <check.latest_version>;
+  'latest'→Latest badge; dev-build stays neutral even with a check 'outdated';
+  systemInfo latest mismatch is IGNORED. 472 tests pass (cards 19).
+- LOCALES: removing the `runNetshiftCheck` body ORPHANED `_('Latest version is
+  unknown')` (no longer referenced anywhere). Ran `node {extract-calls,
+  generate-pot,generate-po ru,distribute-locales}.js`. msgid delta = PURELY the
+  1 removed msgid (calls.json/pot/ru.po) + `#:` line-ref reshuffle + POT header
+  date. fe↔luci pairs byte-identical (diff -q). No new strings added (all toasts
+  reused existing msgids). generate-po reported 340/338 (2 stale retained).
+- main.js: +36/-26 runtime diff = exactly (new method block + netshiftStatus/
+  Card signature change + runNetshiftCheck rewrite). IDEMPOTENT (md5
+  9ce13d2… across 2 builds), banner + `return baseclass.extend({` intact,
+  export block byte-identical to HEAD. yarn classic 1.22.22; ran via
+  node_modules/.bin; yarn.lock unchanged, no .yarn/.yarnrc.yml.
+- FLAG (no browser in env): the neutral→checked card transition + toast were
+  verified by reasoning + the pure cards.test.js, NOT screenshotted.
+
+## task-032 — subscription_format_preference dropdown (Subscription tab)
+
+- Added a `form.ListValue` `subscription_format_preference` in section.js
+  (HAND-WRITTEN, NOT bundled) right AFTER `subscription_url` (~144-157),
+  modelled EXACTLY on `subscription_update_interval`: `.value('auto',_('Auto'))`
+  / `.value('xray',_('Xray JSON (Happ)'))` / `.value('singbox',_('Sing-box'))`,
+  `o.default='auto'`, same `depends({connection_type:'proxy',proxy_config_type:
+  'subscription'})`. NO explicit `rmempty` — like the interval field, LuCI
+  ListValue defaults `rmempty=true`, so selecting the default ('auto') does NOT
+  write a spurious UCI value (matches backend task-031 which treats empty/
+  unknown as auto). Single-literal `_()` description (no concat).
+- types.ts: added optional union `subscription_format_preference?: 'auto' |
+  'xray' | 'singbox';` to `ConfigProxySubscriptionSection` (after
+  subscription_url). Pure type-only → erased at build.
+- BACKEND CONTRACT (task-031, in working tree): UCI option name EXACTLY
+  `subscription_format_preference`, values auto/xray/singbox; netshift bin reads
+  it (`uci -q get …subscription_format_preference`, empty→auto). Confirmed via
+  grep before editing.
+- main.js: NO diff (section.js hand-written + type-only types.ts), like
+  task-023. Build still run to confirm; `git diff --stat main.js` empty.
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-
+  locales}.js`. msgid delta PURELY ADDITIVE — 4 added (Auto / Subscription
+  format / Xray JSON (Happ) / the description), 0 removed; "Sing-box" REUSED an
+  existing msgid (so generate-po reported 339/342, only 3 truly-new beyond the
+  reused one). Filled 4 ru msgstr in SOURCE locales/netshift.ru.po (Auto→Авто,
+  Subscription format→Формат подписки, Xray JSON (Happ)→Xray JSON (Happ),
+  description translated) then distribute → po/ru + po/templates byte-identical
+  to source (diff -q). Only header msgstr empty. 5 catalog files touched.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --write src /
+  eslint src --ext .ts,.tsx --max-warnings=0 / vitest 472 pass / tsup). format
+  diff on src = ONLY my 1 types.ts line (no churn). yarn.lock unchanged, no
+  .yarn/.yarnrc.yml. FLAG (no browser): dropdown rendering/auto-hide not
+  screenshotted — verified structurally.
+
+## task-040 — "Clear subscription cache" button in Diagnostics (async)
+
+- BACKEND CONTRACT (task-039, APPROVED): `component_action subscription
+  clear_cache` deletes all subscription caches + redownloads (restarts service
+  on change), driven via the EXISTING async job machinery
+  `component_action_async subscription clear_cache` → `{success,job_id,message}`,
+  poll `component_action_status <job>`. ACL already allows `/usr/bin/netshift`
+  exec — NO ACL change. Action strings are EXACTLY component='subscription',
+  action='clear_cache'.
+- SHELL METHOD: added `clearSubscriptionCache()` to `methods/shell/index.ts` as
+  a COPY of `netshiftSelfUpdate`'s start-then-poll shape BUT with the STRICT
+  (non-lenient) poll callback used by `singBoxComponentAction` install path
+  (return `null` on empty stdout — no binary swap here, so a parse/exec failure
+  IS terminal). args `['component_action_async','subscription','clear_cache']`,
+  REUSES the component-agnostic `pollSingBoxComponentAction` (NO new poll loop).
+  Returns `SingBoxComponentActionResult {success,version?,message?}`. It's a
+  PROPERTY on `NetShiftShellMethods` → NO new top-level export symbol (the
+  baseclass.extend export block is byte-identical to HEAD). NO new
+  `AvailableMethods` enum entry needed — the existing async actions pass
+  `'component_action_async'`/`'component_action_status'` + the component/action
+  as RAW string-literal args (not enum members), so I mirrored that exactly.
+- HANDLER: `handleClearSubscriptionCache` in diagnostic/initController.ts mirrors
+  `handleRestart`'s service-mutation idiom + globalCheck's toast idiom: set
+  `clearSubscriptionCache.loading=true` → `showToast(_('Clearing subscription
+  cache and re-downloading… this may take a minute'),'info')` → await the async
+  method → success→`showToast(...,'success')` else logger.error+error toast →
+  catch→logger.error+error toast → finally→`await fetchServicesInfo()` +
+  loading=false + `store.reset(['diagnosticsChecks'])`. NB: did NOT use
+  handleRestart's `setTimeout(...,5000)` — the async method ALREADY polls to
+  completion (service restart finished by the time it resolves), so refresh
+  immediately in finally. Wired into `renderDiagnosticAvailableActionsWidget`
+  (visible:true, disabled:atLeastOneServiceCommandLoading).
+- BUTTON: added `clearSubscriptionCache: ActionProps` to renderAvailableActions.ts
+  + an `insertIf(visible,[renderButton(...)])` block using `renderRotateCcwIcon24`
+  (already imported for Restart — rotate/refresh fits "clear+redownload"; the
+  icon set has NO trash icon). Label `_('Clear subscription cache')`. No custom
+  classNames (neutral btn, like globalCheck/viewLogs/showSingBoxConfig).
+- STORE: added `clearSubscriptionCache: { loading: boolean }` to
+  `diagnosticsActions` in store.service.ts type AND
+  `clearSubscriptionCache: { loading: false }` to initialDiagnosticStore in
+  diagnostic.store.ts (after showSingBoxConfig in both).
+- i18n: 4 NEW msgids (PURELY additive): 'Clear subscription cache', 'Clearing
+  subscription cache and re-downloading… this may take a minute', 'Failed to
+  clear subscription cache' (used in BOTH the shell method fallback + handler →
+  same msgid), 'Subscription cache cleared and re-downloaded'. NB the ellipsis is
+  a real `…` char (U+2026), not three dots — kept literal-consistent fe↔ru. Ran
+  `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js` (NOT
+  yarn). generate-po reported 343/346 (its count metric undercounts; there were
+  4 truly-new empty msgstr + the header). Filled ru in SOURCE
+  locales/netshift.ru.po (Очистить кеш подписок / Очистка кеша подписок и
+  повторная загрузка… это может занять минуту / Не удалось очистить кеш подписок
+  / Кеш подписок очищен и загружен заново), re-ran distribute → po/ru +
+  po/templates byte-identical to source (diff -q). Only header msgstr empty.
+- main.js: REAL +98/-1 runtime diff (new method block + handler + button +
+  widget wiring). IDEMPOTENT (md5 aa89dfc… across 2 builds), banner +
+  `return baseclass.extend({` intact, top-level export block byte-identical to
+  HEAD (no barrel leak — clearSubscriptionCache is a NetShiftShellMethods
+  property). Confirmed action args in main.js are exactly
+  `["component_action_async","subscription","clear_cache"]` + poll via
+  `component_action_status`.
+- NO new test: reused existing `pollSingBoxComponentAction` (already
+  table-tested); the method+handler is wiring (DOM/store untestable in node
+  env). vitest 472 pass unchanged.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --check src
+  clean / eslint src --ext .ts,.tsx --max-warnings=0 / vitest 472 / tsup).
+  yarn.lock unchanged, no .yarn/.yarnrc.yml. Working tree also carried UNRELATED
+  task-039 backend changes (netshift bin, updater.sh, tests/entrypoint.sh) +
+  .opencode/agent edits — NOT mine. FLAG (no browser): button render + toast
+  sequence verified by reasoning + the gate, NOT screenshotted.
+
+## task-045 — universal subscription grouper (mode dropdown + prefix length)
+
+- REPLACED the single `subscription_group_by_countries` form.Flag (section.js
+  ~190-201) with TWO taboptions in the SAME `subscription` tab (mandatory —
+  tabbed section, a plain option() renders nothing):
+  (1) `form.ListValue subscription_group_mode` — values off/country/prefix
+  (`_("Off")`/`_("By country flag")`/`_("By name prefix")`), `o.default="off"`,
+  `o.rmempty=false`, depends `{connection_type:"proxy",proxy_config_type:
+  "subscription"}`; title `_("Subscription grouping")` + single-literal help.
+  (2) `form.Value subscription_group_prefix_len` — title `_("Prefix length")`,
+  `o.default="2"`, `o.datatype="and(uinteger,min(1))"`, `o.rmempty=false`,
+  depends ADDS `subscription_group_mode:"prefix"` (3-key object) so it shows
+  ONLY when mode=prefix. CBI cross-field depends within the same section/tab
+  works fine; a fully-hidden field is OK.
+- CROSS-LAYER CONTRACT (task-044 backend, DONE): UCI options EXACTLY
+  `subscription_group_mode` ∈ {off,country,prefix} default off, and
+  `subscription_group_prefix_len` positive-int string default 2 (meaningful
+  only when mode=prefix). Backend falls back to the LEGACY
+  `subscription_group_by_countries` boolean ONLY when the new option is ABSENT
+  → the UI writes only the NEW options; NO JS migration written.
+- types.ts: swapped `subscription_group_by_countries?: '0'|'1'` →
+  `subscription_group_mode?: 'off'|'country'|'prefix'` +
+  `subscription_group_prefix_len?: string`. Grepped src first — NOTHING in TS
+  reads the old key (only the type decl), so removing it is safe (backend reads
+  the legacy UCI key directly, not via UI). Pure type-only → erased at build.
+- main.js: ZERO diff (section.js hand-written + not bundled; types.ts type-only).
+  md5 unchanged across the build (aa89dfc5…). Confirmed via
+  `git diff --exit-code main.js`. This is the EXPECTED/correct outcome — a diff
+  there would mean an unexpected src change.
+- i18n: ran `node {extract-calls,generate-pot,generate-po ru,distribute-
+  locales}.js` (yarn classic 1.22.22, but used node to avoid corepack). msgid
+  delta = clean SWAP: removed 2 (`Group by countries` + its long description),
+  added 7 (Off / By country flag / By name prefix / Subscription grouping /
+  Prefix length / the grouping description / the prefix-length description).
+  Filled 7 RU msgstr in SOURCE locales/netshift.ru.po then re-ran distribute →
+  po/ru + po/templates byte-identical to source (diff -q both pairs). 0 empty
+  non-header msgstr after. RU: Off→Выключено, By country flag→По флагу страны,
+  By name prefix→По префиксу имени, Subscription grouping→Группировка подписки,
+  Prefix length→Длина префикса.
+- yarn ci GREEN: format no-diff, eslint --max-warnings=0, vitest 472 pass, tsup
+  build. yarn.lock unchanged, no .yarn/.yarnrc.yml. No new vitest (no new pure
+  TS logic — datatype validation is LuCI client-side).
+- PRIVACY: no subscription-identifying data (hosts/IPs/URLs/keys/node names) in
+  any code/comment/i18n/test/memory — generic "proxy name"/"country flag"
+  wording only.
+- FLAG (no browser in env): the rendered Subscription tab (dropdown +
+  conditional prefix-length field appearing only on mode=prefix, taboption
+  auto-hide) needs a HUMAN VISUAL CHECK before merge — verified structurally
+  only (taboption completeness, depends preserved).
diff --git a/docs/agent-rules/memory/packaging-ci-engineer.md b/docs/agent-rules/memory/packaging-ci-engineer.md
new file mode 100644
index 00000000..1953962e
--- /dev/null
+++ b/docs/agent-rules/memory/packaging-ci-engineer.md
@@ -0,0 +1,116 @@
+# Memory — packaging-ci-engineer
+
+Durable packaging / CI / release knowledge. Read before working; append
+findings; keep under ~200 lines.
+
+## Packages
+
+- `netshift` (backend) and `luci-app-netshift` (UI; also yields
+  `luci-i18n-netshift-ru` via `LUCI_LANGUAGES=en ru`). Both `PKGARCH=all`.
+- `netshift/Makefile`: DEPENDS `+sing-box +curl +jq +kmod-nft-tproxy
+  +coreutils-base64 +bind-dig`; CONFLICTS `https-dns-proxy nextdns
+  luci-app-passwall luci-app-passwall2`; version
+  `PKG_VERSION = $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(date +%d%m%Y))`;
+  `prerm` removes `105 netshift` from `/etc/iproute2/rt_tables` and stops the
+  service; conffile `/etc/config/netshift`; stamps
+  `__COMPILED_VERSION_VARIABLE__` into `constants.sh` via sed (NO `|| true`, so a
+  missing file fails the build).
+- `luci-app-netshift/Makefile`: uses `luci.mk`, `LUCI_DEPENDS=+luci-base
+  +netshift`; stamps the same placeholder into `main.js` (WITH `|| true`, so a
+  missing main.js silently won't stamp). Asymmetric on purpose — note it.
+
+## Docker build images
+
+- `Dockerfile-ipk` FROM `itdoginfo/openwrt-sdk-ipk:24.10.6`;
+  `Dockerfile-apk` FROM `itdoginfo/openwrt-sdk-apk:25.12.3`.
+- KNOWN INCONSISTENCY (intentional, do NOT "fix" blindly): ipk Dockerfile
+  exports `NETSHIFT_VERSION="v${NETSHIFT_VERSION}"` (adds a `v`); apk sets it
+  raw (no `v`). Embedded version vs artifact filenames can differ across types.
+- `sdk/Dockerfile-sdk-*` are the base SDK images (feeds update + luci-base);
+  apk SDK requires running `./setup.sh` first.
+
+## Release flow (build.yml, on tag push)
+
+smoke-tests gate -> `preparation` derives version (`git describe --tags
+--exact-match`, fallback `0.<date>`) -> matrix build ipk+apk -> `docker cp`
+artifacts out of the container -> **ipk underscore->dash rename**
+(`sed 's/_/-/g'`) -> filter to the 3 packages -> GitHub Release.
+
+- The underscore->dash rename is LOAD-BEARING: `install.sh` scrapes the
+  latest-release API and matches assets by package-name prefix
+  (`netshift*`, `luci-app-netshift*`, `luci-i18n-netshift-ru*`). Breaking the
+  rename breaks install.
+
+## Smoke tests (tests/)
+
+- Image = OpenWRT 24.10.6 rootfs; source is **bind-mounted at runtime**
+  (`../netshift/files -> /netshift/files:ro`), so editing `netshift/files` is
+  picked up without rebuilding the image.
+- Needs `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` + `network_mode: host` for nft/dns;
+  nft tests FAIL (not skip) without caps.
+- `all` runs: deps syntax config helpers jq cm sb nft diagnostics subscription.
+- Add a test: `test_xyz()` (header/pass/fail/skip), add to `main()` `all)` list,
+  add `case` alias, update usage line + docker-compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- Smoke baselines drift as tests get added: 81 passed (pre task-016) -> 84
+  passed after adding `test_nft_ipv6` (3 v6 assertions). Re-confirm the baseline
+  from the actual run, don't trust a stale number in a task spec.
+- `test_nft_ipv6` (alias `nftv6`, task-016): real-nft regression guard for the
+  B-01 IPv6 tproxy blocker. Builds the v6 tproxy rule from constants
+  (`SB_TPROXY_INBOUND_ADDRESS_V6`/`_PORT_V6`) in a throwaway `inet` table, lists
+  it back, and asserts it normalizes to bracketed `[::1]:1603` (positive) and
+  that no portless bare form (`tproxy ip6 to ::0`) appears (negative guard). The
+  unbracketed bug (`::1:1603`) is normalized by nft to a portless bare addr
+  (`[::1:1603]` / `[::0.1.22.3]` depending on nft version) — either way the
+  `\[::1\]:1603` grep fails, so the guard fires. Capability-gated: an
+  ip6-tproxy "not supported"/"operation not supported" kernel `skip`s; a
+  successful-but-wrong load `fail`s. SELF-PROVEN: temp scratch with unbracketed
+  rule -> 1 failed (guard caught it), reverted.
+- Smoke test capability gating pattern: capture `add_err="$(nft add ... 2>&1)"`
+  inside the `if`; on success run asserts, on failure `case "$add_err"` for
+  *not supported* substrings -> `skip`, else `fail`. Avoids false-fails on
+  kernels lacking a feature while still catching real bugs.
+- jq `index()` truthiness nit: `index("x") and index("y")` works (jq treats 0 as
+  truthy) but prefer `(index("x") != null) and (index("y") != null)` for intent
+  + 0-index robustness. Was at entrypoint.sh:688.
+- WSL2 kernel (6.6.x-microsoft-standard-WSL2) DOES support ip6 tproxy in the
+  smoke container, so the v6 assertions run (not skip) locally.
+- nft v6 buggy-form normalization is VERSION-DEPENDENT: the PROOF doc saw
+  `[::0.1.22.3]` (nftables v1.1.3), but the OpenWRT 24.10.6 smoke container
+  re-prints unbracketed `::1:1603` as `[::1:1603]` (no `]:` port sep). A
+  negative guard that greps a single literal (`\[::0`) is therefore a DEAD
+  assertion on the smoke env. ROBUST pattern: flag any `tproxy ip6 to [...]`
+  line that is NOT the correct `[::1]:1603` ->
+  `grep 'tproxy ip6 to \[' | grep -qv '\[::1\]:1603'`. Catches both
+  normalizations + future variants. Self-proved: unbracketed scratch -> BOTH
+  positive (`bracketed`) and negative (`no-bare`) guards FAIL (2 failed).
+
+## CI gates by path
+
+- `frontend-ci.yml`: PRs touching `fe-app-netshift/**` -> yarn install /
+  format(diff) / lint(--max-warnings=0) / test / build(diff).
+- `shellcheck.yml`: `install.sh` + `usr/bin/netshift` + `usr/lib/**.sh`,
+  severity error (Differential ShellCheck).
+- `openwrt-smoke-tests.yml`: `netshift/**`, `luci-app-netshift/**`, `tests/**`,
+  `install.sh`, Dockerfiles -> entrypoint `all`.
+- `.gitlab-ci.yml` declares a `test` stage but runs no tests — only builds and
+  deploys Docker on master. Quality is enforced by the AI review workflow + the
+  GitHub Actions above, not GitLab.
+
+## install.sh
+
+- POSIX; apk/opkg abstraction; podkop->netshift migration STOPS the old service
+  first (that restores dnsmasq keys + removes PodkopTable + `105 podkop`),
+  backs up config to `/etc/config/podkop.bak.pre-netshift`. OpenWRT 23.05
+  unsupported; needs >=15 MB on `/overlay`; NO uninstall path (removal lives in
+  package `prerm`). GitHub API rate-limit is a known fragility (wget path has no
+  guard).
+- `pkg_install` opkg branch uses `opkg install --force-downgrade
+  --force-reinstall "$pkg_file"` (task-042). Plain `opkg install` silently
+  no-op'd (rc=0) when re-run on a router with an older build: the legacy
+  v-prefixed version (`v0.8.6-r1`) sorts ABOVE the no-v release (`0.8.7-r1`) so
+  opkg "won't downgrade", and equal versions report "up to date". Both force
+  flags make opkg remove+reinstall (proven on OWRT 24.10.5 aarch64). apk branch
+  unchanged — `apk add --allow-untrusted` overwrites by default. This is the
+  install.sh twin of the task-041 `updates_pkg_install_file` updater.sh fix;
+  keep both upgrade paths (README script + in-app self-update) aligned.
diff --git a/docs/agent-rules/memory/shell-backend-developer.md b/docs/agent-rules/memory/shell-backend-developer.md
new file mode 100644
index 00000000..8b02bc62
--- /dev/null
+++ b/docs/agent-rules/memory/shell-backend-developer.md
@@ -0,0 +1,1621 @@
+# Memory — shell-backend-developer
+
+Durable backend (ash + jq) knowledge. Read before implementing; append
+findings; keep under ~200 lines.
+
+## Hard constraints (proven)
+
+- **OpenWRT jq has NO Oniguruma** — `test()`, `match()`, `sub()`, `gsub()` and
+  any regex are unavailable. The updater (`updater.sh`) documents workarounds.
+  Build string logic with `split`/`startswith`/`endswith`/`contains`/`ascii`
+  instead.
+- **`fatal` is only a log label** — `log "..." "fatal"` does NOT exit. You must
+  follow it with `exit 1` yourself. Missing the `exit 1` continues with a
+  half-built config.
+- **busybox sed lacks `\x` escapes** — use printf-octal workarounds (see
+  `helpers.sh` `convert_crlf_to_lf` and BOM stripping). Don't assume GNU sed.
+- **Diagnostic strings are UTF-8, NOT mojibake** (corrected by task-004). The
+  emoji/box-drawing in `usr/bin/netshift` (`global_check`, `list_update`,
+  `subscription_update`, `check_nft`: `📡 🛠️ ✅ ❌ ⚠️ ➡️ 🧱 🥸 📄 ━`) are valid
+  UTF-8 and must STAY valid UTF-8. They were once double-encoded (UTF-8 read as
+  CP1251, re-saved as UTF-8 → printed `рџ…`/`в”…`/` `). Never open/save that file
+  in a non-UTF-8 editor or pass it through CP1251 — it re-corrupts. The earlier
+  "preserve the corrupted bytes" note here was the WRONG guidance that protected
+  the bug.
+
+## Conventions (follow exactly)
+
+- File header: `# shellcheck shell=ash`; constants files add
+  `# shellcheck disable=SC2034`. Declare every variable `local`.
+- Function prefixes: `sing_box_cm_*` = one jq mutation each (dumb primitive);
+  `sing_box_cf_*` = facade (parse + several cm_* calls); `url_*` = pure URL
+  parsing; `is_*` = predicate returning 0/1; `nft_*` = nft wrapper; `updates_*`
+  = updater; `get_*_tag` = deterministic tag builder; `configure_*`/`import_*`/
+  `_*_handler` = config_foreach callbacks; leading `_` = private helper.
+- Config threading: `$config` is a shell STRING; cm/cf take it as `$1`, echo
+  mutated JSON; caller does `config=$(sing_box_cm_... "$config" ...)`.
+- jq optional keys: `+ (if $x != "" then {k:$x} else {} end)`. Custom helpers
+  in `helpers.jq`, imported `import "helpers" as h {"search":"/usr/lib/netshift"}`.
+- Validation is mandatory: write to `*.tmp.$$`, run `sing-box -c <file> check`
+  (fatal on fail), `jq -e` for shape, md5sum-compare, then `mv`. Atomic only.
+- New constants -> `constants.sh` (grouped Common/nft/sing-box/Lists). Never
+  hardcode ports/IPs/marks/paths.
+- The service-tag pattern: cm_* functions stamp a transient `__service_tag`
+  (`SERVICE_TAG`) on rules; `sing_box_cm_save_config_to_file` strips every
+  `__service_tag` via `walk(...)` before writing. Don't leave tags in output.
+
+## Subscription / unavailable-outbound flow (don't leak traffic)
+
+- Many code paths branch on `subscription_outbound_is_unavailable` to emit
+  **reject** route rules instead of routes when a subscription is down. Any new
+  routing code MUST respect this or it leaks traffic when a sub is unavailable.
+
+## Testing
+
+- Smoke suite is `tests/entrypoint.sh` (run via `smoke-tests` skill). Categories:
+  deps syntax config helpers jq cm sb nft diagnostics subscription.
+- To add a test: write `test_xyz()` using the `header`/`pass`/`fail`/`skip`
+  helpers; add it to `main()`'s `all)` list; add a `case` alias; update the
+  usage line and the docker-compose comment. Config-gen and subscription
+  parsing changes SHOULD get a smoke test.
+- Pre-commit-equivalent: always run the `shellcheck` skill (severity error) on
+  touched shell files before handing back.
+
+## jq gotchas (proven by task-002)
+
+- **`include` / `exclude` are RESERVED jq keywords** — you cannot name a jq
+  variable `$include` (jq tries to parse the `include` directive). Use `$inc`/
+  `$exc` etc. for keyword-filter lists.
+- **`any(gen; cond)` / `all(gen; cond)` binding trap**: inside the condition,
+  `.` is the generator element ONLY at the top of `cond`. If you write
+  `($name | index(.))` the `.` becomes `$name` (the pipe rebinds `.`), so the
+  match silently always succeeds. Bind first: `any($kw[]; . as $k | ($name |
+  index($k)) != null)`.
+- Subscription keyword filter lives in `sing_box_cf_prepare_subscription_batch`
+  (facade), runs BEFORE static-unsupported filter + tag dedup, threaded from the
+  `subscription)` branch via two UCI **list** options
+  `subscription_filter_include_keywords` / `subscription_filter_exclude_keywords`
+  (the cross-layer contract names for task-003 — do NOT rename). Keywords are
+  opaque user text: collect with a `config_list_foreach` handler that jq
+  `--arg`-appends each item into a JSON array (commas/emoji survive; never use
+  `comma_string_to_json_array` for them). Empty result reuses the existing
+  `mark_subscription_outbound_unavailable` fail-safe (no `exit 1`).
+
+## Known landmines
+
+- nft proxy chain hardcodes `127.0.0.1:1602` (duplicates the constants).
+- VPN `domain_resolver` uses wrong variable `$dns_server`.
+- `check_nft` references stale set names (`netshift_domains`) / UCI options that
+  don't exist elsewhere — likely copied diagnostic cruft.
+
+## task-004: double-encode repair recipe (reusable)
+
+- To reverse a UTF-8→CP1251 double-encode losslessly: `text =
+  bytes.decode("utf-8"); fixed = text.encode("cp1251").decode("utf-8")` then
+  write `fixed.encode("utf-8")`. ASCII bytes pass through; verify 0
+  cp1251-unmappable chars and that ASCII-stripped lines are byte-identical
+  before/after (proves no code moved). Result was exactly 114 lines, all
+  non-ASCII-only. LF/no-BOM preserved.
+- On Windows here, `python3.exe` is the MS Store stub — use `python` (Python
+  3.11 at `...\Programs\Python\Python311`). Don't `print()` emoji to the
+  PowerShell console (cp1251 codepage mangles it / raises); write results to a
+  UTF-8 file and read it back.
+## task-005 review-001: vmess base64 + url_decode landmine (proven)
+
+- `sing_box_cf_add_proxy_outbound` runs `url=$(url_decode "$url")` BEFORE the
+  scheme `case`, and `url_decode` does `s/+/ /g`. Any scheme that base64-decodes
+  the WHOLE payload (vmess `vmess://base64(JSON)`; future tuic/etc.) MUST decode
+  from the RAW link, not the url_decode'd one — standard base64's alphabet
+  includes `+`, so `+`→space corrupts ~1-in-64 real keys. Fix pattern: capture
+  `local raw_url="$3"` at the top (before url_decode) and pass `$raw_url` to the
+  whole-payload decoder. Other scheme cases keep using the url_decode'd `$url`.
+- **busybox `tr` does NOT support POSIX char classes** — `tr -d '[:space:]'`
+  deletes the LITERAL chars `[ : s p a c e ]` (silently corrupts base64!). Use
+  explicit bytes: `tr -d ' \011\012\015'` (space/tab/LF/CR octal). Verified
+  in-container: input `aZ:[]cept123` → `Zt123` with `[:space:]`. This was a real
+  regression I introduced and caught via the `sb` smoke run.
+- base64 padding normalization for unpadded links: right-pad payload length to a
+  multiple of 4 with `=` using `pad=$(( ${#p} % 4 ))` then a `while` append loop.
+  POSIX-safe, busybox-safe.
+- To craft a base64 body that DELIBERATELY contains `+`: a `ps`/label value of
+  `node>>` (bytes 0x3E 0x3E) forces a 6-bit group = 62 → `+`. Realistic ASCII
+  host/word values rarely hit it; `>>` is reliable.
+- Probing helpers in-container without fighting PowerShell quoting: write a tiny
+  `.sh` into `netshift/files/usr/lib/` (it's bind-mounted into the smoke
+  container at `/netshift/files`), run via
+  `docker compose ... run --rm --entrypoint sh netshift-test /netshift/files/usr/lib/_tmp.sh`,
+  then delete it. Inline `-c "..."` one-liners get mangled by PowerShell.
+
+- `test_syntax` in `tests/entrypoint.sh` now also `ash -n`'s `usr/bin/netshift`
+  and asserts no residual `рџ`/`в”`/`вЂ` markers (built via `printf` octal, since
+  busybox grep lacks `\x`). Guards against re-introducing the mojibake.
+
+## task-007: async component-action job state (rpcd 30s wall fix)
+
+- Root cause of "core switch fails": the UI called `component_action sing_box
+  install_extended` SYNCHRONOUSLY via rpcd `fs.exec`; rpcd has `-t 30` and kills
+  the worker mid-extract (after `tar -O > /usr/bin/sing-box`, before
+  `chmod 0755`). The JS-side `timeout: 600000` does NOT help (server-side limit).
+  Fix = fork the worker detached; return a job_id in <<30s; poll status.
+- Job-state machinery lives in `updater.sh` (jq, no ucode). State dir `/var/run/netshift/
+  component-actions` (tmpfs). Constants: `UPDATES_JOB_DIR`,
+  `UPDATES_JOB_FINISHED_TTL_MINUTES=60`, `UPDATES_JOB_ORPHAN_OUTPUT_TTL_MINUTES=60`,
+  `UPDATES_JOB_STALE_GRACE_SECONDS=15`.
+- **State object contract (STABLE — frontend task-008 depends on these field
+  names):** `{ success, running, component, action, message, pid, started_at,
+  updated_at, exit_code, version, latest_version }`. running:
+  `running:true,success:true,exit_code:null`. finished: `running:false`,
+  success/version/message parsed from the worker stdout JSON, exit_code from `$?`.
+- HUP-proof fork: `( trap '' HUP; "$0" component_action "$c" "$a" >"$out" 2>&1;
+  updates_write_finished_job_state ... "$?" "$out" ) >/dev/null 2>&1 &`; record
+  `$!` into the running state via `updates_update_running_job_pid`. `trap '' HUP`
+  is what survives the rpcd session close. The async wrapper NEVER `exit 1`s on a
+  worker failure — the failure is recorded in the finished state.
+- finished-state stdout parser (`updates_extract_worker_json`): `updates_log`/
+  `echolog` can pollute the worker's stdout, so: (1) if the WHOLE file is valid
+  JSON (`jq -e .`) use it; else (2) `sed -n 's/^[^{]*\({.*\)$/\1/p' | tail -n 1`
+  then `jq -e` validate. sed is busybox-safe; NO Oniguruma. success derives from
+  `$w.success // ($exit_code == 0)`; version from `$w.version // $w.current_version`.
+- Path-traversal guard: `updates_job_state_path` rejects ids matching
+  `*[!A-Za-z0-9._-]*` or empty/`.`/`..` → return 1. The id comes straight from
+  the (ACL-gated) UI, so this is the security boundary. `component_action_status`
+  returns a safe self-contained `{success:false,running:false,...}` (via
+  `updates_job_status_response`, non-zero rc) for invalid id / missing file.
+- Stale detection (`updates_refresh_running_job_state`): running:true but pid not
+  `kill -0` alive AND past `started_at + STALE_GRACE` → rewrite as finished/stale
+  (`success:false`). Prevents the UI polling a crashed worker forever.
+- Idempotent install (Req 4): at the START of `updates_install_sing_box_extended`,
+  if `/usr/bin/sing-box` exists but is not `-x` OR fails a `version` probe, `rm`
+  it up front (don't back up a broken partial artifact). `chmod 0755` stays
+  IMMEDIATELY after stream-extract and BEFORE validation — keep that order.
+- **`set -e` + command substitution landmine (smoke harness):** under `set -e`,
+  `x="$(cmd-that-returns-nonzero)"` ABORTS the whole script. When a test
+  deliberately invokes a failing command (e.g. invalid-id status returns rc 1),
+  run it as `cmd > tmpfile 2>/dev/null || rc=$?` then read tmpfile — do NOT
+  capture via `$(...)` in an assignment, and do NOT use `|| true` (that clobbers
+  `$?` so you can't assert the non-zero rc). This cost me one debug cycle.
+- **Brace-in-default-param landmine (busybox ash):** `${VAR:-{json...}}` emits an
+  EXTRA literal `}` even when VAR is set (the inner `{...}` confuses the `}`
+  matching), corrupting JSON. Use `[ -z "$VAR" ] && VAR='{...}'` then print `$VAR`.
+- New top-level smoke test `test_jobstate` (alias `jobstate`): stubs the worker
+  via a tiny generated CLI whose `$0` IS the stub (because `component_action_async`
+  forks `"$0" component_action ...`); controls the worker with `STUB_JSON`/
+  `STUB_SLEEP`/`STUB_RC` env; isolates state under `JOBSTUB_DIR`. Registered in
+  `all)`, case alias, usage line, and the docker-compose comment.
+- Dispatcher (`bin/netshift`): `component_action_async) component_action_async
+  "$2" "$3" ;;` and `component_action_status) component_action_status "$2" ;;`
+  replaced the old naive `"$0" component_action ... > /tmp/...json &` hack. ACL
+  needs NO change (`/usr/bin/netshift` is exec-allowed wholesale).
+
+## task-009: core-switch connectivity self-heal + rollback (anti-brick)
+
+- Root cause of the on-hardware brick: `updates_install_sing_box_stable`
+  removed/replaced /usr/bin/sing-box via opkg/apk with NO backup, while the
+  kill-switch (nft tproxy + dnsmasq->127.0.0.42->dead sing-box) blocked feed
+  access. Binary GONE, no rollback. Extended path already had a tmpfs backup.
+- Fix shape (variant B): both install paths are now thin PUBLIC wrappers
+  (`updates_install_sing_box_extended`/`_stable`) that run
+  `updates_ensure_connectivity <dir>` (preflight; if fail -> selfheal) then call
+  the renamed private core (`_updates_install_sing_box_*_core`), then ALWAYS
+  `updates_restore_after_swap`. **Epilogue guarantee = single cleanup call**:
+  core echoes JSON to a `/tmp/...result.$$` capture file + returns rc; wrapper
+  runs restore once, re-emits the JSON, returns rc. No early return skips it (no
+  trap needed — the wrapper has exactly one core call).
+- `updates_preflight_connectivity <stable|extended>` is direction-aware: stable
+  probes `UPDATES_FEED_PROBE_HOST` (downloads.openwrt.org), extended probes
+  `UPDATES_GITHUB_PROBE_HOST` (api.github.com). Probe = DNS resolve (dig
+  `+short`, nslookup fallback; bind-dig is a dep) AND a curl `-fsSI`/wget
+  `--spider` HEAD with `--connect-timeout 5`. No jq/regex.
+- `updates_selfheal_connectivity`: (1) backup `/etc/resolv.conf` to tmpfs
+  (`UPDATES_RESOLV_BACKUP`), write temp resolver (`UPDATES_HEAL_RESOLVERS`
+  1.1.1.1+9.9.9.9) atomically, recheck; (2) if still failing, tear down redirect
+  via the EXISTING `/etc/init.d/netshift stop` (dnsmasq_restore + stop_main),
+  recheck. Records `UPDATES_HEAL_RESOLV_REPLACED`/`UPDATES_HEAL_REDIRECT_DOWN`
+  module-level flags so the epilogue restores EXACTLY what changed (restore
+  resolv.conf via mv-back, bring redirect up via `/etc/init.d/netshift start`).
+  Reused stop/start so dnsmasq UCI + shutdown_correctly bookkeeping stays right;
+  NO hand-rolled nft flush, NO sacred-constant change.
+- Stable core gained tmpfs backup/rollback (`updates_stable_rollback`) mirroring
+  the extended path: backup binary+libcronet BEFORE package install; restore on
+  install-fail OR still-extended validation. CRITICAL ordering: connectivity is
+  confirmed (preflight/heal in the wrapper) BEFORE the core touches the binary —
+  if heal fails the wrapper aborts and nothing is removed.
+- **Testability indirection**: added `UPDATES_SING_BOX_BIN`/`UPDATES_LIBCRONET_LIB`
+  constants (default the real /usr/bin/sing-box, /usr/lib/libcronet.so) and used
+  them in the STABLE core+rollback only, so the smoke test can point them at
+  /tmp mocks without clobbering the container's real binary. Extended path still
+  uses the literals (spec said mirror, not refactor).
+- New top-level smoke test `test_selfheal` (alias `selfheal`): a generated
+  driver sources updater.sh, re-pins RESOLV_CONF/probe-hosts/bin paths, stubs
+  dig/nslookup/curl/opkg via a PATH-prepended bin dir whose behaviour is keyed
+  off marker files, and installs a fake `/etc/init.d/netshift` that logs
+  stop/start/restart (absolute path can't be PATH-overridden — write+restore the
+  real one). 5 scenarios: preflight-pass, dns-heal, teardown-heal, heal-fail
+  (abort, binary intact), stable-install-fail (backup restored). Registered in
+  `all)`, case alias, usage line, docker-compose comment.
+- **`set -e` landmine (again)**: the worker returns non-zero on recoverable
+  failures (success:false). Calling it directly inside a test under `set -e`
+  aborts the WHOLE suite mid-run (only the passes before it print, summary never
+  runs, rc=1 with no FAIL line). Wrap the invocation `... || true` — assertions
+  read JSON/file-state, not rc. (Distinct from the task-007 `$(...)`-capture
+  variant.)
+
+## task-010: keyword filter case-fold is ASCII+Cyrillic (not just ASCII)
+
+- **`ascii_downcase` only folds ASCII A-Z** — Cyrillic server tags (e.g.
+  `Германия`) stayed mixed-case, so a Cyrillic include keyword in any other
+  case matched 0 nodes → kept=0 → blocked outbound (hardware-confirmed: include
+  `[ГеРма,пОЛЬш,рос]` over 316 outbounds gave 0 before, 28 after).
+- Fix lives in `sing_box_cf_prepare_subscription_batch`
+  (`sing_box_config_facade.sh`). That jq call does NOT `import` helpers.jq, so the
+  fold is defined **inline** at the top of the program as `def ucfold:` using only
+  `explode`/`map`/`implode` (NO Oniguruma): ASCII `65-90`→`+32`, Cyrillic
+  `1040-1071` (А-Я)→`+32`, and the single out-of-block `Ё` `1025`→`1105` (ё).
+  Everything else (emoji/other scripts) passes through unchanged → still matches
+  as exact codepoint substrings. Replaced the 3 `ascii_downcase` uses (the two
+  `$inc`/`$exc` list normalizers + the `$name | ucfold` in the select). The
+  `index()`-based `name_passes_keywords` substring logic is unchanged.
+- Cyrillic codepoints: А-Я = 1040-1071, а-я = 1072-1103 (so +32), Ё = 1025
+  sits BEFORE the block, ё = 1105 sits AFTER it — hence the special-case branch.
+- Smoke: extended the existing FBEOF block in `test_subscription` with CASE K
+  (Cyrillic). No new top-level test / registration needed — it rides the existing
+  `subscription` category. Synthetic names with literal UTF-8 (`Германия`,
+  `Орёл`, etc.) in the heredoc are fine; assert via `.count`/`.names`. Used a
+  `case "$x" in *Польша*)` membership check rather than exact-name compare for the
+  exclude case (order-independent). All ran green in-container.
+
+## task-011: keyword filter must not poison the subscription rejected-hash
+
+- Root cause of the hardware re-download loop: `mark_subscription_outbound_unavailable`
+  (`bin/netshift`) md5'd the VALID `<section>.json` and wrote it to `.rejected`
+  even when `kept=0` was caused purely by the user's keyword filter (a setting,
+  not a bad feed). Then `subscription_cache_is_usable` — which had already passed
+  `validate_subscription_file` — still returned 1 on the hash match, forcing a
+  re-download; `download_subscription_into_cache` saw tmp_hash==rejected_hash and
+  `return 14` (unchanged+rejected) → infinite retry. The poison also survived
+  loosening the filter (lived only in `.rejected`).
+- Fix A: 2nd arg `keyword_filter_active="${2:-0}"`. When 1: NEVER compute/write
+  the hash, `rm -f` the `.rejected` (self-heals a previously poisoned hash), still
+  set unavailable state + `subscription_startup_blocked=1`, warn that the FILTER
+  (not the feed) emptied the set. When 0: unchanged (genuine outbound-less body
+  still recorded → flash-loop guard kept). Caller at the `subscription)` branch
+  passes `$subscription_keyword_filter_active` (set 0/1 just above from the two
+  UCI keyword lists).
+- Fix B: in `subscription_cache_is_usable`, after `validate_subscription_file`,
+  run a jq -e "has >=1 proxy outbound" check (same predicate as the batch:
+  `[.outbounds[]? | select(.type != "selector" and ... != "block")] | length > 0`,
+  NO Oniguruma) → if true `return 0` (usable) regardless of `.rejected`. The
+  rejected-hash veto now only fires on a validated-but-outbound-less body. NB:
+  `validate_subscription_file` ALREADY requires length>0, so a 0-proxy body fails
+  validation first — B is belt-and-suspenders + self-documenting, and robust if
+  validation ever loosens. Did NOT touch `download_subscription_into_cache`'s own
+  rejected logic (spec: once A/B stop writing+vetoing, a valid body has no
+  `.rejected` so return 14 can't fire for it).
+- **Testing functions that live in `bin/netshift` (not a lib):** can't source the
+  file (it runs the dispatcher + needs LuCI `/lib/functions.sh`). Pattern that
+  works: a generated driver that (1) stubs the few helpers the target calls
+  (`log`, the `get_subscription_*_path` builders), (2) sources `helpers.sh` for
+  the real `validate_subscription_file`, (3) extracts JUST the target functions
+  verbatim with awk and `eval`s them:
+  `eval "$(awk '/^fname\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "$bin")"`. Relies on
+  top-level functions closing with a column-0 `}` and having no nested column-0
+  `}` (case/if/while bodies don't). Keeps the test against shipped code, not a copy.
+- New top-level smoke test `test_rejected_hash` (alias `rejected`): 6 cases
+  (A-no-write+clear, A-recovery, B-not-vetoed, A-protected-no-proxy-still-vetoed,
+  regression-usable, A-arg0-genuine-recorded). Registered in `all)`, case alias,
+  usage "Available:" line, docker-compose comment. Same name:OK/FAIL parse + the
+  subshell-pipe PASS-counter quirk as test_subscription (suite `Results:` total
+  omits piped-while passes; the per-test ✓ marks are the source of truth).
+
+## task-012: vmess:// '#fragment' strip before base64 decode
+
+- Root cause: the `vmess)` case in `sing_box_config_facade.sh` passes the RAW
+  pre-url_decode link (`$raw_url`, kept that way by task-005 S1 to preserve `+`),
+  which STILL carries the `#fragment` (server display name, e.g. `#🇳🇱Ne`).
+  `vmess_link_to_json` only did `payload="${url#vmess://}"`, so the `#`/emoji/
+  Cyrillic bytes corrupted the base64 → decode failed → fatal. facade:72's
+  `url_strip_fragment` only touched the separate `$url`, NOT `$raw_url`, so the
+  strip MUST live inside `vmess_link_to_json`.
+- Fix (helpers.sh, ONE line): right after `payload="${url#vmess://}"` add
+  `payload="${payload%%#*}"` (POSIX longest-`#…`-suffix strip). Safe because the
+  base64 body never contains `#`; fragment-less payload = no-op. Existing
+  whitespace-strip (`tr -d ' \011\012\015'`, NOT `[:space:]`) + `=` pad loop +
+  `base64_decode` run unchanged on the fragment-free payload. Did NOT touch the
+  facade / reintroduce url_decode. VMess canonical name still comes from JSON
+  `ps`; we only drop the fragment, do not adopt it as the name.
+- Smoke: extended the existing vmess facade block in `test_sing_box_config` (`sb`
+  category — no new top-level test/registration) with a `vmess-frag-*` case:
+  `vmess://<base64(JSON)>#🇳🇱Ne`, sanity-check the link has `#`, then assert
+  server/uuid/transport/tls on the generated outbound. The existing ws/tcp/plus
+  cases (no `#`) double as the no-fragment regression. shellcheck -S error clean;
+  `all` = 76 passed / 0 failed.
+
+## task-013: sing-box-extended version diagnostic (build-suffix strip)
+
+- Root cause: `check_sing_box()` (`bin/netshift`, ~:3276) does
+  `version=$(sing-box version | awk '{print $3}')` then `patch=$(... cut -d. -f3)`.
+  Extended core prints `1.13.12-extended-2.3.2`, so `patch` became
+  `12-extended-2` → non-numeric → `[ "$patch" -ge 4 ]` errors `bad number` →
+  `❌ not compatible`. Stock cores have numeric patch so they passed.
+- Fix (Variant A′, ONE line + comment): right after the existing
+  `version=$(echo "$version" | sed 's/^v//')`, add `version=${version%%-*}`
+  (POSIX longest-`-…`-suffix strip; no fork/jq/regex). `1.13.12-extended-2.3.2`
+  → `1.13.12`; stock `1.12.0` has no `-` so unchanged; also tolerates future
+  `-beta`/`-rc`. `major`/`minor`/`patch` are already `local`; no new vars.
+- **OUT-OF-SCOPE PRE-EXISTING BUG (left untouched per spec, but flag it):** the
+  comparison chain `if [ "$major" -gt 1 ] || [ "$major" -eq 1 ] && [ "$minor"
+  -gt 12 ] || ... && [ "$patch" -ge 4 ]` has wrong precedence — POSIX `[]`
+  `&&`/`||` are equal-precedence left-associative, so it evaluates as
+  `(...) && [ "$patch" -ge 4 ]`, making the final patch test gate EVERY branch.
+  Result: `1.13.12` and even `2.0.0` evaluate to version_ok=0 (only `1.12.x>=4`
+  passes). The spec (task-013) explicitly says do NOT rewrite the chain — it
+  only fixes the non-numeric `bad number` crash. So the extended diagnostic no
+  longer errors, but a TRUE fix of "newer than 1.12.4 ⇒ compatible" needs a
+  follow-up task to correct the chain (e.g. parenthesize each branch in a
+  single `[ ]` per term or use `sort -V` like `check_requirements` does).
+- Smoke: NO new test (pure string strip, no new control flow — per spec). Reran
+  `shellcheck -S error` clean on `bin/netshift`; `smoke-tests all` = 76 passed /
+  0 failed.
+
+## task-014: route the MAIN DNS server through a proxy outbound (detour)
+
+- The cm/cf DNS primitives ALREADY accept `detour` as the last arg and merge it
+  conditionally (`+ (if $detour != "" then {detour:$detour} else {} end)`):
+  `sing_box_cf_add_dns_server` $6, `sing_box_cm_add_udp/tls_dns_server` $6,
+  `_add_https_dns_server` $8. So an EMPTY detour tag => byte-identical to the
+  pre-feature output (proven in smoke via `jq -cS` object compare of the
+  empty-tag main server vs a no-detour-arg call). Do NOT touch cm/cf for this.
+- New helper `_get_dns_detour_tag()` (bin/netshift, next to
+  `_determine_first_outbound_section`/`get_first_outbound_section`) echoes the
+  tag or "" = direct. NEVER `exit`; every fallback logs `warn` and degrades to
+  direct. Cascade: (1) `dns_via_outbound`!=1 -> "" silent; (2) explicit
+  `dns_outbound_section` valid + `section_has_configured_outbound` -> it, else
+  warn(if non-empty) + `get_first_outbound_section`; (3) no candidate -> warn+"";
+  (4) candidate connection_type block/exclusion -> warn+""; (5)
+  `subscription_outbound_is_unavailable` -> warn+"" (self-heal on fresh boot /
+  failed sub); (6) else `get_outbound_tag_by_section "$candidate"`. Mirrors
+  `get_subscription_download_proxy_address` (toggle + section + fail-safe).
+- Wired ONLY into the main `SB_DNS_SERVER_TAG` server in `sing_box_configure_dns`
+  (6th arg). Bootstrap (`SB_BOOTSTRAP_SERVER_TAG`) + FakeIP stay direct on
+  purpose (chicken-and-egg: bootstrap resolves the DoH/DoT host before the tunnel
+  is up; it's also the `domain_resolver` for a hostname main DNS). Two new UCI
+  opts documented (commented) in `etc/config/netshift`: `dns_via_outbound`(bool,
+  default 0) + `dns_outbound_section`. Read with `config_get_bool`/`config_get`
+  + safe defaults — never required live.
+- Did Req 4 (low-risk, observable): `check_dns_available` JSON gains
+  `"dns_via_outbound_tag"` (via `_get_dns_detour_tag`); `global_check` prints
+  `ℹ️ Main DNS via outbound: <tag>` or `ℹ️ Main DNS: direct` (valid-UTF-8 emoji).
+- **LuCI `config_get` always returns 0** (assign-and-succeed even when the option
+  is unset, leaving the var empty). So step-2's `config_get ... && [ -n "$var" ]`
+  detects a non-existent section purely via the EMPTY connection_type, not via rc.
+  Test stubs must mimic this (assign-then-`return 0`).
+- New top-level smoke test `test_dns_via_outbound` (alias `dnsdetour`): builds
+  on/off configs through the real cf/cm path (asserts main-has-detour,
+  bootstrap/fakeip no-detour, off no-detour, off byte-parity, both pass live
+  `sing-box check`), then awk-extracts `_get_dns_detour_tag` VERBATIM from the bin
+  and runs the 8-case cascade table with stubbed UCI + reused helpers. Registered
+  in `all)` + case alias + usage "Available:" line + docker-compose comment.
+  shellcheck -S error clean on bin + libs + install.sh; `smoke-tests all` = 76
+  passed / 0 failed (suite total unchanged because the per-line `pass` runs in a
+  piped `while` subshell — same counter quirk as test_subscription; the per-test
+  ✓ marks are the source of truth, here 15 green for dnsdetour).
+
+## task-014 (PR#11 backend fixes): nft v6 bracket + dead-code removal
+
+- **nft IPv6 `tproxy ... to` MUST bracket the address** — `tproxy ip6 to
+  "$ADDR_V6:$PORT_V6"` expands to `::1:1603`, which nftables v1.1.3 parses as a
+  BARE IPv6 address (`[::0.1.22.3]`, port 1603 read as 0x1603 hextet) with NO
+  port. `nft -c` PASSES and `sing-box check` is unrelated — neither gate catches
+  it; only on-device IPv6 breaks. Fix: `tproxy ip6 to "[$ADDR_V6]:$PORT_V6"`.
+  Verify with the no-root trick: write the rule to /tmp/t.nft and
+  `unshare -rn sh -c 'nft -f /tmp/t.nft && nft list ruleset' | grep tproxy` —
+  bracketed form normalizes to `tproxy ip6 to [::1]:1603` (correct). The IPv4
+  `tproxy ip to "$ADDR:$PORT"` is fine (IPv4 has no `:` ambiguity). sing-box
+  inbounds (`sing_box_cm_add_*_inbound` address+port as SEPARATE jq args ->
+  JSON `listen`/`listen_port`) have NO bracket defect — don't "fix" them.
+- **Router-originated traffic is DIRECT by design** (operator decision A). The
+  PR's model marks only LAN/forwarded traffic in `mangle` (prerouting) and
+  splits proxy/direct in sing-box; `mangle_output` only carries local/loopback
+  daddr returns + the `NFT_OUTBOUND_MARK` return (so sing-box-originated packets
+  don't loop back into tproxy). Documented with a comment; no behavior change.
+- **The `@netshift_subnets` (`NFT_COMMON_SET_NAME`) nft set was fully dead** —
+  created + populated at 6 sites but matched by NO nft rule after PR#11. SAFE to
+  remove because every subnet source is independently carried into a sing-box
+  rule_set: user_subnets -> `patch_source_ruleset_rules ip_cidr` + local source
+  ruleset; local_subnet_lists -> `import_plain_subnet_list_to_local_source_ruleset_chunked`;
+  community_lists -> `configure_community_list_handler` (`$SRS_MAIN_URL/<svc>.srs`
+  remote ruleset); remote json/srs subnets -> `configure_remote_domain_or_subnet_list_handler`
+  (`sing_box_cm_add_remote_ruleset`); remote plain -> `prepare_source_ruleset` +
+  plain import. DISCORD is the ONE exception that still needs an nft set
+  (`NFT_DISCORD_SET_NAME`) — it has a live dport-restricted mangle rule
+  (`@netshift_discord_subnets udp dport {19000-20000,50000-65535}`) that a
+  sing-box route rule can't express. Removed: set creation (~972), all 6
+  `nft_add_set_elements*` populate calls, the now-orphaned
+  `import_subnets_from_remote_json_file`/`_srs_file` (json/srs now log
+  "sing-box manages updates" like the domains path), `netshift_subnets` from the
+  diagnostics `sets` list, and the `NFT_COMMON_SET_NAME` constant. Left the 9
+  IPv4 `SUBNETS_*` constants (only `SUBNETS_DISCORD` used) in place — constants.sh
+  is `# shellcheck disable=SC2034` so unused-looking vars don't fail lint, and
+  trimming them was out of declared scope.
+- **8 `SUBNETS_*_V6` constants had zero consumers** (`git grep` only matched
+  definitions + a memory doc) — removed.
+- **B-09 dead predicates**: `is_ip`/`is_ipv6_cidr`/`is_ipv6` in helpers.sh were
+  all unused (`is_ipv6` only called by the other two; tests use only `is_ipv4`/
+  `url_is_ipv6_literal`/`is_ipv4_ip_or_ipv4_cidr`). Removed all three.
+- **Monitor spawn guard (B-05)**: extracted `start_sing_box_monitor` mirroring
+  the `start_subscription_startup_retry_worker` pidfile-guard — if
+  `/var/run/netshift_monitor.pid` exists and `kill -0 "$pid"` succeeds, skip the
+  spawn (else `rm` stale pidfile then spawn). Prevents a procd double-start from
+  orphaning a monitor that `stop()` can no longer kill.
+- **B-08 dnsmasq guard (review-001 FIX — sentinel, not markers)**: my first B-08
+  attempt gated `dnsmasq_is_configured_for_netshift` on the presence of a private
+  backup marker (`netshift_server`/`netshift_noresolv`/`netshift_cachesize`).
+  That was WRONG and regressed STOCK dnsmasq: on a default box with no original
+  server/noresolv/cachesize, `dnsmasq_configure` writes NO markers
+  (`backup_dnsmasq_config_option` only writes when the original value is
+  non-empty; the server-backup loop is skipped when current servers are empty).
+  So the guard returned false, and the redundant `dnsmasq_configure force` path
+  (monitor recovery restart, double-start) re-ran "backup" — but the LIVE values
+  were now netshift's OWN (noresolv=1, cachesize=0), so it captured those as the
+  backup -> `dnsmasq_restore` later restored 1/0 instead of the OpenWRT defaults
+  (0/150) -> router DNS broken after stop/uninstall.
+  CORRECT fix = an explicit netshift-owned SENTINEL: `dnsmasq_configure` does
+  `uci_set "dhcp" "@dnsmasq[0]" "netshift_configured" 1` UNCONDITIONALLY right
+  after applying our config (before the commit); `dnsmasq_is_configured_for_netshift`
+  short-circuits iff `netshift_configured == 1` (authoritative ownership flag, no
+  value/marker inference); `dnsmasq_restore` clears it with `uci_remove_quiet`
+  before its commit so a fresh future configure re-establishes ownership. The
+  sentinel is a distinct option name (not in the `server` list), so it never
+  leaks into the server/backup iteration. Verified all 3 scenarios via an
+  awk-extracted-functions harness (use an EXACT-match UCI stub — `awk -F'\t'
+  $1==k`, NOT grep/sed, because the literal `@dnsmasq[0]` key contains `[0]`
+  which a regex reads as a char class and silently mis-reads every lookup):
+  (A) stock -> sentinel set, no spurious backup, force-again short-circuits,
+  restore=0/150, sentinel cleared; (B) admin-had-config -> real values backed up
+  & restored intact; (C) coincidental admin match w/o sentinel -> NOT treated as
+  owned. shellcheck clean; smoke 81/0.
+- shellcheck -S error clean (bin + libs + install.sh); `smoke-tests all` = 81
+  passed / 0 failed (unchanged baseline). No new smoke test (separate packaging
+  task owns nft/v6 coverage per spec). No sacred constant VALUES changed.
+
+## task-017: Component Manager backend (stock latest, NetShift self-update)
+
+- **Two new component_action() cases** (`updater.sh` ~:1612): `sing_box:
+  check_update_stable) updates_check_sing_box_stable` (SYNC) and
+  `netshift:self_update) updates_self_update_netshift` (async via the existing
+  `component_action_async`). NO dispatcher (bin/netshift) change — both are
+  sub-cases of the already-routed `component_action`; `component_action_async`/
+  `_status` are component-agnostic. NO ACL change.
+- **pkg-manager abstraction re-implemented locally** (updater.sh does NOT source
+  install.sh): `updates_pkg_is_apk` (`command -v apk`), `updates_pkg_install_file`
+  (apk add --allow-untrusted / opkg install, `</dev/null` non-interactive),
+  `updates_pkg_is_installed` (apk/opkg list grep), `updates_pkg_candidate_version`
+  (FEED version). Candidate parse, busybox-safe, NO Oniguruma: opkg `list <pkg>`
+  → `"<name> - <ver>"`, `awk -F' - ' '{print $2}'`; apk `list <pkg>` → first
+  token `<name>-<ver>`, strip `"<pkg>-"` prefix via `${line#"$pkg"-}`.
+- **Stock check `updates_check_sing_box_stable`**: mirrors the extended-check JSON
+  shape. Runs `opkg/apk update` best-effort first (`|| true`). status: candidate
+  empty → `success:false` (feed unreachable, return 1); sing-box absent
+  (`command -v`) → `not_installed`; else compare on LEADING semver `${v%%-*}`
+  (drops `-r1`/`-extended-…`) via `is_min_package_version` (sort -V) →
+  `latest`/`outdated`. NEVER exits. STABLE JSON: `{success,current_version,
+  latest_version,status:"latest"|"outdated"|"not_installed"}`.
+- **NetShift self-update = Variant A** (targeted pkg upgrade, NOT install.sh).
+  `updates_self_update_netshift` (public wrapper) COPIES the
+  `updates_install_sing_box_extended` epilogue EXACTLY: reset UPDATES_HEAL_*,
+  `updates_ensure_connectivity "extended"` (GitHub dir) else restore+fail JSON,
+  run `_updates_self_update_netshift_core >"$out"`, capture rc+json, rm, ALWAYS
+  `updates_restore_after_swap`, re-emit, `return $rc`. Single cleanup path; no
+  trap. Core is NON-interactive, all `local`, NEVER `exit`: idempotent guard
+  (`${installed#v}` == `${latest#v}` → "Already up to date"); minimal
+  `/etc/config/netshift` tmpfs backup; download assets matching pkg-name prefixes
+  (`netshift`,`luci-app-netshift`, RU i18n ONLY if `updates_pkg_is_installed`)
+  filtered to `.ipk`/`.apk` by pkg-mgr via `grep -o 'https://[^"[:space:]]*\.ext'`
+  (mirrors install.sh:269-274, busybox-safe); install core→luci→ru; core-install
+  fail is fatal-to-the-op (success:false + restore config), luci/ru fail is
+  non-critical (warn+continue); defensive config restore if live file empty.
+- **Self-replacement CONFIRMED safe**: the `netshift` pkg overwrites
+  `/usr/bin/netshift` (this very script). busybox ash reads the whole script into
+  memory before pkg_install; the async fork (`( trap '' HUP; "$0" component_action
+  netshift self_update >out; updates_write_finished_job_state ... )`) + the
+  finished-state write complete from memory. The self-update core has ZERO live
+  re-exec after install: NO `updates_restart_netshift`, NO `"$0"`, NO `exec`, NO
+  direct `/usr/bin/netshift` or `/etc/init.d/netshift` call. (Only path that runs
+  the init script is `updates_restore_after_swap`'s `/etc/init.d/netshift start`,
+  which fires ONLY if the heal tore the redirect down, AFTER install completes,
+  as a fresh subprocess that safely loads the on-disk binary.) UI (task-018)
+  reloads the page after success. Verified via `grep` of the core's line range.
+- **New constants** (constants.sh, NO ports/marks): `NETSHIFT_RELEASE_API_URL`
+  (= install.sh REPO / get_system_info :3347 endpoint),
+  `UPDATES_NETSHIFT_DOWNLOAD_DIR=/tmp/netshift/selfupdate`,
+  `UPDATES_NETSHIFT_CONFIG_BACKUP=/tmp/netshift/config.bak`,
+  `UPDATES_NETSHIFT_PKG_CORE/LUCI/I18N_RU`. `get_system_info` UNCHANGED (UI gets
+  versions there; stock check is a separate action — no missing field).
+- **Subshell-piped `while read url` loop can't set parent vars** (task-007
+  variant): `_updates_self_update_download_assets` re-checks the dir
+  (`ls "$dir/netshift"*`) AFTER the loop to decide success, not a flag set inside.
+- **Smoke tests `test_check_update_stable` (alias `stablecheck`, 4 cases) +
+  `test_self_update_netshift` (alias `selfupdate`, 13 assertions)**. Both source
+  the REAL updater.sh + helpers.sh, re-pin paths/constants, stub via markers.
+  `test_check_update_stable` KEY GOTCHA: `command -v sing-box` finds the real
+  `/usr/bin/sing-box`; to test `not_installed` I built an ISOLATED PATH dir of
+  symlinks to just the needed coreutils (NO /usr/bin in PATH) and linked the fake
+  sing-box in/out per scenario. `test_self_update_netshift` overrides
+  `updates_http_get_once` (GitHub JSON) + `updates_download_to_file` in the driver
+  + stubs opkg `install`/`list-installed` (logs installs) + fake `/etc/init.d/
+  netshift` (absolute write+restore). Registered all 5 points (all)/case/usage/
+  compose). Used task-009 `... || true` set -e guard. shellcheck -S error clean;
+  `smoke-tests all` = 101 passed / 0 failed (was 84 baseline; +17 new).
+
+## task-019: extended-check false "outdated" — v-prefix mismatch (Variant A)
+
+- Root cause: `updates_check_sing_box_extended` (updater.sh ~:1245) compared
+  installed `get_sing_box_version` (`1.13.12-extended-2.3.2`, NO v) against the
+  GitHub `.tag_name` (`v1.13.12-extended-2.3.2`, WITH v) via `case
+  "$current_version" in *"$tag"*)`. The `v` prefix means the substring never
+  matched → fell through to `outdated` for a user ALREADY on the latest. (Stock
+  check + self-update were already correct: stock candidates have no v;
+  `_updates_self_update_netshift_core` already does `${installed#v}` ==
+  `${latest#v}`.)
+- Fix (Variant A, ONLY this function): strip a single leading v off BOTH sides
+  (`cur_norm="${current_version#v}"; tag_norm="${tag#v}"`; `${x#v}` removes one
+  leading v if present, no-op otherwise), then EXACT-compare `[ "$cur_norm" =
+  "$tag_norm" ]` (the extended version is the full token — exact-after-v-strip is
+  correct and avoids the partial matches the old `case *"$tag"*` allowed). Emit
+  BOTH `current_version` and `latest_version` v-stripped so the UI shows a
+  consistent string. JSON shape/keys/order unchanged (STABLE for task-018);
+  `success:false` branches (fetch fail, no tag) untouched. New vars `local`,
+  POSIX ash, never exits.
+- CRITICAL isolation: the install/asset path is a SEPARATE function
+  (`_updates_install_sing_box_extended_core`, ~:942-957) that re-derives its OWN
+  `tag` from `updates_extended_release_tag` (raw, WITH v) and feeds it to
+  `updates_extended_release_object` (`.tag_name == $t`) + `updates_extended_asset_url`.
+  In the check, `tag` (raw) is NO LONGER fed anywhere downstream — only `cur_norm`/
+  `tag_norm`. Did NOT touch `_release_tag`/`_release_object`/`_asset_url`/wrappers.
+- Smoke: NEW top-level `test_check_update_extended` (alias `extcheck`, 3 cases).
+  updater.sh is a sourceable lib, so the driver sources updater.sh + helpers.sh,
+  silences log/echolog/nolog, then OVERRIDES the 3 deps AFTER sourcing
+  (`get_sing_box_version`, `updates_fetch_sing_box_extended_releases`,
+  `updates_extended_release_tag`) reading marker env (`STUBEXT_INSTALLED/RELEASES/TAG`)
+  — simpler than awk-extract since it's not in bin/netshift. Cases: (1) installed
+  == latest, only tag has v → latest + both v-stripped+equal (THE regression);
+  (2) installed older → outdated; (3) empty releases → success:false. Registered
+   all 5 points (all)/case/usage/docker-compose comment). shellcheck -S error clean
+   (bin+libs+install.sh); `smoke-tests all` = 104 passed / 0 failed (101 baseline
+   + 3 new). `extcheck` alone = 3/0.
+
+## task-020a: drop stale "mangle output counters" diagnostic (PR#11 B-02 align)
+
+- The diagnostic function the spec calls `check_nft` is actually named
+  **`check_nft_rules`** in bin/netshift. After PR#11 (router-originated traffic
+  intentionally DIRECT) the `mangle_output` chain's only counter rule
+  (`meta mark 0x00200000 counter return`) is essentially never hit → counter
+  legitimately 0 → the old non-zero-counter assertion produced a FALSE ⚠️.
+  Operator decision Variant A = REMOVE the "mangle output counters" check
+  entirely; KEEP "mangle output exist".
+- Backend fix (bin/netshift ONLY, 6 deletions): in `check_nft_rules` removed the
+  `rules_mangle_output_counters` local, the inner `grep -qv "packets 0 bytes 0"`
+  block that set it, and the key from the emitted JSON echo. In `global_check`
+  removed it from the `local` decl, its `jq -r '.rules_mangle_output_counters //
+  0'` read, and the `if ... ✅/⚠️ Rules mangle output counters` print block.
+  KEPT the existence check (`grep -q "counter" → rules_mangle_output_exist=1`)
+  and its ✅/❌ print. Did NOT touch mangle(prerouting)/proxy/other_mark or
+  `create_nft_rules`.
+- **STABLE check_nft_rules JSON shape (cross-layer contract for frontend 020b),
+  exactly ONE key removed, order otherwise unchanged:** `{table_exist,
+  rules_mangle_exist, rules_mangle_counters, rules_mangle_output_exist,
+  rules_proxy_exist, rules_proxy_counters, rules_other_mark_exist}`.
+- **No smoke test referenced the field** — `tests/entrypoint.sh` has no
+  `test_diagnostics`/nft-check assertion on the check_nft_rules JSON at all (the
+  `nft` category tests rule installation, not the diagnostic JSON keys). So no
+  smoke change and no registration change. Diagnostics-only edit (read-only
+  checks), NOT a routing/config change — nft model unchanged. shellcheck -S error
+  clean; `smoke-tests all` = 104 passed / 0 failed (unchanged baseline); UTF-8
+  intact (iconv round-trip OK, 0 рџ/в”/†mojibake).
+
+## task-021b: opt-in insecure subscription fetch (--no-check-certificate)
+
+- Cross-layer UCI contract (STABLE, shared with 021a frontend):
+  `option subscription_insecure '0'` (0|1), per `config section`. Default OFF =
+  unchanged secure behavior. On device wget=uclient-fetch supports
+  `--no-check-certificate` (confirmed) — for IP-host panels with invalid/
+  self-signed/missing-SAN HTTPS certs.
+- `download_subscription` (helpers.sh) had SIX identical wget invocations (4 in
+  the main loop: ipv4/normal × proxy/no-proxy + 2 in the IPv4 retry), each with
+  the same 7 `--header` set. Refactored ALL six through a new private helper
+  `_wget_subscription_request "$cert_flag" UA HWID MODEL KERNEL OUT ERR URL --
+  <leading flags>`: it runs `wget $cert_flag "$@" -O "$out" <headers> "$url"
+  2>"$err"`. The `$cert_flag` is the ONE intentional unquoted expansion
+  (`# shellcheck disable=SC2086` on that line): empty string word-splits to ZERO
+  args (byte-identical secure default), `--no-check-certificate` adds exactly
+  one. NO eval. Per-branch `-4`/`-T <timeout>` are passed as the trailing
+  `"$@"` flags; proxy env (`http_proxy=`/`https_proxy=`) still set on the call
+  line. Retry/fallback/rc/mv/errfile logic untouched.
+- 8th positional `insecure="${8:-0}"`; `cert_flag` derived once at top
+  (`[ "$insecure" = "1" ]`).
+- bin/netshift `download_subscription_into_cache`: read
+  `subscription_insecure="$(uci -q get "netshift.${section}.subscription_insecure"
+  2>/dev/null)"`, default 0, log ONE redacted `warn`
+  (`...uses --no-check-certificate (TLS verification disabled): url=$(redact_url_for_log ...)`)
+  when =1, pass as the NEW 8th arg after the existing
+  `... 3 2 10 "$effective_user_agent"`. Declared `local subscription_insecure`.
+- UCI example: added commented `#option subscription_insecure '0'` + 3-line
+  comment near the `subscription_url` example in `etc/config/netshift`.
+- Smoke: NEW top-level `test_insecure_fetch` (alias `insecure`, 6 cases). A
+  PATH-prepended fake `wget` records full argv (`printf '%s\n' "$*"`) and writes
+  a dummy body to its `-O` target so attempt-1 succeeds (no retry). Driver
+  sources REAL helpers.sh, stubs log/metadata helpers + `should_force_wget_ipv4`
+  (per-scenario normal vs ipv4) + inert `has_ipv4_default_route`/
+  `wget_supports_ipv4_flag`. Asserts `--no-check-certificate` ABSENT@insecure=0 /
+  PRESENT@insecure=1 across normal+proxy+ipv4 branches (`-4` co-present on ipv4).
+  Registered all 5 points (all)/case alias/usage line/docker-compose comment).
+  shellcheck -S error clean; `smoke-tests all` = 110 passed / 0 failed (104
+  baseline + 6 new); UTF-8/LF intact. Additive, NO runtime-contract change.
+
+## task-022: multiple subscription_url feeds per section (merge pipeline)
+
+- **subscription_url is now a UCI list.** Back-compat verified: a lone legacy
+  `option subscription_url` is read by `config_list_foreach` as a 1-element list
+  (same as community_lists) — NO migration code. New collector
+  `get_subscription_urls_for_section` resets global `SUBSCRIPTION_URLS_COLLECTED`,
+  runs `config_list_foreach "$section" "subscription_url" _collect_..._handler`,
+  prints newline-delimited URLs. URLs are opaque user text → ALWAYS
+  newline-delimited + `while IFS= read -r` from a temp file, NEVER word-split.
+- **Per-URL cache keying = ALWAYS hash (recommendation ii).** `get_subscription_url_hash`
+  = `printf '%s' "$url" | md5sum | awk '{print $1}'`. The 4 cache-path builders
+  gained an OPTIONAL 2nd arg `urlhash`: `${section}${urlhash:+.$urlhash}.<ext>`
+  — present = hashed `${section}.<hash>.<ext>`, absent = legacy bare path (kept
+  only for the tmp-migration source + the reaper). New
+  `reap_legacy_subscription_cache_files "$section"` rm's the 4 bare files; called
+  at the top of startup/refresh/config-gen so a stale bare body is never read.
+  `subscription_cache_is_usable` derives rejected via `${json%.json}.rejected`
+  which maps correctly onto the hashed path (no change needed there).
+- **download_subscription_into_cache gained a 6th positional `urlhash`** used for
+  the UA + rejected cache paths (json/url paths are already passed in as $3/$4).
+- **Merge-file approach (primary, chosen — NOT the per-feed-loop fallback).** In
+  the config-gen `subscription)` branch: (1) per-feed best-effort download loop
+  (one dead feed never aborts others); (2) concat every `subscription_cache_is_usable`
+  feed's PROXY `.outbounds[]` into one temp `{"outbounds":[...]}` under
+  `TMP_SUBSCRIPTION_MERGE_FOLDER` (new constant) via
+  `jq -c --slurpfile feed '... .outbounds += [ $feed[0].outbounds[]? | select(not selector/urltest/direct/dns/block) ]'`
+  (NO Oniguruma — pure array concat); (3) call
+  `sing_box_cf_add_subscription_outbounds` ONCE on the merged file. WHY merge-file:
+  the facade RESETS its public globals every call (`:757-760`) AND seeds the
+  dedup `used`-set from tags already in `$config`, so a single call over the
+  union reuses the keyword filter + GLOBAL tag-dedup (auto `-1`/`-2`…) + per-batch
+  `sing-box check` bisection + the country-group/selector builder UNCHANGED. The
+  per-feed-loop fallback would force me to re-accumulate SUBSCRIPTION_OUTBOUND_TAGS_JSON
+  by hand (facade resets it each call) — strictly more code for the same result.
+- **Dedup suffix is `-1` then `-2`** (facade loops `range(1; ...)` →
+  `$base + "-" + n`), so two same-named nodes become `X` and `X-1` (NOT `X-2`).
+  Assert base + any `startswith("X-")`, not a specific number.
+- **Best-effort semantics:** section "available" iff merged set has ≥1 proxy
+  (`usable_feed_count>0 && merged_node_count>0`); else
+  `mark_subscription_outbound_unavailable "$section" "$kw_filter_active"` as
+  before. Startup/refresh: section "changed"→restart if ANY feed changed (rc 0);
+  section "failed" only if NO feed usable AND none changed. Per-feed rc 2
+  (unchanged) counts as usable, not failed.
+- **mark_subscription_outbound_unavailable is now per-URL** (memory landmine:
+  keep rejected-hash PER-URL so one bad feed can't poison another). It iterates
+  the section's URLs: keyword-filter case → `rm` each per-URL `.rejected`
+  (self-heal); genuine case → write each usable cached feed's md5 to its per-URL
+  `.rejected`. The section-level unavailable LIST + `subscription_startup_blocked`
+  stay section-level.
+- **section_has_usable_subscription_cache** (new) returns 0 if ANY per-URL cache
+  is usable; replaces the single-json `subscription_cache_is_usable` checks in
+  `get_subscription_download_proxy_address`. Uses temp-file + `while read` (NOT a
+  pipe) so the `found` flag survives.
+- **migrate_subscription_cache_from_tmp** now maps a bare tmp `<section>.json`
+  onto the hashed dest of the URL in its `.url` sidecar (else the section's first
+  configured URL) so a legacy single-feed upgrade keeps working w/o re-download.
+- **Smoke landmine (test stub):** the REAL LuCI `config_list_foreach` iterates in
+  the CURRENT shell (no pipe) so the callback mutates accumulator globals. A test
+  stub that pipes `printf | while` subshell-traps the mutation → collector
+  returns empty. Stub MUST use temp-file + `while read`. Likewise the facade sets
+  globals (SUBSCRIPTION_OUTBOUND_TAGS*) — call it `>/dev/null` (like the real
+  bin) and read `$SING_BOX_CF_LAST_CONFIG`, NOT `out=$(facade ...)` (the `$()`
+  subshell drops the globals). Both cost a debug cycle.
+- Extended `test_subscription` with the 6 spec cases (no registration change —
+  `subscription` already in `all)`): mu-case1 multi-URL merge (count+both feeds+
+  tags-json), mu-case2 same-name dedup (no dup tags + suffix present), mu-case3
+  partial best-effort (A usable/B invalid → still available, not unavailable),
+  mu-case4 all-fail→unavailable, mu-case5 cache-key isolation (distinct
+  `${section}.<hash>.json` + per-URL `.rejected`), mu-case6 single-option
+  back-compat (1-elem list + working config). Driver awk-extracts the shipped
+  path/hash/collector/cache-usable/mark-unavailable fns + mirrors the inline
+  merge jq; feeds are stock shadowsocks so the live `sing-box check` accepts them.
+- shellcheck -S error clean (bin+libs+install.sh); `smoke-tests all` = 110 passed
+  / 0 failed (per-test ✓ marks are truth: 12 green mu-case marks; suite total
+  unchanged due to the documented piped-while subshell counter quirk). UTF-8
+  intact. New constant `TMP_SUBSCRIPTION_MERGE_FOLDER`; UCI example documents the
+  `list subscription_url` form. NO sacred constant/port/mark/path changed.
+
+## task-027: core-swap backup integrity (truncated-rollback anti-segfault)
+
+- Root cause (hardware, OpenWrt 25, armv7, tiny overlay): the tmpfs core backup
+  used `cp -p ... 2>/dev/null` checking ONLY cp's rc. busybox `cp` can TRUNCATE
+  under tmpfs ENOSPC and still return 0, so a partial backup passed the "Failed
+  to backup current sing-box binary" guard; then the rollback `mv backup ->
+  /usr/bin/sing-box` restored a 12.7 MB stub in place of the real ~40 MB core →
+  segfault (rc 139) on every invocation. The rollback IS the safety net, so a
+  corrupt backup is strictly worse than not rolling back.
+- Two new helpers at the top of `updater.sh` (next to `updates_log`):
+  `updates_verify_copy src dst` (0 iff dst exists and `wc -c < dst` == `wc -c <
+  src`; absent src → 0 = nothing to back up) and `updates_backup_is_complete
+  backup expected_size` (0 iff backup exists and `wc -c` == the stashed size).
+  Size-match only — guarding TRUNCATION not bit-rot; do NOT md5/sha a 40 MB
+  binary on slow armv7. busybox-safe `wc -c < file` (NOT GNU stat).
+- **Stash the expected size at backup time.** After each backup `cp` succeeds +
+  verifies, record `backup_binary_size="$(wc -c < "$backup_binary")"` (and
+  `backup_cronet_size`) into NEW locals. Rollbacks compare the backup's current
+  size against that stash (not against the live `/usr/bin/sing-box`, which the
+  half-written extract may have already clobbered). For `updates_stable_rollback`
+  the sizes are passed as NEW args $3/$4 — both call sites updated.
+- Backup-cp gates (4): extended binary, extended libcronet, stable binary,
+  stable libcronet — each `if ! cp -p ... || ! updates_verify_copy ...; then`
+  inside the EXISTING abort path that fires BEFORE the live binary is touched →
+  healthy box = no-op pass, working core left intact on failure.
+- Rollback restore guards (4 sites): extended extract-fail, extended cronet-fail,
+  extended validation-fail, and shared `updates_stable_rollback`. Pattern: `if
+  updates_backup_is_complete "$backup" "$size"; then mv -f ...; else updates_log
+  "...backup is corrupt/incomplete; NOT restoring to avoid installing a broken
+  core" "error"; fi`. NEVER overwrite live from a truncated backup.
+- CRITICAL: this runs inside the `component_action` async worker → NO `exit 1`
+  (would kill the worker, skip JSON emission + restore epilogue). The corrupt-
+  backup branches just `updates_log "..." "error"` and fall through to the
+  existing `echo "{...success:false...}"; return 1` honest-failure path. Did NOT
+  touch download/extract streaming (rm-then-stream), connectivity self-heal,
+  async machinery, or any constant.
+- Smoke: NEW top-level `test_backup_integrity` (alias `backupguard`, 10
+  assertions). Driver sources REAL updater.sh, silences log, re-pins
+  `UPDATES_SING_BOX_BIN`/`UPDATES_LIBCRONET_LIB` to /tmp temp files (so the
+  container's real binary is untouched), builds 64-byte src + complete + 10-byte
+  truncated fixtures via `dd`, then drives the 3 helpers + `updates_stable_rollback`
+  with truncated vs complete backups (asserts live marker survives the truncated
+  rollback AND the complete one overwrites it). Parsed in the CURRENT shell
+  (`while read < "$out"`, no pipe) so PASS counts are EXACT (avoids the
+  piped-while subshell counter quirk). Registered all 5 points (all)/case alias/
+  usage line/docker-compose comment). shellcheck -S error clean (bin+libs+
+  install.sh); `smoke-tests all` = 120 passed / 0 failed (110 baseline + 10 new).
+
+## task-029: NetShift latest-version check on-demand (stop auto-fetch in get_system_info)
+
+- Root cause: `get_system_info` (bin/netshift) did `curl -m 3 ... releases/latest`
+  on EVERY call, and the UI calls it on Manager/Diagnostic mount → a GitHub hit
+  on every page load. Cores do it right via on-demand `component_action`.
+- Fix 1 (get_system_info): REMOVED the curl + the `[ -z ] && unknown` line;
+  replaced with the constant `netshift_latest_version="unknown"`. The KEY stays
+  (frontend type + global_check jq read it; "unknown" is the zero-network
+  sentinel the UI understands). Function now does ZERO network I/O.
+- Fix 2 (new worker `updates_check_netshift`, updater.sh, right after
+  `updates_check_sing_box_stable`): SYNC component_action worker, NEVER exits
+  (echo JSON; return N). Reused the EXISTING shared helper
+  `updates_netshift_latest_tag` (already there from task-017: `updates_http_get_once
+  "$NETSHIFT_RELEASE_API_URL"` then `grep '"tag_name":' | head -n1 | cut -d'"' -f4`)
+  — did NOT add a new helper or a new curl. Empty tag → `{"success":false,
+  "message":"..."}` return 1 (mirrors stable "feed unreachable"). v-normalization:
+  `cur_norm="${current_version#v}"; latest_norm="${latest#v}"` then leading-semver
+  `${x%%-*}`, compared via `is_min_package_version` (sort -V `>=`) → latest/outdated.
+  JSON shape IDENTICAL to `updates_check_sing_box_stable`
+  (`success/current_version/latest_version/status`) so frontend
+  `parseComponentCheckUpdate` is unchanged.
+- DEV-BUILD decision: if `$NETSHIFT_VERSION` is the unstamped placeholder
+  (`*COMPILED*` — it's `__COMPILED_VERSION_VARIABLE__`), report `status:"latest"`
+  (a dev build is never "outdated"; UI also guards dev separately). It STILL
+  fetches the real tag for display, and STILL returns success:false on an
+  unreachable feed (honest failure even for dev).
+- Router: added `netshift:check_update) updates_check_netshift ;;` next to the
+  existing `netshift:self_update` in `component_action()`. NO ACL change
+  (component_action is wholesale exec-allowed); NO new top-level command.
+- Fix 3 (global_check, bin/netshift): since get_system_info no longer carries the
+  real latest, global_check now calls `updates_netshift_latest_tag` itself
+  (`netshift_latest_version=$(updates_netshift_latest_tag); [ -z ] && ="unknown"`)
+  so the `🕳️ NetShift: <ver> (latest: <latest>)` line still shows the true latest.
+  A network call here is fine — one-shot SSH diagnostic, not the UI mount path.
+  updater.sh is sourced by bin/netshift so the helper is in scope.
+- Constant: `NETSHIFT_RELEASE_API_URL` already existed (task-017) — reused, none
+  added.
+- Smoke: NEW top-level `test_check_update_netshift` (alias `netshiftcheck`, 7
+  assertions). Part A = STATIC awk-extract of `get_system_info` body + assert NO
+  `releases/latest` and `netshift_latest_version="unknown"` present. Part B =
+  driver sources updater.sh+helpers.sh, silences log, OVERRIDES
+  `updates_netshift_latest_tag` + sets `NETSHIFT_VERSION` (mirrors the
+  test_check_update_extended stub style), runs the worker. Cases: v0.8.6 vs 0.8.6
+  →latest; 0.8.5 vs 0.8.6→outdated; v0.8.6 vs v0.8.6→latest; JSON-shape has-keys;
+  empty tag→success:false; placeholder dev-build→latest. Registered all 5 points
+  (all)/case alias/usage line/docker-compose comment). shellcheck -S error clean
+  (bin+libs+install.sh); `smoke-tests all` = 127 passed / 0 failed (120 baseline
+  + 7 new). NO sacred constant/port/mark/path/ACL/frontend change.
+
+## task-031 — subscription_format_preference (UA probe reorder)
+
+- Per-section UCI option `subscription_format_preference` (auto|xray|singbox,
+  default auto) REORDERS the UA candidate probe so xray-yielding UAs can be
+  tried FIRST. Root cause it fixes: the download probe loop in
+  `download_subscription_into_cache` (bin/netshift) breaks on the first usable
+  body, so the always-first `singbox/<ver>` UA wins and the Happ/v2rayN UA
+  (which some panels answer with Xray JSON carrying xhttp nodes) is never tried.
+  We ONLY reorder — first-usable-still-wins loop is untouched.
+- `build_subscription_user_agent_candidates` (helpers.sh ~746) now takes a 3rd
+  arg `format_preference`. Configured-UA short-circuit (arg1 set → emit only it)
+  is UNCHANGED and still outranks preference. For auto-mode ordering I switched
+  from a fixed `for candidate in ...` list to `set -- <list>; for candidate in
+  "$@"` so I could pick the list by preference in an `if`:
+  - xray: `set -- $SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES "$default" "$pref" $SUBSCRIPTION_USER_AGENT_CANDIDATES`
+  - else (auto/empty/singbox/unknown): `set -- "$default" "$pref" $SUBSCRIPTION_USER_AGENT_CANDIDATES` (today's exact order).
+  The EXISTING newline `seen` dedup loop is reused unchanged → xray UAs precede
+  the cached winner AND default, and nothing is emitted twice. Unknown values
+  fall through `else` = auto (forward-compatible). Keep the
+  `# shellcheck disable=SC2086` intentional-word-split comment on EACH `set --`
+  line that splices a `$LIST`.
+- New constant: `SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES="v2rayN Happ"` in
+  constants.sh next to `SUBSCRIPTION_USER_AGENT_CANDIDATES` (the xray subset;
+  no inline magic strings per project-core §5).
+- bin/netshift `download_subscription_into_cache` (~530): added local
+  `subscription_format_preference`, read via
+  `uci -q get netshift.${section}.subscription_format_preference`, default
+  "auto" when empty, passed as 3rd arg to the builder (~539). Per-URL cache +
+  UA-winner caching unchanged.
+- UCI example (etc/config/netshift) documents BOTH the new option AND the
+  previously-read-but-undocumented `subscription_user_agent` (schema honesty).
+- Tests: extended existing CASE I in `test_subscription`'s `fb` sub-script
+  (which sources real constants.sh+helpers.sh under ash). Added cases c2–h:
+  empty/auto/singbox→default first; xray→v2rayN,Happ first + outrank
+  default&cached pref + dedup; unknown→auto; configured+xray→only configured.
+  The `fb` parser is generic `*:OK`/`*:FAIL`, so new `fb-caseI-*` lines need NO
+  case alias. shellcheck -S error clean; `smoke-tests all` = 127 passed /
+  0 failed (+8 new CASE-I assertions, same 127 total since they're sub-tokens).
+- GOTCHA: `test_rejected_hash` emits `rh-case1/2/6:FAIL` sub-tokens that print
+  red but are NOT counted by the global tally (suite still EXIT=0, 127/0) — this
+  is PRE-EXISTING on the clean tree (verified by git stash), not a regression.
+
+## task-033: multi-section direct-out i/o timeout — egress mark gap (route.default_mark)
+
+- ROOT CAUSE (confirmed on a LIVE kernel in the smoke container): the 0.8.6
+  "mark everything" nft model marks ALL LAN tcp/udp with NFT_FAKEIP_MARK
+  (0x00100000) in `mangle` prerouting, and `ip rule fwmark 0x00100000 lookup
+  netshift` (table `netshift` = `local default dev lo`) redirects it to tproxy.
+  But NOTHING stamped a mark on sing-box's OWN egress. So sing-box's outbound
+  sockets — especially `direct-out`, which under route.final=direct-out now
+  carries ALL unmatched + proxy-server-dial + DNS-upstream traffic — inherited
+  the tproxy SO_MARK (0x00100000), and the SAME `ip rule` re-captured them into
+  `local lo` -> looped back into tproxy -> never reached the internet. That is
+  the exact `outbound/direct[direct-out]: i/o timeout` triad (+ DNS n/a, since
+  the DNS upstream egress looped too). 0.8.5 masked it: destination-selective
+  marking meant unrelated traffic never entered sing-box.
+- LIVE PROOF (decisive, reproducible with only busybox curl+nft+ip in the
+  container — NO netns/veth needed): install the real `ip rule fwmark
+  0x00100000 lookup netshift` + a tiny `type route hook output` nft chain that
+  sets a chosen mark on egress to a test IP, then `curl -m`:
+  * egress UNMARKED  -> rc=301 ~0.1s (control, reaches internet)
+  * egress mark 0x00100000 (FAKEIP) -> rc=28 timeout 5s = LOOP/BLACKHOLE (bug)
+  * egress mark 0x00200000 (OUTBOUND) -> rc=301 ~0.15s = ESCAPES (fix)
+  Because `ip rule 105` matches ONLY 0x00100000, a 0x00200000-marked egress
+  falls through to the main table and egresses normally.
+- FIX (minimal, fail-open, B-variant per spec — keep mark-everything but make it
+  fail OPEN): emit `route.default_mark = NFT_OUTBOUND_MARK` so every sing-box
+  egress connection is stamped 0x00200000. Per sing-box docs, route.default_mark
+  is "Set routing mark by default" (Linux), overridden by outbound.routing_mark.
+  This makes ALL egress (direct-out, proxy-server dials, DNS upstream) escape
+  the `ip rule`, and the EXISTING `mangle_output meta mark 0x00200000 return`
+  rule (previously dead — nothing set it) now actually fires to keep that egress
+  out of the proxy chain. NO sacred VALUE changed — only newly APPLYING the
+  existing NFT_OUTBOUND_MARK constant to egress (explicitly allowed by the spec).
+- IMPL: `sing_box_cm_configure_route` gained optional 6th arg `default_mark`
+  (sing_box_config_manager.sh) merged conditionally
+  (`+ (if $default_mark != "" then {default_mark: ($default_mark|tonumber)}
+  else {} end)`) — EMPTY arg is byte-identical to the legacy 5-arg call
+  (back-compat asserted in smoke). Caller `sing_box_configure_route`
+  (bin/netshift) derives `default_egress_mark=$(( NFT_OUTBOUND_MARK ))` (ash
+  arithmetic converts the hex `0x00200000` -> decimal `2097152`; sing-box
+  default_mark is an INTEGER, jq `tonumber` does NOT parse hex so pass decimal)
+  and passes it to BOTH branches (auto-detect "" iface + explicit iface).
+- FEATURES PRESERVED: default_mark is route-global -> applies to v4 AND v6 egress
+  (both ip rules match only FAKEIP_MARK, so both escape). DoH-block / per-section
+  route rules / DNS-over-proxy are route.rules / dns.servers — untouched. IPv6
+  inbounds/sets/rules untouched. Verified v6 + explicit-interface variants both
+  carry default_mark=2097152 and `sing-box check` passes.
+- SMOKE: new top-level `test_section_isolation` (alias `isolation`, after
+  test_nft_ipv6). 8 asserts: (a) config-gen contract — default_mark present as a
+  NUMBER == decimal NFT_OUTBOUND_MARK, distinct from FAKEIP mark, empty-arg
+  byte-parity + key-omitted; (b) 2-section config (section 2 hysteria2
+  UNREACHABLE) with the REAL generated route passes `sing-box check` + carries
+  default_mark; (c) LIVE-kernel fail-open proof (gated on nft+curl+net+!SKIP):
+  fakeip-marked egress black-holes, outbound-marked egress escapes. Registered
+  all 5 points (all)/case alias/usage line/docker-compose comment).
+- GOTCHA repeats bitten: (1) `$$` inside a heredoc driver expands to the
+  DRIVER's pid, not the entrypoint's — pass output paths in via sed
+  placeholder, don't rely on `$$` matching across the two shells. (2) The
+  generic `*:OK)` case pattern does NOT match a line with trailing text like
+  `si-...:OK (2097152, number)` — use `*:OK*`/`*:FAIL*` (FAIL first). (3)
+  Under the suite's `set -e`, bare `ip -4 rule del ... 2>/dev/null` /
+  `nft delete ...` abort the whole function when the object is absent — guard
+  EACH with `|| true`. (4) Driver-extracted route needs
+  `del(.route.rules[]?.__service_tag)` before `sing-box check` (the strip
+  normally happens in sing_box_cm_save_config_to_file's walk()).
+- shellcheck -S error clean (bin + sing_box_config_manager.sh + install.sh);
+  `smoke-tests all` = 131 passed / 0 failed (was 127 baseline; `isolation`'s 4
+  direct pass calls counted, its 8 piped-while ✓ marks are the source of truth,
+  all green). The pre-existing `rh-case1/2/6:FAIL` red marks persist (documented
+  task-031 quirk, suite still EXIT=0).
+
+## task-034 — Destination-selective nft marking (CPU regression fix)
+
+- ROOT: 0.8.6 marked ALL LAN tcp/udp into tproxy (mangle prerouting), so every
+  forwarded flow entered sing-box (sniff + full route-rule walk per conn) →
+  100% CPU on weak routers. 0.8.5 marked SELECTIVELY: only `@netshift_subnets`
+  (proxied dest subnets) + FakeIP range `198.18.0.0/15` (proxied domains).
+  Commit 03806d7 went mark-all; d391e32 then deleted NFT_COMMON_SET_NAME + its
+  population. Restored Option-1 selective marking.
+- KEY INSIGHT: nft only decides ENTER-or-not. Inside sing-box, per-section
+  ip_cidr/domain route rules still pick `<section>-out`. So ONE union nft set
+  (all sections' proxied subnets) + FakeIP range gates ingress; multi-section
+  outbound selection is unaffected. No per-section nft sets needed.
+- Re-added `NFT_COMMON_SET_NAME="netshift_subnets"` + v6 mirror
+  `NFT_COMMON_SET_NAME_V6` to constants.sh (NEW SET, not a changed sacred
+  value). Created in create_nft_rules (v4 always, v6 only if
+  netshift_ipv6_enabled).
+- New prerouting mangle (DEFAULT, no global_proxy): `ip daddr @localv4 return`
+  (kept) → `ip daddr @netshift_subnets mark set FAKEIP_MARK` → `ip daddr
+  198.18.0.0/15 mark set` → (ipv6: `@netshift_subnets_v6` + `fd00:ec3a::/32`) →
+  DoH-block CIDRs inline when block_doh=1. NO unconditional mark-all.
+- GLOBAL_PROXY OVERRIDE: `get_global_proxy_section` is a standalone UCI-only
+  helper (reads config_foreach, NOT the `$config` string) so create_nft_rules
+  can call it directly (it runs separately from sing_box_configure_route). When
+  non-empty → keep mark-EVERYTHING tcp/udp (global proxy wants all traffic in).
+- fully_routed_ips are SOURCE clients (source_ip_cidr) — selective dest marking
+  would bypass them for direct dests. Added `nft_mark_fully_routed_source_ips`
+  (config_foreach over proxy/vpn sections) emitting `ip[6] saddr <ip> mark set`
+  rules in the default branch only (global_proxy already marks all).
+- ONE centralized population point (no drift): `populate_netshift_subnets_from_file`
+  / `_from_string` feed the nft union set (v4 via nft_add_set_elements_from_file_chunked,
+  v6 via NEW `nft_add_set_elements_from_file_chunked_v6` in nft.sh — splits by
+  presence of `:`; there is NO is_ipv6 helper). Called ALONGSIDE every sing-box
+  ip_cidr rule_set population: configure_user_subnet_list (string),
+  import_local_subnets_list_handler (file), import_community_service_subnet_list_handler
+  (restored twitter/meta/telegram/cloudflare/hetzner/ovh/digitalocean/cloudfront/
+  roblox/discord URLs; discord ALSO keeps its dport set), import_subnets_from_remote_*
+  (restored json/srs extract via extract_ip_cidr_from_json_ruleset_to_file +
+  decompile_binary_ruleset; plain too).
+- TIMING: user/local subnets populate at config-gen (sing_box_init_config, after
+  create_nft_rules → set exists). community/remote populate in background
+  list_update (set exists; ensure_nft_ready_for_list_update recreates table if
+  missing). reload/restart = stop+start so both regenerate. Matches 0.8.5.
+- PRESERVED: dns-in (127.0.0.42:53) is a separate inbound, not via marked
+  tproxy — localv4 return (127.0.0.0/8) doesn't break DNS steering. Domain
+  routing via FakeIP range mark. task-033 route.default_mark + mangle_output
+  router-origin direct UNTOUCHED. discord dport rule + general @set rule both
+  just set the same mark (idempotent, no shadow/double-mark harm).
+- TEST: new `test_selective_marking` (alias `selmark`) awk-extracts the SHIPPED
+  create_nft_rules + helpers VERBATIM, stubs UCI/predicates via SCN_* env,
+  builds the REAL ruleset on a real nft table (override NFT_TABLE_NAME), dumps
+  `nft list chain ... mangle` and asserts: (1) @set+FakeIP present & NO mark-all
+  (structural: `meta mark set` + `l4proto` line WITHOUT daddr/saddr = mark-all),
+  (2) direct-IP bypass = that mark-all absent, (3) global_proxy → mark-all
+  present + @set absent, (4) ipv6 mirror present + no mark-all + FakeIP v6,
+  (5) fully_routed saddr rule + sing-box check on a 2-section config. 12 asserts
+  all green on real nft. Registered all)/alias/usage/compose comment.
+- GATES: shellcheck -S error clean (bin + nft.sh + constants.sh + install.sh +
+  tests). `smoke-tests all` = 143 passed / 0 failed.
+
+## task-034 RE-OPEN: create_nft_rules was NOT idempotent (stale mark-all survived)
+
+- HARDWARE BUG the first pass + smoke missed: on a real router the LIVE mangle
+  chain was STILL mark-all + the `netshift_subnets` set was absent, even though
+  the installed bin had the selective code and `get_global_proxy_section`
+  returned empty. CONTRADICTION: stubbed-nft trace = selective; real-nft service
+  start = mark-all.
+- HYPOTHESIS VERDICT: **H1 FALSE, H2-variant TRUE.** Faithful container repro
+  (REAL get_global_proxy_section / _determine_global_proxy_section /
+  section_has_configured_outbound / get_subscription_urls_for_section via a real
+  `config_load` of a hardware-shaped config: one subscription proxy section,
+  global_proxy=0) confirmed `get_global_proxy_section` correctly returns EMPTY →
+  selective branch taken (H1 false; the mark-all branch is NOT wrongly entered).
+  The mark-all rules came from a LEFTOVER table (H2): `create_nft_rules` is NOT
+  idempotent — `nft add chain`/`nft add rule` only ever APPEND, and the function
+  did `nft add table` (idempotent, no flush) but never deleted the existing
+  table. So a `NetShiftTable` left behind by a previous start that was not
+  cleanly stopped — **procd respawn (`command /usr/bin/netshift start` re-run
+  with no `stop`), in-place package upgrade, or a crash** — keeps its stale
+  rules and the new selective rules pile on TOP. A stale mark-EVERYTHING rule
+  (from a prior global_proxy run or the 0.8.6 mark-all build) sits at the TOP of
+  the prerouting chain and marks ALL traffic before the new destination-selective
+  rules ever evaluate → "everything proxied / 100% CPU" even though the selective
+  code is present. Reproduced in-container: two consecutive create_nft_rules
+  (1st global_proxy, 2nd selective, NO stop between) → final chain had BOTH the
+  mark-all rules (first) AND the selective rules (dead). `stop_main` DOES delete
+  the table, so the clean stop→start path was always fine; the bug only bit the
+  no-stop respawn/upgrade path. `ensure_nft_ready_for_list_update` only calls
+  create_nft_rules when the table is MISSING, so it was never the rebuild path.
+- FIX (minimal, deterministic): new `nft_delete_table` helper in nft.sh (delete
+  inet table iff it exists, fail-open `2>/dev/null`) called at the TOP of
+  create_nft_rules (`log "Flush stale nft table before rebuild"; nft_delete_table
+  "$NFT_TABLE_NAME"`) BEFORE `nft_create_table`. create_nft_rules rebuilds the
+  whole table (sets+chains+rules) from scratch, so flush-first is safe and makes
+  it idempotent: the FINAL live chain is always exactly the intended ruleset
+  regardless of prior state. No sacred VALUE changed; ensure_nft_ready no-op
+  (table already absent when it calls). task-033 default_mark + mangle_output
+  untouched.
+- WHY THE OLD TEST MISSED IT: `test_selective_marking` (1) STUBBED
+  `get_global_proxy_section`, so it never ran the real UCI helper, and (2) always
+  did `nft delete table` first (clean slate) and called create_nft_rules ONCE —
+  so it never exercised the stale-table/respawn path that is the actual service
+  reality.
+- STRENGTHENED TEST (5 new asserts, now 17 total for selmark, suite 143→148):
+  * Scenario 6 (THE regression repro): env `SCN_PRESEED=1` makes the driver
+    leave a STALE mark-all table (full localv4/interface sets + ct/return +
+    mark-all tcp/udp) then run create_nft_rules ON TOP with REAL nft and NO
+    delete — faithfully reproducing the respawn/upgrade path. Asserts the FINAL
+    live chain has NO mark-all (`meta mark set`+`l4proto` line w/o daddr/saddr),
+    the @set rule IS present, the union set exists, and EXACTLY ONE @set rule
+    (proves rebuild, not append).
+  * Scenario 7 (`selective:realgp`): sources real /lib/functions.sh +
+    /lib/config/uci.sh, awk-extracts the SHIPPED get_global_proxy_section chain,
+    `config_load`s a real hardware-shaped config (subscription proxy,
+    global_proxy=0), asserts `GP=[]` → selective branch (kills the stub blind
+    spot). Skips if LuCI/uci absent.
+  * PROVEN to catch the bug: reverting the flush makes `selective:respawn —
+    stale mark-all rule SURVIVED the rebuild` FAIL (16/1); with the fix 17/0.
+- GATES: shellcheck -S error clean (bin + nft.sh + constants.sh + install.sh +
+  tests/entrypoint.sh). `smoke-tests all` = 148 passed / 0 failed (143 + 5).
+  Pre-existing `rh-case1/2/6:FAIL` red marks persist (documented task-031 quirk;
+  suite still EXIT=0). No registration change needed (selmark already in
+  all)/alias/usage/compose).
+
+## task-035: health monitor held the procd lock fd (1000) → reload/restart hang
+
+- ROOT CAUSE (hardware-confirmed to the exact process): `start_sing_box_monitor`
+  launched the long-lived monitor with a bare `monitor_sing_box &`. procd runs
+  every init action while holding its exclusive service lock on **fd 1000**
+  (`/tmp/lock/procd_<name>.lock`) — confirmed canonical (openwrt/packages#12807:
+  "fd 1000 holds the exclusive concurrency lock for init script execution").
+  The bare `&` inherits ALL open fds incl. 1000, so the never-exiting monitor
+  held the procd lock FOREVER → the NEXT `reload`/`restart` blocked on
+  `flock 1000` indefinitely → settings never re-applied (dashboard frozen). The
+  1st reload "worked" only because it WAS the lock holder.
+- FIX (chosen: hidden `__monitor` subcommand + setsid + fd-close, most robust):
+  `start_sing_box_monitor` now launches
+  `setsid /bin/sh -c 'exec 1000>&- 2>/dev/null; exec /usr/bin/netshift __monitor'
+  </dev/null >/dev/null 2>&1 &`. Three independent detachments: (1) `setsid` →
+  own session, out of procd's process group; (2) `exec 1000>&-` closes the
+  inherited lock fd in the child BEFORE the re-exec (exec does NOT close
+  non-CLOEXEC fds — that IS the bug — so the close is mandatory; harmless no-op
+  on the plain `start`/boot path where fd 1000 isn't open); (3)
+  `</dev/null >/dev/null 2>&1` drops procd's inherited stdout/stderr pipes. The
+  hidden `__monitor) monitor_sing_box ;;` dispatch case (bottom of bin/netshift,
+  NOT in help) runs the UNCHANGED detection/recovery loop.
+- WHY re-exec instead of just `{ exec 1000>&-; monitor_sing_box; } &`: re-exec
+  via setsid is more thorough (new session + fresh process, drops EVERYTHING
+  inherited), and is robust even if procd ever changes the lock fd number — but
+  I still close 1000 explicitly as the belt. The detached monitor's recovery
+  path (`stop_main`/`start_main`) is safe: `start_main` does NOT spawn a monitor
+  (only `start()` does, via `start_sing_box_monitor`), so a recovery restart
+  can't re-introduce a lock-held child; and the monitor itself has no fd 1000.
+- PID TRACKING through setsid/exec: the launcher can't reliably capture the
+  final pid of the setsid→sh→exec chain, so the monitor writes its OWN `$$` to
+  the pidfile at the TOP of `monitor_sing_box` (`echo $$ > "$MONITOR_PIDFILE"`).
+  `start_sing_box_monitor` then waits briefly (`while [ ! -s pidfile ]`, ~2s cap,
+  `sleep 0.1 2>/dev/null || sleep 1` busybox-safe) for it to appear, for
+  diagnostics. `stop()` reads the pidfile + `kill` — unchanged behaviour, still
+  kills exactly the detached monitor. Single-instance pidfile guard at the top
+  of `start_sing_box_monitor` (kill-prior / skip-if-alive) is UNCHANGED → still
+  exactly one monitor after N reloads. `shutdown_correctly` honoring + pidfile
+  cleanup on monitor exit (`rm -f "$MONITOR_PIDFILE"`) unchanged.
+- New constant `MONITOR_PIDFILE="/var/run/netshift_monitor.pid"` (constants.sh,
+  Common) replaced the 4 inlined literals (start/stop/monitor + launcher) — was
+  the one repeated magic path. NO sacred value / nft / default_mark touched.
+- KNOWN RELATED RISK (out of task-035 scope, flagged): the deferred subscription
+  retry worker (`start_subscription_startup_retry_worker`) ALSO backgrounds a
+  `while true` loop with a bare `( ... ) &` and so inherits fd 1000 the same
+  way. It usually exits after the first successful `subscription_update`
+  (self-restarts), so it's not the confirmed culprit, but on a box where the sub
+  stays unreachable it could hold the lock too. Candidate for the same setsid
+  detach in a follow-up.
+- TEST: new top-level `test_monitor_fd_hygiene` (alias `monfd`, 4 asserts),
+  placed after `test_section_isolation`. awk-extracts the SHIPPED
+  `start_sing_box_monitor` verbatim, re-pins `MONITOR_PIDFILE`, installs a stub
+  `/usr/bin/netshift` (back-up/restore the real one) whose `__monitor` writes
+  `$$` + sleep-loops. Driver opens fd 1000 on a sentinel lock file + `flock -x`
+  it (exactly like procd), runs the launcher, then asserts: (1) monitor alive +
+  pidfile correct; (2) NO `/proc/<pid>/fd/*` symlink points at the sentinel lock
+  (THE direct fd-hygiene proof — spec test #1); (3) fd 1000 specifically isn't
+  the lock; (4) repeated-reload-no-hang proxy — CLOSE the parent's fd 1000
+  (modeling procd ENDING the action; must NOT `flock -u`, which releases the
+  per-OFD lock for all and masks the bug) then a separate subshell's
+  `flock -n -x` on the same file must acquire immediately. PROVEN discriminator:
+  reverting to `/usr/bin/netshift __monitor &` makes asserts 2/3/4 FAIL (1/3),
+  fix → 4/0. Parsed in the CURRENT shell (`while read < "$out"`, no pipe) so
+  counts are EXACT. Registered all 5 points (all)/case alias/usage/compose).
+- FLOCK SEMANTICS LANDMINE: an advisory flock lives on the open-file-description
+  (OFD), not the fd. A child that inherits the fd shares the SAME OFD, so the
+  lock persists until ALL fds to that OFD close. `flock -u` on ANY of them
+  releases it for everyone — so a test must model procd by CLOSING the fd, never
+  by `flock -u`, or it can't tell the bug from the fix. busybox `flock` supports
+  both `flock -sxun FD` and `flock FILE -c CMD`; I used the FD form in a subshell
+  (`( exec 9>file; flock -n -x 9 )`) for portability.
+- GATES: shellcheck -S error clean (bin/netshift + lib/*.sh + install.sh +
+  tests/entrypoint.sh). `smoke-tests all` = 152 passed / 0 failed (148 baseline
+  + 4 new monfd). Pre-existing `rh-case1/2/6:FAIL` red marks persist (task-031
+  piped-while quirk; suite still EXIT=0). Verified in the NET_ADMIN smoke
+  container that the detached monitor child holds NO sentinel/lock fd.
+
+## task-036: monitor PROCESS LEAK after the task-035 detach (2-3 live monitors)
+
+- ROOT CAUSE (hardware-confirmed): the task-035 setsid detach is correct, but it
+  introduced a leak. Each monitor self-writes its OWN `$$` to MONITOR_PIDFILE at
+  the top of `monitor_sing_box`, so the pidfile only ever remembers the LATEST
+  monitor. `start_sing_box_monitor`'s old replace-guard only `return 0`'d if the
+  pidfile pid was alive (else `rm`'d it) — it NEVER killed the old monitor.
+  reload = `stop(); start()`; `stop()` kills only the pidfile pid. A monitor from
+  a PRIOR reload whose pid was overwritten in the pidfile is invisible to stop()
+  → and because it's detached (setsid → own session, reparented to init) it
+  survives forever → monitors accumulate (pid=X ppid=1 orphan AND newer one both
+  alive; pidfile names only one).
+- FIX (chosen Option 1, robust kill-all by unique marker): new private helper
+  `_kill_stale_sing_box_monitors` kills ALL detached monitors via
+  `pgrep -f "/usr/bin/netshift __monitor"` (the hidden `__monitor` subcommand is
+  the unique marker — re-exec'd argv is `/bin/ash /usr/bin/netshift __monitor`;
+  matches ONLY the monitor, never the main netshift process). EXCLUDES `$$` and
+  `${PPID:-0}` (numeric-guarded), so it can never self-kill. Wired into TWO
+  paths: (1) `start_sing_box_monitor` runs it + `rm -f pidfile` then ALWAYS
+  spawns one fresh monitor (replaced the old return-0-if-alive guard — a stale
+  monitor from a prior config is not a valid substitute for one bound to the new
+  sing-box run); (2) `stop()` runs it after the pidfile-pid kill so a clean stop
+  leaves ZERO monitors. Result: exactly ONE monitor after N reloads/restarts.
+- SELF-KILL SAFETY during recovery: `monitor_sing_box` recovery calls
+  `stop_main`/`start_main` — NOT `stop()`/`start_sing_box_monitor` — so the
+  kill-all helper is NEVER reached from inside a running monitor. The `$$`/`$PPID`
+  exclusion is the belt-and-suspenders guarantee regardless.
+- KEEP INTACT (re-verified by smoke): task-035 detach (setsid + `exec 1000>&-` +
+  hidden `__monitor` + monitor self-writes pid), monitor holds NO lock fd
+  (re-proven on the RESPAWNED monitor too), reload no-hang, recovery via
+  stop_main/start_main. No sacred value / nft / default_mark touched.
+- `pgrep -f` IS available on busybox target (already used at bin:3974
+  `pgrep -f "sing-box"` in get_system_info, and bin:1062 `pgrep "sing-box"`); I
+  still added a `ps w | grep | grep -v grep | awk` fallback guarded by
+  `command -v pgrep`. Capture pgrep output into a var, iterate with a `for`
+  (word-split is fine — pids are numeric), not a pipe, so the `killed` counter
+  survives.
+- TEST: extended `test_monitor_fd_hygiene` (monfd) with 3 new asserts (now 7
+  total, no new registration — monfd already in all)). awk-extracts BOTH the
+  shipped `_kill_stale_sing_box_monitors` AND `start_sing_box_monitor`. Models
+  the REAL leak precondition before the 2nd launch: monitor A still alive but
+  pidfile pointed at a DEAD pid (`echo 999999 > pidfile`) — exactly the
+  overwritten-then-cleared pidfile state. New asserts: `monfd-prior-monitor-killed`
+  (old pid dead), `monfd-exactly-one-monitor` (pgrep -f count == 1, into file +
+  counted `while read`, no pipe), `monfd-respawn-no-lock-fd` (the NEW monitor
+  also holds no sentinel fd). PROVEN DISCRIMINATOR: reverting to the old guard
+  (return-0-if-alive + neutered selector) makes the buggy code show "found 2 live
+  monitors" + "old pid still alive" (2/7 FAIL); fix → 7/0. The naive
+  "launch twice with the SAME live pidfile" does NOT discriminate (old guard
+  `return 0`s, never respawns, so count stays 1) — you MUST simulate the lost
+  pidfile pointer to expose the leak.
+- GATES: shellcheck -S error clean (bin + lib/*.sh + install.sh +
+  tests/entrypoint.sh). `smoke-tests all` = 155 passed / 0 failed (152 task-035
+  baseline + 3 new monfd asserts). Pre-existing `rh-case1/2/6:FAIL` red marks
+  persist (task-031 piped-while quirk; suite EXIT=0).
+
+## task-038: graceful-skip unsupported scheme (fatal→warn) + splithttp→xhttp alias
+
+- DEFECT 1: `sing_box_cf_add_proxy_outbound`'s `*)` default arm did `log fatal;
+  exit 1`. That dispatcher is SHARED by url(single)/selector-loop/urltest-loop
+  callers (bin/netshift) + the subscription fallback parser
+  (`normalize_subscription_to_singbox` in helpers.sh). One unsupported link
+  (tuic/wireguard/anytls/shadowtls/http/typo) in a urltest/selector list aborted
+  the WHOLE config — and worse, `exit 1` inside the caller's `config=$(facade
+  ...)` only exits the SUBSHELL, so config became EMPTY (the task-033 wipe class),
+  not a clean abort.
+- FIX: `*)` arm now `log "...skipping..." "warn"; echo "$config"; return 1`
+  (config echoed UNCHANGED, never empty; non-zero = "skipped"). Supported arms
+  keep their genuine `exit 1` paths (ss base64 fail, vmess decode fail) — those
+  STILL only exit the subshell, which the callers now treat as skip too (defense:
+  see the `[ -n "$_new_config" ]` guard below). Did NOT touch supported parsing.
+- SKIP CONTRACT (callers): non-zero return + unchanged echo. Caller pattern is
+  `if _new_config="$(facade ...)" && [ -n "$_new_config" ]; then config="$_new_config"; <use it> else <skip>`.
+  The `[ -n ]` guard is belt-and-suspenders so a genuine supported-arm `exit 1`
+  (empty echo) ALSO degrades to skip rather than wiping `config`.
+- CALLER AUDIT (all 4):
+  * url single (bin ~2151): on skip → `echolog ... error` + `mark_section_outbound_unavailable`
+    so the route emits a REJECT rule (section degrades to unavailable). No exit.
+  * selector loop (bin ~2182): add the member tag ONLY on facade success → no
+    dangling selector member. All-skipped → empty `outbound_tags` → mark
+    unavailable, don't build the selector.
+  * urltest loop (bin ~2228): same as selector (urltest+selector members clean).
+  * subscription normalize (helpers ~1489): ALREADY graceful — pre-filters
+    schemes to `vless|trojan|ss|hysteria2|hy2|socks*` (the `*)` arm is never even
+    reached there) AND tolerates non-zero via `|| { continue }` + JSON/count
+    guards. No change needed; my facade change is compatible.
+- SINGLE-URL DEGRADE MECHANISM: new tiny helper `mark_section_outbound_unavailable`
+  (next to `mark_subscription_outbound_unavailable`) just appends the section to
+  `SUBSCRIPTION_UNAVAILABLE_SECTIONS` (the SAME flag `subscription_outbound_is_unavailable`
+  reads), so `sing_box_configure_route` emits `sing_box_cm_add_reject_route_rule`
+  for it (bin ~2818). Does NOT touch any per-URL subscription rejected-hash cache
+  (that is subscription-only). Reuses the existing unavailable-section plumbing.
+- PROVEN: `sing-box check` does NOT reject a route rule whose `outbound` points
+  at a MISSING outbound, NOR a selector/urltest with a missing member (both rc=0
+  in-container). So a dangling tag wouldn't fail `check` — but it would blackhole
+  traffic at runtime, hence we still keep selector members clean + mark unavailable.
+- DEFECT 2 (splithttp = pre-rename xhttp): facade `_add_outbound_transport` now
+  matches `xhttp | splithttp` (same `sing_box_cm_set_xhttp_transport_for_outbound`,
+  same `is_sing_box_extended` gate); `_add_outbound_security` ALPN-default branch
+  also accepts `type=splithttp`. `xray_json_to_uri_lines` (helpers.sh): normalize
+  `$net` `splithttp`→`xhttp` and read settings from `($ss.xhttpSettings //
+  $ss.splithttpSettings // {})`. Emitted URI always carries the modern `type=xhttp`.
+- **JQ-IN-SHELL-STRING APOSTROPHE LANDMINE (cost a debug cycle):** an apostrophe
+  in a jq COMMENT inside a `jq -er '...'` single-quoted shell string CLOSES the
+  shell string. I wrote `# ... the facade's xhttp branch ...` and shellcheck
+  reported SC1073/SC1056/SC1072 brace errors on the FUNCTION line, not the
+  comment — because everything after the `'` was parsed as shell. It would ALSO
+  break the real jq at runtime. NEVER put `'` in a jq comment (or any char that
+  closes the surrounding shell quote). Rewrote the comments apostrophe-free.
+- **`((` at a jq pipe-element start trips shellcheck** (reads it as arithmetic
+  `$((...))` context → SC1056/1072): `| (($x // "y") | if ...)` failed; split it
+  into `| ($x // "y") as $tmp | (if $tmp ...) as $net` (single leading `(`).
+- TEST: new top-level `test_unsupported_skip` (alias `unsupported`, after
+  test_monitor_fd_hygiene). awk-extracts the SHIPPED `configure_outbound_handler`
+  + `mark_section_outbound_unavailable` verbatim, sources real
+  facade/manager/helpers/constants (symlink to /usr/lib/netshift), table-driven
+  `config_get` stub via `US_<section>_<opt>` vars, log stub recording level|msg.
+  Cases: (1) urltest + (1b) selector mix supported(vless/hysteria2)+unsupported
+  (tuic/wireguard/garbage) → no-abort, supported present, unsupported absent,
+  members clean, warning logged, config not wiped, live `sing-box check`; (2)
+  single-URL only-tuic → no crash, no outbound, direct-out survives, section
+  marked unavailable, error logged; (3a) vless `?type=splithttp` → transport.type
+  xhttp + path + extended-gate-off respected; (3b) Xray-JSON
+  network:"splithttp"/splithttpSettings → URI carries `type=xhttp`,`path=/xj`, no
+  literal `splithttp`. The xhttp `sing-box check` SKIPs on the container's STOCK
+  core (rejects xhttp) — assert-only-when-accepted, else SKIP. Registered all 5
+  points (all)/alias/usage/docker-compose comment).
+- GATES: shellcheck -S error clean (install.sh + bin + lib/*.sh + tests). All
+  files UTF-8 intact (syntax test mojibake guard green). `smoke-tests all` = 155
+  passed / 0 failed (same suite total — the new test's per-line passes run in the
+  documented piped-while subshell, so the ✓ marks are truth: 23 green + 1 SKIP).
+  task-037's hysteria2 marks (fb-caseL/N/O) all still green. Pre-existing
+  `rh-case1/2/6:FAIL` red marks persist (task-031 quirk; suite EXIT=0). No sacred
+  value/port/mark/path/ACL changed.
+
+## task-039: `component_action subscription clear_cache` (wipe caches + redownload)
+
+- NEW worker `subscription_clear_cache_and_redownload` in **bin/netshift** (placed
+  right after `subscription_update`, where the cache-path builders +
+  `SUBSCRIPTION_CACHE_FOLDER` + `subscription_update` are in scope). Wired into
+  `updater.sh component_action()` via a new arm `subscription:clear_cache)
+  subscription_clear_cache_and_redownload ;;` beside sing_box:*/netshift:*. Works
+  via BOTH sync `component_action subscription clear_cache` AND async
+  `component_action_async subscription clear_cache`→job_id +
+  `component_action_status <job_id>` — NO new plumbing. Help line added in
+  show_help. NO ACL change (component_action is wholesale exec-allowed).
+- **Cross-package reachability proof**: updater.sh is SOURCED by bin/netshift, and
+  the async fork does `"$0" component_action "$c" "$a"` (re-execs bin/netshift), so
+  a worker DEFINED in bin/netshift is always in scope when the `component_action`
+  arm (FROM updater.sh) dispatches it. A worker can live in either file as long as
+  it's reachable at dispatch time.
+- **Guarded full-reset delete (the only new logic)**: `[ -n
+  "$SUBSCRIPTION_CACHE_FOLDER" ] && [ -d "$SUBSCRIPTION_CACHE_FOLDER" ]` BEFORE any
+  glob, then a `for cache_file in "$SUBSCRIPTION_CACHE_FOLDER"/*; do [ -e ] || continue;
+  rm -f ...; done` (counts removed files, logs the count at info). The two guards
+  make a mistyped/empty constant → `rm -f /*` IMPOSSIBLE. Only ever removes dir
+  CONTENTS, never `rm -rf` the dir. No error on empty/missing dir (the `[ -e ]`
+  continue handles the literal-glob-when-empty case). Deleting `.json` defeats the
+  unchanged guard, deleting `.rejected` defeats the rejected-hash veto → genuine
+  full re-download.
+- **Reused subscription_update VERBATIM** for redownload+revalidate+restart — the
+  ONLY new code is the deletion + the JSON wrapper. Echo+return discipline (NEVER
+  `exit` — runs inside the async fork; an exit would kill it before the finished
+  state is written, same rule as updates_*): success → `{"success":true,
+  "message":"..."}` return 0; redownload fail → `{"success":false,"message":"..."}`
+  return $rc. No subscription sections configured → graceful
+  `{"success":true,"message":"No subscriptions configured;..."}` return 0 (detected
+  via a `config_foreach` callback identical to subscription_update's own
+  has_subscription probe). Action string is EXACTLY `subscription` / `clear_cache`
+  (frontend task-040 must match).
+- TEST: extended `test_subscription` (NO registration change — already in all)) with
+  a `Clear Subscription Cache` driver block (11 cc-case assertions). awk-extracts
+  the SHIPPED worker VERBATIM + the SHIPPED `component_action` from updater.sh,
+  stubs `subscription_update` to a no-op (records call count + controllable rc),
+  table-driven `config_foreach`/`config_get` via `CC_SECTIONS`
+  ("sec|ct|pct" rows). Cases: 1 ≥2-feeds-all-deleted+dir-preserved+success:true+
+  redownload-invoked, 2 empty-dir-graceful, 2b missing-dir-graceful, 3 no-subs→
+  success+no-redownload+files-cleared, 4 redownload-fail→success:false+message,
+  5 guard scoped to cache dir (unrelated sentinel survives) + empty-constant no-op,
+  6 router `component_action subscription clear_cache` dispatches to the worker.
+- **CAPTURE LANDMINE (bit me once, the documented `$()`-subshell variant)**:
+  `cc_json="$(worker)"` runs the worker in a SUBSHELL, so a stub's call-counter
+  (`SUB_UPDATE_CALLS`) or `ROUTER_HIT` flag mutation is TRAPPED and never reaches
+  the parent → the assertion reads the parent's stale reset value (false pass/fail).
+  When a test asserts on a side-effect VARIABLE set inside the worker, run it
+  WITHOUT `$()`: `worker > "$out"; json="$(cat "$out")"`. Cases that assert only on
+  the echoed JSON can use `$()` safely. CASE 6's `component_action()` is awk-extracted
+  function-only — its other arms reference undefined `updates_*` fns but those are
+  just `case` branches (never executed), so no need to source the whole updater.sh.
+- GATES: shellcheck -S error clean (bin/netshift + updater.sh + lib/*.sh + install.sh).
+  `smoke-tests all` = 166 passed / 0 failed (155 baseline + 11 new cc-case, suite
+  total reflects them as the driver parses in the CURRENT shell `while read <
+  "$out"` so counts are EXACT). Pre-existing `rh-case1/2/6:FAIL` red marks persist
+  (task-031 piped-while quirk; suite EXIT=0). No sacred value/port/mark/path/ACL/
+  frontend/async-machinery/download-guard change.
+
+## task-041: self-update verify-after-install (opkg silent no-op fix)
+
+- **Root cause (proven on router):** opkg returns rc=0 for "Not downgrading"/
+  "already installed"/"up to date". A legacy v-prefixed build (`v0.8.6-r1`) sorts
+  ABOVE the no-v target (`0.8.7-r1`) in opkg's dpkg-style compare, so a plain
+  `opkg install` refuses AND returns rc=0. The self-update worker trusted rc and
+  emitted `{"success":true}` while NOTHING installed. **opkg install rc is NOT a
+  reliable success signal** — the only robust check is to RE-READ the installed
+  version after the call.
+- Fix #1 (`updates_pkg_install_file` opkg branch): `opkg install
+  --force-downgrade --force-reinstall "$pkg_file"`. `--force-downgrade` lands the
+  v→no-v transition; `--force-reinstall` covers the same-exact-version no-op. apk
+  branch unchanged (`apk add --allow-untrusted`; apk overwrites by default).
+- Fix #2 new helper `updates_pkg_installed_version <pkg>` (mirrors
+  `updates_pkg_is_installed`/`_candidate_version` but reads INSTALLED not feed):
+  opkg `list-installed | grep "^<pkg> " | head -n1 | awk -F' - ' '{print $2}'`;
+  apk `list --installed <pkg> | awk '{print $1}' | head -n1` then strip `<pkg>-`
+  prefix via `${line#"$pkg"-}`. grep/awk only, NO Oniguruma.
+- Fix #3 verify-after-install belt in `_updates_self_update_netshift_core` (after
+  the install loop, BEFORE the defensive restore + success cleanup): re-read the
+  CORE installed version, normalize with the SAME rules the version-decision uses
+  (`${x#v}` then `${x%%-*}` to drop `-rN`), and gate on
+  `[ "$inst_semver" != "$latest_semver" ] && ! is_min_package_version
+  "$inst_semver" "$latest_semver"` (i.e. fail unless installed == target OR
+  installed >= target). On fail: `_updates_self_update_restore_config
+  "$backup_made"` + `rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR"` + `updates_log ...
+  "error"` + `echo '{"success":false,"message":"NetShift core package did not
+  upgrade ...; configuration preserved"}'` + **`return 1` (NEVER exit** — async
+  worker; exit skips the wrapper's `updates_restore_after_swap` epilogue + the
+  finished-job-state write). Only a verified change reaches the existing success
+  JSON. Gates the CORE pkg only (luci/ru stay non-critical).
+- `is_min_package_version current required` returns 0 when `current >= required`
+  (it's a `sort -V | head -1 == required` test) — so call it as
+  `is_min_package_version "$installed" "$target"`.
+- All new vars declared at the TOP of the core fn (`core_installed
+  core_installed_semver latest_semver`) — shellcheck `-S error` clean.
+- **Smoke (test_self_update_netshift, alias `selfupdate`, no new top-level test):**
+  extended the fake opkg stub: `install` arm now skips leading `--*` flags
+  (`while ...; case --*) shift;; *) break;; esac`) so `$1` is the file path even
+  with the new force flags; on a REAL success it rewrites the `netshift -` line in
+  `$SU_INSTALLED_LIST` to `$SU_TARGET_INSTALLED_VER` (so verify passes) UNLESS
+  `$SU_NOOP` is set (then list keeps the OLD version → simulates "Not
+  downgrading"). luci-* files excluded from the rewrite via nested case. Each
+  scenario now seeds `installed.list` with `netshift - 0.8.0-r1` (the install arm
+  mutates it, so reset per-scenario). New Scenario 6 (`SU_NOOP=1`, all other
+  markers ok): asserts `selfupdate-noop-detected-successfalse` (success:false),
+  `-noop-install-attempted`, `-noop-config-intact`, `-noop-download-dir-cleaned`.
+  Happy path Scenario 3 still `success:true version 0.8.1` (verify passes because
+  the stub reports the target post-install). SELF-PROVED the guard: temporarily
+  prefixed the verify `if` with `false &&` → `selfupdate-noop-detected-successfalse`
+  FAILED (worker falsely reported success on the no-op), then restored → passes.
+- shellcheck -S error clean (bin+libs+install.sh); `smoke-tests all` = 170 passed
+  / 0 failed (166 baseline + 4 new no-op assertions; selfupdate category 13→17).
+  No constants.sh / frontend / async-machinery / version-decision(:1679) /
+  sing-box-install-path / sacred-value change. apk path: the same verify belt
+  covers apk's equal-version no-overwrite quirk (reasoned; opkg covered in smoke).
+
+## task-043 — versioned Xray-JSON probe User-Agents (constants-only)
+
+- Finding (abstract, no identifiers): some panels gate their Xray-JSON branch on
+  a `<client>/<version>` UA SHAPE. A bare/version-less UA can be rejected (server
+  502); a VERSIONED UA of the same client yields the wanted Xray-JSON array body
+  (the multi-profile format `xray_json_to_uri_lines` parses, carrying
+  xhttp/hysteria2). Fix = make the probe send versioned UAs first.
+- `SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES` (constants.sh) is the ordered set
+  probed FIRST in `xray` format-preference mode by
+  `build_subscription_user_agent_candidates` (helpers.sh:765-771;
+  order = XRAY_CANDIDATES → default(singbox/<ver>) → cached-winner → main
+  whitelist, deduped). Changed it from bare `"v2rayN Happ"` to versioned
+  `"Happ/1.0.0 v2rayN/7.0.0 v2rayNG/1.9.0"` (versioned client first). The
+  separate auto-mode `SUBSCRIPTION_USER_AGENT_CANDIDATES` (still has bare names)
+  and the request headers in `_wget_subscription_request` were untouched — only
+  the UA VALUE decides the 502-vs-200 outcome, no header change needed.
+- Coupled smoke test: `fb-caseI-xraypref-*` (tests/entrypoint.sh CASE I, run via
+  the `subscription` category) hardcoded the old bare literals. Rewrote them to
+  DERIVE the expected first/second/third candidates from
+  `$SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES` (sourced in the CASE-I subshell via
+  `set -- $SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES`) so a future version bump
+  won't rot the test. Added one generic guard `fb-caseI-xraypref-first-versioned`
+  (`case "$first" in */*)`) so we never regress to a bare UA. The auto-mode
+  `fb-caseI-auto-has-v2rayN` assertion is unrelated (tests the auto whitelist).
+- shellcheck -S error clean (entrypoint.sh is OUT of the lint scope — only
+  bin/lib/install.sh). `smoke-tests all` = 170 passed / 0 failed (same total
+  before+after; the standalone `subscription` category went 86→87 from the +1
+  guard, but the aggregate `all` "Results:" counter reported 170 either way — a
+  harness counting quirk, not a regression; all four `fb-caseI-xraypref-*` lines
+  print :OK in both runs). No ports/marks/paths/schema touched; runtime contract
+  intact.
+
+## task-046 — gzip subscription body decompress + NUL guard (issue #13)
+
+- Some panels return a gzip-compressed HTTP body unconditionally; busybox wget
+  does NOT transparently decompress and NetShift sends no Accept-Encoding, so the
+  raw bytes are binary and validate/normalize choke ("No subscription User-Agent
+  candidate produced valid outbounds").
+- Added two best-effort helpers to `helpers.sh` (next to `convert_crlf_to_lf`):
+  - `maybe_gunzip_subscription_file <f>`: attempt-based detection (no
+    od/hexdump/xxd — none on device). `gzip -dc` (busybox built-in) into a
+    mktemp; accept ONLY if rc=0 AND result non-empty AND NUL-free, then `mv` into
+    place (else `rm`). `gzip -dc` on plain text returns rc!=0 cleanly, so plain
+    text is left byte-for-byte untouched — never corrupts text. Always returns 0.
+  - `subscription_body_is_binary <f>`: returns 0 (true) if file has a NUL byte.
+    Busybox-safe, no od: compare `wc -c < f` to `tr -d '\000' < f | wc -c` (differ
+    ⇒ had NUL). All vars local.
+- Wired in `bin/netshift` `download_subscription_into_cache` right after a
+  successful `download_subscription` (now ~:590-591), BEFORE
+  `validate_subscription_file`: call `maybe_gunzip_subscription_file`, then if
+  `subscription_body_is_binary` log a warn and `continue` (inside the per-UA
+  `while read` loop → falls to next UA, same flow as a validation failure). The
+  file_size/debug log stays AFTER so the logged size reflects the decompressed
+  body. mv/cache-persist below unchanged.
+- NO Accept-Encoding/wget change, NO Makefile DEPENDS change (gzip/gunzip/zcat
+  are busybox built-ins), NO schema/ports/marks/frontend. zstd/unzstd are NOT on
+  device — gzip-only by design; deflate/zstd are a future task if panels send
+  them.
+- Smoke: extended the `test_subscription` fb harness (sources helpers via the
+  facade) with synthetic-only fixtures: caseP gzip→text (cmp byte-equal),
+  text-passthrough (cmp unchanged), gzip→validate (validate_subscription_file
+  passes); caseQ `printf 'abc\000def'`→binary true, plain text→false. The smoke
+  container has gzip (tests/Dockerfile apk add gzip). No new test_* fn — folded
+  into existing test_subscription, so no main()/case/usage registration needed.
+- Gates: shellcheck -S error clean on bin + all libs + install.sh; `smoke-tests
+  all` 174 passed / 0 failed (aggregate counter folds the 5 new tokens into the
+  test_subscription header group — count unchanged, the 5 fb-caseP/Q :OK lines
+  print explicitly in the `subscription` run).
+
+## task-047 — latest-tag jq parse (false "Outdated" fix)
+
+- `updates_netshift_latest_tag` (`updater.sh:~1635`) used
+  `grep '"tag_name":' | head -n1 | cut -d'"' -f4`. That ONLY works on
+  pretty-printed JSON. On MINIFIED GitHub JSON (whole object on one line, `"url"`
+  before `"tag_name"`), grep matches the whole line and `cut -f4` returns the
+  FIRST key's value = the release `"url"` → false "outdated" + self-update
+  downloads a garbage "version". Fix: `jq -r '.tag_name // empty'`
+  (format-independent; `// empty` → empty on rate-limit/error objects; no
+  Oniguruma). jq is a hard dep (used 23× in updater.sh) and the sibling
+  sing-box-extended path already used `.tag_name`.
+- LESSON (whitespace-fragile grep|cut on JSON): never field-position-`cut` JSON
+  that may be minified. Prefer jq when it's already a dep.
+- New smoke test `test_netshift_latest_tag` (token `latesttag`): driver sources
+  updater.sh, stubs ONLY the network boundary `updates_http_get_once` (NOT the
+  parse fn), runs the REAL `updates_netshift_latest_tag`. 4 cases: minified→tag
+  (regression guard), pretty→tag, rate-limit→empty+nonzero, e2e via
+  `updates_check_netshift`→status "latest". Registered in main() all)+case+usage
+  +docker-compose.yml comment.
+- GOTCHA: under harness `set -e`, a stub-driver `ash "$drv"` that returns
+  non-zero (the rate-limit case) aborts the whole suite — guard rc capture with
+  `ash ... && printf 0 >rc || printf $? >rc`.
+- Guard self-proven: restoring the old grep|cut line made
+  `latesttag-minified-returns-tag-not-url` FAIL (returned the .../releases/<id>
+  url), then restored jq. Gates: shellcheck -S error clean (bin + libs +
+  install.sh); `smoke-tests all` 174→178 passed / 0 failed (+4 latesttag).
+
+## task-048: scalar `option subscription_url` read-fallback + option->list migration
+
+- Root cause (PROVEN on hardware, Cudy WR3000E / OWRt 25.12.4 / NetShift 0.8.9):
+  a section storing `option subscription_url '<url>'` (legacy / CLI /
+  podkop-migrated configs) made `get_subscription_urls_for_section`
+  (`bin/netshift`) return EMPTY → `has_outbound_section` false → "Outbound
+  section not found. Aborted." → sing-box never starts → whole chain down (no nft
+  table, FakeIP 127.0.0.42:53 refused). `config_list_foreach` iterates ONLY UCI
+  `list` values; over a scalar `option` it iterates NOTHING. `config_get` reads
+  the scalar. Regression from task-022 (multi-URL feature made subscription_url a
+  list / form.DynamicList); the task-022 memory note "a lone legacy option reads
+  as a 1-element list — NO migration code" was the FALSE assumption that shipped
+  the bug. EVERY subscription-URL reader funnels through this one helper.
+- Fix 1 (load-bearing, single source): in `get_subscription_urls_for_section`,
+  AFTER the `config_list_foreach`, if `SUBSCRIPTION_URLS_COLLECTED` is still
+  empty, `config_get scalar_url "$section" "subscription_url"` and (if non-empty)
+  `_collect_subscription_url_handler "$scalar_url"` (reuse the handler so
+  dedup/format stays identical). All new vars `local`. Must stand alone on
+  read-only fs / when migration is skipped. Corrected the false comment at
+  `section_has_configured_outbound` (subscription branch) and the collector
+  header.
+- Fix 2 (hygiene, idempotent): `migrate_legacy_subscription_url_option` +
+  `_migrate_legacy_subscription_url_option_handler` (config_foreach callback).
+  Detects the broken shape robustly: LIST read empty AND scalar config_get
+  non-empty (an already-correct list is never touched). Rewrites via
+  `uci -q delete netshift.<sec>.subscription_url` then the `uci_add_list netshift
+  "$sec" subscription_url "$url"` SHELL HELPER (from /lib/functions.sh) — NOT the
+  `uci add_list "key=value"` CLI form, which splits on the first `=` and SILENTLY
+  LOSES query-string URLs (`?token=abc&x=1`) [code-review BLOCKER B1, reproduced
+  on hardware: CLI add_list rc=1, list empty, scalar already deleted => URL lost
+  on disk]. On add_list FAILURE the else branch `uci_set`s the scalar back so a
+  failed migration never leaves the section with NO url (and the flag stays 0 =>
+  no commit => uncommitted in-memory delete never persists; on-disk URL survives).
+  sets a module-level flag `SUBSCRIPTION_URL_OPTION_MIGRATED`; a SINGLE `uci commit netshift` +
+  `config_load "$NETSHIFT_CONFIG"` only if anything changed (mirrors the
+  :956/:1099 commit+reload). NEVER exits — uci failures log `warn` and continue
+  (the read-fallback covers correctness). Invoked ONCE at the TOP of `start_main`
+  BEFORE `check_requirements` (which reads URLs via has_outbound_section), AFTER
+  the file-scope `config_load`.
+- Smoke landmine confirmed (again): the multi-url `test_subscription` harness
+  STUBS `config_list_foreach` (feeds MU_URLS) and does NOT touch real UCI / does
+  NOT stub `config_get` — so it can NEVER catch this bug (it bypasses the broken
+  primitive). The regression guard MUST be a REAL-UCI test that `config_load`s a
+  fixture and runs the SHIPPED (awk-extracted) functions.
+- New top-level smoke test `test_sub_url_option` (alias `suburlopt`). 12 tokens:
+  `suburlopt:scalar-read` (regression guard — empty before fix),
+  `:scalar-hasoutbound`, `:list-read` (no-regression), `:migrate-flag`,
+  `:migrate-value`, `:migrate-islist`, `:migrate-idempotent`,
+  `:migrate-idempotent-value`, PLUS the `=`-URL [B1] guards
+  `:migrate-equrl-preserved`, `:migrate-equrl-islist`, `:migrate-equrl-single`
+  (asserts exactly 1 list element), `:migrate-idempotent-equrl` — fixture URL
+  `https://example.com/sub?token=abc&x=1`. The driver output is parsed in the
+  CURRENT shell (temp file + `while read < "$out"`, NO pipe) so the tokens
+  ACTUALLY GATE CI (fixed the harness-wide piped-while counter-quirk for this
+  test). Migration is tested against a throwaway
+  `/etc/config/netshift` (the function hardcodes the `netshift` config name) with
+  NETSHIFT_CONFIG=netshift; the caller backs up + restores any real one. Skips
+  cleanly if /lib/functions.sh or uci unavailable. Registered in all)+case alias+
+  "Available:" usage line + docker-compose.yml comment. Synthetic
+  `https://example.com/sub` ONLY (operator privacy rule: a user dump leaked a
+  real URL — never write a real subscription URL/host/id anywhere).
+- Self-prove DONE: removing the read-fallback block made `suburlopt:scalar-read`
+  go empty (its `:OK` disappeared) and `suburlopt:scalar-hasoutbound:FAIL`
+  appeared; restored and all tokens green again. Also self-proved [B1]: the old
+  `key=value` CLI add_list made `:migrate-equrl-preserved` FAIL (URL lost);
+  `uci_add_list` helper fixed it.
+- Whole-chain verified in-container: `has_outbound_section` returns TRUE for an
+  option-shaped config → requirements gate passes → config gen + sing-box check
+  proceed.
+- PRE-EXISTING (NOT mine): `test_rejected_hash` rh-case1/2/6 fail on the BASELINE
+  bin/netshift too (verified via git stash) — an existing container/env issue,
+  unrelated to task-048.
+- Gates: shellcheck -S error clean (bin + libs + install.sh); `smoke-tests all`
+  178→190 passed / 0 failed (the +12 is the 12 `suburlopt` tokens, which now
+  count because the test parses driver output in the CURRENT shell, NOT a pipe).
+  NO sacred constant/port/mark/path changed; UCI schema only normalizes an
+  existing key's representation (option→list, back-compat).
+- code-review round 2: APPROVED WITH CONDITIONS — [B1]/[S1]/[M1] all resolved;
+  the only condition was fixing THIS stale memory note (done).
+
+## task-049: avoid api.github.com rate-limit via github.com redirect (curl)
+
+- Anonymous api.github.com = 60 req/HOUR/IP; CGNAT/shared-IP/shared-VPN routers
+  share that budget → frequent "API rate limit exceeded". LEVER (proven on HW):
+  github.com/<repo>/releases/latest is the github.com FRONTEND (NOT the API) and
+  302-redirects to /releases/tag/<tag>; releases/download/<tag>/<asset> 302s to
+  the CDN. Neither hits the rate-limited API.
+- New constants (constants.sh, repo slug ONLY here): NETSHIFT_REPO_RELEASES_LATEST_URL
+  (.../releases/latest), NETSHIFT_REPO_RELEASES_DOWNLOAD_BASE (.../releases/download).
+  Kept NETSHIFT_RELEASE_API_URL as the fallback.
+- New STUBBABLE resolver `updates_github_resolve_redirect <url>` (updater.sh):
+  `command -v curl || return 1; curl -sI -o /dev/null -w '%{redirect_url}'
+  --connect-timeout 5 -m 15 -A 'netshift-updater' "$url"`. busybox wget is
+  STRIPPED (no -S/header read) so tag extraction MUST be curl; curl is a hard dep.
+- `updates_netshift_latest_tag` rewrite: PRIMARY resolve redirect, parse with
+  `case "$redirect" in */releases/tag/*) tag="${redirect##*/releases/tag/}";
+  case "$tag" in ''|*/*) tag="" ;; esac ;; *) tag="" ;; esac` (NO Oniguruma) —
+  a trailing-slash redirect leaves a `/` in tag → rejected → empty → fallback.
+  FALLBACK = the task-047 api.github.com + `jq -r '.tag_name // empty'` path,
+  kept intact. Bare-tag/non-zero contract preserved (feeds updates_check_netshift
+  + self-update worker).
+- `updates_netshift_asset_filename <pkg> <tag> <ext>` single-source naming helper:
+  i18n = `<pkg>-<tag>.<ext>` (no -r1); core/luci ipk = `<pkg>-<tag>-r1-all.ipk`,
+  apk = `<pkg>-<tag>-r1.apk`. `_updates_self_update_download_assets` now resolves
+  the tag and builds deterministic `$DOWNLOAD_BASE/<tag>/<filename>` URLs (core+luci
+  always, i18n only if updates_pkg_is_installed), downloads via updates_http_get_once
+  (follows the 302 to CDN), got_core=1 when core `-s "$dest"`. OLD api-JSON grep -o
+  loop KEPT verbatim as the else branch when tag unresolved.
+- install.sh: added RELEASES_LATEST_REDIRECT + RELEASES_DOWNLOAD_BASE literals
+  (install.sh has its own REPO, not constants.sh). PRIMARY: curl -sI redirect →
+  case/param-expansion tag → deterministic releases/download/<tag>/<asset> URLs
+  (core+luci, RU i18n if pkg_is_installed). FALLBACK: existing API scrape + the
+  "API rate limit" message kept intact. Factored the retry-download into a new
+  `download_release_asset url filename` helper reused by both paths. name-prefix
+  install loop semantics unchanged.
+- GOTCHA: the EXISTING test_netshift_latest_tag driver had to ALSO stub
+  `updates_github_resolve_redirect() { printf ''; }` — else the new primary would
+  shell out to real curl in CI (network) and bypass the API path that test targets.
+- EXTENDED PATH UNTOUCHED: updates_fetch_sing_box_extended_releases
+  (releases?per_page=30) + updates_extended_release_* — they need the releases LIST
+  (draft/prerelease/per-arch) a redirect can't give. Left on API + proxy-fallback.
+- New smoke test `test_github_redirect_tag` (alias `ghredirect`, 6 tokens): stubs
+  the resolver + updates_http_get_once, parses driver output in the CURRENT shell
+  (gates). tag-from-redirect, tag-trailing-slash-rejected (→fallback empty),
+  nonmatch-falls-back (login URL→API stub→tag), ratelimit-empty (curl-absent +
+  rate-limit object→empty+nonzero), asset-ipk, asset-apk. Registered all 5 points.
+- SELF-PROVEN: `if false && [ -n "$tag" ]` on the primary return made
+  ghredirect:tag-from-redirect FAIL (5/1), restored→6/0.
+- Gates: shellcheck -S error clean (bin+libs+install.sh); `smoke-tests all`
+  190→196 passed / 0 failed (+6 ghredirect). NO sacred constant/port/mark/path/
+  schema/frontend change.
diff --git a/docs/agent-rules/packaging.md b/docs/agent-rules/packaging.md
new file mode 100644
index 00000000..8df87e21
--- /dev/null
+++ b/docs/agent-rules/packaging.md
@@ -0,0 +1,204 @@
+# Agent Rules: Packaging, CI & Release
+
+Authoritative rules for building, testing, and releasing NetShift. Read this
+before touching anything below.
+
+**Scope:** `netshift/Makefile`, `luci-app-netshift/Makefile`,
+`Dockerfile-ipk`, `Dockerfile-apk`, `sdk/`, `tests/`, `.github/workflows/`,
+`install.sh`.
+
+---
+
+## 1. The packages
+
+Two source packages produce three published artifacts:
+
+- **`netshift`** — the backend (init script, UCI config, `/usr/bin/netshift`,
+  shell + jq libs under `/usr/lib/netshift`).
+- **`luci-app-netshift`** — the web UI. Its Makefile sets
+  `LUCI_LANGUAGES := en ru`, so the build also emits
+  **`luci-i18n-netshift-ru`** (the Russian translation) as a third package.
+
+Both packages are `PKGARCH := all` / `LUCI_PKGARCH := all` (architecture-
+independent).
+
+---
+
+## 2. `netshift/Makefile` (backend)
+
+- `DEPENDS := +sing-box +curl +jq +kmod-nft-tproxy +coreutils-base64
+  +bind-dig`
+- `CONFLICTS := https-dns-proxy nextdns luci-app-passwall luci-app-passwall2`
+- Version:
+  `PKG_VERSION := $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(shell date +%d%m%Y))`
+  — i.e. use `NETSHIFT_VERSION` when set, otherwise a date-stamped fallback.
+- `Package/netshift/prerm` removes the `105 netshift` line from
+  `/etc/iproute2/rt_tables` (only if present) and runs
+  `/etc/init.d/netshift stop`. **Service/system-state teardown lives in the
+  package `prerm`, not in `install.sh`.**
+- `Package/netshift/conffiles` declares `/etc/config/netshift` (preserved
+  across upgrades).
+- Version stamp: `Package/netshift/install` runs
+  `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g'
+  $(1)/usr/lib/netshift/constants.sh` — **no `|| true`** (this stamp must
+  succeed).
+
+`luci-app-netshift/Makefile` stamps the **same** placeholder into the bundled
+UI: `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g'
+.../view/netshift/main.js || true` — note the **`|| true`** here (UI stamp is
+best-effort). It uses the same `PKG_VERSION` expression and
+`LUCI_DEPENDS := +luci-base +netshift`.
+
+> If you ever rename `__COMPILED_VERSION_VARIABLE__`, update **both** Makefile
+> `sed`s and `fe-app-netshift/src/constants.ts` together. See
+> `frontend-luci.md` §6.
+
+---
+
+## 3. Docker build images
+
+- `Dockerfile-ipk` — `FROM itdoginfo/openwrt-sdk-ipk:24.10.6`.
+- `Dockerfile-apk` — `FROM itdoginfo/openwrt-sdk-apk:25.12.3`.
+- Both copy `./netshift` → `feeds/utilities/netshift` and
+  `./luci-app-netshift` → `feeds/luci/luci-app-netshift`, then run
+  `make defconfig` + `make package/<pkg>/compile`.
+- `sdk/Dockerfile-sdk-ipk` (`FROM openwrt/sdk:x86_64-v24.10.6`) and
+  `sdk/Dockerfile-sdk-apk` (`FROM openwrt/sdk:x86_64-v25.12.3`) are the **base
+  SDK images** that the `itdoginfo/openwrt-sdk-*` images derive from (feeds
+  updated, `luci-base` installed, feed dirs created; the apk one also runs
+  `./setup.sh`).
+
+### Version passing — symmetric, both RAW (no `v` prefix)
+
+Both release Dockerfiles now pass the version **raw**, with no `v` prefix:
+
+- `Dockerfile-ipk`: `ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}` — **raw, no
+  `v`**.
+- `Dockerfile-apk`: `ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}` — **raw, no
+  `v`**.
+
+> Historical note (task-028): `Dockerfile-ipk` used to **prepend `v`**
+> (`RUN export NETSHIFT_VERSION="v${NETSHIFT_VERSION}" && ...`) while the apk
+> file passed it raw. That asymmetry stamped a leading `v` into the ipk
+> package/control version and the runtime `constants.sh` `NETSHIFT_VERSION`,
+> so on OWRT24/ipk the installed version (`v0.8.6`) never matched the no-`v`
+> GitHub tag (`0.8.6`) and the LuCI UI falsely reported "outdated". The `v`
+> prepend was removed (ipk normalized to the apk shape) after verifying the
+> whole release flow (§4) and `install.sh` matching (§6): the `_`→`-` rename,
+> the 3-package filter, the i18n `-${VERSION}` naming, and the release tag all
+> derive from the git tag, and `install.sh` matches assets by **name prefix**
+> (the `v` lived in the version segment, not the name prefix) — so dropping it
+> does not affect either. Keep both Dockerfiles passing the version raw.
+>
+> Residual fragility (out of scope, on record): the UI version-equality check
+> in `fe-app-netshift` does **not** normalize a leading `v`. If a future
+> release is tagged **with** a `v` (e.g. `v0.8.7`), `netshift_latest_version`
+> would carry `v` while the installed (no-`v`) version would not, re-triggering
+> the false-"outdated" mismatch. **Tag releases WITHOUT a `v`** to keep
+> ipk / apk / tag all consistent.
+
+---
+
+## 4. Release flow (`.github/workflows/build.yml`)
+
+Triggered on **tag push** (`tags: ['*']`). Jobs:
+
+1. **`smoke-tests`** — builds and runs the OpenWRT rootfs smoke suite
+   (`docker compose -f tests/docker-compose.yml run --rm netshift-test all`).
+   This is a **gate**: `build` `needs` it.
+2. **`preparation`** — derives the version:
+   `git describe --tags --exact-match || "0.$(date +%d%m%Y)"`.
+3. **`build`** (matrix `ipk` + `apk`) — builds via
+   `Dockerfile-<type>`, passing `NETSHIFT_VERSION` from `preparation`; then
+   `docker create` + `docker cp` the built packages out of
+   `/builder/bin/packages/x86_64/{utilities,luci}/`.
+4. **ipk-only rename** — for `ipk`, every `*.ipk` filename is rewritten with
+   `sed 's/_/-/g'` (underscore → dash).
+5. **Filter** — copies exactly the **three** packages into `filtered-bin/`:
+   `luci-i18n-netshift-ru-*`, `netshift-*`, `luci-app-netshift-*` (the i18n
+   one is renamed to carry `${VERSION}`).
+6. **`release`** — downloads both matrices' artifacts and publishes a
+   **GitHub Release** (`softprops/action-gh-release`) named/tagged
+   `github.ref_name`.
+
+The underscore→dash rename (step 4) is **load-bearing**: `install.sh` matches
+release assets by **package-name prefix** (see §6), and the dashed names are
+what it expects.
+
+---
+
+## 5. Smoke tests (`tests/`)
+
+- Runs in an **OpenWRT 24.10.6 rootfs** container (`tests/Dockerfile`: pulls
+  the official `openwrt-24.10.6-x86-64-rootfs.tar.gz`, `opkg install`s
+  `sing-box curl jq coreutils-base64 bind-dig nftables`).
+- Source is **bind-mounted read-only**: `../netshift/files` →
+  `/netshift/files:ro` (see `tests/docker-compose.yml`). The container has no
+  copy of the scripts — it tests the live source tree.
+- Requires kernel caps **`NET_ADMIN` + `NET_RAW` + `SYS_ADMIN`** and
+  `network_mode: host` (for real nft / DNS operations).
+- `entrypoint.sh` `main()` dispatches by category. The `all` target runs, in
+  order: `test_deps test_syntax test_config test_helpers test_jq_helpers
+  test_config_manager test_sing_box_config test_nft test_diagnostics
+  test_subscription`. The usage line lists:
+  `all deps syntax config helpers jq cm sb nft diagnostics subscription`.
+
+### How to ADD a smoke test
+
+1. Write a `test_xyz()` function using the existing helpers:
+   `header`, `pass`, `fail`, `skip` (they drive the `PASS`/`FAIL`/`SKIP`
+   counters and `summary`). For sub-shells, emit `name:OK` / `name:FAIL` /
+   `name:SKIP` lines and let the `case` parser pick them up (see
+   `test_helpers` / `test_subscription`).
+2. Add it to the `all)` list in `main()`.
+3. Add a short **case alias** (e.g. `xyz) test_xyz ;;`).
+4. Update the **usage line** in `main()` (the `Available: ...` echo).
+5. Update the **`docker-compose.yml` comment** that documents test names.
+
+---
+
+## 6. CI gates by path
+
+| Workflow | Triggers (paths) | What it does |
+|---|---|---|
+| `frontend-ci.yml` | `fe-app-netshift/**` (PR) | `yarn install --frozen-lockfile`, `yarn format` (fail on diff), `yarn lint --max-warnings=0`, `yarn test --run`, `yarn build` (fail on diff). See `frontend-luci.md`. |
+| `shellcheck.yml` | `install.sh`, `netshift/files/usr/bin/**`, `netshift/files/usr/lib/**` (push/PR to `main`/`rc/**`) | Differential ShellCheck, `severity: error`, include-paths `netshift/files/usr/bin/netshift`, `netshift/files/usr/lib/**.sh`, `install.sh`. |
+| `openwrt-smoke-tests.yml` | `netshift/**`, `luci-app-netshift/**`, `tests/**`, `install.sh`, `Dockerfile-ipk`, `Dockerfile-apk`, `.dockerignore` (push/PR to `main`/`rc/**`) | Builds the smoke image and runs `netshift-test all`. |
+
+> **Keep the two smoke invocations in sync.** `build.yml`'s `smoke-tests` job
+> runs the suite **only on tag push**; PR/branch coverage comes from the
+> separate `openwrt-smoke-tests.yml`. Both call
+> `docker compose -f tests/docker-compose.yml ... netshift-test all` — if you
+> change one compose command (image name, target, flags), change the other.
+
+---
+
+## 7. `install.sh`
+
+- **POSIX `sh`** (BusyBox `ash` compatible); shellcheck-gated at `error`.
+- **Package-manager abstraction:** detects `apk` (`PKG_IS_APK=1`) vs `opkg`
+  and wraps install/remove/update/list (`pkg_install`, `pkg_remove`,
+  `pkg_is_installed`, etc.). apk install uses `--allow-untrusted`; opkg remove
+  uses `--force-depends`.
+- **podkop → netshift migration** (`migrate_from_podkop`, triggered by
+  `podkop_is_installed` since podkop never reached 0.8.0): **stop the old
+  service first** (`/etc/init.d/podkop stop` then `disable`) so dnsmasq/nft
+  teardown happens, **back up config** to
+  `/etc/config/podkop.bak.pre-netshift`, copy config to
+  `/etc/config/netshift`, remove the original `/etc/config/podkop`, clean the
+  old `105 podkop` rt_tables line and podkop cron entries, and remove the old
+  `luci-i18n-podkop*` / `luci-app-podkop` / `podkop` packages.
+- **OpenWRT 23.05 is unsupported** (since NetShift 0.8.0): `check_system`
+  exits if `DISTRIB_RELEASE` major == `23`.
+- **Space requirement:** needs **≥ 15 MB** free in `/overlay`
+  (`REQUIRED_SPACE=15360` KB).
+- **Asset matching:** scrapes the latest-release API
+  (`https://api.github.com/repos/yandexru45/netshift/releases/latest`),
+  greps `.apk`/`.ipk` URLs, then installs by **package-name prefix**
+  (loops `for pkg in netshift luci-app-netshift`, plus
+  `luci-i18n-netshift-ru*`). This is why the ipk underscore→dash rename in
+  `build.yml` (§4) is load-bearing.
+- **NO uninstall path.** `install.sh` only installs/migrates; removal lives in
+  the package `prerm` (see §2). Do not add an uninstaller here.
+- **Known fragility:** GitHub API **rate limiting** — the script detects
+  `API rate limit` and exits with a "repeat in five minutes" message.
diff --git a/docs/agent-rules/project-core.md b/docs/agent-rules/project-core.md
new file mode 100644
index 00000000..39b8495e
--- /dev/null
+++ b/docs/agent-rules/project-core.md
@@ -0,0 +1,112 @@
+# NetShift — Project Core Rules (AUTHORITATIVE)
+
+> Single source of truth for AI agents working anywhere in this repo. Read this before touching code. Every rule below is grounded in the actual source — do not invent values.
+
+## 1. Project identity
+
+NetShift is an OpenWRT traffic router built on top of [sing-box](https://github.com/SagerNet/sing-box): it selectively routes chosen domains/subnets through a tunnel and sends everything else directly. It is a fork of [itdoginfo/podkop](https://github.com/itdoginfo/podkop), rebranded to NetShift at version `0.8.0`. The project is **beta** (expect breaking changes). License: **GPL-2.0-or-later** (`LICENSE`), with a **separate trademark policy** — the NetShift name and logos are protected; see `TRADEMARK.md`. Code is GPL-licensed; the brand is not.
+
+Hard requirements (target device):
+- OpenWRT **24.10+**
+- `sing-box >= 1.12.0` (`SB_REQUIRED_VERSION` in `constants.sh`)
+- `jq >= 1.7.1` (`JQ_REQUIRED_VERSION`)
+- `coreutils-base64 >= 9.7` (`COREUTILS_BASE64_REQUIRED_VERSION`)
+- `>= 25 MB` free space (16 MB flash devices unsupported)
+
+## 2. The three packages and strict dependency direction
+
+Layers point in ONE direction. **No layer skips another.**
+
+```
+luci-app-netshift  (TS/LuCI UI, hand-written views + generated main.js)
+        │  consumes the generated main.js produced from
+        ▼
+fe-app-netshift    (TypeScript source, built with tsup)
+        │  UI talks ONLY to the backend, never to sing-box/nft/dnsmasq directly
+        ▼
+netshift backend   via LuCI fs.exec of /usr/bin/netshift and /etc/init.d/netshift (ACL-gated)
+        │
+        ▼
+sing-box / nftables / dnsmasq
+```
+
+- `luci-app-netshift` — LuCI web UI. Its `htdocs/.../view/netshift/main.js` is **generated** from `fe-app-netshift`. Hand-written views live alongside it.
+- `fe-app-netshift` — the TypeScript source of `main.js` (fetchers, methods, services, tabs). Edit UI logic **here**, not in the generated bundle.
+- `netshift` — the backend package (POSIX ash + jq): CLI dispatcher `/usr/bin/netshift`, procd init `/etc/init.d/netshift`, libraries in `/usr/lib/netshift/`, UCI config `/etc/config/netshift`.
+
+The UI never reimplements backend logic; it invokes backend commands. The backend never depends on the UI.
+
+## 3. Runtime contract (sacred — do not change casually)
+
+These values are wired across `constants.sh`, `nft.sh`, the CLI, and the generated sing-box config. Changing one without the rest breaks the whole chain.
+
+| Concept | Value | Source constant |
+|---|---|---|
+| tproxy inbound | `127.0.0.1:1602` | `SB_TPROXY_INBOUND_ADDRESS` / `SB_TPROXY_INBOUND_PORT` |
+| DNS inbound | `127.0.0.42:53` | `SB_DNS_INBOUND_ADDRESS` / `SB_DNS_INBOUND_PORT` |
+| Service mixed inbound | `127.0.0.1:4534` | `SB_SERVICE_MIXED_INBOUND_*` |
+| Clash API controller | `:9090` | `SB_CLASH_API_CONTROLLER_PORT` |
+| FakeIP range | `198.18.0.0/15` | `SB_FAKEIP_INET4_RANGE` |
+| nft FakeIP mark | `0x00100000` | `NFT_FAKEIP_MARK` |
+| nft outbound mark | `0x00200000` | `NFT_OUTBOUND_MARK` |
+| nft table | `NetShiftTable` (family `inet`) | `NFT_TABLE_NAME` |
+| routing table | `105 netshift` | `RT_TABLE_NAME` + `/etc/iproute2/rt_tables` |
+| state dir | `/etc/netshift` | `NETSHIFT_STATE_DIR` |
+| sing-box config | `/etc/sing-box/config.json` (UCI `settings.config_path`) | UCI |
+
+These ports, marks, addresses, the nft table name, and the routing table id are **sacred**. They are referenced in `nft.sh` rules, `route_table_rule_mark`, dnsmasq integration (`127.0.0.42`), diagnostics (`check_sing_box`, `check_nft_rules`, `check_dns_available`), and the generated config. Treat any change to them as a system-level change (§4).
+
+## 4. System-level change rule
+
+A change is **system-level** if it touches any of:
+- nft rules / sets / chains, routing rules or tables, fwmarks
+- sing-box config schema or generation
+- dnsmasq integration (server `127.0.0.42`, `noresolv`, `cachesize`, backup/restore)
+- UCI schema (`/etc/config/netshift`)
+- ports / marks / tags in `constants.sh`
+- packaging (`Makefile`, install, conffiles, dependencies)
+- the payment-free subscription flow (download → validate → cache → generate outbounds)
+
+For system-level changes you MUST verify the **whole chain**, not a single file:
+
+```
+UCI (config_get) → config generation (sing_box_*) → sing-box -c <file> check → nft rules → running service
+```
+
+Validate by running the smoke tests and, where relevant, confirming the generated config still passes `sing-box check` and the nft table/routing still install (see `start_main` in `/usr/bin/netshift`).
+
+## 5. Repo-wide conventions
+
+- **LF line endings everywhere.** `.gitattributes` enforces `* text=auto eol=lf`. Never introduce CRLF.
+- **No magic strings.** All ports, IPs, marks, tags, paths, versions, and service lists live in `netshift/files/usr/lib/constants.sh`, grouped as `## Common`, `## nft`, `## sing-box`, `## Lists`. New constants go there.
+- Community service list is `COMMUNITY_SERVICES` in `constants.sh`; the UI and `validate_service` both depend on it.
+
+## 6. Mandatory quality gates (CI a contributor must pass)
+
+These gate every PR. Use the matching skills.
+
+1. **ShellCheck** (`.github/workflows/shellcheck.yml`) — severity `error`, over:
+   - `install.sh`
+   - `netshift/files/usr/bin/netshift`
+   - `netshift/files/usr/lib/**.sh`
+   - Skill: `shellcheck`.
+2. **OpenWRT smoke tests** (`.github/workflows/openwrt-smoke-tests.yml`) — runs `tests/entrypoint.sh` in an OpenWRT rootfs via `tests/docker-compose.yml` (`run --rm netshift-test all`).
+   - Skill: `smoke-tests`.
+3. **Frontend `yarn ci`** (in `fe-app-netshift`) — defined as:
+   `yarn format && yarn lint --max-warnings=0 && yarn test --run && yarn build`
+   i.e. prettier (no diff), ESLint with `--max-warnings=0`, vitest, and a build that must produce no diff in the committed `main.js`.
+   - Skill: `frontend-ci`.
+
+## 7. Contribution gating
+
+- `CODEOWNERS = @yandexru45`.
+- PRs are accepted **only after coordination with the authors via Telegram** (per README; see `t.me/netshift_chat`).
+- **Agents NEVER auto-commit.** A human reviews and commits manually. Do not run `git commit`, `git push`, amend, or open PRs unless the human explicitly asks.
+
+## 8. Anti-patterns (do NOT do these)
+
+- Hardcoding ports / IPs / marks / paths instead of using `constants.sh`.
+- Duplicating routing/marking logic instead of reusing `nft.sh` / `route_table_rule_mark` / `create_nft_rules`.
+- Editing the generated `main.js` by hand — edit `fe-app-netshift` TS source and rebuild.
+- Reimplementing backend logic in the UI — the UI must call `/usr/bin/netshift` / `/etc/init.d/netshift`.
+- Changing a sacred runtime value in one place while leaving the rest of the chain stale.
diff --git a/docs/icon.png b/docs/icon.png
new file mode 100644
index 00000000..798633ec
Binary files /dev/null and b/docs/icon.png differ
diff --git a/docs/tasks/TEMPLATE-review.md b/docs/tasks/TEMPLATE-review.md
new file mode 100644
index 00000000..5c1d44fd
--- /dev/null
+++ b/docs/tasks/TEMPLATE-review.md
@@ -0,0 +1,55 @@
+# Code Review — <Title> (task-NNN)
+
+> Authored by `code-reviewer`. File name: `<task-name>-review-001.md`
+> (use `-002`, `-003`, ... or append a "Re-review" section for later rounds).
+
+**Review ID:** review-001
+**Date:** <YYYY-MM-DD>
+**Scope:** <uncommitted working-tree changes | branch X vs base>
+**Reviewer:** code-reviewer agent
+
+**Files reviewed:**
+- `path/...`
+
+---
+
+## Summary
+
+<Brief, neutral assessment of what the change does and its overall quality. No
+flattery.>
+
+## Critical Issues
+
+> Must fix before merge. Architecture violations, broken runtime contract, jq
+> regex on OpenWRT, missing `exit 1` after `fatal`, hand-edited `main.js`, traffic
+> leaks, etc.
+
+### [C1] <Issue title>
+- **File:** `path/to/file` (line X)
+- **Problem:** <what is wrong and why it matters>
+- **Recommendation:** <concrete fix>
+
+## Significant Issues
+
+### [S1] <Issue title>
+- **File:** `path/to/file` (line X)
+- **Problem:** ...
+- **Recommendation:** ...
+
+## Minor Observations
+
+- **[M1]** `path/to/file`: <short note>
+
+## Test Coverage
+
+<Were the required tests/gates added and run? Backend config-gen/subscription →
+smoke test? New pure frontend logic → vitest? Was the relevant gate green? If
+frontend tests were explicitly not required, say so and state what was verified
+by reasoning + build.>
+
+## Verdict
+
+**APPROVED** | **APPROVED WITH CONDITIONS** | **REQUIRES CHANGES**
+
+<One sentence overall. If conditional, list "Conditions before merge" by issue
+ID. If changes required, list "Required before merge" by issue ID.>
diff --git a/docs/tasks/TEMPLATE-task.md b/docs/tasks/TEMPLATE-task.md
new file mode 100644
index 00000000..9c109c4f
--- /dev/null
+++ b/docs/tasks/TEMPLATE-task.md
@@ -0,0 +1,62 @@
+# Task: <imperative title>
+
+> Authored by `architect-orchestrator`. One self-contained spec per subtask.
+> File name: `task-NNN-<kebab-slug>.md`.
+
+## Context
+
+<Narrative: what the user wants and why. Link any relevant prior tasks.>
+
+### Root cause / research basis (authoritative)
+
+<What investigation established. Cite `file:line`. State facts, not guesses.>
+
+### Operator decisions (already made — do NOT re-ask)
+
+- <Design choice the operator already approved, e.g. "Variant 2".>
+
+## Goal
+
+<One paragraph describing the desired end state.>
+
+## Scope
+
+- Layer(s): <backend ash/jq | TS/LuCI frontend | packaging/CI>.
+- Files to modify (exact paths):
+  - `path/one`
+  - `path/two`
+- Do NOT touch: <explicit out-of-scope files/areas>.
+
+## Requirements
+
+### 1. <numbered requirement>
+
+<Be specific. Include exact target `file:line` and fenced code blocks of the
+intended change where helpful.>
+
+### 2. <numbered requirement>
+
+## Architecture Notes
+
+- Applicable rules: <e.g. `docs/agent-rules/backend-shell.md` (no jq regex;
+  `fatal` needs `exit 1`)>.
+- Runtime-contract impact: <none | which ports/marks/paths and the whole-chain
+  verification required>.
+- Single-source-of-truth constraints: <constants.sh; barrel→main.*; etc.>.
+
+## Tests Required
+
+- Backend: <which `test_*` to add/extend in `tests/entrypoint.sh`, or "covered
+  by existing X">. Run the `shellcheck` and `smoke-tests` skills.
+- Frontend: <vitest `.test.js` to add, or "verify by reasoning + build">. Run
+  the `frontend-ci` skill; ensure `main.js` rebuild leaves no git diff.
+- Packaging: <smoke tests; verify ipk + apk paths>.
+
+## Definition of Done
+
+- [ ] All requirements implemented in scope; nothing out-of-scope changed.
+- [ ] Relevant gate(s) pass (shellcheck / smoke-tests / yarn ci).
+- [ ] (Frontend) `main.js` regenerated; `git diff` clean after build.
+- [ ] Runtime contract intact (or whole chain verified if changed).
+- [ ] New user-facing strings wrapped in `_()` (frontend).
+- [ ] `code-reviewer` verdict: APPROVED or APPROVED WITH CONDITIONS.
diff --git a/fe-app-netshift/.env.example b/fe-app-netshift/.env.example
new file mode 100644
index 00000000..4cf8dfa0
--- /dev/null
+++ b/fe-app-netshift/.env.example
@@ -0,0 +1,16 @@
+SFTP_HOST=192.168.160.129
+SFTP_PORT=22
+SFTP_USER=root
+SFTP_PASS=
+
+# you can use key if needed
+# SFTP_PRIVATE_KEY=~/.ssh/id_rsa
+
+LOCAL_DIR_FE=../luci-app-netshift/htdocs/luci-static/resources/view/netshift
+REMOTE_DIR_FE=/www/luci-static/resources/view/netshift
+
+LOCAL_DIR_BIN=../netshift/files/usr/bin/
+REMOTE_DIR_BIN=/usr/bin/
+
+LOCAL_DIR_LIB=../netshift/files/usr/lib/
+REMOTE_DIR_LIB=/usr/lib/netshift/
diff --git a/fe-app-podkop/.prettierrc b/fe-app-netshift/.prettierrc
similarity index 100%
rename from fe-app-podkop/.prettierrc
rename to fe-app-netshift/.prettierrc
diff --git a/fe-app-podkop/distribute-locales.js b/fe-app-netshift/distribute-locales.js
similarity index 80%
rename from fe-app-podkop/distribute-locales.js
rename to fe-app-netshift/distribute-locales.js
index 0bc27b23..48c303cc 100644
--- a/fe-app-podkop/distribute-locales.js
+++ b/fe-app-netshift/distribute-locales.js
@@ -6,7 +6,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 const sourceDir = path.resolve(__dirname, 'locales');
-const targetRoot = path.resolve(__dirname, '../luci-app-podkop/po');
+const targetRoot = path.resolve(__dirname, '../luci-app-netshift/po');
 
 async function main() {
     const files = await fs.readdir(sourceDir);
@@ -14,17 +14,17 @@ async function main() {
     for (const file of files) {
         const filePath = path.join(sourceDir, file);
 
-        if (file === 'podkop.pot') {
-            const potTarget = path.join(targetRoot, 'templates', 'podkop.pot');
+        if (file === 'netshift.pot') {
+            const potTarget = path.join(targetRoot, 'templates', 'netshift.pot');
             await fs.mkdir(path.dirname(potTarget), { recursive: true });
             await fs.copyFile(filePath, potTarget);
             console.log(`✅ Copied POT: ${filePath} → ${potTarget}`);
         }
 
-        const match = file.match(/^podkop\.([a-zA-Z_]+)\.po$/);
+        const match = file.match(/^netshift\.([a-zA-Z_]+)\.po$/);
         if (match) {
             const lang = match[1];
-            const poTarget = path.join(targetRoot, lang, 'podkop.po');
+            const poTarget = path.join(targetRoot, lang, 'netshift.po');
             await fs.mkdir(path.dirname(poTarget), { recursive: true });
             await fs.copyFile(filePath, poTarget);
             console.log(`✅ Copied ${lang.toUpperCase()}: ${filePath} → ${poTarget}`);
diff --git a/fe-app-podkop/eslint.config.js b/fe-app-netshift/eslint.config.js
similarity index 100%
rename from fe-app-podkop/eslint.config.js
rename to fe-app-netshift/eslint.config.js
diff --git a/fe-app-podkop/extract-calls.js b/fe-app-netshift/extract-calls.js
similarity index 93%
rename from fe-app-podkop/extract-calls.js
rename to fe-app-netshift/extract-calls.js
index 6b7d765e..0bab3b73 100644
--- a/fe-app-podkop/extract-calls.js
+++ b/fe-app-netshift/extract-calls.js
@@ -19,12 +19,12 @@ function stripIllegalReturn(code) {
 
 const files = await glob([
     'src/**/*.ts',
-    '../luci-app-podkop/htdocs/luci-static/resources/view/podkop/**/*.js',
+    '../luci-app-netshift/htdocs/luci-static/resources/view/netshift/**/*.js',
 ], {
     ignore: [
         '**/*.test.ts',
         '**/main.js',
-        '../luci-app-podkop/htdocs/luci-static/resources/view/podkop/main.js',
+        '../luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js',
     ],
     absolute: true,
 });
diff --git a/fe-app-podkop/generate-po.js b/fe-app-netshift/generate-po.js
similarity index 92%
rename from fe-app-podkop/generate-po.js
rename to fe-app-netshift/generate-po.js
index 234d6b8e..1859666a 100644
--- a/fe-app-podkop/generate-po.js
+++ b/fe-app-netshift/generate-po.js
@@ -8,7 +8,7 @@ if (!lang) {
 }
 
 const callsPath = 'locales/calls.json';
-const poPath = `locales/podkop.${lang}.po`;
+const poPath = `locales/netshift.${lang}.po`;
 
 function getGitUser() {
     try {
@@ -36,14 +36,14 @@ function getHeader(lang) {
         : 'nplurals=2; plural=(n != 1);';
 
     return [
-        `# ${lang.toUpperCase()} translations for PODKOP package.`,
-        `# Copyright (C) ${now.getFullYear()} THE PODKOP'S COPYRIGHT HOLDER`,
-        `# This file is distributed under the same license as the PODKOP package.`,
+        `# ${lang.toUpperCase()} translations for NETSHIFT package.`,
+        `# Copyright (C) ${now.getFullYear()} THE NETSHIFT'S COPYRIGHT HOLDER`,
+        `# This file is distributed under the same license as the NETSHIFT package.`,
         `# ${translator}, ${now.getFullYear()}.`,
         '#',
         'msgid ""',
         'msgstr ""',
-        `"Project-Id-Version: PODKOP\\n"`,
+        `"Project-Id-Version: NETSHIFT\\n"`,
         `"Report-Msgid-Bugs-To: \\n"`,
         `"POT-Creation-Date: ${date} ${time}${tzOffset}\\n"`,
         `"PO-Revision-Date: ${date} ${time}${tzOffset}\\n"`,
diff --git a/fe-app-podkop/generate-pot.js b/fe-app-netshift/generate-pot.js
similarity index 96%
rename from fe-app-podkop/generate-pot.js
rename to fe-app-netshift/generate-pot.js
index b7390440..3af0f84a 100644
--- a/fe-app-podkop/generate-pot.js
+++ b/fe-app-netshift/generate-pot.js
@@ -2,8 +2,8 @@ import fs from 'fs/promises';
 import { execSync } from 'child_process';
 
 const inputFile = 'locales/calls.json';
-const outputFile = 'locales/podkop.pot';
-const projectId = 'PODKOP';
+const outputFile = 'locales/netshift.pot';
+const projectId = 'NETSHIFT';
 
 function getGitUser() {
     const name = execSync('git config user.name').toString().trim();
diff --git a/fe-app-netshift/locales/calls.json b/fe-app-netshift/locales/calls.json
new file mode 100644
index 00000000..51179121
--- /dev/null
+++ b/fe-app-netshift/locales/calls.json
@@ -0,0 +1,2561 @@
+[
+  {
+    "call": "✔ Enabled",
+    "key": "✔ Enabled",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:345"
+    ]
+  },
+  {
+    "call": "✔ Running",
+    "key": "✔ Running",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:356"
+    ]
+  },
+  {
+    "call": "✘ Disabled",
+    "key": "✘ Disabled",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:346"
+    ]
+  },
+  {
+    "call": "✘ Stopped",
+    "key": "✘ Stopped",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:357"
+    ]
+  },
+  {
+    "call": "Active Connections",
+    "key": "Active Connections",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:307"
+    ]
+  },
+  {
+    "call": "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged.",
+    "key": "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:123"
+    ]
+  },
+  {
+    "call": "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    "key": "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:607"
+    ]
+  },
+  {
+    "call": "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    "key": "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:695"
+    ]
+  },
+  {
+    "call": "Additional marking rules found",
+    "key": "Additional marking rules found",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:99"
+    ]
+  },
+  {
+    "call": "Advanced",
+    "key": "Advanced",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:31",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:36"
+    ]
+  },
+  {
+    "call": "Allow insecure TLS for subscription fetch",
+    "key": "Allow insecure TLS for subscription fetch",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:163"
+    ]
+  },
+  {
+    "call": "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall.",
+    "key": "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:420"
+    ]
+  },
+  {
+    "call": "Applicable for SOCKS and Shadowsocks proxy",
+    "key": "Applicable for SOCKS and Shadowsocks proxy",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:390"
+    ]
+  },
+  {
+    "call": "At least one valid domain must be specified. Comments-only content is not allowed.",
+    "key": "At least one valid domain must be specified. Comments-only content is not allowed.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:667"
+    ]
+  },
+  {
+    "call": "At least one valid subnet or IP must be specified. Comments-only content is not allowed.",
+    "key": "At least one valid subnet or IP must be specified. Comments-only content is not allowed.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:756"
+    ]
+  },
+  {
+    "call": "Auto",
+    "key": "Auto",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:153"
+    ]
+  },
+  {
+    "call": "Available actions",
+    "key": "Available actions",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:45"
+    ]
+  },
+  {
+    "call": "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering.",
+    "key": "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:480"
+    ]
+  },
+  {
+    "call": "Block DoH Servers",
+    "key": "Block DoH Servers",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:479"
+    ]
+  },
+  {
+    "call": "Bootsrap DNS",
+    "key": "Bootsrap DNS",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:65"
+    ]
+  },
+  {
+    "call": "Bootstrap DNS server",
+    "key": "Bootstrap DNS server",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:80"
+    ]
+  },
+  {
+    "call": "Browser is not using FakeIP",
+    "key": "Browser is not using FakeIP",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:58"
+    ]
+  },
+  {
+    "call": "Browser is using FakeIP correctly",
+    "key": "Browser is using FakeIP correctly",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:57"
+    ]
+  },
+  {
+    "call": "By country flag",
+    "key": "By country flag",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:200"
+    ]
+  },
+  {
+    "call": "By name prefix",
+    "key": "By name prefix",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:201"
+    ]
+  },
+  {
+    "call": "Cache File Path",
+    "key": "Cache File Path",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:517"
+    ]
+  },
+  {
+    "call": "Cache file path cannot be empty",
+    "key": "Cache file path cannot be empty",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:531"
+    ]
+  },
+  {
+    "call": "Cannot receive checks result",
+    "key": "Cannot receive checks result",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:27",
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:28",
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:27",
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:25"
+    ]
+  },
+  {
+    "call": "Check update",
+    "key": "Check update",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:144",
+      "src/netshift/tabs/manager/cards.ts:181",
+      "src/netshift/tabs/manager/cards.ts:227"
+    ]
+  },
+  {
+    "call": "Checking, please wait",
+    "key": "Checking, please wait",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:15",
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:15",
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:13",
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:15",
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:13"
+    ]
+  },
+  {
+    "call": "checks",
+    "key": "checks",
+    "places": [
+      "src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts:2"
+    ]
+  },
+  {
+    "call": "Checks failed",
+    "key": "Checks failed",
+    "places": [
+      "src/netshift/tabs/diagnostic/helpers/getMeta.ts:26"
+    ]
+  },
+  {
+    "call": "Checks passed",
+    "key": "Checks passed",
+    "places": [
+      "src/netshift/tabs/diagnostic/helpers/getMeta.ts:13"
+    ]
+  },
+  {
+    "call": "CIDR must be between 0 and 32",
+    "key": "CIDR must be between 0 and 32",
+    "places": [
+      "src/validators/validateSubnet.ts:25"
+    ]
+  },
+  {
+    "call": "Clear subscription cache",
+    "key": "Clear subscription cache",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:127"
+    ]
+  },
+  {
+    "call": "Clearing subscription cache and re-downloading… this may take a minute",
+    "key": "Clearing subscription cache and re-downloading… this may take a minute",
+    "places": [
+      "src/netshift/tabs/diagnostic/initController.ts:329"
+    ]
+  },
+  {
+    "call": "Close",
+    "key": "Close",
+    "places": [
+      "src/partials/modal/renderModal.ts:26"
+    ]
+  },
+  {
+    "call": "Community Lists",
+    "key": "Community Lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:513"
+    ]
+  },
+  {
+    "call": "Component Manager",
+    "key": "Component Manager",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:83"
+    ]
+  },
+  {
+    "call": "Config File Path",
+    "key": "Config File Path",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:503"
+    ]
+  },
+  {
+    "call": "Configuration for NetShift service",
+    "key": "Configuration for NetShift service",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:30"
+    ]
+  },
+  {
+    "call": "Configuration Type",
+    "key": "Configuration Type",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:51"
+    ]
+  },
+  {
+    "call": "Connection",
+    "key": "Connection",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:16"
+    ]
+  },
+  {
+    "call": "Connection Type",
+    "key": "Connection Type",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:39"
+    ]
+  },
+  {
+    "call": "Connection type, transport and DNS resolver for this section",
+    "key": "Connection type, transport and DNS resolver for this section",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:17"
+    ]
+  },
+  {
+    "call": "Connection URL",
+    "key": "Connection URL",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:54"
+    ]
+  },
+  {
+    "call": "Copy",
+    "key": "Copy",
+    "places": [
+      "src/partials/modal/renderModal.ts:20"
+    ]
+  },
+  {
+    "call": "Core switch failed",
+    "key": "Core switch failed",
+    "places": [
+      "src/netshift/methods/shell/index.ts:159",
+      "src/netshift/methods/shell/pollSingBoxComponentAction.ts:65"
+    ]
+  },
+  {
+    "call": "Core switch timed out",
+    "key": "Core switch timed out",
+    "places": [
+      "src/netshift/methods/shell/pollSingBoxComponentAction.ts:82"
+    ]
+  },
+  {
+    "call": "Currently unavailable",
+    "key": "Currently unavailable",
+    "places": [
+      "src/netshift/tabs/dashboard/partials/renderWidget.ts:22"
+    ]
+  },
+  {
+    "call": "Custom domains",
+    "key": "Custom domains",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:606"
+    ]
+  },
+  {
+    "call": "Custom subnets",
+    "key": "Custom subnets",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:694"
+    ]
+  },
+  {
+    "call": "Dashboard",
+    "key": "Dashboard",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:39",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:31"
+    ]
+  },
+  {
+    "call": "Dashboard currently unavailable",
+    "key": "Dashboard currently unavailable",
+    "places": [
+      "src/netshift/tabs/dashboard/partials/renderSections.ts:20"
+    ]
+  },
+  {
+    "call": "Delay in milliseconds before reloading NetShift after interface UP",
+    "key": "Delay in milliseconds before reloading NetShift after interface UP",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:310"
+    ]
+  },
+  {
+    "call": "Delay value cannot be empty",
+    "key": "Delay value cannot be empty",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:317"
+    ]
+  },
+  {
+    "call": "Dev",
+    "key": "Dev",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:101"
+    ]
+  },
+  {
+    "call": "DHCP has DNS server",
+    "key": "DHCP has DNS server",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:93"
+    ]
+  },
+  {
+    "call": "Diagnostics",
+    "key": "Diagnostics",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:98"
+    ]
+  },
+  {
+    "call": "Disable autostart",
+    "key": "Disable autostart",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:81"
+    ]
+  },
+  {
+    "call": "Disable QUIC",
+    "key": "Disable QUIC",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:445"
+    ]
+  },
+  {
+    "call": "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
+    "key": "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:446"
+    ]
+  },
+  {
+    "call": "Disabled",
+    "key": "Disabled",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:611",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:699"
+    ]
+  },
+  {
+    "call": "Disables TLS certificate verification when downloading the subscription.",
+    "key": "Disables TLS certificate verification when downloading the subscription.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:164"
+    ]
+  },
+  {
+    "call": "DNS",
+    "key": "DNS",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:16"
+    ]
+  },
+  {
+    "call": "DNS on router",
+    "key": "DNS on router",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:88"
+    ]
+  },
+  {
+    "call": "DNS outbound section",
+    "key": "DNS outbound section",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:116"
+    ]
+  },
+  {
+    "call": "DNS over HTTPS (DoH)",
+    "key": "DNS over HTTPS (DoH)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:479",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:48"
+    ]
+  },
+  {
+    "call": "DNS over TLS (DoT)",
+    "key": "DNS over TLS (DoT)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:480",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:49"
+    ]
+  },
+  {
+    "call": "DNS Protocol Type",
+    "key": "DNS Protocol Type",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:476",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:45"
+    ]
+  },
+  {
+    "call": "DNS Rewrite TTL",
+    "key": "DNS Rewrite TTL",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:151"
+    ]
+  },
+  {
+    "call": "DNS Server",
+    "key": "DNS Server",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:490",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:58"
+    ]
+  },
+  {
+    "call": "DNS server address cannot be empty",
+    "key": "DNS server address cannot be empty",
+    "places": [
+      "src/validators/validateDns.ts:7"
+    ]
+  },
+  {
+    "call": "Do not panic, everything can be fixed, just...",
+    "key": "Do not panic, everything can be fixed, just...",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:27"
+    ]
+  },
+  {
+    "call": "Domain and subnet lists that decide which traffic uses this section",
+    "key": "Domain and subnet lists that decide which traffic uses this section",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:27"
+    ]
+  },
+  {
+    "call": "Domain Resolver",
+    "key": "Domain Resolver",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:465"
+    ]
+  },
+  {
+    "call": "Dont Touch My DHCP!",
+    "key": "Dont Touch My DHCP!",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:457"
+    ]
+  },
+  {
+    "call": "Downlink",
+    "key": "Downlink",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:241",
+      "src/netshift/tabs/dashboard/initController.ts:275"
+    ]
+  },
+  {
+    "call": "Download",
+    "key": "Download",
+    "places": [
+      "src/partials/modal/renderModal.ts:15"
+    ]
+  },
+  {
+    "call": "Download Lists via Proxy/VPN",
+    "key": "Download Lists via Proxy/VPN",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:340"
+    ]
+  },
+  {
+    "call": "Download Lists via specific proxy section",
+    "key": "Download Lists via specific proxy section",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:350"
+    ]
+  },
+  {
+    "call": "Downloading all lists via specific Proxy/VPN",
+    "key": "Downloading all lists via specific Proxy/VPN",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:341",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:351"
+    ]
+  },
+  {
+    "call": "Drop subscription servers whose name contains any of these keywords (case-insensitive).",
+    "key": "Drop subscription servers whose name contains any of these keywords (case-insensitive).",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:239"
+    ]
+  },
+  {
+    "call": "Dynamic List",
+    "key": "Dynamic List",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:612",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:700"
+    ]
+  },
+  {
+    "call": "Enable autostart",
+    "key": "Enable autostart",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:91"
+    ]
+  },
+  {
+    "call": "Enable built-in DNS resolver for domains handled by this section",
+    "key": "Enable built-in DNS resolver for domains handled by this section",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:466"
+    ]
+  },
+  {
+    "call": "Enable DNS resolve to get real IP when routing",
+    "key": "Enable DNS resolve to get real IP when routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:933"
+    ]
+  },
+  {
+    "call": "Enable IPv6 Support",
+    "key": "Enable IPv6 Support",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:491"
+    ]
+  },
+  {
+    "call": "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support.",
+    "key": "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:492"
+    ]
+  },
+  {
+    "call": "Enable Mixed Proxy",
+    "key": "Enable Mixed Proxy",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:902"
+    ]
+  },
+  {
+    "call": "Enable Output Network Interface",
+    "key": "Enable Output Network Interface",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:212"
+    ]
+  },
+  {
+    "call": "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies",
+    "key": "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:903"
+    ]
+  },
+  {
+    "call": "Enable YACD",
+    "key": "Enable YACD",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:409"
+    ]
+  },
+  {
+    "call": "Enable YACD WAN Access",
+    "key": "Enable YACD WAN Access",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:419"
+    ]
+  },
+  {
+    "call": "Enter complete outbound configuration in JSON format",
+    "key": "Enter complete outbound configuration in JSON format",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:99"
+    ]
+  },
+  {
+    "call": "Enter domain names separated by commas, spaces, or newlines. You can add comments using //",
+    "key": "Enter domain names separated by commas, spaces, or newlines. You can add comments using //",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:649"
+    ]
+  },
+  {
+    "call": "Enter domain names without protocols, e.g. example.com or sub.example.com",
+    "key": "Enter domain names without protocols, e.g. example.com or sub.example.com",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:622"
+    ]
+  },
+  {
+    "call": "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses",
+    "key": "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:710"
+    ]
+  },
+  {
+    "call": "Every 1 minute",
+    "key": "Every 1 minute",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:306"
+    ]
+  },
+  {
+    "call": "Every 12 hours",
+    "key": "Every 12 hours",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:185"
+    ]
+  },
+  {
+    "call": "Every 3 hours",
+    "key": "Every 3 hours",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:183"
+    ]
+  },
+  {
+    "call": "Every 3 minutes",
+    "key": "Every 3 minutes",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:307"
+    ]
+  },
+  {
+    "call": "Every 30 minutes",
+    "key": "Every 30 minutes",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:181"
+    ]
+  },
+  {
+    "call": "Every 30 seconds",
+    "key": "Every 30 seconds",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:305"
+    ]
+  },
+  {
+    "call": "Every 5 minutes",
+    "key": "Every 5 minutes",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:308"
+    ]
+  },
+  {
+    "call": "Every 6 hours",
+    "key": "Every 6 hours",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:184"
+    ]
+  },
+  {
+    "call": "Every day",
+    "key": "Every day",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:186"
+    ]
+  },
+  {
+    "call": "Every hour",
+    "key": "Every hour",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:182"
+    ]
+  },
+  {
+    "call": "Exclude NTP",
+    "key": "Exclude NTP",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:467"
+    ]
+  },
+  {
+    "call": "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
+    "key": "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:468"
+    ]
+  },
+  {
+    "call": "Exclude servers by keyword",
+    "key": "Exclude servers by keyword",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:238"
+    ]
+  },
+  {
+    "call": "Failed to clear subscription cache",
+    "key": "Failed to clear subscription cache",
+    "places": [
+      "src/netshift/methods/shell/index.ts:254",
+      "src/netshift/tabs/diagnostic/initController.ts:344",
+      "src/netshift/tabs/diagnostic/initController.ts:348"
+    ]
+  },
+  {
+    "call": "Failed to copy!",
+    "key": "Failed to copy!",
+    "places": [
+      "src/helpers/copyToClipboard.ts:12"
+    ]
+  },
+  {
+    "call": "Failed to execute!",
+    "key": "Failed to execute!",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:122",
+      "src/netshift/tabs/manager/initController.ts:132",
+      "src/netshift/tabs/manager/initController.ts:150",
+      "src/netshift/tabs/manager/initController.ts:160",
+      "src/netshift/tabs/manager/initController.ts:188",
+      "src/netshift/tabs/manager/initController.ts:192",
+      "src/netshift/tabs/manager/initController.ts:225",
+      "src/netshift/tabs/manager/initController.ts:229",
+      "src/netshift/tabs/diagnostic/initController.ts:229",
+      "src/netshift/tabs/diagnostic/initController.ts:233",
+      "src/netshift/tabs/diagnostic/initController.ts:263",
+      "src/netshift/tabs/diagnostic/initController.ts:267",
+      "src/netshift/tabs/diagnostic/initController.ts:304",
+      "src/netshift/tabs/diagnostic/initController.ts:308"
+    ]
+  },
+  {
+    "call": "Fastest",
+    "key": "Fastest",
+    "places": [
+      "src/netshift/methods/custom/getDashboardSections.ts:150",
+      "src/netshift/methods/custom/getDashboardSections.ts:181",
+      "src/netshift/methods/custom/getDashboardSections.ts:218",
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:58"
+    ]
+  },
+  {
+    "call": "Fully Routed IPs",
+    "key": "Fully Routed IPs",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:874"
+    ]
+  },
+  {
+    "call": "Get global check",
+    "key": "Get global check",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:100"
+    ]
+  },
+  {
+    "call": "Global check",
+    "key": "Global check",
+    "places": [
+      "src/netshift/tabs/diagnostic/initController.ts:224"
+    ]
+  },
+  {
+    "call": "Global Proxy",
+    "key": "Global Proxy",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:400"
+    ]
+  },
+  {
+    "call": "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters.",
+    "key": "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:195"
+    ]
+  },
+  {
+    "call": "How often to automatically update the subscription",
+    "key": "How often to automatically update the subscription",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:179"
+    ]
+  },
+  {
+    "call": "HTTP error",
+    "key": "HTTP error",
+    "places": [
+      "src/netshift/api.ts:27"
+    ]
+  },
+  {
+    "call": "Include servers by keyword",
+    "key": "Include servers by keyword",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:226"
+    ]
+  },
+  {
+    "call": "Install %s",
+    "key": "Install %s",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:136",
+      "src/netshift/tabs/manager/cards.ts:174",
+      "src/netshift/tabs/manager/cards.ts:220"
+    ]
+  },
+  {
+    "call": "Installed version is newer than release",
+    "key": "Installed version is newer than release",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:96"
+    ]
+  },
+  {
+    "call": "Interface Monitoring",
+    "key": "Interface Monitoring",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:275"
+    ]
+  },
+  {
+    "call": "Interface Monitoring Delay",
+    "key": "Interface Monitoring Delay",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:309"
+    ]
+  },
+  {
+    "call": "Interface monitoring for Bad WAN",
+    "key": "Interface monitoring for Bad WAN",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:276"
+    ]
+  },
+  {
+    "call": "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH",
+    "key": "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH",
+    "places": [
+      "src/validators/validateDns.ts:39"
+    ]
+  },
+  {
+    "call": "Invalid domain address",
+    "key": "Invalid domain address",
+    "places": [
+      "src/validators/validateDomain.ts:18",
+      "src/validators/validateDomain.ts:27"
+    ]
+  },
+  {
+    "call": "Invalid format. Use X.X.X.X/Y or IPv6/Y",
+    "key": "Invalid format. Use X.X.X.X/Y or IPv6/Y",
+    "places": [
+      "src/validators/validateSubnet.ts:57"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: insecure must be 0 or 1",
+    "key": "Invalid HY2 URL: insecure must be 0 or 1",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:90"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: invalid port number",
+    "key": "Invalid HY2 URL: invalid port number",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:77"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: missing credentials/server",
+    "key": "Invalid HY2 URL: missing credentials/server",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:30"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: missing host",
+    "key": "Invalid HY2 URL: missing host",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:47"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: missing host & port",
+    "key": "Invalid HY2 URL: missing host & port",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:41"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: missing password",
+    "key": "Invalid HY2 URL: missing password",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:36"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: missing port",
+    "key": "Invalid HY2 URL: missing port",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:50"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: must not contain spaces",
+    "key": "Invalid HY2 URL: must not contain spaces",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:18"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: must start with hysteria2:// or hy2://",
+    "key": "Invalid HY2 URL: must start with hysteria2:// or hy2://",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:12"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: obfs-password required when obfs is set",
+    "key": "Invalid HY2 URL: obfs-password required when obfs is set",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:108"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: parsing failed",
+    "key": "Invalid HY2 URL: parsing failed",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:122"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: sni cannot be empty",
+    "key": "Invalid HY2 URL: sni cannot be empty",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:116"
+    ]
+  },
+  {
+    "call": "Invalid HY2 URL: unsupported obfs type",
+    "key": "Invalid HY2 URL: unsupported obfs type",
+    "places": [
+      "src/validators/validateHysteriaUrl.ts:98"
+    ]
+  },
+  {
+    "call": "Invalid IP address",
+    "key": "Invalid IP address",
+    "places": [
+      "src/validators/validateIp.ts:11"
+    ]
+  },
+  {
+    "call": "Invalid IPv6 address",
+    "key": "Invalid IPv6 address",
+    "places": [
+      "src/validators/validateIp.ts:66"
+    ]
+  },
+  {
+    "call": "Invalid JSON format",
+    "key": "Invalid JSON format",
+    "places": [
+      "src/validators/validateOutboundJson.ts:9"
+    ]
+  },
+  {
+    "call": "Invalid path format. Path must start with \"/\" and contain valid characters",
+    "key": "Invalid path format. Path must start with \"/\" and contain valid characters",
+    "places": [
+      "src/validators/validatePath.ts:22"
+    ]
+  },
+  {
+    "call": "Invalid port number. Must be between 1 and 65535",
+    "key": "Invalid port number. Must be between 1 and 65535",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:85"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: decoded credentials must contain method:password",
+    "key": "Invalid Shadowsocks URL: decoded credentials must contain method:password",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:37"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: missing credentials",
+    "key": "Invalid Shadowsocks URL: missing credentials",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:27"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: missing method and password separator \":\"",
+    "key": "Invalid Shadowsocks URL: missing method and password separator \":\"",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:46"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: missing port",
+    "key": "Invalid Shadowsocks URL: missing port",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:76"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: missing server",
+    "key": "Invalid Shadowsocks URL: missing server",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:67"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: missing server address",
+    "key": "Invalid Shadowsocks URL: missing server address",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:58"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: must not contain spaces",
+    "key": "Invalid Shadowsocks URL: must not contain spaces",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:16"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: must start with ss://",
+    "key": "Invalid Shadowsocks URL: must start with ss://",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:8"
+    ]
+  },
+  {
+    "call": "Invalid Shadowsocks URL: parsing failed",
+    "key": "Invalid Shadowsocks URL: parsing failed",
+    "places": [
+      "src/validators/validateShadowsocksUrl.ts:91"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: invalid host format",
+    "key": "Invalid SOCKS URL: invalid host format",
+    "places": [
+      "src/validators/validateSocksUrl.ts:73"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: invalid port number",
+    "key": "Invalid SOCKS URL: invalid port number",
+    "places": [
+      "src/validators/validateSocksUrl.ts:63"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: missing host and port",
+    "key": "Invalid SOCKS URL: missing host and port",
+    "places": [
+      "src/validators/validateSocksUrl.ts:42"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: missing hostname or IP",
+    "key": "Invalid SOCKS URL: missing hostname or IP",
+    "places": [
+      "src/validators/validateSocksUrl.ts:51"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: missing port",
+    "key": "Invalid SOCKS URL: missing port",
+    "places": [
+      "src/validators/validateSocksUrl.ts:56"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: missing username",
+    "key": "Invalid SOCKS URL: missing username",
+    "places": [
+      "src/validators/validateSocksUrl.ts:34"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: must not contain spaces",
+    "key": "Invalid SOCKS URL: must not contain spaces",
+    "places": [
+      "src/validators/validateSocksUrl.ts:19"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://",
+    "key": "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://",
+    "places": [
+      "src/validators/validateSocksUrl.ts:10"
+    ]
+  },
+  {
+    "call": "Invalid SOCKS URL: parsing failed",
+    "key": "Invalid SOCKS URL: parsing failed",
+    "places": [
+      "src/validators/validateSocksUrl.ts:77"
+    ]
+  },
+  {
+    "call": "Invalid Trojan URL: must not contain spaces",
+    "key": "Invalid Trojan URL: must not contain spaces",
+    "places": [
+      "src/validators/validateTrojanUrl.ts:15"
+    ]
+  },
+  {
+    "call": "Invalid Trojan URL: must start with trojan://",
+    "key": "Invalid Trojan URL: must start with trojan://",
+    "places": [
+      "src/validators/validateTrojanUrl.ts:8"
+    ]
+  },
+  {
+    "call": "Invalid Trojan URL: parsing failed",
+    "key": "Invalid Trojan URL: parsing failed",
+    "places": [
+      "src/validators/validateTrojanUrl.ts:56"
+    ]
+  },
+  {
+    "call": "Invalid URL format",
+    "key": "Invalid URL format",
+    "places": [
+      "src/validators/validateUrl.ts:49",
+      "src/validators/validateUrl.ts:66",
+      "src/validators/validateUrl.ts:78"
+    ]
+  },
+  {
+    "call": "Invalid VLESS URL: parsing failed",
+    "key": "Invalid VLESS URL: parsing failed",
+    "places": [
+      "src/validators/validateVlessUrl.ts:110"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: invalid port",
+    "key": "Invalid VMess URL: invalid port",
+    "places": [
+      "src/validators/validateVmessUrl.ts:82"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: malformed base64",
+    "key": "Invalid VMess URL: malformed base64",
+    "places": [
+      "src/validators/validateVmessUrl.ts:40"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: malformed JSON",
+    "key": "Invalid VMess URL: malformed JSON",
+    "places": [
+      "src/validators/validateVmessUrl.ts:50",
+      "src/validators/validateVmessUrl.ts:57"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: missing address",
+    "key": "Invalid VMess URL: missing address",
+    "places": [
+      "src/validators/validateVmessUrl.ts:66"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: missing id",
+    "key": "Invalid VMess URL: missing id",
+    "places": [
+      "src/validators/validateVmessUrl.ts:73"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: must not contain spaces",
+    "key": "Invalid VMess URL: must not contain spaces",
+    "places": [
+      "src/validators/validateVmessUrl.ts:25"
+    ]
+  },
+  {
+    "call": "Invalid VMess URL: must start with vmess://",
+    "key": "Invalid VMess URL: must start with vmess://",
+    "places": [
+      "src/validators/validateVmessUrl.ts:7"
+    ]
+  },
+  {
+    "call": "IP address 0.0.0.0 is not allowed",
+    "key": "IP address 0.0.0.0 is not allowed",
+    "places": [
+      "src/validators/validateSubnet.ts:11"
+    ]
+  },
+  {
+    "call": "IPv6 CIDR must be between 0 and 128",
+    "key": "IPv6 CIDR must be between 0 and 128",
+    "places": [
+      "src/validators/validateSubnet.ts:47"
+    ]
+  },
+  {
+    "call": "Issues detected",
+    "key": "Issues detected",
+    "places": [
+      "src/netshift/tabs/diagnostic/helpers/getMeta.ts:20"
+    ]
+  },
+  {
+    "call": "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all.",
+    "key": "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:227"
+    ]
+  },
+  {
+    "call": "Latest",
+    "key": "Latest",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:90",
+      "src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:48"
+    ]
+  },
+  {
+    "call": "Latest version is installed",
+    "key": "Latest version is installed",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:103"
+    ]
+  },
+  {
+    "call": "List Update Frequency",
+    "key": "List Update Frequency",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:327"
+    ]
+  },
+  {
+    "call": "List update schedule, download routing, and routing exclusions",
+    "key": "List update schedule, download routing, and routing exclusions",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:27"
+    ]
+  },
+  {
+    "call": "Lists & Updates",
+    "key": "Lists & Updates",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:26"
+    ]
+  },
+  {
+    "call": "Local Domain Lists",
+    "key": "Local Domain Lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:778"
+    ]
+  },
+  {
+    "call": "Local Subnet Lists",
+    "key": "Local Subnet Lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:802"
+    ]
+  },
+  {
+    "call": "Log Level",
+    "key": "Log Level",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:554"
+    ]
+  },
+  {
+    "call": "Main DNS",
+    "key": "Main DNS",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:72"
+    ]
+  },
+  {
+    "call": "Main DNS via outbound",
+    "key": "Main DNS via outbound",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:81"
+    ]
+  },
+  {
+    "call": "Memory Usage",
+    "key": "Memory Usage",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:311"
+    ]
+  },
+  {
+    "call": "Mixed proxy and DNS resolution tuning",
+    "key": "Mixed proxy and DNS resolution tuning",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:32"
+    ]
+  },
+  {
+    "call": "Mixed Proxy Port",
+    "key": "Mixed Proxy Port",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:916"
+    ]
+  },
+  {
+    "call": "Monitored Interfaces",
+    "key": "Monitored Interfaces",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:285"
+    ]
+  },
+  {
+    "call": "Must be a number in the range of 50 - 1000",
+    "key": "Must be a number in the range of 50 - 1000",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:343"
+    ]
+  },
+  {
+    "call": "NetShift",
+    "key": "NetShift",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:343"
+    ]
+  },
+  {
+    "call": "NetShift Settings",
+    "key": "NetShift Settings",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:29"
+    ]
+  },
+  {
+    "call": "NetShift updated, version:",
+    "key": "NetShift updated, version:",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:217"
+    ]
+  },
+  {
+    "call": "NetShift will not modify your DHCP configuration",
+    "key": "NetShift will not modify your DHCP configuration",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:458"
+    ]
+  },
+  {
+    "call": "Network",
+    "key": "Network",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:21"
+    ]
+  },
+  {
+    "call": "Network Interface",
+    "key": "Network Interface",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:418"
+    ]
+  },
+  {
+    "call": "No other marking rules found",
+    "key": "No other marking rules found",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:98"
+    ]
+  },
+  {
+    "call": "Not implement yet",
+    "key": "Not implement yet",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderCheckSection.ts:189"
+    ]
+  },
+  {
+    "call": "Not installed",
+    "key": "Not installed",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:98",
+      "src/netshift/tabs/manager/cards.ts:198",
+      "src/netshift/tabs/manager/cards.ts:243",
+      "src/netshift/tabs/manager/initController.ts:100"
+    ]
+  },
+  {
+    "call": "Not responding",
+    "key": "Not responding",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:74",
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:80",
+      "src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:99"
+    ]
+  },
+  {
+    "call": "Not running",
+    "key": "Not running",
+    "places": [
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:59",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:67",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:75",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:83",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:91"
+    ]
+  },
+  {
+    "call": "Number of leading characters of each proxy name to group by.",
+    "key": "Number of leading characters of each proxy name to group by.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:211"
+    ]
+  },
+  {
+    "call": "Off",
+    "key": "Off",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:199"
+    ]
+  },
+  {
+    "call": "Only one section can be global at a time.",
+    "key": "Only one section can be global at a time.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:409"
+    ]
+  },
+  {
+    "call": "Operation timed out",
+    "key": "Operation timed out",
+    "places": [
+      "src/helpers/withTimeout.ts:7"
+    ]
+  },
+  {
+    "call": "Outbound Config",
+    "key": "Outbound Config",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:58"
+    ]
+  },
+  {
+    "call": "Outbound Configuration",
+    "key": "Outbound Configuration",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:98"
+    ]
+  },
+  {
+    "call": "Outdated",
+    "key": "Outdated",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:94",
+      "src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:38"
+    ]
+  },
+  {
+    "call": "Output Network Interface",
+    "key": "Output Network Interface",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:222"
+    ]
+  },
+  {
+    "call": "Path cannot be empty",
+    "key": "Path cannot be empty",
+    "places": [
+      "src/validators/validatePath.ts:7"
+    ]
+  },
+  {
+    "call": "Path must be absolute (start with /)",
+    "key": "Path must be absolute (start with /)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:535"
+    ]
+  },
+  {
+    "call": "Path must contain at least one directory (like /tmp/cache.db)",
+    "key": "Path must contain at least one directory (like /tmp/cache.db)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:544"
+    ]
+  },
+  {
+    "call": "Path must end with cache.db",
+    "key": "Path must end with cache.db",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:539"
+    ]
+  },
+  {
+    "call": "Pending",
+    "key": "Pending",
+    "places": [
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:107",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:115",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:123",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:131",
+      "src/netshift/tabs/diagnostic/diagnostic.store.ts:139"
+    ]
+  },
+  {
+    "call": "Prefix length",
+    "key": "Prefix length",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:210"
+    ]
+  },
+  {
+    "call": "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT.",
+    "key": "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:37"
+    ]
+  },
+  {
+    "call": "Proxy Configuration URL",
+    "key": "Proxy Configuration URL",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:66"
+    ]
+  },
+  {
+    "call": "Proxy traffic is not routed via FakeIP",
+    "key": "Proxy traffic is not routed via FakeIP",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:66"
+    ]
+  },
+  {
+    "call": "Proxy traffic is routed via FakeIP",
+    "key": "Proxy traffic is routed via FakeIP",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:65"
+    ]
+  },
+  {
+    "call": "Regional options cannot be used together",
+    "key": "Regional options cannot be used together",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:547"
+    ]
+  },
+  {
+    "call": "Remote Domain Lists",
+    "key": "Remote Domain Lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:826"
+    ]
+  },
+  {
+    "call": "Remote Subnet Lists",
+    "key": "Remote Subnet Lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:850"
+    ]
+  },
+  {
+    "call": "Resolve real IP for routing",
+    "key": "Resolve real IP for routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:932"
+    ]
+  },
+  {
+    "call": "Restart NetShift",
+    "key": "Restart NetShift",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:51"
+    ]
+  },
+  {
+    "call": "Route all unmatched traffic through this section's outbound.",
+    "key": "Route all unmatched traffic through this section's outbound.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:401"
+    ]
+  },
+  {
+    "call": "Route main DNS through proxy/VPN",
+    "key": "Route main DNS through proxy/VPN",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:104"
+    ]
+  },
+  {
+    "call": "Router DNS is not routed through sing-box",
+    "key": "Router DNS is not routed through sing-box",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:51"
+    ]
+  },
+  {
+    "call": "Router DNS is routed through sing-box",
+    "key": "Router DNS is routed through sing-box",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:50"
+    ]
+  },
+  {
+    "call": "Routing",
+    "key": "Routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:26"
+    ]
+  },
+  {
+    "call": "Routing Excluded IPs",
+    "key": "Routing Excluded IPs",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:384"
+    ]
+  },
+  {
+    "call": "Rules mangle counters",
+    "key": "Rules mangle counters",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:77"
+    ]
+  },
+  {
+    "call": "Rules mangle exist",
+    "key": "Rules mangle exist",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:72"
+    ]
+  },
+  {
+    "call": "Rules mangle output exist",
+    "key": "Rules mangle output exist",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:82"
+    ]
+  },
+  {
+    "call": "Rules proxy counters",
+    "key": "Rules proxy counters",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:92"
+    ]
+  },
+  {
+    "call": "Rules proxy exist",
+    "key": "Rules proxy exist",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:87"
+    ]
+  },
+  {
+    "call": "Run Diagnostic",
+    "key": "Run Diagnostic",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderRunAction.ts:15"
+    ]
+  },
+  {
+    "call": "Russia inside restrictions",
+    "key": "Russia inside restrictions",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:566"
+    ]
+  },
+  {
+    "call": "Secret key for authenticating remote access to YACD when WAN access is enabled.",
+    "key": "Secret key for authenticating remote access to YACD when WAN access is enabled.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:433"
+    ]
+  },
+  {
+    "call": "Sections",
+    "key": "Sections",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:54"
+    ]
+  },
+  {
+    "call": "Select a predefined list for routing",
+    "key": "Select a predefined list for routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:514"
+    ]
+  },
+  {
+    "call": "Select between VPN and Proxy connection methods for traffic routing",
+    "key": "Select between VPN and Proxy connection methods for traffic routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:40"
+    ]
+  },
+  {
+    "call": "Select DNS protocol to use",
+    "key": "Select DNS protocol to use",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:46"
+    ]
+  },
+  {
+    "call": "Select how often the domain or subnet lists are updated automatically",
+    "key": "Select how often the domain or subnet lists are updated automatically",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:328"
+    ]
+  },
+  {
+    "call": "Select how to configure the proxy",
+    "key": "Select how to configure the proxy",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:52"
+    ]
+  },
+  {
+    "call": "Select network interface for VPN connection",
+    "key": "Select network interface for VPN connection",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:419"
+    ]
+  },
+  {
+    "call": "Select or enter DNS server address",
+    "key": "Select or enter DNS server address",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:491",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:59"
+    ]
+  },
+  {
+    "call": "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing",
+    "key": "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:518"
+    ]
+  },
+  {
+    "call": "Select path for sing-box config file. Change this ONLY if you know what you are doing",
+    "key": "Select path for sing-box config file. Change this ONLY if you know what you are doing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:504"
+    ]
+  },
+  {
+    "call": "Select the DNS protocol type for the domain resolver",
+    "key": "Select the DNS protocol type for the domain resolver",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:477"
+    ]
+  },
+  {
+    "call": "Select the log level for sing-box",
+    "key": "Select the log level for sing-box",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:555"
+    ]
+  },
+  {
+    "call": "Select the network interface from which the traffic will originate",
+    "key": "Select the network interface from which the traffic will originate",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:175"
+    ]
+  },
+  {
+    "call": "Select the network interface to which the traffic will originate",
+    "key": "Select the network interface to which the traffic will originate",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:223"
+    ]
+  },
+  {
+    "call": "Select the WAN interfaces to be monitored",
+    "key": "Select the WAN interfaces to be monitored",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:286"
+    ]
+  },
+  {
+    "call": "Selector",
+    "key": "Selector",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:55"
+    ]
+  },
+  {
+    "call": "Selector Proxy Links",
+    "key": "Selector Proxy Links",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:250"
+    ]
+  },
+  {
+    "call": "Self-update failed",
+    "key": "Self-update failed",
+    "places": [
+      "src/netshift/methods/shell/index.ts:303"
+    ]
+  },
+  {
+    "call": "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct.",
+    "key": "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:105"
+    ]
+  },
+  {
+    "call": "Services info",
+    "key": "Services info",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:340"
+    ]
+  },
+  {
+    "call": "Settings",
+    "key": "Settings",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:67"
+    ]
+  },
+  {
+    "call": "Show sing-box config",
+    "key": "Show sing-box config",
+    "places": [
+      "src/netshift/tabs/diagnostic/initController.ts:292",
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:118"
+    ]
+  },
+  {
+    "call": "Sing-box",
+    "key": "Sing-box",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:155",
+      "src/netshift/tabs/dashboard/initController.ts:354"
+    ]
+  },
+  {
+    "call": "Sing-box autostart disabled",
+    "key": "Sing-box autostart disabled",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:77"
+    ]
+  },
+  {
+    "call": "Sing-box core changed, version:",
+    "key": "Sing-box core changed, version:",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:181"
+    ]
+  },
+  {
+    "call": "Sing-box installed",
+    "key": "Sing-box installed",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:62"
+    ]
+  },
+  {
+    "call": "Sing-box listening ports",
+    "key": "Sing-box listening ports",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:87"
+    ]
+  },
+  {
+    "call": "Sing-box process running",
+    "key": "Sing-box process running",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:82"
+    ]
+  },
+  {
+    "call": "Sing-box service exist",
+    "key": "Sing-box service exist",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:72"
+    ]
+  },
+  {
+    "call": "Sing-box version is compatible (newer than 1.12.4)",
+    "key": "Sing-box version is compatible (newer than 1.12.4)",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:67"
+    ]
+  },
+  {
+    "call": "Source and output interfaces, and Bad WAN interface monitoring",
+    "key": "Source and output interfaces, and Bad WAN interface monitoring",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:22"
+    ]
+  },
+  {
+    "call": "Source Network Interface",
+    "key": "Source Network Interface",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:174"
+    ]
+  },
+  {
+    "call": "Specify a local IP address to be excluded from routing",
+    "key": "Specify a local IP address to be excluded from routing",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:385"
+    ]
+  },
+  {
+    "call": "Specify local IP addresses or subnets whose traffic will always be routed through the configured route",
+    "key": "Specify local IP addresses or subnets whose traffic will always be routed through the configured route",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:875"
+    ]
+  },
+  {
+    "call": "Specify remote URLs to download and use domain lists",
+    "key": "Specify remote URLs to download and use domain lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:827"
+    ]
+  },
+  {
+    "call": "Specify remote URLs to download and use subnet lists",
+    "key": "Specify remote URLs to download and use subnet lists",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:851"
+    ]
+  },
+  {
+    "call": "Specify the path to the list file located on the router filesystem",
+    "key": "Specify the path to the list file located on the router filesystem",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:779",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:803"
+    ]
+  },
+  {
+    "call": "Start NetShift",
+    "key": "Start NetShift",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:71"
+    ]
+  },
+  {
+    "call": "Stop NetShift",
+    "key": "Stop NetShift",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:61"
+    ]
+  },
+  {
+    "call": "Subscription",
+    "key": "Subscription",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:21",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:57"
+    ]
+  },
+  {
+    "call": "Subscription cache cleared and re-downloaded",
+    "key": "Subscription cache cleared and re-downloaded",
+    "places": [
+      "src/netshift/tabs/diagnostic/initController.ts:337"
+    ]
+  },
+  {
+    "call": "Subscription feeds, server filters and URLTest tuning",
+    "key": "Subscription feeds, server filters and URLTest tuning",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:22"
+    ]
+  },
+  {
+    "call": "Subscription format",
+    "key": "Subscription format",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:148"
+    ]
+  },
+  {
+    "call": "Subscription grouping",
+    "key": "Subscription grouping",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:194"
+    ]
+  },
+  {
+    "call": "Subscription Update Interval",
+    "key": "Subscription Update Interval",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:178"
+    ]
+  },
+  {
+    "call": "Subscription URLs",
+    "key": "Subscription URLs",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:122"
+    ]
+  },
+  {
+    "call": "Successfully copied!",
+    "key": "Successfully copied!",
+    "places": [
+      "src/helpers/copyToClipboard.ts:10"
+    ]
+  },
+  {
+    "call": "Switch to extended",
+    "key": "Switch to extended",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:235"
+    ]
+  },
+  {
+    "call": "Switch to stable",
+    "key": "Switch to stable",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:190"
+    ]
+  },
+  {
+    "call": "Switching sing-box core, this may take a few minutes…",
+    "key": "Switching sing-box core, this may take a few minutes…",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:171"
+    ]
+  },
+  {
+    "call": "System info",
+    "key": "System info",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:304"
+    ]
+  },
+  {
+    "call": "System information",
+    "key": "System information",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts:24"
+    ]
+  },
+  {
+    "call": "Table exist",
+    "key": "Table exist",
+    "places": [
+      "src/netshift/tabs/diagnostic/checks/runNftCheck.ts:67"
+    ]
+  },
+  {
+    "call": "Test latency",
+    "key": "Test latency",
+    "places": [
+      "src/netshift/tabs/dashboard/partials/renderSections.ts:104"
+    ]
+  },
+  {
+    "call": "Text List",
+    "key": "Text List",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:613",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:701"
+    ]
+  },
+  {
+    "call": "The DNS server used to look up the IP address of an upstream DNS server",
+    "key": "The DNS server used to look up the IP address of an upstream DNS server",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:81"
+    ]
+  },
+  {
+    "call": "The interval between connectivity tests",
+    "key": "The interval between connectivity tests",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:303"
+    ]
+  },
+  {
+    "call": "The maximum difference in response times (ms) allowed when comparing servers",
+    "key": "The maximum difference in response times (ms) allowed when comparing servers",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:318"
+    ]
+  },
+  {
+    "call": "The URL used to test server connectivity",
+    "key": "The URL used to test server connectivity",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:351"
+    ]
+  },
+  {
+    "call": "This is a security trade-off: an attacker could intercept the fetch.",
+    "key": "This is a security trade-off: an attacker could intercept the fetch.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:168"
+    ]
+  },
+  {
+    "call": "Time in seconds for DNS record caching (default: 60)",
+    "key": "Time in seconds for DNS record caching (default: 60)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:152"
+    ]
+  },
+  {
+    "call": "Traffic",
+    "key": "Traffic",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:238"
+    ]
+  },
+  {
+    "call": "Traffic Total",
+    "key": "Traffic Total",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:268"
+    ]
+  },
+  {
+    "call": "Troubleshooting",
+    "key": "Troubleshooting",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26"
+    ]
+  },
+  {
+    "call": "TTL must be a positive number",
+    "key": "TTL must be a positive number",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:163"
+    ]
+  },
+  {
+    "call": "TTL value cannot be empty",
+    "key": "TTL value cannot be empty",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:158"
+    ]
+  },
+  {
+    "call": "UDP (Unprotected DNS)",
+    "key": "UDP (Unprotected DNS)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:481",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:50"
+    ]
+  },
+  {
+    "call": "UDP over TCP",
+    "key": "UDP over TCP",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:389"
+    ]
+  },
+  {
+    "call": "unknown",
+    "key": "unknown",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:37",
+      "src/netshift/tabs/manager/initController.ts:38",
+      "src/netshift/tabs/manager/initController.ts:39",
+      "src/netshift/tabs/manager/initController.ts:40",
+      "src/netshift/tabs/manager/initController.ts:41",
+      "src/netshift/tabs/manager/initController.ts:42",
+      "src/netshift/tabs/diagnostic/initController.ts:39",
+      "src/netshift/tabs/diagnostic/initController.ts:40",
+      "src/netshift/tabs/diagnostic/initController.ts:41",
+      "src/netshift/tabs/diagnostic/initController.ts:42",
+      "src/netshift/tabs/diagnostic/initController.ts:43",
+      "src/netshift/tabs/diagnostic/initController.ts:44",
+      "src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:7"
+    ]
+  },
+  {
+    "call": "Unknown error",
+    "key": "Unknown error",
+    "places": [
+      "src/netshift/api.ts:40"
+    ]
+  },
+  {
+    "call": "Update",
+    "key": "Update",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:174",
+      "src/netshift/tabs/manager/cards.ts:220"
+    ]
+  },
+  {
+    "call": "Update is available",
+    "key": "Update is available",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:92"
+    ]
+  },
+  {
+    "call": "Update NetShift",
+    "key": "Update NetShift",
+    "places": [
+      "src/netshift/tabs/manager/cards.ts:137"
+    ]
+  },
+  {
+    "call": "Updating NetShift, this may take a few minutes; the page will reload…",
+    "key": "Updating NetShift, this may take a few minutes; the page will reload…",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:208"
+    ]
+  },
+  {
+    "call": "Uplink",
+    "key": "Uplink",
+    "places": [
+      "src/netshift/tabs/dashboard/initController.ts:240",
+      "src/netshift/tabs/dashboard/initController.ts:271"
+    ]
+  },
+  {
+    "call": "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy",
+    "key": "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:17"
+    ]
+  },
+  {
+    "call": "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://",
+    "key": "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://",
+    "places": [
+      "src/validators/validateProxyUrl.ts:42"
+    ]
+  },
+  {
+    "call": "URL must use one of the following protocols:",
+    "key": "URL must use one of the following protocols:",
+    "places": [
+      "src/validators/validateUrl.ts:58"
+    ]
+  },
+  {
+    "call": "URLTest",
+    "key": "URLTest",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:56"
+    ]
+  },
+  {
+    "call": "URLTest Check Interval",
+    "key": "URLTest Check Interval",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:302"
+    ]
+  },
+  {
+    "call": "URLTest Proxy Links",
+    "key": "URLTest Proxy Links",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:276"
+    ]
+  },
+  {
+    "call": "URLTest Testing URL",
+    "key": "URLTest Testing URL",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:350"
+    ]
+  },
+  {
+    "call": "URLTest Tolerance",
+    "key": "URLTest Tolerance",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:317"
+    ]
+  },
+  {
+    "call": "Use only for IP-host panels that serve an invalid or self-signed certificate.",
+    "key": "Use only for IP-host panels that serve an invalid or self-signed certificate.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:166"
+    ]
+  },
+  {
+    "call": "Use this only when the router has working IPv6 connectivity.",
+    "key": "Use this only when the router has working IPv6 connectivity.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:494"
+    ]
+  },
+  {
+    "call": "Use with Exclusion sections to route specific domains directly.",
+    "key": "Use with Exclusion sections to route specific domains directly.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:407"
+    ]
+  },
+  {
+    "call": "User Domains",
+    "key": "User Domains",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:621"
+    ]
+  },
+  {
+    "call": "User Domains List",
+    "key": "User Domains List",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:648"
+    ]
+  },
+  {
+    "call": "User Subnets",
+    "key": "User Subnets",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:709"
+    ]
+  },
+  {
+    "call": "User Subnets List",
+    "key": "User Subnets List",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:736"
+    ]
+  },
+  {
+    "call": "Valid",
+    "key": "Valid",
+    "places": [
+      "src/validators/validateDns.ts:26",
+      "src/validators/validateDns.ts:30",
+      "src/validators/validateDns.ts:34",
+      "src/validators/validateDomain.ts:13",
+      "src/validators/validateDomain.ts:30",
+      "src/validators/validateHysteriaUrl.ts:120",
+      "src/validators/validateIp.ts:8",
+      "src/validators/validateIp.ts:91",
+      "src/validators/validateIp.ts:97",
+      "src/validators/validateOutboundJson.ts:7",
+      "src/validators/validatePath.ts:16",
+      "src/validators/validateShadowsocksUrl.ts:95",
+      "src/validators/validateSocksUrl.ts:80",
+      "src/validators/validateSubnet.ts:30",
+      "src/validators/validateSubnet.ts:52",
+      "src/validators/validateTrojanUrl.ts:59",
+      "src/validators/validateUrl.ts:75",
+      "src/validators/validateVlessUrl.ts:108",
+      "src/validators/validateVmessUrl.ts:86"
+    ]
+  },
+  {
+    "call": "Validation errors:",
+    "key": "Validation errors:",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:681",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:768"
+    ]
+  },
+  {
+    "call": "Version",
+    "key": "Version",
+    "places": [
+      "src/netshift/tabs/manager/initController.ts:306"
+    ]
+  },
+  {
+    "call": "View logs",
+    "key": "View logs",
+    "places": [
+      "src/netshift/tabs/diagnostic/initController.ts:258",
+      "src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:109"
+    ]
+  },
+  {
+    "call": "Visit Wiki",
+    "key": "Visit Wiki",
+    "places": [
+      "src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:32"
+    ]
+  },
+  {
+    "call": "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
+    "key": "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:67",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:251",
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:277"
+    ]
+  },
+  {
+    "call": "Warning: %s cannot be used together with %s. Previous selections have been removed.",
+    "key": "Warning: %s cannot be used together with %s. Previous selections have been removed.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:549"
+    ]
+  },
+  {
+    "call": "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection.",
+    "key": "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:568"
+    ]
+  },
+  {
+    "call": "When enabled, traffic not matching any other section's lists will go through this proxy.",
+    "key": "When enabled, traffic not matching any other section's lists will go through this proxy.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:403"
+    ]
+  },
+  {
+    "call": "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound.",
+    "key": "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:117"
+    ]
+  },
+  {
+    "call": "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format.",
+    "key": "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format.",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:149"
+    ]
+  },
+  {
+    "call": "Xray JSON (Happ)",
+    "key": "Xray JSON (Happ)",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:154"
+    ]
+  },
+  {
+    "call": "YACD Secret Key",
+    "key": "YACD Secret Key",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:432"
+    ]
+  },
+  {
+    "call": "YACD web dashboard access and remote-access protection",
+    "key": "YACD web dashboard access and remote-access protection",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:32"
+    ]
+  },
+  {
+    "call": "You can select Output Network Interface, by default autodetect",
+    "key": "You can select Output Network Interface, by default autodetect",
+    "places": [
+      "../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:213"
+    ]
+  }
+]
\ No newline at end of file
diff --git a/fe-app-netshift/locales/netshift.pot b/fe-app-netshift/locales/netshift.pot
new file mode 100644
index 00000000..df59ccb2
--- /dev/null
+++ b/fe-app-netshift/locales/netshift.pot
@@ -0,0 +1,1523 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2026 THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the NETSHIFT package.
+# yandexru45 <>, 2026.
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: NETSHIFT\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-06-12 05:52+0300\n"
+"PO-Revision-Date: 2026-06-12 05:52+0300\n"
+"Last-Translator: yandexru45 <>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: src/netshift/tabs/dashboard/initController.ts:345
+msgid "✔ Enabled"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:356
+msgid "✔ Running"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:346
+msgid "✘ Disabled"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:357
+msgid "✘ Stopped"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:307
+msgid "Active Connections"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:123
+msgid "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:607
+msgid "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:695
+msgid "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:99
+msgid "Additional marking rules found"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:31
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:36
+msgid "Advanced"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:163
+msgid "Allow insecure TLS for subscription fetch"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:420
+msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:390
+msgid "Applicable for SOCKS and Shadowsocks proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:667
+msgid "At least one valid domain must be specified. Comments-only content is not allowed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:756
+msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:153
+msgid "Auto"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:45
+msgid "Available actions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:480
+msgid "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:479
+msgid "Block DoH Servers"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:65
+msgid "Bootsrap DNS"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:80
+msgid "Bootstrap DNS server"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:58
+msgid "Browser is not using FakeIP"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:57
+msgid "Browser is using FakeIP correctly"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:200
+msgid "By country flag"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:201
+msgid "By name prefix"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:517
+msgid "Cache File Path"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:531
+msgid "Cache file path cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:27
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:28
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:27
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:25
+msgid "Cannot receive checks result"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:144
+#: src/netshift/tabs/manager/cards.ts:181
+#: src/netshift/tabs/manager/cards.ts:227
+msgid "Check update"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:13
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:13
+msgid "Checking, please wait"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts:2
+msgid "checks"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:26
+msgid "Checks failed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:13
+msgid "Checks passed"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:25
+msgid "CIDR must be between 0 and 32"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:127
+msgid "Clear subscription cache"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:329
+msgid "Clearing subscription cache and re-downloading… this may take a minute"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:26
+msgid "Close"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:513
+msgid "Community Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:83
+msgid "Component Manager"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:503
+msgid "Config File Path"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:30
+msgid "Configuration for NetShift service"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:51
+msgid "Configuration Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:16
+msgid "Connection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:39
+msgid "Connection Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:17
+msgid "Connection type, transport and DNS resolver for this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:54
+msgid "Connection URL"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:20
+msgid "Copy"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:159
+#: src/netshift/methods/shell/pollSingBoxComponentAction.ts:65
+msgid "Core switch failed"
+msgstr ""
+
+#: src/netshift/methods/shell/pollSingBoxComponentAction.ts:82
+msgid "Core switch timed out"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderWidget.ts:22
+msgid "Currently unavailable"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:606
+msgid "Custom domains"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:694
+msgid "Custom subnets"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:39
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:31
+msgid "Dashboard"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderSections.ts:20
+msgid "Dashboard currently unavailable"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:310
+msgid "Delay in milliseconds before reloading NetShift after interface UP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:317
+msgid "Delay value cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:101
+msgid "Dev"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:93
+msgid "DHCP has DNS server"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:98
+msgid "Diagnostics"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:81
+msgid "Disable autostart"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:445
+msgid "Disable QUIC"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:446
+msgid "Disable the QUIC protocol to improve compatibility or fix issues with video streaming"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:611
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:699
+msgid "Disabled"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:164
+msgid "Disables TLS certificate verification when downloading the subscription."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:16
+msgid "DNS"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:88
+msgid "DNS on router"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:116
+msgid "DNS outbound section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:479
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:48
+msgid "DNS over HTTPS (DoH)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:480
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:49
+msgid "DNS over TLS (DoT)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:476
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:45
+msgid "DNS Protocol Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:151
+msgid "DNS Rewrite TTL"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:490
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:58
+msgid "DNS Server"
+msgstr ""
+
+#: src/validators/validateDns.ts:7
+msgid "DNS server address cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:27
+msgid "Do not panic, everything can be fixed, just..."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:27
+msgid "Domain and subnet lists that decide which traffic uses this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:465
+msgid "Domain Resolver"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:457
+msgid "Dont Touch My DHCP!"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:241
+#: src/netshift/tabs/dashboard/initController.ts:275
+msgid "Downlink"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:15
+msgid "Download"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:340
+msgid "Download Lists via Proxy/VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:350
+msgid "Download Lists via specific proxy section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:341
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:351
+msgid "Downloading all lists via specific Proxy/VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:239
+msgid "Drop subscription servers whose name contains any of these keywords (case-insensitive)."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:612
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:700
+msgid "Dynamic List"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:91
+msgid "Enable autostart"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:466
+msgid "Enable built-in DNS resolver for domains handled by this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:933
+msgid "Enable DNS resolve to get real IP when routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:491
+msgid "Enable IPv6 Support"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:492
+msgid "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:902
+msgid "Enable Mixed Proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:212
+msgid "Enable Output Network Interface"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:903
+msgid "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:409
+msgid "Enable YACD"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:419
+msgid "Enable YACD WAN Access"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:99
+msgid "Enter complete outbound configuration in JSON format"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:649
+msgid "Enter domain names separated by commas, spaces, or newlines. You can add comments using //"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:622
+msgid "Enter domain names without protocols, e.g. example.com or sub.example.com"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:710
+msgid "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:306
+msgid "Every 1 minute"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:185
+msgid "Every 12 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:183
+msgid "Every 3 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:307
+msgid "Every 3 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:181
+msgid "Every 30 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:305
+msgid "Every 30 seconds"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:308
+msgid "Every 5 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:184
+msgid "Every 6 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:186
+msgid "Every day"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:182
+msgid "Every hour"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:467
+msgid "Exclude NTP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:468
+msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:238
+msgid "Exclude servers by keyword"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:254
+#: src/netshift/tabs/diagnostic/initController.ts:344
+#: src/netshift/tabs/diagnostic/initController.ts:348
+msgid "Failed to clear subscription cache"
+msgstr ""
+
+#: src/helpers/copyToClipboard.ts:12
+msgid "Failed to copy!"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:122
+#: src/netshift/tabs/manager/initController.ts:132
+#: src/netshift/tabs/manager/initController.ts:150
+#: src/netshift/tabs/manager/initController.ts:160
+#: src/netshift/tabs/manager/initController.ts:188
+#: src/netshift/tabs/manager/initController.ts:192
+#: src/netshift/tabs/manager/initController.ts:225
+#: src/netshift/tabs/manager/initController.ts:229
+#: src/netshift/tabs/diagnostic/initController.ts:229
+#: src/netshift/tabs/diagnostic/initController.ts:233
+#: src/netshift/tabs/diagnostic/initController.ts:263
+#: src/netshift/tabs/diagnostic/initController.ts:267
+#: src/netshift/tabs/diagnostic/initController.ts:304
+#: src/netshift/tabs/diagnostic/initController.ts:308
+msgid "Failed to execute!"
+msgstr ""
+
+#: src/netshift/methods/custom/getDashboardSections.ts:150
+#: src/netshift/methods/custom/getDashboardSections.ts:181
+#: src/netshift/methods/custom/getDashboardSections.ts:218
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:58
+msgid "Fastest"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:874
+msgid "Fully Routed IPs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:100
+msgid "Get global check"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:224
+msgid "Global check"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:400
+msgid "Global Proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:195
+msgid "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:179
+msgid "How often to automatically update the subscription"
+msgstr ""
+
+#: src/netshift/api.ts:27
+msgid "HTTP error"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:226
+msgid "Include servers by keyword"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:136
+#: src/netshift/tabs/manager/cards.ts:174
+#: src/netshift/tabs/manager/cards.ts:220
+msgid "Install %s"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:96
+msgid "Installed version is newer than release"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:275
+msgid "Interface Monitoring"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:309
+msgid "Interface Monitoring Delay"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:276
+msgid "Interface monitoring for Bad WAN"
+msgstr ""
+
+#: src/validators/validateDns.ts:39
+msgid "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
+msgstr ""
+
+#: src/validators/validateDomain.ts:18
+#: src/validators/validateDomain.ts:27
+msgid "Invalid domain address"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:57
+msgid "Invalid format. Use X.X.X.X/Y or IPv6/Y"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:90
+msgid "Invalid HY2 URL: insecure must be 0 or 1"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:77
+msgid "Invalid HY2 URL: invalid port number"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:30
+msgid "Invalid HY2 URL: missing credentials/server"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:47
+msgid "Invalid HY2 URL: missing host"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:41
+msgid "Invalid HY2 URL: missing host & port"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:36
+msgid "Invalid HY2 URL: missing password"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:50
+msgid "Invalid HY2 URL: missing port"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:18
+msgid "Invalid HY2 URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:12
+msgid "Invalid HY2 URL: must start with hysteria2:// or hy2://"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:108
+msgid "Invalid HY2 URL: obfs-password required when obfs is set"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:122
+msgid "Invalid HY2 URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:116
+msgid "Invalid HY2 URL: sni cannot be empty"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:98
+msgid "Invalid HY2 URL: unsupported obfs type"
+msgstr ""
+
+#: src/validators/validateIp.ts:11
+msgid "Invalid IP address"
+msgstr ""
+
+#: src/validators/validateIp.ts:66
+msgid "Invalid IPv6 address"
+msgstr ""
+
+#: src/validators/validateOutboundJson.ts:9
+msgid "Invalid JSON format"
+msgstr ""
+
+#: src/validators/validatePath.ts:22
+msgid "Invalid path format. Path must start with \"/\" and contain valid characters"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:85
+msgid "Invalid port number. Must be between 1 and 65535"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:37
+msgid "Invalid Shadowsocks URL: decoded credentials must contain method:password"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:27
+msgid "Invalid Shadowsocks URL: missing credentials"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:46
+msgid "Invalid Shadowsocks URL: missing method and password separator \":\""
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:76
+msgid "Invalid Shadowsocks URL: missing port"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:67
+msgid "Invalid Shadowsocks URL: missing server"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:58
+msgid "Invalid Shadowsocks URL: missing server address"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:16
+msgid "Invalid Shadowsocks URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:8
+msgid "Invalid Shadowsocks URL: must start with ss://"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:91
+msgid "Invalid Shadowsocks URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:73
+msgid "Invalid SOCKS URL: invalid host format"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:63
+msgid "Invalid SOCKS URL: invalid port number"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:42
+msgid "Invalid SOCKS URL: missing host and port"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:51
+msgid "Invalid SOCKS URL: missing hostname or IP"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:56
+msgid "Invalid SOCKS URL: missing port"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:34
+msgid "Invalid SOCKS URL: missing username"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:19
+msgid "Invalid SOCKS URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:10
+msgid "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:77
+msgid "Invalid SOCKS URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:15
+msgid "Invalid Trojan URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:8
+msgid "Invalid Trojan URL: must start with trojan://"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:56
+msgid "Invalid Trojan URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateUrl.ts:49
+#: src/validators/validateUrl.ts:66
+#: src/validators/validateUrl.ts:78
+msgid "Invalid URL format"
+msgstr ""
+
+#: src/validators/validateVlessUrl.ts:110
+msgid "Invalid VLESS URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:82
+msgid "Invalid VMess URL: invalid port"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:40
+msgid "Invalid VMess URL: malformed base64"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:50
+#: src/validators/validateVmessUrl.ts:57
+msgid "Invalid VMess URL: malformed JSON"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:66
+msgid "Invalid VMess URL: missing address"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:73
+msgid "Invalid VMess URL: missing id"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:25
+msgid "Invalid VMess URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:7
+msgid "Invalid VMess URL: must start with vmess://"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:11
+msgid "IP address 0.0.0.0 is not allowed"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:47
+msgid "IPv6 CIDR must be between 0 and 128"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:20
+msgid "Issues detected"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:227
+msgid "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all."
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:90
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:48
+msgid "Latest"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:103
+msgid "Latest version is installed"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:327
+msgid "List Update Frequency"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:27
+msgid "List update schedule, download routing, and routing exclusions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:26
+msgid "Lists & Updates"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:778
+msgid "Local Domain Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:802
+msgid "Local Subnet Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:554
+msgid "Log Level"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:72
+msgid "Main DNS"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:81
+msgid "Main DNS via outbound"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:311
+msgid "Memory Usage"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:32
+msgid "Mixed proxy and DNS resolution tuning"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:916
+msgid "Mixed Proxy Port"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:285
+msgid "Monitored Interfaces"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:343
+msgid "Must be a number in the range of 50 - 1000"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:343
+msgid "NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:29
+msgid "NetShift Settings"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:217
+msgid "NetShift updated, version:"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:458
+msgid "NetShift will not modify your DHCP configuration"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:21
+msgid "Network"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:418
+msgid "Network Interface"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:98
+msgid "No other marking rules found"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderCheckSection.ts:189
+msgid "Not implement yet"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:98
+#: src/netshift/tabs/manager/cards.ts:198
+#: src/netshift/tabs/manager/cards.ts:243
+#: src/netshift/tabs/manager/initController.ts:100
+msgid "Not installed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:74
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:80
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:99
+msgid "Not responding"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:59
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:67
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:75
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:83
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:91
+msgid "Not running"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:211
+msgid "Number of leading characters of each proxy name to group by."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:199
+msgid "Off"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:409
+msgid "Only one section can be global at a time."
+msgstr ""
+
+#: src/helpers/withTimeout.ts:7
+msgid "Operation timed out"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:58
+msgid "Outbound Config"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:98
+msgid "Outbound Configuration"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:94
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:38
+msgid "Outdated"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:222
+msgid "Output Network Interface"
+msgstr ""
+
+#: src/validators/validatePath.ts:7
+msgid "Path cannot be empty"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:535
+msgid "Path must be absolute (start with /)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:544
+msgid "Path must contain at least one directory (like /tmp/cache.db)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:539
+msgid "Path must end with cache.db"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:107
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:115
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:123
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:131
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:139
+msgid "Pending"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:210
+msgid "Prefix length"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:37
+msgid "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:66
+msgid "Proxy Configuration URL"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:66
+msgid "Proxy traffic is not routed via FakeIP"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:65
+msgid "Proxy traffic is routed via FakeIP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:547
+msgid "Regional options cannot be used together"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:826
+msgid "Remote Domain Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:850
+msgid "Remote Subnet Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:932
+msgid "Resolve real IP for routing"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:51
+msgid "Restart NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:401
+msgid "Route all unmatched traffic through this section's outbound."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:104
+msgid "Route main DNS through proxy/VPN"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:51
+msgid "Router DNS is not routed through sing-box"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:50
+msgid "Router DNS is routed through sing-box"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:26
+msgid "Routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:384
+msgid "Routing Excluded IPs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:77
+msgid "Rules mangle counters"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:72
+msgid "Rules mangle exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:82
+msgid "Rules mangle output exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:92
+msgid "Rules proxy counters"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:87
+msgid "Rules proxy exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderRunAction.ts:15
+msgid "Run Diagnostic"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:566
+msgid "Russia inside restrictions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:433
+msgid "Secret key for authenticating remote access to YACD when WAN access is enabled."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:54
+msgid "Sections"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:514
+msgid "Select a predefined list for routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:40
+msgid "Select between VPN and Proxy connection methods for traffic routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:46
+msgid "Select DNS protocol to use"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:328
+msgid "Select how often the domain or subnet lists are updated automatically"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:52
+msgid "Select how to configure the proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:419
+msgid "Select network interface for VPN connection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:491
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:59
+msgid "Select or enter DNS server address"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:518
+msgid "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:504
+msgid "Select path for sing-box config file. Change this ONLY if you know what you are doing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:477
+msgid "Select the DNS protocol type for the domain resolver"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:555
+msgid "Select the log level for sing-box"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:175
+msgid "Select the network interface from which the traffic will originate"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:223
+msgid "Select the network interface to which the traffic will originate"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:286
+msgid "Select the WAN interfaces to be monitored"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:55
+msgid "Selector"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:250
+msgid "Selector Proxy Links"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:303
+msgid "Self-update failed"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:105
+msgid "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct."
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:340
+msgid "Services info"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:67
+msgid "Settings"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:292
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:118
+msgid "Show sing-box config"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:155
+#: src/netshift/tabs/dashboard/initController.ts:354
+msgid "Sing-box"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:77
+msgid "Sing-box autostart disabled"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:181
+msgid "Sing-box core changed, version:"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:62
+msgid "Sing-box installed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:87
+msgid "Sing-box listening ports"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:82
+msgid "Sing-box process running"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:72
+msgid "Sing-box service exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:67
+msgid "Sing-box version is compatible (newer than 1.12.4)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:22
+msgid "Source and output interfaces, and Bad WAN interface monitoring"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:174
+msgid "Source Network Interface"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:385
+msgid "Specify a local IP address to be excluded from routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:875
+msgid "Specify local IP addresses or subnets whose traffic will always be routed through the configured route"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:827
+msgid "Specify remote URLs to download and use domain lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:851
+msgid "Specify remote URLs to download and use subnet lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:779
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:803
+msgid "Specify the path to the list file located on the router filesystem"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:71
+msgid "Start NetShift"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:61
+msgid "Stop NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:21
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:57
+msgid "Subscription"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:337
+msgid "Subscription cache cleared and re-downloaded"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:22
+msgid "Subscription feeds, server filters and URLTest tuning"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:148
+msgid "Subscription format"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:194
+msgid "Subscription grouping"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:178
+msgid "Subscription Update Interval"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:122
+msgid "Subscription URLs"
+msgstr ""
+
+#: src/helpers/copyToClipboard.ts:10
+msgid "Successfully copied!"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:235
+msgid "Switch to extended"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:190
+msgid "Switch to stable"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:171
+msgid "Switching sing-box core, this may take a few minutes…"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:304
+msgid "System info"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts:24
+msgid "System information"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:67
+msgid "Table exist"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderSections.ts:104
+msgid "Test latency"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:613
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:701
+msgid "Text List"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:81
+msgid "The DNS server used to look up the IP address of an upstream DNS server"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:303
+msgid "The interval between connectivity tests"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:318
+msgid "The maximum difference in response times (ms) allowed when comparing servers"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:351
+msgid "The URL used to test server connectivity"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:168
+msgid "This is a security trade-off: an attacker could intercept the fetch."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:152
+msgid "Time in seconds for DNS record caching (default: 60)"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:238
+msgid "Traffic"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:268
+msgid "Traffic Total"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26
+msgid "Troubleshooting"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:163
+msgid "TTL must be a positive number"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:158
+msgid "TTL value cannot be empty"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:481
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:50
+msgid "UDP (Unprotected DNS)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:389
+msgid "UDP over TCP"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:37
+#: src/netshift/tabs/manager/initController.ts:38
+#: src/netshift/tabs/manager/initController.ts:39
+#: src/netshift/tabs/manager/initController.ts:40
+#: src/netshift/tabs/manager/initController.ts:41
+#: src/netshift/tabs/manager/initController.ts:42
+#: src/netshift/tabs/diagnostic/initController.ts:39
+#: src/netshift/tabs/diagnostic/initController.ts:40
+#: src/netshift/tabs/diagnostic/initController.ts:41
+#: src/netshift/tabs/diagnostic/initController.ts:42
+#: src/netshift/tabs/diagnostic/initController.ts:43
+#: src/netshift/tabs/diagnostic/initController.ts:44
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:7
+msgid "unknown"
+msgstr ""
+
+#: src/netshift/api.ts:40
+msgid "Unknown error"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:174
+#: src/netshift/tabs/manager/cards.ts:220
+msgid "Update"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:92
+msgid "Update is available"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:137
+msgid "Update NetShift"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:208
+msgid "Updating NetShift, this may take a few minutes; the page will reload…"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:240
+#: src/netshift/tabs/dashboard/initController.ts:271
+msgid "Uplink"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:17
+msgid "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"
+msgstr ""
+
+#: src/validators/validateProxyUrl.ts:42
+msgid "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+msgstr ""
+
+#: src/validators/validateUrl.ts:58
+msgid "URL must use one of the following protocols:"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:56
+msgid "URLTest"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:302
+msgid "URLTest Check Interval"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:276
+msgid "URLTest Proxy Links"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:350
+msgid "URLTest Testing URL"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:317
+msgid "URLTest Tolerance"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:166
+msgid "Use only for IP-host panels that serve an invalid or self-signed certificate."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:494
+msgid "Use this only when the router has working IPv6 connectivity."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:407
+msgid "Use with Exclusion sections to route specific domains directly."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:621
+msgid "User Domains"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:648
+msgid "User Domains List"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:709
+msgid "User Subnets"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:736
+msgid "User Subnets List"
+msgstr ""
+
+#: src/validators/validateDns.ts:26
+#: src/validators/validateDns.ts:30
+#: src/validators/validateDns.ts:34
+#: src/validators/validateDomain.ts:13
+#: src/validators/validateDomain.ts:30
+#: src/validators/validateHysteriaUrl.ts:120
+#: src/validators/validateIp.ts:8
+#: src/validators/validateIp.ts:91
+#: src/validators/validateIp.ts:97
+#: src/validators/validateOutboundJson.ts:7
+#: src/validators/validatePath.ts:16
+#: src/validators/validateShadowsocksUrl.ts:95
+#: src/validators/validateSocksUrl.ts:80
+#: src/validators/validateSubnet.ts:30
+#: src/validators/validateSubnet.ts:52
+#: src/validators/validateTrojanUrl.ts:59
+#: src/validators/validateUrl.ts:75
+#: src/validators/validateVlessUrl.ts:108
+#: src/validators/validateVmessUrl.ts:86
+msgid "Valid"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:681
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:768
+msgid "Validation errors:"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:306
+msgid "Version"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:258
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:109
+msgid "View logs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:32
+msgid "Visit Wiki"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:67
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:251
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:277
+msgid "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:549
+msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:568
+msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:403
+msgid "When enabled, traffic not matching any other section's lists will go through this proxy."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:117
+msgid "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:149
+msgid "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:154
+msgid "Xray JSON (Happ)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:432
+msgid "YACD Secret Key"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:32
+msgid "YACD web dashboard access and remote-access protection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:213
+msgid "You can select Output Network Interface, by default autodetect"
+msgstr ""
diff --git a/luci-app-podkop/po/ru/podkop.po b/fe-app-netshift/locales/netshift.ru.po
similarity index 63%
rename from luci-app-podkop/po/ru/podkop.po
rename to fe-app-netshift/locales/netshift.ru.po
index 77a33a4f..6c21c32c 100644
--- a/luci-app-podkop/po/ru/podkop.po
+++ b/fe-app-netshift/locales/netshift.ru.po
@@ -1,15 +1,15 @@
-# RU translations for PODKOP package.
-# Copyright (C) 2026 THE PODKOP'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PODKOP package.
-# divocatt, 2026.
+# RU translations for NETSHIFT package.
+# Copyright (C) 2026 THE NETSHIFT'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the NETSHIFT package.
+# yandexru45, 2026.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: PODKOP\n"
+"Project-Id-Version: NETSHIFT\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-29 16:40+0300\n"
-"PO-Revision-Date: 2026-05-29 16:40+0300\n"
-"Last-Translator: divocatt\n"
+"POT-Creation-Date: 2026-06-12 08:52+0300\n"
+"PO-Revision-Date: 2026-06-12 08:52+0300\n"
+"Last-Translator: yandexru45\n"
 "Language-Team: none\n"
 "Language: ru\n"
 "MIME-Version: 1.0\n"
@@ -32,9 +32,24 @@ msgstr "✘ Остановлен"
 msgid "Active Connections"
 msgstr "Активные соединения"
 
+msgid "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged."
+msgstr "Добавьте один или несколько URL подписок для получения конфигураций прокси. Все источники загружаются и объединяются."
+
+msgid "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои домены: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
+msgid "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои подсети или IP: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
 msgid "Additional marking rules found"
 msgstr "Найдены дополнительные правила маркировки"
 
+msgid "Advanced"
+msgstr "Дополнительно"
+
+msgid "Allow insecure TLS for subscription fetch"
+msgstr "Разрешить небезопасный TLS при загрузке подписки"
+
 msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
 msgstr "Обеспечивает доступ к YACD из WAN. Убедитесь, что в брандмауэре открыт соответствующий порт."
 
@@ -47,9 +62,18 @@ msgstr "Необходимо указать хотя бы один действ
 msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
 msgstr "Необходимо указать хотя бы одну действительную подсеть или IP. Только комментарии недопустимы."
 
+msgid "Auto"
+msgstr "Авто"
+
 msgid "Available actions"
 msgstr "Доступные действия"
 
+msgid "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering."
+msgstr "Блокировать прямые подключения к известным публичным DoH-серверам (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex), чтобы приложения не могли обойти DNS-фильтрацию роутера."
+
+msgid "Block DoH Servers"
+msgstr "Блокировать DoH-серверы"
+
 msgid "Bootsrap DNS"
 msgstr "Bootstrap DNS"
 
@@ -62,6 +86,12 @@ msgstr "Браузер не использует FakeIP"
 msgid "Browser is using FakeIP correctly"
 msgstr "Браузер использует FakeIP"
 
+msgid "By country flag"
+msgstr "По флагу страны"
+
+msgid "By name prefix"
+msgstr "По префиксу имени"
+
 msgid "Cache File Path"
 msgstr "Путь к файлу кэша"
 
@@ -71,6 +101,9 @@ msgstr "Путь к файлу кэша не может быть пустым"
 msgid "Cannot receive checks result"
 msgstr "Не удалось получить результаты проверки"
 
+msgid "Check update"
+msgstr "Проверить обновление"
+
 msgid "Checking, please wait"
 msgstr "Проверяем, пожалуйста подождите"
 
@@ -86,45 +119,75 @@ msgstr "Проверки пройдены"
 msgid "CIDR must be between 0 and 32"
 msgstr "CIDR должен быть между 0 и 32"
 
+msgid "Clear subscription cache"
+msgstr "Очистить кеш подписок"
+
+msgid "Clearing subscription cache and re-downloading… this may take a minute"
+msgstr "Очистка кеша подписок и повторная загрузка… это может занять минуту"
+
 msgid "Close"
 msgstr "Закрыть"
 
 msgid "Community Lists"
 msgstr "Списки сообщества"
 
+msgid "Component Manager"
+msgstr "Менеджер компонентов"
+
 msgid "Config File Path"
 msgstr "Путь к файлу конфигурации"
 
-msgid "Configuration for Podkop service"
-msgstr "Настройки сервиса Podkop"
+msgid "Configuration for NetShift service"
+msgstr "Конфигурация службы NetShift"
 
 msgid "Configuration Type"
 msgstr "Тип конфигурации"
 
+msgid "Connection"
+msgstr "Подключение"
+
 msgid "Connection Type"
 msgstr "Тип подключения"
 
+msgid "Connection type, transport and DNS resolver for this section"
+msgstr "Тип подключения, транспорт и DNS-резолвер для этой секции"
+
 msgid "Connection URL"
 msgstr "URL подключения"
 
 msgid "Copy"
 msgstr "Копировать"
 
+msgid "Core switch failed"
+msgstr "Не удалось переключить ядро"
+
+msgid "Core switch timed out"
+msgstr "Истекло время ожидания переключения ядра"
+
 msgid "Currently unavailable"
 msgstr "Временно недоступно"
 
+msgid "Custom domains"
+msgstr "Свои домены"
+
+msgid "Custom subnets"
+msgstr "Свои подсети"
+
 msgid "Dashboard"
 msgstr "Дашборд"
 
 msgid "Dashboard currently unavailable"
 msgstr "Дашборд сейчас недоступен"
 
-msgid "Delay in milliseconds before reloading podkop after interface UP"
-msgstr "Задержка в миллисекундах перед перезагрузкой podkop после поднятия интерфейса"
+msgid "Delay in milliseconds before reloading NetShift after interface UP"
+msgstr "Задержка в миллисекундах перед перезагрузкой NetShift после поднятия интерфейса"
 
 msgid "Delay value cannot be empty"
 msgstr "Значение задержки не может быть пустым"
 
+msgid "Dev"
+msgstr "Dev"
+
 msgid "DHCP has DNS server"
 msgstr "DHCP содержит DNS сервер"
 
@@ -143,9 +206,18 @@ msgstr "Отключить QUIC протокол для улучшения со
 msgid "Disabled"
 msgstr "Отключено"
 
+msgid "Disables TLS certificate verification when downloading the subscription."
+msgstr "Отключает проверку TLS-сертификата при загрузке подписки."
+
+msgid "DNS"
+msgstr "DNS"
+
 msgid "DNS on router"
 msgstr "DNS на роутере"
 
+msgid "DNS outbound section"
+msgstr "Секция outbound для DNS"
+
 msgid "DNS over HTTPS (DoH)"
 msgstr "DNS через HTTPS (DoH)"
 
@@ -167,6 +239,9 @@ msgstr "Адрес DNS-сервера не может быть пустым"
 msgid "Do not panic, everything can be fixed, just..."
 msgstr "Не паникуйте, всё можно исправить, просто..."
 
+msgid "Domain and subnet lists that decide which traffic uses this section"
+msgstr "Списки доменов и подсетей, определяющие, какой трафик идёт через эту секцию"
+
 msgid "Domain Resolver"
 msgstr "Резолвер доменов"
 
@@ -188,6 +263,9 @@ msgstr "Скачивать списки через выбранную секци
 msgid "Downloading all lists via specific Proxy/VPN"
 msgstr "Загрузка всех списков через указанный прокси/VPN"
 
+msgid "Drop subscription servers whose name contains any of these keywords (case-insensitive)."
+msgstr "Исключать серверы подписки, имя которых содержит любое из этих ключевых слов (без учёта регистра)."
+
 msgid "Dynamic List"
 msgstr "Динамический список"
 
@@ -200,6 +278,12 @@ msgstr "Включить встроенный DNS-резолвер для дом
 msgid "Enable DNS resolve to get real IP when routing"
 msgstr "Разрешать домены в реальные IP-адреса перед маршрутизацией в outbound"
 
+msgid "Enable IPv6 Support"
+msgstr "Включить поддержку IPv6"
+
+msgid "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support."
+msgstr "Включить маршрутизацию TProxy по IPv6, входящий DNS по IPv6 и поддержку FakeIP для IPv6."
+
 msgid "Enable Mixed Proxy"
 msgstr "Включить смешанный прокси"
 
@@ -230,21 +314,45 @@ msgstr "Введите подсети в нотации CIDR (например,
 msgid "Every 1 minute"
 msgstr "Каждую минуту"
 
+msgid "Every 12 hours"
+msgstr "Каждые 12 часов"
+
+msgid "Every 3 hours"
+msgstr "Каждые 3 часа"
+
 msgid "Every 3 minutes"
 msgstr "Каждые 3 минуты"
 
+msgid "Every 30 minutes"
+msgstr "Каждые 30 минут"
+
 msgid "Every 30 seconds"
 msgstr "Каждые 30 секунд"
 
 msgid "Every 5 minutes"
 msgstr "Каждые 5 минут"
 
+msgid "Every 6 hours"
+msgstr "Каждые 6 часов"
+
+msgid "Every day"
+msgstr "Каждый день"
+
+msgid "Every hour"
+msgstr "Каждый час"
+
 msgid "Exclude NTP"
 msgstr "Исключить NTP"
 
 msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
 msgstr "Исключите трафик протокола NTP из туннеля, чтобы предотвратить его маршрутизацию через прокси-сервер или VPN."
 
+msgid "Exclude servers by keyword"
+msgstr "Исключать серверы по ключевому слову"
+
+msgid "Failed to clear subscription cache"
+msgstr "Не удалось очистить кеш подписок"
+
 msgid "Failed to copy!"
 msgstr "Не удалось скопировать!"
 
@@ -263,9 +371,27 @@ msgstr "Получить глобальную проверку"
 msgid "Global check"
 msgstr "Глобальная проверка"
 
+msgid "Global Proxy"
+msgstr "Глобальный прокси"
+
+msgid "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters."
+msgstr "Группировать прокси из подписки в группы URLTest. «По флагу страны» использует эмодзи флага в начале каждого имени; «По префиксу имени» группирует по первым N символам."
+
+msgid "How often to automatically update the subscription"
+msgstr "Как часто автоматически обновлять подписку"
+
 msgid "HTTP error"
 msgstr "Ошибка HTTP"
 
+msgid "Include servers by keyword"
+msgstr "Включать серверы по ключевому слову"
+
+msgid "Install %s"
+msgstr "Установить %s"
+
+msgid "Installed version is newer than release"
+msgstr "Установленная версия новее релиза"
+
 msgid "Interface Monitoring"
 msgstr "Мониторинг интерфейса"
 
@@ -275,14 +401,14 @@ msgstr "Задержка при мониторинге интерфейсов"
 msgid "Interface monitoring for Bad WAN"
 msgstr "Мониторинг интерфейса для Bad WAN"
 
-msgid "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
-msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, dns.example.com или dns.example.com/nicedns для DoH"
+msgid "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
+msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, [::1], dns.example.com или dns.example.com/dns-query для DoH"
 
 msgid "Invalid domain address"
 msgstr "Неверный домен"
 
-msgid "Invalid format. Use X.X.X.X or X.X.X.X/Y"
-msgstr "Неверный формат. Используйте X.X.X.X или X.X.X.X/Y"
+msgid "Invalid format. Use X.X.X.X/Y or IPv6/Y"
+msgstr "Неверный формат. Используйте X.X.X.X/Y или IPv6/Y"
 
 msgid "Invalid HY2 URL: insecure must be 0 or 1"
 msgstr "Неверный URL Hysteria2: параметр insecure должен быть 0 или 1"
@@ -326,6 +452,9 @@ msgstr "Неверный URL Hysteria2: неподдерживаемый тип
 msgid "Invalid IP address"
 msgstr "Неверный IP-адрес"
 
+msgid "Invalid IPv6 address"
+msgstr "Неверный IPv6-адрес"
+
 msgid "Invalid JSON format"
 msgstr "Неверный формат JSON"
 
@@ -404,18 +533,54 @@ msgstr "Неверный формат URL"
 msgid "Invalid VLESS URL: parsing failed"
 msgstr "Неверный URL VLESS: ошибка разбора"
 
+msgid "Invalid VMess URL: invalid port"
+msgstr "Неверный URL VMess: недопустимый порт"
+
+msgid "Invalid VMess URL: malformed base64"
+msgstr "Неверный URL VMess: некорректный base64"
+
+msgid "Invalid VMess URL: malformed JSON"
+msgstr "Неверный URL VMess: некорректный JSON"
+
+msgid "Invalid VMess URL: missing address"
+msgstr "Неверный URL VMess: отсутствует адрес"
+
+msgid "Invalid VMess URL: missing id"
+msgstr "Неверный URL VMess: отсутствует id"
+
+msgid "Invalid VMess URL: must not contain spaces"
+msgstr "Неверный URL VMess: не должен содержать пробелы"
+
+msgid "Invalid VMess URL: must start with vmess://"
+msgstr "Неверный URL VMess: должен начинаться с vmess://"
+
 msgid "IP address 0.0.0.0 is not allowed"
 msgstr "IP-адрес 0.0.0.0 не допускается"
 
+msgid "IPv6 CIDR must be between 0 and 128"
+msgstr "IPv6 CIDR должен быть от 0 до 128"
+
 msgid "Issues detected"
 msgstr "Обнаружены проблемы"
 
+msgid "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all."
+msgstr "Оставлять только серверы подписки, имя которых содержит хотя бы одно из этих ключевых слов (без учёта регистра). Оставьте пустым, чтобы оставить все."
+
 msgid "Latest"
 msgstr "Последняя"
 
+msgid "Latest version is installed"
+msgstr "Установлена последняя версия"
+
 msgid "List Update Frequency"
 msgstr "Частота обновления списков"
 
+msgid "List update schedule, download routing, and routing exclusions"
+msgstr "Расписание обновления списков, маршрутизация загрузок и исключения из маршрутизации"
+
+msgid "Lists & Updates"
+msgstr "Списки и обновления"
+
 msgid "Local Domain Lists"
 msgstr "Локальные списки доменов"
 
@@ -428,9 +593,15 @@ msgstr "Уровень логов"
 msgid "Main DNS"
 msgstr "Основной DNS"
 
+msgid "Main DNS via outbound"
+msgstr "Основной DNS через outbound"
+
 msgid "Memory Usage"
 msgstr "Использование памяти"
 
+msgid "Mixed proxy and DNS resolution tuning"
+msgstr "Настройка смешанного прокси и разрешения DNS"
+
 msgid "Mixed Proxy Port"
 msgstr "Порт смешанного прокси"
 
@@ -440,6 +611,21 @@ msgstr "Наблюдаемые интерфейсы"
 msgid "Must be a number in the range of 50 - 1000"
 msgstr "Должно быть числом от 50 до 1000"
 
+msgid "NetShift"
+msgstr "NetShift"
+
+msgid "NetShift Settings"
+msgstr "Настройки NetShift"
+
+msgid "NetShift updated, version:"
+msgstr "NetShift обновлён, версия:"
+
+msgid "NetShift will not modify your DHCP configuration"
+msgstr "NetShift не будет изменять вашу конфигурацию DHCP"
+
+msgid "Network"
+msgstr "Сеть"
+
 msgid "Network Interface"
 msgstr "Сетевой интерфейс"
 
@@ -449,12 +635,24 @@ msgstr "Другие правила маркировки не найдены"
 msgid "Not implement yet"
 msgstr "Ещё не реализовано"
 
+msgid "Not installed"
+msgstr "Не установлено"
+
 msgid "Not responding"
 msgstr "Не отвечает"
 
 msgid "Not running"
 msgstr "Не запущено"
 
+msgid "Number of leading characters of each proxy name to group by."
+msgstr "Количество начальных символов имени каждого прокси для группировки."
+
+msgid "Off"
+msgstr "Выключено"
+
+msgid "Only one section can be global at a time."
+msgstr "Только одна секция может быть глобальной одновременно."
+
 msgid "Operation timed out"
 msgstr "Время ожидания истекло"
 
@@ -485,14 +683,11 @@ msgstr "Путь должен заканчиваться на cache.db"
 msgid "Pending"
 msgstr "Ожидает запуска"
 
-msgid "Podkop"
-msgstr "Podkop"
-
-msgid "Podkop Settings"
-msgstr "Настройки podkop"
+msgid "Prefix length"
+msgstr "Длина префикса"
 
-msgid "Podkop will not modify your DHCP configuration"
-msgstr "Podkop не будет изменять вашу конфигурацию DHCP."
+msgid "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."
+msgstr "Переключатели протоколов, пути к файлам и журналирование. Включайте блокировку DoH только после переключения вышестоящего DNS на UDP или DoT."
 
 msgid "Proxy Configuration URL"
 msgstr "URL конфигурации прокси"
@@ -515,8 +710,14 @@ msgstr "Внешние списки подсетей"
 msgid "Resolve real IP for routing"
 msgstr "Разрешение реальных IP-адресов"
 
-msgid "Restart podkop"
-msgstr "Перезапустить Podkop"
+msgid "Restart NetShift"
+msgstr "Перезапустить NetShift"
+
+msgid "Route all unmatched traffic through this section's outbound."
+msgstr "Направлять весь несовпавший трафик через outbound этой секции."
+
+msgid "Route main DNS through proxy/VPN"
+msgstr "Основной DNS через прокси/VPN"
 
 msgid "Router DNS is not routed through sing-box"
 msgstr "DNS роутера не проходит через sing-box"
@@ -524,6 +725,9 @@ msgstr "DNS роутера не проходит через sing-box"
 msgid "Router DNS is routed through sing-box"
 msgstr "DNS роутера проходит через sing-box"
 
+msgid "Routing"
+msgstr "Маршрутизация"
+
 msgid "Routing Excluded IPs"
 msgstr "Исключённые из маршрутизации IP-адреса"
 
@@ -533,9 +737,6 @@ msgstr "Счётчики правил mangle"
 msgid "Rules mangle exist"
 msgstr "Правила mangle существуют"
 
-msgid "Rules mangle output counters"
-msgstr "Счётчики правил mangle output"
-
 msgid "Rules mangle output exist"
 msgstr "Правила mangle output существуют"
 
@@ -587,12 +788,6 @@ msgstr "Выберите путь к файлу конфигурации sing-bo
 msgid "Select the DNS protocol type for the domain resolver"
 msgstr "Выберите тип протокола DNS для резолвера доменов"
 
-msgid "Select the list type for adding custom domains"
-msgstr "Выберите тип списка для добавления пользовательских доменов"
-
-msgid "Select the list type for adding custom subnets"
-msgstr "Выберите тип списка для добавления пользовательских подсетей"
-
 msgid "Select the log level for sing-box"
 msgstr "Выберите уровень логов для sing-box"
 
@@ -611,6 +806,12 @@ msgstr "Selector"
 msgid "Selector Proxy Links"
 msgstr "Ссылки прокси для Selector"
 
+msgid "Self-update failed"
+msgstr "Не удалось обновить"
+
+msgid "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct."
+msgstr "Отправлять запросы к основному DNS через outbound прокси/VPN вместо прямого подключения. Bootstrap DNS всегда остаётся прямым."
+
 msgid "Services info"
 msgstr "Информация о сервисах"
 
@@ -626,6 +827,9 @@ msgstr "Sing-box"
 msgid "Sing-box autostart disabled"
 msgstr "Автостарт sing-box отключен"
 
+msgid "Sing-box core changed, version:"
+msgstr "Ядро sing-box изменено, версия:"
+
 msgid "Sing-box installed"
 msgstr "Sing-box установлен"
 
@@ -641,6 +845,9 @@ msgstr "Сервис sing-box существует"
 msgid "Sing-box version is compatible (newer than 1.12.4)"
 msgstr "Версия Sing-box совместима (новее 1.12.4)"
 
+msgid "Source and output interfaces, and Bad WAN interface monitoring"
+msgstr "Входящий и исходящий интерфейсы, а также мониторинг интерфейсов Bad WAN"
+
 msgid "Source Network Interface"
 msgstr "Сетевой интерфейс источника"
 
@@ -659,15 +866,45 @@ msgstr "Укажите URL-адреса для загрузки и исполь
 msgid "Specify the path to the list file located on the router filesystem"
 msgstr "Укажите путь к файлу списка, расположенному в файловой системе маршрутизатора."
 
-msgid "Start podkop"
-msgstr "Запустить podkop"
+msgid "Start NetShift"
+msgstr "Запустить NetShift"
+
+msgid "Stop NetShift"
+msgstr "Остановить NetShift"
 
-msgid "Stop podkop"
-msgstr "Остановить podkop"
+msgid "Subscription"
+msgstr "Подписка"
+
+msgid "Subscription cache cleared and re-downloaded"
+msgstr "Кеш подписок очищен и загружен заново"
+
+msgid "Subscription feeds, server filters and URLTest tuning"
+msgstr "Источники подписок, фильтры серверов и настройка URLTest"
+
+msgid "Subscription format"
+msgstr "Формат подписки"
+
+msgid "Subscription grouping"
+msgstr "Группировка подписки"
+
+msgid "Subscription Update Interval"
+msgstr "Интервал обновления подписки"
+
+msgid "Subscription URLs"
+msgstr "URL подписок"
 
 msgid "Successfully copied!"
 msgstr "Успешно скопировано!"
 
+msgid "Switch to extended"
+msgstr "Переключить на extended"
+
+msgid "Switch to stable"
+msgstr "Переключить на stable"
+
+msgid "Switching sing-box core, this may take a few minutes…"
+msgstr "Переключение ядра sing-box, это может занять несколько минут…"
+
 msgid "System info"
 msgstr "Системная информация"
 
@@ -695,6 +932,9 @@ msgstr "Максимально допустимая разница во врем
 msgid "The URL used to test server connectivity"
 msgstr "URL-адрес, используемый для проверки подключения к серверу"
 
+msgid "This is a security trade-off: an attacker could intercept the fetch."
+msgstr "Это компромисс в безопасности: злоумышленник может перехватить загрузку."
+
 msgid "Time in seconds for DNS record caching (default: 60)"
 msgstr "Время в секундах для кэширования DNS записей (по умолчанию: 60)"
 
@@ -725,11 +965,26 @@ msgstr "неизвестно"
 msgid "Unknown error"
 msgstr "Неизвестная ошибка"
 
+msgid "Update"
+msgstr "Обновить"
+
+msgid "Update is available"
+msgstr "Доступно обновление"
+
+msgid "Update NetShift"
+msgstr "Обновить NetShift"
+
+msgid "Updating NetShift, this may take a few minutes; the page will reload…"
+msgstr "Обновление NetShift, это может занять несколько минут; страница перезагрузится…"
+
 msgid "Uplink"
 msgstr "Исходящий"
 
-msgid "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
-msgstr "URL должен начинаться с vless://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
+msgid "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"
+msgstr "Вышестоящий и начальный (bootstrap) DNS-резолверы и опциональный DNS через прокси"
+
+msgid "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+msgstr "URL должен начинаться с vless://, vmess://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
 
 msgid "URL must use one of the following protocols:"
 msgstr "URL должен использовать один из следующих протоколов:"
@@ -749,8 +1004,14 @@ msgstr "URLTest ссылка для проверки"
 msgid "URLTest Tolerance"
 msgstr "URLTest допустимое отклонение"
 
-msgid "User Domain List Type"
-msgstr "Тип пользовательского списка доменов"
+msgid "Use only for IP-host panels that serve an invalid or self-signed certificate."
+msgstr "Используйте только для панелей с IP-адресом, у которых недействительный или самоподписанный сертификат."
+
+msgid "Use this only when the router has working IPv6 connectivity."
+msgstr "Используйте это только если на роутере есть рабочее подключение по IPv6."
+
+msgid "Use with Exclusion sections to route specific domains directly."
+msgstr "Используйте вместе с секциями исключений для прямой маршрутизации определённых доменов."
 
 msgid "User Domains"
 msgstr "Пользовательские домены"
@@ -758,9 +1019,6 @@ msgstr "Пользовательские домены"
 msgid "User Domains List"
 msgstr "Список пользовательских доменов"
 
-msgid "User Subnet List Type"
-msgstr "Тип пользовательского списка подсетей"
-
 msgid "User Subnets"
 msgstr "Пользовательские подсети"
 
@@ -773,14 +1031,17 @@ msgstr "Валидно"
 msgid "Validation errors:"
 msgstr "Ошибки валидации:"
 
+msgid "Version"
+msgstr "Версия"
+
 msgid "View logs"
 msgstr "Посмотреть логи"
 
 msgid "Visit Wiki"
 msgstr "Перейти в wiki"
 
-msgid "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
-msgstr ""
+msgid "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
+msgstr "ссылки vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2://"
 
 msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
 msgstr "Предупреждение: %s нельзя использовать вместе с %s. Предыдущие варианты были удалены."
@@ -788,8 +1049,23 @@ msgstr "Предупреждение: %s нельзя использовать 
 msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
 msgstr "Предупреждение: Russia inside может быть использован только с %s. %s уже есть в Russia inside и будет удален из выбранных."
 
+msgid "When enabled, traffic not matching any other section's lists will go through this proxy."
+msgstr "Когда включено, трафик, не совпадающий со списками других секций, будет идти через этот прокси."
+
+msgid "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound."
+msgstr "Какая секция прокси/VPN обслуживает DNS. Оставьте пустым, чтобы использовать первый настроенный outbound."
+
+msgid "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format."
+msgstr "Какой формат подписки (клиент) запрашивать первым. «Авто» использует порядок по умолчанию. Выберите «Xray JSON (Happ)», если ваша панель отдаёт некоторые узлы (например, xhttp) только под клиентом вроде Happ, или «Sing-box», чтобы предпочесть формат sing-box."
+
+msgid "Xray JSON (Happ)"
+msgstr "Xray JSON (Happ)"
+
 msgid "YACD Secret Key"
 msgstr "Секретный ключ YACD"
 
+msgid "YACD web dashboard access and remote-access protection"
+msgstr "Доступ к веб-панели YACD и защита удалённого доступа"
+
 msgid "You can select Output Network Interface, by default autodetect"
 msgstr "Вы можете выбрать выходной сетевой интерфейс, по умолчанию он определяется автоматически."
diff --git a/fe-app-podkop/package.json b/fe-app-netshift/package.json
similarity index 90%
rename from fe-app-podkop/package.json
rename to fe-app-netshift/package.json
index 3b60630c..aebbf833 100644
--- a/fe-app-podkop/package.json
+++ b/fe-app-netshift/package.json
@@ -1,11 +1,11 @@
 {
-  "name": "fe-app-podkop",
+  "name": "fe-app-netshift",
   "version": "1.0.0",
   "license": "MIT",
   "type": "module",
   "scripts": {
     "format": "prettier --write src",
-    "format:js": "prettier --write ../luci-app-podkop/htdocs/luci-static/resources/view/podkop",
+    "format:js": "prettier --write ../luci-app-netshift/htdocs/luci-static/resources/view/netshift",
     "lint": "eslint src --ext .ts,.tsx",
     "lint:fix": "eslint src --ext .ts,.tsx --fix",
     "build": "tsup src/main.ts",
diff --git a/fe-app-podkop/src/constants.ts b/fe-app-netshift/src/constants.ts
similarity index 83%
rename from fe-app-podkop/src/constants.ts
rename to fe-app-netshift/src/constants.ts
index 6f840d14..fb889410 100644
--- a/fe-app-podkop/src/constants.ts
+++ b/fe-app-netshift/src/constants.ts
@@ -4,7 +4,7 @@ export const STATUS_COLORS = {
   WARNING: '#ff9800',
 };
 
-export const PODKOP_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';
+export const NETSHIFT_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';
 export const FAKEIP_CHECK_DOMAIN = 'fakeip.podkop.fyi';
 export const IP_CHECK_DOMAIN = 'ip.podkop.fyi';
 
@@ -66,6 +66,15 @@ export const UPDATE_INTERVAL_OPTIONS = {
   '3d': 'Every 3 days',
 };
 
+export const SUBSCRIPTION_UPDATE_INTERVAL_OPTIONS = {
+  '30m': 'Every 30 minutes',
+  '1h': 'Every hour',
+  '3h': 'Every 3 hours',
+  '6h': 'Every 6 hours',
+  '12h': 'Every 12 hours',
+  '1d': 'Every day',
+};
+
 export const DNS_SERVER_OPTIONS = {
   '1.1.1.1': '1.1.1.1 (Cloudflare)',
   '8.8.8.8': '8.8.8.8 (Google)',
@@ -74,6 +83,9 @@ export const DNS_SERVER_OPTIONS = {
   'unfiltered.adguard-dns.com':
     'unfiltered.adguard-dns.com (AdGuard Unfiltered)',
   'family.adguard-dns.com': 'family.adguard-dns.com (AdGuard Family)',
+  '2001:4860:4860::8888': '2001:4860:4860::8888 (Google IPv6)',
+  '2606:4700:4700::1111': '2606:4700:4700::1111 (Cloudflare IPv6)',
+  '2620:fe::fe': '2620:fe::fe (Quad9 IPv6)',
 };
 export const BOOTSTRAP_DNS_SERVER_OPTIONS = {
   '77.88.8.8': '77.88.8.8 (Yandex DNS)',
@@ -84,6 +96,8 @@ export const BOOTSTRAP_DNS_SERVER_OPTIONS = {
   '8.8.4.4': '8.8.4.4 (Google DNS)',
   '9.9.9.9': '9.9.9.9 (Quad9 DNS)',
   '9.9.9.11': '9.9.9.11 (Quad9 DNS)',
+  '2001:4860:4860::8888': '2001:4860:4860::8888 (Google DNS IPv6)',
+  '2606:4700:4700::1111': '2606:4700:4700::1111 (Cloudflare DNS IPv6)',
 };
 
 export const DIAGNOSTICS_UPDATE_INTERVAL = 10000; // 10 seconds
diff --git a/fe-app-podkop/src/helpers/copyToClipboard.ts b/fe-app-netshift/src/helpers/copyToClipboard.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/copyToClipboard.ts
rename to fe-app-netshift/src/helpers/copyToClipboard.ts
diff --git a/fe-app-podkop/src/helpers/downloadAsTxt.ts b/fe-app-netshift/src/helpers/downloadAsTxt.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/downloadAsTxt.ts
rename to fe-app-netshift/src/helpers/downloadAsTxt.ts
diff --git a/fe-app-podkop/src/helpers/executeShellCommand.ts b/fe-app-netshift/src/helpers/executeShellCommand.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/executeShellCommand.ts
rename to fe-app-netshift/src/helpers/executeShellCommand.ts
diff --git a/fe-app-podkop/src/helpers/getClashApiUrl.ts b/fe-app-netshift/src/helpers/getClashApiUrl.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/getClashApiUrl.ts
rename to fe-app-netshift/src/helpers/getClashApiUrl.ts
diff --git a/fe-app-podkop/src/helpers/getProxyUrlName.ts b/fe-app-netshift/src/helpers/getProxyUrlName.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/getProxyUrlName.ts
rename to fe-app-netshift/src/helpers/getProxyUrlName.ts
diff --git a/fe-app-podkop/src/helpers/index.ts b/fe-app-netshift/src/helpers/index.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/index.ts
rename to fe-app-netshift/src/helpers/index.ts
diff --git a/fe-app-podkop/src/helpers/injectGlobalStyles.ts b/fe-app-netshift/src/helpers/injectGlobalStyles.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/injectGlobalStyles.ts
rename to fe-app-netshift/src/helpers/injectGlobalStyles.ts
diff --git a/fe-app-podkop/src/helpers/insertIf.ts b/fe-app-netshift/src/helpers/insertIf.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/insertIf.ts
rename to fe-app-netshift/src/helpers/insertIf.ts
diff --git a/fe-app-podkop/src/helpers/maskIP.ts b/fe-app-netshift/src/helpers/maskIP.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/maskIP.ts
rename to fe-app-netshift/src/helpers/maskIP.ts
diff --git a/fe-app-podkop/src/helpers/normalizeCompiledVersion.ts b/fe-app-netshift/src/helpers/normalizeCompiledVersion.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/normalizeCompiledVersion.ts
rename to fe-app-netshift/src/helpers/normalizeCompiledVersion.ts
diff --git a/fe-app-podkop/src/helpers/onMount.ts b/fe-app-netshift/src/helpers/onMount.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/onMount.ts
rename to fe-app-netshift/src/helpers/onMount.ts
diff --git a/fe-app-podkop/src/helpers/parseQueryString.ts b/fe-app-netshift/src/helpers/parseQueryString.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/parseQueryString.ts
rename to fe-app-netshift/src/helpers/parseQueryString.ts
diff --git a/fe-app-podkop/src/helpers/parseValueList.ts b/fe-app-netshift/src/helpers/parseValueList.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/parseValueList.ts
rename to fe-app-netshift/src/helpers/parseValueList.ts
diff --git a/fe-app-podkop/src/helpers/preserveScrollForPage.ts b/fe-app-netshift/src/helpers/preserveScrollForPage.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/preserveScrollForPage.ts
rename to fe-app-netshift/src/helpers/preserveScrollForPage.ts
diff --git a/fe-app-podkop/src/helpers/prettyBytes.ts b/fe-app-netshift/src/helpers/prettyBytes.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/prettyBytes.ts
rename to fe-app-netshift/src/helpers/prettyBytes.ts
diff --git a/fe-app-podkop/src/helpers/removeVersionPrefix.ts b/fe-app-netshift/src/helpers/removeVersionPrefix.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/removeVersionPrefix.ts
rename to fe-app-netshift/src/helpers/removeVersionPrefix.ts
diff --git a/fe-app-podkop/src/helpers/showToast.ts b/fe-app-netshift/src/helpers/showToast.ts
similarity index 92%
rename from fe-app-podkop/src/helpers/showToast.ts
rename to fe-app-netshift/src/helpers/showToast.ts
index 92dcdd98..b32c1075 100644
--- a/fe-app-podkop/src/helpers/showToast.ts
+++ b/fe-app-netshift/src/helpers/showToast.ts
@@ -1,6 +1,6 @@
 export function showToast(
   message: string,
-  type: 'success' | 'error',
+  type: 'success' | 'error' | 'warning' | 'info',
   duration: number = 3000,
 ) {
   let container = document.querySelector('.toast-container');
diff --git a/fe-app-podkop/src/helpers/splitProxyString.ts b/fe-app-netshift/src/helpers/splitProxyString.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/splitProxyString.ts
rename to fe-app-netshift/src/helpers/splitProxyString.ts
diff --git a/fe-app-podkop/src/helpers/svgEl.ts b/fe-app-netshift/src/helpers/svgEl.ts
similarity index 100%
rename from fe-app-podkop/src/helpers/svgEl.ts
rename to fe-app-netshift/src/helpers/svgEl.ts
diff --git a/fe-app-podkop/src/helpers/tests/maskIp.test.js b/fe-app-netshift/src/helpers/tests/maskIp.test.js
similarity index 100%
rename from fe-app-podkop/src/helpers/tests/maskIp.test.js
rename to fe-app-netshift/src/helpers/tests/maskIp.test.js
diff --git a/fe-app-podkop/src/helpers/withTimeout.ts b/fe-app-netshift/src/helpers/withTimeout.ts
similarity index 94%
rename from fe-app-podkop/src/helpers/withTimeout.ts
rename to fe-app-netshift/src/helpers/withTimeout.ts
index e2207409..d9319af4 100644
--- a/fe-app-podkop/src/helpers/withTimeout.ts
+++ b/fe-app-netshift/src/helpers/withTimeout.ts
@@ -1,4 +1,4 @@
-import { logger } from '../podkop';
+import { logger } from '../netshift';
 
 export async function withTimeout<T>(
   promise: Promise<T>,
diff --git a/fe-app-podkop/src/icons/index.ts b/fe-app-netshift/src/icons/index.ts
similarity index 100%
rename from fe-app-podkop/src/icons/index.ts
rename to fe-app-netshift/src/icons/index.ts
diff --git a/fe-app-podkop/src/icons/renderBookOpenTextIcon24.ts b/fe-app-netshift/src/icons/renderBookOpenTextIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderBookOpenTextIcon24.ts
rename to fe-app-netshift/src/icons/renderBookOpenTextIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCheckIcon24.ts b/fe-app-netshift/src/icons/renderCheckIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCheckIcon24.ts
rename to fe-app-netshift/src/icons/renderCheckIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleAlertIcon24.ts b/fe-app-netshift/src/icons/renderCircleAlertIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleAlertIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleAlertIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleCheckBigIcon24.ts b/fe-app-netshift/src/icons/renderCircleCheckBigIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleCheckBigIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleCheckBigIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleCheckIcon24.ts b/fe-app-netshift/src/icons/renderCircleCheckIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleCheckIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleCheckIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCirclePlayIcon24.ts b/fe-app-netshift/src/icons/renderCirclePlayIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCirclePlayIcon24.ts
rename to fe-app-netshift/src/icons/renderCirclePlayIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleSlashIcon24.ts b/fe-app-netshift/src/icons/renderCircleSlashIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleSlashIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleSlashIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleStopIcon24.ts b/fe-app-netshift/src/icons/renderCircleStopIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleStopIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleStopIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCircleXIcon24.ts b/fe-app-netshift/src/icons/renderCircleXIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCircleXIcon24.ts
rename to fe-app-netshift/src/icons/renderCircleXIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderCogIcon24.ts b/fe-app-netshift/src/icons/renderCogIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderCogIcon24.ts
rename to fe-app-netshift/src/icons/renderCogIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderLoaderCircleIcon24.ts b/fe-app-netshift/src/icons/renderLoaderCircleIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderLoaderCircleIcon24.ts
rename to fe-app-netshift/src/icons/renderLoaderCircleIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderPauseIcon24.ts b/fe-app-netshift/src/icons/renderPauseIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderPauseIcon24.ts
rename to fe-app-netshift/src/icons/renderPauseIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderPlayIcon24.ts b/fe-app-netshift/src/icons/renderPlayIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderPlayIcon24.ts
rename to fe-app-netshift/src/icons/renderPlayIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderRotateCcwIcon24.ts b/fe-app-netshift/src/icons/renderRotateCcwIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderRotateCcwIcon24.ts
rename to fe-app-netshift/src/icons/renderRotateCcwIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderSearchIcon24.ts b/fe-app-netshift/src/icons/renderSearchIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderSearchIcon24.ts
rename to fe-app-netshift/src/icons/renderSearchIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderSquareChartGanttIcon24.ts b/fe-app-netshift/src/icons/renderSquareChartGanttIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderSquareChartGanttIcon24.ts
rename to fe-app-netshift/src/icons/renderSquareChartGanttIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderTriangleAlertIcon24.ts b/fe-app-netshift/src/icons/renderTriangleAlertIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderTriangleAlertIcon24.ts
rename to fe-app-netshift/src/icons/renderTriangleAlertIcon24.ts
diff --git a/fe-app-podkop/src/icons/renderXIcon24.ts b/fe-app-netshift/src/icons/renderXIcon24.ts
similarity index 100%
rename from fe-app-podkop/src/icons/renderXIcon24.ts
rename to fe-app-netshift/src/icons/renderXIcon24.ts
diff --git a/fe-app-podkop/src/luci.d.ts b/fe-app-netshift/src/luci.d.ts
similarity index 100%
rename from fe-app-podkop/src/luci.d.ts
rename to fe-app-netshift/src/luci.d.ts
diff --git a/fe-app-podkop/src/main.ts b/fe-app-netshift/src/main.ts
similarity index 90%
rename from fe-app-podkop/src/main.ts
rename to fe-app-netshift/src/main.ts
index 497e60ef..3df7b463 100644
--- a/fe-app-podkop/src/main.ts
+++ b/fe-app-netshift/src/main.ts
@@ -9,5 +9,5 @@ if (typeof structuredClone !== 'function')
 
 export * from './validators';
 export * from './helpers';
-export * from './podkop';
+export * from './netshift';
 export * from './constants';
diff --git a/fe-app-podkop/src/podkop/api.ts b/fe-app-netshift/src/netshift/api.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/api.ts
rename to fe-app-netshift/src/netshift/api.ts
diff --git a/fe-app-netshift/src/netshift/fetchers/fetchServicesInfo.ts b/fe-app-netshift/src/netshift/fetchers/fetchServicesInfo.ts
new file mode 100644
index 00000000..f2886309
--- /dev/null
+++ b/fe-app-netshift/src/netshift/fetchers/fetchServicesInfo.ts
@@ -0,0 +1,32 @@
+import { NetShiftShellMethods } from '../methods';
+import { store } from '../services';
+
+export async function fetchServicesInfo() {
+  const [netshift, singbox] = await Promise.all([
+    NetShiftShellMethods.getStatus(),
+    NetShiftShellMethods.getSingBoxStatus(),
+  ]);
+
+  if (!netshift.success || !singbox.success) {
+    store.set({
+      servicesInfoWidget: {
+        loading: false,
+        failed: true,
+        data: { singbox: 0, netshift: 0 },
+      },
+    });
+  }
+
+  if (netshift.success && singbox.success) {
+    store.set({
+      servicesInfoWidget: {
+        loading: false,
+        failed: false,
+        data: {
+          singbox: singbox.data.running,
+          netshift: netshift.data.enabled,
+        },
+      },
+    });
+  }
+}
diff --git a/fe-app-podkop/src/podkop/fetchers/index.ts b/fe-app-netshift/src/netshift/fetchers/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/fetchers/index.ts
rename to fe-app-netshift/src/netshift/fetchers/index.ts
diff --git a/fe-app-podkop/src/podkop/index.ts b/fe-app-netshift/src/netshift/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/index.ts
rename to fe-app-netshift/src/netshift/index.ts
diff --git a/fe-app-podkop/src/podkop/methods/custom/getClashApiSecret.ts b/fe-app-netshift/src/netshift/methods/custom/getClashApiSecret.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/methods/custom/getClashApiSecret.ts
rename to fe-app-netshift/src/netshift/methods/custom/getClashApiSecret.ts
diff --git a/fe-app-netshift/src/netshift/methods/custom/getConfigSections.ts b/fe-app-netshift/src/netshift/methods/custom/getConfigSections.ts
new file mode 100644
index 00000000..1f40d04f
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/custom/getConfigSections.ts
@@ -0,0 +1,5 @@
+import { NetShift } from '../../types';
+
+export async function getConfigSections(): Promise<NetShift.ConfigSection[]> {
+  return uci.load('netshift').then(() => uci.sections('netshift'));
+}
diff --git a/fe-app-podkop/src/podkop/methods/custom/getDashboardSections.ts b/fe-app-netshift/src/netshift/methods/custom/getDashboardSections.ts
similarity index 67%
rename from fe-app-podkop/src/podkop/methods/custom/getDashboardSections.ts
rename to fe-app-netshift/src/netshift/methods/custom/getDashboardSections.ts
index a1f12d01..9248568f 100644
--- a/fe-app-podkop/src/podkop/methods/custom/getDashboardSections.ts
+++ b/fe-app-netshift/src/netshift/methods/custom/getDashboardSections.ts
@@ -1,16 +1,16 @@
 import { getConfigSections } from './getConfigSections';
-import { Podkop } from '../../types';
+import { NetShift } from '../../types';
 import { getProxyUrlName, splitProxyString } from '../../../helpers';
-import { PodkopShellMethods } from '../shell';
+import { NetShiftShellMethods } from '../shell';
 
 interface IGetDashboardSectionsResponse {
   success: boolean;
-  data: Podkop.OutboundGroup[];
+  data: NetShift.OutboundGroup[];
 }
 
 export async function getDashboardSections(): Promise<IGetDashboardSectionsResponse> {
   const configSections = await getConfigSections();
-  const clashProxies = await PodkopShellMethods.getClashApiProxies();
+  const clashProxies = await NetShiftShellMethods.getClashApiProxies();
 
   if (!clashProxies.success) {
     return {
@@ -156,6 +156,82 @@ export async function getDashboardSections(): Promise<IGetDashboardSectionsRespo
             ],
           };
         }
+
+        if (section.proxy_config_type === 'subscription') {
+          const selector = proxies.find(
+            (proxy) => proxy.code === `${section['.name']}-out`,
+          );
+          const fallbackUrltest = proxies.find(
+            (proxy) => proxy.code === `${section['.name']}-urltest-out`,
+          );
+          const selectorOutbounds = (selector?.value?.all ?? []).flatMap(
+            (code) => {
+              const item = proxies.find((proxy) => proxy.code === code);
+              if (!item) {
+                return [];
+              }
+
+              const isLegacyFastest =
+                item.code === `${section['.name']}-urltest-out`;
+
+              return [
+                {
+                  code: item.code,
+                  displayName: isLegacyFastest
+                    ? _('Fastest')
+                    : item?.value?.name || '',
+                  latency: item?.value?.history?.[0]?.delay || 0,
+                  type: item?.value?.type || '',
+                  selected: selector?.value?.now === item.code,
+                },
+              ];
+            },
+          );
+
+          const outbounds = [
+            ...selectorOutbounds.filter(
+              (item) => item.type?.toLowerCase() === 'urltest',
+            ),
+            ...selectorOutbounds.filter(
+              (item) => item.type?.toLowerCase() !== 'urltest',
+            ),
+          ];
+
+          if (outbounds.length === 0 && fallbackUrltest) {
+            const fallbackOutbounds = (fallbackUrltest?.value?.all ?? [])
+              .map((code) => proxies.find((item) => item.code === code))
+              .map((item) => ({
+                code: item?.code || '',
+                displayName: item?.value?.name || '',
+                latency: item?.value?.history?.[0]?.delay || 0,
+                type: item?.value?.type || '',
+                selected: selector?.value?.now === item?.code,
+              }));
+
+            return {
+              withTagSelect: true,
+              code: selector?.code || section['.name'],
+              displayName: section['.name'],
+              outbounds: [
+                {
+                  code: fallbackUrltest?.code || '',
+                  displayName: _('Fastest'),
+                  latency: fallbackUrltest?.value?.history?.[0]?.delay || 0,
+                  type: fallbackUrltest?.value?.type || '',
+                  selected: selector?.value?.now === fallbackUrltest?.code,
+                },
+                ...fallbackOutbounds,
+              ],
+            };
+          }
+
+          return {
+            withTagSelect: true,
+            code: selector?.code || section['.name'],
+            displayName: section['.name'],
+            outbounds,
+          };
+        }
       }
 
       if (section.connection_type === 'vpn') {
diff --git a/fe-app-podkop/src/podkop/methods/custom/index.ts b/fe-app-netshift/src/netshift/methods/custom/index.ts
similarity index 86%
rename from fe-app-podkop/src/podkop/methods/custom/index.ts
rename to fe-app-netshift/src/netshift/methods/custom/index.ts
index 8aba225c..13a8f0d3 100644
--- a/fe-app-podkop/src/podkop/methods/custom/index.ts
+++ b/fe-app-netshift/src/netshift/methods/custom/index.ts
@@ -2,7 +2,7 @@ import { getConfigSections } from './getConfigSections';
 import { getDashboardSections } from './getDashboardSections';
 import { getClashApiSecret } from './getClashApiSecret';
 
-export const CustomPodkopMethods = {
+export const CustomNetShiftMethods = {
   getConfigSections,
   getDashboardSections,
   getClashApiSecret,
diff --git a/fe-app-podkop/src/podkop/methods/fakeip/getFakeIpCheck.ts b/fe-app-netshift/src/netshift/methods/fakeip/getFakeIpCheck.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/methods/fakeip/getFakeIpCheck.ts
rename to fe-app-netshift/src/netshift/methods/fakeip/getFakeIpCheck.ts
diff --git a/fe-app-podkop/src/podkop/methods/fakeip/getIpCheck.ts b/fe-app-netshift/src/netshift/methods/fakeip/getIpCheck.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/methods/fakeip/getIpCheck.ts
rename to fe-app-netshift/src/netshift/methods/fakeip/getIpCheck.ts
diff --git a/fe-app-podkop/src/podkop/methods/fakeip/index.ts b/fe-app-netshift/src/netshift/methods/fakeip/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/methods/fakeip/index.ts
rename to fe-app-netshift/src/netshift/methods/fakeip/index.ts
diff --git a/fe-app-podkop/src/podkop/methods/index.ts b/fe-app-netshift/src/netshift/methods/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/methods/index.ts
rename to fe-app-netshift/src/netshift/methods/index.ts
diff --git a/fe-app-podkop/src/podkop/methods/shell/callBaseMethod.ts b/fe-app-netshift/src/netshift/methods/shell/callBaseMethod.ts
similarity index 77%
rename from fe-app-podkop/src/podkop/methods/shell/callBaseMethod.ts
rename to fe-app-netshift/src/netshift/methods/shell/callBaseMethod.ts
index 519cd369..f278a3de 100644
--- a/fe-app-podkop/src/podkop/methods/shell/callBaseMethod.ts
+++ b/fe-app-netshift/src/netshift/methods/shell/callBaseMethod.ts
@@ -1,11 +1,11 @@
 import { executeShellCommand } from '../../../helpers';
-import { Podkop } from '../../types';
+import { NetShift } from '../../types';
 
 export async function callBaseMethod<T>(
-  method: Podkop.AvailableMethods,
+  method: NetShift.AvailableMethods,
   args: string[] = [],
-  command: string = '/usr/bin/podkop',
-): Promise<Podkop.MethodResponse<T>> {
+  command: string = '/usr/bin/netshift',
+): Promise<NetShift.MethodResponse<T>> {
   const response = await executeShellCommand({
     command,
     args: [method as string, ...args],
diff --git a/fe-app-netshift/src/netshift/methods/shell/index.ts b/fe-app-netshift/src/netshift/methods/shell/index.ts
new file mode 100644
index 00000000..2e0d02ce
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/index.ts
@@ -0,0 +1,332 @@
+import { callBaseMethod } from './callBaseMethod';
+import { ClashAPI, NetShift } from '../../types';
+import { executeShellCommand } from '../../../helpers';
+import {
+  ComponentActionStartResponse,
+  ComponentActionStatus,
+  SingBoxComponentActionResult,
+  parseComponentActionStatus,
+  pollSingBoxComponentAction,
+} from './pollSingBoxComponentAction';
+import { parseComponentCheckUpdate } from './parseComponentCheckUpdate';
+
+export const NetShiftShellMethods = {
+  checkDNSAvailable: async () =>
+    callBaseMethod<NetShift.DnsCheckResult>(
+      NetShift.AvailableMethods.CHECK_DNS_AVAILABLE,
+    ),
+  checkFakeIP: async () =>
+    callBaseMethod<NetShift.FakeIPCheckResult>(
+      NetShift.AvailableMethods.CHECK_FAKEIP,
+    ),
+  checkNftRules: async () =>
+    callBaseMethod<NetShift.NftRulesCheckResult>(
+      NetShift.AvailableMethods.CHECK_NFT_RULES,
+    ),
+  getStatus: async () =>
+    callBaseMethod<NetShift.GetStatus>(NetShift.AvailableMethods.GET_STATUS),
+  checkSingBox: async () =>
+    callBaseMethod<NetShift.SingBoxCheckResult>(
+      NetShift.AvailableMethods.CHECK_SING_BOX,
+    ),
+  getSingBoxStatus: async () =>
+    callBaseMethod<NetShift.GetSingBoxStatus>(
+      NetShift.AvailableMethods.GET_SING_BOX_STATUS,
+    ),
+  getClashApiProxies: async () =>
+    callBaseMethod<ClashAPI.Proxies>(NetShift.AvailableMethods.CLASH_API, [
+      NetShift.AvailableClashAPIMethods.GET_PROXIES,
+    ]),
+  getClashApiProxyLatency: async (tag: string) =>
+    callBaseMethod<NetShift.GetClashApiProxyLatency>(
+      NetShift.AvailableMethods.CLASH_API,
+      [NetShift.AvailableClashAPIMethods.GET_PROXY_LATENCY, tag, '5000'],
+    ),
+  getClashApiGroupLatency: async (tag: string) =>
+    callBaseMethod<NetShift.GetClashApiGroupLatency>(
+      NetShift.AvailableMethods.CLASH_API,
+      [NetShift.AvailableClashAPIMethods.GET_GROUP_LATENCY, tag, '10000'],
+    ),
+  setClashApiGroupProxy: async (group: string, proxy: string) =>
+    callBaseMethod<unknown>(NetShift.AvailableMethods.CLASH_API, [
+      NetShift.AvailableClashAPIMethods.SET_GROUP_PROXY,
+      group,
+      proxy,
+    ]),
+  restart: async () =>
+    callBaseMethod<unknown>(
+      NetShift.AvailableMethods.RESTART,
+      [],
+      '/etc/init.d/netshift',
+    ),
+  start: async () =>
+    callBaseMethod<unknown>(
+      NetShift.AvailableMethods.START,
+      [],
+      '/etc/init.d/netshift',
+    ),
+  stop: async () =>
+    callBaseMethod<unknown>(
+      NetShift.AvailableMethods.STOP,
+      [],
+      '/etc/init.d/netshift',
+    ),
+  enable: async () =>
+    callBaseMethod<unknown>(
+      NetShift.AvailableMethods.ENABLE,
+      [],
+      '/etc/init.d/netshift',
+    ),
+  disable: async () =>
+    callBaseMethod<unknown>(
+      NetShift.AvailableMethods.DISABLE,
+      [],
+      '/etc/init.d/netshift',
+    ),
+  globalCheck: async () =>
+    callBaseMethod<unknown>(NetShift.AvailableMethods.GLOBAL_CHECK),
+  showSingBoxConfig: async () =>
+    callBaseMethod<unknown>(NetShift.AvailableMethods.SHOW_SING_BOX_CONFIG),
+  checkLogs: async () =>
+    callBaseMethod<unknown>(NetShift.AvailableMethods.CHECK_LOGS),
+  getSystemInfo: async () =>
+    callBaseMethod<NetShift.GetSystemInfo>(
+      NetShift.AvailableMethods.GET_SYSTEM_INFO,
+    ),
+  subscriptionUpdate: async () =>
+    callBaseMethod<unknown>(NetShift.AvailableMethods.SUBSCRIPTION_UPDATE),
+  singBoxComponentAction: async (
+    action: 'install_extended' | 'install_stable' | 'check_update',
+  ): Promise<SingBoxComponentActionResult> => {
+    // `check_update` is a quick single call — not subject to the rpcd 30s wall —
+    // so keep it on the SYNCHRONOUS `component_action` path (unchanged shape).
+    if (action === 'check_update') {
+      const response = await executeShellCommand({
+        command: '/usr/bin/netshift',
+        args: ['component_action', 'sing_box', action],
+        timeout: 600000,
+      });
+
+      if (response.stdout) {
+        try {
+          const parsed = JSON.parse(
+            response.stdout,
+          ) as SingBoxComponentActionResult;
+
+          return {
+            success: Boolean(parsed.success),
+            version: parsed.version,
+            message: parsed.message,
+          };
+        } catch (_e) {
+          return {
+            success: false,
+            message: response.stdout,
+          };
+        }
+      }
+
+      return {
+        success: false,
+        message: response.stderr || '',
+      };
+    }
+
+    // Install actions can take minutes — drive the async backend contract:
+    // start the job, then poll `component_action_status` with short execs so
+    // rpcd never kills a single long-running call.
+    const startResponse = await executeShellCommand({
+      command: '/usr/bin/netshift',
+      args: ['component_action_async', 'sing_box', action],
+    });
+
+    let start: ComponentActionStartResponse | null = null;
+
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout,
+        ) as ComponentActionStartResponse;
+      } catch (_e) {
+        start = null;
+      }
+    }
+
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message:
+          start?.message || startResponse.stderr || _('Core switch failed'),
+      };
+    }
+
+    const jobId = start.job_id;
+
+    return pollSingBoxComponentAction(async () => {
+      const statusResponse = await executeShellCommand({
+        command: '/usr/bin/netshift',
+        args: ['component_action_status', jobId],
+      });
+
+      if (!statusResponse.stdout) {
+        return null;
+      }
+
+      return parseComponentActionStatus(statusResponse.stdout);
+    });
+  },
+  // Sing-box update checks (sync) — STABLE task-017 contract:
+  //   component_action sing_box check_update        (extended)
+  //   component_action sing_box check_update_stable (stock)
+  // → {success, current_version, latest_version, status}.
+  singBoxCheckUpdate: async (
+    action: 'check_update' | 'check_update_stable',
+  ): Promise<NetShift.ComponentCheckUpdateResult> => {
+    const response = await executeShellCommand({
+      command: '/usr/bin/netshift',
+      args: ['component_action', 'sing_box', action],
+      timeout: 600000,
+    });
+
+    if (response.stdout) {
+      return parseComponentCheckUpdate(response.stdout);
+    }
+
+    return {
+      success: false,
+      message: response.stderr || '',
+    };
+  },
+  // NetShift update check (sync) — task-029/030 contract:
+  //   component_action netshift check_update
+  // → {success, current_version, latest_version, status}. Same shape as the
+  // sing-box cores (parsed by parseComponentCheckUpdate). The status is already
+  // v-normalized server-side, so the caller TRUSTS result.status (no string
+  // compare in TS). Stays on the SYNC component_action path (fast call).
+  netshiftCheckUpdate:
+    async (): Promise<NetShift.ComponentCheckUpdateResult> => {
+      const response = await executeShellCommand({
+        command: '/usr/bin/netshift',
+        args: ['component_action', 'netshift', 'check_update'],
+        timeout: 600000,
+      });
+
+      if (response.stdout) {
+        return parseComponentCheckUpdate(response.stdout);
+      }
+
+      return {
+        success: false,
+        message: response.stderr || '',
+      };
+    },
+  // Clear subscription cache (async) — task-039/040 contract:
+  // component_action_async subscription clear_cache + component_action_status
+  // <job>. Deletes all subscription caches then re-downloads, which restarts
+  // the service and can exceed the rpcd ~30s wall — so it MUST run through the
+  // SAME async start+poll mechanism as the sing-box core switch (reusing the
+  // component-agnostic `pollSingBoxComponentAction`). The component/action
+  // strings are EXACTLY 'subscription'/'clear_cache' (match task-039's router).
+  clearSubscriptionCache: async (): Promise<SingBoxComponentActionResult> => {
+    const startResponse = await executeShellCommand({
+      command: '/usr/bin/netshift',
+      args: ['component_action_async', 'subscription', 'clear_cache'],
+    });
+
+    let start: ComponentActionStartResponse | null = null;
+
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout,
+        ) as ComponentActionStartResponse;
+      } catch (_e) {
+        start = null;
+      }
+    }
+
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message:
+          start?.message ||
+          startResponse.stderr ||
+          _('Failed to clear subscription cache'),
+      };
+    }
+
+    const jobId = start.job_id;
+
+    return pollSingBoxComponentAction(async () => {
+      const statusResponse = await executeShellCommand({
+        command: '/usr/bin/netshift',
+        args: ['component_action_status', jobId],
+      });
+
+      if (!statusResponse.stdout) {
+        return null;
+      }
+
+      return parseComponentActionStatus(statusResponse.stdout);
+    });
+  },
+  // NetShift self-update (async) — STABLE task-017 contract:
+  // component_action_async netshift self_update + component_action_status <job>.
+  // Reuses the component-agnostic poll. Because the package install swaps
+  // /usr/bin/netshift mid-job, status polls can transiently fail (rpcd / binary
+  // swap); once the job has STARTED we treat such failures leniently — keep
+  // polling (return a synthetic running status) instead of aborting hard, so a
+  // successful self-update is not misreported as a failure. The UI reloads the
+  // page on success.
+  netshiftSelfUpdate: async (): Promise<SingBoxComponentActionResult> => {
+    const startResponse = await executeShellCommand({
+      command: '/usr/bin/netshift',
+      args: ['component_action_async', 'netshift', 'self_update'],
+    });
+
+    let start: ComponentActionStartResponse | null = null;
+
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout,
+        ) as ComponentActionStartResponse;
+      } catch (_e) {
+        start = null;
+      }
+    }
+
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message:
+          start?.message || startResponse.stderr || _('Self-update failed'),
+      };
+    }
+
+    const jobId = start.job_id;
+
+    return pollSingBoxComponentAction(async () => {
+      // Lenient mid-job polling: any exec/parse error AFTER a successful start
+      // is reported as "still running" so the binary swap doesn't end the loop
+      // prematurely. The MAX_POLLS backstop still bounds the loop.
+      try {
+        const statusResponse = await executeShellCommand({
+          command: '/usr/bin/netshift',
+          args: ['component_action_status', jobId],
+        });
+
+        if (!statusResponse.stdout) {
+          return { running: true } as ComponentActionStatus;
+        }
+
+        return (
+          parseComponentActionStatus(statusResponse.stdout) ??
+          ({ running: true } as ComponentActionStatus)
+        );
+      } catch (_e) {
+        return { running: true } as ComponentActionStatus;
+      }
+    });
+  },
+};
diff --git a/fe-app-netshift/src/netshift/methods/shell/parseComponentCheckUpdate.ts b/fe-app-netshift/src/netshift/methods/shell/parseComponentCheckUpdate.ts
new file mode 100644
index 00000000..b7489019
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/parseComponentCheckUpdate.ts
@@ -0,0 +1,58 @@
+import { NetShift } from '../../types';
+
+const VALID_STATUSES: NetShift.ComponentUpdateStatus[] = [
+  'latest',
+  'outdated',
+  'dev',
+  'not_installed',
+];
+
+function normalizeStatus(
+  status: unknown,
+): NetShift.ComponentUpdateStatus | undefined {
+  if (
+    typeof status === 'string' &&
+    (VALID_STATUSES as string[]).includes(status)
+  ) {
+    return status as NetShift.ComponentUpdateStatus;
+  }
+
+  return undefined;
+}
+
+/**
+ * Parse the STABLE JSON echoed by the sync update-check actions
+ * (`component_action sing_box check_update` /
+ * `component_action sing_box check_update_stable`):
+ * `{success, current_version, latest_version, status}`.
+ *
+ * Pure (types-only import) so it is unit-testable without dragging in the
+ * helpers barrel (which pulls TabService → MutationObserver and crashes the
+ * node test env at collect time).
+ */
+export function parseComponentCheckUpdate(
+  stdout: string,
+): NetShift.ComponentCheckUpdateResult {
+  try {
+    const parsed = JSON.parse(stdout) as Record<string, unknown>;
+
+    return {
+      success: Boolean(parsed.success),
+      current_version:
+        typeof parsed.current_version === 'string'
+          ? parsed.current_version
+          : undefined,
+      latest_version:
+        typeof parsed.latest_version === 'string'
+          ? parsed.latest_version
+          : undefined,
+      status: normalizeStatus(parsed.status),
+      message: typeof parsed.message === 'string' ? parsed.message : undefined,
+    };
+  } catch (_e) {
+    return {
+      success: false,
+      message: stdout,
+    };
+  }
+}
diff --git a/fe-app-netshift/src/netshift/methods/shell/pollSingBoxComponentAction.ts b/fe-app-netshift/src/netshift/methods/shell/pollSingBoxComponentAction.ts
new file mode 100644
index 00000000..d3cbc79a
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/pollSingBoxComponentAction.ts
@@ -0,0 +1,84 @@
+import { sleep } from './sleep';
+
+export interface SingBoxComponentActionResult {
+  success: boolean;
+  version?: string;
+  message?: string;
+}
+
+// Shape echoed by `component_action_async sing_box <action>` on start.
+export interface ComponentActionStartResponse {
+  success?: boolean;
+  job_id?: string;
+  message?: string;
+}
+
+// Shape echoed by `component_action_status <job_id>` (task-007/009 contract).
+export interface ComponentActionStatus {
+  success?: boolean;
+  running?: boolean;
+  component?: string;
+  action?: string;
+  message?: string;
+  pid?: number | null;
+  started_at?: number;
+  updated_at?: number;
+  exit_code?: number | null;
+  version?: string;
+  latest_version?: string;
+}
+
+// ~2s between polls; ~150 polls ≈ 5 min backstop against a wedged job.
+export const POLL_INTERVAL_MS = 2000;
+export const MAX_POLLS = 150;
+
+export function parseComponentActionStatus(
+  stdout: string,
+): ComponentActionStatus | null {
+  try {
+    return JSON.parse(stdout) as ComponentActionStatus;
+  } catch (_e) {
+    return null;
+  }
+}
+
+/**
+ * Pure poll loop for the async core switch. Each `fetchStatus` call is a tiny,
+ * individual `component_action_status` exec (well under the rpcd 30s wall); the
+ * loop runs until the job is no longer running (a parse failure or
+ * `running === false` is terminal). `sleepFn` is injected so tests can avoid
+ * real 2s waits.
+ */
+export async function pollSingBoxComponentAction(
+  fetchStatus: () => Promise<ComponentActionStatus | null>,
+  sleepFn: (ms: number) => Promise<void> = sleep,
+  intervalMs: number = POLL_INTERVAL_MS,
+  maxPolls: number = MAX_POLLS,
+): Promise<SingBoxComponentActionResult> {
+  for (let poll = 0; poll < maxPolls; poll += 1) {
+    const status = await fetchStatus();
+
+    // A parse failure (null) is terminal — we cannot keep polling blindly.
+    if (!status) {
+      return {
+        success: false,
+        message: _('Core switch failed'),
+      };
+    }
+
+    if (status.running !== true) {
+      return {
+        success: Boolean(status.success),
+        version: status.version,
+        message: status.message,
+      };
+    }
+
+    await sleepFn(intervalMs);
+  }
+
+  return {
+    success: false,
+    message: _('Core switch timed out'),
+  };
+}
diff --git a/fe-app-netshift/src/netshift/methods/shell/sleep.ts b/fe-app-netshift/src/netshift/methods/shell/sleep.ts
new file mode 100644
index 00000000..421bda08
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/sleep.ts
@@ -0,0 +1,3 @@
+export function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
diff --git a/fe-app-netshift/src/netshift/methods/shell/tests/parseComponentCheckUpdate.test.js b/fe-app-netshift/src/netshift/methods/shell/tests/parseComponentCheckUpdate.test.js
new file mode 100644
index 00000000..b82f904c
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/tests/parseComponentCheckUpdate.test.js
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import { parseComponentCheckUpdate } from '../parseComponentCheckUpdate';
+
+describe('parseComponentCheckUpdate', () => {
+  it('parses the STABLE check-update JSON', () => {
+    const result = parseComponentCheckUpdate(
+      JSON.stringify({
+        success: true,
+        current_version: '1.12.0',
+        latest_version: '1.12.9',
+        status: 'outdated',
+      }),
+    );
+
+    expect(result).toEqual({
+      success: true,
+      current_version: '1.12.0',
+      latest_version: '1.12.9',
+      status: 'outdated',
+      message: undefined,
+    });
+  });
+
+  it.each(['latest', 'outdated', 'dev', 'not_installed'])(
+    'accepts the valid status %s',
+    (status) => {
+      const result = parseComponentCheckUpdate(
+        JSON.stringify({ success: true, status }),
+      );
+
+      expect(result.status).toBe(status);
+    },
+  );
+
+  it('drops an unknown status to undefined', () => {
+    const result = parseComponentCheckUpdate(
+      JSON.stringify({ success: true, status: 'weird' }),
+    );
+
+    expect(result.status).toBeUndefined();
+  });
+
+  it('returns success:false with the raw stdout on invalid JSON', () => {
+    const result = parseComponentCheckUpdate('not json');
+
+    expect(result).toEqual({ success: false, message: 'not json' });
+  });
+
+  it('coerces a missing success to false', () => {
+    const result = parseComponentCheckUpdate(JSON.stringify({}));
+
+    expect(result.success).toBe(false);
+  });
+});
diff --git a/fe-app-netshift/src/netshift/methods/shell/tests/pollSingBoxComponentAction.test.js b/fe-app-netshift/src/netshift/methods/shell/tests/pollSingBoxComponentAction.test.js
new file mode 100644
index 00000000..bf7e097c
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/tests/pollSingBoxComponentAction.test.js
@@ -0,0 +1,106 @@
+import { describe, expect, it, vi } from 'vitest';
+import { pollSingBoxComponentAction } from '../pollSingBoxComponentAction';
+
+// No-op sleep so polls resolve instantly (no real 2s waits in tests).
+const noSleep = () => Promise.resolve();
+
+// Build a fetchStatus callback that returns the queued statuses in order,
+// then keeps returning the last one.
+function makeFetchStatus(statuses) {
+  let index = 0;
+
+  return vi.fn(async () => {
+    const status = statuses[Math.min(index, statuses.length - 1)];
+    index += 1;
+
+    return status;
+  });
+}
+
+describe('pollSingBoxComponentAction', () => {
+  it('resolves success with version after N running polls then terminal', async () => {
+    const fetchStatus = makeFetchStatus([
+      { running: true, success: true, exit_code: null },
+      { running: true, success: true, exit_code: null },
+      {
+        running: false,
+        success: true,
+        version: '1.12.4',
+        message: 'Core switched',
+        exit_code: 0,
+      },
+    ]);
+
+    const result = await pollSingBoxComponentAction(fetchStatus, noSleep);
+
+    expect(result).toEqual({
+      success: true,
+      version: '1.12.4',
+      message: 'Core switched',
+    });
+    // 3 status reads (2 running + 1 terminal).
+    expect(fetchStatus).toHaveBeenCalledTimes(3);
+  });
+
+  it('surfaces the failure message on terminal success:false', async () => {
+    const fetchStatus = makeFetchStatus([
+      { running: true, success: true },
+      {
+        running: false,
+        success: false,
+        message: 'core switch aborted (existing sing-box left intact)',
+        exit_code: 1,
+      },
+    ]);
+
+    const result = await pollSingBoxComponentAction(fetchStatus, noSleep);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toBe(
+      'core switch aborted (existing sing-box left intact)',
+    );
+  });
+
+  it('treats a parse failure (null status) as terminal failure', async () => {
+    const fetchStatus = makeFetchStatus([
+      { running: true, success: true },
+      null,
+    ]);
+
+    const result = await pollSingBoxComponentAction(fetchStatus, noSleep);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toBe('Core switch failed');
+  });
+
+  it('returns timeout when the safety cap is exceeded', async () => {
+    // Always running → never terminal.
+    const fetchStatus = vi.fn(async () => ({ running: true, success: true }));
+
+    const result = await pollSingBoxComponentAction(fetchStatus, noSleep, 0, 5);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toBe('Core switch timed out');
+    expect(fetchStatus).toHaveBeenCalledTimes(5);
+  });
+
+  it('returns immediately on a terminal-first status', async () => {
+    const fetchStatus = makeFetchStatus([
+      {
+        running: false,
+        success: true,
+        version: '1.13.0',
+        message: 'done',
+      },
+    ]);
+
+    const result = await pollSingBoxComponentAction(fetchStatus, noSleep);
+
+    expect(result).toEqual({
+      success: true,
+      version: '1.13.0',
+      message: 'done',
+    });
+    expect(fetchStatus).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/fe-app-netshift/src/netshift/methods/shell/tests/singBoxComponentAction.test.js b/fe-app-netshift/src/netshift/methods/shell/tests/singBoxComponentAction.test.js
new file mode 100644
index 00000000..ab6f448c
--- /dev/null
+++ b/fe-app-netshift/src/netshift/methods/shell/tests/singBoxComponentAction.test.js
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+// `methods/shell/index.ts` (and its `callBaseMethod` import) pull in the
+// `../../../helpers` barrel, which transitively loads `withTimeout` →
+// `../netshift` → `TabService`, whose constructor calls `new MutationObserver`
+// at module-init time. In the node test env that throws
+// "MutationObserver is not defined" at COLLECT time. Mocking the helpers barrel
+// here short-circuits that chain so we can import and exercise the REAL
+// `singBoxComponentAction` method while controlling its `executeShellCommand`.
+const executeShellCommand = vi.fn();
+
+vi.mock('../../../../helpers', () => ({
+  executeShellCommand: (...args) => executeShellCommand(...args),
+}));
+
+// Avoid pulling the real `callBaseMethod` (also imports the helpers barrel and
+// the LuCI types); the start-failure path under test never reaches it.
+vi.mock('../../callBaseMethod', () => ({
+  callBaseMethod: vi.fn(),
+}));
+
+const { NetShiftShellMethods } = await import('../index');
+
+afterEach(() => {
+  executeShellCommand.mockReset();
+});
+
+describe('singBoxComponentAction (start-failure path)', () => {
+  it('fails fast on start success:false WITHOUT entering the poll loop', async () => {
+    executeShellCommand.mockResolvedValueOnce({
+      stdout: JSON.stringify({
+        success: false,
+        message: 'binary updater is busy',
+      }),
+      stderr: '',
+    });
+
+    const result =
+      await NetShiftShellMethods.singBoxComponentAction('install_extended');
+
+    expect(result).toEqual({
+      success: false,
+      message: 'binary updater is busy',
+    });
+    // Only the async-start call ran; no `component_action_status` polls.
+    expect(executeShellCommand).toHaveBeenCalledTimes(1);
+    expect(executeShellCommand).toHaveBeenCalledWith({
+      command: '/usr/bin/netshift',
+      args: ['component_action_async', 'sing_box', 'install_extended'],
+    });
+  });
+
+  it('fails fast when the start response has no job_id', async () => {
+    executeShellCommand.mockResolvedValueOnce({
+      stdout: JSON.stringify({ success: true }),
+      stderr: '',
+    });
+
+    const result =
+      await NetShiftShellMethods.singBoxComponentAction('install_stable');
+
+    expect(result.success).toBe(false);
+    expect(executeShellCommand).toHaveBeenCalledTimes(1);
+  });
+
+  it('surfaces stderr / generic message when start output is unparseable', async () => {
+    executeShellCommand.mockResolvedValueOnce({
+      stdout: 'not json',
+      stderr: 'boom',
+    });
+
+    const result =
+      await NetShiftShellMethods.singBoxComponentAction('install_extended');
+
+    expect(result.success).toBe(false);
+    expect(result.message).toBe('boom');
+    expect(executeShellCommand).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/fe-app-podkop/src/podkop/services/core.service.ts b/fe-app-netshift/src/netshift/services/core.service.ts
similarity index 71%
rename from fe-app-podkop/src/podkop/services/core.service.ts
rename to fe-app-netshift/src/netshift/services/core.service.ts
index 79b63dbb..e401565c 100644
--- a/fe-app-podkop/src/podkop/services/core.service.ts
+++ b/fe-app-netshift/src/netshift/services/core.service.ts
@@ -1,8 +1,8 @@
 import { TabServiceInstance } from './tab.service';
 import { store } from './store.service';
 import { logger } from './logger.service';
-import { PodkopLogWatcher } from './podkopLogWatcher.service';
-import { PodkopShellMethods } from '../methods';
+import { NetShiftLogWatcher } from './netshiftLogWatcher.service';
+import { NetShiftShellMethods } from '../methods';
 
 export function coreService() {
   TabServiceInstance.onChange((activeId, tabs) => {
@@ -15,11 +15,11 @@ export function coreService() {
     });
   });
 
-  const watcher = PodkopLogWatcher.getInstance();
+  const watcher = NetShiftLogWatcher.getInstance();
 
   watcher.init(
     async () => {
-      const logs = await PodkopShellMethods.checkLogs();
+      const logs = await NetShiftShellMethods.checkLogs();
 
       if (logs.success) {
         return logs.data as string;
@@ -34,7 +34,7 @@ export function coreService() {
           line.toLowerCase().includes('[error]') ||
           line.toLowerCase().includes('[fatal]')
         ) {
-          ui.addNotification('Podkop Error', E('div', {}, line), 'error');
+          ui.addNotification('NetShift Error', E('div', {}, line), 'error');
         }
       },
     },
diff --git a/fe-app-podkop/src/podkop/services/index.ts b/fe-app-netshift/src/netshift/services/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/services/index.ts
rename to fe-app-netshift/src/netshift/services/index.ts
diff --git a/fe-app-podkop/src/podkop/services/logger.service.ts b/fe-app-netshift/src/netshift/services/logger.service.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/services/logger.service.ts
rename to fe-app-netshift/src/netshift/services/logger.service.ts
diff --git a/fe-app-podkop/src/podkop/services/podkopLogWatcher.service.ts b/fe-app-netshift/src/netshift/services/netshiftLogWatcher.service.ts
similarity index 68%
rename from fe-app-podkop/src/podkop/services/podkopLogWatcher.service.ts
rename to fe-app-netshift/src/netshift/services/netshiftLogWatcher.service.ts
index e09b288e..560af7cc 100644
--- a/fe-app-podkop/src/podkop/services/podkopLogWatcher.service.ts
+++ b/fe-app-netshift/src/netshift/services/netshiftLogWatcher.service.ts
@@ -2,13 +2,13 @@ import { logger } from './logger.service';
 
 export type LogFetcher = () => Promise<string> | string;
 
-export interface PodkopLogWatcherOptions {
+export interface NetShiftLogWatcherOptions {
   intervalMs?: number;
   onNewLog?: (line: string) => void;
 }
 
-export class PodkopLogWatcher {
-  private static instance: PodkopLogWatcher;
+export class NetShiftLogWatcher {
+  private static instance: NetShiftLogWatcher;
   private fetcher?: LogFetcher;
   private onNewLog?: (line: string) => void;
   private intervalMs = 5000;
@@ -26,31 +26,31 @@ export class PodkopLogWatcher {
     }
   }
 
-  static getInstance(): PodkopLogWatcher {
-    if (!PodkopLogWatcher.instance) {
-      PodkopLogWatcher.instance = new PodkopLogWatcher();
+  static getInstance(): NetShiftLogWatcher {
+    if (!NetShiftLogWatcher.instance) {
+      NetShiftLogWatcher.instance = new NetShiftLogWatcher();
     }
-    return PodkopLogWatcher.instance;
+    return NetShiftLogWatcher.instance;
   }
 
-  init(fetcher: LogFetcher, options?: PodkopLogWatcherOptions): void {
+  init(fetcher: LogFetcher, options?: NetShiftLogWatcherOptions): void {
     this.fetcher = fetcher;
     this.onNewLog = options?.onNewLog;
     this.intervalMs = options?.intervalMs ?? 5000;
     logger.info(
-      '[PodkopLogWatcher]',
+      '[NetShiftLogWatcher]',
       `initialized (interval: ${this.intervalMs}ms)`,
     );
   }
 
   async checkOnce(): Promise<void> {
     if (!this.fetcher) {
-      logger.warn('[PodkopLogWatcher]', 'fetcher not found');
+      logger.warn('[NetShiftLogWatcher]', 'fetcher not found');
       return;
     }
 
     if (this.paused) {
-      logger.debug('[PodkopLogWatcher]', 'skipped check — tab not visible');
+      logger.debug('[NetShiftLogWatcher]', 'skipped check — tab not visible');
       return;
     }
 
@@ -70,21 +70,21 @@ export class PodkopLogWatcher {
         this.lastLines = new Set(arr.slice(-500));
       }
     } catch (err) {
-      logger.error('[PodkopLogWatcher]', 'failed to read logs:', err);
+      logger.error('[NetShiftLogWatcher]', 'failed to read logs:', err);
     }
   }
 
   start(): void {
     if (this.running) return;
     if (!this.fetcher) {
-      logger.warn('[PodkopLogWatcher]', 'attempted to start without fetcher');
+      logger.warn('[NetShiftLogWatcher]', 'attempted to start without fetcher');
       return;
     }
 
     this.running = true;
     this.timer = setInterval(() => this.checkOnce(), this.intervalMs);
     logger.info(
-      '[PodkopLogWatcher]',
+      '[NetShiftLogWatcher]',
       `started (interval: ${this.intervalMs}ms)`,
     );
   }
@@ -93,24 +93,24 @@ export class PodkopLogWatcher {
     if (!this.running) return;
     this.running = false;
     if (this.timer) clearInterval(this.timer);
-    logger.info('[PodkopLogWatcher]', 'stopped');
+    logger.info('[NetShiftLogWatcher]', 'stopped');
   }
 
   pause(): void {
     if (!this.running || this.paused) return;
     this.paused = true;
-    logger.info('[PodkopLogWatcher]', 'paused (tab not visible)');
+    logger.info('[NetShiftLogWatcher]', 'paused (tab not visible)');
   }
 
   resume(): void {
     if (!this.running || !this.paused) return;
     this.paused = false;
-    logger.info('[PodkopLogWatcher]', 'resumed (tab active)');
+    logger.info('[NetShiftLogWatcher]', 'resumed (tab active)');
     this.checkOnce(); // сразу проверить, не появились ли новые логи
   }
 
   reset(): void {
     this.lastLines.clear();
-    logger.info('[PodkopLogWatcher]', 'log history reset');
+    logger.info('[NetShiftLogWatcher]', 'log history reset');
   }
 }
diff --git a/fe-app-podkop/src/podkop/services/socket.service.ts b/fe-app-netshift/src/netshift/services/socket.service.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/services/socket.service.ts
rename to fe-app-netshift/src/netshift/services/socket.service.ts
diff --git a/fe-app-podkop/src/podkop/services/store.service.ts b/fe-app-netshift/src/netshift/services/store.service.ts
similarity index 82%
rename from fe-app-podkop/src/podkop/services/store.service.ts
rename to fe-app-netshift/src/netshift/services/store.service.ts
index 4069240c..47aa65f4 100644
--- a/fe-app-podkop/src/podkop/services/store.service.ts
+++ b/fe-app-netshift/src/netshift/services/store.service.ts
@@ -1,5 +1,11 @@
-import { Podkop } from '../types';
+import { NetShift } from '../types';
 import { initialDiagnosticStore } from '../tabs/diagnostic/diagnostic.store';
+import { initialManagerStore } from '../tabs/manager/manager.store';
+import type { ManagerComponentKey } from '../tabs/manager/cards';
+
+// Single source of truth for the component key union lives in `tabs/manager/cards`;
+// re-export it here so store consumers keep their existing import path.
+export type { ManagerComponentKey };
 
 function jsonStableStringify<T, V>(obj: T): string {
   return JSON.stringify(obj, (_, value) => {
@@ -159,12 +165,12 @@ export interface StoreType {
   servicesInfoWidget: {
     loading: boolean;
     failed: boolean;
-    data: { singbox: number; podkop: number };
+    data: { singbox: number; netshift: number };
   };
   sectionsWidget: {
     loading: boolean;
     failed: boolean;
-    data: Podkop.OutboundGroup[];
+    data: NetShift.OutboundGroup[];
     latencyFetching: boolean;
   };
   diagnosticsRunAction: {
@@ -180,16 +186,33 @@ export interface StoreType {
     globalCheck: { loading: boolean };
     viewLogs: { loading: boolean };
     showSingBoxConfig: { loading: boolean };
+    clearSubscriptionCache: { loading: boolean };
   };
   diagnosticsSystemInfo: {
     loading: boolean;
-    podkop_version: string;
-    podkop_latest_version: string;
+    netshift_version: string;
+    netshift_latest_version: string;
     luci_app_version: string;
     sing_box_version: string;
     openwrt_version: string;
     device_model: string;
+    sing_box_extended: 0 | 1;
+  };
+  managerActions: {
+    netshiftCheck: { loading: boolean };
+    netshiftUpdate: { loading: boolean };
+    singBoxStockCheck: { loading: boolean };
+    singBoxStockAction: { loading: boolean };
+    singBoxExtendedCheck: { loading: boolean };
+    singBoxExtendedAction: { loading: boolean };
   };
+  managerChecks: Record<
+    ManagerComponentKey,
+    {
+      status: NetShift.ComponentUpdateStatus | null;
+      latest_version: string;
+    }
+  >;
 }
 
 const initialStore: StoreType = {
@@ -215,7 +238,7 @@ const initialStore: StoreType = {
   servicesInfoWidget: {
     loading: true,
     failed: false,
-    data: { singbox: 0, podkop: 0 },
+    data: { singbox: 0, netshift: 0 },
   },
   sectionsWidget: {
     loading: true,
@@ -224,6 +247,7 @@ const initialStore: StoreType = {
     data: [],
   },
   ...initialDiagnosticStore,
+  ...initialManagerStore,
 };
 
 export const store = new StoreService<StoreType>(initialStore);
diff --git a/fe-app-podkop/src/podkop/services/tab.service.ts b/fe-app-netshift/src/netshift/services/tab.service.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/services/tab.service.ts
rename to fe-app-netshift/src/netshift/services/tab.service.ts
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/index.ts b/fe-app-netshift/src/netshift/tabs/dashboard/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/dashboard/index.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/index.ts
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/initController.ts b/fe-app-netshift/src/netshift/tabs/dashboard/initController.ts
similarity index 95%
rename from fe-app-podkop/src/podkop/tabs/dashboard/initController.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/initController.ts
index 2b8c9487..f30c414d 100644
--- a/fe-app-podkop/src/podkop/tabs/dashboard/initController.ts
+++ b/fe-app-netshift/src/netshift/tabs/dashboard/initController.ts
@@ -4,7 +4,7 @@ import {
   preserveScrollForPage,
 } from '../../../helpers';
 import { prettyBytes } from '../../../helpers/prettyBytes';
-import { CustomPodkopMethods, PodkopShellMethods } from '../../methods';
+import { CustomNetShiftMethods, NetShiftShellMethods } from '../../methods';
 import { logger, socket, store, StoreType } from '../../services';
 import { renderSections, renderWidget } from './partials';
 import { fetchServicesInfo } from '../../fetchers';
@@ -22,7 +22,7 @@ async function fetchDashboardSections() {
     },
   });
 
-  const { data, success } = await CustomPodkopMethods.getDashboardSections();
+  const { data, success } = await CustomNetShiftMethods.getDashboardSections();
 
   if (!success) {
     logger.error('[DASHBOARD]', 'fetchDashboardSections: failed to fetch');
@@ -122,7 +122,7 @@ async function connectToClashSockets() {
 // Handlers
 
 async function handleChooseOutbound(selector: string, tag: string) {
-  await PodkopShellMethods.setClashApiGroupProxy(selector, tag);
+  await NetShiftShellMethods.setClashApiGroupProxy(selector, tag);
   await fetchDashboardSections();
 }
 
@@ -134,7 +134,7 @@ async function handleTestGroupLatency(tag: string) {
     },
   });
 
-  await PodkopShellMethods.getClashApiGroupLatency(tag);
+  await NetShiftShellMethods.getClashApiGroupLatency(tag);
   await fetchDashboardSections();
 
   store.set({
@@ -153,7 +153,7 @@ async function handleTestProxyLatency(tag: string) {
     },
   });
 
-  await PodkopShellMethods.getClashApiProxyLatency(tag);
+  await NetShiftShellMethods.getClashApiProxyLatency(tag);
   await fetchDashboardSections();
 
   store.set({
@@ -340,12 +340,12 @@ async function renderServicesInfoWidget() {
     title: _('Services info'),
     items: [
       {
-        key: _('Podkop'),
-        value: servicesInfoWidget.data.podkop
+        key: _('NetShift'),
+        value: servicesInfoWidget.data.netshift
           ? _('✔ Enabled')
           : _('✘ Disabled'),
         attributes: {
-          class: servicesInfoWidget.data.podkop
+          class: servicesInfoWidget.data.netshift
             ? 'pdk_dashboard-page__widgets-section__item__row--success'
             : 'pdk_dashboard-page__widgets-section__item__row--error',
         },
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/partials/index.ts b/fe-app-netshift/src/netshift/tabs/dashboard/partials/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/dashboard/partials/index.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/partials/index.ts
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/partials/renderSections.ts b/fe-app-netshift/src/netshift/tabs/dashboard/partials/renderSections.ts
similarity index 76%
rename from fe-app-podkop/src/podkop/tabs/dashboard/partials/renderSections.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/partials/renderSections.ts
index bf78e7e6..f204ee68 100644
--- a/fe-app-podkop/src/podkop/tabs/dashboard/partials/renderSections.ts
+++ b/fe-app-netshift/src/netshift/tabs/dashboard/partials/renderSections.ts
@@ -1,9 +1,10 @@
-import { Podkop } from '../../../types';
+import { renderButton } from '../../../../partials';
+import { NetShift } from '../../../types';
 
 interface IRenderSectionsProps {
   loading: boolean;
   failed: boolean;
-  section: Podkop.OutboundGroup;
+  section: NetShift.OutboundGroup;
   onTestLatency: (tag: string) => void;
   onChooseOutbound: (selector: string, tag: string) => void;
   latencyFetching: boolean;
@@ -13,7 +14,7 @@ function renderFailedState() {
   return E(
     'div',
     {
-      class: 'pdk_dashboard-page__outbound-section centered',
+      class: 'card pdk_dashboard-page__outbound-section centered',
       style: 'height: 127px',
     },
     E('span', {}, [E('span', {}, _('Dashboard currently unavailable'))]),
@@ -23,7 +24,7 @@ function renderFailedState() {
 function renderLoadingState() {
   return E('div', {
     id: 'dashboard-sections-grid-skeleton',
-    class: 'pdk_dashboard-page__outbound-section skeleton',
+    class: 'card pdk_dashboard-page__outbound-section skeleton',
     style: 'height: 127px',
   });
 }
@@ -44,7 +45,7 @@ export function renderDefaultState({
     }
   }
 
-  function renderOutbound(outbound: Podkop.Outbound) {
+  function renderOutbound(outbound: NetShift.Outbound) {
     function getLatencyClass() {
       if (!outbound.latency) {
         return 'pdk_dashboard-page__outbound-grid__item__latency--empty';
@@ -64,7 +65,7 @@ export function renderDefaultState({
     return E(
       'div',
       {
-        class: `pdk_dashboard-page__outbound-grid__item ${outbound.selected ? 'pdk_dashboard-page__outbound-grid__item--active' : ''} ${section.withTagSelect ? 'pdk_dashboard-page__outbound-grid__item--selectable' : ''}`,
+        class: `card pdk_dashboard-page__outbound-grid__item ${outbound.selected ? 'pdk_dashboard-page__outbound-grid__item--active' : ''} ${section.withTagSelect ? 'pdk_dashboard-page__outbound-grid__item--selectable' : ''}`,
         click: () =>
           section.withTagSelect &&
           onChooseOutbound(section.code, outbound.code),
@@ -87,7 +88,7 @@ export function renderDefaultState({
     );
   }
 
-  return E('div', { class: 'pdk_dashboard-page__outbound-section' }, [
+  return E('div', { class: 'card pdk_dashboard-page__outbound-section' }, [
     // Title with test latency
     E('div', { class: 'pdk_dashboard-page__outbound-section__title-section' }, [
       E(
@@ -99,14 +100,11 @@ export function renderDefaultState({
       ),
       latencyFetching
         ? E('div', { class: 'skeleton', style: 'width: 99px; height: 28px' })
-        : E(
-            'button',
-            {
-              class: 'btn dashboard-sections-grid-item-test-latency',
-              click: () => testLatency(),
-            },
-            _('Test latency'),
-          ),
+        : renderButton({
+            text: _('Test latency'),
+            onClick: () => testLatency(),
+            classNames: ['dashboard-sections-grid-item-test-latency'],
+          }),
     ]),
     E(
       'div',
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/partials/renderWidget.ts b/fe-app-netshift/src/netshift/tabs/dashboard/partials/renderWidget.ts
similarity index 86%
rename from fe-app-podkop/src/podkop/tabs/dashboard/partials/renderWidget.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/partials/renderWidget.ts
index 25216c09..36e26ba5 100644
--- a/fe-app-podkop/src/podkop/tabs/dashboard/partials/renderWidget.ts
+++ b/fe-app-netshift/src/netshift/tabs/dashboard/partials/renderWidget.ts
@@ -17,7 +17,7 @@ function renderFailedState() {
     {
       id: '',
       style: 'height: 78px',
-      class: 'pdk_dashboard-page__widgets-section__item centered',
+      class: 'card pdk_dashboard-page__widgets-section__item centered',
     },
     _('Currently unavailable'),
   );
@@ -29,14 +29,14 @@ function renderLoadingState() {
     {
       id: '',
       style: 'height: 78px',
-      class: 'pdk_dashboard-page__widgets-section__item skeleton',
+      class: 'card pdk_dashboard-page__widgets-section__item skeleton',
     },
     '',
   );
 }
 
 function renderDefaultState({ title, items }: IRenderWidgetProps) {
-  return E('div', { class: 'pdk_dashboard-page__widgets-section__item' }, [
+  return E('div', { class: 'card pdk_dashboard-page__widgets-section__item' }, [
     E(
       'b',
       { class: 'pdk_dashboard-page__widgets-section__item__title' },
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/render.ts b/fe-app-netshift/src/netshift/tabs/dashboard/render.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/dashboard/render.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/render.ts
diff --git a/fe-app-podkop/src/podkop/tabs/dashboard/styles.ts b/fe-app-netshift/src/netshift/tabs/dashboard/styles.ts
similarity index 86%
rename from fe-app-podkop/src/podkop/tabs/dashboard/styles.ts
rename to fe-app-netshift/src/netshift/tabs/dashboard/styles.ts
index 32066e5b..9fb09214 100644
--- a/fe-app-podkop/src/podkop/tabs/dashboard/styles.ts
+++ b/fe-app-netshift/src/netshift/tabs/dashboard/styles.ts
@@ -1,10 +1,10 @@
 // language=CSS
 export const styles = `
-#cbi-podkop-dashboard-_mount_node > div {
+#cbi-netshift-dashboard-_mount_node > div {
     width: 100%;
 }
 
-#cbi-podkop-dashboard > h3 {
+#cbi-netshift-dashboard > h3 {
     display: none;
 }
     
@@ -27,9 +27,6 @@ export const styles = `
 }
 
 .pdk_dashboard-page__widgets-section__item {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
 }
 
 .pdk_dashboard-page__widgets-section__item__title {}
@@ -50,9 +47,6 @@ export const styles = `
 
 .pdk_dashboard-page__outbound-section {
     margin-top: 10px;
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
 }
 
 .pdk_dashboard-page__outbound-section__title-section {
@@ -74,9 +68,6 @@ export const styles = `
 }
 
 .pdk_dashboard-page__outbound-grid__item {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
     transition: border 0.2s ease;
 }
 
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/contstants.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/contstants.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/contstants.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/contstants.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runDnsCheck.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runDnsCheck.ts
similarity index 82%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/runDnsCheck.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/runDnsCheck.ts
index 4a13b4ec..36abebce 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runDnsCheck.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runDnsCheck.ts
@@ -1,6 +1,6 @@
 import { insertIf } from '../../../../helpers';
 import { DIAGNOSTICS_CHECKS_MAP } from './contstants';
-import { PodkopShellMethods } from '../../../methods';
+import { NetShiftShellMethods } from '../../../methods';
 import { IDiagnosticsChecksItem } from '../../../services';
 import { updateCheckStore } from './updateCheckStore';
 import { getMeta } from '../helpers/getMeta';
@@ -17,7 +17,7 @@ export async function runDnsCheck() {
     items: [],
   });
 
-  const dnsChecks = await PodkopShellMethods.checkDNSAvailable();
+  const dnsChecks = await NetShiftShellMethods.checkDNSAvailable();
 
   if (!dnsChecks.success) {
     updateCheckStore({
@@ -72,6 +72,17 @@ export async function runDnsCheck() {
         key: _('Main DNS'),
         value: `${data.dns_server} [${data.dns_type}]`,
       },
+      ...insertIf<IDiagnosticsChecksItem>(
+        typeof data.dns_via_outbound_tag === 'string' &&
+          data.dns_via_outbound_tag.length > 0,
+        [
+          {
+            state: 'success',
+            key: _('Main DNS via outbound'),
+            value: data.dns_via_outbound_tag ?? '',
+          },
+        ],
+      ),
       {
         state: data.dns_on_router ? 'success' : 'error',
         key: _('DNS on router'),
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts
similarity index 93%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts
index ebfc7298..f77ff6f2 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts
@@ -1,6 +1,6 @@
 import { insertIf } from '../../../../helpers';
 import { DIAGNOSTICS_CHECKS_MAP } from './contstants';
-import { PodkopShellMethods, RemoteFakeIPMethods } from '../../../methods';
+import { NetShiftShellMethods, RemoteFakeIPMethods } from '../../../methods';
 import { IDiagnosticsChecksItem } from '../../../services';
 import { updateCheckStore } from './updateCheckStore';
 import { getMeta } from '../helpers/getMeta';
@@ -17,7 +17,7 @@ export async function runFakeIPCheck() {
     items: [],
   });
 
-  const routerFakeIPResponse = await PodkopShellMethods.checkFakeIP();
+  const routerFakeIPResponse = await NetShiftShellMethods.checkFakeIP();
   const checkFakeIPResponse = await RemoteFakeIPMethods.getFakeIpCheck();
   const checkIPResponse = await RemoteFakeIPMethods.getIpCheck();
 
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runNftCheck.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runNftCheck.ts
similarity index 87%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/runNftCheck.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/runNftCheck.ts
index a28a378e..04277163 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runNftCheck.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runNftCheck.ts
@@ -1,5 +1,5 @@
 import { DIAGNOSTICS_CHECKS_MAP } from './contstants';
-import { RemoteFakeIPMethods, PodkopShellMethods } from '../../../methods';
+import { RemoteFakeIPMethods, NetShiftShellMethods } from '../../../methods';
 import { updateCheckStore } from './updateCheckStore';
 import { getMeta } from '../helpers/getMeta';
 
@@ -18,7 +18,7 @@ export async function runNftCheck() {
   await RemoteFakeIPMethods.getFakeIpCheck();
   await RemoteFakeIPMethods.getIpCheck();
 
-  const nftablesChecks = await PodkopShellMethods.checkNftRules();
+  const nftablesChecks = await NetShiftShellMethods.checkNftRules();
 
   if (!nftablesChecks.success) {
     updateCheckStore({
@@ -40,7 +40,6 @@ export async function runNftCheck() {
     Boolean(data.rules_mangle_exist) &&
     Boolean(data.rules_mangle_counters) &&
     Boolean(data.rules_mangle_output_exist) &&
-    Boolean(data.rules_mangle_output_counters) &&
     Boolean(data.rules_proxy_exist) &&
     Boolean(data.rules_proxy_counters) &&
     !data.rules_other_mark_exist;
@@ -50,7 +49,6 @@ export async function runNftCheck() {
     Boolean(data.rules_mangle_exist) ||
     Boolean(data.rules_mangle_counters) ||
     Boolean(data.rules_mangle_output_exist) ||
-    Boolean(data.rules_mangle_output_counters) ||
     Boolean(data.rules_proxy_exist) ||
     Boolean(data.rules_proxy_counters) ||
     !data.rules_other_mark_exist;
@@ -84,11 +82,6 @@ export async function runNftCheck() {
         key: _('Rules mangle output exist'),
         value: '',
       },
-      {
-        state: data.rules_mangle_output_counters ? 'success' : 'error',
-        key: _('Rules mangle output counters'),
-        value: '',
-      },
       {
         state: data.rules_proxy_exist ? 'success' : 'error',
         key: _('Rules proxy exist'),
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts
similarity index 92%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts
index 35c85ae2..67fb9731 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts
@@ -1,5 +1,5 @@
 import { DIAGNOSTICS_CHECKS_MAP } from './contstants';
-import { PodkopShellMethods } from '../../../methods';
+import { NetShiftShellMethods } from '../../../methods';
 import { updateCheckStore } from './updateCheckStore';
 import { getMeta } from '../helpers/getMeta';
 import { getDashboardSections } from '../../../methods/custom/getDashboardSections';
@@ -36,9 +36,8 @@ export async function runSectionsCheck() {
     sections.data.map(async (section) => {
       async function getLatency() {
         if (section.withTagSelect) {
-          const latencyGroup = await PodkopShellMethods.getClashApiGroupLatency(
-            section.code,
-          );
+          const latencyGroup =
+            await NetShiftShellMethods.getClashApiGroupLatency(section.code);
 
           const selectedOutbound = section.outbounds.find(
             (item) => item.selected,
@@ -82,7 +81,7 @@ export async function runSectionsCheck() {
           };
         }
 
-        const latencyProxy = await PodkopShellMethods.getClashApiProxyLatency(
+        const latencyProxy = await NetShiftShellMethods.getClashApiProxyLatency(
           section.code,
         );
 
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts
similarity index 95%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts
index b13f0bc0..3d5f9bb2 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts
@@ -1,5 +1,5 @@
 import { DIAGNOSTICS_CHECKS_MAP } from './contstants';
-import { PodkopShellMethods } from '../../../methods';
+import { NetShiftShellMethods } from '../../../methods';
 import { updateCheckStore } from './updateCheckStore';
 import { getMeta } from '../helpers/getMeta';
 
@@ -15,7 +15,7 @@ export async function runSingBoxCheck() {
     items: [],
   });
 
-  const singBoxChecks = await PodkopShellMethods.checkSingBox();
+  const singBoxChecks = await NetShiftShellMethods.checkSingBox();
 
   if (!singBoxChecks.success) {
     updateCheckStore({
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/checks/updateCheckStore.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/checks/updateCheckStore.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/checks/updateCheckStore.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/checks/updateCheckStore.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/diagnostic.store.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/diagnostic.store.ts
similarity index 95%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/diagnostic.store.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/diagnostic.store.ts
index c6ea5626..c62e3946 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/diagnostic.store.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/diagnostic.store.ts
@@ -13,12 +13,13 @@ export const initialDiagnosticStore: Pick<
 > = {
   diagnosticsSystemInfo: {
     loading: true,
-    podkop_version: 'loading',
-    podkop_latest_version: 'loading',
+    netshift_version: 'loading',
+    netshift_latest_version: 'loading',
     luci_app_version: 'loading',
     sing_box_version: 'loading',
     openwrt_version: 'loading',
     device_model: 'loading',
+    sing_box_extended: 0,
   },
   diagnosticsActions: {
     restart: {
@@ -45,6 +46,9 @@ export const initialDiagnosticStore: Pick<
     showSingBoxConfig: {
       loading: false,
     },
+    clearSubscriptionCache: {
+      loading: false,
+    },
   },
   diagnosticsRunAction: { loading: false },
   diagnosticsChecks: [
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getMeta.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getMeta.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getMeta.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getMeta.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts
similarity index 71%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts
index 32b0688b..6f3b6761 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts
@@ -7,32 +7,32 @@ function isUnknownVersion(version?: string | null): boolean {
   return version === 'unknown' || version === _('unknown');
 }
 
-export function getPodkopVersionRow(
+export function getNetshiftVersionRow(
   diagnosticsSystemInfo: StoreType['diagnosticsSystemInfo'],
 ): IRenderSystemInfoRow {
   const loading = diagnosticsSystemInfo.loading;
-  const unknown = isUnknownVersion(diagnosticsSystemInfo.podkop_version);
+  const unknown = isUnknownVersion(diagnosticsSystemInfo.netshift_version);
   const hasActualVersion =
-    Boolean(diagnosticsSystemInfo.podkop_latest_version) &&
-    !isUnknownVersion(diagnosticsSystemInfo.podkop_latest_version);
+    Boolean(diagnosticsSystemInfo.netshift_latest_version) &&
+    !isUnknownVersion(diagnosticsSystemInfo.netshift_latest_version);
   const version = normalizeCompiledVersion(
-    diagnosticsSystemInfo.podkop_version,
+    diagnosticsSystemInfo.netshift_version,
   );
   const isDevVersion = version === 'dev';
 
   if (loading || unknown || !hasActualVersion || isDevVersion) {
     return {
-      key: 'Podkop',
+      key: 'NetShift',
       value: version,
     };
   }
 
   if (
     removeVersionPrefix(version) !==
-    removeVersionPrefix(diagnosticsSystemInfo.podkop_latest_version)
+    removeVersionPrefix(diagnosticsSystemInfo.netshift_latest_version)
   ) {
     return {
-      key: 'Podkop',
+      key: 'NetShift',
       value: version,
       tag: {
         label: _('Outdated'),
@@ -42,7 +42,7 @@ export function getPodkopVersionRow(
   }
 
   return {
-    key: 'Podkop',
+    key: 'NetShift',
     value: version,
     tag: {
       label: _('Latest'),
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/index.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/index.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/index.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/initController.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/initController.ts
similarity index 84%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/initController.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/initController.ts
index 7ef08cdd..ef811537 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/initController.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/initController.ts
@@ -11,36 +11,38 @@ import {
   renderRunAction,
   renderSystemInfo,
 } from './partials';
-import { PodkopShellMethods } from '../../methods';
+import { NetShiftShellMethods } from '../../methods';
 import { fetchServicesInfo } from '../../fetchers';
 import { normalizeCompiledVersion } from '../../../helpers/normalizeCompiledVersion';
 import { renderModal } from '../../../partials';
-import { PODKOP_LUCI_APP_VERSION } from '../../../constants';
+import { NETSHIFT_LUCI_APP_VERSION } from '../../../constants';
 import { showToast } from '../../../helpers/showToast';
 import { renderWikiDisclaimer } from './partials/renderWikiDisclaimer';
 import { runSectionsCheck } from './checks/runSectionsCheck';
-import { getPodkopVersionRow } from './helpers/getPodkopVersionRow';
+import { getNetshiftVersionRow } from './helpers/getNetshiftVersionRow';
 
 async function fetchSystemInfo() {
-  const systemInfo = await PodkopShellMethods.getSystemInfo();
+  const systemInfo = await NetShiftShellMethods.getSystemInfo();
 
   if (systemInfo.success) {
     store.set({
       diagnosticsSystemInfo: {
         loading: false,
         ...systemInfo.data,
+        sing_box_extended: systemInfo.data.sing_box_extended === 1 ? 1 : 0,
       },
     });
   } else {
     store.set({
       diagnosticsSystemInfo: {
         loading: false,
-        podkop_version: _('unknown'),
-        podkop_latest_version: _('unknown'),
+        netshift_version: _('unknown'),
+        netshift_latest_version: _('unknown'),
         luci_app_version: _('unknown'),
         sing_box_version: _('unknown'),
         openwrt_version: _('unknown'),
         device_model: _('unknown'),
+        sing_box_extended: 0,
       },
     });
   }
@@ -88,7 +90,7 @@ async function handleRestart() {
   });
 
   try {
-    await PodkopShellMethods.restart();
+    await NetShiftShellMethods.restart();
   } catch (e) {
     logger.error('[DIAGNOSTIC]', 'handleRestart - e', e);
   } finally {
@@ -115,7 +117,7 @@ async function handleStop() {
   });
 
   try {
-    await PodkopShellMethods.stop();
+    await NetShiftShellMethods.stop();
   } catch (e) {
     logger.error('[DIAGNOSTIC]', 'handleStop - e', e);
   } finally {
@@ -140,7 +142,7 @@ async function handleStart() {
   });
 
   try {
-    await PodkopShellMethods.start();
+    await NetShiftShellMethods.start();
   } catch (e) {
     logger.error('[DIAGNOSTIC]', 'handleStart - e', e);
   } finally {
@@ -167,7 +169,7 @@ async function handleEnable() {
   });
 
   try {
-    await PodkopShellMethods.enable();
+    await NetShiftShellMethods.enable();
   } catch (e) {
     logger.error('[DIAGNOSTIC]', 'handleEnable - e', e);
   } finally {
@@ -191,7 +193,7 @@ async function handleDisable() {
   });
 
   try {
-    await PodkopShellMethods.disable();
+    await NetShiftShellMethods.disable();
   } catch (e) {
     logger.error('[DIAGNOSTIC]', 'handleDisable - e', e);
   } finally {
@@ -215,7 +217,7 @@ async function handleShowGlobalCheck() {
   });
 
   try {
-    const globalCheck = await PodkopShellMethods.globalCheck();
+    const globalCheck = await NetShiftShellMethods.globalCheck();
 
     if (globalCheck.success) {
       ui.showModal(
@@ -249,7 +251,7 @@ async function handleViewLogs() {
   });
 
   try {
-    const viewLogs = await PodkopShellMethods.checkLogs();
+    const viewLogs = await NetShiftShellMethods.checkLogs();
 
     if (viewLogs.success) {
       ui.showModal(
@@ -283,7 +285,7 @@ async function handleShowSingBoxConfig() {
   });
 
   try {
-    const showSingBoxConfig = await PodkopShellMethods.showSingBoxConfig();
+    const showSingBoxConfig = await NetShiftShellMethods.showSingBoxConfig();
 
     if (showSingBoxConfig.success) {
       ui.showModal(
@@ -314,6 +316,48 @@ async function handleShowSingBoxConfig() {
   }
 }
 
+async function handleClearSubscriptionCache() {
+  const diagnosticsActions = store.get().diagnosticsActions;
+  store.set({
+    diagnosticsActions: {
+      ...diagnosticsActions,
+      clearSubscriptionCache: { loading: true },
+    },
+  });
+
+  showToast(
+    _('Clearing subscription cache and re-downloading… this may take a minute'),
+    'info',
+  );
+
+  try {
+    const result = await NetShiftShellMethods.clearSubscriptionCache();
+
+    if (result.success) {
+      showToast(_('Subscription cache cleared and re-downloaded'), 'success');
+    } else {
+      logger.error(
+        '[DIAGNOSTIC]',
+        'handleClearSubscriptionCache - result',
+        result,
+      );
+      showToast(_('Failed to clear subscription cache'), 'error');
+    }
+  } catch (e) {
+    logger.error('[DIAGNOSTIC]', 'handleClearSubscriptionCache - e', e);
+    showToast(_('Failed to clear subscription cache'), 'error');
+  } finally {
+    await fetchServicesInfo();
+    store.set({
+      diagnosticsActions: {
+        ...diagnosticsActions,
+        clearSubscriptionCache: { loading: false },
+      },
+    });
+    store.reset(['diagnosticsChecks']);
+  }
+}
+
 function renderWikiDisclaimerWidget() {
   const diagnosticsChecks = store.get().diagnosticsChecks;
 
@@ -343,7 +387,7 @@ function renderDiagnosticAvailableActionsWidget() {
   const servicesInfoWidget = store.get().servicesInfoWidget;
   logger.debug('[DIAGNOSTIC]', 'renderDiagnosticAvailableActionsWidget');
 
-  const podkopEnabled = Boolean(servicesInfoWidget.data.podkop);
+  const netshiftEnabled = Boolean(servicesInfoWidget.data.netshift);
   const singBoxRunning = Boolean(servicesInfoWidget.data.singbox);
   const atLeastOneServiceCommandLoading =
     servicesInfoWidget.loading ||
@@ -374,13 +418,13 @@ function renderDiagnosticAvailableActionsWidget() {
     },
     enable: {
       loading: diagnosticsActions.enable.loading,
-      visible: !podkopEnabled,
+      visible: !netshiftEnabled,
       onClick: handleEnable,
       disabled: atLeastOneServiceCommandLoading,
     },
     disable: {
       loading: diagnosticsActions.disable.loading,
-      visible: podkopEnabled,
+      visible: netshiftEnabled,
       onClick: handleDisable,
       disabled: atLeastOneServiceCommandLoading,
     },
@@ -402,6 +446,12 @@ function renderDiagnosticAvailableActionsWidget() {
       onClick: handleShowSingBoxConfig,
       disabled: atLeastOneServiceCommandLoading,
     },
+    clearSubscriptionCache: {
+      loading: diagnosticsActions.clearSubscriptionCache.loading,
+      visible: true,
+      onClick: handleClearSubscriptionCache,
+      disabled: atLeastOneServiceCommandLoading,
+    },
   });
 
   return preserveScrollForPage(() => {
@@ -417,10 +467,10 @@ function renderDiagnosticSystemInfoWidget() {
 
   const renderedSystemInfo = renderSystemInfo({
     items: [
-      getPodkopVersionRow(diagnosticsSystemInfo),
+      getNetshiftVersionRow(diagnosticsSystemInfo),
       {
         key: 'Luci App',
-        value: normalizeCompiledVersion(PODKOP_LUCI_APP_VERSION),
+        value: normalizeCompiledVersion(NETSHIFT_LUCI_APP_VERSION),
       },
       {
         key: 'Sing-box',
@@ -456,7 +506,11 @@ async function onStoreUpdate(
     renderDiagnosticRunActionWidget();
   }
 
-  if (diff.diagnosticsActions || diff.servicesInfoWidget) {
+  if (
+    diff.diagnosticsActions ||
+    diff.servicesInfoWidget ||
+    diff.diagnosticsSystemInfo
+  ) {
     renderDiagnosticAvailableActionsWidget();
   }
 
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/index.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/index.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/partials/index.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/partials/index.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts
similarity index 84%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts
index f54fd7f3..fc48775e 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts
@@ -27,6 +27,7 @@ interface IRenderAvailableActionsProps {
   globalCheck: ActionProps;
   viewLogs: ActionProps;
   showSingBoxConfig: ActionProps;
+  clearSubscriptionCache: ActionProps;
 }
 
 export function renderAvailableActions({
@@ -38,15 +39,16 @@ export function renderAvailableActions({
   globalCheck,
   viewLogs,
   showSingBoxConfig,
+  clearSubscriptionCache,
 }: IRenderAvailableActionsProps) {
-  return E('div', { class: 'pdk_diagnostic-page__right-bar__actions' }, [
+  return E('div', { class: 'card pdk_diagnostic-page__right-bar__actions' }, [
     E('b', {}, _('Available actions')),
     ...insertIf(restart.visible, [
       renderButton({
         classNames: ['cbi-button-apply'],
         onClick: restart.onClick,
         icon: renderRotateCcwIcon24,
-        text: _('Restart podkop'),
+        text: _('Restart NetShift'),
         loading: restart.loading,
         disabled: restart.disabled,
       }),
@@ -56,7 +58,7 @@ export function renderAvailableActions({
         classNames: ['cbi-button-remove'],
         onClick: stop.onClick,
         icon: renderCircleStopIcon24,
-        text: _('Stop podkop'),
+        text: _('Stop NetShift'),
         loading: stop.loading,
         disabled: stop.disabled,
       }),
@@ -66,7 +68,7 @@ export function renderAvailableActions({
         classNames: ['cbi-button-save'],
         onClick: start.onClick,
         icon: renderCirclePlayIcon24,
-        text: _('Start podkop'),
+        text: _('Start NetShift'),
         loading: start.loading,
         disabled: start.disabled,
       }),
@@ -118,5 +120,14 @@ export function renderAvailableActions({
         disabled: showSingBoxConfig.disabled,
       }),
     ]),
+    ...insertIf(clearSubscriptionCache.visible, [
+      renderButton({
+        onClick: clearSubscriptionCache.onClick,
+        icon: renderRotateCcwIcon24,
+        text: _('Clear subscription cache'),
+        loading: clearSubscriptionCache.loading,
+        disabled: clearSubscriptionCache.disabled,
+      }),
+    ]),
   ]);
 }
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderCheckSection.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderCheckSection.ts
similarity index 92%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderCheckSection.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderCheckSection.ts
index a54da42b..019c0cbb 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderCheckSection.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderCheckSection.ts
@@ -56,7 +56,7 @@ function renderLoadingState(props: IRenderCheckSectionProps) {
 
   return E(
     'div',
-    { class: 'pdk_diagnostic_alert pdk_diagnostic_alert--loading' },
+    { class: 'card pdk_diagnostic_alert pdk_diagnostic_alert--loading' },
     [
       iconWrap,
       E('div', { class: 'pdk_diagnostic_alert__content' }, [
@@ -79,7 +79,7 @@ function renderWarningState(props: IRenderCheckSectionProps) {
 
   return E(
     'div',
-    { class: 'pdk_diagnostic_alert pdk_diagnostic_alert--warning' },
+    { class: 'card pdk_diagnostic_alert pdk_diagnostic_alert--warning' },
     [
       iconWrap,
       E('div', { class: 'pdk_diagnostic_alert__content' }, [
@@ -102,7 +102,7 @@ function renderErrorState(props: IRenderCheckSectionProps) {
 
   return E(
     'div',
-    { class: 'pdk_diagnostic_alert pdk_diagnostic_alert--error' },
+    { class: 'card pdk_diagnostic_alert pdk_diagnostic_alert--error' },
     [
       iconWrap,
       E('div', { class: 'pdk_diagnostic_alert__content' }, [
@@ -125,7 +125,7 @@ function renderSuccessState(props: IRenderCheckSectionProps) {
 
   return E(
     'div',
-    { class: 'pdk_diagnostic_alert pdk_diagnostic_alert--success' },
+    { class: 'card pdk_diagnostic_alert pdk_diagnostic_alert--success' },
     [
       iconWrap,
       E('div', { class: 'pdk_diagnostic_alert__content' }, [
@@ -148,7 +148,7 @@ function renderSkippedState(props: IRenderCheckSectionProps) {
 
   return E(
     'div',
-    { class: 'pdk_diagnostic_alert pdk_diagnostic_alert--skipped' },
+    { class: 'card pdk_diagnostic_alert pdk_diagnostic_alert--skipped' },
     [
       iconWrap,
       E('div', { class: 'pdk_diagnostic_alert__content' }, [
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderRunAction.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderRunAction.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderRunAction.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderRunAction.ts
diff --git a/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts
new file mode 100644
index 00000000..78a50637
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts
@@ -0,0 +1,53 @@
+import { insertIf } from '../../../../helpers';
+
+export interface IRenderSystemInfoRow {
+  key: string;
+  value: string;
+  tag?: {
+    label: string;
+    kind: 'warning' | 'success';
+  };
+}
+
+interface IRenderSystemInfoProps {
+  items: Array<IRenderSystemInfoRow>;
+}
+
+export function renderSystemInfo({ items }: IRenderSystemInfoProps) {
+  return E(
+    'div',
+    { class: 'card pdk_diagnostic-page__right-bar__system-info' },
+    [
+      E(
+        'b',
+        { class: 'pdk_diagnostic-page__right-bar__system-info__title' },
+        _('System information'),
+      ),
+      ...items.map((item) => {
+        const tagClass = [
+          'pdk_diagnostic-page__right-bar__system-info__row__tag',
+          ...insertIf(item.tag?.kind === 'warning', [
+            'pdk_diagnostic-page__right-bar__system-info__row__tag--warning',
+          ]),
+          ...insertIf(item.tag?.kind === 'success', [
+            'pdk_diagnostic-page__right-bar__system-info__row__tag--success',
+          ]),
+        ]
+          .filter(Boolean)
+          .join(' ');
+
+        return E(
+          'div',
+          { class: 'pdk_diagnostic-page__right-bar__system-info__row' },
+          [
+            E('b', {}, item.key),
+            E('div', {}, [
+              E('span', {}, item.value),
+              E('span', { class: tagClass }, item?.tag?.label),
+            ]),
+          ],
+        );
+      }),
+    ],
+  );
+}
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts
similarity index 93%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts
index 9511e80a..0abb6e8d 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts
@@ -9,6 +9,7 @@ export function renderWikiDisclaimer(kind: 'default' | 'error' | 'warning') {
   iconWrap.appendChild(renderBookOpenTextIcon24());
 
   const className = [
+    'card',
     'pdk_diagnostic-page__right-bar__wiki',
     ...insertIf(kind === 'error', [
       'pdk_diagnostic-page__right-bar__wiki--error',
@@ -31,7 +32,7 @@ export function renderWikiDisclaimer(kind: 'default' | 'error' | 'warning') {
       text: _('Visit Wiki'),
       onClick: () =>
         window.open(
-          'https://podkop.net/docs/troubleshooting/?utm_source=podkop',
+          'https://podkop.net/docs/troubleshooting/?utm_source=netshift',
           '_blank',
           'noopener,noreferrer',
         ),
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/renderDiagnostic.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/renderDiagnostic.ts
similarity index 100%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/renderDiagnostic.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/renderDiagnostic.ts
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/styles.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/styles.ts
similarity index 87%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/styles.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/styles.ts
index def1d781..a8f78aa2 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/styles.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/styles.ts
@@ -1,11 +1,11 @@
 // language=CSS
 export const styles = `
 
-#cbi-podkop-diagnostic-_mount_node > div {
+#cbi-netshift-diagnostic-_mount_node > div {
     width: 100%;
 }
 
-#cbi-podkop-diagnostic > h3 {
+#cbi-netshift-diagnostic > h3 {
     display: none;
 }
 
@@ -29,10 +29,6 @@ export const styles = `
 }
 
 .pdk_diagnostic-page__right-bar__wiki {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
@@ -54,21 +50,12 @@ export const styles = `
 .pdk_diagnostic-page__right-bar__wiki__texts {}
 
 .pdk_diagnostic-page__right-bar__actions {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
-
 }
 
 .pdk_diagnostic-page__right-bar__system-info {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
@@ -120,14 +107,10 @@ export const styles = `
 }
 
 .pdk_diagnostic_alert {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-
     display: grid;
     grid-template-columns: 24px 1fr;
     grid-column-gap: 10px;
     align-items: center;
-    padding: 10px;
 }
 
 .pdk_diagnostic_alert--loading {
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/tests/getPodkopVersionRow.test.ts b/fe-app-netshift/src/netshift/tabs/diagnostic/tests/getNetshiftVersionRow.test.ts
similarity index 66%
rename from fe-app-podkop/src/podkop/tabs/diagnostic/tests/getPodkopVersionRow.test.ts
rename to fe-app-netshift/src/netshift/tabs/diagnostic/tests/getNetshiftVersionRow.test.ts
index 88642f42..e8d93c89 100644
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/tests/getPodkopVersionRow.test.ts
+++ b/fe-app-netshift/src/netshift/tabs/diagnostic/tests/getNetshiftVersionRow.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { getPodkopVersionRow } from '../helpers/getPodkopVersionRow';
+import { getNetshiftVersionRow } from '../helpers/getNetshiftVersionRow';
 import type { StoreType } from '../../../services/store.service';
 
 function makeDiagnosticsSystemInfo(
@@ -7,8 +7,8 @@ function makeDiagnosticsSystemInfo(
 ): StoreType['diagnosticsSystemInfo'] {
   return {
     loading: false,
-    podkop_version: '1.2.3',
-    podkop_latest_version: '1.2.3',
+    netshift_version: '1.2.3',
+    netshift_latest_version: '1.2.3',
     luci_app_version: '1.0.0',
     sing_box_version: '1.11.0',
     openwrt_version: 'OpenWrt 25.12',
@@ -17,17 +17,17 @@ function makeDiagnosticsSystemInfo(
   };
 }
 
-describe('getPodkopVersionRow', () => {
+describe('getNetshiftVersionRow', () => {
   it('returns Latest when versions differ only by leading v', () => {
-    const row = getPodkopVersionRow(
+    const row = getNetshiftVersionRow(
       makeDiagnosticsSystemInfo({
-        podkop_version: 'v1.2.3',
-        podkop_latest_version: '1.2.3',
+        netshift_version: 'v1.2.3',
+        netshift_latest_version: '1.2.3',
       }),
     );
 
     expect(row).toEqual({
-      key: 'Podkop',
+      key: 'NetShift',
       value: 'v1.2.3',
       tag: {
         label: 'Latest',
@@ -37,15 +37,15 @@ describe('getPodkopVersionRow', () => {
   });
 
   it('returns Outdated when versions differ', () => {
-    const row = getPodkopVersionRow(
+    const row = getNetshiftVersionRow(
       makeDiagnosticsSystemInfo({
-        podkop_version: '1.2.2',
-        podkop_latest_version: '1.2.3',
+        netshift_version: '1.2.2',
+        netshift_latest_version: '1.2.3',
       }),
     );
 
     expect(row).toEqual({
-      key: 'Podkop',
+      key: 'NetShift',
       value: '1.2.2',
       tag: {
         label: 'Outdated',
@@ -55,14 +55,14 @@ describe('getPodkopVersionRow', () => {
   });
 
   it('returns plain row without tag for dev build', () => {
-    const row = getPodkopVersionRow(
+    const row = getNetshiftVersionRow(
       makeDiagnosticsSystemInfo({
-        podkop_version: 'COMPILED_VERSION',
+        netshift_version: 'COMPILED_VERSION',
       }),
     );
 
     expect(row).toEqual({
-      key: 'Podkop',
+      key: 'NetShift',
       value: 'dev',
     });
   });
diff --git a/fe-app-podkop/src/podkop/tabs/index.ts b/fe-app-netshift/src/netshift/tabs/index.ts
similarity index 68%
rename from fe-app-podkop/src/podkop/tabs/index.ts
rename to fe-app-netshift/src/netshift/tabs/index.ts
index b49ac00d..1a4fdc3b 100644
--- a/fe-app-podkop/src/podkop/tabs/index.ts
+++ b/fe-app-netshift/src/netshift/tabs/index.ts
@@ -1,2 +1,3 @@
 export * from './dashboard';
 export * from './diagnostic';
+export * from './manager';
diff --git a/fe-app-netshift/src/netshift/tabs/manager/cards.ts b/fe-app-netshift/src/netshift/tabs/manager/cards.ts
new file mode 100644
index 00000000..3f168bb9
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/cards.ts
@@ -0,0 +1,264 @@
+import { NetShift } from '../../types';
+import { normalizeCompiledVersion } from '../../../helpers/normalizeCompiledVersion';
+
+export type ManagerComponentKey =
+  | 'netshift'
+  | 'sing_box_stock'
+  | 'sing_box_extended';
+
+// `check` = a sing-box update check (routed to the sing-box check method);
+// `check_netshift` = the NetShift card's on-demand check (task-030), which now
+// calls the dedicated `component_action netshift check_update` action and writes
+// `managerChecks.netshift` — exactly like the sing-box cores. Keeping it a
+// DISTINCT kind guarantees a NetShift check can never be routed to the sing-box
+// check method (the dispatcher routes it to runNetshiftCheck).
+export type ManagerActionKind =
+  | 'check'
+  | 'check_netshift'
+  | 'update'
+  | 'switch'
+  | 'self_update';
+
+export interface ManagerActionDescriptor {
+  // The store-slice key driving this button's loading flag.
+  loadingKey:
+    | 'netshiftCheck'
+    | 'netshiftUpdate'
+    | 'singBoxStockCheck'
+    | 'singBoxStockAction'
+    | 'singBoxExtendedCheck'
+    | 'singBoxExtendedAction';
+  kind: ManagerActionKind;
+  text: string;
+  // For `update`/`switch`: the backend install action; for `self_update`:
+  // 'self_update'; for `check`: the sing-box check action; for `check_netshift`:
+  // the NetShift check action (routed to the dedicated NetShift check method).
+  backendAction?:
+    | 'check_update'
+    | 'check_update_stable'
+    | 'install_stable'
+    | 'install_extended'
+    | 'self_update';
+}
+
+export interface ManagerCardTag {
+  label: string;
+  kind: 'neutral' | 'success' | 'warning';
+}
+
+export interface ManagerCardDescriptor {
+  key: ManagerComponentKey;
+  title: string;
+  version: string;
+  installed: boolean;
+  tag?: ManagerCardTag;
+  actions: ManagerActionDescriptor[];
+}
+
+export type ManagerSystemInfo = {
+  netshift_version: string;
+  netshift_latest_version: string;
+  sing_box_version: string;
+  sing_box_extended: 0 | 1;
+};
+
+export type ManagerCheckState = {
+  status: NetShift.ComponentUpdateStatus | null;
+  latest_version: string;
+};
+
+const NOT_INSTALLED = 'not installed';
+
+export function isSingBoxInstalled(systemInfo: ManagerSystemInfo): boolean {
+  const version = systemInfo.sing_box_version;
+
+  return Boolean(version) && version !== NOT_INSTALLED;
+}
+
+/**
+ * Map a check status to a status badge. Pure — same logic as podkop-plus
+ * `getCheckTag`, extended with `not_installed`.
+ */
+export function getCheckTag(
+  status: NetShift.ComponentUpdateStatus | null,
+): ManagerCardTag | undefined {
+  if (!status) {
+    return undefined;
+  }
+
+  if (status === 'latest') {
+    return { label: _('Latest'), kind: 'success' };
+  }
+
+  if (status === 'outdated') {
+    return { label: _('Outdated'), kind: 'warning' };
+  }
+
+  if (status === 'not_installed') {
+    return { label: _('Not installed'), kind: 'neutral' };
+  }
+
+  return { label: _('Dev'), kind: 'neutral' };
+}
+
+// NetShift status is derived from the on-demand check result (task-030):
+// `managerChecks.netshift.status` is null until the user presses "Check update"
+// → neutral card (no badge, no update button). The backend already computes the
+// v-normalized status, so we TRUST it (no installed-vs-latest string compare).
+// The `dev`-build guard is kept locally: a dev/placeholder build never shows an
+// update prompt regardless of any check result.
+function netshiftStatus(
+  systemInfo: ManagerSystemInfo,
+  check: ManagerCheckState,
+): NetShift.ComponentUpdateStatus | null {
+  const installed = normalizeCompiledVersion(systemInfo.netshift_version);
+
+  if (installed === 'dev') {
+    return null;
+  }
+
+  return check.status;
+}
+
+function netshiftCard(
+  systemInfo: ManagerSystemInfo,
+  check: ManagerCheckState,
+): ManagerCardDescriptor {
+  const status = netshiftStatus(systemInfo, check);
+  const latest = check.latest_version;
+  const actions: ManagerActionDescriptor[] = [];
+
+  if (status === 'outdated') {
+    actions.push({
+      loadingKey: 'netshiftUpdate',
+      kind: 'self_update',
+      text: latest
+        ? _('Install %s').replace('%s', latest)
+        : _('Update NetShift'),
+      backendAction: 'self_update',
+    });
+  } else {
+    actions.push({
+      loadingKey: 'netshiftCheck',
+      kind: 'check_netshift',
+      text: _('Check update'),
+      backendAction: 'check_update',
+    });
+  }
+
+  return {
+    key: 'netshift',
+    title: 'NetShift',
+    version: normalizeCompiledVersion(systemInfo.netshift_version),
+    installed: true,
+    tag: getCheckTag(status),
+    actions,
+  };
+}
+
+function singBoxStockCard(
+  systemInfo: ManagerSystemInfo,
+  check: ManagerCheckState,
+): ManagerCardDescriptor {
+  const installed = isSingBoxInstalled(systemInfo);
+  const isActive = installed && systemInfo.sing_box_extended === 0;
+  const actions: ManagerActionDescriptor[] = [];
+
+  if (isActive) {
+    if (check.status === 'outdated') {
+      const latest = check.latest_version;
+
+      actions.push({
+        loadingKey: 'singBoxStockAction',
+        kind: 'update',
+        text: latest ? _('Install %s').replace('%s', latest) : _('Update'),
+        backendAction: 'install_stable',
+      });
+    } else {
+      actions.push({
+        loadingKey: 'singBoxStockCheck',
+        kind: 'check',
+        text: _('Check update'),
+        backendAction: 'check_update_stable',
+      });
+    }
+  } else {
+    // Either extended is active, or no sing-box at all → offer switch-to-stable.
+    actions.push({
+      loadingKey: 'singBoxStockAction',
+      kind: 'switch',
+      text: _('Switch to stable'),
+      backendAction: 'install_stable',
+    });
+  }
+
+  return {
+    key: 'sing_box_stock',
+    title: 'sing-box (stock)',
+    version: isActive ? systemInfo.sing_box_version : _('Not installed'),
+    installed: isActive,
+    tag: isActive ? getCheckTag(check.status) : getCheckTag('not_installed'),
+    actions,
+  };
+}
+
+function singBoxExtendedCard(
+  systemInfo: ManagerSystemInfo,
+  check: ManagerCheckState,
+): ManagerCardDescriptor {
+  const installed = isSingBoxInstalled(systemInfo);
+  const isActive = installed && systemInfo.sing_box_extended === 1;
+  const actions: ManagerActionDescriptor[] = [];
+
+  if (isActive) {
+    if (check.status === 'outdated') {
+      const latest = check.latest_version;
+
+      actions.push({
+        loadingKey: 'singBoxExtendedAction',
+        kind: 'update',
+        text: latest ? _('Install %s').replace('%s', latest) : _('Update'),
+        backendAction: 'install_extended',
+      });
+    } else {
+      actions.push({
+        loadingKey: 'singBoxExtendedCheck',
+        kind: 'check',
+        text: _('Check update'),
+        backendAction: 'check_update',
+      });
+    }
+  } else {
+    actions.push({
+      loadingKey: 'singBoxExtendedAction',
+      kind: 'switch',
+      text: _('Switch to extended'),
+      backendAction: 'install_extended',
+    });
+  }
+
+  return {
+    key: 'sing_box_extended',
+    title: 'sing-box (extended)',
+    version: isActive ? systemInfo.sing_box_version : _('Not installed'),
+    installed: isActive,
+    tag: isActive ? getCheckTag(check.status) : getCheckTag('not_installed'),
+    actions,
+  };
+}
+
+/**
+ * Build the three Component Manager cards from systemInfo + per-component check
+ * state. Pure (no DOM, no store) so it is unit-testable; the controller maps
+ * descriptors to DOM + click handlers.
+ */
+export function getComponentCards(
+  systemInfo: ManagerSystemInfo,
+  checks: Record<ManagerComponentKey, ManagerCheckState>,
+): ManagerCardDescriptor[] {
+  return [
+    netshiftCard(systemInfo, checks.netshift),
+    singBoxStockCard(systemInfo, checks.sing_box_stock),
+    singBoxExtendedCard(systemInfo, checks.sing_box_extended),
+  ];
+}
diff --git a/fe-app-netshift/src/netshift/tabs/manager/index.ts b/fe-app-netshift/src/netshift/tabs/manager/index.ts
new file mode 100644
index 00000000..08c7657d
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/index.ts
@@ -0,0 +1,9 @@
+import { render } from './render';
+import { initController } from './initController';
+import { styles } from './styles';
+
+export const ManagerTab = {
+  render,
+  initController,
+  styles,
+};
diff --git a/fe-app-netshift/src/netshift/tabs/manager/initController.ts b/fe-app-netshift/src/netshift/tabs/manager/initController.ts
new file mode 100644
index 00000000..427c03fa
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/initController.ts
@@ -0,0 +1,425 @@
+import { onMount, preserveScrollForPage } from '../../../helpers';
+import { normalizeCompiledVersion } from '../../../helpers/normalizeCompiledVersion';
+import { showToast } from '../../../helpers/showToast';
+import { renderRotateCcwIcon24, renderSearchIcon24 } from '../../../icons';
+import { renderButton } from '../../../partials';
+import { NetShiftShellMethods } from '../../methods';
+import { logger, store, StoreType } from '../../services';
+import { NetShift } from '../../types';
+import {
+  ManagerActionDescriptor,
+  ManagerCardDescriptor,
+  ManagerComponentKey,
+  getComponentCards,
+} from './cards';
+
+type ManagerActionKey = keyof StoreType['managerActions'];
+
+let managerLifecycleRegistered = false;
+let managerControllerInitialized = false;
+let managerMounted = false;
+
+async function fetchSystemInfo() {
+  const systemInfo = await NetShiftShellMethods.getSystemInfo();
+
+  if (systemInfo.success) {
+    store.set({
+      diagnosticsSystemInfo: {
+        loading: false,
+        ...systemInfo.data,
+        sing_box_extended: systemInfo.data.sing_box_extended === 1 ? 1 : 0,
+      },
+    });
+  } else {
+    store.set({
+      diagnosticsSystemInfo: {
+        loading: false,
+        netshift_version: _('unknown'),
+        netshift_latest_version: _('unknown'),
+        luci_app_version: _('unknown'),
+        sing_box_version: _('unknown'),
+        openwrt_version: _('unknown'),
+        device_model: _('unknown'),
+        sing_box_extended: 0,
+      },
+    });
+  }
+}
+
+function isAnyActionLoading() {
+  return Object.values(store.get().managerActions).some((item) => item.loading);
+}
+
+function isSystemInfoLoading() {
+  return store.get().diagnosticsSystemInfo.loading;
+}
+
+function setActionLoading(action: ManagerActionKey, loading: boolean) {
+  const managerActions = store.get().managerActions;
+
+  store.set({
+    managerActions: {
+      ...managerActions,
+      [action]: { loading },
+    },
+  });
+}
+
+function setCheckResult(
+  component: ManagerComponentKey,
+  status: NetShift.ComponentUpdateStatus | null,
+  latestVersion: string,
+) {
+  const managerChecks = store.get().managerChecks;
+
+  store.set({
+    managerChecks: {
+      ...managerChecks,
+      [component]: {
+        status,
+        latest_version: latestVersion,
+      },
+    },
+  });
+}
+
+function resetCheckResult(component: ManagerComponentKey) {
+  setCheckResult(component, null, '');
+}
+
+function getCheckToastMessage(status: NetShift.ComponentUpdateStatus | null) {
+  if (status === 'outdated') {
+    return _('Update is available');
+  }
+
+  if (status === 'dev') {
+    return _('Installed version is newer than release');
+  }
+
+  if (status === 'not_installed') {
+    return _('Not installed');
+  }
+
+  return _('Latest version is installed');
+}
+
+// Sing-box check: routes to the sing-box check method (stock or extended) and
+// stores the result into the matching managerChecks slice.
+async function runSingBoxCheck(
+  component: ManagerComponentKey,
+  button: ManagerActionDescriptor,
+) {
+  setActionLoading(button.loadingKey, true);
+
+  try {
+    const parsed = await NetShiftShellMethods.singBoxCheckUpdate(
+      button.backendAction === 'check_update_stable'
+        ? 'check_update_stable'
+        : 'check_update',
+    );
+
+    if (!parsed.success) {
+      showToast(parsed.message || _('Failed to execute!'), 'error');
+      return;
+    }
+
+    const status = parsed.status ?? null;
+
+    setCheckResult(component, status, parsed.latest_version || '');
+    showToast(getCheckToastMessage(status), 'success');
+  } catch (error) {
+    logger.error('[MANAGER]', 'runSingBoxCheck failed', error);
+    showToast(_('Failed to execute!'), 'error');
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+
+// NetShift check (task-030): on-demand call to the dedicated
+// `component_action netshift check_update` action, which returns the same
+// {success, current_version, latest_version, status} contract as the sing-box
+// cores (status already v-normalized server-side). We TRUST result.status and
+// write it into managerChecks.netshift — mirroring runSingBoxCheck precisely.
+async function runNetshiftCheck(button: ManagerActionDescriptor) {
+  setActionLoading(button.loadingKey, true);
+
+  try {
+    const parsed = await NetShiftShellMethods.netshiftCheckUpdate();
+
+    if (!parsed.success) {
+      showToast(parsed.message || _('Failed to execute!'), 'error');
+      return;
+    }
+
+    const status = parsed.status ?? null;
+
+    setCheckResult('netshift', status, parsed.latest_version || '');
+    showToast(getCheckToastMessage(status), 'success');
+  } catch (error) {
+    logger.error('[MANAGER]', 'runNetshiftCheck failed', error);
+    showToast(_('Failed to execute!'), 'error');
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+
+async function runSingBoxMutation(
+  component: ManagerComponentKey,
+  button: ManagerActionDescriptor,
+) {
+  setActionLoading(button.loadingKey, true);
+  showToast(_('Switching sing-box core, this may take a few minutes…'), 'info');
+
+  try {
+    const result = await NetShiftShellMethods.singBoxComponentAction(
+      button.backendAction === 'install_stable'
+        ? 'install_stable'
+        : 'install_extended',
+    );
+
+    if (result.success) {
+      const changed = _('Sing-box core changed, version:');
+
+      showToast(`${changed} ${result.version || ''}`.trim(), 'success');
+      resetCheckResult(component);
+      await fetchSystemInfo();
+    } else {
+      logger.error('[MANAGER]', 'runSingBoxMutation failed', result);
+      showToast(result.message || _('Failed to execute!'), 'error');
+    }
+  } catch (error) {
+    logger.error('[MANAGER]', 'runSingBoxMutation failed', error);
+    showToast(_('Failed to execute!'), 'error');
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+
+function reloadPageAfterSelfUpdate() {
+  window.setTimeout(() => {
+    window.location.reload();
+  }, 1200);
+}
+
+async function runNetshiftSelfUpdate(button: ManagerActionDescriptor) {
+  setActionLoading(button.loadingKey, true);
+  // Warning-style toast: self-update is long and ends in a page reload.
+  showToast(
+    _('Updating NetShift, this may take a few minutes; the page will reload…'),
+    'warning',
+    6000,
+  );
+
+  try {
+    const result = await NetShiftShellMethods.netshiftSelfUpdate();
+
+    if (result.success) {
+      const updated = _('NetShift updated, version:');
+
+      showToast(`${updated} ${result.version || ''}`.trim(), 'success', 1200);
+      reloadPageAfterSelfUpdate();
+      return;
+    }
+
+    logger.error('[MANAGER]', 'runNetshiftSelfUpdate failed', result);
+    showToast(result.message || _('Failed to execute!'), 'error');
+    setActionLoading(button.loadingKey, false);
+  } catch (error) {
+    logger.error('[MANAGER]', 'runNetshiftSelfUpdate failed', error);
+    showToast(_('Failed to execute!'), 'error');
+    setActionLoading(button.loadingKey, false);
+  }
+}
+
+function handleManagerAction(
+  card: ManagerCardDescriptor,
+  button: ManagerActionDescriptor,
+) {
+  if (isAnyActionLoading()) {
+    return;
+  }
+
+  if (button.kind === 'check_netshift') {
+    void runNetshiftCheck(button);
+    return;
+  }
+
+  if (button.kind === 'check') {
+    void runSingBoxCheck(card.key, button);
+    return;
+  }
+
+  if (button.kind === 'self_update') {
+    void runNetshiftSelfUpdate(button);
+    return;
+  }
+
+  // `update` / `switch` — both drive the async sing-box install contract.
+  void runSingBoxMutation(card.key, button);
+}
+
+function renderComponentTag(card: ManagerCardDescriptor) {
+  if (!card.tag) {
+    return null;
+  }
+
+  return E(
+    'span',
+    {
+      class: [
+        'pdk_manager-page__component__tag',
+        card.tag.kind === 'success'
+          ? 'pdk_manager-page__component__tag--success'
+          : '',
+        card.tag.kind === 'warning'
+          ? 'pdk_manager-page__component__tag--warning'
+          : '',
+      ]
+        .filter(Boolean)
+        .join(' '),
+    },
+    card.tag.label,
+  );
+}
+
+function renderComponentCard(card: ManagerCardDescriptor) {
+  const managerActions = store.get().managerActions;
+  const anyActionLoading = isAnyActionLoading();
+  const systemInfoLoading = isSystemInfoLoading();
+  const tag = renderComponentTag(card);
+  const headerChildren: Node[] = [
+    E('b', { class: 'pdk_manager-page__component__title' }, card.title),
+  ];
+
+  if (tag) {
+    headerChildren.push(
+      E('div', { class: 'pdk_manager-page__component__status' }, [tag]),
+    );
+  }
+
+  return E('div', { class: 'card pdk_manager-page__component' }, [
+    E('div', { class: 'pdk_manager-page__component__header' }, headerChildren),
+    E('div', { class: 'pdk_manager-page__component__version' }, [
+      E(
+        'span',
+        { class: 'pdk_manager-page__component__version__label' },
+        _('Version'),
+      ),
+      E(
+        'span',
+        { class: 'pdk_manager-page__component__version__value' },
+        card.version,
+      ),
+    ]),
+    E(
+      'div',
+      { class: 'pdk_manager-page__component__actions' },
+      card.actions.map((action) => {
+        const loading = managerActions[action.loadingKey].loading;
+
+        return renderButton({
+          text: action.text,
+          icon:
+            action.kind === 'check' || action.kind === 'check_netshift'
+              ? renderSearchIcon24
+              : renderRotateCcwIcon24,
+          loading,
+          disabled: systemInfoLoading || (anyActionLoading && !loading),
+          onClick: () => handleManagerAction(card, action),
+        });
+      }),
+    ),
+  ]);
+}
+
+function renderManagerComponents() {
+  const container = document.getElementById('pdk_manager-components');
+
+  if (!container) {
+    return;
+  }
+
+  const { diagnosticsSystemInfo, managerChecks } = store.get();
+  const renderedComponents = getComponentCards(
+    {
+      netshift_version: normalizeCompiledVersion(
+        diagnosticsSystemInfo.netshift_version,
+      ),
+      netshift_latest_version: diagnosticsSystemInfo.netshift_latest_version,
+      sing_box_version: diagnosticsSystemInfo.sing_box_version,
+      sing_box_extended: diagnosticsSystemInfo.sing_box_extended,
+    },
+    managerChecks,
+  ).map(renderComponentCard);
+
+  return preserveScrollForPage(() => {
+    container.replaceChildren(...renderedComponents);
+  });
+}
+
+function onStoreUpdate(
+  _next: StoreType,
+  _prev: StoreType,
+  diff: Partial<StoreType>,
+) {
+  if (diff.diagnosticsSystemInfo || diff.managerActions || diff.managerChecks) {
+    renderManagerComponents();
+  }
+}
+
+function onPageMount() {
+  onPageUnmount();
+
+  managerMounted = true;
+  store.subscribe(onStoreUpdate);
+  renderManagerComponents();
+  void fetchSystemInfo();
+}
+
+function onPageUnmount() {
+  managerMounted = false;
+  store.unsubscribe(onStoreUpdate);
+  store.reset(['managerActions', 'managerChecks']);
+}
+
+function registerLifecycleListeners() {
+  if (managerLifecycleRegistered) {
+    return;
+  }
+
+  managerLifecycleRegistered = true;
+
+  store.subscribe((next, prev, diff) => {
+    if (
+      diff.tabService &&
+      next.tabService.current !== prev.tabService.current
+    ) {
+      const isManagerVisible = next.tabService.current === 'manager';
+
+      if (isManagerVisible) {
+        return onPageMount();
+      }
+
+      if (managerMounted) {
+        return onPageUnmount();
+      }
+    }
+  });
+}
+
+export async function initController(): Promise<void> {
+  if (managerControllerInitialized) {
+    return;
+  }
+
+  managerControllerInitialized = true;
+
+  onMount('manager-status').then(() => {
+    logger.debug('[MANAGER]', 'initController', 'onMount');
+    registerLifecycleListeners();
+
+    if (store.get().tabService.current === 'manager') {
+      onPageMount();
+    }
+  });
+}
diff --git a/fe-app-netshift/src/netshift/tabs/manager/manager.store.ts b/fe-app-netshift/src/netshift/tabs/manager/manager.store.ts
new file mode 100644
index 00000000..54df338b
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/manager.store.ts
@@ -0,0 +1,20 @@
+import { StoreType } from '../../services';
+
+export const initialManagerStore: Pick<
+  StoreType,
+  'managerActions' | 'managerChecks'
+> = {
+  managerActions: {
+    netshiftCheck: { loading: false },
+    netshiftUpdate: { loading: false },
+    singBoxStockCheck: { loading: false },
+    singBoxStockAction: { loading: false },
+    singBoxExtendedCheck: { loading: false },
+    singBoxExtendedAction: { loading: false },
+  },
+  managerChecks: {
+    netshift: { status: null, latest_version: '' },
+    sing_box_stock: { status: null, latest_version: '' },
+    sing_box_extended: { status: null, latest_version: '' },
+  },
+};
diff --git a/fe-app-netshift/src/netshift/tabs/manager/render.ts b/fe-app-netshift/src/netshift/tabs/manager/render.ts
new file mode 100644
index 00000000..5c140930
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/render.ts
@@ -0,0 +1,8 @@
+export function render() {
+  return E('div', { id: 'manager-status', class: 'pdk_manager-page' }, [
+    E('div', {
+      id: 'pdk_manager-components',
+      class: 'pdk_manager-page__components',
+    }),
+  ]);
+}
diff --git a/fe-app-netshift/src/netshift/tabs/manager/styles.ts b/fe-app-netshift/src/netshift/tabs/manager/styles.ts
new file mode 100644
index 00000000..558c74a0
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/styles.ts
@@ -0,0 +1,105 @@
+// language=CSS
+export const styles = `
+#cbi-netshift-manager-_mount_node > div {
+    width: 100%;
+}
+
+#cbi-netshift-manager > h3 {
+    display: none;
+}
+
+.pdk_manager-page {
+    width: 100%;
+}
+
+.pdk_manager-page__components {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(240px, 1fr));
+    grid-gap: 10px;
+}
+
+@media (max-width: 760px) {
+    .pdk_manager-page__components {
+        grid-template-columns: 1fr;
+    }
+}
+
+.pdk_manager-page__component {
+    display: grid;
+    grid-template-columns: 1fr;
+    grid-row-gap: 10px;
+}
+
+.pdk_manager-page__component__header {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, auto);
+    align-items: start;
+    gap: 8px;
+    min-width: 0;
+}
+
+.pdk_manager-page__component__title {
+    color: var(--text-color-high);
+    line-height: 1.25;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.pdk_manager-page__component__status {
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 6px;
+    min-width: 0;
+    max-width: 180px;
+    overflow: hidden;
+}
+
+.pdk_manager-page__component__version {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    grid-column-gap: 6px;
+    align-items: baseline;
+    min-width: 0;
+}
+
+.pdk_manager-page__component__version__label {
+    color: var(--text-color-medium);
+}
+
+.pdk_manager-page__component__version__value {
+    min-width: 0;
+    overflow-wrap: anywhere;
+}
+
+.pdk_manager-page__component__tag {
+    flex: 0 0 auto;
+    padding: 2px 5px;
+    border: 1px var(--background-color-high, gray) solid;
+    border-radius: 4px;
+    color: var(--text-color-medium, gray);
+    line-height: 1.2;
+}
+
+.pdk_manager-page__component__tag--success {
+    border-color: var(--success-color-medium, green);
+    color: var(--success-color-medium, green);
+}
+
+.pdk_manager-page__component__tag--warning {
+    border-color: var(--warn-color-medium, orange);
+    color: var(--warn-color-medium, orange);
+}
+
+.pdk_manager-page__component__actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+}
+
+.pdk_manager-page__component__actions > .pdk-partial-button {
+    margin-left: 0;
+}
+`;
diff --git a/fe-app-netshift/src/netshift/tabs/manager/tests/cards.test.js b/fe-app-netshift/src/netshift/tabs/manager/tests/cards.test.js
new file mode 100644
index 00000000..e5d69486
--- /dev/null
+++ b/fe-app-netshift/src/netshift/tabs/manager/tests/cards.test.js
@@ -0,0 +1,215 @@
+import { describe, expect, it } from 'vitest';
+import { getCheckTag, getComponentCards, isSingBoxInstalled } from '../cards';
+
+const emptyChecks = {
+  netshift: { status: null, latest_version: '' },
+  sing_box_stock: { status: null, latest_version: '' },
+  sing_box_extended: { status: null, latest_version: '' },
+};
+
+function makeSystemInfo(patch = {}) {
+  return {
+    netshift_version: '1.0.0',
+    netshift_latest_version: '1.0.0',
+    sing_box_version: '1.12.0',
+    sing_box_extended: 0,
+    ...patch,
+  };
+}
+
+describe('getCheckTag', () => {
+  it.each([
+    ['latest', { label: 'Latest', kind: 'success' }],
+    ['outdated', { label: 'Outdated', kind: 'warning' }],
+    ['dev', { label: 'Dev', kind: 'neutral' }],
+    ['not_installed', { label: 'Not installed', kind: 'neutral' }],
+  ])('maps status %s to the right badge', (status, expected) => {
+    expect(getCheckTag(status)).toEqual(expected);
+  });
+
+  it('returns undefined for a null status', () => {
+    expect(getCheckTag(null)).toBeUndefined();
+  });
+});
+
+describe('isSingBoxInstalled', () => {
+  it.each([
+    ['1.12.0', true],
+    ['not installed', false],
+    ['', false],
+  ])('treats %s as installed=%s', (version, expected) => {
+    expect(
+      isSingBoxInstalled(makeSystemInfo({ sing_box_version: version })),
+    ).toBe(expected);
+  });
+});
+
+describe('getComponentCards', () => {
+  it('always builds exactly three cards in order', () => {
+    const cards = getComponentCards(makeSystemInfo(), emptyChecks);
+
+    expect(cards.map((c) => c.key)).toEqual([
+      'netshift',
+      'sing_box_stock',
+      'sing_box_extended',
+    ]);
+  });
+
+  it('shows the stock card as installed/active when sing_box_extended=0', () => {
+    const cards = getComponentCards(
+      makeSystemInfo({ sing_box_extended: 0, sing_box_version: '1.12.0' }),
+      emptyChecks,
+    );
+    const [, stock, extended] = cards;
+
+    expect(stock.installed).toBe(true);
+    expect(stock.version).toBe('1.12.0');
+    // No check yet → no badge for the active card.
+    expect(stock.tag).toBeUndefined();
+    expect(stock.actions[0].kind).toBe('check');
+    expect(stock.actions[0].backendAction).toBe('check_update_stable');
+
+    // Inactive extended card → "Not installed" + switch-to-extended.
+    expect(extended.installed).toBe(false);
+    expect(extended.version).toBe('Not installed');
+    expect(extended.actions[0].kind).toBe('switch');
+    expect(extended.actions[0].backendAction).toBe('install_extended');
+  });
+
+  it('mirrors the layout when sing_box_extended=1', () => {
+    const cards = getComponentCards(
+      makeSystemInfo({ sing_box_extended: 1, sing_box_version: '1.12.5' }),
+      emptyChecks,
+    );
+    const [, stock, extended] = cards;
+
+    expect(extended.installed).toBe(true);
+    expect(extended.actions[0].backendAction).toBe('check_update');
+
+    expect(stock.installed).toBe(false);
+    expect(stock.actions[0].kind).toBe('switch');
+    expect(stock.actions[0].backendAction).toBe('install_stable');
+  });
+
+  it('offers switch-to on both cores when sing-box is absent', () => {
+    const cards = getComponentCards(
+      makeSystemInfo({ sing_box_version: 'not installed' }),
+      emptyChecks,
+    );
+    const [, stock, extended] = cards;
+
+    expect(stock.installed).toBe(false);
+    expect(stock.actions[0].kind).toBe('switch');
+    expect(extended.installed).toBe(false);
+    expect(extended.actions[0].kind).toBe('switch');
+  });
+
+  it('turns an outdated stock check into an Install %s update action', () => {
+    const cards = getComponentCards(
+      makeSystemInfo({ sing_box_extended: 0, sing_box_version: '1.12.0' }),
+      {
+        ...emptyChecks,
+        sing_box_stock: { status: 'outdated', latest_version: '1.12.9' },
+      },
+    );
+    const stock = cards[1];
+
+    expect(stock.tag).toEqual({ label: 'Outdated', kind: 'warning' });
+    expect(stock.actions[0].kind).toBe('update');
+    expect(stock.actions[0].backendAction).toBe('install_stable');
+    expect(stock.actions[0].text).toBe('Install 1.12.9');
+  });
+
+  it('is neutral until checked — null managerChecks.netshift status', () => {
+    // task-030: mount does NO network check; managerChecks.netshift.status is
+    // null → no badge, the "Check update" action (no outdated/update button).
+    const cards = getComponentCards(makeSystemInfo(), emptyChecks);
+    const netshift = cards[0];
+
+    expect(netshift.tag).toBeUndefined();
+    expect(netshift.actions[0].kind).toBe('check_netshift');
+    expect(netshift.actions[0].backendAction).toBe('check_update');
+  });
+
+  it('derives an outdated NetShift card from the on-demand check result', () => {
+    // task-030: status comes from managerChecks.netshift (the check result), NOT
+    // from a systemInfo installed-vs-latest string compare. The latest_version
+    // for the "Install %s" text also comes from the check result.
+    const cards = getComponentCards(
+      makeSystemInfo({
+        netshift_version: '1.0.0',
+        netshift_latest_version: '1.0.0',
+      }),
+      {
+        ...emptyChecks,
+        netshift: { status: 'outdated', latest_version: '1.1.0' },
+      },
+    );
+    const netshift = cards[0];
+
+    expect(netshift.tag).toEqual({ label: 'Outdated', kind: 'warning' });
+    expect(netshift.actions[0].kind).toBe('self_update');
+    expect(netshift.actions[0].backendAction).toBe('self_update');
+    expect(netshift.actions[0].text).toBe('Install 1.1.0');
+  });
+
+  it('shows the Latest badge + Check update when the check says latest', () => {
+    const cards = getComponentCards(makeSystemInfo(), {
+      ...emptyChecks,
+      netshift: { status: 'latest', latest_version: '1.0.0' },
+    });
+    const netshift = cards[0];
+
+    expect(netshift.tag).toEqual({ label: 'Latest', kind: 'success' });
+    // The NetShift check is a DISTINCT kind so it can never be routed to the
+    // sing-box check method.
+    expect(netshift.actions[0].kind).toBe('check_netshift');
+  });
+
+  it('NetShift check action carries its own (non-sing-box) backendAction', () => {
+    // The NetShift "Check update" routes to runNetshiftCheck (distinct kind) and
+    // calls `component_action netshift check_update` — NOT a sing-box check
+    // action. Guard against accidentally reusing a sing-box check action.
+    const cards = getComponentCards(makeSystemInfo(), emptyChecks);
+    const netshift = cards[0];
+
+    expect(netshift.actions[0].kind).toBe('check_netshift');
+    expect(netshift.actions[0].backendAction).toBe('check_update');
+    expect(['check_update_stable']).not.toContain(
+      netshift.actions[0].backendAction,
+    );
+  });
+
+  it('keeps a dev build neutral even if a check result says outdated', () => {
+    // The dev-build guard: a placeholder/dev install never shows an update
+    // prompt regardless of any check result.
+    const cards = getComponentCards(
+      makeSystemInfo({ netshift_version: 'COMPILED_VERSION' }),
+      {
+        ...emptyChecks,
+        netshift: { status: 'outdated', latest_version: '9.9.9' },
+      },
+    );
+    const netshift = cards[0];
+
+    expect(netshift.version).toBe('dev');
+    expect(netshift.tag).toBeUndefined();
+    expect(netshift.actions[0].kind).toBe('check_netshift');
+  });
+
+  it('ignores systemInfo netshift_latest_version for status (now on-demand)', () => {
+    // task-030: a stale/unknown systemInfo latest must NOT drive the badge — only
+    // the on-demand managerChecks.netshift result does.
+    const cards = getComponentCards(
+      makeSystemInfo({
+        netshift_version: '1.0.0',
+        netshift_latest_version: '9.9.9',
+      }),
+      emptyChecks,
+    );
+    const netshift = cards[0];
+
+    expect(netshift.tag).toBeUndefined();
+    expect(netshift.actions[0].kind).toBe('check_netshift');
+  });
+});
diff --git a/fe-app-podkop/src/podkop/types.ts b/fe-app-netshift/src/netshift/types.ts
similarity index 72%
rename from fe-app-podkop/src/podkop/types.ts
rename to fe-app-netshift/src/netshift/types.ts
index fff03c5d..bae558b1 100644
--- a/fe-app-podkop/src/podkop/types.ts
+++ b/fe-app-netshift/src/netshift/types.ts
@@ -20,30 +20,30 @@ export namespace ClashAPI {
 }
 
 // eslint-disable-next-line @typescript-eslint/no-namespace
-export namespace Podkop {
+export namespace NetShift {
   // Available commands:
-  // start                   Start podkop service
-  // stop                    Stop podkop service
-  // reload                  Reload podkop configuration
-  // restart                 Restart podkop service
-  // enable                  Enable podkop autostart
-  // disable                 Disable podkop autostart
-  // main                    Run main podkop process
+  // start                   Start netshift service
+  // stop                    Stop netshift service
+  // reload                  Reload netshift configuration
+  // restart                 Restart netshift service
+  // enable                  Enable netshift autostart
+  // disable                 Disable netshift autostart
+  // main                    Run main netshift process
   // list_update             Update domain lists
   // check_proxy             Check proxy connectivity
   // check_nft               Check NFT rules
   // check_nft_rules         Check NFT rules status
   // check_sing_box          Check sing-box installation and status
-  // check_logs              Show podkop logs from system journal
+  // check_logs              Show netshift logs from system journal
   // check_sing_box_logs     Show sing-box logs
   // check_fakeip            Test FakeIP on router
   // clash_api               Clash API interface for managing proxies and groups
-  // show_config             Display current podkop configuration
-  // show_version            Show podkop version
+  // show_config             Display current netshift configuration
+  // show_version            Show netshift version
   // show_sing_box_config    Show sing-box configuration
   // show_sing_box_version   Show sing-box version
   // show_system_info        Show system information
-  // get_status              Get podkop service status
+  // get_status              Get netshift service status
   // get_sing_box_status     Get sing-box service status
   // check_dns_available     Check DNS server availability
   // global_check            Run global system check
@@ -65,6 +65,7 @@ export namespace Podkop {
     SHOW_SING_BOX_CONFIG = 'show_sing_box_config',
     CHECK_LOGS = 'check_logs',
     GET_SYSTEM_INFO = 'get_system_info',
+    SUBSCRIPTION_UPDATE = 'subscription_update',
   }
 
   export enum AvailableClashAPIMethods {
@@ -113,6 +114,18 @@ export namespace Podkop {
     outbound_json: string;
   }
 
+  export interface ConfigProxySubscriptionSection {
+    connection_type: 'proxy';
+    proxy_config_type: 'subscription';
+    subscription_url: string[];
+    subscription_format_preference?: 'auto' | 'xray' | 'singbox';
+    subscription_update_interval?: string;
+    subscription_group_mode?: 'off' | 'country' | 'prefix';
+    subscription_group_prefix_len?: string;
+    subscription_filter_include_keywords?: string[];
+    subscription_filter_exclude_keywords?: string[];
+  }
+
   export interface ConfigVpnSection {
     connection_type: 'vpn';
     interface: string;
@@ -131,6 +144,7 @@ export namespace Podkop {
     | ConfigProxySelectorSection
     | ConfigProxyUrlSection
     | ConfigProxyOutboundSection
+    | ConfigProxySubscriptionSection
     | ConfigVpnSection
     | ConfigBlockSection
     | ConfigExclusionSection;
@@ -163,6 +177,7 @@ export namespace Podkop {
     bootstrap_dns_server: string;
     bootstrap_dns_status: 0 | 1;
     dhcp_config_status: 0 | 1;
+    dns_via_outbound_tag?: string;
   }
 
   export interface NftRulesCheckResult {
@@ -170,7 +185,6 @@ export namespace Podkop {
     rules_mangle_exist: 0 | 1;
     rules_mangle_counters: 0 | 1;
     rules_mangle_output_exist: 0 | 1;
-    rules_mangle_output_counters: 0 | 1;
     rules_proxy_exist: 0 | 1;
     rules_proxy_counters: 0 | 1;
     rules_other_mark_exist: 0 | 1;
@@ -202,12 +216,13 @@ export namespace Podkop {
   }
 
   export interface GetSystemInfo {
-    podkop_version: string;
-    podkop_latest_version: string;
+    netshift_version: string;
+    netshift_latest_version: string;
     luci_app_version: string;
     sing_box_version: string;
     openwrt_version: string;
     device_model: string;
+    sing_box_extended: 0 | 1;
   }
 
   export interface GetClashApiProxyLatency {
@@ -216,4 +231,23 @@ export namespace Podkop {
   }
 
   export type GetClashApiGroupLatency = Record<string, number>;
+
+  // Component Manager (task-018) — consumes the STABLE backend contract from
+  // task-017. Status union returned by the sync update-check actions.
+  export type ComponentUpdateStatus =
+    | 'latest'
+    | 'outdated'
+    | 'dev'
+    | 'not_installed';
+
+  // Shape echoed by the sync update-check actions:
+  //   component_action sing_box check_update        (extended)
+  //   component_action sing_box check_update_stable (stock)
+  export interface ComponentCheckUpdateResult {
+    success: boolean;
+    current_version?: string;
+    latest_version?: string;
+    status?: ComponentUpdateStatus;
+    message?: string;
+  }
 }
diff --git a/fe-app-podkop/src/partials/button/renderButton.ts b/fe-app-netshift/src/partials/button/renderButton.ts
similarity index 100%
rename from fe-app-podkop/src/partials/button/renderButton.ts
rename to fe-app-netshift/src/partials/button/renderButton.ts
diff --git a/fe-app-podkop/src/partials/button/styles.ts b/fe-app-netshift/src/partials/button/styles.ts
similarity index 100%
rename from fe-app-podkop/src/partials/button/styles.ts
rename to fe-app-netshift/src/partials/button/styles.ts
diff --git a/fe-app-podkop/src/partials/index.ts b/fe-app-netshift/src/partials/index.ts
similarity index 100%
rename from fe-app-podkop/src/partials/index.ts
rename to fe-app-netshift/src/partials/index.ts
diff --git a/fe-app-podkop/src/partials/modal/renderModal.ts b/fe-app-netshift/src/partials/modal/renderModal.ts
similarity index 100%
rename from fe-app-podkop/src/partials/modal/renderModal.ts
rename to fe-app-netshift/src/partials/modal/renderModal.ts
diff --git a/fe-app-podkop/src/partials/modal/styles.ts b/fe-app-netshift/src/partials/modal/styles.ts
similarity index 100%
rename from fe-app-podkop/src/partials/modal/styles.ts
rename to fe-app-netshift/src/partials/modal/styles.ts
diff --git a/fe-app-netshift/src/styles.ts b/fe-app-netshift/src/styles.ts
new file mode 100644
index 00000000..4cee85c2
--- /dev/null
+++ b/fe-app-netshift/src/styles.ts
@@ -0,0 +1,189 @@
+// language=CSS
+import { DashboardTab, DiagnosticTab, ManagerTab } from './netshift';
+import { PartialStyles } from './partials';
+
+export const GlobalStyles = `
+/*
+ * NetShift design tokens (Stage 1 foundation — task-024).
+ * Each token layers over the LuCI theme var (with a hardcoded fallback) so
+ * themes still win. Reused by the custom tabs and the form redesigns
+ * (task-025/026). Keep these names stable.
+ */
+:root,
+.cbi-map {
+    --ns-card-border: var(--background-color-low, lightgray);
+    --ns-card-border-width: 2px;
+    --ns-card-radius: 4px;
+    --ns-gap: 10px;
+    --ns-card-padding: var(--ns-gap);
+    --ns-success: var(--success-color-medium, #28a745);
+    --ns-warning: var(--warn-color-medium, #f0ad4e);
+    --ns-error: var(--error-color-medium, #dc3545);
+    --ns-info: var(--primary-color-high, #2196f3);
+}
+
+/*
+ * Shared card primitive. Mirrors the Manager component card look
+ * (2px solid border, 4px radius, 10px padding, overflow-safe min-width:0).
+ * Defined BEFORE the per-tab styles so colored-border modifiers
+ * (e.g. .pdk_diagnostic_alert--warning) still win via source order.
+ */
+.card {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
+${DashboardTab.styles}
+${DiagnosticTab.styles}
+${ManagerTab.styles}
+${PartialStyles}
+
+
+/* Hide extra H3 for settings tab */
+#cbi-netshift-settings > h3 {
+    display: none;
+}
+
+/* Hide extra H3 for sections tab */
+#cbi-netshift-section > h3:nth-child(1) {
+    display: none;
+}
+
+/* Vertical align for remove section action button */
+#cbi-netshift-section > .cbi-section-remove {
+    margin-bottom: -32px;
+}
+
+/*
+ * Sections (connection) form — native CBI option-group tabs styled as a
+ * card (task-025). Reuses task-024's --ns-* tokens. The tab strip
+ * (ul.cbi-tabmenu) sits on top; each tab pane (.cbi-section-node-tabbed)
+ * reads as the card body. depends()-driven auto-hide of tabs is unaffected.
+ */
+#cbi-netshift-section .cbi-section-node-tabbed {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
+#cbi-netshift-section ul.cbi-tabmenu {
+    margin-bottom: var(--ns-gap);
+}
+
+/*
+ * Settings form — native CBI option-group tabs styled as a card (task-026).
+ * Reuses task-024's --ns-* tokens and mirrors the #cbi-netshift-section
+ * pattern above. The tab strip (ul.cbi-tabmenu) sits on top; each tab pane
+ * (.cbi-section-node-tabbed) reads as the card body. depends()-driven
+ * auto-hide of tabs is unaffected. The existing
+ * #cbi-netshift-settings > h3 hide rule above stays valid.
+ */
+#cbi-netshift-settings .cbi-section-node-tabbed {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
+#cbi-netshift-settings ul.cbi-tabmenu {
+    margin-bottom: var(--ns-gap);
+}
+
+/* Centered class helper */
+.centered {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+}
+
+/* Rotate class helper */
+.rotate {
+    animation: spin 1s linear infinite;
+}
+
+@keyframes spin {
+    from { transform: rotate(0deg); }
+    to { transform: rotate(360deg); }
+}
+
+/* Skeleton styles*/
+.skeleton {
+    background-color: var(--background-color-low, #e0e0e0);
+    border-radius: 4px;
+    position: relative;
+    overflow: hidden;
+}
+
+.skeleton::after {
+    content: '';
+    position: absolute;
+    top: 0;
+    left: -150%;
+    width: 150%;
+    height: 100%;
+    background: linear-gradient(
+            90deg,
+            transparent,
+            rgba(255, 255, 255, 0.4),
+            transparent
+    );
+    animation: skeleton-shimmer 1.6s infinite;
+}
+
+@keyframes skeleton-shimmer {
+    100% {
+        left: 150%;
+    }
+}
+/* Toast */
+.toast-container {
+    position: fixed;
+    bottom: 30px;
+    left: 50%;
+    transform: translateX(-50%);
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 10px;
+    z-index: 9999;
+    font-family: system-ui, sans-serif;
+}
+
+.toast {
+    opacity: 0;
+    transform: translateY(10px);
+    transition: opacity 0.3s ease, transform 0.3s ease;
+    padding: 10px 16px;
+    border-radius: 6px;
+    color: #fff;
+    font-size: 14px;
+    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.2);
+    min-width: 220px;
+    max-width: 340px;
+    text-align: center;
+}
+
+.toast-success {
+    background-color: var(--ns-success, #28a745);
+}
+
+.toast-error {
+    background-color: var(--ns-error, #dc3545);
+}
+
+.toast-warning {
+    background-color: var(--ns-warning, #f0ad4e);
+}
+
+.toast-info {
+    background-color: var(--ns-info, #2196f3);
+}
+
+.toast.visible {
+    opacity: 1;
+    transform: translateY(0);
+}
+`;
diff --git a/fe-app-podkop/src/validators/bulkValidate.ts b/fe-app-netshift/src/validators/bulkValidate.ts
similarity index 100%
rename from fe-app-podkop/src/validators/bulkValidate.ts
rename to fe-app-netshift/src/validators/bulkValidate.ts
diff --git a/fe-app-podkop/src/validators/index.ts b/fe-app-netshift/src/validators/index.ts
similarity index 100%
rename from fe-app-podkop/src/validators/index.ts
rename to fe-app-netshift/src/validators/index.ts
diff --git a/fe-app-podkop/src/validators/tests/validateDns.test.js b/fe-app-netshift/src/validators/tests/validateDns.test.js
similarity index 69%
rename from fe-app-podkop/src/validators/tests/validateDns.test.js
rename to fe-app-netshift/src/validators/tests/validateDns.test.js
index bd105b1c..9fa72c9c 100644
--- a/fe-app-podkop/src/validators/tests/validateDns.test.js
+++ b/fe-app-netshift/src/validators/tests/validateDns.test.js
@@ -12,11 +12,23 @@ export const additionalValidDns = [
   ['DoH IP with port 443', '1.1.1.1:443/dns-query'],
   ['DoH domain', 'cloudflare-dns.com/dns-query'],
   ['DoH domain with port 443', 'cloudflare-dns.com:443/dns-query'],
+  ['IPv6 address', '2001:db8::1'],
+  ['Bracketed IPv6', '[2001:db8::1]'],
+  ['Bracketed IPv6 with port', '[2001:db8::1]:853'],
+  ['IPv6 DoH path', '2001:db8::1/dns-query'],
+  ['Bracketed IPv6 DoH path with port', '[2001:db8::1]:443/dns-query'],
+];
+
+export const additionalInvalidDns = [
+  ['IPv6 invalid hex', '2001:db8::zzzz'],
+  ['IPv6 group too long', '12345::1'],
+  ['IPv6 triple colon only', ':::'],
+  ['IPv6 multiple compressions', '1::2::3'],
 ];
 
 const validDns = [...validIPs, ...validDomains, ...additionalValidDns];
 
-const invalidDns = [...invalidIPs, ...invalidDomains];
+const invalidDns = [...invalidIPs, ...invalidDomains, ...additionalInvalidDns];
 
 describe('validateDns', () => {
   describe.each(validDns)('Valid dns: %s', (_desc, domain) => {
diff --git a/fe-app-podkop/src/validators/tests/validateDomain.test.js b/fe-app-netshift/src/validators/tests/validateDomain.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateDomain.test.js
rename to fe-app-netshift/src/validators/tests/validateDomain.test.js
diff --git a/fe-app-podkop/src/validators/tests/validateHysteriaUrl.test.js b/fe-app-netshift/src/validators/tests/validateHysteriaUrl.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateHysteriaUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateHysteriaUrl.test.js
diff --git a/fe-app-netshift/src/validators/tests/validateIp.test.js b/fe-app-netshift/src/validators/tests/validateIp.test.js
new file mode 100644
index 00000000..d44913a9
--- /dev/null
+++ b/fe-app-netshift/src/validators/tests/validateIp.test.js
@@ -0,0 +1,99 @@
+import { describe, it, expect } from 'vitest';
+import { validateIP, validateIPV4, validateIPV6 } from '../validateIp';
+
+export const validIPs = [
+  ['Private LAN', '192.168.1.1'],
+  ['All zeros', '0.0.0.0'],
+  ['Broadcast', '255.255.255.255'],
+  ['Simple', '1.2.3.4'],
+  ['Loopback', '127.0.0.1'],
+];
+
+export const invalidIPs = [
+  ['Octet too large', '256.0.0.1'],
+  ['Too few octets', '192.168.1'],
+  ['Too many octets', '1.2.3.4.5'],
+  ['Leading zero (1st octet)', '01.2.3.4'],
+  ['Leading zero (2nd octet)', '1.02.3.4'],
+  ['Leading zero (3rd octet)', '1.2.003.4'],
+  ['Leading zero (4th octet)', '1.2.3.004'],
+  ['Four digits in octet', '1.2.3.0004'],
+  ['Trailing dot', '1.2.3.'],
+];
+
+export const validIPv6 = [
+  ['Loopback', '::1'],
+  ['Compressed', '2001:db8::1'],
+  ['Full form', '2001:0db8:85a3:0000:0000:8a2e:0370:7334'],
+  ['Bracketed', '[2001:db8::1]'],
+  ['Unspecified', '::'],
+  ['Compressed middle', '2001:db8:0:0:1::1'],
+  ['IPv4-mapped', '::ffff:192.168.1.1'],
+  ['IPv4-embedded', '2001:db8::192.168.1.1'],
+];
+
+export const invalidIPv6 = [
+  ['Invalid hex', '2001:db8::zzzz'],
+  ['Group too long', '12345::1'],
+  ['Too many groups', '2001:db8:85a3:0:0:8a2e:370:7334:1234'],
+  ['Triple colon only', ':::'],
+  ['Colon run inside', '1:2:::3'],
+  ['Multiple compressions', '1::2::3'],
+  ['Incomplete (7 groups, no ::)', '1:2:3:4:5:6:7'],
+  ['Bad hex group', 'gggg::1'],
+  ['Too many groups (9)', '1:2:3:4:5:6:7:8:9'],
+];
+
+describe('validateIPV4', () => {
+  describe.each(validIPs)('Valid IP: %s', (_desc, ip) => {
+    it(`returns {valid:true} for "${ip}"`, () => {
+      const res = validateIPV4(ip);
+      expect(res.valid).toBe(true);
+    });
+  });
+
+  describe.each(invalidIPs)('Invalid IP: %s', (_desc, ip) => {
+    it(`returns {valid:false} for "${ip}"`, () => {
+      const res = validateIPV4(ip);
+      expect(res.valid).toBe(false);
+    });
+  });
+});
+
+describe('validateIPV6', () => {
+  describe.each(validIPv6)('Valid IPv6: %s', (_desc, ip) => {
+    it(`returns {valid:true} for "${ip}"`, () => {
+      const res = validateIPV6(ip);
+      expect(res.valid).toBe(true);
+    });
+  });
+
+  describe.each([...invalidIPv6, ['IPv4 address', '192.168.1.1']])(
+    'Invalid IPv6: %s',
+    (_desc, ip) => {
+      it(`returns {valid:false} for "${ip}"`, () => {
+        const res = validateIPV6(ip);
+        expect(res.valid).toBe(false);
+      });
+    },
+  );
+});
+
+describe('validateIP', () => {
+  describe.each([...validIPs, ...validIPv6])('Valid IP: %s', (_desc, ip) => {
+    it(`returns {valid:true} for "${ip}"`, () => {
+      const res = validateIP(ip);
+      expect(res.valid).toBe(true);
+    });
+  });
+
+  describe.each([...invalidIPs, ...invalidIPv6])(
+    'Invalid IP: %s',
+    (_desc, ip) => {
+      it(`returns {valid:false} for "${ip}"`, () => {
+        const res = validateIP(ip);
+        expect(res.valid).toBe(false);
+      });
+    },
+  );
+});
diff --git a/fe-app-podkop/src/validators/tests/validatePath.test.js b/fe-app-netshift/src/validators/tests/validatePath.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validatePath.test.js
rename to fe-app-netshift/src/validators/tests/validatePath.test.js
diff --git a/fe-app-podkop/src/validators/tests/validateShadowsocksUrl.test.js b/fe-app-netshift/src/validators/tests/validateShadowsocksUrl.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateShadowsocksUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateShadowsocksUrl.test.js
diff --git a/fe-app-podkop/src/validators/tests/validateSocksUrl.test.js b/fe-app-netshift/src/validators/tests/validateSocksUrl.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateSocksUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateSocksUrl.test.js
diff --git a/fe-app-podkop/src/validators/tests/validateSubnet.test.js b/fe-app-netshift/src/validators/tests/validateSubnet.test.js
similarity index 74%
rename from fe-app-podkop/src/validators/tests/validateSubnet.test.js
rename to fe-app-netshift/src/validators/tests/validateSubnet.test.js
index 13621b74..0ad92ade 100644
--- a/fe-app-podkop/src/validators/tests/validateSubnet.test.js
+++ b/fe-app-netshift/src/validators/tests/validateSubnet.test.js
@@ -8,6 +8,10 @@ export const validSubnets = [
   ['CIDR /32', '172.16.0.1/32'],
   ['Loopback', '127.0.0.1'],
   ['Broadcast with mask', '255.255.255.255/32'],
+  ['IPv6 loopback', '::1'],
+  ['IPv6 with CIDR /0', '::/0'],
+  ['IPv6 with CIDR /32', '2001:db8::/32'],
+  ['IPv6 with CIDR /128', '2001:db8::1/128'],
 ];
 
 export const invalidSubnets = [
@@ -22,6 +26,12 @@ export const invalidSubnets = [
   ['Invalid CIDR (negative)', '192.168.1.1/-1'],
   ['CIDR not number', '192.168.1.1/abc'],
   ['Forbidden 0.0.0.0', '0.0.0.0'],
+  ['IPv6 invalid hex', '2001:db8::zzzz'],
+  ['IPv6 CIDR too high', '2001:db8::1/129'],
+  ['IPv6 CIDR negative', '2001:db8::1/-1'],
+  ['IPv6 CIDR not number', '2001:db8::1/abc'],
+  ['IPv6 triple colon with CIDR', ':::/64'],
+  ['IPv6 multiple compressions with CIDR', '1::2::3/64'],
 ];
 
 describe('validateSubnet', () => {
diff --git a/fe-app-podkop/src/validators/tests/validateTrojanUrl.test.js b/fe-app-netshift/src/validators/tests/validateTrojanUrl.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateTrojanUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateTrojanUrl.test.js
diff --git a/fe-app-podkop/src/validators/tests/validateUrl.test.js b/fe-app-netshift/src/validators/tests/validateUrl.test.js
similarity index 79%
rename from fe-app-podkop/src/validators/tests/validateUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateUrl.test.js
index f8ae3d69..c6cbef2c 100644
--- a/fe-app-podkop/src/validators/tests/validateUrl.test.js
+++ b/fe-app-netshift/src/validators/tests/validateUrl.test.js
@@ -8,6 +8,9 @@ const validUrls = [
   ['With query', 'https://example.com/?q=test'],
   ['With port', 'http://example.com:8080'],
   ['With subdomain', 'https://sub.example.com'],
+  ['IPv4 host with port and path', 'https://91.199.111.52:2096/sub/abc'],
+  ['IPv4 host with path', 'http://10.0.0.1/x'],
+  ['Bracketed IPv6 host with port and path', 'https://[2001:db8::1]:2096/sub'],
 ];
 
 const invalidUrls = [
@@ -17,6 +20,9 @@ const invalidUrls = [
   ['Unsupported protocol (ws)', 'ws://example.com'],
   ['Empty string', ''],
   ['Without tld', 'https://google'],
+  ['Bad IPv4 host', 'https://999.1.1.1/x'],
+  ['Bad protocol with IP host', 'ftp://1.2.3.4'],
+  ['No host', 'https://'],
 ];
 
 describe('validateUrl', () => {
diff --git a/fe-app-podkop/src/validators/tests/validateVlessUrl.test.js b/fe-app-netshift/src/validators/tests/validateVlessUrl.test.js
similarity index 100%
rename from fe-app-podkop/src/validators/tests/validateVlessUrl.test.js
rename to fe-app-netshift/src/validators/tests/validateVlessUrl.test.js
diff --git a/fe-app-netshift/src/validators/tests/validateVmessUrl.test.js b/fe-app-netshift/src/validators/tests/validateVmessUrl.test.js
new file mode 100644
index 00000000..2277359e
--- /dev/null
+++ b/fe-app-netshift/src/validators/tests/validateVmessUrl.test.js
@@ -0,0 +1,150 @@
+import { describe, it, expect } from 'vitest';
+import { validateVmessUrl } from '../validateVmessUrl';
+
+// Node global (vitest runs in the node environment); aliased so ESLint's
+// no-undef does not flag the bare `Buffer` identifier.
+const NodeBuffer = globalThis.Buffer;
+
+// Build a vmess:// link from a config object the V2RayN way:
+// vmess:// + base64(JSON).
+const b64 = (obj) => NodeBuffer.from(JSON.stringify(obj)).toString('base64');
+const vmess = (obj) => `vmess://${b64(obj)}`;
+
+const baseConfig = {
+  v: '2',
+  ps: 'node',
+  add: '1.2.3.4',
+  port: 443,
+  id: 'b831381d-6324-4d53-ad4f-8cda48b30811',
+  net: 'ws',
+  type: 'none',
+  host: '',
+  path: '/',
+  tls: 'tls',
+  aid: 0,
+};
+
+// A config whose JSON base64 contains a '+' char (ps:'>>>' forces it).
+// Regression parity with the backend S1 fix.
+const plusB64 = b64({ ...baseConfig, ps: '>>>' });
+
+// An unpadded base64 variant of a valid config (strip trailing '=' padding).
+const unpaddedBody = b64(baseConfig).replace(/=+$/, '');
+
+// The user's REAL key: V2RayN base64(JSON) followed by a "#🇳🇱Ne" display-name
+// fragment. The fragment (emoji/Cyrillic/etc.) used to corrupt the base64 and
+// throw "malformed base64"; stripping it before decode must validate it.
+const realUserKey =
+  'vmess://eyJhZGQiOiJyZW5kZXJlci1zdHJlYW0tMS00MTEubWlycmEubm93IiwiYWlkIjoiMCIsImFsbG93SW5zZWN1cmUiOiIwIiwiYWxsb3dfaW5zZWN1cmUiOiIwIiwiaG9zdCI6InJlbmRlcmVyLXN0cmVhbS0xLTQxMS5taXJyYS5ub3ciLCJpZCI6ImRmOWM5MzU1LWIwMmMtNGMxMi05MDlkLTBkYmViNzI1ZDUyYiIsImluc2VjdXJlIjoiMCIsIm5ldCI6IndzIiwicGF0aCI6Ii9hcGkvdjEvZ3B1LXN0cmVhbS9zb2NrZXQiLCJwb3J0IjoiNDQzIiwicHMiOiLwn4ez8J+HsSBUaGUgTmV0aGVybGFuZHMgfCBbKkNJRFJdIiwic2VjdXJpdHkiOiJhdXRvIiwic25pIjoicmVuZGVyZXItc3RyZWFtLTEtNDExLm1pcnJhLm5vdyIsInRscyI6InRscyIsInYiOiIyIiwidHlwZSI6Im5vbmUiLCJzY3kiOiJhdXRvIiwiYWxwbiI6IiIsImZwIjoiIn0=#🇳🇱Ne';
+
+const validUrls = [
+  ['basic add/port/id', vmess({ add: '1.2.3.4', port: 443, id: 'uuid-1' })],
+  ['full config with net:ws tls:tls', vmess(baseConfig)],
+  ['port as numeric string', vmess({ ...baseConfig, port: '8443' })],
+  ['base64 body containing "+"', `vmess://${plusB64}`],
+  ['unpadded base64 body', `vmess://${unpaddedBody}`],
+  ["user's real key with #🇳🇱Ne fragment", realUserKey],
+  ['fragment label after #', `${vmess(baseConfig)}#label`],
+  ['fragment with spaces after #', `${vmess(baseConfig)}#name with spaces`],
+  ['no fragment (no regression)', vmess(baseConfig)],
+];
+
+const invalidUrls = [
+  ['wrong prefix', `vless://${b64(baseConfig)}`],
+  ['contains space', `vmess://${b64(baseConfig)} `],
+  ['non-base64 body', 'vmess://!!!not base64!!!'],
+  [
+    'base64 of non-JSON',
+    `vmess://${NodeBuffer.from('not json at all').toString('base64')}`,
+  ],
+  [
+    'base64 of JSON array',
+    `vmess://${NodeBuffer.from('[1,2,3]').toString('base64')}`,
+  ],
+  ['missing add', vmess({ port: 443, id: 'uuid-1' })],
+  ['empty add', vmess({ add: '', port: 443, id: 'uuid-1' })],
+  ['missing id', vmess({ add: '1.2.3.4', port: 443 })],
+  ['empty id', vmess({ add: '1.2.3.4', port: 443, id: '' })],
+  ['port 0', vmess({ add: '1.2.3.4', port: 0, id: 'uuid-1' })],
+  ['port 99999', vmess({ add: '1.2.3.4', port: 99999, id: 'uuid-1' })],
+  ['non-numeric port', vmess({ add: '1.2.3.4', port: 'abc', id: 'uuid-1' })],
+];
+
+describe('validateVmessUrl', () => {
+  describe.each(validUrls)('Valid URL: %s', (_desc, url) => {
+    it(`returns valid=true for "${url}"`, () => {
+      const res = validateVmessUrl(url);
+      expect(res.valid).toBe(true);
+      expect(res.message).toBe('Valid');
+    });
+  });
+
+  describe.each(invalidUrls)('Invalid URL: %s', (_desc, url) => {
+    it(`returns valid=false for "${url}"`, () => {
+      const res = validateVmessUrl(url);
+      expect(res.valid).toBe(false);
+    });
+  });
+
+  it('reports the wrong-prefix message', () => {
+    const res = validateVmessUrl('http://example.com');
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: must start with vmess://');
+  });
+
+  it('reports malformed base64', () => {
+    const res = validateVmessUrl('vmess://@@@@');
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: malformed base64');
+  });
+
+  it('reports malformed JSON', () => {
+    const res = validateVmessUrl(
+      `vmess://${NodeBuffer.from('definitely not json').toString('base64')}`,
+    );
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: malformed JSON');
+  });
+
+  it('reports missing address', () => {
+    const res = validateVmessUrl(vmess({ port: 443, id: 'uuid-1' }));
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: missing address');
+  });
+
+  it('reports missing id', () => {
+    const res = validateVmessUrl(vmess({ add: '1.2.3.4', port: 443 }));
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: missing id');
+  });
+
+  it('reports invalid port', () => {
+    const res = validateVmessUrl(
+      vmess({ add: '1.2.3.4', port: 99999, id: 'uuid-1' }),
+    );
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: invalid port');
+  });
+
+  it('confirms the "+"-containing base64 fixture really contains "+"', () => {
+    expect(plusB64).toContain('+');
+  });
+
+  it("validates the user's real #🇳🇱Ne-fragment key", () => {
+    const res = validateVmessUrl(realUserKey);
+    expect(res.valid).toBe(true);
+    expect(res.message).toBe('Valid');
+  });
+
+  it('strips a fragment with spaces (whitespace check runs on base64 only)', () => {
+    const res = validateVmessUrl(`${vmess(baseConfig)}#name with spaces`);
+    expect(res.valid).toBe(true);
+    expect(res.message).toBe('Valid');
+  });
+
+  it('still rejects whitespace inside the base64 body (no fragment)', () => {
+    const res = validateVmessUrl(`vmess://${b64(baseConfig)} `);
+    expect(res.valid).toBe(false);
+    expect(res.message).toBe('Invalid VMess URL: must not contain spaces');
+  });
+});
diff --git a/fe-app-podkop/src/validators/types.ts b/fe-app-netshift/src/validators/types.ts
similarity index 100%
rename from fe-app-podkop/src/validators/types.ts
rename to fe-app-netshift/src/validators/types.ts
diff --git a/fe-app-netshift/src/validators/validateDns.ts b/fe-app-netshift/src/validators/validateDns.ts
new file mode 100644
index 00000000..55e01110
--- /dev/null
+++ b/fe-app-netshift/src/validators/validateDns.ts
@@ -0,0 +1,43 @@
+import { validateDomain } from './validateDomain';
+import { validateIPV4, validateIPV6 } from './validateIp';
+import { ValidationResult } from './types';
+
+export function validateDNS(value: string): ValidationResult {
+  if (!value) {
+    return { valid: false, message: _('DNS server address cannot be empty') };
+  }
+
+  const valueBeforePath = value.split('/')[0];
+  let cleanedValueWithoutPort = value;
+  let cleanedIpWithoutPath = valueBeforePath;
+
+  if (valueBeforePath.startsWith('[')) {
+    const closingBracketIndex = valueBeforePath.indexOf(']');
+
+    if (closingBracketIndex > 0) {
+      cleanedIpWithoutPath = valueBeforePath.slice(1, closingBracketIndex);
+    }
+  } else if ((valueBeforePath.match(/:/g) || []).length < 2) {
+    cleanedValueWithoutPort = value.replace(/:(\d+)(?=\/|$)/, '');
+    cleanedIpWithoutPath = cleanedValueWithoutPort.split('/')[0];
+  }
+
+  if (validateIPV4(cleanedIpWithoutPath).valid) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  if (validateIPV6(cleanedIpWithoutPath).valid) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  if (validateDomain(cleanedValueWithoutPort).valid) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  return {
+    valid: false,
+    message: _(
+      'Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH',
+    ),
+  };
+}
diff --git a/fe-app-podkop/src/validators/validateDomain.ts b/fe-app-netshift/src/validators/validateDomain.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateDomain.ts
rename to fe-app-netshift/src/validators/validateDomain.ts
diff --git a/fe-app-podkop/src/validators/validateHysteriaUrl.ts b/fe-app-netshift/src/validators/validateHysteriaUrl.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateHysteriaUrl.ts
rename to fe-app-netshift/src/validators/validateHysteriaUrl.ts
diff --git a/fe-app-netshift/src/validators/validateIp.ts b/fe-app-netshift/src/validators/validateIp.ts
new file mode 100644
index 00000000..d5fae88e
--- /dev/null
+++ b/fe-app-netshift/src/validators/validateIp.ts
@@ -0,0 +1,111 @@
+import { ValidationResult } from './types';
+
+export function validateIPV4(ip: string): ValidationResult {
+  const ipRegex =
+    /^(?:(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/;
+
+  if (ipRegex.test(ip)) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  return { valid: false, message: _('Invalid IP address') };
+}
+
+const HEXTET_REGEX = /^[0-9a-fA-F]{1,4}$/;
+
+function isHextet(group: string): boolean {
+  return HEXTET_REGEX.test(group);
+}
+
+function isEmbeddedIPv4(group: string): boolean {
+  return validateIPV4(group).valid;
+}
+
+// Validates one side (the part before or after "::") as a list of hextets.
+// The trailing group may be a dotted IPv4 (embedded/IPv4-mapped IPv6), which
+// counts as TWO 16-bit groups. Returns the 16-bit group count, or null on any
+// invalid group.
+function countGroups(side: string, allowEmbeddedIPv4: boolean): number | null {
+  if (side === '') {
+    return 0;
+  }
+
+  const groups = side.split(':');
+
+  for (let i = 0; i < groups.length; i++) {
+    const group = groups[i];
+    const isLast = i === groups.length - 1;
+
+    if (allowEmbeddedIPv4 && isLast && group.includes('.')) {
+      if (!isEmbeddedIPv4(group)) {
+        return null;
+      }
+
+      continue;
+    }
+
+    if (!isHextet(group)) {
+      return null;
+    }
+  }
+
+  // An embedded IPv4 tail occupies two 16-bit groups instead of one.
+  const lastGroup = groups[groups.length - 1];
+  const embeddedExtra =
+    allowEmbeddedIPv4 && lastGroup.includes('.') && isEmbeddedIPv4(lastGroup)
+      ? 1
+      : 0;
+
+  return groups.length + embeddedExtra;
+}
+
+export function validateIPV6(ip: string): ValidationResult {
+  const stripped = ip.replace(/^\[/, '').replace(/\]$/, '');
+  const invalid: ValidationResult = {
+    valid: false,
+    message: _('Invalid IPv6 address'),
+  };
+
+  // At most one "::" compression is allowed.
+  const doubleColonCount = stripped.split('::').length - 1;
+  if (doubleColonCount > 1) {
+    return invalid;
+  }
+
+  if (doubleColonCount === 1) {
+    const [head, tail] = stripped.split('::');
+
+    const headGroups = countGroups(head, true);
+    const tailGroups = countGroups(tail, true);
+
+    if (headGroups === null || tailGroups === null) {
+      return invalid;
+    }
+
+    // "::" must replace at least one group, so the explicit groups can total
+    // at most 7 (it stands in for one or more zero groups).
+    if (headGroups + tailGroups > 7) {
+      return invalid;
+    }
+
+    return { valid: true, message: _('Valid') };
+  }
+
+  // No "::" → must be exactly 8 groups, all explicit.
+  const totalGroups = countGroups(stripped, true);
+  if (totalGroups === 8) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  return invalid;
+}
+
+export function validateIP(ip: string): ValidationResult {
+  const ipv4 = validateIPV4(ip);
+
+  if (ipv4.valid) {
+    return ipv4;
+  }
+
+  return validateIPV6(ip);
+}
diff --git a/fe-app-podkop/src/validators/validateOutboundJson.ts b/fe-app-netshift/src/validators/validateOutboundJson.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateOutboundJson.ts
rename to fe-app-netshift/src/validators/validateOutboundJson.ts
diff --git a/fe-app-podkop/src/validators/validatePath.ts b/fe-app-netshift/src/validators/validatePath.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validatePath.ts
rename to fe-app-netshift/src/validators/validatePath.ts
diff --git a/fe-app-podkop/src/validators/validateProxyUrl.ts b/fe-app-netshift/src/validators/validateProxyUrl.ts
similarity index 81%
rename from fe-app-podkop/src/validators/validateProxyUrl.ts
rename to fe-app-netshift/src/validators/validateProxyUrl.ts
index d0be83d7..0e6f5851 100644
--- a/fe-app-podkop/src/validators/validateProxyUrl.ts
+++ b/fe-app-netshift/src/validators/validateProxyUrl.ts
@@ -4,6 +4,7 @@ import { validateVlessUrl } from './validateVlessUrl';
 import { validateTrojanUrl } from './validateTrojanUrl';
 import { validateSocksUrl } from './validateSocksUrl';
 import { validateHysteria2Url } from './validateHysteriaUrl';
+import { validateVmessUrl } from './validateVmessUrl';
 
 // TODO refactor current validation and add tests
 export function validateProxyUrl(url: string): ValidationResult {
@@ -21,6 +22,10 @@ export function validateProxyUrl(url: string): ValidationResult {
     return validateTrojanUrl(trimmedUrl);
   }
 
+  if (trimmedUrl.startsWith('vmess://')) {
+    return validateVmessUrl(trimmedUrl);
+  }
+
   if (/^socks(4|4a|5):\/\//.test(trimmedUrl)) {
     return validateSocksUrl(trimmedUrl);
   }
@@ -35,7 +40,7 @@ export function validateProxyUrl(url: string): ValidationResult {
   return {
     valid: false,
     message: _(
-      'URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://',
+      'URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://',
     ),
   };
 }
diff --git a/fe-app-podkop/src/validators/validateShadowsocksUrl.ts b/fe-app-netshift/src/validators/validateShadowsocksUrl.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateShadowsocksUrl.ts
rename to fe-app-netshift/src/validators/validateShadowsocksUrl.ts
diff --git a/fe-app-podkop/src/validators/validateSocksUrl.ts b/fe-app-netshift/src/validators/validateSocksUrl.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateSocksUrl.ts
rename to fe-app-netshift/src/validators/validateSocksUrl.ts
diff --git a/fe-app-netshift/src/validators/validateSubnet.ts b/fe-app-netshift/src/validators/validateSubnet.ts
new file mode 100644
index 00000000..06032ee2
--- /dev/null
+++ b/fe-app-netshift/src/validators/validateSubnet.ts
@@ -0,0 +1,59 @@
+import { ValidationResult } from './types';
+import { validateIPV4, validateIPV6 } from './validateIp';
+
+export function validateSubnet(value: string): ValidationResult {
+  const subnetRegex = /^(\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$/;
+
+  if (subnetRegex.test(value)) {
+    const [ip, cidr] = value.split('/');
+
+    if (ip === '0.0.0.0') {
+      return { valid: false, message: _('IP address 0.0.0.0 is not allowed') };
+    }
+
+    const ipCheck = validateIPV4(ip);
+    if (!ipCheck.valid) {
+      return ipCheck;
+    }
+
+    if (cidr) {
+      const cidrNum = parseInt(cidr, 10);
+
+      if (cidrNum < 0 || cidrNum > 32) {
+        return {
+          valid: false,
+          message: _('CIDR must be between 0 and 32'),
+        };
+      }
+    }
+
+    return { valid: true, message: _('Valid') };
+  }
+
+  const ipv6CidrRegex = /^([0-9a-fA-F:]+(?:\/[0-9]{1,3})?)$/;
+  if (ipv6CidrRegex.test(value)) {
+    const [ip, cidr] = value.split('/');
+    const ipCheck = validateIPV6(ip);
+
+    if (!ipCheck.valid) {
+      return ipCheck;
+    }
+
+    if (cidr) {
+      const cidrNum = parseInt(cidr, 10);
+      if (cidrNum < 0 || cidrNum > 128) {
+        return {
+          valid: false,
+          message: _('IPv6 CIDR must be between 0 and 128'),
+        };
+      }
+    }
+
+    return { valid: true, message: _('Valid') };
+  }
+
+  return {
+    valid: false,
+    message: _('Invalid format. Use X.X.X.X/Y or IPv6/Y'),
+  };
+}
diff --git a/fe-app-podkop/src/validators/validateTrojanUrl.ts b/fe-app-netshift/src/validators/validateTrojanUrl.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateTrojanUrl.ts
rename to fe-app-netshift/src/validators/validateTrojanUrl.ts
diff --git a/fe-app-netshift/src/validators/validateUrl.ts b/fe-app-netshift/src/validators/validateUrl.ts
new file mode 100644
index 00000000..38944bea
--- /dev/null
+++ b/fe-app-netshift/src/validators/validateUrl.ts
@@ -0,0 +1,79 @@
+import { ValidationResult } from './types';
+import { validateDomain } from './validateDomain';
+import { validateIPV4, validateIPV6 } from './validateIp';
+
+// Extracts the bare host from a URL, stripping the scheme, optional userinfo,
+// the port, and the path/query/fragment. A bracketed IPv6 literal (e.g.
+// "[2001:db8::1]") is unwrapped to "2001:db8::1".
+function extractHost(url: string): string {
+  // Strip scheme://
+  const schemeIndex = url.indexOf('://');
+  let rest = schemeIndex === -1 ? url : url.slice(schemeIndex + 3);
+
+  // Strip path/query/fragment (everything from the first '/', '?' or '#').
+  const pathIndex = rest.search(/[/?#]/);
+  if (pathIndex !== -1) {
+    rest = rest.slice(0, pathIndex);
+  }
+
+  // Strip optional userinfo ("user:pass@").
+  const atIndex = rest.lastIndexOf('@');
+  if (atIndex !== -1) {
+    rest = rest.slice(atIndex + 1);
+  }
+
+  // Bracketed IPv6 literal: "[2001:db8::1]:2096" -> "2001:db8::1".
+  if (rest.startsWith('[')) {
+    const closeIndex = rest.indexOf(']');
+    if (closeIndex !== -1) {
+      return rest.slice(1, closeIndex);
+    }
+    // Unterminated bracket: drop the leading '[' and any ':port' suffix.
+    return rest.slice(1).split(':')[0];
+  }
+
+  // Bare host: strip a trailing ":port".
+  const colonIndex = rest.lastIndexOf(':');
+  if (colonIndex !== -1) {
+    rest = rest.slice(0, colonIndex);
+  }
+
+  return rest;
+}
+
+export function validateUrl(
+  url: string,
+  protocols = ['http:', 'https:'],
+): ValidationResult {
+  if (!url.length) {
+    return { valid: false, message: _('Invalid URL format') };
+  }
+
+  const hasValidProtocol = protocols.some((p) => url.indexOf(p + '//') === 0);
+
+  if (!hasValidProtocol)
+    return {
+      valid: false,
+      message:
+        _('URL must use one of the following protocols:') +
+        ' ' +
+        protocols.join(', '),
+    };
+
+  const host = extractHost(url);
+
+  if (!host) {
+    return { valid: false, message: _('Invalid URL format') };
+  }
+
+  const isValidHost =
+    validateIPV4(host).valid ||
+    validateIPV6(host).valid ||
+    validateDomain(host).valid;
+
+  if (isValidHost) {
+    return { valid: true, message: _('Valid') };
+  }
+
+  return { valid: false, message: _('Invalid URL format') };
+}
diff --git a/fe-app-podkop/src/validators/validateVlessUrl.ts b/fe-app-netshift/src/validators/validateVlessUrl.ts
similarity index 100%
rename from fe-app-podkop/src/validators/validateVlessUrl.ts
rename to fe-app-netshift/src/validators/validateVlessUrl.ts
diff --git a/fe-app-netshift/src/validators/validateVmessUrl.ts b/fe-app-netshift/src/validators/validateVmessUrl.ts
new file mode 100644
index 00000000..c9c28c7a
--- /dev/null
+++ b/fe-app-netshift/src/validators/validateVmessUrl.ts
@@ -0,0 +1,87 @@
+import { ValidationResult } from './types';
+
+export function validateVmessUrl(url: string): ValidationResult {
+  if (!url.startsWith('vmess://')) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: must start with vmess://'),
+    };
+  }
+
+  const body = url.slice('vmess://'.length);
+
+  // The optional `#fragment` is the server display name (like #name in
+  // vless/ss/trojan); the canonical name also lives in the JSON `ps` field.
+  // Strip it BEFORE base64 decode (cut at the first '#'); the base64 body
+  // never contains '#', so this is safe and matches the other schemes.
+  const b64 = body.split('#')[0];
+
+  // Whitespace ordering: validate AFTER stripping the fragment, and only on
+  // the base64 part. The base64 itself must contain no whitespace, but a
+  // display-name fragment (e.g. "#The Netherlands") legitimately may.
+  if (/\s/.test(b64)) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: must not contain spaces'),
+    };
+  }
+
+  // VMess (V2RayN) is vmess:// + base64(JSON), not a user@host URL.
+  // Tolerate unpadded base64 by right-padding to a multiple of 4, matching
+  // the backend fix.
+  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+
+  let decoded: string;
+  try {
+    decoded = atob(padded);
+  } catch (_e) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: malformed base64'),
+    };
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(decoded);
+  } catch (_e) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: malformed JSON'),
+    };
+  }
+
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: malformed JSON'),
+    };
+  }
+
+  const config = parsed as Record<string, unknown>;
+
+  if (typeof config.add !== 'string' || config.add.length === 0) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: missing address'),
+    };
+  }
+
+  if (typeof config.id !== 'string' || config.id.length === 0) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: missing id'),
+    };
+  }
+
+  const portNum = Number(config.port);
+
+  if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) {
+    return {
+      valid: false,
+      message: _('Invalid VMess URL: invalid port'),
+    };
+  }
+
+  return { valid: true, message: _('Valid') };
+}
diff --git a/fe-app-podkop/tests/setup/global-mocks.ts b/fe-app-netshift/tests/setup/global-mocks.ts
similarity index 100%
rename from fe-app-podkop/tests/setup/global-mocks.ts
rename to fe-app-netshift/tests/setup/global-mocks.ts
diff --git a/fe-app-podkop/tsconfig.json b/fe-app-netshift/tsconfig.json
similarity index 100%
rename from fe-app-podkop/tsconfig.json
rename to fe-app-netshift/tsconfig.json
diff --git a/fe-app-podkop/tsup.config.ts b/fe-app-netshift/tsup.config.ts
similarity index 85%
rename from fe-app-podkop/tsup.config.ts
rename to fe-app-netshift/tsup.config.ts
index 6caf4791..8f210667 100644
--- a/fe-app-podkop/tsup.config.ts
+++ b/fe-app-netshift/tsup.config.ts
@@ -5,7 +5,7 @@ import path from 'path';
 export default defineConfig({
     entry: ['src/main.ts'],
     format: ['esm'], // пусть tsup генерит export {...}
-    outDir: '../luci-app-podkop/htdocs/luci-static/resources/view/podkop',
+    outDir: '../luci-app-netshift/htdocs/luci-static/resources/view/netshift',
     outExtension: () => ({ js: '.js' }),
     dts: false,
     clean: false,
@@ -18,7 +18,7 @@ export default defineConfig({
     },
     onSuccess: () => {
         const outDir =
-            '../luci-app-podkop/htdocs/luci-static/resources/view/podkop';
+            '../luci-app-netshift/htdocs/luci-static/resources/view/netshift';
         const file = path.join(outDir, 'main.js');
         let code = fs.readFileSync(file, 'utf8');
 
diff --git a/fe-app-podkop/vitest.config.js b/fe-app-netshift/vitest.config.js
similarity index 100%
rename from fe-app-podkop/vitest.config.js
rename to fe-app-netshift/vitest.config.js
diff --git a/fe-app-podkop/watch-upload.js b/fe-app-netshift/watch-upload.js
similarity index 87%
rename from fe-app-podkop/watch-upload.js
rename to fe-app-netshift/watch-upload.js
index 0f578328..4b3ea844 100644
--- a/fe-app-podkop/watch-upload.js
+++ b/fe-app-netshift/watch-upload.js
@@ -18,19 +18,19 @@ const config = {
 
 const syncDirs = [
   {
-    local: path.resolve(process.env.LOCAL_DIR_FE ?? '../luci-app-podkop/htdocs/luci-static/resources/view/podkop'),
-    remote: process.env.REMOTE_DIR_FE ?? '/www/luci-static/resources/view/podkop',
+    local: path.resolve(process.env.LOCAL_DIR_FE ?? '../luci-app-netshift/htdocs/luci-static/resources/view/netshift'),
+    remote: process.env.REMOTE_DIR_FE ?? '/www/luci-static/resources/view/netshift',
   },
   {
-    local: path.resolve(process.env.LOCAL_DIR_BIN ?? '../podkop/files/usr/bin/'),
+    local: path.resolve(process.env.LOCAL_DIR_BIN ?? '../netshift/files/usr/bin/'),
     remote: process.env.REMOTE_DIR_BIN ?? '/usr/bin/',
   },
   {
-    local: path.resolve(process.env.LOCAL_DIR_LIB ?? '../podkop/files/usr/lib/'),
-    remote: process.env.REMOTE_DIR_LIB ?? '/usr/lib/podkop/',
+    local: path.resolve(process.env.LOCAL_DIR_LIB ?? '../netshift/files/usr/lib/'),
+    remote: process.env.REMOTE_DIR_LIB ?? '/usr/lib/netshift/',
   },
   {
-    local: path.resolve(process.env.LOCAL_DIR_INIT ?? '../podkop/files/etc/init.d/'),
+    local: path.resolve(process.env.LOCAL_DIR_INIT ?? '../netshift/files/etc/init.d/'),
     remote: process.env.REMOTE_DIR_INIT ?? '/etc/init.d/',
   }
 ];
diff --git a/fe-app-podkop/yarn.lock b/fe-app-netshift/yarn.lock
similarity index 100%
rename from fe-app-podkop/yarn.lock
rename to fe-app-netshift/yarn.lock
diff --git a/fe-app-podkop/.env.example b/fe-app-podkop/.env.example
deleted file mode 100644
index b82d0b60..00000000
--- a/fe-app-podkop/.env.example
+++ /dev/null
@@ -1,16 +0,0 @@
-SFTP_HOST=192.168.160.129
-SFTP_PORT=22
-SFTP_USER=root
-SFTP_PASS=
-
-# you can use key if needed
-# SFTP_PRIVATE_KEY=~/.ssh/id_rsa
-
-LOCAL_DIR_FE=../luci-app-podkop/htdocs/luci-static/resources/view/podkop
-REMOTE_DIR_FE=/www/luci-static/resources/view/podkop
-
-LOCAL_DIR_BIN=../podkop/files/usr/bin/
-REMOTE_DIR_BIN=/usr/bin/
-
-LOCAL_DIR_LIB=../podkop/files/usr/lib/
-REMOTE_DIR_LIB=/usr/lib/podkop/
diff --git a/fe-app-podkop/locales/calls.json b/fe-app-podkop/locales/calls.json
deleted file mode 100644
index 742d92b9..00000000
--- a/fe-app-podkop/locales/calls.json
+++ /dev/null
@@ -1,1877 +0,0 @@
-[
-  {
-    "call": "✔ Enabled",
-    "key": "✔ Enabled",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:345"
-    ]
-  },
-  {
-    "call": "✔ Running",
-    "key": "✔ Running",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:356"
-    ]
-  },
-  {
-    "call": "✘ Disabled",
-    "key": "✘ Disabled",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:346"
-    ]
-  },
-  {
-    "call": "✘ Stopped",
-    "key": "✘ Stopped",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:357"
-    ]
-  },
-  {
-    "call": "Active Connections",
-    "key": "Active Connections",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:307"
-    ]
-  },
-  {
-    "call": "Additional marking rules found",
-    "key": "Additional marking rules found",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:106"
-    ]
-  },
-  {
-    "call": "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall.",
-    "key": "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:247"
-    ]
-  },
-  {
-    "call": "Applicable for SOCKS and Shadowsocks proxy",
-    "key": "Applicable for SOCKS and Shadowsocks proxy",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:199"
-    ]
-  },
-  {
-    "call": "At least one valid domain must be specified. Comments-only content is not allowed.",
-    "key": "At least one valid domain must be specified. Comments-only content is not allowed.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:444"
-    ]
-  },
-  {
-    "call": "At least one valid subnet or IP must be specified. Comments-only content is not allowed.",
-    "key": "At least one valid subnet or IP must be specified. Comments-only content is not allowed.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:525"
-    ]
-  },
-  {
-    "call": "Available actions",
-    "key": "Available actions",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:43"
-    ]
-  },
-  {
-    "call": "Bootsrap DNS",
-    "key": "Bootsrap DNS",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:65"
-    ]
-  },
-  {
-    "call": "Bootstrap DNS server",
-    "key": "Bootstrap DNS server",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:45"
-    ]
-  },
-  {
-    "call": "Browser is not using FakeIP",
-    "key": "Browser is not using FakeIP",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:58"
-    ]
-  },
-  {
-    "call": "Browser is using FakeIP correctly",
-    "key": "Browser is using FakeIP correctly",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:57"
-    ]
-  },
-  {
-    "call": "Cache File Path",
-    "key": "Cache File Path",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:348"
-    ]
-  },
-  {
-    "call": "Cache file path cannot be empty",
-    "key": "Cache file path cannot be empty",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:362"
-    ]
-  },
-  {
-    "call": "Cannot receive checks result",
-    "key": "Cannot receive checks result",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:27",
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:28",
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:27",
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:25"
-    ]
-  },
-  {
-    "call": "Checking, please wait",
-    "key": "Checking, please wait",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:15",
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:15",
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:13",
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:15",
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:13"
-    ]
-  },
-  {
-    "call": "checks",
-    "key": "checks",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts:2"
-    ]
-  },
-  {
-    "call": "Checks failed",
-    "key": "Checks failed",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getMeta.ts:26"
-    ]
-  },
-  {
-    "call": "Checks passed",
-    "key": "Checks passed",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getMeta.ts:13"
-    ]
-  },
-  {
-    "call": "CIDR must be between 0 and 32",
-    "key": "CIDR must be between 0 and 32",
-    "places": [
-      "src/validators/validateSubnet.ts:33"
-    ]
-  },
-  {
-    "call": "Close",
-    "key": "Close",
-    "places": [
-      "src/partials/modal/renderModal.ts:26"
-    ]
-  },
-  {
-    "call": "Community Lists",
-    "key": "Community Lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:299"
-    ]
-  },
-  {
-    "call": "Config File Path",
-    "key": "Config File Path",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:335"
-    ]
-  },
-  {
-    "call": "Configuration for Podkop service",
-    "key": "Configuration for Podkop service",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:27"
-    ]
-  },
-  {
-    "call": "Configuration Type",
-    "key": "Configuration Type",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:23"
-    ]
-  },
-  {
-    "call": "Connection Type",
-    "key": "Connection Type",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:12"
-    ]
-  },
-  {
-    "call": "Connection URL",
-    "key": "Connection URL",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:26"
-    ]
-  },
-  {
-    "call": "Copy",
-    "key": "Copy",
-    "places": [
-      "src/partials/modal/renderModal.ts:20"
-    ]
-  },
-  {
-    "call": "Currently unavailable",
-    "key": "Currently unavailable",
-    "places": [
-      "src/podkop/tabs/dashboard/partials/renderWidget.ts:22"
-    ]
-  },
-  {
-    "call": "Dashboard",
-    "key": "Dashboard",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:80"
-    ]
-  },
-  {
-    "call": "Dashboard currently unavailable",
-    "key": "Dashboard currently unavailable",
-    "places": [
-      "src/podkop/tabs/dashboard/partials/renderSections.ts:19"
-    ]
-  },
-  {
-    "call": "Delay in milliseconds before reloading podkop after interface UP",
-    "key": "Delay in milliseconds before reloading podkop after interface UP",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:222"
-    ]
-  },
-  {
-    "call": "Delay value cannot be empty",
-    "key": "Delay value cannot be empty",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:229"
-    ]
-  },
-  {
-    "call": "DHCP has DNS server",
-    "key": "DHCP has DNS server",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:82"
-    ]
-  },
-  {
-    "call": "Diagnostics",
-    "key": "Diagnostics",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:65"
-    ]
-  },
-  {
-    "call": "Disable autostart",
-    "key": "Disable autostart",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:79"
-    ]
-  },
-  {
-    "call": "Disable QUIC",
-    "key": "Disable QUIC",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:265"
-    ]
-  },
-  {
-    "call": "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
-    "key": "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:266"
-    ]
-  },
-  {
-    "call": "Disabled",
-    "key": "Disabled",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:390",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:470"
-    ]
-  },
-  {
-    "call": "DNS on router",
-    "key": "DNS on router",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:77"
-    ]
-  },
-  {
-    "call": "DNS over HTTPS (DoH)",
-    "key": "DNS over HTTPS (DoH)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:267",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:15"
-    ]
-  },
-  {
-    "call": "DNS over TLS (DoT)",
-    "key": "DNS over TLS (DoT)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:268",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:16"
-    ]
-  },
-  {
-    "call": "DNS Protocol Type",
-    "key": "DNS Protocol Type",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:264",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:12"
-    ]
-  },
-  {
-    "call": "DNS Rewrite TTL",
-    "key": "DNS Rewrite TTL",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:68"
-    ]
-  },
-  {
-    "call": "DNS Server",
-    "key": "DNS Server",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:277",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:24"
-    ]
-  },
-  {
-    "call": "DNS server address cannot be empty",
-    "key": "DNS server address cannot be empty",
-    "places": [
-      "src/validators/validateDns.ts:7"
-    ]
-  },
-  {
-    "call": "Do not panic, everything can be fixed, just...",
-    "key": "Do not panic, everything can be fixed, just...",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26"
-    ]
-  },
-  {
-    "call": "Domain Resolver",
-    "key": "Domain Resolver",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:254"
-    ]
-  },
-  {
-    "call": "Dont Touch My DHCP!",
-    "key": "Dont Touch My DHCP!",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:326"
-    ]
-  },
-  {
-    "call": "Downlink",
-    "key": "Downlink",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:241",
-      "src/podkop/tabs/dashboard/initController.ts:275"
-    ]
-  },
-  {
-    "call": "Download",
-    "key": "Download",
-    "places": [
-      "src/partials/modal/renderModal.ts:15"
-    ]
-  },
-  {
-    "call": "Download Lists via Proxy/VPN",
-    "key": "Download Lists via Proxy/VPN",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:288"
-    ]
-  },
-  {
-    "call": "Download Lists via specific proxy section",
-    "key": "Download Lists via specific proxy section",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:297"
-    ]
-  },
-  {
-    "call": "Downloading all lists via specific Proxy/VPN",
-    "key": "Downloading all lists via specific Proxy/VPN",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:289",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:298"
-    ]
-  },
-  {
-    "call": "Dynamic List",
-    "key": "Dynamic List",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:391",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:471"
-    ]
-  },
-  {
-    "call": "Enable autostart",
-    "key": "Enable autostart",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:89"
-    ]
-  },
-  {
-    "call": "Enable built-in DNS resolver for domains handled by this section",
-    "key": "Enable built-in DNS resolver for domains handled by this section",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:255"
-    ]
-  },
-  {
-    "call": "Enable DNS resolve to get real IP when routing",
-    "key": "Enable DNS resolve to get real IP when routing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:691"
-    ]
-  },
-  {
-    "call": "Enable Mixed Proxy",
-    "key": "Enable Mixed Proxy",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:665"
-    ]
-  },
-  {
-    "call": "Enable Output Network Interface",
-    "key": "Enable Output Network Interface",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:126"
-    ]
-  },
-  {
-    "call": "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies",
-    "key": "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:666"
-    ]
-  },
-  {
-    "call": "Enable YACD",
-    "key": "Enable YACD",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:237"
-    ]
-  },
-  {
-    "call": "Enable YACD WAN Access",
-    "key": "Enable YACD WAN Access",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:246"
-    ]
-  },
-  {
-    "call": "Enter complete outbound configuration in JSON format",
-    "key": "Enter complete outbound configuration in JSON format",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:66"
-    ]
-  },
-  {
-    "call": "Enter domain names separated by commas, spaces, or newlines. You can add comments using //",
-    "key": "Enter domain names separated by commas, spaces, or newlines. You can add comments using //",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:426"
-    ]
-  },
-  {
-    "call": "Enter domain names without protocols, e.g. example.com or sub.example.com",
-    "key": "Enter domain names without protocols, e.g. example.com or sub.example.com",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:400"
-    ]
-  },
-  {
-    "call": "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses",
-    "key": "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:480"
-    ]
-  },
-  {
-    "call": "Every 1 minute",
-    "key": "Every 1 minute",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:138"
-    ]
-  },
-  {
-    "call": "Every 3 minutes",
-    "key": "Every 3 minutes",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:139"
-    ]
-  },
-  {
-    "call": "Every 30 seconds",
-    "key": "Every 30 seconds",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:137"
-    ]
-  },
-  {
-    "call": "Every 5 minutes",
-    "key": "Every 5 minutes",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:140"
-    ]
-  },
-  {
-    "call": "Exclude NTP",
-    "key": "Exclude NTP",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:402"
-    ]
-  },
-  {
-    "call": "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
-    "key": "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:403"
-    ]
-  },
-  {
-    "call": "Failed to copy!",
-    "key": "Failed to copy!",
-    "places": [
-      "src/helpers/copyToClipboard.ts:12"
-    ]
-  },
-  {
-    "call": "Failed to execute!",
-    "key": "Failed to execute!",
-    "places": [
-      "src/podkop/tabs/diagnostic/initController.ts:227",
-      "src/podkop/tabs/diagnostic/initController.ts:231",
-      "src/podkop/tabs/diagnostic/initController.ts:261",
-      "src/podkop/tabs/diagnostic/initController.ts:265",
-      "src/podkop/tabs/diagnostic/initController.ts:302",
-      "src/podkop/tabs/diagnostic/initController.ts:306"
-    ]
-  },
-  {
-    "call": "Fastest",
-    "key": "Fastest",
-    "places": [
-      "src/podkop/methods/custom/getDashboardSections.ts:148",
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:59"
-    ]
-  },
-  {
-    "call": "Fully Routed IPs",
-    "key": "Fully Routed IPs",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:638"
-    ]
-  },
-  {
-    "call": "Get global check",
-    "key": "Get global check",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:98"
-    ]
-  },
-  {
-    "call": "Global check",
-    "key": "Global check",
-    "places": [
-      "src/podkop/tabs/diagnostic/initController.ts:222"
-    ]
-  },
-  {
-    "call": "HTTP error",
-    "key": "HTTP error",
-    "places": [
-      "src/podkop/api.ts:27"
-    ]
-  },
-  {
-    "call": "Interface Monitoring",
-    "key": "Interface Monitoring",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:189"
-    ]
-  },
-  {
-    "call": "Interface Monitoring Delay",
-    "key": "Interface Monitoring Delay",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:221"
-    ]
-  },
-  {
-    "call": "Interface monitoring for Bad WAN",
-    "key": "Interface monitoring for Bad WAN",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:190"
-    ]
-  },
-  {
-    "call": "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH",
-    "key": "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH",
-    "places": [
-      "src/validators/validateDns.ts:23"
-    ]
-  },
-  {
-    "call": "Invalid domain address",
-    "key": "Invalid domain address",
-    "places": [
-      "src/validators/validateDomain.ts:18",
-      "src/validators/validateDomain.ts:27"
-    ]
-  },
-  {
-    "call": "Invalid format. Use X.X.X.X or X.X.X.X/Y",
-    "key": "Invalid format. Use X.X.X.X or X.X.X.X/Y",
-    "places": [
-      "src/validators/validateSubnet.ts:11"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: insecure must be 0 or 1",
-    "key": "Invalid HY2 URL: insecure must be 0 or 1",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:90"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: invalid port number",
-    "key": "Invalid HY2 URL: invalid port number",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:77"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: missing credentials/server",
-    "key": "Invalid HY2 URL: missing credentials/server",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:30"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: missing host",
-    "key": "Invalid HY2 URL: missing host",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:47"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: missing host & port",
-    "key": "Invalid HY2 URL: missing host & port",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:41"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: missing password",
-    "key": "Invalid HY2 URL: missing password",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:36"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: missing port",
-    "key": "Invalid HY2 URL: missing port",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:50"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: must not contain spaces",
-    "key": "Invalid HY2 URL: must not contain spaces",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:18"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: must start with hysteria2:// or hy2://",
-    "key": "Invalid HY2 URL: must start with hysteria2:// or hy2://",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:12"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: obfs-password required when obfs is set",
-    "key": "Invalid HY2 URL: obfs-password required when obfs is set",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:108"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: parsing failed",
-    "key": "Invalid HY2 URL: parsing failed",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:122"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: sni cannot be empty",
-    "key": "Invalid HY2 URL: sni cannot be empty",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:116"
-    ]
-  },
-  {
-    "call": "Invalid HY2 URL: unsupported obfs type",
-    "key": "Invalid HY2 URL: unsupported obfs type",
-    "places": [
-      "src/validators/validateHysteriaUrl.ts:98"
-    ]
-  },
-  {
-    "call": "Invalid IP address",
-    "key": "Invalid IP address",
-    "places": [
-      "src/validators/validateIp.ts:11"
-    ]
-  },
-  {
-    "call": "Invalid JSON format",
-    "key": "Invalid JSON format",
-    "places": [
-      "src/validators/validateOutboundJson.ts:9"
-    ]
-  },
-  {
-    "call": "Invalid path format. Path must start with \"/\" and contain valid characters",
-    "key": "Invalid path format. Path must start with \"/\" and contain valid characters",
-    "places": [
-      "src/validators/validatePath.ts:22"
-    ]
-  },
-  {
-    "call": "Invalid port number. Must be between 1 and 65535",
-    "key": "Invalid port number. Must be between 1 and 65535",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:85"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: decoded credentials must contain method:password",
-    "key": "Invalid Shadowsocks URL: decoded credentials must contain method:password",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:37"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: missing credentials",
-    "key": "Invalid Shadowsocks URL: missing credentials",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:27"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: missing method and password separator \":\"",
-    "key": "Invalid Shadowsocks URL: missing method and password separator \":\"",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:46"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: missing port",
-    "key": "Invalid Shadowsocks URL: missing port",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:76"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: missing server",
-    "key": "Invalid Shadowsocks URL: missing server",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:67"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: missing server address",
-    "key": "Invalid Shadowsocks URL: missing server address",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:58"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: must not contain spaces",
-    "key": "Invalid Shadowsocks URL: must not contain spaces",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:16"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: must start with ss://",
-    "key": "Invalid Shadowsocks URL: must start with ss://",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:8"
-    ]
-  },
-  {
-    "call": "Invalid Shadowsocks URL: parsing failed",
-    "key": "Invalid Shadowsocks URL: parsing failed",
-    "places": [
-      "src/validators/validateShadowsocksUrl.ts:91"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: invalid host format",
-    "key": "Invalid SOCKS URL: invalid host format",
-    "places": [
-      "src/validators/validateSocksUrl.ts:73"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: invalid port number",
-    "key": "Invalid SOCKS URL: invalid port number",
-    "places": [
-      "src/validators/validateSocksUrl.ts:63"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: missing host and port",
-    "key": "Invalid SOCKS URL: missing host and port",
-    "places": [
-      "src/validators/validateSocksUrl.ts:42"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: missing hostname or IP",
-    "key": "Invalid SOCKS URL: missing hostname or IP",
-    "places": [
-      "src/validators/validateSocksUrl.ts:51"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: missing port",
-    "key": "Invalid SOCKS URL: missing port",
-    "places": [
-      "src/validators/validateSocksUrl.ts:56"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: missing username",
-    "key": "Invalid SOCKS URL: missing username",
-    "places": [
-      "src/validators/validateSocksUrl.ts:34"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: must not contain spaces",
-    "key": "Invalid SOCKS URL: must not contain spaces",
-    "places": [
-      "src/validators/validateSocksUrl.ts:19"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://",
-    "key": "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://",
-    "places": [
-      "src/validators/validateSocksUrl.ts:10"
-    ]
-  },
-  {
-    "call": "Invalid SOCKS URL: parsing failed",
-    "key": "Invalid SOCKS URL: parsing failed",
-    "places": [
-      "src/validators/validateSocksUrl.ts:77"
-    ]
-  },
-  {
-    "call": "Invalid Trojan URL: must not contain spaces",
-    "key": "Invalid Trojan URL: must not contain spaces",
-    "places": [
-      "src/validators/validateTrojanUrl.ts:15"
-    ]
-  },
-  {
-    "call": "Invalid Trojan URL: must start with trojan://",
-    "key": "Invalid Trojan URL: must start with trojan://",
-    "places": [
-      "src/validators/validateTrojanUrl.ts:8"
-    ]
-  },
-  {
-    "call": "Invalid Trojan URL: parsing failed",
-    "key": "Invalid Trojan URL: parsing failed",
-    "places": [
-      "src/validators/validateTrojanUrl.ts:56"
-    ]
-  },
-  {
-    "call": "Invalid URL format",
-    "key": "Invalid URL format",
-    "places": [
-      "src/validators/validateUrl.ts:8",
-      "src/validators/validateUrl.ts:31"
-    ]
-  },
-  {
-    "call": "Invalid VLESS URL: parsing failed",
-    "key": "Invalid VLESS URL: parsing failed",
-    "places": [
-      "src/validators/validateVlessUrl.ts:110"
-    ]
-  },
-  {
-    "call": "IP address 0.0.0.0 is not allowed",
-    "key": "IP address 0.0.0.0 is not allowed",
-    "places": [
-      "src/validators/validateSubnet.ts:18"
-    ]
-  },
-  {
-    "call": "Issues detected",
-    "key": "Issues detected",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getMeta.ts:20"
-    ]
-  },
-  {
-    "call": "Latest",
-    "key": "Latest",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:48"
-    ]
-  },
-  {
-    "call": "List Update Frequency",
-    "key": "List Update Frequency",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:276"
-    ]
-  },
-  {
-    "call": "Local Domain Lists",
-    "key": "Local Domain Lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:546"
-    ]
-  },
-  {
-    "call": "Local Subnet Lists",
-    "key": "Local Subnet Lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:569"
-    ]
-  },
-  {
-    "call": "Log Level",
-    "key": "Log Level",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:384"
-    ]
-  },
-  {
-    "call": "Main DNS",
-    "key": "Main DNS",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:72"
-    ]
-  },
-  {
-    "call": "Memory Usage",
-    "key": "Memory Usage",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:311"
-    ]
-  },
-  {
-    "call": "Mixed Proxy Port",
-    "key": "Mixed Proxy Port",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:678"
-    ]
-  },
-  {
-    "call": "Monitored Interfaces",
-    "key": "Monitored Interfaces",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:198"
-    ]
-  },
-  {
-    "call": "Must be a number in the range of 50 - 1000",
-    "key": "Must be a number in the range of 50 - 1000",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:164"
-    ]
-  },
-  {
-    "call": "Network Interface",
-    "key": "Network Interface",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:208"
-    ]
-  },
-  {
-    "call": "No other marking rules found",
-    "key": "No other marking rules found",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:105"
-    ]
-  },
-  {
-    "call": "Not implement yet",
-    "key": "Not implement yet",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderCheckSection.ts:189"
-    ]
-  },
-  {
-    "call": "Not responding",
-    "key": "Not responding",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:75",
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:81",
-      "src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:100"
-    ]
-  },
-  {
-    "call": "Not running",
-    "key": "Not running",
-    "places": [
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:55",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:63",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:71",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:79",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:87"
-    ]
-  },
-  {
-    "call": "Operation timed out",
-    "key": "Operation timed out",
-    "places": [
-      "src/helpers/withTimeout.ts:7"
-    ]
-  },
-  {
-    "call": "Outbound Config",
-    "key": "Outbound Config",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:29"
-    ]
-  },
-  {
-    "call": "Outbound Configuration",
-    "key": "Outbound Configuration",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:65"
-    ]
-  },
-  {
-    "call": "Outdated",
-    "key": "Outdated",
-    "places": [
-      "src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:38"
-    ]
-  },
-  {
-    "call": "Output Network Interface",
-    "key": "Output Network Interface",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:135"
-    ]
-  },
-  {
-    "call": "Path cannot be empty",
-    "key": "Path cannot be empty",
-    "places": [
-      "src/validators/validatePath.ts:7"
-    ]
-  },
-  {
-    "call": "Path must be absolute (start with /)",
-    "key": "Path must be absolute (start with /)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:366"
-    ]
-  },
-  {
-    "call": "Path must contain at least one directory (like /tmp/cache.db)",
-    "key": "Path must contain at least one directory (like /tmp/cache.db)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:375"
-    ]
-  },
-  {
-    "call": "Path must end with cache.db",
-    "key": "Path must end with cache.db",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:370"
-    ]
-  },
-  {
-    "call": "Pending",
-    "key": "Pending",
-    "places": [
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:103",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:111",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:119",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:127",
-      "src/podkop/tabs/diagnostic/diagnostic.store.ts:135"
-    ]
-  },
-  {
-    "call": "Podkop",
-    "key": "Podkop",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:343"
-    ]
-  },
-  {
-    "call": "Podkop Settings",
-    "key": "Podkop Settings",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:26"
-    ]
-  },
-  {
-    "call": "Podkop will not modify your DHCP configuration",
-    "key": "Podkop will not modify your DHCP configuration",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:327"
-    ]
-  },
-  {
-    "call": "Proxy Configuration URL",
-    "key": "Proxy Configuration URL",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:36"
-    ]
-  },
-  {
-    "call": "Proxy traffic is not routed via FakeIP",
-    "key": "Proxy traffic is not routed via FakeIP",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:66"
-    ]
-  },
-  {
-    "call": "Proxy traffic is routed via FakeIP",
-    "key": "Proxy traffic is routed via FakeIP",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:65"
-    ]
-  },
-  {
-    "call": "Regional options cannot be used together",
-    "key": "Regional options cannot be used together",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:333"
-    ]
-  },
-  {
-    "call": "Remote Domain Lists",
-    "key": "Remote Domain Lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:592"
-    ]
-  },
-  {
-    "call": "Remote Subnet Lists",
-    "key": "Remote Subnet Lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:615"
-    ]
-  },
-  {
-    "call": "Resolve real IP for routing",
-    "key": "Resolve real IP for routing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:690"
-    ]
-  },
-  {
-    "call": "Restart podkop",
-    "key": "Restart podkop",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:49"
-    ]
-  },
-  {
-    "call": "Router DNS is not routed through sing-box",
-    "key": "Router DNS is not routed through sing-box",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:51"
-    ]
-  },
-  {
-    "call": "Router DNS is routed through sing-box",
-    "key": "Router DNS is routed through sing-box",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:50"
-    ]
-  },
-  {
-    "call": "Routing Excluded IPs",
-    "key": "Routing Excluded IPs",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:413"
-    ]
-  },
-  {
-    "call": "Rules mangle counters",
-    "key": "Rules mangle counters",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:79"
-    ]
-  },
-  {
-    "call": "Rules mangle exist",
-    "key": "Rules mangle exist",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:74"
-    ]
-  },
-  {
-    "call": "Rules mangle output counters",
-    "key": "Rules mangle output counters",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:89"
-    ]
-  },
-  {
-    "call": "Rules mangle output exist",
-    "key": "Rules mangle output exist",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:84"
-    ]
-  },
-  {
-    "call": "Rules proxy counters",
-    "key": "Rules proxy counters",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:99"
-    ]
-  },
-  {
-    "call": "Rules proxy exist",
-    "key": "Rules proxy exist",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:94"
-    ]
-  },
-  {
-    "call": "Run Diagnostic",
-    "key": "Run Diagnostic",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderRunAction.ts:15"
-    ]
-  },
-  {
-    "call": "Russia inside restrictions",
-    "key": "Russia inside restrictions",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:352"
-    ]
-  },
-  {
-    "call": "Secret key for authenticating remote access to YACD when WAN access is enabled.",
-    "key": "Secret key for authenticating remote access to YACD when WAN access is enabled.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:257"
-    ]
-  },
-  {
-    "call": "Sections",
-    "key": "Sections",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:36"
-    ]
-  },
-  {
-    "call": "Select a predefined list for routing",
-    "key": "Select a predefined list for routing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:300"
-    ]
-  },
-  {
-    "call": "Select between VPN and Proxy connection methods for traffic routing",
-    "key": "Select between VPN and Proxy connection methods for traffic routing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:13"
-    ]
-  },
-  {
-    "call": "Select DNS protocol to use",
-    "key": "Select DNS protocol to use",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:13"
-    ]
-  },
-  {
-    "call": "Select how often the domain or subnet lists are updated automatically",
-    "key": "Select how often the domain or subnet lists are updated automatically",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:277"
-    ]
-  },
-  {
-    "call": "Select how to configure the proxy",
-    "key": "Select how to configure the proxy",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:24"
-    ]
-  },
-  {
-    "call": "Select network interface for VPN connection",
-    "key": "Select network interface for VPN connection",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:209"
-    ]
-  },
-  {
-    "call": "Select or enter DNS server address",
-    "key": "Select or enter DNS server address",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:278",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:25"
-    ]
-  },
-  {
-    "call": "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing",
-    "key": "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:349"
-    ]
-  },
-  {
-    "call": "Select path for sing-box config file. Change this ONLY if you know what you are doing",
-    "key": "Select path for sing-box config file. Change this ONLY if you know what you are doing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:336"
-    ]
-  },
-  {
-    "call": "Select the DNS protocol type for the domain resolver",
-    "key": "Select the DNS protocol type for the domain resolver",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:265"
-    ]
-  },
-  {
-    "call": "Select the list type for adding custom domains",
-    "key": "Select the list type for adding custom domains",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:388"
-    ]
-  },
-  {
-    "call": "Select the list type for adding custom subnets",
-    "key": "Select the list type for adding custom subnets",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:468"
-    ]
-  },
-  {
-    "call": "Select the log level for sing-box",
-    "key": "Select the log level for sing-box",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:385"
-    ]
-  },
-  {
-    "call": "Select the network interface from which the traffic will originate",
-    "key": "Select the network interface from which the traffic will originate",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:90"
-    ]
-  },
-  {
-    "call": "Select the network interface to which the traffic will originate",
-    "key": "Select the network interface to which the traffic will originate",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:136"
-    ]
-  },
-  {
-    "call": "Select the WAN interfaces to be monitored",
-    "key": "Select the WAN interfaces to be monitored",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:199"
-    ]
-  },
-  {
-    "call": "Selector",
-    "key": "Selector",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:27"
-    ]
-  },
-  {
-    "call": "Selector Proxy Links",
-    "key": "Selector Proxy Links",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:88"
-    ]
-  },
-  {
-    "call": "Services info",
-    "key": "Services info",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:340"
-    ]
-  },
-  {
-    "call": "Settings",
-    "key": "Settings",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:49"
-    ]
-  },
-  {
-    "call": "Show sing-box config",
-    "key": "Show sing-box config",
-    "places": [
-      "src/podkop/tabs/diagnostic/initController.ts:290",
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:116"
-    ]
-  },
-  {
-    "call": "Sing-box",
-    "key": "Sing-box",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:354"
-    ]
-  },
-  {
-    "call": "Sing-box autostart disabled",
-    "key": "Sing-box autostart disabled",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:77"
-    ]
-  },
-  {
-    "call": "Sing-box installed",
-    "key": "Sing-box installed",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:62"
-    ]
-  },
-  {
-    "call": "Sing-box listening ports",
-    "key": "Sing-box listening ports",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:87"
-    ]
-  },
-  {
-    "call": "Sing-box process running",
-    "key": "Sing-box process running",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:82"
-    ]
-  },
-  {
-    "call": "Sing-box service exist",
-    "key": "Sing-box service exist",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:72"
-    ]
-  },
-  {
-    "call": "Sing-box version is compatible (newer than 1.12.4)",
-    "key": "Sing-box version is compatible (newer than 1.12.4)",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:67"
-    ]
-  },
-  {
-    "call": "Source Network Interface",
-    "key": "Source Network Interface",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:89"
-    ]
-  },
-  {
-    "call": "Specify a local IP address to be excluded from routing",
-    "key": "Specify a local IP address to be excluded from routing",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:414"
-    ]
-  },
-  {
-    "call": "Specify local IP addresses or subnets whose traffic will always be routed through the configured route",
-    "key": "Specify local IP addresses or subnets whose traffic will always be routed through the configured route",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:639"
-    ]
-  },
-  {
-    "call": "Specify remote URLs to download and use domain lists",
-    "key": "Specify remote URLs to download and use domain lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:593"
-    ]
-  },
-  {
-    "call": "Specify remote URLs to download and use subnet lists",
-    "key": "Specify remote URLs to download and use subnet lists",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:616"
-    ]
-  },
-  {
-    "call": "Specify the path to the list file located on the router filesystem",
-    "key": "Specify the path to the list file located on the router filesystem",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:547",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:570"
-    ]
-  },
-  {
-    "call": "Start podkop",
-    "key": "Start podkop",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:69"
-    ]
-  },
-  {
-    "call": "Stop podkop",
-    "key": "Stop podkop",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:59"
-    ]
-  },
-  {
-    "call": "Successfully copied!",
-    "key": "Successfully copied!",
-    "places": [
-      "src/helpers/copyToClipboard.ts:10"
-    ]
-  },
-  {
-    "call": "System info",
-    "key": "System info",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:304"
-    ]
-  },
-  {
-    "call": "System information",
-    "key": "System information",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts:21"
-    ]
-  },
-  {
-    "call": "Table exist",
-    "key": "Table exist",
-    "places": [
-      "src/podkop/tabs/diagnostic/checks/runNftCheck.ts:69"
-    ]
-  },
-  {
-    "call": "Test latency",
-    "key": "Test latency",
-    "places": [
-      "src/podkop/tabs/dashboard/partials/renderSections.ts:108"
-    ]
-  },
-  {
-    "call": "Text List",
-    "key": "Text List",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:392",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:472"
-    ]
-  },
-  {
-    "call": "The DNS server used to look up the IP address of an upstream DNS server",
-    "key": "The DNS server used to look up the IP address of an upstream DNS server",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:46"
-    ]
-  },
-  {
-    "call": "The interval between connectivity tests",
-    "key": "The interval between connectivity tests",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:135"
-    ]
-  },
-  {
-    "call": "The maximum difference in response times (ms) allowed when comparing servers",
-    "key": "The maximum difference in response times (ms) allowed when comparing servers",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:148"
-    ]
-  },
-  {
-    "call": "The URL used to test server connectivity",
-    "key": "The URL used to test server connectivity",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:171"
-    ]
-  },
-  {
-    "call": "Time in seconds for DNS record caching (default: 60)",
-    "key": "Time in seconds for DNS record caching (default: 60)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:69"
-    ]
-  },
-  {
-    "call": "Traffic",
-    "key": "Traffic",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:238"
-    ]
-  },
-  {
-    "call": "Traffic Total",
-    "key": "Traffic Total",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:268"
-    ]
-  },
-  {
-    "call": "Troubleshooting",
-    "key": "Troubleshooting",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:25"
-    ]
-  },
-  {
-    "call": "TTL must be a positive number",
-    "key": "TTL must be a positive number",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:80"
-    ]
-  },
-  {
-    "call": "TTL value cannot be empty",
-    "key": "TTL value cannot be empty",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:75"
-    ]
-  },
-  {
-    "call": "UDP (Unprotected DNS)",
-    "key": "UDP (Unprotected DNS)",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:269",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:17"
-    ]
-  },
-  {
-    "call": "UDP over TCP",
-    "key": "UDP over TCP",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:198"
-    ]
-  },
-  {
-    "call": "unknown",
-    "key": "unknown",
-    "places": [
-      "src/podkop/tabs/diagnostic/initController.ts:38",
-      "src/podkop/tabs/diagnostic/initController.ts:39",
-      "src/podkop/tabs/diagnostic/initController.ts:40",
-      "src/podkop/tabs/diagnostic/initController.ts:41",
-      "src/podkop/tabs/diagnostic/initController.ts:42",
-      "src/podkop/tabs/diagnostic/initController.ts:43",
-      "src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:7"
-    ]
-  },
-  {
-    "call": "Unknown error",
-    "key": "Unknown error",
-    "places": [
-      "src/podkop/api.ts:40"
-    ]
-  },
-  {
-    "call": "Uplink",
-    "key": "Uplink",
-    "places": [
-      "src/podkop/tabs/dashboard/initController.ts:240",
-      "src/podkop/tabs/dashboard/initController.ts:271"
-    ]
-  },
-  {
-    "call": "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://",
-    "key": "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://",
-    "places": [
-      "src/validators/validateProxyUrl.ts:37"
-    ]
-  },
-  {
-    "call": "URL must use one of the following protocols:",
-    "key": "URL must use one of the following protocols:",
-    "places": [
-      "src/validators/validateUrl.ts:17"
-    ]
-  },
-  {
-    "call": "URLTest",
-    "key": "URLTest",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:28"
-    ]
-  },
-  {
-    "call": "URLTest Check Interval",
-    "key": "URLTest Check Interval",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:134"
-    ]
-  },
-  {
-    "call": "URLTest Proxy Links",
-    "key": "URLTest Proxy Links",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:111"
-    ]
-  },
-  {
-    "call": "URLTest Testing URL",
-    "key": "URLTest Testing URL",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:170"
-    ]
-  },
-  {
-    "call": "URLTest Tolerance",
-    "key": "URLTest Tolerance",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:147"
-    ]
-  },
-  {
-    "call": "User Domain List Type",
-    "key": "User Domain List Type",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:387"
-    ]
-  },
-  {
-    "call": "User Domains",
-    "key": "User Domains",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:399"
-    ]
-  },
-  {
-    "call": "User Domains List",
-    "key": "User Domains List",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:425"
-    ]
-  },
-  {
-    "call": "User Subnet List Type",
-    "key": "User Subnet List Type",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:467"
-    ]
-  },
-  {
-    "call": "User Subnets",
-    "key": "User Subnets",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:479"
-    ]
-  },
-  {
-    "call": "User Subnets List",
-    "key": "User Subnets List",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:505"
-    ]
-  },
-  {
-    "call": "Valid",
-    "key": "Valid",
-    "places": [
-      "src/validators/validateDns.ts:14",
-      "src/validators/validateDns.ts:18",
-      "src/validators/validateDomain.ts:13",
-      "src/validators/validateDomain.ts:30",
-      "src/validators/validateHysteriaUrl.ts:120",
-      "src/validators/validateIp.ts:8",
-      "src/validators/validateOutboundJson.ts:7",
-      "src/validators/validatePath.ts:16",
-      "src/validators/validateShadowsocksUrl.ts:95",
-      "src/validators/validateSocksUrl.ts:80",
-      "src/validators/validateSubnet.ts:38",
-      "src/validators/validateTrojanUrl.ts:59",
-      "src/validators/validateUrl.ts:28",
-      "src/validators/validateVlessUrl.ts:108"
-    ]
-  },
-  {
-    "call": "Validation errors:",
-    "key": "Validation errors:",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:458",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:537"
-    ]
-  },
-  {
-    "call": "View logs",
-    "key": "View logs",
-    "places": [
-      "src/podkop/tabs/diagnostic/initController.ts:256",
-      "src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:107"
-    ]
-  },
-  {
-    "call": "Visit Wiki",
-    "key": "Visit Wiki",
-    "places": [
-      "src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:31"
-    ]
-  },
-  {
-    "call": "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
-    "key": "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:37",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:89",
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:112"
-    ]
-  },
-  {
-    "call": "Warning: %s cannot be used together with %s. Previous selections have been removed.",
-    "key": "Warning: %s cannot be used together with %s. Previous selections have been removed.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:335"
-    ]
-  },
-  {
-    "call": "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection.",
-    "key": "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection.",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:354"
-    ]
-  },
-  {
-    "call": "YACD Secret Key",
-    "key": "YACD Secret Key",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:256"
-    ]
-  },
-  {
-    "call": "You can select Output Network Interface, by default autodetect",
-    "key": "You can select Output Network Interface, by default autodetect",
-    "places": [
-      "../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:127"
-    ]
-  }
-]
\ No newline at end of file
diff --git a/fe-app-podkop/locales/podkop.pot b/fe-app-podkop/locales/podkop.pot
deleted file mode 100644
index d96b948e..00000000
--- a/fe-app-podkop/locales/podkop.pot
+++ /dev/null
@@ -1,1115 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) 2026 THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PODKOP package.
-# divocatt <210179590+divocatt@users.noreply.github.com>, 2026.
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PODKOP\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-29 13:40+0300\n"
-"PO-Revision-Date: 2026-05-29 13:40+0300\n"
-"Last-Translator: divocatt <210179590+divocatt@users.noreply.github.com>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: src/podkop/tabs/dashboard/initController.ts:345
-msgid "✔ Enabled"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:356
-msgid "✔ Running"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:346
-msgid "✘ Disabled"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:357
-msgid "✘ Stopped"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:307
-msgid "Active Connections"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:106
-msgid "Additional marking rules found"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:247
-msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:199
-msgid "Applicable for SOCKS and Shadowsocks proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:444
-msgid "At least one valid domain must be specified. Comments-only content is not allowed."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:525
-msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:43
-msgid "Available actions"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:65
-msgid "Bootsrap DNS"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:45
-msgid "Bootstrap DNS server"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:58
-msgid "Browser is not using FakeIP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:57
-msgid "Browser is using FakeIP correctly"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:348
-msgid "Cache File Path"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:362
-msgid "Cache file path cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:27
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:28
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:27
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:25
-msgid "Cannot receive checks result"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:13
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:13
-msgid "Checking, please wait"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts:2
-msgid "checks"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:26
-msgid "Checks failed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:13
-msgid "Checks passed"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:33
-msgid "CIDR must be between 0 and 32"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:26
-msgid "Close"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:299
-msgid "Community Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:335
-msgid "Config File Path"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:27
-msgid "Configuration for Podkop service"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:23
-msgid "Configuration Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:12
-msgid "Connection Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:26
-msgid "Connection URL"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:20
-msgid "Copy"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderWidget.ts:22
-msgid "Currently unavailable"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:80
-msgid "Dashboard"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderSections.ts:19
-msgid "Dashboard currently unavailable"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:222
-msgid "Delay in milliseconds before reloading podkop after interface UP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:229
-msgid "Delay value cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:82
-msgid "DHCP has DNS server"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:65
-msgid "Diagnostics"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:79
-msgid "Disable autostart"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:265
-msgid "Disable QUIC"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:266
-msgid "Disable the QUIC protocol to improve compatibility or fix issues with video streaming"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:390
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:470
-msgid "Disabled"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:77
-msgid "DNS on router"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:267
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:15
-msgid "DNS over HTTPS (DoH)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:268
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:16
-msgid "DNS over TLS (DoT)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:264
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:12
-msgid "DNS Protocol Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:68
-msgid "DNS Rewrite TTL"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:277
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:24
-msgid "DNS Server"
-msgstr ""
-
-#: src/validators/validateDns.ts:7
-msgid "DNS server address cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26
-msgid "Do not panic, everything can be fixed, just..."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:254
-msgid "Domain Resolver"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:326
-msgid "Dont Touch My DHCP!"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:241
-#: src/podkop/tabs/dashboard/initController.ts:275
-msgid "Downlink"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:15
-msgid "Download"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:288
-msgid "Download Lists via Proxy/VPN"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:297
-msgid "Download Lists via specific proxy section"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:289
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:298
-msgid "Downloading all lists via specific Proxy/VPN"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:391
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:471
-msgid "Dynamic List"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:89
-msgid "Enable autostart"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:255
-msgid "Enable built-in DNS resolver for domains handled by this section"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:691
-msgid "Enable DNS resolve to get real IP when routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:665
-msgid "Enable Mixed Proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:126
-msgid "Enable Output Network Interface"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:666
-msgid "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:237
-msgid "Enable YACD"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:246
-msgid "Enable YACD WAN Access"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:66
-msgid "Enter complete outbound configuration in JSON format"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:426
-msgid "Enter domain names separated by commas, spaces, or newlines. You can add comments using //"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:400
-msgid "Enter domain names without protocols, e.g. example.com or sub.example.com"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:480
-msgid "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:138
-msgid "Every 1 minute"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:139
-msgid "Every 3 minutes"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:137
-msgid "Every 30 seconds"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:140
-msgid "Every 5 minutes"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:402
-msgid "Exclude NTP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:403
-msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
-msgstr ""
-
-#: src/helpers/copyToClipboard.ts:12
-msgid "Failed to copy!"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:227
-#: src/podkop/tabs/diagnostic/initController.ts:231
-#: src/podkop/tabs/diagnostic/initController.ts:261
-#: src/podkop/tabs/diagnostic/initController.ts:265
-#: src/podkop/tabs/diagnostic/initController.ts:302
-#: src/podkop/tabs/diagnostic/initController.ts:306
-msgid "Failed to execute!"
-msgstr ""
-
-#: src/podkop/methods/custom/getDashboardSections.ts:148
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:59
-msgid "Fastest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:638
-msgid "Fully Routed IPs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:98
-msgid "Get global check"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:222
-msgid "Global check"
-msgstr ""
-
-#: src/podkop/api.ts:27
-msgid "HTTP error"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:189
-msgid "Interface Monitoring"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:221
-msgid "Interface Monitoring Delay"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:190
-msgid "Interface monitoring for Bad WAN"
-msgstr ""
-
-#: src/validators/validateDns.ts:23
-msgid "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
-msgstr ""
-
-#: src/validators/validateDomain.ts:18
-#: src/validators/validateDomain.ts:27
-msgid "Invalid domain address"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:11
-msgid "Invalid format. Use X.X.X.X or X.X.X.X/Y"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:90
-msgid "Invalid HY2 URL: insecure must be 0 or 1"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:77
-msgid "Invalid HY2 URL: invalid port number"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:30
-msgid "Invalid HY2 URL: missing credentials/server"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:47
-msgid "Invalid HY2 URL: missing host"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:41
-msgid "Invalid HY2 URL: missing host & port"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:36
-msgid "Invalid HY2 URL: missing password"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:50
-msgid "Invalid HY2 URL: missing port"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:18
-msgid "Invalid HY2 URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:12
-msgid "Invalid HY2 URL: must start with hysteria2:// or hy2://"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:108
-msgid "Invalid HY2 URL: obfs-password required when obfs is set"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:122
-msgid "Invalid HY2 URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:116
-msgid "Invalid HY2 URL: sni cannot be empty"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:98
-msgid "Invalid HY2 URL: unsupported obfs type"
-msgstr ""
-
-#: src/validators/validateIp.ts:11
-msgid "Invalid IP address"
-msgstr ""
-
-#: src/validators/validateOutboundJson.ts:9
-msgid "Invalid JSON format"
-msgstr ""
-
-#: src/validators/validatePath.ts:22
-msgid "Invalid path format. Path must start with \"/\" and contain valid characters"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:85
-msgid "Invalid port number. Must be between 1 and 65535"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:37
-msgid "Invalid Shadowsocks URL: decoded credentials must contain method:password"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:27
-msgid "Invalid Shadowsocks URL: missing credentials"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:46
-msgid "Invalid Shadowsocks URL: missing method and password separator \":\""
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:76
-msgid "Invalid Shadowsocks URL: missing port"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:67
-msgid "Invalid Shadowsocks URL: missing server"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:58
-msgid "Invalid Shadowsocks URL: missing server address"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:16
-msgid "Invalid Shadowsocks URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:8
-msgid "Invalid Shadowsocks URL: must start with ss://"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:91
-msgid "Invalid Shadowsocks URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:73
-msgid "Invalid SOCKS URL: invalid host format"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:63
-msgid "Invalid SOCKS URL: invalid port number"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:42
-msgid "Invalid SOCKS URL: missing host and port"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:51
-msgid "Invalid SOCKS URL: missing hostname or IP"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:56
-msgid "Invalid SOCKS URL: missing port"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:34
-msgid "Invalid SOCKS URL: missing username"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:19
-msgid "Invalid SOCKS URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:10
-msgid "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:77
-msgid "Invalid SOCKS URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:15
-msgid "Invalid Trojan URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:8
-msgid "Invalid Trojan URL: must start with trojan://"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:56
-msgid "Invalid Trojan URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateUrl.ts:8
-#: src/validators/validateUrl.ts:31
-msgid "Invalid URL format"
-msgstr ""
-
-#: src/validators/validateVlessUrl.ts:110
-msgid "Invalid VLESS URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:18
-msgid "IP address 0.0.0.0 is not allowed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:20
-msgid "Issues detected"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:48
-msgid "Latest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:276
-msgid "List Update Frequency"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:546
-msgid "Local Domain Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:569
-msgid "Local Subnet Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:384
-msgid "Log Level"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:72
-msgid "Main DNS"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:311
-msgid "Memory Usage"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:678
-msgid "Mixed Proxy Port"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:198
-msgid "Monitored Interfaces"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:164
-msgid "Must be a number in the range of 50 - 1000"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:208
-msgid "Network Interface"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:105
-msgid "No other marking rules found"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderCheckSection.ts:189
-msgid "Not implement yet"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:75
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:81
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:100
-msgid "Not responding"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:55
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:63
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:71
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:79
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:87
-msgid "Not running"
-msgstr ""
-
-#: src/helpers/withTimeout.ts:7
-msgid "Operation timed out"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:29
-msgid "Outbound Config"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:65
-msgid "Outbound Configuration"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:38
-msgid "Outdated"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:135
-msgid "Output Network Interface"
-msgstr ""
-
-#: src/validators/validatePath.ts:7
-msgid "Path cannot be empty"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:366
-msgid "Path must be absolute (start with /)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:375
-msgid "Path must contain at least one directory (like /tmp/cache.db)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:370
-msgid "Path must end with cache.db"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:103
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:111
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:119
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:127
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:135
-msgid "Pending"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:343
-msgid "Podkop"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:26
-msgid "Podkop Settings"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:327
-msgid "Podkop will not modify your DHCP configuration"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:36
-msgid "Proxy Configuration URL"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:66
-msgid "Proxy traffic is not routed via FakeIP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:65
-msgid "Proxy traffic is routed via FakeIP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:333
-msgid "Regional options cannot be used together"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:592
-msgid "Remote Domain Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:615
-msgid "Remote Subnet Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:690
-msgid "Resolve real IP for routing"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:49
-msgid "Restart podkop"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:51
-msgid "Router DNS is not routed through sing-box"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:50
-msgid "Router DNS is routed through sing-box"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:413
-msgid "Routing Excluded IPs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:79
-msgid "Rules mangle counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:74
-msgid "Rules mangle exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:89
-msgid "Rules mangle output counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:84
-msgid "Rules mangle output exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:99
-msgid "Rules proxy counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:94
-msgid "Rules proxy exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderRunAction.ts:15
-msgid "Run Diagnostic"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:352
-msgid "Russia inside restrictions"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:257
-msgid "Secret key for authenticating remote access to YACD when WAN access is enabled."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:36
-msgid "Sections"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:300
-msgid "Select a predefined list for routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:13
-msgid "Select between VPN and Proxy connection methods for traffic routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:13
-msgid "Select DNS protocol to use"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:277
-msgid "Select how often the domain or subnet lists are updated automatically"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:24
-msgid "Select how to configure the proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:209
-msgid "Select network interface for VPN connection"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:278
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:25
-msgid "Select or enter DNS server address"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:349
-msgid "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:336
-msgid "Select path for sing-box config file. Change this ONLY if you know what you are doing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:265
-msgid "Select the DNS protocol type for the domain resolver"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:388
-msgid "Select the list type for adding custom domains"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:468
-msgid "Select the list type for adding custom subnets"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:385
-msgid "Select the log level for sing-box"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:90
-msgid "Select the network interface from which the traffic will originate"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:136
-msgid "Select the network interface to which the traffic will originate"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:199
-msgid "Select the WAN interfaces to be monitored"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:27
-msgid "Selector"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:88
-msgid "Selector Proxy Links"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:340
-msgid "Services info"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:49
-msgid "Settings"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:290
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:116
-msgid "Show sing-box config"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:354
-msgid "Sing-box"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:77
-msgid "Sing-box autostart disabled"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:62
-msgid "Sing-box installed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:87
-msgid "Sing-box listening ports"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:82
-msgid "Sing-box process running"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:72
-msgid "Sing-box service exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:67
-msgid "Sing-box version is compatible (newer than 1.12.4)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:89
-msgid "Source Network Interface"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:414
-msgid "Specify a local IP address to be excluded from routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:639
-msgid "Specify local IP addresses or subnets whose traffic will always be routed through the configured route"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:593
-msgid "Specify remote URLs to download and use domain lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:616
-msgid "Specify remote URLs to download and use subnet lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:547
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:570
-msgid "Specify the path to the list file located on the router filesystem"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:69
-msgid "Start podkop"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:59
-msgid "Stop podkop"
-msgstr ""
-
-#: src/helpers/copyToClipboard.ts:10
-msgid "Successfully copied!"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:304
-msgid "System info"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts:21
-msgid "System information"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:69
-msgid "Table exist"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderSections.ts:108
-msgid "Test latency"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:392
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:472
-msgid "Text List"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:46
-msgid "The DNS server used to look up the IP address of an upstream DNS server"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:135
-msgid "The interval between connectivity tests"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:148
-msgid "The maximum difference in response times (ms) allowed when comparing servers"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:171
-msgid "The URL used to test server connectivity"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:69
-msgid "Time in seconds for DNS record caching (default: 60)"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:238
-msgid "Traffic"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:268
-msgid "Traffic Total"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:25
-msgid "Troubleshooting"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:80
-msgid "TTL must be a positive number"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:75
-msgid "TTL value cannot be empty"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:269
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:17
-msgid "UDP (Unprotected DNS)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:198
-msgid "UDP over TCP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:38
-#: src/podkop/tabs/diagnostic/initController.ts:39
-#: src/podkop/tabs/diagnostic/initController.ts:40
-#: src/podkop/tabs/diagnostic/initController.ts:41
-#: src/podkop/tabs/diagnostic/initController.ts:42
-#: src/podkop/tabs/diagnostic/initController.ts:43
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:7
-msgid "unknown"
-msgstr ""
-
-#: src/podkop/api.ts:40
-msgid "Unknown error"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:240
-#: src/podkop/tabs/dashboard/initController.ts:271
-msgid "Uplink"
-msgstr ""
-
-#: src/validators/validateProxyUrl.ts:37
-msgid "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
-msgstr ""
-
-#: src/validators/validateUrl.ts:17
-msgid "URL must use one of the following protocols:"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:28
-msgid "URLTest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:134
-msgid "URLTest Check Interval"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:111
-msgid "URLTest Proxy Links"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:170
-msgid "URLTest Testing URL"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:147
-msgid "URLTest Tolerance"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:387
-msgid "User Domain List Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:399
-msgid "User Domains"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:425
-msgid "User Domains List"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:467
-msgid "User Subnet List Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:479
-msgid "User Subnets"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:505
-msgid "User Subnets List"
-msgstr ""
-
-#: src/validators/validateDns.ts:14
-#: src/validators/validateDns.ts:18
-#: src/validators/validateDomain.ts:13
-#: src/validators/validateDomain.ts:30
-#: src/validators/validateHysteriaUrl.ts:120
-#: src/validators/validateIp.ts:8
-#: src/validators/validateOutboundJson.ts:7
-#: src/validators/validatePath.ts:16
-#: src/validators/validateShadowsocksUrl.ts:95
-#: src/validators/validateSocksUrl.ts:80
-#: src/validators/validateSubnet.ts:38
-#: src/validators/validateTrojanUrl.ts:59
-#: src/validators/validateUrl.ts:28
-#: src/validators/validateVlessUrl.ts:108
-msgid "Valid"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:458
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:537
-msgid "Validation errors:"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:256
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:107
-msgid "View logs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:31
-msgid "Visit Wiki"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:37
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:89
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:112
-msgid "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:335
-msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:354
-msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:256
-msgid "YACD Secret Key"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:127
-msgid "You can select Output Network Interface, by default autodetect"
-msgstr ""
diff --git a/fe-app-podkop/src/podkop/fetchers/fetchServicesInfo.ts b/fe-app-podkop/src/podkop/fetchers/fetchServicesInfo.ts
deleted file mode 100644
index 777ab94b..00000000
--- a/fe-app-podkop/src/podkop/fetchers/fetchServicesInfo.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { PodkopShellMethods } from '../methods';
-import { store } from '../services';
-
-export async function fetchServicesInfo() {
-  const [podkop, singbox] = await Promise.all([
-    PodkopShellMethods.getStatus(),
-    PodkopShellMethods.getSingBoxStatus(),
-  ]);
-
-  if (!podkop.success || !singbox.success) {
-    store.set({
-      servicesInfoWidget: {
-        loading: false,
-        failed: true,
-        data: { singbox: 0, podkop: 0 },
-      },
-    });
-  }
-
-  if (podkop.success && singbox.success) {
-    store.set({
-      servicesInfoWidget: {
-        loading: false,
-        failed: false,
-        data: { singbox: singbox.data.running, podkop: podkop.data.enabled },
-      },
-    });
-  }
-}
diff --git a/fe-app-podkop/src/podkop/methods/custom/getConfigSections.ts b/fe-app-podkop/src/podkop/methods/custom/getConfigSections.ts
deleted file mode 100644
index bdb13c46..00000000
--- a/fe-app-podkop/src/podkop/methods/custom/getConfigSections.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { Podkop } from '../../types';
-
-export async function getConfigSections(): Promise<Podkop.ConfigSection[]> {
-  return uci.load('podkop').then(() => uci.sections('podkop'));
-}
diff --git a/fe-app-podkop/src/podkop/methods/shell/index.ts b/fe-app-podkop/src/podkop/methods/shell/index.ts
deleted file mode 100644
index e9c29406..00000000
--- a/fe-app-podkop/src/podkop/methods/shell/index.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-import { callBaseMethod } from './callBaseMethod';
-import { ClashAPI, Podkop } from '../../types';
-
-export const PodkopShellMethods = {
-  checkDNSAvailable: async () =>
-    callBaseMethod<Podkop.DnsCheckResult>(
-      Podkop.AvailableMethods.CHECK_DNS_AVAILABLE,
-    ),
-  checkFakeIP: async () =>
-    callBaseMethod<Podkop.FakeIPCheckResult>(
-      Podkop.AvailableMethods.CHECK_FAKEIP,
-    ),
-  checkNftRules: async () =>
-    callBaseMethod<Podkop.NftRulesCheckResult>(
-      Podkop.AvailableMethods.CHECK_NFT_RULES,
-    ),
-  getStatus: async () =>
-    callBaseMethod<Podkop.GetStatus>(Podkop.AvailableMethods.GET_STATUS),
-  checkSingBox: async () =>
-    callBaseMethod<Podkop.SingBoxCheckResult>(
-      Podkop.AvailableMethods.CHECK_SING_BOX,
-    ),
-  getSingBoxStatus: async () =>
-    callBaseMethod<Podkop.GetSingBoxStatus>(
-      Podkop.AvailableMethods.GET_SING_BOX_STATUS,
-    ),
-  getClashApiProxies: async () =>
-    callBaseMethod<ClashAPI.Proxies>(Podkop.AvailableMethods.CLASH_API, [
-      Podkop.AvailableClashAPIMethods.GET_PROXIES,
-    ]),
-  getClashApiProxyLatency: async (tag: string) =>
-    callBaseMethod<Podkop.GetClashApiProxyLatency>(
-      Podkop.AvailableMethods.CLASH_API,
-      [Podkop.AvailableClashAPIMethods.GET_PROXY_LATENCY, tag, '5000'],
-    ),
-  getClashApiGroupLatency: async (tag: string) =>
-    callBaseMethod<Podkop.GetClashApiGroupLatency>(
-      Podkop.AvailableMethods.CLASH_API,
-      [Podkop.AvailableClashAPIMethods.GET_GROUP_LATENCY, tag, '10000'],
-    ),
-  setClashApiGroupProxy: async (group: string, proxy: string) =>
-    callBaseMethod<unknown>(Podkop.AvailableMethods.CLASH_API, [
-      Podkop.AvailableClashAPIMethods.SET_GROUP_PROXY,
-      group,
-      proxy,
-    ]),
-  restart: async () =>
-    callBaseMethod<unknown>(
-      Podkop.AvailableMethods.RESTART,
-      [],
-      '/etc/init.d/podkop',
-    ),
-  start: async () =>
-    callBaseMethod<unknown>(
-      Podkop.AvailableMethods.START,
-      [],
-      '/etc/init.d/podkop',
-    ),
-  stop: async () =>
-    callBaseMethod<unknown>(
-      Podkop.AvailableMethods.STOP,
-      [],
-      '/etc/init.d/podkop',
-    ),
-  enable: async () =>
-    callBaseMethod<unknown>(
-      Podkop.AvailableMethods.ENABLE,
-      [],
-      '/etc/init.d/podkop',
-    ),
-  disable: async () =>
-    callBaseMethod<unknown>(
-      Podkop.AvailableMethods.DISABLE,
-      [],
-      '/etc/init.d/podkop',
-    ),
-  globalCheck: async () =>
-    callBaseMethod<unknown>(Podkop.AvailableMethods.GLOBAL_CHECK),
-  showSingBoxConfig: async () =>
-    callBaseMethod<unknown>(Podkop.AvailableMethods.SHOW_SING_BOX_CONFIG),
-  checkLogs: async () =>
-    callBaseMethod<unknown>(Podkop.AvailableMethods.CHECK_LOGS),
-  getSystemInfo: async () =>
-    callBaseMethod<Podkop.GetSystemInfo>(
-      Podkop.AvailableMethods.GET_SYSTEM_INFO,
-    ),
-};
diff --git a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts b/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts
deleted file mode 100644
index f686b8a6..00000000
--- a/fe-app-podkop/src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { insertIf } from '../../../../helpers';
-
-export interface IRenderSystemInfoRow {
-  key: string;
-  value: string;
-  tag?: {
-    label: string;
-    kind: 'warning' | 'success';
-  };
-}
-
-interface IRenderSystemInfoProps {
-  items: Array<IRenderSystemInfoRow>;
-}
-
-export function renderSystemInfo({ items }: IRenderSystemInfoProps) {
-  return E('div', { class: 'pdk_diagnostic-page__right-bar__system-info' }, [
-    E(
-      'b',
-      { class: 'pdk_diagnostic-page__right-bar__system-info__title' },
-      _('System information'),
-    ),
-    ...items.map((item) => {
-      const tagClass = [
-        'pdk_diagnostic-page__right-bar__system-info__row__tag',
-        ...insertIf(item.tag?.kind === 'warning', [
-          'pdk_diagnostic-page__right-bar__system-info__row__tag--warning',
-        ]),
-        ...insertIf(item.tag?.kind === 'success', [
-          'pdk_diagnostic-page__right-bar__system-info__row__tag--success',
-        ]),
-      ]
-        .filter(Boolean)
-        .join(' ');
-
-      return E(
-        'div',
-        { class: 'pdk_diagnostic-page__right-bar__system-info__row' },
-        [
-          E('b', {}, item.key),
-          E('div', {}, [
-            E('span', {}, item.value),
-            E('span', { class: tagClass }, item?.tag?.label),
-          ]),
-        ],
-      );
-    }),
-  ]);
-}
diff --git a/fe-app-podkop/src/styles.ts b/fe-app-podkop/src/styles.ts
deleted file mode 100644
index e40000dd..00000000
--- a/fe-app-podkop/src/styles.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-// language=CSS
-import { DashboardTab, DiagnosticTab } from './podkop';
-import { PartialStyles } from './partials';
-
-export const GlobalStyles = `
-${DashboardTab.styles}
-${DiagnosticTab.styles}
-${PartialStyles}
-
-
-/* Hide extra H3 for settings tab */
-#cbi-podkop-settings > h3 {
-    display: none;
-}
-
-/* Hide extra H3 for sections tab */
-#cbi-podkop-section > h3:nth-child(1) {
-    display: none;
-}
-
-/* Vertical align for remove section action button */
-#cbi-podkop-section > .cbi-section-remove {
-    margin-bottom: -32px;
-}
-
-/* Centered class helper */
-.centered {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-}
-
-/* Rotate class helper */
-.rotate {
-    animation: spin 1s linear infinite;
-}
-
-@keyframes spin {
-    from { transform: rotate(0deg); }
-    to { transform: rotate(360deg); }
-}
-
-/* Skeleton styles*/
-.skeleton {
-    background-color: var(--background-color-low, #e0e0e0);
-    border-radius: 4px;
-    position: relative;
-    overflow: hidden;
-}
-
-.skeleton::after {
-    content: '';
-    position: absolute;
-    top: 0;
-    left: -150%;
-    width: 150%;
-    height: 100%;
-    background: linear-gradient(
-            90deg,
-            transparent,
-            rgba(255, 255, 255, 0.4),
-            transparent
-    );
-    animation: skeleton-shimmer 1.6s infinite;
-}
-
-@keyframes skeleton-shimmer {
-    100% {
-        left: 150%;
-    }
-}
-/* Toast */
-.toast-container {
-    position: fixed;
-    bottom: 30px;
-    left: 50%;
-    transform: translateX(-50%);
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: 10px;
-    z-index: 9999;
-    font-family: system-ui, sans-serif;
-}
-
-.toast {
-    opacity: 0;
-    transform: translateY(10px);
-    transition: opacity 0.3s ease, transform 0.3s ease;
-    padding: 10px 16px;
-    border-radius: 6px;
-    color: #fff;
-    font-size: 14px;
-    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.2);
-    min-width: 220px;
-    max-width: 340px;
-    text-align: center;
-}
-
-.toast-success {
-    background-color: #28a745;
-}
-
-.toast-error {
-    background-color: #dc3545;
-}
-
-.toast.visible {
-    opacity: 1;
-    transform: translateY(0);
-}
-`;
diff --git a/fe-app-podkop/src/validators/tests/validateIp.test.js b/fe-app-podkop/src/validators/tests/validateIp.test.js
deleted file mode 100644
index fe86c1ce..00000000
--- a/fe-app-podkop/src/validators/tests/validateIp.test.js
+++ /dev/null
@@ -1,38 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { validateIPV4 } from '../validateIp';
-
-export const validIPs = [
-  ['Private LAN', '192.168.1.1'],
-  ['All zeros', '0.0.0.0'],
-  ['Broadcast', '255.255.255.255'],
-  ['Simple', '1.2.3.4'],
-  ['Loopback', '127.0.0.1'],
-];
-
-export const invalidIPs = [
-  ['Octet too large', '256.0.0.1'],
-  ['Too few octets', '192.168.1'],
-  ['Too many octets', '1.2.3.4.5'],
-  ['Leading zero (1st octet)', '01.2.3.4'],
-  ['Leading zero (2nd octet)', '1.02.3.4'],
-  ['Leading zero (3rd octet)', '1.2.003.4'],
-  ['Leading zero (4th octet)', '1.2.3.004'],
-  ['Four digits in octet', '1.2.3.0004'],
-  ['Trailing dot', '1.2.3.'],
-];
-
-describe('validateIPV4', () => {
-  describe.each(validIPs)('Valid IP: %s', (_desc, ip) => {
-    it(`returns {valid:true} for "${ip}"`, () => {
-      const res = validateIPV4(ip);
-      expect(res.valid).toBe(true);
-    });
-  });
-
-  describe.each(invalidIPs)('Invalid IP: %s', (_desc, ip) => {
-    it(`returns {valid:false} for "${ip}"`, () => {
-      const res = validateIPV4(ip);
-      expect(res.valid).toBe(false);
-    });
-  });
-});
diff --git a/fe-app-podkop/src/validators/validateDns.ts b/fe-app-podkop/src/validators/validateDns.ts
deleted file mode 100644
index 1952a739..00000000
--- a/fe-app-podkop/src/validators/validateDns.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { validateDomain } from './validateDomain';
-import { validateIPV4 } from './validateIp';
-import { ValidationResult } from './types';
-
-export function validateDNS(value: string): ValidationResult {
-  if (!value) {
-    return { valid: false, message: _('DNS server address cannot be empty') };
-  }
-
-  const cleanedValueWithoutPort = value.replace(/:(\d+)(?=\/|$)/, '');
-  const cleanedIpWithoutPath = cleanedValueWithoutPort.split('/')[0];
-
-  if (validateIPV4(cleanedIpWithoutPath).valid) {
-    return { valid: true, message: _('Valid') };
-  }
-
-  if (validateDomain(cleanedValueWithoutPort).valid) {
-    return { valid: true, message: _('Valid') };
-  }
-
-  return {
-    valid: false,
-    message: _(
-      'Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH',
-    ),
-  };
-}
diff --git a/fe-app-podkop/src/validators/validateIp.ts b/fe-app-podkop/src/validators/validateIp.ts
deleted file mode 100644
index 78c154d2..00000000
--- a/fe-app-podkop/src/validators/validateIp.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { ValidationResult } from './types';
-
-export function validateIPV4(ip: string): ValidationResult {
-  const ipRegex =
-    /^(?:(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/;
-
-  if (ipRegex.test(ip)) {
-    return { valid: true, message: _('Valid') };
-  }
-
-  return { valid: false, message: _('Invalid IP address') };
-}
diff --git a/fe-app-podkop/src/validators/validateSubnet.ts b/fe-app-podkop/src/validators/validateSubnet.ts
deleted file mode 100644
index e7974a21..00000000
--- a/fe-app-podkop/src/validators/validateSubnet.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { ValidationResult } from './types';
-import { validateIPV4 } from './validateIp';
-
-export function validateSubnet(value: string): ValidationResult {
-  // Must be in form X.X.X.X or X.X.X.X/Y
-  const subnetRegex = /^(\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$/;
-
-  if (!subnetRegex.test(value)) {
-    return {
-      valid: false,
-      message: _('Invalid format. Use X.X.X.X or X.X.X.X/Y'),
-    };
-  }
-
-  const [ip, cidr] = value.split('/');
-
-  if (ip === '0.0.0.0') {
-    return { valid: false, message: _('IP address 0.0.0.0 is not allowed') };
-  }
-
-  const ipCheck = validateIPV4(ip);
-  if (!ipCheck.valid) {
-    return ipCheck;
-  }
-
-  // Validate CIDR if present
-  if (cidr) {
-    const cidrNum = parseInt(cidr, 10);
-
-    if (cidrNum < 0 || cidrNum > 32) {
-      return {
-        valid: false,
-        message: _('CIDR must be between 0 and 32'),
-      };
-    }
-  }
-
-  return { valid: true, message: _('Valid') };
-}
diff --git a/fe-app-podkop/src/validators/validateUrl.ts b/fe-app-podkop/src/validators/validateUrl.ts
deleted file mode 100644
index 417b4e79..00000000
--- a/fe-app-podkop/src/validators/validateUrl.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { ValidationResult } from './types';
-
-export function validateUrl(
-  url: string,
-  protocols = ['http:', 'https:'],
-): ValidationResult {
-  if (!url.length) {
-    return { valid: false, message: _('Invalid URL format') };
-  }
-
-  const hasValidProtocol = protocols.some((p) => url.indexOf(p + '//') === 0);
-
-  if (!hasValidProtocol)
-    return {
-      valid: false,
-      message:
-        _('URL must use one of the following protocols:') +
-        ' ' +
-        protocols.join(', '),
-    };
-
-  const regex = new RegExp(
-    `^(?:${protocols.map((p) => p.replace(':', '')).join('|')})://` +
-      `(?:[A-Za-z0-9-]+\\.)+[A-Za-z]{2,}(?::\\d+)?(?:/[^\\s]*)?$`,
-  );
-
-  if (regex.test(url)) {
-    return { valid: true, message: _('Valid') };
-  }
-
-  return { valid: false, message: _('Invalid URL format') };
-}
diff --git a/install.sh b/install.sh
index 6376d7c2..baaf5895 100755
--- a/install.sh
+++ b/install.sh
@@ -1,8 +1,14 @@
 #!/bin/sh
 # shellcheck shell=dash
 
-REPO="https://api.github.com/repos/itdoginfo/podkop/releases/latest"
-DOWNLOAD_DIR="/tmp/podkop"
+REPO="https://api.github.com/repos/yandexru45/netshift/releases/latest"
+# github.com FRONTEND redirect path (NOT the rate-limited api.github.com).
+# /releases/latest 302s to /releases/tag/<tag>; /releases/download/<tag>/<asset>
+# 302s to the CDN. Primary install path so CGNAT / shared-IP routers avoid the
+# 60/hour/IP API limit; REPO stays as the fallback.
+RELEASES_LATEST_REDIRECT="https://github.com/yandexru45/netshift/releases/latest"
+RELEASES_DOWNLOAD_BASE="https://github.com/yandexru45/netshift/releases/download"
+DOWNLOAD_DIR="/tmp/netshift"
 COUNT=3
 
 # Cached flag to switch between ipk or apk package managers
@@ -57,26 +63,26 @@ pkg_install() {
         # If you're installing a non-standard (self-built) package, use the --allow-untrusted option:
         apk add --allow-untrusted "$pkg_file"
     else
-        opkg install "$pkg_file"
+        opkg install --force-downgrade --force-reinstall "$pkg_file"
     fi
 }
 
 update_config() {
     printf "\033[48;5;196m\033[1m╔══════════════════════════════════════════════════════════════════════╗\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ ! Обнаружена старая версия podkop.                                   ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ Если продолжите обновление, вам потребуется настроить Podkop заново. ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ Старая конфигурация будет сохранена в /etc/config/podkop-070         ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ Подробности: https://github.com/itdoginfo/podkop                     ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ ! Обнаружена старая версия NetShift.                                 ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Если продолжите обновление, вам потребуется настроить NetShift заново.║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Старая конфигурация будет сохранена в /etc/config/netshift-070       ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Подробности: https://github.com/yandexru45/netshift                  ║\033[0m\n"
     printf "\033[48;5;196m\033[1m║ Точно хотите продолжить?                                             ║\033[0m\n"
     printf "\033[48;5;196m\033[1m╚══════════════════════════════════════════════════════════════════════╝\033[0m\n"
 
     echo ""
 
     printf "\033[48;5;196m\033[1m╔══════════════════════════════════════════════════════════════════════╗\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ ! Detected old podkop version.                                       ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ If you continue the update, you will need to RECONFIGURE podkop.     ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ Your old configuration will be saved to /etc/config/podkop-070       ║\033[0m\n"
-    printf "\033[48;5;196m\033[1m║ Details: https://github.com/itdoginfo/podkop                         ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ ! Detected old NetShift version.                                     ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ If you continue the update, you will need to RECONFIGURE NetShift.   ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Your old configuration will be saved to /etc/config/netshift-070     ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Details: https://github.com/yandexru45/netshift                      ║\033[0m\n"
     printf "\033[48;5;196m\033[1m║ Are you sure you want to continue?                                   ║\033[0m\n"
     printf "\033[48;5;196m\033[1m╚══════════════════════════════════════════════════════════════════════╝\033[0m\n"
 
@@ -87,9 +93,9 @@ update_config() {
             case $CONFIG_UPDATE in
 
             yes|y|Y)
-                mv /etc/config/podkop /etc/config/podkop-070
-                wget -O /etc/config/podkop https://raw.githubusercontent.com/itdoginfo/podkop/refs/heads/main/podkop/files/etc/config/podkop
-                msg "Podkop config has been reset to default. Your old config saved in /etc/config/podkop-070"
+                mv /etc/config/netshift /etc/config/netshift-070
+                wget -O /etc/config/netshift https://raw.githubusercontent.com/yandexru45/netshift/refs/heads/main/netshift/files/etc/config/netshift
+                msg "NetShift config has been reset to default. Your old config saved in /etc/config/netshift-070"
                 break
                 ;;
             *)
@@ -100,6 +106,171 @@ update_config() {
     done
 }
 
+# Detect whether an OLD podkop install is present on this router.
+# Returns 0 (true) if any podkop artifact is found.
+podkop_is_installed() {
+    if [ -f "/etc/config/podkop" ]; then
+        return 0
+    fi
+    if command -v podkop >/dev/null 2>&1; then
+        return 0
+    fi
+    if [ -x "/etc/init.d/podkop" ] || [ -f "/etc/init.d/podkop" ]; then
+        return 0
+    fi
+    return 1
+}
+
+# Migrate an existing podkop (< 0.8.0) install to NetShift.
+# podkop never reached 0.8.0, so any old podkop install triggers this.
+# Every step is guarded by existence checks, POSIX, and idempotent so that
+# re-running install.sh is safe.
+migrate_from_podkop() {
+    local old_version
+    old_version=$(/usr/bin/podkop show_version 2>/dev/null)
+
+    # 1. Bilingual banner (RU first, EN second) + confirmation prompt.
+    printf "\033[48;5;196m\033[1m╔══════════════════════════════════════════════════════════════════════╗\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ ! Обнаружена установка podkop. Она будет перенесена в NetShift.      ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Ваша конфигурация будет перенесена автоматически.                   ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Старая конфигурация сохранится в /etc/config/podkop.bak.pre-netshift║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Старый пакет podkop будет удалён, NetShift будет установлен.         ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Подробности: https://github.com/yandexru45/netshift                  ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Точно хотите продолжить?                                             ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m╚══════════════════════════════════════════════════════════════════════╝\033[0m\n"
+
+    echo ""
+
+    printf "\033[48;5;196m\033[1m╔══════════════════════════════════════════════════════════════════════╗\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ ! Detected a podkop install. It will be migrated to NetShift.        ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Your configuration will be carried over automatically.              ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Old config will be backed up to /etc/config/podkop.bak.pre-netshift ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ The old podkop package will be removed, NetShift installed.          ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Details: https://github.com/yandexru45/netshift                      ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m║ Are you sure you want to continue?                                   ║\033[0m\n"
+    printf "\033[48;5;196m\033[1m╚══════════════════════════════════════════════════════════════════════╝\033[0m\n"
+
+    if [ -n "$old_version" ]; then
+        msg "Detected podkop version: $old_version"
+    fi
+
+    msg "Continue migration to NetShift? (yes/no)"
+
+    read -r -p '' MIGRATE_CONFIRM
+    case $MIGRATE_CONFIRM in
+        yes|y|Y)
+            ;;
+        *)
+            msg "Exit"
+            exit 1
+            ;;
+    esac
+
+    # 2. Stop the old service if running. The old 'stop' restores dnsmasq
+    #    (podkop_server/noresolv/cachesize keys in /etc/config/dhcp), removes
+    #    the old nft table PodkopTable and the '105 podkop' rt_tables line.
+    #    Must run BEFORE removing the package for a clean teardown.
+    if [ -x "/etc/init.d/podkop" ]; then
+        msg "Stopping old podkop service..."
+        /etc/init.d/podkop stop 2>/dev/null || true
+    fi
+
+    # 3. Disable old rc.d autostart (best-effort).
+    if [ -x "/etc/init.d/podkop" ]; then
+        msg "Disabling old podkop autostart..."
+        /etc/init.d/podkop disable 2>/dev/null || true
+    fi
+
+    # 4. Migrate config (copy first, then remove the original — we keep a
+    #    backup). Schema is compatible.
+    if [ -f "/etc/config/podkop" ]; then
+        if [ ! -f "/etc/config/netshift" ]; then
+            msg "Migrating config /etc/config/podkop -> /etc/config/netshift..."
+            cp /etc/config/podkop /etc/config/netshift 2>/dev/null || true
+        else
+            msg "/etc/config/netshift already exists, keeping it."
+        fi
+        if [ ! -f "/etc/config/podkop.bak.pre-netshift" ]; then
+            cp /etc/config/podkop /etc/config/podkop.bak.pre-netshift 2>/dev/null || true
+        fi
+        # Remove the original /etc/config/podkop so a re-run does not keep
+        # detecting an "old podkop install" (podkop_is_installed checks this
+        # path). opkg/apk never delete user config, so we must do it here.
+        # Only remove once the backup is confirmed present, to avoid data loss.
+        if [ -f "/etc/config/podkop.bak.pre-netshift" ]; then
+            msg "Removing migrated /etc/config/podkop (backup kept at podkop.bak.pre-netshift)..."
+            rm -f /etc/config/podkop 2>/dev/null || true
+        fi
+    fi
+
+    # 5. Migrate state dir (preserves subscription cache). Best-effort.
+    if [ -d "/etc/podkop" ] && [ ! -d "/etc/netshift" ]; then
+        msg "Migrating state dir /etc/podkop -> /etc/netshift..."
+        cp -r /etc/podkop /etc/netshift 2>/dev/null || true
+    fi
+
+    # 6. Clean leftover OLD persistent system state that opkg/apk remove won't.
+    #    rt_tables: remove old '105 podkop' line (NetShift adds '105 netshift'
+    #    itself on start).
+    if [ -f "/etc/iproute2/rt_tables" ] && grep -q "105 podkop" /etc/iproute2/rt_tables 2>/dev/null; then
+        msg "Removing old '105 podkop' rt_tables entry..."
+        sed -i "/105 podkop/d" /etc/iproute2/rt_tables 2>/dev/null || true
+    fi
+    #    Old cron lines: strip entries that call the old binary (NetShift re-adds
+    #    its own on start).
+    if crontab -l >/dev/null 2>&1; then
+        if crontab -l 2>/dev/null | grep -q "/usr/bin/podkop"; then
+            msg "Removing old podkop cron entries..."
+            crontab -l 2>/dev/null | grep -v "/usr/bin/podkop" | crontab - 2>/dev/null || true
+        fi
+    fi
+    #    NOTE: nft table PodkopTable + dnsmasq keys are cleaned by the
+    #    '/etc/init.d/podkop stop' above; we do NOT hand-edit /etc/config/dhcp.
+
+    # 7. Remove OLD packages (after config/state migrated).
+    #    Order: i18n, then luci-app, then backend.
+    if pkg_is_installed luci-i18n-podkop; then
+        msg "Removing old luci-i18n-podkop* packages..."
+        pkg_remove luci-i18n-podkop*
+    fi
+    if pkg_is_installed luci-app-podkop; then
+        msg "Removing old luci-app-podkop package..."
+        pkg_remove luci-app-podkop
+    fi
+    if pkg_is_installed "^podkop" || command -v podkop >/dev/null 2>&1; then
+        msg "Removing old podkop package..."
+        pkg_remove podkop
+    fi
+
+    # 8. Done.
+    msg "Migration complete. NetShift will now be installed."
+    msg "Your old config is preserved at /etc/config/podkop.bak.pre-netshift"
+}
+
+# Download one release asset URL into $DOWNLOAD_DIR with retry. POSIX sh.
+download_release_asset() {
+    url="$1"
+    filename="$2"
+    filepath="$DOWNLOAD_DIR/$filename"
+
+    attempt=0
+    while [ $attempt -lt $COUNT ]; do
+        msg "Download $filename (count $((attempt + 1)))..."
+        if wget -q -O "$filepath" "$url"; then
+            if [ -s "$filepath" ]; then
+                msg "$filename successfully downloaded"
+                return 0
+            fi
+        fi
+        msg "Download error for $filename. Retrying..."
+        rm -f "$filepath"
+        attempt=$((attempt + 1))
+    done
+
+    msg "Failed to download $filename after $COUNT attempts"
+    return 1
+}
+
 main() {
     check_system
     sing_box
@@ -108,58 +279,77 @@ main() {
 
     pkg_list_update || { echo "Packages list update failed"; exit 1; }
 
-    if [ -f "/etc/init.d/podkop" ]; then
-        msg "Podkop is already installed. Upgrading..."
+    if [ -f "/etc/init.d/netshift" ]; then
+        msg "NetShift is already installed. Upgrading..."
     else
-        msg "Installing podkop..."
+        msg "Installing NetShift..."
     fi
 
-    if command -v curl >/dev/null 2>&1; then
-        check_response=$(curl -s "https://api.github.com/repos/itdoginfo/podkop/releases/latest")
-
-        if echo "$check_response" | grep -q 'API rate limit '; then
-            msg "You've reached the GitHub rate limit. Repeat in five minutes."
-            exit 1
-        fi
-    fi
-
-    local grep_url_pattern
+    local ext release_tag redirect_url
     if [ "$PKG_IS_APK" -eq 1 ]; then
-        grep_url_pattern='https://[^"[:space:]]*\.apk'
+        ext="apk"
     else
-        grep_url_pattern='https://[^"[:space:]]*\.ipk'
+        ext="ipk"
     fi
 
-    wget -qO- "$REPO" | grep -o "$grep_url_pattern" | while read -r url; do
-        filename=$(basename "$url")
-        filepath="$DOWNLOAD_DIR/$filename"
+    # PRIMARY: resolve the latest tag via the github.com frontend redirect (no
+    # api.github.com hit → not subject to the 60/hour/IP rate limit), then build
+    # the deterministic releases/download/<tag>/<asset> URLs and download them.
+    release_tag=""
+    if command -v curl >/dev/null 2>&1; then
+        redirect_url=$(curl -sI -o /dev/null -w '%{redirect_url}' \
+            --connect-timeout 5 -m 15 -A 'netshift-installer' \
+            "$RELEASES_LATEST_REDIRECT" 2>/dev/null)
+        case "$redirect_url" in
+        */releases/tag/*)
+            release_tag="${redirect_url##*/releases/tag/}"
+            case "$release_tag" in '' | */*) release_tag="" ;; esac
+            ;;
+        esac
+    fi
 
-        attempt=0
-        while [ $attempt -lt $COUNT ]; do
-            msg "Download $filename (count $((attempt+1)))..."
-            if wget -q -O "$filepath" "$url"; then
-                if [ -s "$filepath" ]; then
-                    msg "$filename successfully downloaded"
-                    break
-                fi
+    if [ -n "$release_tag" ]; then
+        msg "Latest NetShift release: $release_tag (direct download, no GitHub API)"
+        for pkg in netshift luci-app-netshift; do
+            if [ "$ext" = "ipk" ]; then
+                filename="${pkg}-${release_tag}-r1-all.${ext}"
+            else
+                filename="${pkg}-${release_tag}-r1.${ext}"
             fi
-            msg "Download error for $filename. Retrying..."
-            rm -f "$filepath"
-            attempt=$((attempt+1))
+            download_release_asset "$RELEASES_DOWNLOAD_BASE/$release_tag/$filename" "$filename"
         done
+        # RU i18n only if already installed (mirrors the install flow below).
+        if pkg_is_installed luci-i18n-netshift-ru; then
+            filename="luci-i18n-netshift-ru-${release_tag}.${ext}"
+            download_release_asset "$RELEASES_DOWNLOAD_BASE/$release_tag/$filename" "$filename"
+        fi
+    else
+        # FALLBACK: scrape the api.github.com release JSON for .ipk/.apk URLs.
+        if command -v curl >/dev/null 2>&1; then
+            check_response=$(curl -s "$REPO")
 
-        if [ $attempt -eq $COUNT ]; then
-            msg "Failed to download $filename after $COUNT attempts"
+            if echo "$check_response" | grep -q 'API rate limit '; then
+                msg "You've reached the GitHub rate limit. Repeat in five minutes."
+                exit 1
+            fi
         fi
-    done
+
+        local grep_url_pattern
+        grep_url_pattern="https://[^\"[:space:]]*\.${ext}"
+
+        wget -qO- "$REPO" | grep -o "$grep_url_pattern" | while read -r url; do
+            filename=$(basename "$url")
+            download_release_asset "$url" "$filename"
+        done
+    fi
 
     # Check if any files were downloaded
-    if ! ls "$DOWNLOAD_DIR"/*podkop* >/dev/null 2>&1; then
+    if ! ls "$DOWNLOAD_DIR"/*netshift* >/dev/null 2>&1; then
         msg "No packages were downloaded successfully"
         exit 1
     fi
 
-    for pkg in podkop luci-app-podkop; do
+    for pkg in netshift luci-app-netshift; do
         file=""
         for f in "$DOWNLOAD_DIR"/"$pkg"*; do
             if [ -f "$f" ]; then
@@ -175,16 +365,16 @@ main() {
     done
 
     ru=""
-    for f in "$DOWNLOAD_DIR"/luci-i18n-podkop-ru*; do
+    for f in "$DOWNLOAD_DIR"/luci-i18n-netshift-ru*; do
         if [ -f "$f" ]; then
             ru=$(basename "$f")
             break
         fi
     done
     if [ -n "$ru" ]; then
-        if pkg_is_installed luci-i18n-podkop-ru; then
+        if pkg_is_installed luci-i18n-netshift-ru; then
                 msg "Upgrading Russian translation..."
-                pkg_remove luci-i18n-podkop*
+                pkg_remove luci-i18n-netshift*
                 pkg_install "$DOWNLOAD_DIR/$ru"
         else
             msg "Русский язык интерфейса ставим? y/n (Install the Russian interface language?)"
@@ -192,7 +382,7 @@ main() {
                 read -r -p '' RUS
                 case $RUS in
                 y)
-                    pkg_remove luci-i18n-podkop*
+                    pkg_remove luci-i18n-netshift*
                     pkg_install "$DOWNLOAD_DIR/$ru"
                     break
                     ;;
@@ -207,7 +397,7 @@ main() {
         fi
     fi
 
-    find "$DOWNLOAD_DIR" -type f -name '*podkop*' -exec rm {} \;
+    find "$DOWNLOAD_DIR" -type f -name '*netshift*' -exec rm {} \;
 }
 
 check_system() {
@@ -218,8 +408,8 @@ check_system() {
     # Check OpenWrt version
     openwrt_version=$(cat /etc/openwrt_release | grep DISTRIB_RELEASE | cut -d"'" -f2 | cut -d'.' -f1)
     if [ "$openwrt_version" = "23" ]; then
-        msg "OpenWrt 23.05 не поддерживается начиная с podkop 0.5.0"
-        msg "Для OpenWrt 23.05 используйте podkop версии 0.4.11 или устанавливайте зависимости и podkop вручную"
+        msg "OpenWrt 23.05 не поддерживается начиная с NetShift 0.8.0"
+        msg "Для OpenWrt 23.05 устанавливайте зависимости и NetShift вручную"
         msg "Подробности: https://podkop.net/docs/install/#%d1%83%d1%81%d1%82%d0%b0%d0%bd%d0%be%d0%b2%d0%ba%d0%b0-%d0%bd%d0%b0-2305"
         exit 1
     fi
@@ -240,10 +430,17 @@ check_system() {
         exit 1
     fi
 
-    # Check version
-    if command -v podkop > /dev/null 2>&1; then
+    # Old podkop install detected -> migrate to NetShift before installing the
+    # new packages. podkop never reached 0.8.0, so ANY old podkop triggers this.
+    if podkop_is_installed; then
+        migrate_from_podkop
+        return
+    fi
+
+    # Otherwise check existing NetShift version (just upgrading NetShift).
+    if command -v netshift > /dev/null 2>&1; then
         local version
-        version=$(/usr/bin/podkop show_version 2> /dev/null)
+        version=$(/usr/bin/netshift show_version 2> /dev/null)
         if [ -n "$version" ]; then
             version=$(echo "$version" | sed 's/^v//')
             local major
@@ -253,18 +450,17 @@ check_system() {
             minor=$(echo "$version" | cut -d. -f2)
             patch=$(echo "$version" | cut -d. -f3)
 
-            # Compare version: must be >= 0.7.0
+            # Compare version: must be >= 0.8.0
             if [ "$major" -gt 0 ] ||
-                [ "$major" -eq 0 ] && [ "$minor" -gt 7 ] ||
-                [ "$major" -eq 0 ] && [ "$minor" -eq 7 ] && [ "$patch" -ge 0 ]; then
-                msg "Podkop version >= 0.7.0"
-                break
+                { [ "$major" -eq 0 ] && [ "$minor" -gt 8 ]; } ||
+                { [ "$major" -eq 0 ] && [ "$minor" -eq 8 ] && [ "$patch" -ge 0 ]; }; then
+                msg "NetShift version >= 0.8.0"
             else
-                msg "Podkop version < 0.7.0"
+                msg "NetShift version < 0.8.0"
                 update_config
             fi
         else
-            msg "Unknown podkop version"
+            msg "Unknown NetShift version"
             update_config
         fi
     fi
@@ -302,7 +498,7 @@ sing_box() {
     if [ "$(printf '%s\n%s\n' "$sing_box_version" "$required_version" | sort -V | head -n 1)" != "$required_version" ]; then
         msg "sing-box version $sing_box_version is older than the required version $required_version."
         msg "Removing old version..."
-        service podkop stop
+        service netshift stop 2>/dev/null || service podkop stop 2>/dev/null || true
         pkg_remove sing-box
     fi
 }
diff --git a/luci-app-podkop/Makefile b/luci-app-netshift/Makefile
similarity index 69%
rename from luci-app-podkop/Makefile
rename to luci-app-netshift/Makefile
index f6ae3a0d..712405e4 100644
--- a/luci-app-podkop/Makefile
+++ b/luci-app-netshift/Makefile
@@ -1,13 +1,13 @@
 include $(TOPDIR)/rules.mk
 
-PKG_NAME:=luci-app-podkop
+PKG_NAME:=luci-app-netshift
 
-PKG_VERSION := $(if $(PODKOP_VERSION),$(PODKOP_VERSION),0.$(shell date +%d%m%Y))
+PKG_VERSION := $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(shell date +%d%m%Y))
 
 PKG_RELEASE:=1
 
-LUCI_TITLE:=LuCI podkop app
-LUCI_DEPENDS:=+luci-base +podkop
+LUCI_TITLE:=LuCI NetShift app
+LUCI_DEPENDS:=+luci-base +netshift
 LUCI_PKGARCH:=all
 LUCI_LANG.ru:=Русский (Russian)
 LUCI_LANG.en:=English
@@ -24,7 +24,7 @@ define Package/$(PKG_NAME)/install
 	$(CP) $(PKG_BUILD_DIR)/htdocs/* $(1)$(HTDOCS)/
 	$(INSTALL_DIR) $(1)/
 	$(CP) $(PKG_BUILD_DIR)/root/* $(1)/
-	sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' $(1)$(HTDOCS)/luci-static/resources/view/podkop/main.js || true
+	sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' $(1)$(HTDOCS)/luci-static/resources/view/netshift/main.js || true
 endef
 
 $(eval $(call BuildPackage,$(PKG_NAME)))
\ No newline at end of file
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/dashboard.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/dashboard.js
similarity index 91%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/dashboard.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/dashboard.js
index 6fd97cfe..990d4fac 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/dashboard.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/dashboard.js
@@ -4,7 +4,7 @@
 "require ui";
 "require uci";
 "require fs";
-"require view.podkop.main as main";
+"require view.netshift.main as main";
 
 function createDashboardContent(section) {
   const o = section.option(form.DummyValue, "_mount_node");
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/diagnostic.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/diagnostic.js
similarity index 91%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/diagnostic.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/diagnostic.js
index e6ac146d..02304a4b 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/diagnostic.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/diagnostic.js
@@ -4,7 +4,7 @@
 "require ui";
 "require uci";
 "require fs";
-"require view.podkop.main as main";
+"require view.netshift.main as main";
 
 function createDiagnosticContent(section) {
   const o = section.option(form.DummyValue, "_mount_node");
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/main.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js
similarity index 70%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/main.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js
index 009c1ae3..e1c9b687 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/main.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js
@@ -13,6 +13,70 @@ function validateIPV4(ip) {
   }
   return { valid: false, message: _("Invalid IP address") };
 }
+var HEXTET_REGEX = /^[0-9a-fA-F]{1,4}$/;
+function isHextet(group) {
+  return HEXTET_REGEX.test(group);
+}
+function isEmbeddedIPv4(group) {
+  return validateIPV4(group).valid;
+}
+function countGroups(side, allowEmbeddedIPv4) {
+  if (side === "") {
+    return 0;
+  }
+  const groups = side.split(":");
+  for (let i = 0; i < groups.length; i++) {
+    const group = groups[i];
+    const isLast = i === groups.length - 1;
+    if (allowEmbeddedIPv4 && isLast && group.includes(".")) {
+      if (!isEmbeddedIPv4(group)) {
+        return null;
+      }
+      continue;
+    }
+    if (!isHextet(group)) {
+      return null;
+    }
+  }
+  const lastGroup = groups[groups.length - 1];
+  const embeddedExtra = allowEmbeddedIPv4 && lastGroup.includes(".") && isEmbeddedIPv4(lastGroup) ? 1 : 0;
+  return groups.length + embeddedExtra;
+}
+function validateIPV6(ip) {
+  const stripped = ip.replace(/^\[/, "").replace(/\]$/, "");
+  const invalid = {
+    valid: false,
+    message: _("Invalid IPv6 address")
+  };
+  const doubleColonCount = stripped.split("::").length - 1;
+  if (doubleColonCount > 1) {
+    return invalid;
+  }
+  if (doubleColonCount === 1) {
+    const [head, tail] = stripped.split("::");
+    const headGroups = countGroups(head, true);
+    const tailGroups = countGroups(tail, true);
+    if (headGroups === null || tailGroups === null) {
+      return invalid;
+    }
+    if (headGroups + tailGroups > 7) {
+      return invalid;
+    }
+    return { valid: true, message: _("Valid") };
+  }
+  const totalGroups = countGroups(stripped, true);
+  if (totalGroups === 8) {
+    return { valid: true, message: _("Valid") };
+  }
+  return invalid;
+}
+function validateIP(ip) {
+  const ipv4 = validateIPV4(ip);
+  if (ipv4.valid) {
+    return ipv4;
+  }
+  return validateIPV6(ip);
+}
 
 // src/validators/validateDomain.ts
 function validateDomain(domain, allowDotTLD = false) {
@@ -40,23 +104,60 @@ function validateDNS(value) {
   if (!value) {
     return { valid: false, message: _("DNS server address cannot be empty") };
   }
-  const cleanedValueWithoutPort = value.replace(/:(\d+)(?=\/|$)/, "");
-  const cleanedIpWithoutPath = cleanedValueWithoutPort.split("/")[0];
+  const valueBeforePath = value.split("/")[0];
+  let cleanedValueWithoutPort = value;
+  let cleanedIpWithoutPath = valueBeforePath;
+  if (valueBeforePath.startsWith("[")) {
+    const closingBracketIndex = valueBeforePath.indexOf("]");
+    if (closingBracketIndex > 0) {
+      cleanedIpWithoutPath = valueBeforePath.slice(1, closingBracketIndex);
+    }
+  } else if ((valueBeforePath.match(/:/g) || []).length < 2) {
+    cleanedValueWithoutPort = value.replace(/:(\d+)(?=\/|$)/, "");
+    cleanedIpWithoutPath = cleanedValueWithoutPort.split("/")[0];
+  }
   if (validateIPV4(cleanedIpWithoutPath).valid) {
     return { valid: true, message: _("Valid") };
   }
+  if (validateIPV6(cleanedIpWithoutPath).valid) {
+    return { valid: true, message: _("Valid") };
+  }
   if (validateDomain(cleanedValueWithoutPort).valid) {
     return { valid: true, message: _("Valid") };
   }
   return {
     valid: false,
     message: _(
-      "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
+      "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
     )
   };
 }
 
 // src/validators/validateUrl.ts
+function extractHost(url) {
+  const schemeIndex = url.indexOf("://");
+  let rest = schemeIndex === -1 ? url : url.slice(schemeIndex + 3);
+  const pathIndex = rest.search(/[/?#]/);
+  if (pathIndex !== -1) {
+    rest = rest.slice(0, pathIndex);
+  }
+  const atIndex = rest.lastIndexOf("@");
+  if (atIndex !== -1) {
+    rest = rest.slice(atIndex + 1);
+  }
+  if (rest.startsWith("[")) {
+    const closeIndex = rest.indexOf("]");
+    if (closeIndex !== -1) {
+      return rest.slice(1, closeIndex);
+    }
+    return rest.slice(1).split(":")[0];
+  }
+  const colonIndex = rest.lastIndexOf(":");
+  if (colonIndex !== -1) {
+    rest = rest.slice(0, colonIndex);
+  }
+  return rest;
+}
 function validateUrl(url, protocols = ["http:", "https:"]) {
   if (!url.length) {
     return { valid: false, message: _("Invalid URL format") };
@@ -67,10 +168,12 @@ function validateUrl(url, protocols = ["http:", "https:"]) {
       valid: false,
       message: _("URL must use one of the following protocols:") + " " + protocols.join(", ")
     };
-  const regex = new RegExp(
-    `^(?:${protocols.map((p) => p.replace(":", "")).join("|")})://(?:[A-Za-z0-9-]+\\.)+[A-Za-z]{2,}(?::\\d+)?(?:/[^\\s]*)?$`
-  );
-  if (regex.test(url)) {
+  const host = extractHost(url);
+  if (!host) {
+    return { valid: false, message: _("Invalid URL format") };
+  }
+  const isValidHost = validateIPV4(host).valid || validateIPV6(host).valid || validateDomain(host).valid;
+  if (isValidHost) {
     return { valid: true, message: _("Valid") };
   }
   return { valid: false, message: _("Invalid URL format") };
@@ -102,30 +205,48 @@ function validatePath(value) {
 // src/validators/validateSubnet.ts
 function validateSubnet(value) {
   const subnetRegex = /^(\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$/;
-  if (!subnetRegex.test(value)) {
-    return {
-      valid: false,
-      message: _("Invalid format. Use X.X.X.X or X.X.X.X/Y")
-    };
-  }
-  const [ip, cidr] = value.split("/");
-  if (ip === "0.0.0.0") {
-    return { valid: false, message: _("IP address 0.0.0.0 is not allowed") };
-  }
-  const ipCheck = validateIPV4(ip);
-  if (!ipCheck.valid) {
-    return ipCheck;
+  if (subnetRegex.test(value)) {
+    const [ip, cidr] = value.split("/");
+    if (ip === "0.0.0.0") {
+      return { valid: false, message: _("IP address 0.0.0.0 is not allowed") };
+    }
+    const ipCheck = validateIPV4(ip);
+    if (!ipCheck.valid) {
+      return ipCheck;
+    }
+    if (cidr) {
+      const cidrNum = parseInt(cidr, 10);
+      if (cidrNum < 0 || cidrNum > 32) {
+        return {
+          valid: false,
+          message: _("CIDR must be between 0 and 32")
+        };
+      }
+    }
+    return { valid: true, message: _("Valid") };
   }
-  if (cidr) {
-    const cidrNum = parseInt(cidr, 10);
-    if (cidrNum < 0 || cidrNum > 32) {
-      return {
-        valid: false,
-        message: _("CIDR must be between 0 and 32")
-      };
+  const ipv6CidrRegex = /^([0-9a-fA-F:]+(?:\/[0-9]{1,3})?)$/;
+  if (ipv6CidrRegex.test(value)) {
+    const [ip, cidr] = value.split("/");
+    const ipCheck = validateIPV6(ip);
+    if (!ipCheck.valid) {
+      return ipCheck;
+    }
+    if (cidr) {
+      const cidrNum = parseInt(cidr, 10);
+      if (cidrNum < 0 || cidrNum > 128) {
+        return {
+          valid: false,
+          message: _("IPv6 CIDR must be between 0 and 128")
+        };
+      }
     }
+    return { valid: true, message: _("Valid") };
   }
-  return { valid: true, message: _("Valid") };
+  return {
+    valid: false,
+    message: _("Invalid format. Use X.X.X.X/Y or IPv6/Y")
+  };
 }
 
 // src/validators/bulkValidate.ts
@@ -539,6 +660,70 @@ function validateHysteria2Url(url) {
   }
 }
 
+// src/validators/validateVmessUrl.ts
+function validateVmessUrl(url) {
+  if (!url.startsWith("vmess://")) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: must start with vmess://")
+    };
+  }
+  const body = url.slice("vmess://".length);
+  const b64 = body.split("#")[0];
+  if (/\s/.test(b64)) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: must not contain spaces")
+    };
+  }
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  let decoded;
+  try {
+    decoded = atob(padded);
+  } catch (_e) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: malformed base64")
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(decoded);
+  } catch (_e) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: malformed JSON")
+    };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: malformed JSON")
+    };
+  }
+  const config = parsed;
+  if (typeof config.add !== "string" || config.add.length === 0) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: missing address")
+    };
+  }
+  if (typeof config.id !== "string" || config.id.length === 0) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: missing id")
+    };
+  }
+  const portNum = Number(config.port);
+  if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) {
+    return {
+      valid: false,
+      message: _("Invalid VMess URL: invalid port")
+    };
+  }
+  return { valid: true, message: _("Valid") };
+}
+
 // src/validators/validateProxyUrl.ts
 function validateProxyUrl(url) {
   const trimmedUrl = url.trim();
@@ -551,6 +736,9 @@ function validateProxyUrl(url) {
   if (trimmedUrl.startsWith("trojan://")) {
     return validateTrojanUrl(trimmedUrl);
   }
+  if (trimmedUrl.startsWith("vmess://")) {
+    return validateVmessUrl(trimmedUrl);
+  }
   if (/^socks(4|4a|5):\/\//.test(trimmedUrl)) {
     return validateSocksUrl(trimmedUrl);
   }
@@ -560,7 +748,7 @@ function validateProxyUrl(url) {
   return {
     valid: false,
     message: _(
-      "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+      "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
     )
   };
 }
@@ -570,13 +758,13 @@ function parseValueList(value) {
   return value.split(/\n/).map((line) => line.split("//")[0]).join(" ").split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
 }
 
-// src/podkop/methods/custom/getConfigSections.ts
+// src/netshift/methods/custom/getConfigSections.ts
 async function getConfigSections() {
-  return uci.load("podkop").then(() => uci.sections("podkop"));
+  return uci.load("netshift").then(() => uci.sections("netshift"));
 }
 
-// src/podkop/methods/shell/callBaseMethod.ts
-async function callBaseMethod(method, args = [], command = "/usr/bin/podkop") {
+// src/netshift/methods/shell/callBaseMethod.ts
+async function callBaseMethod(method, args = [], command = "/usr/bin/netshift") {
   const response = await executeShellCommand({
     command,
     args: [method, ...args],
@@ -601,9 +789,9 @@ async function callBaseMethod(method, args = [], command = "/usr/bin/podkop") {
   };
 }
 
-// src/podkop/types.ts
-var Podkop;
-((Podkop2) => {
+// src/netshift/types.ts
+var NetShift;
+((NetShift2) => {
   let AvailableMethods;
   ((AvailableMethods2) => {
     AvailableMethods2["CHECK_DNS_AVAILABLE"] = "check_dns_available";
@@ -622,87 +810,343 @@ var Podkop;
     AvailableMethods2["SHOW_SING_BOX_CONFIG"] = "show_sing_box_config";
     AvailableMethods2["CHECK_LOGS"] = "check_logs";
     AvailableMethods2["GET_SYSTEM_INFO"] = "get_system_info";
-  })(AvailableMethods = Podkop2.AvailableMethods || (Podkop2.AvailableMethods = {}));
+    AvailableMethods2["SUBSCRIPTION_UPDATE"] = "subscription_update";
+  })(AvailableMethods = NetShift2.AvailableMethods || (NetShift2.AvailableMethods = {}));
   let AvailableClashAPIMethods;
   ((AvailableClashAPIMethods2) => {
     AvailableClashAPIMethods2["GET_PROXIES"] = "get_proxies";
     AvailableClashAPIMethods2["GET_PROXY_LATENCY"] = "get_proxy_latency";
     AvailableClashAPIMethods2["GET_GROUP_LATENCY"] = "get_group_latency";
     AvailableClashAPIMethods2["SET_GROUP_PROXY"] = "set_group_proxy";
-  })(AvailableClashAPIMethods = Podkop2.AvailableClashAPIMethods || (Podkop2.AvailableClashAPIMethods = {}));
-})(Podkop || (Podkop = {}));
+  })(AvailableClashAPIMethods = NetShift2.AvailableClashAPIMethods || (NetShift2.AvailableClashAPIMethods = {}));
+})(NetShift || (NetShift = {}));
+
+// src/netshift/methods/shell/sleep.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/netshift/methods/shell/pollSingBoxComponentAction.ts
+var POLL_INTERVAL_MS = 2e3;
+var MAX_POLLS = 150;
+function parseComponentActionStatus(stdout) {
+  try {
+    return JSON.parse(stdout);
+  } catch (_e) {
+    return null;
+  }
+}
+async function pollSingBoxComponentAction(fetchStatus, sleepFn = sleep, intervalMs = POLL_INTERVAL_MS, maxPolls = MAX_POLLS) {
+  for (let poll = 0; poll < maxPolls; poll += 1) {
+    const status = await fetchStatus();
+    if (!status) {
+      return {
+        success: false,
+        message: _("Core switch failed")
+      };
+    }
+    if (status.running !== true) {
+      return {
+        success: Boolean(status.success),
+        version: status.version,
+        message: status.message
+      };
+    }
+    await sleepFn(intervalMs);
+  }
+  return {
+    success: false,
+    message: _("Core switch timed out")
+  };
+}
 
-// src/podkop/methods/shell/index.ts
-var PodkopShellMethods = {
+// src/netshift/methods/shell/parseComponentCheckUpdate.ts
+var VALID_STATUSES = [
+  "latest",
+  "outdated",
+  "dev",
+  "not_installed"
+];
+function normalizeStatus(status) {
+  if (typeof status === "string" && VALID_STATUSES.includes(status)) {
+    return status;
+  }
+  return void 0;
+}
+function parseComponentCheckUpdate(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return {
+      success: Boolean(parsed.success),
+      current_version: typeof parsed.current_version === "string" ? parsed.current_version : void 0,
+      latest_version: typeof parsed.latest_version === "string" ? parsed.latest_version : void 0,
+      status: normalizeStatus(parsed.status),
+      message: typeof parsed.message === "string" ? parsed.message : void 0
+    };
+  } catch (_e) {
+    return {
+      success: false,
+      message: stdout
+    };
+  }
+}
+
+// src/netshift/methods/shell/index.ts
+var NetShiftShellMethods = {
   checkDNSAvailable: async () => callBaseMethod(
-    Podkop.AvailableMethods.CHECK_DNS_AVAILABLE
+    NetShift.AvailableMethods.CHECK_DNS_AVAILABLE
   ),
   checkFakeIP: async () => callBaseMethod(
-    Podkop.AvailableMethods.CHECK_FAKEIP
+    NetShift.AvailableMethods.CHECK_FAKEIP
   ),
   checkNftRules: async () => callBaseMethod(
-    Podkop.AvailableMethods.CHECK_NFT_RULES
+    NetShift.AvailableMethods.CHECK_NFT_RULES
   ),
-  getStatus: async () => callBaseMethod(Podkop.AvailableMethods.GET_STATUS),
+  getStatus: async () => callBaseMethod(NetShift.AvailableMethods.GET_STATUS),
   checkSingBox: async () => callBaseMethod(
-    Podkop.AvailableMethods.CHECK_SING_BOX
+    NetShift.AvailableMethods.CHECK_SING_BOX
   ),
   getSingBoxStatus: async () => callBaseMethod(
-    Podkop.AvailableMethods.GET_SING_BOX_STATUS
+    NetShift.AvailableMethods.GET_SING_BOX_STATUS
   ),
-  getClashApiProxies: async () => callBaseMethod(Podkop.AvailableMethods.CLASH_API, [
-    Podkop.AvailableClashAPIMethods.GET_PROXIES
+  getClashApiProxies: async () => callBaseMethod(NetShift.AvailableMethods.CLASH_API, [
+    NetShift.AvailableClashAPIMethods.GET_PROXIES
   ]),
   getClashApiProxyLatency: async (tag) => callBaseMethod(
-    Podkop.AvailableMethods.CLASH_API,
-    [Podkop.AvailableClashAPIMethods.GET_PROXY_LATENCY, tag, "5000"]
+    NetShift.AvailableMethods.CLASH_API,
+    [NetShift.AvailableClashAPIMethods.GET_PROXY_LATENCY, tag, "5000"]
   ),
   getClashApiGroupLatency: async (tag) => callBaseMethod(
-    Podkop.AvailableMethods.CLASH_API,
-    [Podkop.AvailableClashAPIMethods.GET_GROUP_LATENCY, tag, "10000"]
+    NetShift.AvailableMethods.CLASH_API,
+    [NetShift.AvailableClashAPIMethods.GET_GROUP_LATENCY, tag, "10000"]
   ),
-  setClashApiGroupProxy: async (group, proxy) => callBaseMethod(Podkop.AvailableMethods.CLASH_API, [
-    Podkop.AvailableClashAPIMethods.SET_GROUP_PROXY,
+  setClashApiGroupProxy: async (group, proxy) => callBaseMethod(NetShift.AvailableMethods.CLASH_API, [
+    NetShift.AvailableClashAPIMethods.SET_GROUP_PROXY,
     group,
     proxy
   ]),
   restart: async () => callBaseMethod(
-    Podkop.AvailableMethods.RESTART,
+    NetShift.AvailableMethods.RESTART,
     [],
-    "/etc/init.d/podkop"
+    "/etc/init.d/netshift"
   ),
   start: async () => callBaseMethod(
-    Podkop.AvailableMethods.START,
+    NetShift.AvailableMethods.START,
     [],
-    "/etc/init.d/podkop"
+    "/etc/init.d/netshift"
   ),
   stop: async () => callBaseMethod(
-    Podkop.AvailableMethods.STOP,
+    NetShift.AvailableMethods.STOP,
     [],
-    "/etc/init.d/podkop"
+    "/etc/init.d/netshift"
   ),
   enable: async () => callBaseMethod(
-    Podkop.AvailableMethods.ENABLE,
+    NetShift.AvailableMethods.ENABLE,
     [],
-    "/etc/init.d/podkop"
+    "/etc/init.d/netshift"
   ),
   disable: async () => callBaseMethod(
-    Podkop.AvailableMethods.DISABLE,
+    NetShift.AvailableMethods.DISABLE,
     [],
-    "/etc/init.d/podkop"
+    "/etc/init.d/netshift"
   ),
-  globalCheck: async () => callBaseMethod(Podkop.AvailableMethods.GLOBAL_CHECK),
-  showSingBoxConfig: async () => callBaseMethod(Podkop.AvailableMethods.SHOW_SING_BOX_CONFIG),
-  checkLogs: async () => callBaseMethod(Podkop.AvailableMethods.CHECK_LOGS),
+  globalCheck: async () => callBaseMethod(NetShift.AvailableMethods.GLOBAL_CHECK),
+  showSingBoxConfig: async () => callBaseMethod(NetShift.AvailableMethods.SHOW_SING_BOX_CONFIG),
+  checkLogs: async () => callBaseMethod(NetShift.AvailableMethods.CHECK_LOGS),
   getSystemInfo: async () => callBaseMethod(
-    Podkop.AvailableMethods.GET_SYSTEM_INFO
-  )
+    NetShift.AvailableMethods.GET_SYSTEM_INFO
+  ),
+  subscriptionUpdate: async () => callBaseMethod(NetShift.AvailableMethods.SUBSCRIPTION_UPDATE),
+  singBoxComponentAction: async (action) => {
+    if (action === "check_update") {
+      const response = await executeShellCommand({
+        command: "/usr/bin/netshift",
+        args: ["component_action", "sing_box", action],
+        timeout: 6e5
+      });
+      if (response.stdout) {
+        try {
+          const parsed = JSON.parse(
+            response.stdout
+          );
+          return {
+            success: Boolean(parsed.success),
+            version: parsed.version,
+            message: parsed.message
+          };
+        } catch (_e) {
+          return {
+            success: false,
+            message: response.stdout
+          };
+        }
+      }
+      return {
+        success: false,
+        message: response.stderr || ""
+      };
+    }
+    const startResponse = await executeShellCommand({
+      command: "/usr/bin/netshift",
+      args: ["component_action_async", "sing_box", action]
+    });
+    let start = null;
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout
+        );
+      } catch (_e) {
+        start = null;
+      }
+    }
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message: start?.message || startResponse.stderr || _("Core switch failed")
+      };
+    }
+    const jobId = start.job_id;
+    return pollSingBoxComponentAction(async () => {
+      const statusResponse = await executeShellCommand({
+        command: "/usr/bin/netshift",
+        args: ["component_action_status", jobId]
+      });
+      if (!statusResponse.stdout) {
+        return null;
+      }
+      return parseComponentActionStatus(statusResponse.stdout);
+    });
+  },
+  // Sing-box update checks (sync) — STABLE task-017 contract:
+  //   component_action sing_box check_update        (extended)
+  //   component_action sing_box check_update_stable (stock)
+  // → {success, current_version, latest_version, status}.
+  singBoxCheckUpdate: async (action) => {
+    const response = await executeShellCommand({
+      command: "/usr/bin/netshift",
+      args: ["component_action", "sing_box", action],
+      timeout: 6e5
+    });
+    if (response.stdout) {
+      return parseComponentCheckUpdate(response.stdout);
+    }
+    return {
+      success: false,
+      message: response.stderr || ""
+    };
+  },
+  // NetShift update check (sync) — task-029/030 contract:
+  //   component_action netshift check_update
+  // → {success, current_version, latest_version, status}. Same shape as the
+  // sing-box cores (parsed by parseComponentCheckUpdate). The status is already
+  // v-normalized server-side, so the caller TRUSTS result.status (no string
+  // compare in TS). Stays on the SYNC component_action path (fast call).
+  netshiftCheckUpdate: async () => {
+    const response = await executeShellCommand({
+      command: "/usr/bin/netshift",
+      args: ["component_action", "netshift", "check_update"],
+      timeout: 6e5
+    });
+    if (response.stdout) {
+      return parseComponentCheckUpdate(response.stdout);
+    }
+    return {
+      success: false,
+      message: response.stderr || ""
+    };
+  },
+  // Clear subscription cache (async) — task-039/040 contract:
+  // component_action_async subscription clear_cache + component_action_status
+  // <job>. Deletes all subscription caches then re-downloads, which restarts
+  // the service and can exceed the rpcd ~30s wall — so it MUST run through the
+  // SAME async start+poll mechanism as the sing-box core switch (reusing the
+  // component-agnostic `pollSingBoxComponentAction`). The component/action
+  // strings are EXACTLY 'subscription'/'clear_cache' (match task-039's router).
+  clearSubscriptionCache: async () => {
+    const startResponse = await executeShellCommand({
+      command: "/usr/bin/netshift",
+      args: ["component_action_async", "subscription", "clear_cache"]
+    });
+    let start = null;
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout
+        );
+      } catch (_e) {
+        start = null;
+      }
+    }
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message: start?.message || startResponse.stderr || _("Failed to clear subscription cache")
+      };
+    }
+    const jobId = start.job_id;
+    return pollSingBoxComponentAction(async () => {
+      const statusResponse = await executeShellCommand({
+        command: "/usr/bin/netshift",
+        args: ["component_action_status", jobId]
+      });
+      if (!statusResponse.stdout) {
+        return null;
+      }
+      return parseComponentActionStatus(statusResponse.stdout);
+    });
+  },
+  // NetShift self-update (async) — STABLE task-017 contract:
+  // component_action_async netshift self_update + component_action_status <job>.
+  // Reuses the component-agnostic poll. Because the package install swaps
+  // /usr/bin/netshift mid-job, status polls can transiently fail (rpcd / binary
+  // swap); once the job has STARTED we treat such failures leniently — keep
+  // polling (return a synthetic running status) instead of aborting hard, so a
+  // successful self-update is not misreported as a failure. The UI reloads the
+  // page on success.
+  netshiftSelfUpdate: async () => {
+    const startResponse = await executeShellCommand({
+      command: "/usr/bin/netshift",
+      args: ["component_action_async", "netshift", "self_update"]
+    });
+    let start = null;
+    if (startResponse.stdout) {
+      try {
+        start = JSON.parse(
+          startResponse.stdout
+        );
+      } catch (_e) {
+        start = null;
+      }
+    }
+    if (!start || start.success !== true || !start.job_id) {
+      return {
+        success: false,
+        message: start?.message || startResponse.stderr || _("Self-update failed")
+      };
+    }
+    const jobId = start.job_id;
+    return pollSingBoxComponentAction(async () => {
+      try {
+        const statusResponse = await executeShellCommand({
+          command: "/usr/bin/netshift",
+          args: ["component_action_status", jobId]
+        });
+        if (!statusResponse.stdout) {
+          return { running: true };
+        }
+        return parseComponentActionStatus(statusResponse.stdout) ?? { running: true };
+      } catch (_e) {
+        return { running: true };
+      }
+    });
+  }
 };
 
-// src/podkop/methods/custom/getDashboardSections.ts
+// src/netshift/methods/custom/getDashboardSections.ts
 async function getDashboardSections() {
   const configSections = await getConfigSections();
-  const clashProxies = await PodkopShellMethods.getClashApiProxies();
+  const clashProxies = await NetShiftShellMethods.getClashApiProxies();
   if (!clashProxies.success) {
     return {
       success: false,
@@ -816,6 +1260,70 @@ async function getDashboardSections() {
           ]
         };
       }
+      if (section.proxy_config_type === "subscription") {
+        const selector = proxies.find(
+          (proxy) => proxy.code === `${section[".name"]}-out`
+        );
+        const fallbackUrltest = proxies.find(
+          (proxy) => proxy.code === `${section[".name"]}-urltest-out`
+        );
+        const selectorOutbounds = (selector?.value?.all ?? []).flatMap(
+          (code) => {
+            const item = proxies.find((proxy) => proxy.code === code);
+            if (!item) {
+              return [];
+            }
+            const isLegacyFastest = item.code === `${section[".name"]}-urltest-out`;
+            return [
+              {
+                code: item.code,
+                displayName: isLegacyFastest ? _("Fastest") : item?.value?.name || "",
+                latency: item?.value?.history?.[0]?.delay || 0,
+                type: item?.value?.type || "",
+                selected: selector?.value?.now === item.code
+              }
+            ];
+          }
+        );
+        const outbounds = [
+          ...selectorOutbounds.filter(
+            (item) => item.type?.toLowerCase() === "urltest"
+          ),
+          ...selectorOutbounds.filter(
+            (item) => item.type?.toLowerCase() !== "urltest"
+          )
+        ];
+        if (outbounds.length === 0 && fallbackUrltest) {
+          const fallbackOutbounds = (fallbackUrltest?.value?.all ?? []).map((code) => proxies.find((item) => item.code === code)).map((item) => ({
+            code: item?.code || "",
+            displayName: item?.value?.name || "",
+            latency: item?.value?.history?.[0]?.delay || 0,
+            type: item?.value?.type || "",
+            selected: selector?.value?.now === item?.code
+          }));
+          return {
+            withTagSelect: true,
+            code: selector?.code || section[".name"],
+            displayName: section[".name"],
+            outbounds: [
+              {
+                code: fallbackUrltest?.code || "",
+                displayName: _("Fastest"),
+                latency: fallbackUrltest?.value?.history?.[0]?.delay || 0,
+                type: fallbackUrltest?.value?.type || "",
+                selected: selector?.value?.now === fallbackUrltest?.code
+              },
+              ...fallbackOutbounds
+            ]
+          };
+        }
+        return {
+          withTagSelect: true,
+          code: selector?.code || section[".name"],
+          displayName: section[".name"],
+          outbounds
+        };
+      }
     }
     if (section.connection_type === "vpn") {
       const outbound = proxies.find(
@@ -849,15 +1357,15 @@ async function getDashboardSections() {
   };
 }
 
-// src/podkop/methods/custom/getClashApiSecret.ts
+// src/netshift/methods/custom/getClashApiSecret.ts
 async function getClashApiSecret() {
   const sections = await getConfigSections();
   const settings = sections.find((section) => section[".type"] === "settings");
   return settings?.yacd_secret_key || "";
 }
 
-// src/podkop/methods/custom/index.ts
-var CustomPodkopMethods = {
+// src/netshift/methods/custom/index.ts
+var CustomNetShiftMethods = {
   getConfigSections,
   getDashboardSections,
   getClashApiSecret
@@ -869,7 +1377,7 @@ var STATUS_COLORS = {
   ERROR: "#f44336",
   WARNING: "#ff9800"
 };
-var PODKOP_LUCI_APP_VERSION = "__COMPILED_VERSION_VARIABLE__";
+var NETSHIFT_LUCI_APP_VERSION = "__COMPILED_VERSION_VARIABLE__";
 var FAKEIP_CHECK_DOMAIN = "fakeip.podkop.fyi";
 var IP_CHECK_DOMAIN = "ip.podkop.fyi";
 var REGIONAL_OPTIONS = [
@@ -926,13 +1434,24 @@ var UPDATE_INTERVAL_OPTIONS = {
   "1d": "Every day",
   "3d": "Every 3 days"
 };
+var SUBSCRIPTION_UPDATE_INTERVAL_OPTIONS = {
+  "30m": "Every 30 minutes",
+  "1h": "Every hour",
+  "3h": "Every 3 hours",
+  "6h": "Every 6 hours",
+  "12h": "Every 12 hours",
+  "1d": "Every day"
+};
 var DNS_SERVER_OPTIONS = {
   "1.1.1.1": "1.1.1.1 (Cloudflare)",
   "8.8.8.8": "8.8.8.8 (Google)",
   "9.9.9.9": "9.9.9.9 (Quad9)",
   "dns.adguard-dns.com": "dns.adguard-dns.com (AdGuard Default)",
   "unfiltered.adguard-dns.com": "unfiltered.adguard-dns.com (AdGuard Unfiltered)",
-  "family.adguard-dns.com": "family.adguard-dns.com (AdGuard Family)"
+  "family.adguard-dns.com": "family.adguard-dns.com (AdGuard Family)",
+  "2001:4860:4860::8888": "2001:4860:4860::8888 (Google IPv6)",
+  "2606:4700:4700::1111": "2606:4700:4700::1111 (Cloudflare IPv6)",
+  "2620:fe::fe": "2620:fe::fe (Quad9 IPv6)"
 };
 var BOOTSTRAP_DNS_SERVER_OPTIONS = {
   "77.88.8.8": "77.88.8.8 (Yandex DNS)",
@@ -942,7 +1461,9 @@ var BOOTSTRAP_DNS_SERVER_OPTIONS = {
   "8.8.8.8": "8.8.8.8 (Google DNS)",
   "8.8.4.4": "8.8.4.4 (Google DNS)",
   "9.9.9.9": "9.9.9.9 (Quad9 DNS)",
-  "9.9.9.11": "9.9.9.11 (Quad9 DNS)"
+  "9.9.9.11": "9.9.9.11 (Quad9 DNS)",
+  "2001:4860:4860::8888": "2001:4860:4860::8888 (Google DNS IPv6)",
+  "2606:4700:4700::1111": "2606:4700:4700::1111 (Cloudflare DNS IPv6)"
 };
 var DIAGNOSTICS_UPDATE_INTERVAL = 1e4;
 var CACHE_TIMEOUT = DIAGNOSTICS_UPDATE_INTERVAL - 1e3;
@@ -976,7 +1497,7 @@ var COMMAND_SCHEDULING = {
   // Lowest priority
 };
 
-// src/podkop/api.ts
+// src/netshift/api.ts
 async function createBaseApiRequest(fetchFn, options) {
   const wrappedFn = () => options?.timeoutMs && options?.operationName ? withTimeout(
     fetchFn(),
@@ -1005,7 +1526,7 @@ async function createBaseApiRequest(fetchFn, options) {
   }
 }
 
-// src/podkop/methods/fakeip/getFakeIpCheck.ts
+// src/netshift/methods/fakeip/getFakeIpCheck.ts
 async function getFakeIpCheck() {
   return createBaseApiRequest(
     () => fetch(`https://${FAKEIP_CHECK_DOMAIN}/check`, {
@@ -1019,7 +1540,7 @@ async function getFakeIpCheck() {
   );
 }
 
-// src/podkop/methods/fakeip/getIpCheck.ts
+// src/netshift/methods/fakeip/getIpCheck.ts
 async function getIpCheck() {
   return createBaseApiRequest(
     () => fetch(`https://${IP_CHECK_DOMAIN}/check`, {
@@ -1033,13 +1554,13 @@ async function getIpCheck() {
   );
 }
 
-// src/podkop/methods/fakeip/index.ts
+// src/netshift/methods/fakeip/index.ts
 var RemoteFakeIPMethods = {
   getFakeIpCheck,
   getIpCheck
 };
 
-// src/podkop/services/tab.service.ts
+// src/netshift/services/tab.service.ts
 var TabService = class _TabService {
   constructor() {
     this.observer = null;
@@ -1106,12 +1627,12 @@ var TabService = class _TabService {
 };
 var TabServiceInstance = TabService.getInstance();
 
-// src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts
+// src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts
 function getCheckTitle(name) {
   return `${name} ${_("checks")}`;
 }
 
-// src/podkop/tabs/diagnostic/checks/contstants.ts
+// src/netshift/tabs/diagnostic/checks/contstants.ts
 var DIAGNOSTICS_CHECKS_MAP = {
   ["DNS" /* DNS */]: {
     order: 1,
@@ -1140,16 +1661,17 @@ var DIAGNOSTICS_CHECKS_MAP = {
   }
 };
 
-// src/podkop/tabs/diagnostic/diagnostic.store.ts
+// src/netshift/tabs/diagnostic/diagnostic.store.ts
 var initialDiagnosticStore = {
   diagnosticsSystemInfo: {
     loading: true,
-    podkop_version: "loading",
-    podkop_latest_version: "loading",
+    netshift_version: "loading",
+    netshift_latest_version: "loading",
     luci_app_version: "loading",
     sing_box_version: "loading",
     openwrt_version: "loading",
-    device_model: "loading"
+    device_model: "loading",
+    sing_box_extended: 0
   },
   diagnosticsActions: {
     restart: {
@@ -1175,6 +1697,9 @@ var initialDiagnosticStore = {
     },
     showSingBoxConfig: {
       loading: false
+    },
+    clearSubscriptionCache: {
+      loading: false
     }
   },
   diagnosticsRunAction: { loading: false },
@@ -1266,7 +1791,24 @@ var loadingDiagnosticsChecksStore = {
   ]
 };
 
-// src/podkop/services/store.service.ts
+// src/netshift/tabs/manager/manager.store.ts
+var initialManagerStore = {
+  managerActions: {
+    netshiftCheck: { loading: false },
+    netshiftUpdate: { loading: false },
+    singBoxStockCheck: { loading: false },
+    singBoxStockAction: { loading: false },
+    singBoxExtendedCheck: { loading: false },
+    singBoxExtendedAction: { loading: false }
+  },
+  managerChecks: {
+    netshift: { status: null, latest_version: "" },
+    sing_box_stock: { status: null, latest_version: "" },
+    sing_box_extended: { status: null, latest_version: "" }
+  }
+};
+
+// src/netshift/services/store.service.ts
 function jsonStableStringify(obj) {
   return JSON.stringify(obj, (_2, value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
@@ -1379,7 +1921,7 @@ var initialStore = {
   servicesInfoWidget: {
     loading: true,
     failed: false,
-    data: { singbox: 0, podkop: 0 }
+    data: { singbox: 0, netshift: 0 }
   },
   sectionsWidget: {
     loading: true,
@@ -1387,7 +1929,8 @@ var initialStore = {
     latencyFetching: false,
     data: []
   },
-  ...initialDiagnosticStore
+  ...initialDiagnosticStore,
+  ...initialManagerStore
 };
 var store = new StoreService(initialStore);
 
@@ -1404,7 +1947,7 @@ function downloadAsTxt(text, filename) {
   URL.revokeObjectURL(link.href);
 }
 
-// src/podkop/services/logger.service.ts
+// src/netshift/services/logger.service.ts
 var Logger = class {
   constructor() {
     this.logs = [];
@@ -1459,8 +2002,8 @@ var Logger = class {
 };
 var logger = new Logger();
 
-// src/podkop/services/podkopLogWatcher.service.ts
-var PodkopLogWatcher = class _PodkopLogWatcher {
+// src/netshift/services/netshiftLogWatcher.service.ts
+var NetShiftLogWatcher = class _NetShiftLogWatcher {
   constructor() {
     this.intervalMs = 5e3;
     this.lastLines = /* @__PURE__ */ new Set();
@@ -1474,27 +2017,27 @@ var PodkopLogWatcher = class _PodkopLogWatcher {
     }
   }
   static getInstance() {
-    if (!_PodkopLogWatcher.instance) {
-      _PodkopLogWatcher.instance = new _PodkopLogWatcher();
+    if (!_NetShiftLogWatcher.instance) {
+      _NetShiftLogWatcher.instance = new _NetShiftLogWatcher();
     }
-    return _PodkopLogWatcher.instance;
+    return _NetShiftLogWatcher.instance;
   }
   init(fetcher, options) {
     this.fetcher = fetcher;
     this.onNewLog = options?.onNewLog;
     this.intervalMs = options?.intervalMs ?? 5e3;
     logger.info(
-      "[PodkopLogWatcher]",
+      "[NetShiftLogWatcher]",
       `initialized (interval: ${this.intervalMs}ms)`
     );
   }
   async checkOnce() {
     if (!this.fetcher) {
-      logger.warn("[PodkopLogWatcher]", "fetcher not found");
+      logger.warn("[NetShiftLogWatcher]", "fetcher not found");
       return;
     }
     if (this.paused) {
-      logger.debug("[PodkopLogWatcher]", "skipped check \u2014 tab not visible");
+      logger.debug("[NetShiftLogWatcher]", "skipped check \u2014 tab not visible");
       return;
     }
     try {
@@ -1511,19 +2054,19 @@ var PodkopLogWatcher = class _PodkopLogWatcher {
         this.lastLines = new Set(arr.slice(-500));
       }
     } catch (err) {
-      logger.error("[PodkopLogWatcher]", "failed to read logs:", err);
+      logger.error("[NetShiftLogWatcher]", "failed to read logs:", err);
     }
   }
   start() {
     if (this.running) return;
     if (!this.fetcher) {
-      logger.warn("[PodkopLogWatcher]", "attempted to start without fetcher");
+      logger.warn("[NetShiftLogWatcher]", "attempted to start without fetcher");
       return;
     }
     this.running = true;
     this.timer = setInterval(() => this.checkOnce(), this.intervalMs);
     logger.info(
-      "[PodkopLogWatcher]",
+      "[NetShiftLogWatcher]",
       `started (interval: ${this.intervalMs}ms)`
     );
   }
@@ -1531,26 +2074,26 @@ var PodkopLogWatcher = class _PodkopLogWatcher {
     if (!this.running) return;
     this.running = false;
     if (this.timer) clearInterval(this.timer);
-    logger.info("[PodkopLogWatcher]", "stopped");
+    logger.info("[NetShiftLogWatcher]", "stopped");
   }
   pause() {
     if (!this.running || this.paused) return;
     this.paused = true;
-    logger.info("[PodkopLogWatcher]", "paused (tab not visible)");
+    logger.info("[NetShiftLogWatcher]", "paused (tab not visible)");
   }
   resume() {
     if (!this.running || !this.paused) return;
     this.paused = false;
-    logger.info("[PodkopLogWatcher]", "resumed (tab active)");
+    logger.info("[NetShiftLogWatcher]", "resumed (tab active)");
     this.checkOnce();
   }
   reset() {
     this.lastLines.clear();
-    logger.info("[PodkopLogWatcher]", "log history reset");
+    logger.info("[NetShiftLogWatcher]", "log history reset");
   }
 };
 
-// src/podkop/services/core.service.ts
+// src/netshift/services/core.service.ts
 function coreService() {
   TabServiceInstance.onChange((activeId, tabs) => {
     logger.info("[TAB]", activeId);
@@ -1561,10 +2104,10 @@ function coreService() {
       }
     });
   });
-  const watcher = PodkopLogWatcher.getInstance();
+  const watcher = NetShiftLogWatcher.getInstance();
   watcher.init(
     async () => {
-      const logs = await PodkopShellMethods.checkLogs();
+      const logs = await NetShiftShellMethods.checkLogs();
       if (logs.success) {
         return logs.data;
       }
@@ -1574,7 +2117,7 @@ function coreService() {
       intervalMs: 3e3,
       onNewLog: (line) => {
         if (line.toLowerCase().includes("[error]") || line.toLowerCase().includes("[fatal]")) {
-          ui.addNotification("Podkop Error", E("div", {}, line), "error");
+          ui.addNotification("NetShift Error", E("div", {}, line), "error");
         }
       }
     }
@@ -1582,7 +2125,7 @@ function coreService() {
   watcher.start();
 }
 
-// src/podkop/services/socket.service.ts
+// src/netshift/services/socket.service.ts
 var SocketManager = class _SocketManager {
   constructor() {
     this.sockets = /* @__PURE__ */ new Map();
@@ -1721,1777 +2264,1773 @@ var SocketManager = class _SocketManager {
 };
 var socket = SocketManager.getInstance();
 
-// src/podkop/tabs/dashboard/partials/renderSections.ts
-function renderFailedState() {
-  return E(
-    "div",
-    {
-      class: "pdk_dashboard-page__outbound-section centered",
-      style: "height: 127px"
-    },
-    E("span", {}, [E("span", {}, _("Dashboard currently unavailable"))])
-  );
+// src/partials/button/styles.ts
+var styles = `
+.pdk-partial-button {
+    text-align: center;
 }
-function renderLoadingState() {
-  return E("div", {
-    id: "dashboard-sections-grid-skeleton",
-    class: "pdk_dashboard-page__outbound-section skeleton",
-    style: "height: 127px"
-  });
+
+.pdk-partial-button--with-icon {
+    display: flex;
+    align-items: center;
+    justify-content: center;
 }
-function renderDefaultState({
-  section,
-  onChooseOutbound,
-  onTestLatency,
-  latencyFetching
-}) {
-  function testLatency() {
-    if (section.withTagSelect) {
-      return onTestLatency(section.code);
-    }
-    if (section.outbounds.length) {
-      return onTestLatency(section.outbounds[0].code);
-    }
-  }
-  function renderOutbound(outbound) {
-    function getLatencyClass() {
-      if (!outbound.latency) {
-        return "pdk_dashboard-page__outbound-grid__item__latency--empty";
-      }
-      if (outbound.latency < 800) {
-        return "pdk_dashboard-page__outbound-grid__item__latency--green";
-      }
-      if (outbound.latency < 1500) {
-        return "pdk_dashboard-page__outbound-grid__item__latency--yellow";
-      }
-      return "pdk_dashboard-page__outbound-grid__item__latency--red";
-    }
-    return E(
-      "div",
-      {
-        class: `pdk_dashboard-page__outbound-grid__item ${outbound.selected ? "pdk_dashboard-page__outbound-grid__item--active" : ""} ${section.withTagSelect ? "pdk_dashboard-page__outbound-grid__item--selectable" : ""}`,
-        click: () => section.withTagSelect && onChooseOutbound(section.code, outbound.code)
-      },
-      [
-        E("b", {}, outbound.displayName),
-        E("div", { class: "pdk_dashboard-page__outbound-grid__item__footer" }, [
-          E(
-            "div",
-            { class: "pdk_dashboard-page__outbound-grid__item__type" },
-            outbound.type
-          ),
-          E(
-            "div",
-            { class: getLatencyClass() },
-            outbound.latency ? `${outbound.latency}ms` : "N/A"
-          )
-        ])
-      ]
-    );
-  }
-  return E("div", { class: "pdk_dashboard-page__outbound-section" }, [
-    // Title with test latency
-    E("div", { class: "pdk_dashboard-page__outbound-section__title-section" }, [
-      E(
-        "div",
-        {
-          class: "pdk_dashboard-page__outbound-section__title-section__title"
-        },
-        section.displayName
-      ),
-      latencyFetching ? E("div", { class: "skeleton", style: "width: 99px; height: 28px" }) : E(
-        "button",
-        {
-          class: "btn dashboard-sections-grid-item-test-latency",
-          click: () => testLatency()
-        },
-        _("Test latency")
-      )
-    ]),
-    E(
-      "div",
-      { class: "pdk_dashboard-page__outbound-grid" },
-      section.outbounds.map((outbound) => renderOutbound(outbound))
-    )
-  ]);
+
+.pdk-partial-button--loading {
 }
-function renderSections(props) {
-  if (props.failed) {
-    return renderFailedState();
-  }
-  if (props.loading) {
-    return renderLoadingState();
-  }
-  return renderDefaultState(props);
+
+.pdk-partial-button--disabled {
 }
 
-// src/podkop/tabs/dashboard/partials/renderWidget.ts
-function renderFailedState2() {
-  return E(
-    "div",
-    {
-      id: "",
-      style: "height: 78px",
-      class: "pdk_dashboard-page__widgets-section__item centered"
-    },
-    _("Currently unavailable")
-  );
+.pdk-partial-button__icon {
+    margin-right: 5px;
 }
-function renderLoadingState2() {
-  return E(
-    "div",
-    {
-      id: "",
-      style: "height: 78px",
-      class: "pdk_dashboard-page__widgets-section__item skeleton"
-    },
-    ""
-  );
+
+.pdk-partial-button__icon {
+    display: flex;
+    align-items: center;
+    justify-content: center;
 }
-function renderDefaultState2({ title, items }) {
-  return E("div", { class: "pdk_dashboard-page__widgets-section__item" }, [
-    E(
-      "b",
-      { class: "pdk_dashboard-page__widgets-section__item__title" },
-      title
-    ),
-    ...items.map(
-      (item) => E(
-        "div",
-        {
-          class: `pdk_dashboard-page__widgets-section__item__row ${item?.attributes?.class || ""}`
-        },
-        [
-          E(
-            "span",
-            { class: "pdk_dashboard-page__widgets-section__item__row__key" },
-            `${item.key}: `
-          ),
-          E(
-            "span",
-            { class: "pdk_dashboard-page__widgets-section__item__row__value" },
-            item.value
-          )
-        ]
-      )
-    )
-  ]);
+
+.pdk-partial-button__icon svg {
+    width: 16px;
+    height: 16px;
 }
-function renderWidget(props) {
-  if (props.loading) {
-    return renderLoadingState2();
-  }
-  if (props.failed) {
-    return renderFailedState2();
-  }
-  return renderDefaultState2(props);
+`;
+
+// src/partials/modal/styles.ts
+var styles2 = `
+
+.pdk-partial-modal__body {}
+
+.pdk-partial-modal__content {
+    max-height: 70vh;
+    overflow: scroll;
+    border-radius: 4px;
 }
 
-// src/podkop/tabs/dashboard/render.ts
-function render() {
-  return E(
-    "div",
+.pdk-partial-modal__footer {
+    display: flex;
+    justify-content: flex-end;
+}
+
+.pdk-partial-modal__footer button {
+    margin-left: 10px;
+}
+`;
+
+// src/icons/renderLoaderCircleIcon24.ts
+function renderLoaderCircleIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
     {
-      id: "dashboard-status",
-      class: "pdk_dashboard-page"
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-loader-circle rotate"
     },
     [
-      // Widgets section
-      E("div", { class: "pdk_dashboard-page__widgets-section" }, [
-        E(
-          "div",
-          { id: "dashboard-widget-traffic" },
-          renderWidget({ loading: true, failed: false, title: "", items: [] })
-        ),
-        E(
-          "div",
-          { id: "dashboard-widget-traffic-total" },
-          renderWidget({ loading: true, failed: false, title: "", items: [] })
-        ),
-        E(
-          "div",
-          { id: "dashboard-widget-system-info" },
-          renderWidget({ loading: true, failed: false, title: "", items: [] })
-        ),
-        E(
-          "div",
-          { id: "dashboard-widget-service-info" },
-          renderWidget({ loading: true, failed: false, title: "", items: [] })
-        )
-      ]),
-      // All outbounds
-      E(
-        "div",
-        { id: "dashboard-sections-grid" },
-        renderSections({
-          loading: true,
-          failed: false,
-          section: {
-            code: "",
-            displayName: "",
-            outbounds: [],
-            withTagSelect: false
-          },
-          onTestLatency: () => {
-          },
-          onChooseOutbound: () => {
-          },
-          latencyFetching: false
-        })
-      )
+      svgEl("path", {
+        d: "M21 12a9 9 0 1 1-6.219-8.56"
+      }),
+      svgEl("animateTransform", {
+        attributeName: "transform",
+        attributeType: "XML",
+        type: "rotate",
+        from: "0 12 12",
+        to: "360 12 12",
+        dur: "1s",
+        repeatCount: "indefinite"
+      })
     ]
   );
 }
 
-// src/helpers/prettyBytes.ts
-function prettyBytes(n) {
-  const UNITS = ["B", "KB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"];
-  if (n < 1e3) {
-    return n + " B";
-  }
-  const exponent = Math.min(Math.floor(Math.log10(n) / 3), UNITS.length - 1);
-  n = Number((n / Math.pow(1e3, exponent)).toPrecision(3));
-  const unit = UNITS[exponent];
-  return n + " " + unit;
-}
-
-// src/podkop/fetchers/fetchServicesInfo.ts
-async function fetchServicesInfo() {
-  const [podkop, singbox] = await Promise.all([
-    PodkopShellMethods.getStatus(),
-    PodkopShellMethods.getSingBoxStatus()
-  ]);
-  if (!podkop.success || !singbox.success) {
-    store.set({
-      servicesInfoWidget: {
-        loading: false,
-        failed: true,
-        data: { singbox: 0, podkop: 0 }
-      }
-    });
-  }
-  if (podkop.success && singbox.success) {
-    store.set({
-      servicesInfoWidget: {
-        loading: false,
-        failed: false,
-        data: { singbox: singbox.data.running, podkop: podkop.data.enabled }
-      }
-    });
-  }
-}
-
-// src/podkop/tabs/dashboard/initController.ts
-async function fetchDashboardSections() {
-  const prev = store.get().sectionsWidget;
-  store.set({
-    sectionsWidget: {
-      ...prev,
-      failed: false
-    }
-  });
-  const { data, success } = await CustomPodkopMethods.getDashboardSections();
-  if (!success) {
-    logger.error("[DASHBOARD]", "fetchDashboardSections: failed to fetch");
-  }
-  store.set({
-    sectionsWidget: {
-      latencyFetching: false,
-      loading: false,
-      failed: !success,
-      data
-    }
-  });
-}
-async function connectToClashSockets() {
-  const clashApiSecret = await getClashApiSecret();
-  socket.subscribe(
-    `${getClashWsUrl()}/traffic?token=${clashApiSecret}`,
-    (msg) => {
-      const parsedMsg = JSON.parse(msg);
-      store.set({
-        bandwidthWidget: {
-          loading: false,
-          failed: false,
-          data: { up: parsedMsg.up, down: parsedMsg.down }
-        }
-      });
-    },
-    (_err) => {
-      logger.error(
-        "[DASHBOARD]",
-        "connectToClashSockets - traffic: failed to connect to",
-        getClashWsUrl()
-      );
-      store.set({
-        bandwidthWidget: {
-          loading: false,
-          failed: true,
-          data: { up: 0, down: 0 }
-        }
-      });
-    }
-  );
-  socket.subscribe(
-    `${getClashWsUrl()}/connections?token=${clashApiSecret}`,
-    (msg) => {
-      const parsedMsg = JSON.parse(msg);
-      store.set({
-        trafficTotalWidget: {
-          loading: false,
-          failed: false,
-          data: {
-            downloadTotal: parsedMsg.downloadTotal,
-            uploadTotal: parsedMsg.uploadTotal
-          }
-        },
-        systemInfoWidget: {
-          loading: false,
-          failed: false,
-          data: {
-            connections: parsedMsg.connections?.length,
-            memory: parsedMsg.memory
-          }
-        }
-      });
+// src/icons/renderCircleAlertIcon24.ts
+function renderCircleAlertIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      width: "24",
+      height: "24",
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-alert-icon lucide-circle-alert"
     },
-    (_err) => {
-      logger.error(
-        "[DASHBOARD]",
-        "connectToClashSockets - connections: failed to connect to",
-        getClashWsUrl()
-      );
-      store.set({
-        trafficTotalWidget: {
-          loading: false,
-          failed: true,
-          data: { downloadTotal: 0, uploadTotal: 0 }
-        },
-        systemInfoWidget: {
-          loading: false,
-          failed: true,
-          data: {
-            connections: 0,
-            memory: 0
-          }
-        }
-      });
-    }
+    [
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      }),
+      svgEl("line", {
+        x1: "12",
+        y1: "8",
+        x2: "12",
+        y2: "12"
+      }),
+      svgEl("line", {
+        x1: "12",
+        y1: "16",
+        x2: "12.01",
+        y2: "16"
+      })
+    ]
   );
 }
-async function handleChooseOutbound(selector, tag) {
-  await PodkopShellMethods.setClashApiGroupProxy(selector, tag);
-  await fetchDashboardSections();
-}
-async function handleTestGroupLatency(tag) {
-  store.set({
-    sectionsWidget: {
-      ...store.get().sectionsWidget,
-      latencyFetching: true
-    }
-  });
-  await PodkopShellMethods.getClashApiGroupLatency(tag);
-  await fetchDashboardSections();
-  store.set({
-    sectionsWidget: {
-      ...store.get().sectionsWidget,
-      latencyFetching: false
-    }
-  });
-}
-async function handleTestProxyLatency(tag) {
-  store.set({
-    sectionsWidget: {
-      ...store.get().sectionsWidget,
-      latencyFetching: true
-    }
-  });
-  await PodkopShellMethods.getClashApiProxyLatency(tag);
-  await fetchDashboardSections();
-  store.set({
-    sectionsWidget: {
-      ...store.get().sectionsWidget,
-      latencyFetching: false
-    }
-  });
-}
-async function renderSectionsWidget() {
-  logger.debug("[DASHBOARD]", "renderSectionsWidget");
-  const sectionsWidget = store.get().sectionsWidget;
-  const container = document.getElementById("dashboard-sections-grid");
-  if (sectionsWidget.loading || sectionsWidget.failed) {
-    const renderedWidget = renderSections({
-      loading: sectionsWidget.loading,
-      failed: sectionsWidget.failed,
-      section: {
-        code: "",
-        displayName: "",
-        outbounds: [],
-        withTagSelect: false
-      },
-      onTestLatency: () => {
-      },
-      onChooseOutbound: () => {
-      },
-      latencyFetching: sectionsWidget.latencyFetching
-    });
-    return preserveScrollForPage(() => {
-      container.replaceChildren(renderedWidget);
-    });
-  }
-  const renderedWidgets = sectionsWidget.data.map(
-    (section) => renderSections({
-      loading: sectionsWidget.loading,
-      failed: sectionsWidget.failed,
-      section,
-      latencyFetching: sectionsWidget.latencyFetching,
-      onTestLatency: (tag) => {
-        if (section.withTagSelect) {
-          return handleTestGroupLatency(tag);
-        }
-        return handleTestProxyLatency(tag);
-      },
-      onChooseOutbound: (selector, tag) => {
-        handleChooseOutbound(selector, tag);
-      }
-    })
+
+// src/icons/renderCircleCheckIcon24.ts
+function renderCircleCheckIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      width: "24",
+      height: "24",
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-check-icon lucide-circle-check"
+    },
+    [
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      }),
+      svgEl("path", {
+        d: "M9 12l2 2 4-4"
+      })
+    ]
   );
-  return preserveScrollForPage(() => {
-    container.replaceChildren(...renderedWidgets);
-  });
 }
-async function renderBandwidthWidget() {
-  logger.debug("[DASHBOARD]", "renderBandwidthWidget");
-  const traffic = store.get().bandwidthWidget;
-  const container = document.getElementById("dashboard-widget-traffic");
-  if (traffic.loading || traffic.failed) {
-    const renderedWidget2 = renderWidget({
-      loading: traffic.loading,
-      failed: traffic.failed,
-      title: "",
-      items: []
-    });
-    return container.replaceChildren(renderedWidget2);
-  }
-  const renderedWidget = renderWidget({
-    loading: traffic.loading,
-    failed: traffic.failed,
-    title: _("Traffic"),
-    items: [
-      { key: _("Uplink"), value: `${prettyBytes(traffic.data.up)}/s` },
-      { key: _("Downlink"), value: `${prettyBytes(traffic.data.down)}/s` }
+
+// src/icons/renderCircleSlashIcon24.ts
+function renderCircleSlashIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      width: "24",
+      height: "24",
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-slash-icon lucide-circle-slash"
+    },
+    [
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      }),
+      svgEl("line", {
+        x1: "9",
+        y1: "15",
+        x2: "15",
+        y2: "9"
+      })
     ]
-  });
-  container.replaceChildren(renderedWidget);
+  );
 }
-async function renderTrafficTotalWidget() {
-  logger.debug("[DASHBOARD]", "renderTrafficTotalWidget");
-  const trafficTotalWidget = store.get().trafficTotalWidget;
-  const container = document.getElementById("dashboard-widget-traffic-total");
-  if (trafficTotalWidget.loading || trafficTotalWidget.failed) {
-    const renderedWidget2 = renderWidget({
-      loading: trafficTotalWidget.loading,
-      failed: trafficTotalWidget.failed,
-      title: "",
-      items: []
-    });
-    return container.replaceChildren(renderedWidget2);
-  }
-  const renderedWidget = renderWidget({
-    loading: trafficTotalWidget.loading,
-    failed: trafficTotalWidget.failed,
-    title: _("Traffic Total"),
-    items: [
-      {
-        key: _("Uplink"),
-        value: String(prettyBytes(trafficTotalWidget.data.uploadTotal))
-      },
-      {
-        key: _("Downlink"),
-        value: String(prettyBytes(trafficTotalWidget.data.downloadTotal))
-      }
+
+// src/icons/renderCircleXIcon24.ts
+function renderCircleXIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      width: "24",
+      height: "24",
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-x-icon lucide-circle-x"
+    },
+    [
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      }),
+      svgEl("path", {
+        d: "M15 9L9 15"
+      }),
+      svgEl("path", {
+        d: "M9 9L15 15"
+      })
     ]
-  });
-  container.replaceChildren(renderedWidget);
+  );
 }
-async function renderSystemInfoWidget() {
-  logger.debug("[DASHBOARD]", "renderSystemInfoWidget");
-  const systemInfoWidget = store.get().systemInfoWidget;
-  const container = document.getElementById("dashboard-widget-system-info");
-  if (systemInfoWidget.loading || systemInfoWidget.failed) {
-    const renderedWidget2 = renderWidget({
-      loading: systemInfoWidget.loading,
-      failed: systemInfoWidget.failed,
-      title: "",
-      items: []
-    });
-    return container.replaceChildren(renderedWidget2);
-  }
-  const renderedWidget = renderWidget({
-    loading: systemInfoWidget.loading,
-    failed: systemInfoWidget.failed,
-    title: _("System info"),
-    items: [
-      {
-        key: _("Active Connections"),
-        value: String(systemInfoWidget.data.connections)
-      },
-      {
-        key: _("Memory Usage"),
-        value: String(prettyBytes(systemInfoWidget.data.memory))
-      }
+
+// src/icons/renderCheckIcon24.ts
+function renderCheckIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-check-icon lucide-check"
+    },
+    [
+      svgEl("path", {
+        d: "M20 6 9 17l-5-5"
+      })
     ]
-  });
-  container.replaceChildren(renderedWidget);
+  );
 }
-async function renderServicesInfoWidget() {
-  logger.debug("[DASHBOARD]", "renderServicesInfoWidget");
-  const servicesInfoWidget = store.get().servicesInfoWidget;
-  const container = document.getElementById("dashboard-widget-service-info");
-  if (servicesInfoWidget.loading || servicesInfoWidget.failed) {
-    const renderedWidget2 = renderWidget({
-      loading: servicesInfoWidget.loading,
-      failed: servicesInfoWidget.failed,
-      title: "",
-      items: []
-    });
-    return container.replaceChildren(renderedWidget2);
-  }
-  const renderedWidget = renderWidget({
-    loading: servicesInfoWidget.loading,
-    failed: servicesInfoWidget.failed,
-    title: _("Services info"),
-    items: [
-      {
-        key: _("Podkop"),
-        value: servicesInfoWidget.data.podkop ? _("\u2714 Enabled") : _("\u2718 Disabled"),
-        attributes: {
-          class: servicesInfoWidget.data.podkop ? "pdk_dashboard-page__widgets-section__item__row--success" : "pdk_dashboard-page__widgets-section__item__row--error"
-        }
-      },
-      {
-        key: _("Sing-box"),
-        value: servicesInfoWidget.data.singbox ? _("\u2714 Running") : _("\u2718 Stopped"),
-        attributes: {
-          class: servicesInfoWidget.data.singbox ? "pdk_dashboard-page__widgets-section__item__row--success" : "pdk_dashboard-page__widgets-section__item__row--error"
-        }
-      }
+
+// src/icons/renderXIcon24.ts
+function renderXIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-x-icon lucide-x"
+    },
+    [svgEl("path", { d: "M18 6 6 18" }), svgEl("path", { d: "m6 6 12 12" })]
+  );
+}
+
+// src/icons/renderTriangleAlertIcon24.ts
+function renderTriangleAlertIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-triangle-alert-icon lucide-triangle-alert"
+    },
+    [
+      svgEl("path", {
+        d: "m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"
+      }),
+      svgEl("path", { d: "M12 9v4" }),
+      svgEl("path", { d: "M12 17h.01" })
     ]
-  });
-  container.replaceChildren(renderedWidget);
+  );
 }
-async function onStoreUpdate(next, prev, diff) {
-  if (diff.sectionsWidget) {
-    renderSectionsWidget();
-  }
-  if (diff.bandwidthWidget) {
-    renderBandwidthWidget();
-  }
-  if (diff.trafficTotalWidget) {
-    renderTrafficTotalWidget();
-  }
-  if (diff.systemInfoWidget) {
-    renderSystemInfoWidget();
-  }
-  if (diff.servicesInfoWidget) {
-    renderServicesInfoWidget();
-  }
+
+// src/icons/renderPauseIcon24.ts
+function renderPauseIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-pause-icon lucide-pause"
+    },
+    [
+      svgEl("rect", {
+        x: "14",
+        y: "3",
+        width: "5",
+        height: "18",
+        rx: "1"
+      }),
+      svgEl("rect", {
+        x: "5",
+        y: "3",
+        width: "5",
+        height: "18",
+        rx: "1"
+      })
+    ]
+  );
 }
-async function onPageMount() {
-  onPageUnmount();
-  store.subscribe(onStoreUpdate);
-  await fetchDashboardSections();
-  await fetchServicesInfo();
-  await connectToClashSockets();
+
+// src/icons/renderPlayIcon24.ts
+function renderPlayIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-play-icon lucide-play"
+    },
+    [
+      svgEl("path", {
+        d: "M5 5a2 2 0 0 1 3.008-1.728l11.997 6.998a2 2 0 0 1 .003 3.458l-12 7A2 2 0 0 1 5 19z"
+      })
+    ]
+  );
 }
-function onPageUnmount() {
-  store.unsubscribe(onStoreUpdate);
-  store.reset([
-    "bandwidthWidget",
-    "trafficTotalWidget",
-    "systemInfoWidget",
-    "servicesInfoWidget",
-    "sectionsWidget"
-  ]);
-  socket.resetAll();
+
+// src/icons/renderRotateCcwIcon24.ts
+function renderRotateCcwIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-rotate-ccw-icon lucide-rotate-ccw"
+    },
+    [
+      svgEl("path", {
+        d: "M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"
+      }),
+      svgEl("path", {
+        d: "M3 3v5h5"
+      })
+    ]
+  );
 }
-function registerLifecycleListeners() {
-  store.subscribe((next, prev, diff) => {
-    if (diff.tabService && next.tabService.current !== prev.tabService.current) {
-      logger.debug(
-        "[DASHBOARD]",
-        "active tab diff event, active tab:",
-        diff.tabService.current
-      );
-      const isDashboardVisible = next.tabService.current === "dashboard";
-      if (isDashboardVisible) {
-        logger.debug(
-          "[DASHBOARD]",
-          "registerLifecycleListeners",
-          "onPageMount"
-        );
-        return onPageMount();
-      }
-      if (!isDashboardVisible) {
-        logger.debug(
-          "[DASHBOARD]",
-          "registerLifecycleListeners",
-          "onPageUnmount"
-        );
-        return onPageUnmount();
-      }
-    }
-  });
+
+// src/icons/renderCircleStopIcon24.ts
+function renderCircleStopIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-stop-icon lucide-circle-stop"
+    },
+    [
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      }),
+      svgEl("rect", {
+        x: "9",
+        y: "9",
+        width: "6",
+        height: "6",
+        rx: "1"
+      })
+    ]
+  );
 }
-async function initController() {
-  onMount("dashboard-status").then(() => {
-    logger.debug("[DASHBOARD]", "initController", "onMount");
-    onPageMount();
-    registerLifecycleListeners();
-  });
+
+// src/icons/renderCirclePlayIcon24.ts
+function renderCirclePlayIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-play-icon lucide-circle-play"
+    },
+    [
+      svgEl("path", {
+        d: "M9 9.003a1 1 0 0 1 1.517-.859l4.997 2.997a1 1 0 0 1 0 1.718l-4.997 2.997A1 1 0 0 1 9 14.996z"
+      }),
+      svgEl("circle", {
+        cx: "12",
+        cy: "12",
+        r: "10"
+      })
+    ]
+  );
 }
 
-// src/podkop/tabs/dashboard/styles.ts
-var styles = `
-#cbi-podkop-dashboard-_mount_node > div {
-    width: 100%;
+// src/icons/renderCircleCheckBigIcon24.ts
+function renderCircleCheckBigIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-circle-check-big-icon lucide-circle-check-big"
+    },
+    [
+      svgEl("path", {
+        d: "M21.801 10A10 10 0 1 1 17 3.335"
+      }),
+      svgEl("path", {
+        d: "m9 11 3 3L22 4"
+      })
+    ]
+  );
 }
 
-#cbi-podkop-dashboard > h3 {
-    display: none;
+// src/icons/renderSquareChartGanttIcon24.ts
+function renderSquareChartGanttIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-square-chart-gantt-icon lucide-square-chart-gantt"
+    },
+    [
+      svgEl("rect", {
+        width: "18",
+        height: "18",
+        x: "3",
+        y: "3",
+        rx: "2"
+      }),
+      svgEl("path", { d: "M9 8h7" }),
+      svgEl("path", { d: "M8 12h6" }),
+      svgEl("path", { d: "M11 16h5" })
+    ]
+  );
 }
-    
-.pdk_dashboard-page {
-    width: 100%;
-    --dashboard-grid-columns: 4;
+
+// src/icons/renderCogIcon24.ts
+function renderCogIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-cog-icon lucide-cog"
+    },
+    [
+      svgEl("path", { d: "M11 10.27 7 3.34" }),
+      svgEl("path", { d: "m11 13.73-4 6.93" }),
+      svgEl("path", { d: "M12 22v-2" }),
+      svgEl("path", { d: "M12 2v2" }),
+      svgEl("path", { d: "M14 12h8" }),
+      svgEl("path", { d: "m17 20.66-1-1.73" }),
+      svgEl("path", { d: "m17 3.34-1 1.73" }),
+      svgEl("path", { d: "M2 12h2" }),
+      svgEl("path", { d: "m20.66 17-1.73-1" }),
+      svgEl("path", { d: "m20.66 7-1.73 1" }),
+      svgEl("path", { d: "m3.34 17 1.73-1" }),
+      svgEl("path", { d: "m3.34 7 1.73 1" }),
+      svgEl("circle", { cx: "12", cy: "12", r: "2" }),
+      svgEl("circle", { cx: "12", cy: "12", r: "8" })
+    ]
+  );
 }
 
-@media (max-width: 900px) {
-    .pdk_dashboard-page {
-        --dashboard-grid-columns: 2;
-    }
+// src/icons/renderSearchIcon24.ts
+function renderSearchIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-search-icon lucide-search"
+    },
+    [
+      svgEl("path", { d: "m21 21-4.34-4.34" }),
+      svgEl("circle", { cx: "11", cy: "11", r: "8" })
+    ]
+  );
 }
 
-.pdk_dashboard-page__widgets-section {
-    margin-top: 10px;
-    display: grid;
-    grid-template-columns: repeat(var(--dashboard-grid-columns), 1fr);
-    grid-gap: 10px;
+// src/icons/renderBookOpenTextIcon24.ts
+function renderBookOpenTextIcon24() {
+  const NS = "http://www.w3.org/2000/svg";
+  return svgEl(
+    "svg",
+    {
+      xmlns: NS,
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      "stroke-width": "2",
+      "stroke-linecap": "round",
+      "stroke-linejoin": "round",
+      class: "lucide lucide-book-open-text-icon lucide-book-open-text"
+    },
+    [
+      svgEl("path", { d: "M12 7v14" }),
+      svgEl("path", { d: "M16 12h2" }),
+      svgEl("path", { d: "M16 8h2" }),
+      svgEl("path", {
+        d: "M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z"
+      }),
+      svgEl("path", { d: "M6 12h2" }),
+      svgEl("path", { d: "M6 8h2" })
+    ]
+  );
 }
 
-.pdk_dashboard-page__widgets-section__item {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
+// src/partials/button/renderButton.ts
+function renderButton({
+  classNames = [],
+  disabled,
+  loading,
+  onClick,
+  text,
+  icon
+}) {
+  const hasIcon = !!loading || !!icon;
+  function getWrappedIcon() {
+    const iconWrap = E("span", {
+      class: "pdk-partial-button__icon"
+    });
+    if (loading) {
+      iconWrap.appendChild(renderLoaderCircleIcon24());
+      return iconWrap;
+    }
+    if (icon) {
+      iconWrap.appendChild(icon());
+      return iconWrap;
+    }
+    return iconWrap;
+  }
+  function getClass() {
+    return [
+      "btn",
+      "pdk-partial-button",
+      ...insertIf(Boolean(disabled), ["pdk-partial-button--disabled"]),
+      ...insertIf(Boolean(loading), ["pdk-partial-button--loading"]),
+      ...insertIf(Boolean(hasIcon), ["pdk-partial-button--with-icon"]),
+      ...classNames
+    ].filter(Boolean).join(" ");
+  }
+  function getDisabled() {
+    if (loading || disabled) {
+      return true;
+    }
+    return void 0;
+  }
+  return E(
+    "button",
+    { class: getClass(), disabled: getDisabled(), click: onClick },
+    [...insertIf(hasIcon, [getWrappedIcon()]), E("span", {}, text)]
+  );
 }
 
-.pdk_dashboard-page__widgets-section__item__title {}
-
-.pdk_dashboard-page__widgets-section__item__row {}
-
-.pdk_dashboard-page__widgets-section__item__row--success .pdk_dashboard-page__widgets-section__item__row__value {
-    color: var(--success-color-medium, green);
+// src/helpers/showToast.ts
+function showToast(message, type, duration = 3e3) {
+  let container = document.querySelector(".toast-container");
+  if (!container) {
+    container = document.createElement("div");
+    container.className = "toast-container";
+    document.body.appendChild(container);
+  }
+  const toast = document.createElement("div");
+  toast.className = `toast toast-${type}`;
+  toast.textContent = message;
+  container.appendChild(toast);
+  setTimeout(() => toast.classList.add("visible"), 100);
+  setTimeout(() => {
+    toast.classList.remove("visible");
+    setTimeout(() => toast.remove(), 300);
+  }, duration);
 }
 
-.pdk_dashboard-page__widgets-section__item__row--error .pdk_dashboard-page__widgets-section__item__row__value {
-    color: var(--error-color-medium, red);
+// src/helpers/copyToClipboard.ts
+function copyToClipboard(text) {
+  const textarea = document.createElement("textarea");
+  textarea.value = text;
+  document.body.appendChild(textarea);
+  textarea.select();
+  try {
+    document.execCommand("copy");
+    showToast(_("Successfully copied!"), "success");
+  } catch (_err) {
+    showToast(_("Failed to copy!"), "error");
+    console.error("copyToClipboard - e", _err);
+  }
+  document.body.removeChild(textarea);
 }
 
-.pdk_dashboard-page__widgets-section__item__row__key {}
+// src/partials/modal/renderModal.ts
+function renderModal(text, name) {
+  return E(
+    "div",
+    { class: "pdk-partial-modal__body" },
+    E("div", {}, [
+      E("pre", { class: "pdk-partial-modal__content" }, E("code", {}, text)),
+      E("div", { class: "pdk-partial-modal__footer" }, [
+        renderButton({
+          classNames: ["cbi-button-apply"],
+          text: _("Download"),
+          onClick: () => downloadAsTxt(text, name)
+        }),
+        renderButton({
+          classNames: ["cbi-button-apply"],
+          text: _("Copy"),
+          onClick: () => copyToClipboard(` \`\`\`${name} 
+ ${text}  
+ \`\`\``)
+        }),
+        renderButton({
+          classNames: ["cbi-button-remove"],
+          text: _("Close"),
+          onClick: ui.hideModal
+        })
+      ])
+    ])
+  );
+}
 
-.pdk_dashboard-page__widgets-section__item__row__value {}
+// src/partials/index.ts
+var PartialStyles = `
+${styles}
+${styles2}
+`;
 
-.pdk_dashboard-page__outbound-section {
-    margin-top: 10px;
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
+// src/netshift/tabs/dashboard/partials/renderSections.ts
+function renderFailedState() {
+  return E(
+    "div",
+    {
+      class: "card pdk_dashboard-page__outbound-section centered",
+      style: "height: 127px"
+    },
+    E("span", {}, [E("span", {}, _("Dashboard currently unavailable"))])
+  );
 }
-
-.pdk_dashboard-page__outbound-section__title-section {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
+function renderLoadingState() {
+  return E("div", {
+    id: "dashboard-sections-grid-skeleton",
+    class: "card pdk_dashboard-page__outbound-section skeleton",
+    style: "height: 127px"
+  });
 }
-
-.pdk_dashboard-page__outbound-section__title-section__title {
-    color: var(--text-color-high);
-    font-weight: 700;
+function renderDefaultState({
+  section,
+  onChooseOutbound,
+  onTestLatency,
+  latencyFetching
+}) {
+  function testLatency() {
+    if (section.withTagSelect) {
+      return onTestLatency(section.code);
+    }
+    if (section.outbounds.length) {
+      return onTestLatency(section.outbounds[0].code);
+    }
+  }
+  function renderOutbound(outbound) {
+    function getLatencyClass() {
+      if (!outbound.latency) {
+        return "pdk_dashboard-page__outbound-grid__item__latency--empty";
+      }
+      if (outbound.latency < 800) {
+        return "pdk_dashboard-page__outbound-grid__item__latency--green";
+      }
+      if (outbound.latency < 1500) {
+        return "pdk_dashboard-page__outbound-grid__item__latency--yellow";
+      }
+      return "pdk_dashboard-page__outbound-grid__item__latency--red";
+    }
+    return E(
+      "div",
+      {
+        class: `card pdk_dashboard-page__outbound-grid__item ${outbound.selected ? "pdk_dashboard-page__outbound-grid__item--active" : ""} ${section.withTagSelect ? "pdk_dashboard-page__outbound-grid__item--selectable" : ""}`,
+        click: () => section.withTagSelect && onChooseOutbound(section.code, outbound.code)
+      },
+      [
+        E("b", {}, outbound.displayName),
+        E("div", { class: "pdk_dashboard-page__outbound-grid__item__footer" }, [
+          E(
+            "div",
+            { class: "pdk_dashboard-page__outbound-grid__item__type" },
+            outbound.type
+          ),
+          E(
+            "div",
+            { class: getLatencyClass() },
+            outbound.latency ? `${outbound.latency}ms` : "N/A"
+          )
+        ])
+      ]
+    );
+  }
+  return E("div", { class: "card pdk_dashboard-page__outbound-section" }, [
+    // Title with test latency
+    E("div", { class: "pdk_dashboard-page__outbound-section__title-section" }, [
+      E(
+        "div",
+        {
+          class: "pdk_dashboard-page__outbound-section__title-section__title"
+        },
+        section.displayName
+      ),
+      latencyFetching ? E("div", { class: "skeleton", style: "width: 99px; height: 28px" }) : renderButton({
+        text: _("Test latency"),
+        onClick: () => testLatency(),
+        classNames: ["dashboard-sections-grid-item-test-latency"]
+      })
+    ]),
+    E(
+      "div",
+      { class: "pdk_dashboard-page__outbound-grid" },
+      section.outbounds.map((outbound) => renderOutbound(outbound))
+    )
+  ]);
 }
-
-.pdk_dashboard-page__outbound-grid {
-    margin-top: 5px;
-    display: grid;
-    grid-template-columns: repeat(var(--dashboard-grid-columns), 1fr);
-    grid-gap: 10px;
+function renderSections(props) {
+  if (props.failed) {
+    return renderFailedState();
+  }
+  if (props.loading) {
+    return renderLoadingState();
+  }
+  return renderDefaultState(props);
 }
 
-.pdk_dashboard-page__outbound-grid__item {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-    transition: border 0.2s ease;
+// src/netshift/tabs/dashboard/partials/renderWidget.ts
+function renderFailedState2() {
+  return E(
+    "div",
+    {
+      id: "",
+      style: "height: 78px",
+      class: "card pdk_dashboard-page__widgets-section__item centered"
+    },
+    _("Currently unavailable")
+  );
 }
-
-.pdk_dashboard-page__outbound-grid__item--selectable {
-    cursor: pointer;
+function renderLoadingState2() {
+  return E(
+    "div",
+    {
+      id: "",
+      style: "height: 78px",
+      class: "card pdk_dashboard-page__widgets-section__item skeleton"
+    },
+    ""
+  );
 }
-
-.pdk_dashboard-page__outbound-grid__item--selectable:hover {
-    border-color: var(--primary-color-high, dodgerblue);
+function renderDefaultState2({ title, items }) {
+  return E("div", { class: "card pdk_dashboard-page__widgets-section__item" }, [
+    E(
+      "b",
+      { class: "pdk_dashboard-page__widgets-section__item__title" },
+      title
+    ),
+    ...items.map(
+      (item) => E(
+        "div",
+        {
+          class: `pdk_dashboard-page__widgets-section__item__row ${item?.attributes?.class || ""}`
+        },
+        [
+          E(
+            "span",
+            { class: "pdk_dashboard-page__widgets-section__item__row__key" },
+            `${item.key}: `
+          ),
+          E(
+            "span",
+            { class: "pdk_dashboard-page__widgets-section__item__row__value" },
+            item.value
+          )
+        ]
+      )
+    )
+  ]);
 }
-
-.pdk_dashboard-page__outbound-grid__item--active {
-    border-color: var(--success-color-medium, green);
+function renderWidget(props) {
+  if (props.loading) {
+    return renderLoadingState2();
+  }
+  if (props.failed) {
+    return renderFailedState2();
+  }
+  return renderDefaultState2(props);
 }
 
-.pdk_dashboard-page__outbound-grid__item__footer {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    margin-top: 10px;
+// src/netshift/tabs/dashboard/render.ts
+function render() {
+  return E(
+    "div",
+    {
+      id: "dashboard-status",
+      class: "pdk_dashboard-page"
+    },
+    [
+      // Widgets section
+      E("div", { class: "pdk_dashboard-page__widgets-section" }, [
+        E(
+          "div",
+          { id: "dashboard-widget-traffic" },
+          renderWidget({ loading: true, failed: false, title: "", items: [] })
+        ),
+        E(
+          "div",
+          { id: "dashboard-widget-traffic-total" },
+          renderWidget({ loading: true, failed: false, title: "", items: [] })
+        ),
+        E(
+          "div",
+          { id: "dashboard-widget-system-info" },
+          renderWidget({ loading: true, failed: false, title: "", items: [] })
+        ),
+        E(
+          "div",
+          { id: "dashboard-widget-service-info" },
+          renderWidget({ loading: true, failed: false, title: "", items: [] })
+        )
+      ]),
+      // All outbounds
+      E(
+        "div",
+        { id: "dashboard-sections-grid" },
+        renderSections({
+          loading: true,
+          failed: false,
+          section: {
+            code: "",
+            displayName: "",
+            outbounds: [],
+            withTagSelect: false
+          },
+          onTestLatency: () => {
+          },
+          onChooseOutbound: () => {
+          },
+          latencyFetching: false
+        })
+      )
+    ]
+  );
 }
 
-.pdk_dashboard-page__outbound-grid__item__type {}
-
-.pdk_dashboard-page__outbound-grid__item__latency--empty {
-    color: var(--primary-color-low, lightgray);
+// src/helpers/prettyBytes.ts
+function prettyBytes(n) {
+  const UNITS = ["B", "KB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"];
+  if (n < 1e3) {
+    return n + " B";
+  }
+  const exponent = Math.min(Math.floor(Math.log10(n) / 3), UNITS.length - 1);
+  n = Number((n / Math.pow(1e3, exponent)).toPrecision(3));
+  const unit = UNITS[exponent];
+  return n + " " + unit;
 }
 
-.pdk_dashboard-page__outbound-grid__item__latency--green {
-    color: var(--success-color-medium, green);
+// src/netshift/fetchers/fetchServicesInfo.ts
+async function fetchServicesInfo() {
+  const [netshift, singbox] = await Promise.all([
+    NetShiftShellMethods.getStatus(),
+    NetShiftShellMethods.getSingBoxStatus()
+  ]);
+  if (!netshift.success || !singbox.success) {
+    store.set({
+      servicesInfoWidget: {
+        loading: false,
+        failed: true,
+        data: { singbox: 0, netshift: 0 }
+      }
+    });
+  }
+  if (netshift.success && singbox.success) {
+    store.set({
+      servicesInfoWidget: {
+        loading: false,
+        failed: false,
+        data: {
+          singbox: singbox.data.running,
+          netshift: netshift.data.enabled
+        }
+      }
+    });
+  }
 }
 
-.pdk_dashboard-page__outbound-grid__item__latency--yellow {
-    color: var(--warn-color-medium, orange);
+// src/netshift/tabs/dashboard/initController.ts
+async function fetchDashboardSections() {
+  const prev = store.get().sectionsWidget;
+  store.set({
+    sectionsWidget: {
+      ...prev,
+      failed: false
+    }
+  });
+  const { data, success } = await CustomNetShiftMethods.getDashboardSections();
+  if (!success) {
+    logger.error("[DASHBOARD]", "fetchDashboardSections: failed to fetch");
+  }
+  store.set({
+    sectionsWidget: {
+      latencyFetching: false,
+      loading: false,
+      failed: !success,
+      data
+    }
+  });
 }
-
-.pdk_dashboard-page__outbound-grid__item__latency--red {
-    color: var(--error-color-medium, red);
+async function connectToClashSockets() {
+  const clashApiSecret = await getClashApiSecret();
+  socket.subscribe(
+    `${getClashWsUrl()}/traffic?token=${clashApiSecret}`,
+    (msg) => {
+      const parsedMsg = JSON.parse(msg);
+      store.set({
+        bandwidthWidget: {
+          loading: false,
+          failed: false,
+          data: { up: parsedMsg.up, down: parsedMsg.down }
+        }
+      });
+    },
+    (_err) => {
+      logger.error(
+        "[DASHBOARD]",
+        "connectToClashSockets - traffic: failed to connect to",
+        getClashWsUrl()
+      );
+      store.set({
+        bandwidthWidget: {
+          loading: false,
+          failed: true,
+          data: { up: 0, down: 0 }
+        }
+      });
+    }
+  );
+  socket.subscribe(
+    `${getClashWsUrl()}/connections?token=${clashApiSecret}`,
+    (msg) => {
+      const parsedMsg = JSON.parse(msg);
+      store.set({
+        trafficTotalWidget: {
+          loading: false,
+          failed: false,
+          data: {
+            downloadTotal: parsedMsg.downloadTotal,
+            uploadTotal: parsedMsg.uploadTotal
+          }
+        },
+        systemInfoWidget: {
+          loading: false,
+          failed: false,
+          data: {
+            connections: parsedMsg.connections?.length,
+            memory: parsedMsg.memory
+          }
+        }
+      });
+    },
+    (_err) => {
+      logger.error(
+        "[DASHBOARD]",
+        "connectToClashSockets - connections: failed to connect to",
+        getClashWsUrl()
+      );
+      store.set({
+        trafficTotalWidget: {
+          loading: false,
+          failed: true,
+          data: { downloadTotal: 0, uploadTotal: 0 }
+        },
+        systemInfoWidget: {
+          loading: false,
+          failed: true,
+          data: {
+            connections: 0,
+            memory: 0
+          }
+        }
+      });
+    }
+  );
 }
-
-`;
-
-// src/podkop/tabs/dashboard/index.ts
-var DashboardTab = {
-  render,
-  initController,
-  styles
-};
-
-// src/podkop/tabs/diagnostic/renderDiagnostic.ts
-function render2() {
-  return E("div", { id: "diagnostic-status", class: "pdk_diagnostic-page" }, [
-    E("div", { class: "pdk_diagnostic-page__left-bar" }, [
-      E("div", { id: "pdk_diagnostic-page-run-check" }),
-      E("div", {
-        class: "pdk_diagnostic-page__checks",
-        id: "pdk_diagnostic-page-checks"
-      })
-    ]),
-    E("div", { class: "pdk_diagnostic-page__right-bar" }, [
-      E("div", { id: "pdk_diagnostic-page-wiki" }),
-      E("div", { id: "pdk_diagnostic-page-actions" }),
-      E("div", { id: "pdk_diagnostic-page-system-info" })
-    ])
-  ]);
+async function handleChooseOutbound(selector, tag) {
+  await NetShiftShellMethods.setClashApiGroupProxy(selector, tag);
+  await fetchDashboardSections();
 }
-
-// src/podkop/tabs/diagnostic/checks/updateCheckStore.ts
-function updateCheckStore(check, minified) {
-  const diagnosticsChecks = store.get().diagnosticsChecks;
-  const other = diagnosticsChecks.filter((item) => item.code !== check.code);
-  const smallCheck = {
-    ...check,
-    items: check.items.filter((item) => item.state !== "success")
-  };
-  const targetCheck = minified ? smallCheck : check;
+async function handleTestGroupLatency(tag) {
   store.set({
-    diagnosticsChecks: [...other, targetCheck]
+    sectionsWidget: {
+      ...store.get().sectionsWidget,
+      latencyFetching: true
+    }
+  });
+  await NetShiftShellMethods.getClashApiGroupLatency(tag);
+  await fetchDashboardSections();
+  store.set({
+    sectionsWidget: {
+      ...store.get().sectionsWidget,
+      latencyFetching: false
+    }
   });
 }
-
-// src/podkop/tabs/diagnostic/helpers/getMeta.ts
-function getMeta({ allGood, atLeastOneGood }) {
-  if (allGood) {
-    return {
-      state: "success",
-      description: _("Checks passed")
-    };
-  }
-  if (atLeastOneGood) {
-    return {
-      state: "warning",
-      description: _("Issues detected")
-    };
-  }
-  return {
-    state: "error",
-    description: _("Checks failed")
-  };
+async function handleTestProxyLatency(tag) {
+  store.set({
+    sectionsWidget: {
+      ...store.get().sectionsWidget,
+      latencyFetching: true
+    }
+  });
+  await NetShiftShellMethods.getClashApiProxyLatency(tag);
+  await fetchDashboardSections();
+  store.set({
+    sectionsWidget: {
+      ...store.get().sectionsWidget,
+      latencyFetching: false
+    }
+  });
 }
-
-// src/podkop/tabs/diagnostic/checks/runDnsCheck.ts
-async function runDnsCheck() {
-  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.DNS;
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description: _("Checking, please wait"),
-    state: "loading",
-    items: []
+async function renderSectionsWidget() {
+  logger.debug("[DASHBOARD]", "renderSectionsWidget");
+  const sectionsWidget = store.get().sectionsWidget;
+  const container = document.getElementById("dashboard-sections-grid");
+  if (sectionsWidget.loading || sectionsWidget.failed) {
+    const renderedWidget = renderSections({
+      loading: sectionsWidget.loading,
+      failed: sectionsWidget.failed,
+      section: {
+        code: "",
+        displayName: "",
+        outbounds: [],
+        withTagSelect: false
+      },
+      onTestLatency: () => {
+      },
+      onChooseOutbound: () => {
+      },
+      latencyFetching: sectionsWidget.latencyFetching
+    });
+    return preserveScrollForPage(() => {
+      container.replaceChildren(renderedWidget);
+    });
+  }
+  const renderedWidgets = sectionsWidget.data.map(
+    (section) => renderSections({
+      loading: sectionsWidget.loading,
+      failed: sectionsWidget.failed,
+      section,
+      latencyFetching: sectionsWidget.latencyFetching,
+      onTestLatency: (tag) => {
+        if (section.withTagSelect) {
+          return handleTestGroupLatency(tag);
+        }
+        return handleTestProxyLatency(tag);
+      },
+      onChooseOutbound: (selector, tag) => {
+        handleChooseOutbound(selector, tag);
+      }
+    })
+  );
+  return preserveScrollForPage(() => {
+    container.replaceChildren(...renderedWidgets);
   });
-  const dnsChecks = await PodkopShellMethods.checkDNSAvailable();
-  if (!dnsChecks.success) {
-    updateCheckStore({
-      order,
-      code,
-      title,
-      description: _("Cannot receive checks result"),
-      state: "error",
+}
+async function renderBandwidthWidget() {
+  logger.debug("[DASHBOARD]", "renderBandwidthWidget");
+  const traffic = store.get().bandwidthWidget;
+  const container = document.getElementById("dashboard-widget-traffic");
+  if (traffic.loading || traffic.failed) {
+    const renderedWidget2 = renderWidget({
+      loading: traffic.loading,
+      failed: traffic.failed,
+      title: "",
       items: []
     });
-    throw new Error("DNS checks failed");
+    return container.replaceChildren(renderedWidget2);
   }
-  const data = dnsChecks.data;
-  const allGood = Boolean(data.dns_on_router) && Boolean(data.dhcp_config_status) && Boolean(data.bootstrap_dns_status) && Boolean(data.dns_status);
-  const atLeastOneGood = Boolean(data.dns_on_router) || Boolean(data.dhcp_config_status) || Boolean(data.bootstrap_dns_status) || Boolean(data.dns_status);
-  const { state, description } = getMeta({ atLeastOneGood, allGood });
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description,
-    state,
+  const renderedWidget = renderWidget({
+    loading: traffic.loading,
+    failed: traffic.failed,
+    title: _("Traffic"),
     items: [
-      ...insertIf(
-        data.dns_type === "doh" || data.dns_type === "dot" || !data.bootstrap_dns_status,
-        [
-          {
-            state: data.bootstrap_dns_status ? "success" : "error",
-            key: _("Bootsrap DNS"),
-            value: data.bootstrap_dns_server
-          }
-        ]
-      ),
-      {
-        state: data.dns_status ? "success" : "error",
-        key: _("Main DNS"),
-        value: `${data.dns_server} [${data.dns_type}]`
-      },
-      {
-        state: data.dns_on_router ? "success" : "error",
-        key: _("DNS on router"),
-        value: ""
-      },
-      {
-        state: data.dhcp_config_status ? "success" : "error",
-        key: _("DHCP has DNS server"),
-        value: ""
-      }
+      { key: _("Uplink"), value: `${prettyBytes(traffic.data.up)}/s` },
+      { key: _("Downlink"), value: `${prettyBytes(traffic.data.down)}/s` }
     ]
   });
-  if (!atLeastOneGood) {
-    throw new Error("DNS checks failed");
-  }
+  container.replaceChildren(renderedWidget);
 }
-
-// src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts
-async function runSingBoxCheck() {
-  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.SINGBOX;
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description: _("Checking, please wait"),
-    state: "loading",
-    items: []
-  });
-  const singBoxChecks = await PodkopShellMethods.checkSingBox();
-  if (!singBoxChecks.success) {
-    updateCheckStore({
-      order,
-      code,
-      title,
-      description: _("Cannot receive checks result"),
-      state: "error",
+async function renderTrafficTotalWidget() {
+  logger.debug("[DASHBOARD]", "renderTrafficTotalWidget");
+  const trafficTotalWidget = store.get().trafficTotalWidget;
+  const container = document.getElementById("dashboard-widget-traffic-total");
+  if (trafficTotalWidget.loading || trafficTotalWidget.failed) {
+    const renderedWidget2 = renderWidget({
+      loading: trafficTotalWidget.loading,
+      failed: trafficTotalWidget.failed,
+      title: "",
       items: []
     });
-    throw new Error("Sing-box checks failed");
+    return container.replaceChildren(renderedWidget2);
   }
-  const data = singBoxChecks.data;
-  const allGood = Boolean(data.sing_box_installed) && Boolean(data.sing_box_version_ok) && Boolean(data.sing_box_service_exist) && Boolean(data.sing_box_autostart_disabled) && Boolean(data.sing_box_process_running) && Boolean(data.sing_box_ports_listening);
-  const atLeastOneGood = Boolean(data.sing_box_installed) || Boolean(data.sing_box_version_ok) || Boolean(data.sing_box_service_exist) || Boolean(data.sing_box_autostart_disabled) || Boolean(data.sing_box_process_running) || Boolean(data.sing_box_ports_listening);
-  const { state, description } = getMeta({ atLeastOneGood, allGood });
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description,
-    state,
-    items: [
-      {
-        state: data.sing_box_installed ? "success" : "error",
-        key: _("Sing-box installed"),
-        value: ""
-      },
-      {
-        state: data.sing_box_version_ok ? "success" : "error",
-        key: _("Sing-box version is compatible (newer than 1.12.4)"),
-        value: ""
-      },
-      {
-        state: data.sing_box_service_exist ? "success" : "error",
-        key: _("Sing-box service exist"),
-        value: ""
-      },
-      {
-        state: data.sing_box_autostart_disabled ? "success" : "error",
-        key: _("Sing-box autostart disabled"),
-        value: ""
-      },
+  const renderedWidget = renderWidget({
+    loading: trafficTotalWidget.loading,
+    failed: trafficTotalWidget.failed,
+    title: _("Traffic Total"),
+    items: [
       {
-        state: data.sing_box_process_running ? "success" : "error",
-        key: _("Sing-box process running"),
-        value: ""
+        key: _("Uplink"),
+        value: String(prettyBytes(trafficTotalWidget.data.uploadTotal))
       },
       {
-        state: data.sing_box_ports_listening ? "success" : "error",
-        key: _("Sing-box listening ports"),
-        value: ""
+        key: _("Downlink"),
+        value: String(prettyBytes(trafficTotalWidget.data.downloadTotal))
       }
     ]
   });
-  if (!atLeastOneGood || !data.sing_box_process_running) {
-    throw new Error("Sing-box checks failed");
-  }
+  container.replaceChildren(renderedWidget);
 }
-
-// src/podkop/tabs/diagnostic/checks/runNftCheck.ts
-async function runNftCheck() {
-  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.NFT;
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description: _("Checking, please wait"),
-    state: "loading",
-    items: []
-  });
-  await RemoteFakeIPMethods.getFakeIpCheck();
-  await RemoteFakeIPMethods.getIpCheck();
-  const nftablesChecks = await PodkopShellMethods.checkNftRules();
-  if (!nftablesChecks.success) {
-    updateCheckStore({
-      order,
-      code,
-      title,
-      description: _("Cannot receive checks result"),
-      state: "error",
+async function renderSystemInfoWidget() {
+  logger.debug("[DASHBOARD]", "renderSystemInfoWidget");
+  const systemInfoWidget = store.get().systemInfoWidget;
+  const container = document.getElementById("dashboard-widget-system-info");
+  if (systemInfoWidget.loading || systemInfoWidget.failed) {
+    const renderedWidget2 = renderWidget({
+      loading: systemInfoWidget.loading,
+      failed: systemInfoWidget.failed,
+      title: "",
       items: []
     });
-    throw new Error("Nftables checks failed");
+    return container.replaceChildren(renderedWidget2);
   }
-  const data = nftablesChecks.data;
-  const allGood = Boolean(data.table_exist) && Boolean(data.rules_mangle_exist) && Boolean(data.rules_mangle_counters) && Boolean(data.rules_mangle_output_exist) && Boolean(data.rules_mangle_output_counters) && Boolean(data.rules_proxy_exist) && Boolean(data.rules_proxy_counters) && !data.rules_other_mark_exist;
-  const atLeastOneGood = Boolean(data.table_exist) || Boolean(data.rules_mangle_exist) || Boolean(data.rules_mangle_counters) || Boolean(data.rules_mangle_output_exist) || Boolean(data.rules_mangle_output_counters) || Boolean(data.rules_proxy_exist) || Boolean(data.rules_proxy_counters) || !data.rules_other_mark_exist;
-  const { state, description } = getMeta({ atLeastOneGood, allGood });
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description,
-    state,
+  const renderedWidget = renderWidget({
+    loading: systemInfoWidget.loading,
+    failed: systemInfoWidget.failed,
+    title: _("System info"),
     items: [
       {
-        state: data.table_exist ? "success" : "error",
-        key: _("Table exist"),
-        value: ""
-      },
-      {
-        state: data.rules_mangle_exist ? "success" : "error",
-        key: _("Rules mangle exist"),
-        value: ""
-      },
-      {
-        state: data.rules_mangle_counters ? "success" : "error",
-        key: _("Rules mangle counters"),
-        value: ""
-      },
-      {
-        state: data.rules_mangle_output_exist ? "success" : "error",
-        key: _("Rules mangle output exist"),
-        value: ""
-      },
-      {
-        state: data.rules_mangle_output_counters ? "success" : "error",
-        key: _("Rules mangle output counters"),
-        value: ""
-      },
-      {
-        state: data.rules_proxy_exist ? "success" : "error",
-        key: _("Rules proxy exist"),
-        value: ""
-      },
-      {
-        state: data.rules_proxy_counters ? "success" : "error",
-        key: _("Rules proxy counters"),
-        value: ""
+        key: _("Active Connections"),
+        value: String(systemInfoWidget.data.connections)
       },
       {
-        state: !data.rules_other_mark_exist ? "success" : "warning",
-        key: !data.rules_other_mark_exist ? _("No other marking rules found") : _("Additional marking rules found"),
-        value: ""
+        key: _("Memory Usage"),
+        value: String(prettyBytes(systemInfoWidget.data.memory))
       }
     ]
   });
-  if (!atLeastOneGood) {
-    throw new Error("Nftables checks failed");
-  }
+  container.replaceChildren(renderedWidget);
 }
-
-// src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts
-async function runFakeIPCheck() {
-  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.FAKEIP;
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description: _("Checking, please wait"),
-    state: "loading",
-    items: []
-  });
-  const routerFakeIPResponse = await PodkopShellMethods.checkFakeIP();
-  const checkFakeIPResponse = await RemoteFakeIPMethods.getFakeIpCheck();
-  const checkIPResponse = await RemoteFakeIPMethods.getIpCheck();
-  const checks = {
-    router: routerFakeIPResponse.success && routerFakeIPResponse.data.fakeip,
-    browserFakeIP: checkFakeIPResponse.success && checkFakeIPResponse.data.fakeip,
-    differentIP: checkFakeIPResponse.success && checkIPResponse.success && checkFakeIPResponse.data.IP !== checkIPResponse.data.IP
-  };
-  const allGood = checks.router || checks.browserFakeIP || checks.differentIP;
-  const atLeastOneGood = checks.router && checks.browserFakeIP && checks.differentIP;
-  const { state, description } = getMeta({ atLeastOneGood, allGood });
-  updateCheckStore({
-    order,
-    code,
-    title,
-    description,
-    state,
+async function renderServicesInfoWidget() {
+  logger.debug("[DASHBOARD]", "renderServicesInfoWidget");
+  const servicesInfoWidget = store.get().servicesInfoWidget;
+  const container = document.getElementById("dashboard-widget-service-info");
+  if (servicesInfoWidget.loading || servicesInfoWidget.failed) {
+    const renderedWidget2 = renderWidget({
+      loading: servicesInfoWidget.loading,
+      failed: servicesInfoWidget.failed,
+      title: "",
+      items: []
+    });
+    return container.replaceChildren(renderedWidget2);
+  }
+  const renderedWidget = renderWidget({
+    loading: servicesInfoWidget.loading,
+    failed: servicesInfoWidget.failed,
+    title: _("Services info"),
     items: [
       {
-        state: checks.router ? "success" : "warning",
-        key: checks.router ? _("Router DNS is routed through sing-box") : _("Router DNS is not routed through sing-box"),
-        value: ""
+        key: _("NetShift"),
+        value: servicesInfoWidget.data.netshift ? _("\u2714 Enabled") : _("\u2718 Disabled"),
+        attributes: {
+          class: servicesInfoWidget.data.netshift ? "pdk_dashboard-page__widgets-section__item__row--success" : "pdk_dashboard-page__widgets-section__item__row--error"
+        }
       },
       {
-        state: checks.browserFakeIP ? "success" : "error",
-        key: checks.browserFakeIP ? _("Browser is using FakeIP correctly") : _("Browser is not using FakeIP"),
-        value: ""
-      },
-      ...insertIf(checks.browserFakeIP, [
-        {
-          state: checks.differentIP ? "success" : "error",
-          key: checks.differentIP ? _("Proxy traffic is routed via FakeIP") : _("Proxy traffic is not routed via FakeIP"),
-          value: ""
+        key: _("Sing-box"),
+        value: servicesInfoWidget.data.singbox ? _("\u2714 Running") : _("\u2718 Stopped"),
+        attributes: {
+          class: servicesInfoWidget.data.singbox ? "pdk_dashboard-page__widgets-section__item__row--success" : "pdk_dashboard-page__widgets-section__item__row--error"
         }
-      ])
+      }
     ]
   });
+  container.replaceChildren(renderedWidget);
 }
-
-// src/partials/button/styles.ts
-var styles2 = `
-.pdk-partial-button {
-    text-align: center;
-}
-
-.pdk-partial-button--with-icon {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-}
-
-.pdk-partial-button--loading {
-}
-
-.pdk-partial-button--disabled {
+async function onStoreUpdate(next, prev, diff) {
+  if (diff.sectionsWidget) {
+    renderSectionsWidget();
+  }
+  if (diff.bandwidthWidget) {
+    renderBandwidthWidget();
+  }
+  if (diff.trafficTotalWidget) {
+    renderTrafficTotalWidget();
+  }
+  if (diff.systemInfoWidget) {
+    renderSystemInfoWidget();
+  }
+  if (diff.servicesInfoWidget) {
+    renderServicesInfoWidget();
+  }
 }
-
-.pdk-partial-button__icon {
-    margin-right: 5px;
+async function onPageMount() {
+  onPageUnmount();
+  store.subscribe(onStoreUpdate);
+  await fetchDashboardSections();
+  await fetchServicesInfo();
+  await connectToClashSockets();
 }
-
-.pdk-partial-button__icon {
-    display: flex;
-    align-items: center;
-    justify-content: center;
+function onPageUnmount() {
+  store.unsubscribe(onStoreUpdate);
+  store.reset([
+    "bandwidthWidget",
+    "trafficTotalWidget",
+    "systemInfoWidget",
+    "servicesInfoWidget",
+    "sectionsWidget"
+  ]);
+  socket.resetAll();
 }
-
-.pdk-partial-button__icon svg {
-    width: 16px;
-    height: 16px;
+function registerLifecycleListeners() {
+  store.subscribe((next, prev, diff) => {
+    if (diff.tabService && next.tabService.current !== prev.tabService.current) {
+      logger.debug(
+        "[DASHBOARD]",
+        "active tab diff event, active tab:",
+        diff.tabService.current
+      );
+      const isDashboardVisible = next.tabService.current === "dashboard";
+      if (isDashboardVisible) {
+        logger.debug(
+          "[DASHBOARD]",
+          "registerLifecycleListeners",
+          "onPageMount"
+        );
+        return onPageMount();
+      }
+      if (!isDashboardVisible) {
+        logger.debug(
+          "[DASHBOARD]",
+          "registerLifecycleListeners",
+          "onPageUnmount"
+        );
+        return onPageUnmount();
+      }
+    }
+  });
+}
+async function initController() {
+  onMount("dashboard-status").then(() => {
+    logger.debug("[DASHBOARD]", "initController", "onMount");
+    onPageMount();
+    registerLifecycleListeners();
+  });
 }
-`;
 
-// src/partials/modal/styles.ts
+// src/netshift/tabs/dashboard/styles.ts
 var styles3 = `
+#cbi-netshift-dashboard-_mount_node > div {
+    width: 100%;
+}
 
-.pdk-partial-modal__body {}
-
-.pdk-partial-modal__content {
-    max-height: 70vh;
-    overflow: scroll;
-    border-radius: 4px;
+#cbi-netshift-dashboard > h3 {
+    display: none;
+}
+    
+.pdk_dashboard-page {
+    width: 100%;
+    --dashboard-grid-columns: 4;
 }
 
-.pdk-partial-modal__footer {
-    display: flex;
-    justify-content: flex-end;
+@media (max-width: 900px) {
+    .pdk_dashboard-page {
+        --dashboard-grid-columns: 2;
+    }
 }
 
-.pdk-partial-modal__footer button {
-    margin-left: 10px;
+.pdk_dashboard-page__widgets-section {
+    margin-top: 10px;
+    display: grid;
+    grid-template-columns: repeat(var(--dashboard-grid-columns), 1fr);
+    grid-gap: 10px;
 }
-`;
 
-// src/icons/renderLoaderCircleIcon24.ts
-function renderLoaderCircleIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-loader-circle rotate"
-    },
-    [
-      svgEl("path", {
-        d: "M21 12a9 9 0 1 1-6.219-8.56"
-      }),
-      svgEl("animateTransform", {
-        attributeName: "transform",
-        attributeType: "XML",
-        type: "rotate",
-        from: "0 12 12",
-        to: "360 12 12",
-        dur: "1s",
-        repeatCount: "indefinite"
-      })
-    ]
-  );
+.pdk_dashboard-page__widgets-section__item {
 }
 
-// src/icons/renderCircleAlertIcon24.ts
-function renderCircleAlertIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      width: "24",
-      height: "24",
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-alert-icon lucide-circle-alert"
-    },
-    [
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      }),
-      svgEl("line", {
-        x1: "12",
-        y1: "8",
-        x2: "12",
-        y2: "12"
-      }),
-      svgEl("line", {
-        x1: "12",
-        y1: "16",
-        x2: "12.01",
-        y2: "16"
-      })
-    ]
-  );
+.pdk_dashboard-page__widgets-section__item__title {}
+
+.pdk_dashboard-page__widgets-section__item__row {}
+
+.pdk_dashboard-page__widgets-section__item__row--success .pdk_dashboard-page__widgets-section__item__row__value {
+    color: var(--success-color-medium, green);
 }
 
-// src/icons/renderCircleCheckIcon24.ts
-function renderCircleCheckIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      width: "24",
-      height: "24",
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-check-icon lucide-circle-check"
-    },
-    [
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      }),
-      svgEl("path", {
-        d: "M9 12l2 2 4-4"
-      })
-    ]
-  );
+.pdk_dashboard-page__widgets-section__item__row--error .pdk_dashboard-page__widgets-section__item__row__value {
+    color: var(--error-color-medium, red);
 }
 
-// src/icons/renderCircleSlashIcon24.ts
-function renderCircleSlashIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      width: "24",
-      height: "24",
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-slash-icon lucide-circle-slash"
-    },
-    [
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      }),
-      svgEl("line", {
-        x1: "9",
-        y1: "15",
-        x2: "15",
-        y2: "9"
-      })
-    ]
-  );
+.pdk_dashboard-page__widgets-section__item__row__key {}
+
+.pdk_dashboard-page__widgets-section__item__row__value {}
+
+.pdk_dashboard-page__outbound-section {
+    margin-top: 10px;
 }
 
-// src/icons/renderCircleXIcon24.ts
-function renderCircleXIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      width: "24",
-      height: "24",
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-x-icon lucide-circle-x"
-    },
-    [
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      }),
-      svgEl("path", {
-        d: "M15 9L9 15"
-      }),
-      svgEl("path", {
-        d: "M9 9L15 15"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-section__title-section {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
 }
 
-// src/icons/renderCheckIcon24.ts
-function renderCheckIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-check-icon lucide-check"
-    },
-    [
-      svgEl("path", {
-        d: "M20 6 9 17l-5-5"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-section__title-section__title {
+    color: var(--text-color-high);
+    font-weight: 700;
 }
 
-// src/icons/renderXIcon24.ts
-function renderXIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-x-icon lucide-x"
-    },
-    [svgEl("path", { d: "M18 6 6 18" }), svgEl("path", { d: "m6 6 12 12" })]
-  );
+.pdk_dashboard-page__outbound-grid {
+    margin-top: 5px;
+    display: grid;
+    grid-template-columns: repeat(var(--dashboard-grid-columns), 1fr);
+    grid-gap: 10px;
 }
 
-// src/icons/renderTriangleAlertIcon24.ts
-function renderTriangleAlertIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-triangle-alert-icon lucide-triangle-alert"
-    },
-    [
-      svgEl("path", {
-        d: "m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"
-      }),
-      svgEl("path", { d: "M12 9v4" }),
-      svgEl("path", { d: "M12 17h.01" })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item {
+    transition: border 0.2s ease;
 }
 
-// src/icons/renderPauseIcon24.ts
-function renderPauseIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-pause-icon lucide-pause"
-    },
-    [
-      svgEl("rect", {
-        x: "14",
-        y: "3",
-        width: "5",
-        height: "18",
-        rx: "1"
-      }),
-      svgEl("rect", {
-        x: "5",
-        y: "3",
-        width: "5",
-        height: "18",
-        rx: "1"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item--selectable {
+    cursor: pointer;
 }
 
-// src/icons/renderPlayIcon24.ts
-function renderPlayIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-play-icon lucide-play"
-    },
-    [
-      svgEl("path", {
-        d: "M5 5a2 2 0 0 1 3.008-1.728l11.997 6.998a2 2 0 0 1 .003 3.458l-12 7A2 2 0 0 1 5 19z"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item--selectable:hover {
+    border-color: var(--primary-color-high, dodgerblue);
 }
 
-// src/icons/renderRotateCcwIcon24.ts
-function renderRotateCcwIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-rotate-ccw-icon lucide-rotate-ccw"
-    },
-    [
-      svgEl("path", {
-        d: "M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"
-      }),
-      svgEl("path", {
-        d: "M3 3v5h5"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item--active {
+    border-color: var(--success-color-medium, green);
 }
 
-// src/icons/renderCircleStopIcon24.ts
-function renderCircleStopIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-stop-icon lucide-circle-stop"
-    },
-    [
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      }),
-      svgEl("rect", {
-        x: "9",
-        y: "9",
-        width: "6",
-        height: "6",
-        rx: "1"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item__footer {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    margin-top: 10px;
 }
 
-// src/icons/renderCirclePlayIcon24.ts
-function renderCirclePlayIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-play-icon lucide-circle-play"
-    },
-    [
-      svgEl("path", {
-        d: "M9 9.003a1 1 0 0 1 1.517-.859l4.997 2.997a1 1 0 0 1 0 1.718l-4.997 2.997A1 1 0 0 1 9 14.996z"
-      }),
-      svgEl("circle", {
-        cx: "12",
-        cy: "12",
-        r: "10"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item__type {}
+
+.pdk_dashboard-page__outbound-grid__item__latency--empty {
+    color: var(--primary-color-low, lightgray);
 }
 
-// src/icons/renderCircleCheckBigIcon24.ts
-function renderCircleCheckBigIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-circle-check-big-icon lucide-circle-check-big"
-    },
-    [
-      svgEl("path", {
-        d: "M21.801 10A10 10 0 1 1 17 3.335"
-      }),
-      svgEl("path", {
-        d: "m9 11 3 3L22 4"
-      })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item__latency--green {
+    color: var(--success-color-medium, green);
 }
 
-// src/icons/renderSquareChartGanttIcon24.ts
-function renderSquareChartGanttIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-square-chart-gantt-icon lucide-square-chart-gantt"
-    },
-    [
-      svgEl("rect", {
-        width: "18",
-        height: "18",
-        x: "3",
-        y: "3",
-        rx: "2"
-      }),
-      svgEl("path", { d: "M9 8h7" }),
-      svgEl("path", { d: "M8 12h6" }),
-      svgEl("path", { d: "M11 16h5" })
-    ]
-  );
+.pdk_dashboard-page__outbound-grid__item__latency--yellow {
+    color: var(--warn-color-medium, orange);
+}
+
+.pdk_dashboard-page__outbound-grid__item__latency--red {
+    color: var(--error-color-medium, red);
+}
+
+`;
+
+// src/netshift/tabs/dashboard/index.ts
+var DashboardTab = {
+  render,
+  initController,
+  styles: styles3
+};
+
+// src/netshift/tabs/diagnostic/renderDiagnostic.ts
+function render2() {
+  return E("div", { id: "diagnostic-status", class: "pdk_diagnostic-page" }, [
+    E("div", { class: "pdk_diagnostic-page__left-bar" }, [
+      E("div", { id: "pdk_diagnostic-page-run-check" }),
+      E("div", {
+        class: "pdk_diagnostic-page__checks",
+        id: "pdk_diagnostic-page-checks"
+      })
+    ]),
+    E("div", { class: "pdk_diagnostic-page__right-bar" }, [
+      E("div", { id: "pdk_diagnostic-page-wiki" }),
+      E("div", { id: "pdk_diagnostic-page-actions" }),
+      E("div", { id: "pdk_diagnostic-page-system-info" })
+    ])
+  ]);
 }
 
-// src/icons/renderCogIcon24.ts
-function renderCogIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-cog-icon lucide-cog"
-    },
-    [
-      svgEl("path", { d: "M11 10.27 7 3.34" }),
-      svgEl("path", { d: "m11 13.73-4 6.93" }),
-      svgEl("path", { d: "M12 22v-2" }),
-      svgEl("path", { d: "M12 2v2" }),
-      svgEl("path", { d: "M14 12h8" }),
-      svgEl("path", { d: "m17 20.66-1-1.73" }),
-      svgEl("path", { d: "m17 3.34-1 1.73" }),
-      svgEl("path", { d: "M2 12h2" }),
-      svgEl("path", { d: "m20.66 17-1.73-1" }),
-      svgEl("path", { d: "m20.66 7-1.73 1" }),
-      svgEl("path", { d: "m3.34 17 1.73-1" }),
-      svgEl("path", { d: "m3.34 7 1.73 1" }),
-      svgEl("circle", { cx: "12", cy: "12", r: "2" }),
-      svgEl("circle", { cx: "12", cy: "12", r: "8" })
-    ]
-  );
+// src/netshift/tabs/diagnostic/checks/updateCheckStore.ts
+function updateCheckStore(check, minified) {
+  const diagnosticsChecks = store.get().diagnosticsChecks;
+  const other = diagnosticsChecks.filter((item) => item.code !== check.code);
+  const smallCheck = {
+    ...check,
+    items: check.items.filter((item) => item.state !== "success")
+  };
+  const targetCheck = minified ? smallCheck : check;
+  store.set({
+    diagnosticsChecks: [...other, targetCheck]
+  });
 }
 
-// src/icons/renderSearchIcon24.ts
-function renderSearchIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-search-icon lucide-search"
-    },
-    [
-      svgEl("path", { d: "m21 21-4.34-4.34" }),
-      svgEl("circle", { cx: "11", cy: "11", r: "8" })
-    ]
-  );
+// src/netshift/tabs/diagnostic/helpers/getMeta.ts
+function getMeta({ allGood, atLeastOneGood }) {
+  if (allGood) {
+    return {
+      state: "success",
+      description: _("Checks passed")
+    };
+  }
+  if (atLeastOneGood) {
+    return {
+      state: "warning",
+      description: _("Issues detected")
+    };
+  }
+  return {
+    state: "error",
+    description: _("Checks failed")
+  };
 }
 
-// src/icons/renderBookOpenTextIcon24.ts
-function renderBookOpenTextIcon24() {
-  const NS = "http://www.w3.org/2000/svg";
-  return svgEl(
-    "svg",
-    {
-      xmlns: NS,
-      viewBox: "0 0 24 24",
-      fill: "none",
-      stroke: "currentColor",
-      "stroke-width": "2",
-      "stroke-linecap": "round",
-      "stroke-linejoin": "round",
-      class: "lucide lucide-book-open-text-icon lucide-book-open-text"
-    },
-    [
-      svgEl("path", { d: "M12 7v14" }),
-      svgEl("path", { d: "M16 12h2" }),
-      svgEl("path", { d: "M16 8h2" }),
-      svgEl("path", {
-        d: "M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z"
-      }),
-      svgEl("path", { d: "M6 12h2" }),
-      svgEl("path", { d: "M6 8h2" })
+// src/netshift/tabs/diagnostic/checks/runDnsCheck.ts
+async function runDnsCheck() {
+  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.DNS;
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description: _("Checking, please wait"),
+    state: "loading",
+    items: []
+  });
+  const dnsChecks = await NetShiftShellMethods.checkDNSAvailable();
+  if (!dnsChecks.success) {
+    updateCheckStore({
+      order,
+      code,
+      title,
+      description: _("Cannot receive checks result"),
+      state: "error",
+      items: []
+    });
+    throw new Error("DNS checks failed");
+  }
+  const data = dnsChecks.data;
+  const allGood = Boolean(data.dns_on_router) && Boolean(data.dhcp_config_status) && Boolean(data.bootstrap_dns_status) && Boolean(data.dns_status);
+  const atLeastOneGood = Boolean(data.dns_on_router) || Boolean(data.dhcp_config_status) || Boolean(data.bootstrap_dns_status) || Boolean(data.dns_status);
+  const { state, description } = getMeta({ atLeastOneGood, allGood });
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description,
+    state,
+    items: [
+      ...insertIf(
+        data.dns_type === "doh" || data.dns_type === "dot" || !data.bootstrap_dns_status,
+        [
+          {
+            state: data.bootstrap_dns_status ? "success" : "error",
+            key: _("Bootsrap DNS"),
+            value: data.bootstrap_dns_server
+          }
+        ]
+      ),
+      {
+        state: data.dns_status ? "success" : "error",
+        key: _("Main DNS"),
+        value: `${data.dns_server} [${data.dns_type}]`
+      },
+      ...insertIf(
+        typeof data.dns_via_outbound_tag === "string" && data.dns_via_outbound_tag.length > 0,
+        [
+          {
+            state: "success",
+            key: _("Main DNS via outbound"),
+            value: data.dns_via_outbound_tag ?? ""
+          }
+        ]
+      ),
+      {
+        state: data.dns_on_router ? "success" : "error",
+        key: _("DNS on router"),
+        value: ""
+      },
+      {
+        state: data.dhcp_config_status ? "success" : "error",
+        key: _("DHCP has DNS server"),
+        value: ""
+      }
     ]
-  );
+  });
+  if (!atLeastOneGood) {
+    throw new Error("DNS checks failed");
+  }
 }
 
-// src/partials/button/renderButton.ts
-function renderButton({
-  classNames = [],
-  disabled,
-  loading,
-  onClick,
-  text,
-  icon
-}) {
-  const hasIcon = !!loading || !!icon;
-  function getWrappedIcon() {
-    const iconWrap = E("span", {
-      class: "pdk-partial-button__icon"
+// src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts
+async function runSingBoxCheck() {
+  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.SINGBOX;
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description: _("Checking, please wait"),
+    state: "loading",
+    items: []
+  });
+  const singBoxChecks = await NetShiftShellMethods.checkSingBox();
+  if (!singBoxChecks.success) {
+    updateCheckStore({
+      order,
+      code,
+      title,
+      description: _("Cannot receive checks result"),
+      state: "error",
+      items: []
     });
-    if (loading) {
-      iconWrap.appendChild(renderLoaderCircleIcon24());
-      return iconWrap;
-    }
-    if (icon) {
-      iconWrap.appendChild(icon());
-      return iconWrap;
-    }
-    return iconWrap;
-  }
-  function getClass() {
-    return [
-      "btn",
-      "pdk-partial-button",
-      ...insertIf(Boolean(disabled), ["pdk-partial-button--disabled"]),
-      ...insertIf(Boolean(loading), ["pdk-partial-button--loading"]),
-      ...insertIf(Boolean(hasIcon), ["pdk-partial-button--with-icon"]),
-      ...classNames
-    ].filter(Boolean).join(" ");
+    throw new Error("Sing-box checks failed");
   }
-  function getDisabled() {
-    if (loading || disabled) {
-      return true;
-    }
-    return void 0;
+  const data = singBoxChecks.data;
+  const allGood = Boolean(data.sing_box_installed) && Boolean(data.sing_box_version_ok) && Boolean(data.sing_box_service_exist) && Boolean(data.sing_box_autostart_disabled) && Boolean(data.sing_box_process_running) && Boolean(data.sing_box_ports_listening);
+  const atLeastOneGood = Boolean(data.sing_box_installed) || Boolean(data.sing_box_version_ok) || Boolean(data.sing_box_service_exist) || Boolean(data.sing_box_autostart_disabled) || Boolean(data.sing_box_process_running) || Boolean(data.sing_box_ports_listening);
+  const { state, description } = getMeta({ atLeastOneGood, allGood });
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description,
+    state,
+    items: [
+      {
+        state: data.sing_box_installed ? "success" : "error",
+        key: _("Sing-box installed"),
+        value: ""
+      },
+      {
+        state: data.sing_box_version_ok ? "success" : "error",
+        key: _("Sing-box version is compatible (newer than 1.12.4)"),
+        value: ""
+      },
+      {
+        state: data.sing_box_service_exist ? "success" : "error",
+        key: _("Sing-box service exist"),
+        value: ""
+      },
+      {
+        state: data.sing_box_autostart_disabled ? "success" : "error",
+        key: _("Sing-box autostart disabled"),
+        value: ""
+      },
+      {
+        state: data.sing_box_process_running ? "success" : "error",
+        key: _("Sing-box process running"),
+        value: ""
+      },
+      {
+        state: data.sing_box_ports_listening ? "success" : "error",
+        key: _("Sing-box listening ports"),
+        value: ""
+      }
+    ]
+  });
+  if (!atLeastOneGood || !data.sing_box_process_running) {
+    throw new Error("Sing-box checks failed");
   }
-  return E(
-    "button",
-    { class: getClass(), disabled: getDisabled(), click: onClick },
-    [...insertIf(hasIcon, [getWrappedIcon()]), E("span", {}, text)]
-  );
 }
 
-// src/helpers/showToast.ts
-function showToast(message, type, duration = 3e3) {
-  let container = document.querySelector(".toast-container");
-  if (!container) {
-    container = document.createElement("div");
-    container.className = "toast-container";
-    document.body.appendChild(container);
+// src/netshift/tabs/diagnostic/checks/runNftCheck.ts
+async function runNftCheck() {
+  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.NFT;
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description: _("Checking, please wait"),
+    state: "loading",
+    items: []
+  });
+  await RemoteFakeIPMethods.getFakeIpCheck();
+  await RemoteFakeIPMethods.getIpCheck();
+  const nftablesChecks = await NetShiftShellMethods.checkNftRules();
+  if (!nftablesChecks.success) {
+    updateCheckStore({
+      order,
+      code,
+      title,
+      description: _("Cannot receive checks result"),
+      state: "error",
+      items: []
+    });
+    throw new Error("Nftables checks failed");
   }
-  const toast = document.createElement("div");
-  toast.className = `toast toast-${type}`;
-  toast.textContent = message;
-  container.appendChild(toast);
-  setTimeout(() => toast.classList.add("visible"), 100);
-  setTimeout(() => {
-    toast.classList.remove("visible");
-    setTimeout(() => toast.remove(), 300);
-  }, duration);
-}
-
-// src/helpers/copyToClipboard.ts
-function copyToClipboard(text) {
-  const textarea = document.createElement("textarea");
-  textarea.value = text;
-  document.body.appendChild(textarea);
-  textarea.select();
-  try {
-    document.execCommand("copy");
-    showToast(_("Successfully copied!"), "success");
-  } catch (_err) {
-    showToast(_("Failed to copy!"), "error");
-    console.error("copyToClipboard - e", _err);
+  const data = nftablesChecks.data;
+  const allGood = Boolean(data.table_exist) && Boolean(data.rules_mangle_exist) && Boolean(data.rules_mangle_counters) && Boolean(data.rules_mangle_output_exist) && Boolean(data.rules_proxy_exist) && Boolean(data.rules_proxy_counters) && !data.rules_other_mark_exist;
+  const atLeastOneGood = Boolean(data.table_exist) || Boolean(data.rules_mangle_exist) || Boolean(data.rules_mangle_counters) || Boolean(data.rules_mangle_output_exist) || Boolean(data.rules_proxy_exist) || Boolean(data.rules_proxy_counters) || !data.rules_other_mark_exist;
+  const { state, description } = getMeta({ atLeastOneGood, allGood });
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description,
+    state,
+    items: [
+      {
+        state: data.table_exist ? "success" : "error",
+        key: _("Table exist"),
+        value: ""
+      },
+      {
+        state: data.rules_mangle_exist ? "success" : "error",
+        key: _("Rules mangle exist"),
+        value: ""
+      },
+      {
+        state: data.rules_mangle_counters ? "success" : "error",
+        key: _("Rules mangle counters"),
+        value: ""
+      },
+      {
+        state: data.rules_mangle_output_exist ? "success" : "error",
+        key: _("Rules mangle output exist"),
+        value: ""
+      },
+      {
+        state: data.rules_proxy_exist ? "success" : "error",
+        key: _("Rules proxy exist"),
+        value: ""
+      },
+      {
+        state: data.rules_proxy_counters ? "success" : "error",
+        key: _("Rules proxy counters"),
+        value: ""
+      },
+      {
+        state: !data.rules_other_mark_exist ? "success" : "warning",
+        key: !data.rules_other_mark_exist ? _("No other marking rules found") : _("Additional marking rules found"),
+        value: ""
+      }
+    ]
+  });
+  if (!atLeastOneGood) {
+    throw new Error("Nftables checks failed");
   }
-  document.body.removeChild(textarea);
 }
 
-// src/partials/modal/renderModal.ts
-function renderModal(text, name) {
-  return E(
-    "div",
-    { class: "pdk-partial-modal__body" },
-    E("div", {}, [
-      E("pre", { class: "pdk-partial-modal__content" }, E("code", {}, text)),
-      E("div", { class: "pdk-partial-modal__footer" }, [
-        renderButton({
-          classNames: ["cbi-button-apply"],
-          text: _("Download"),
-          onClick: () => downloadAsTxt(text, name)
-        }),
-        renderButton({
-          classNames: ["cbi-button-apply"],
-          text: _("Copy"),
-          onClick: () => copyToClipboard(` \`\`\`${name} 
- ${text}  
- \`\`\``)
-        }),
-        renderButton({
-          classNames: ["cbi-button-remove"],
-          text: _("Close"),
-          onClick: ui.hideModal
-        })
+// src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts
+async function runFakeIPCheck() {
+  const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.FAKEIP;
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description: _("Checking, please wait"),
+    state: "loading",
+    items: []
+  });
+  const routerFakeIPResponse = await NetShiftShellMethods.checkFakeIP();
+  const checkFakeIPResponse = await RemoteFakeIPMethods.getFakeIpCheck();
+  const checkIPResponse = await RemoteFakeIPMethods.getIpCheck();
+  const checks = {
+    router: routerFakeIPResponse.success && routerFakeIPResponse.data.fakeip,
+    browserFakeIP: checkFakeIPResponse.success && checkFakeIPResponse.data.fakeip,
+    differentIP: checkFakeIPResponse.success && checkIPResponse.success && checkFakeIPResponse.data.IP !== checkIPResponse.data.IP
+  };
+  const allGood = checks.router || checks.browserFakeIP || checks.differentIP;
+  const atLeastOneGood = checks.router && checks.browserFakeIP && checks.differentIP;
+  const { state, description } = getMeta({ atLeastOneGood, allGood });
+  updateCheckStore({
+    order,
+    code,
+    title,
+    description,
+    state,
+    items: [
+      {
+        state: checks.router ? "success" : "warning",
+        key: checks.router ? _("Router DNS is routed through sing-box") : _("Router DNS is not routed through sing-box"),
+        value: ""
+      },
+      {
+        state: checks.browserFakeIP ? "success" : "error",
+        key: checks.browserFakeIP ? _("Browser is using FakeIP correctly") : _("Browser is not using FakeIP"),
+        value: ""
+      },
+      ...insertIf(checks.browserFakeIP, [
+        {
+          state: checks.differentIP ? "success" : "error",
+          key: checks.differentIP ? _("Proxy traffic is routed via FakeIP") : _("Proxy traffic is not routed via FakeIP"),
+          value: ""
+        }
       ])
-    ])
-  );
+    ]
+  });
 }
 
-// src/partials/index.ts
-var PartialStyles = `
-${styles2}
-${styles3}
-`;
-
-// src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts
+// src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts
 function renderAvailableActions({
   restart,
   start,
@@ -3500,16 +4039,17 @@ function renderAvailableActions({
   disable,
   globalCheck,
   viewLogs,
-  showSingBoxConfig
+  showSingBoxConfig,
+  clearSubscriptionCache
 }) {
-  return E("div", { class: "pdk_diagnostic-page__right-bar__actions" }, [
+  return E("div", { class: "card pdk_diagnostic-page__right-bar__actions" }, [
     E("b", {}, _("Available actions")),
     ...insertIf(restart.visible, [
       renderButton({
         classNames: ["cbi-button-apply"],
         onClick: restart.onClick,
         icon: renderRotateCcwIcon24,
-        text: _("Restart podkop"),
+        text: _("Restart NetShift"),
         loading: restart.loading,
         disabled: restart.disabled
       })
@@ -3519,7 +4059,7 @@ function renderAvailableActions({
         classNames: ["cbi-button-remove"],
         onClick: stop.onClick,
         icon: renderCircleStopIcon24,
-        text: _("Stop podkop"),
+        text: _("Stop NetShift"),
         loading: stop.loading,
         disabled: stop.disabled
       })
@@ -3529,7 +4069,7 @@ function renderAvailableActions({
         classNames: ["cbi-button-save"],
         onClick: start.onClick,
         icon: renderCirclePlayIcon24,
-        text: _("Start podkop"),
+        text: _("Start NetShift"),
         loading: start.loading,
         disabled: start.disabled
       })
@@ -3580,11 +4120,20 @@ function renderAvailableActions({
         loading: showSingBoxConfig.loading,
         disabled: showSingBoxConfig.disabled
       })
+    ]),
+    ...insertIf(clearSubscriptionCache.visible, [
+      renderButton({
+        onClick: clearSubscriptionCache.onClick,
+        icon: renderRotateCcwIcon24,
+        text: _("Clear subscription cache"),
+        loading: clearSubscriptionCache.loading,
+        disabled: clearSubscriptionCache.disabled
+      })
     ])
   ]);
 }
 
-// src/podkop/tabs/diagnostic/partials/renderCheckSection.ts
+// src/netshift/tabs/diagnostic/partials/renderCheckSection.ts
 function renderCheckSummary(items) {
   if (!items.length) {
     return E("div", {}, "");
@@ -3620,7 +4169,7 @@ function renderLoadingState3(props) {
   iconWrap.appendChild(renderLoaderCircleIcon24());
   return E(
     "div",
-    { class: "pdk_diagnostic_alert pdk_diagnostic_alert--loading" },
+    { class: "card pdk_diagnostic_alert pdk_diagnostic_alert--loading" },
     [
       iconWrap,
       E("div", { class: "pdk_diagnostic_alert__content" }, [
@@ -3641,7 +4190,7 @@ function renderWarningState(props) {
   iconWrap.appendChild(renderCircleAlertIcon24());
   return E(
     "div",
-    { class: "pdk_diagnostic_alert pdk_diagnostic_alert--warning" },
+    { class: "card pdk_diagnostic_alert pdk_diagnostic_alert--warning" },
     [
       iconWrap,
       E("div", { class: "pdk_diagnostic_alert__content" }, [
@@ -3662,7 +4211,7 @@ function renderErrorState(props) {
   iconWrap.appendChild(renderCircleXIcon24());
   return E(
     "div",
-    { class: "pdk_diagnostic_alert pdk_diagnostic_alert--error" },
+    { class: "card pdk_diagnostic_alert pdk_diagnostic_alert--error" },
     [
       iconWrap,
       E("div", { class: "pdk_diagnostic_alert__content" }, [
@@ -3683,7 +4232,7 @@ function renderSuccessState(props) {
   iconWrap.appendChild(renderCircleCheckIcon24());
   return E(
     "div",
-    { class: "pdk_diagnostic_alert pdk_diagnostic_alert--success" },
+    { class: "card pdk_diagnostic_alert pdk_diagnostic_alert--success" },
     [
       iconWrap,
       E("div", { class: "pdk_diagnostic_alert__content" }, [
@@ -3704,7 +4253,7 @@ function renderSkippedState(props) {
   iconWrap.appendChild(renderCircleSlashIcon24());
   return E(
     "div",
-    { class: "pdk_diagnostic_alert pdk_diagnostic_alert--skipped" },
+    { class: "card pdk_diagnostic_alert pdk_diagnostic_alert--skipped" },
     [
       iconWrap,
       E("div", { class: "pdk_diagnostic_alert__content" }, [
@@ -3739,7 +4288,7 @@ function renderCheckSection(props) {
   return E("div", {}, _("Not implement yet"));
 }
 
-// src/podkop/tabs/diagnostic/partials/renderRunAction.ts
+// src/netshift/tabs/diagnostic/partials/renderRunAction.ts
 function renderRunAction({
   loading,
   click
@@ -3755,37 +4304,41 @@ function renderRunAction({
   ]);
 }
 
-// src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts
+// src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts
 function renderSystemInfo({ items }) {
-  return E("div", { class: "pdk_diagnostic-page__right-bar__system-info" }, [
-    E(
-      "b",
-      { class: "pdk_diagnostic-page__right-bar__system-info__title" },
-      _("System information")
-    ),
-    ...items.map((item) => {
-      const tagClass = [
-        "pdk_diagnostic-page__right-bar__system-info__row__tag",
-        ...insertIf(item.tag?.kind === "warning", [
-          "pdk_diagnostic-page__right-bar__system-info__row__tag--warning"
-        ]),
-        ...insertIf(item.tag?.kind === "success", [
-          "pdk_diagnostic-page__right-bar__system-info__row__tag--success"
-        ])
-      ].filter(Boolean).join(" ");
-      return E(
-        "div",
-        { class: "pdk_diagnostic-page__right-bar__system-info__row" },
-        [
-          E("b", {}, item.key),
-          E("div", {}, [
-            E("span", {}, item.value),
-            E("span", { class: tagClass }, item?.tag?.label)
+  return E(
+    "div",
+    { class: "card pdk_diagnostic-page__right-bar__system-info" },
+    [
+      E(
+        "b",
+        { class: "pdk_diagnostic-page__right-bar__system-info__title" },
+        _("System information")
+      ),
+      ...items.map((item) => {
+        const tagClass = [
+          "pdk_diagnostic-page__right-bar__system-info__row__tag",
+          ...insertIf(item.tag?.kind === "warning", [
+            "pdk_diagnostic-page__right-bar__system-info__row__tag--warning"
+          ]),
+          ...insertIf(item.tag?.kind === "success", [
+            "pdk_diagnostic-page__right-bar__system-info__row__tag--success"
           ])
-        ]
-      );
-    })
-  ]);
+        ].filter(Boolean).join(" ");
+        return E(
+          "div",
+          { class: "pdk_diagnostic-page__right-bar__system-info__row" },
+          [
+            E("b", {}, item.key),
+            E("div", {}, [
+              E("span", {}, item.value),
+              E("span", { class: tagClass }, item?.tag?.label)
+            ])
+          ]
+        );
+      })
+    ]
+  );
 }
 
 // src/helpers/normalizeCompiledVersion.ts
@@ -3796,13 +4349,14 @@ function normalizeCompiledVersion(version) {
   return version;
 }
 
-// src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts
+// src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts
 function renderWikiDisclaimer(kind) {
   const iconWrap = E("span", {
     class: "pdk_diagnostic-page__right-bar__wiki__icon"
   });
   iconWrap.appendChild(renderBookOpenTextIcon24());
   const className = [
+    "card",
     "pdk_diagnostic-page__right-bar__wiki",
     ...insertIf(kind === "error", [
       "pdk_diagnostic-page__right-bar__wiki--error"
@@ -3823,7 +4377,7 @@ function renderWikiDisclaimer(kind) {
       classNames: ["cbi-button-save"],
       text: _("Visit Wiki"),
       onClick: () => window.open(
-        "https://podkop.net/docs/troubleshooting/?utm_source=podkop",
+        "https://podkop.net/docs/troubleshooting/?utm_source=netshift",
         "_blank",
         "noopener,noreferrer"
       )
@@ -3831,7 +4385,7 @@ function renderWikiDisclaimer(kind) {
   ]);
 }
 
-// src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts
+// src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts
 async function runSectionsCheck() {
   const { order, title, code } = DIAGNOSTICS_CHECKS_MAP.OUTBOUNDS;
   updateCheckStore({
@@ -3858,9 +4412,7 @@ async function runSectionsCheck() {
     sections.data.map(async (section) => {
       async function getLatency() {
         if (section.withTagSelect) {
-          const latencyGroup = await PodkopShellMethods.getClashApiGroupLatency(
-            section.code
-          );
+          const latencyGroup = await NetShiftShellMethods.getClashApiGroupLatency(section.code);
           const selectedOutbound = section.outbounds.find(
             (item) => item.selected
           );
@@ -3891,7 +4443,7 @@ async function runSectionsCheck() {
             latency: _("Not responding")
           };
         }
-        const latencyProxy = await PodkopShellMethods.getClashApiProxyLatency(
+        const latencyProxy = await NetShiftShellMethods.getClashApiProxyLatency(
           section.code
         );
         const success2 = latencyProxy.success && !latencyProxy.data.message;
@@ -3935,27 +4487,27 @@ function removeVersionPrefix(version) {
   return version.replace(/^v/, "");
 }
 
-// src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts
+// src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts
 function isUnknownVersion(version) {
   return version === "unknown" || version === _("unknown");
 }
-function getPodkopVersionRow(diagnosticsSystemInfo) {
+function getNetshiftVersionRow(diagnosticsSystemInfo) {
   const loading = diagnosticsSystemInfo.loading;
-  const unknown = isUnknownVersion(diagnosticsSystemInfo.podkop_version);
-  const hasActualVersion = Boolean(diagnosticsSystemInfo.podkop_latest_version) && !isUnknownVersion(diagnosticsSystemInfo.podkop_latest_version);
+  const unknown = isUnknownVersion(diagnosticsSystemInfo.netshift_version);
+  const hasActualVersion = Boolean(diagnosticsSystemInfo.netshift_latest_version) && !isUnknownVersion(diagnosticsSystemInfo.netshift_latest_version);
   const version = normalizeCompiledVersion(
-    diagnosticsSystemInfo.podkop_version
+    diagnosticsSystemInfo.netshift_version
   );
   const isDevVersion = version === "dev";
   if (loading || unknown || !hasActualVersion || isDevVersion) {
     return {
-      key: "Podkop",
+      key: "NetShift",
       value: version
     };
   }
-  if (removeVersionPrefix(version) !== removeVersionPrefix(diagnosticsSystemInfo.podkop_latest_version)) {
+  if (removeVersionPrefix(version) !== removeVersionPrefix(diagnosticsSystemInfo.netshift_latest_version)) {
     return {
-      key: "Podkop",
+      key: "NetShift",
       value: version,
       tag: {
         label: _("Outdated"),
@@ -3964,7 +4516,7 @@ function getPodkopVersionRow(diagnosticsSystemInfo) {
     };
   }
   return {
-    key: "Podkop",
+    key: "NetShift",
     value: version,
     tag: {
       label: _("Latest"),
@@ -3973,26 +4525,28 @@ function getPodkopVersionRow(diagnosticsSystemInfo) {
   };
 }
 
-// src/podkop/tabs/diagnostic/initController.ts
+// src/netshift/tabs/diagnostic/initController.ts
 async function fetchSystemInfo() {
-  const systemInfo = await PodkopShellMethods.getSystemInfo();
+  const systemInfo = await NetShiftShellMethods.getSystemInfo();
   if (systemInfo.success) {
     store.set({
       diagnosticsSystemInfo: {
         loading: false,
-        ...systemInfo.data
+        ...systemInfo.data,
+        sing_box_extended: systemInfo.data.sing_box_extended === 1 ? 1 : 0
       }
     });
   } else {
     store.set({
       diagnosticsSystemInfo: {
         loading: false,
-        podkop_version: _("unknown"),
-        podkop_latest_version: _("unknown"),
+        netshift_version: _("unknown"),
+        netshift_latest_version: _("unknown"),
         luci_app_version: _("unknown"),
         sing_box_version: _("unknown"),
         openwrt_version: _("unknown"),
-        device_model: _("unknown")
+        device_model: _("unknown"),
+        sing_box_extended: 0
       }
     });
   }
@@ -4029,7 +4583,7 @@ async function handleRestart() {
     }
   });
   try {
-    await PodkopShellMethods.restart();
+    await NetShiftShellMethods.restart();
   } catch (e) {
     logger.error("[DIAGNOSTIC]", "handleRestart - e", e);
   } finally {
@@ -4054,7 +4608,7 @@ async function handleStop() {
     }
   });
   try {
-    await PodkopShellMethods.stop();
+    await NetShiftShellMethods.stop();
   } catch (e) {
     logger.error("[DIAGNOSTIC]", "handleStop - e", e);
   } finally {
@@ -4077,7 +4631,7 @@ async function handleStart() {
     }
   });
   try {
-    await PodkopShellMethods.start();
+    await NetShiftShellMethods.start();
   } catch (e) {
     logger.error("[DIAGNOSTIC]", "handleStart - e", e);
   } finally {
@@ -4102,7 +4656,7 @@ async function handleEnable() {
     }
   });
   try {
-    await PodkopShellMethods.enable();
+    await NetShiftShellMethods.enable();
   } catch (e) {
     logger.error("[DIAGNOSTIC]", "handleEnable - e", e);
   } finally {
@@ -4124,7 +4678,7 @@ async function handleDisable() {
     }
   });
   try {
-    await PodkopShellMethods.disable();
+    await NetShiftShellMethods.disable();
   } catch (e) {
     logger.error("[DIAGNOSTIC]", "handleDisable - e", e);
   } finally {
@@ -4146,7 +4700,7 @@ async function handleShowGlobalCheck() {
     }
   });
   try {
-    const globalCheck = await PodkopShellMethods.globalCheck();
+    const globalCheck = await NetShiftShellMethods.globalCheck();
     if (globalCheck.success) {
       ui.showModal(
         _("Global check"),
@@ -4177,7 +4731,7 @@ async function handleViewLogs() {
     }
   });
   try {
-    const viewLogs = await PodkopShellMethods.checkLogs();
+    const viewLogs = await NetShiftShellMethods.checkLogs();
     if (viewLogs.success) {
       ui.showModal(
         _("View logs"),
@@ -4208,7 +4762,7 @@ async function handleShowSingBoxConfig() {
     }
   });
   try {
-    const showSingBoxConfig = await PodkopShellMethods.showSingBoxConfig();
+    const showSingBoxConfig = await NetShiftShellMethods.showSingBoxConfig();
     if (showSingBoxConfig.success) {
       ui.showModal(
         _("Show sing-box config"),
@@ -4220,21 +4774,59 @@ async function handleShowSingBoxConfig() {
     } else {
       logger.error(
         "[DIAGNOSTIC]",
-        "handleShowSingBoxConfig - e",
-        showSingBoxConfig
+        "handleShowSingBoxConfig - e",
+        showSingBoxConfig
+      );
+      showToast(_("Failed to execute!"), "error");
+    }
+  } catch (e) {
+    logger.error("[DIAGNOSTIC]", "handleShowSingBoxConfig - e", e);
+    showToast(_("Failed to execute!"), "error");
+  } finally {
+    store.set({
+      diagnosticsActions: {
+        ...diagnosticsActions,
+        showSingBoxConfig: { loading: false }
+      }
+    });
+  }
+}
+async function handleClearSubscriptionCache() {
+  const diagnosticsActions = store.get().diagnosticsActions;
+  store.set({
+    diagnosticsActions: {
+      ...diagnosticsActions,
+      clearSubscriptionCache: { loading: true }
+    }
+  });
+  showToast(
+    _("Clearing subscription cache and re-downloading\u2026 this may take a minute"),
+    "info"
+  );
+  try {
+    const result = await NetShiftShellMethods.clearSubscriptionCache();
+    if (result.success) {
+      showToast(_("Subscription cache cleared and re-downloaded"), "success");
+    } else {
+      logger.error(
+        "[DIAGNOSTIC]",
+        "handleClearSubscriptionCache - result",
+        result
       );
-      showToast(_("Failed to execute!"), "error");
+      showToast(_("Failed to clear subscription cache"), "error");
     }
   } catch (e) {
-    logger.error("[DIAGNOSTIC]", "handleShowSingBoxConfig - e", e);
-    showToast(_("Failed to execute!"), "error");
+    logger.error("[DIAGNOSTIC]", "handleClearSubscriptionCache - e", e);
+    showToast(_("Failed to clear subscription cache"), "error");
   } finally {
+    await fetchServicesInfo();
     store.set({
       diagnosticsActions: {
         ...diagnosticsActions,
-        showSingBoxConfig: { loading: false }
+        clearSubscriptionCache: { loading: false }
       }
     });
+    store.reset(["diagnosticsChecks"]);
   }
 }
 function renderWikiDisclaimerWidget() {
@@ -4258,7 +4850,7 @@ function renderDiagnosticAvailableActionsWidget() {
   const diagnosticsActions = store.get().diagnosticsActions;
   const servicesInfoWidget = store.get().servicesInfoWidget;
   logger.debug("[DIAGNOSTIC]", "renderDiagnosticAvailableActionsWidget");
-  const podkopEnabled = Boolean(servicesInfoWidget.data.podkop);
+  const netshiftEnabled = Boolean(servicesInfoWidget.data.netshift);
   const singBoxRunning = Boolean(servicesInfoWidget.data.singbox);
   const atLeastOneServiceCommandLoading = servicesInfoWidget.loading || diagnosticsActions.restart.loading || diagnosticsActions.start.loading || diagnosticsActions.stop.loading;
   const container = document.getElementById("pdk_diagnostic-page-actions");
@@ -4283,13 +4875,13 @@ function renderDiagnosticAvailableActionsWidget() {
     },
     enable: {
       loading: diagnosticsActions.enable.loading,
-      visible: !podkopEnabled,
+      visible: !netshiftEnabled,
       onClick: handleEnable,
       disabled: atLeastOneServiceCommandLoading
     },
     disable: {
       loading: diagnosticsActions.disable.loading,
-      visible: podkopEnabled,
+      visible: netshiftEnabled,
       onClick: handleDisable,
       disabled: atLeastOneServiceCommandLoading
     },
@@ -4310,6 +4902,12 @@ function renderDiagnosticAvailableActionsWidget() {
       visible: true,
       onClick: handleShowSingBoxConfig,
       disabled: atLeastOneServiceCommandLoading
+    },
+    clearSubscriptionCache: {
+      loading: diagnosticsActions.clearSubscriptionCache.loading,
+      visible: true,
+      onClick: handleClearSubscriptionCache,
+      disabled: atLeastOneServiceCommandLoading
     }
   });
   return preserveScrollForPage(() => {
@@ -4322,10 +4920,10 @@ function renderDiagnosticSystemInfoWidget() {
   const container = document.getElementById("pdk_diagnostic-page-system-info");
   const renderedSystemInfo = renderSystemInfo({
     items: [
-      getPodkopVersionRow(diagnosticsSystemInfo),
+      getNetshiftVersionRow(diagnosticsSystemInfo),
       {
         key: "Luci App",
-        value: normalizeCompiledVersion(PODKOP_LUCI_APP_VERSION)
+        value: normalizeCompiledVersion(NETSHIFT_LUCI_APP_VERSION)
       },
       {
         key: "Sing-box",
@@ -4353,7 +4951,7 @@ async function onStoreUpdate2(next, prev, diff) {
   if (diff.diagnosticsRunAction) {
     renderDiagnosticRunActionWidget();
   }
-  if (diff.diagnosticsActions || diff.servicesInfoWidget) {
+  if (diff.diagnosticsActions || diff.servicesInfoWidget || diff.diagnosticsSystemInfo) {
     renderDiagnosticAvailableActionsWidget();
   }
   if (diff.diagnosticsSystemInfo) {
@@ -4433,14 +5031,14 @@ async function initController2() {
   });
 }
 
-// src/podkop/tabs/diagnostic/styles.ts
+// src/netshift/tabs/diagnostic/styles.ts
 var styles4 = `
 
-#cbi-podkop-diagnostic-_mount_node > div {
+#cbi-netshift-diagnostic-_mount_node > div {
     width: 100%;
 }
 
-#cbi-podkop-diagnostic > h3 {
+#cbi-netshift-diagnostic > h3 {
     display: none;
 }
 
@@ -4464,10 +5062,6 @@ var styles4 = `
 }
 
 .pdk_diagnostic-page__right-bar__wiki {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
@@ -4489,21 +5083,12 @@ var styles4 = `
 .pdk_diagnostic-page__right-bar__wiki__texts {}
 
 .pdk_diagnostic-page__right-bar__actions {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
-
 }
 
 .pdk_diagnostic-page__right-bar__system-info {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-    padding: 10px;
-
     display: grid;
     grid-template-columns: auto;
     grid-row-gap: 10px;
@@ -4555,14 +5140,10 @@ var styles4 = `
 }
 
 .pdk_diagnostic_alert {
-    border: 2px var(--background-color-low, lightgray) solid;
-    border-radius: 4px;
-
     display: grid;
     grid-template-columns: 24px 1fr;
     grid-column-gap: 10px;
     align-items: center;
-    padding: 10px;
 }
 
 .pdk_diagnostic_alert--loading {
@@ -4624,35 +5205,674 @@ var styles4 = `
 }
 `;
 
-// src/podkop/tabs/diagnostic/index.ts
+// src/netshift/tabs/diagnostic/index.ts
 var DiagnosticTab = {
   render: render2,
   initController: initController2,
   styles: styles4
 };
 
+// src/netshift/tabs/manager/render.ts
+function render3() {
+  return E("div", { id: "manager-status", class: "pdk_manager-page" }, [
+    E("div", {
+      id: "pdk_manager-components",
+      class: "pdk_manager-page__components"
+    })
+  ]);
+}
+
+// src/netshift/tabs/manager/cards.ts
+var NOT_INSTALLED = "not installed";
+function isSingBoxInstalled(systemInfo) {
+  const version = systemInfo.sing_box_version;
+  return Boolean(version) && version !== NOT_INSTALLED;
+}
+function getCheckTag(status) {
+  if (!status) {
+    return void 0;
+  }
+  if (status === "latest") {
+    return { label: _("Latest"), kind: "success" };
+  }
+  if (status === "outdated") {
+    return { label: _("Outdated"), kind: "warning" };
+  }
+  if (status === "not_installed") {
+    return { label: _("Not installed"), kind: "neutral" };
+  }
+  return { label: _("Dev"), kind: "neutral" };
+}
+function netshiftStatus(systemInfo, check) {
+  const installed = normalizeCompiledVersion(systemInfo.netshift_version);
+  if (installed === "dev") {
+    return null;
+  }
+  return check.status;
+}
+function netshiftCard(systemInfo, check) {
+  const status = netshiftStatus(systemInfo, check);
+  const latest = check.latest_version;
+  const actions = [];
+  if (status === "outdated") {
+    actions.push({
+      loadingKey: "netshiftUpdate",
+      kind: "self_update",
+      text: latest ? _("Install %s").replace("%s", latest) : _("Update NetShift"),
+      backendAction: "self_update"
+    });
+  } else {
+    actions.push({
+      loadingKey: "netshiftCheck",
+      kind: "check_netshift",
+      text: _("Check update"),
+      backendAction: "check_update"
+    });
+  }
+  return {
+    key: "netshift",
+    title: "NetShift",
+    version: normalizeCompiledVersion(systemInfo.netshift_version),
+    installed: true,
+    tag: getCheckTag(status),
+    actions
+  };
+}
+function singBoxStockCard(systemInfo, check) {
+  const installed = isSingBoxInstalled(systemInfo);
+  const isActive = installed && systemInfo.sing_box_extended === 0;
+  const actions = [];
+  if (isActive) {
+    if (check.status === "outdated") {
+      const latest = check.latest_version;
+      actions.push({
+        loadingKey: "singBoxStockAction",
+        kind: "update",
+        text: latest ? _("Install %s").replace("%s", latest) : _("Update"),
+        backendAction: "install_stable"
+      });
+    } else {
+      actions.push({
+        loadingKey: "singBoxStockCheck",
+        kind: "check",
+        text: _("Check update"),
+        backendAction: "check_update_stable"
+      });
+    }
+  } else {
+    actions.push({
+      loadingKey: "singBoxStockAction",
+      kind: "switch",
+      text: _("Switch to stable"),
+      backendAction: "install_stable"
+    });
+  }
+  return {
+    key: "sing_box_stock",
+    title: "sing-box (stock)",
+    version: isActive ? systemInfo.sing_box_version : _("Not installed"),
+    installed: isActive,
+    tag: isActive ? getCheckTag(check.status) : getCheckTag("not_installed"),
+    actions
+  };
+}
+function singBoxExtendedCard(systemInfo, check) {
+  const installed = isSingBoxInstalled(systemInfo);
+  const isActive = installed && systemInfo.sing_box_extended === 1;
+  const actions = [];
+  if (isActive) {
+    if (check.status === "outdated") {
+      const latest = check.latest_version;
+      actions.push({
+        loadingKey: "singBoxExtendedAction",
+        kind: "update",
+        text: latest ? _("Install %s").replace("%s", latest) : _("Update"),
+        backendAction: "install_extended"
+      });
+    } else {
+      actions.push({
+        loadingKey: "singBoxExtendedCheck",
+        kind: "check",
+        text: _("Check update"),
+        backendAction: "check_update"
+      });
+    }
+  } else {
+    actions.push({
+      loadingKey: "singBoxExtendedAction",
+      kind: "switch",
+      text: _("Switch to extended"),
+      backendAction: "install_extended"
+    });
+  }
+  return {
+    key: "sing_box_extended",
+    title: "sing-box (extended)",
+    version: isActive ? systemInfo.sing_box_version : _("Not installed"),
+    installed: isActive,
+    tag: isActive ? getCheckTag(check.status) : getCheckTag("not_installed"),
+    actions
+  };
+}
+function getComponentCards(systemInfo, checks) {
+  return [
+    netshiftCard(systemInfo, checks.netshift),
+    singBoxStockCard(systemInfo, checks.sing_box_stock),
+    singBoxExtendedCard(systemInfo, checks.sing_box_extended)
+  ];
+}
+
+// src/netshift/tabs/manager/initController.ts
+var managerLifecycleRegistered = false;
+var managerControllerInitialized = false;
+var managerMounted = false;
+async function fetchSystemInfo2() {
+  const systemInfo = await NetShiftShellMethods.getSystemInfo();
+  if (systemInfo.success) {
+    store.set({
+      diagnosticsSystemInfo: {
+        loading: false,
+        ...systemInfo.data,
+        sing_box_extended: systemInfo.data.sing_box_extended === 1 ? 1 : 0
+      }
+    });
+  } else {
+    store.set({
+      diagnosticsSystemInfo: {
+        loading: false,
+        netshift_version: _("unknown"),
+        netshift_latest_version: _("unknown"),
+        luci_app_version: _("unknown"),
+        sing_box_version: _("unknown"),
+        openwrt_version: _("unknown"),
+        device_model: _("unknown"),
+        sing_box_extended: 0
+      }
+    });
+  }
+}
+function isAnyActionLoading() {
+  return Object.values(store.get().managerActions).some((item) => item.loading);
+}
+function isSystemInfoLoading() {
+  return store.get().diagnosticsSystemInfo.loading;
+}
+function setActionLoading(action, loading) {
+  const managerActions = store.get().managerActions;
+  store.set({
+    managerActions: {
+      ...managerActions,
+      [action]: { loading }
+    }
+  });
+}
+function setCheckResult(component, status, latestVersion) {
+  const managerChecks = store.get().managerChecks;
+  store.set({
+    managerChecks: {
+      ...managerChecks,
+      [component]: {
+        status,
+        latest_version: latestVersion
+      }
+    }
+  });
+}
+function resetCheckResult(component) {
+  setCheckResult(component, null, "");
+}
+function getCheckToastMessage(status) {
+  if (status === "outdated") {
+    return _("Update is available");
+  }
+  if (status === "dev") {
+    return _("Installed version is newer than release");
+  }
+  if (status === "not_installed") {
+    return _("Not installed");
+  }
+  return _("Latest version is installed");
+}
+async function runSingBoxCheck2(component, button) {
+  setActionLoading(button.loadingKey, true);
+  try {
+    const parsed = await NetShiftShellMethods.singBoxCheckUpdate(
+      button.backendAction === "check_update_stable" ? "check_update_stable" : "check_update"
+    );
+    if (!parsed.success) {
+      showToast(parsed.message || _("Failed to execute!"), "error");
+      return;
+    }
+    const status = parsed.status ?? null;
+    setCheckResult(component, status, parsed.latest_version || "");
+    showToast(getCheckToastMessage(status), "success");
+  } catch (error) {
+    logger.error("[MANAGER]", "runSingBoxCheck failed", error);
+    showToast(_("Failed to execute!"), "error");
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+async function runNetshiftCheck(button) {
+  setActionLoading(button.loadingKey, true);
+  try {
+    const parsed = await NetShiftShellMethods.netshiftCheckUpdate();
+    if (!parsed.success) {
+      showToast(parsed.message || _("Failed to execute!"), "error");
+      return;
+    }
+    const status = parsed.status ?? null;
+    setCheckResult("netshift", status, parsed.latest_version || "");
+    showToast(getCheckToastMessage(status), "success");
+  } catch (error) {
+    logger.error("[MANAGER]", "runNetshiftCheck failed", error);
+    showToast(_("Failed to execute!"), "error");
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+async function runSingBoxMutation(component, button) {
+  setActionLoading(button.loadingKey, true);
+  showToast(_("Switching sing-box core, this may take a few minutes\u2026"), "info");
+  try {
+    const result = await NetShiftShellMethods.singBoxComponentAction(
+      button.backendAction === "install_stable" ? "install_stable" : "install_extended"
+    );
+    if (result.success) {
+      const changed = _("Sing-box core changed, version:");
+      showToast(`${changed} ${result.version || ""}`.trim(), "success");
+      resetCheckResult(component);
+      await fetchSystemInfo2();
+    } else {
+      logger.error("[MANAGER]", "runSingBoxMutation failed", result);
+      showToast(result.message || _("Failed to execute!"), "error");
+    }
+  } catch (error) {
+    logger.error("[MANAGER]", "runSingBoxMutation failed", error);
+    showToast(_("Failed to execute!"), "error");
+  } finally {
+    setActionLoading(button.loadingKey, false);
+  }
+}
+function reloadPageAfterSelfUpdate() {
+  window.setTimeout(() => {
+    window.location.reload();
+  }, 1200);
+}
+async function runNetshiftSelfUpdate(button) {
+  setActionLoading(button.loadingKey, true);
+  showToast(
+    _("Updating NetShift, this may take a few minutes; the page will reload\u2026"),
+    "warning",
+    6e3
+  );
+  try {
+    const result = await NetShiftShellMethods.netshiftSelfUpdate();
+    if (result.success) {
+      const updated = _("NetShift updated, version:");
+      showToast(`${updated} ${result.version || ""}`.trim(), "success", 1200);
+      reloadPageAfterSelfUpdate();
+      return;
+    }
+    logger.error("[MANAGER]", "runNetshiftSelfUpdate failed", result);
+    showToast(result.message || _("Failed to execute!"), "error");
+    setActionLoading(button.loadingKey, false);
+  } catch (error) {
+    logger.error("[MANAGER]", "runNetshiftSelfUpdate failed", error);
+    showToast(_("Failed to execute!"), "error");
+    setActionLoading(button.loadingKey, false);
+  }
+}
+function handleManagerAction(card, button) {
+  if (isAnyActionLoading()) {
+    return;
+  }
+  if (button.kind === "check_netshift") {
+    void runNetshiftCheck(button);
+    return;
+  }
+  if (button.kind === "check") {
+    void runSingBoxCheck2(card.key, button);
+    return;
+  }
+  if (button.kind === "self_update") {
+    void runNetshiftSelfUpdate(button);
+    return;
+  }
+  void runSingBoxMutation(card.key, button);
+}
+function renderComponentTag(card) {
+  if (!card.tag) {
+    return null;
+  }
+  return E(
+    "span",
+    {
+      class: [
+        "pdk_manager-page__component__tag",
+        card.tag.kind === "success" ? "pdk_manager-page__component__tag--success" : "",
+        card.tag.kind === "warning" ? "pdk_manager-page__component__tag--warning" : ""
+      ].filter(Boolean).join(" ")
+    },
+    card.tag.label
+  );
+}
+function renderComponentCard(card) {
+  const managerActions = store.get().managerActions;
+  const anyActionLoading = isAnyActionLoading();
+  const systemInfoLoading = isSystemInfoLoading();
+  const tag = renderComponentTag(card);
+  const headerChildren = [
+    E("b", { class: "pdk_manager-page__component__title" }, card.title)
+  ];
+  if (tag) {
+    headerChildren.push(
+      E("div", { class: "pdk_manager-page__component__status" }, [tag])
+    );
+  }
+  return E("div", { class: "card pdk_manager-page__component" }, [
+    E("div", { class: "pdk_manager-page__component__header" }, headerChildren),
+    E("div", { class: "pdk_manager-page__component__version" }, [
+      E(
+        "span",
+        { class: "pdk_manager-page__component__version__label" },
+        _("Version")
+      ),
+      E(
+        "span",
+        { class: "pdk_manager-page__component__version__value" },
+        card.version
+      )
+    ]),
+    E(
+      "div",
+      { class: "pdk_manager-page__component__actions" },
+      card.actions.map((action) => {
+        const loading = managerActions[action.loadingKey].loading;
+        return renderButton({
+          text: action.text,
+          icon: action.kind === "check" || action.kind === "check_netshift" ? renderSearchIcon24 : renderRotateCcwIcon24,
+          loading,
+          disabled: systemInfoLoading || anyActionLoading && !loading,
+          onClick: () => handleManagerAction(card, action)
+        });
+      })
+    )
+  ]);
+}
+function renderManagerComponents() {
+  const container = document.getElementById("pdk_manager-components");
+  if (!container) {
+    return;
+  }
+  const { diagnosticsSystemInfo, managerChecks } = store.get();
+  const renderedComponents = getComponentCards(
+    {
+      netshift_version: normalizeCompiledVersion(
+        diagnosticsSystemInfo.netshift_version
+      ),
+      netshift_latest_version: diagnosticsSystemInfo.netshift_latest_version,
+      sing_box_version: diagnosticsSystemInfo.sing_box_version,
+      sing_box_extended: diagnosticsSystemInfo.sing_box_extended
+    },
+    managerChecks
+  ).map(renderComponentCard);
+  return preserveScrollForPage(() => {
+    container.replaceChildren(...renderedComponents);
+  });
+}
+function onStoreUpdate3(_next, _prev, diff) {
+  if (diff.diagnosticsSystemInfo || diff.managerActions || diff.managerChecks) {
+    renderManagerComponents();
+  }
+}
+function onPageMount3() {
+  onPageUnmount3();
+  managerMounted = true;
+  store.subscribe(onStoreUpdate3);
+  renderManagerComponents();
+  void fetchSystemInfo2();
+}
+function onPageUnmount3() {
+  managerMounted = false;
+  store.unsubscribe(onStoreUpdate3);
+  store.reset(["managerActions", "managerChecks"]);
+}
+function registerLifecycleListeners3() {
+  if (managerLifecycleRegistered) {
+    return;
+  }
+  managerLifecycleRegistered = true;
+  store.subscribe((next, prev, diff) => {
+    if (diff.tabService && next.tabService.current !== prev.tabService.current) {
+      const isManagerVisible = next.tabService.current === "manager";
+      if (isManagerVisible) {
+        return onPageMount3();
+      }
+      if (managerMounted) {
+        return onPageUnmount3();
+      }
+    }
+  });
+}
+async function initController3() {
+  if (managerControllerInitialized) {
+    return;
+  }
+  managerControllerInitialized = true;
+  onMount("manager-status").then(() => {
+    logger.debug("[MANAGER]", "initController", "onMount");
+    registerLifecycleListeners3();
+    if (store.get().tabService.current === "manager") {
+      onPageMount3();
+    }
+  });
+}
+
+// src/netshift/tabs/manager/styles.ts
+var styles5 = `
+#cbi-netshift-manager-_mount_node > div {
+    width: 100%;
+}
+
+#cbi-netshift-manager > h3 {
+    display: none;
+}
+
+.pdk_manager-page {
+    width: 100%;
+}
+
+.pdk_manager-page__components {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(240px, 1fr));
+    grid-gap: 10px;
+}
+
+@media (max-width: 760px) {
+    .pdk_manager-page__components {
+        grid-template-columns: 1fr;
+    }
+}
+
+.pdk_manager-page__component {
+    display: grid;
+    grid-template-columns: 1fr;
+    grid-row-gap: 10px;
+}
+
+.pdk_manager-page__component__header {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(0, auto);
+    align-items: start;
+    gap: 8px;
+    min-width: 0;
+}
+
+.pdk_manager-page__component__title {
+    color: var(--text-color-high);
+    line-height: 1.25;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.pdk_manager-page__component__status {
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 6px;
+    min-width: 0;
+    max-width: 180px;
+    overflow: hidden;
+}
+
+.pdk_manager-page__component__version {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    grid-column-gap: 6px;
+    align-items: baseline;
+    min-width: 0;
+}
+
+.pdk_manager-page__component__version__label {
+    color: var(--text-color-medium);
+}
+
+.pdk_manager-page__component__version__value {
+    min-width: 0;
+    overflow-wrap: anywhere;
+}
+
+.pdk_manager-page__component__tag {
+    flex: 0 0 auto;
+    padding: 2px 5px;
+    border: 1px var(--background-color-high, gray) solid;
+    border-radius: 4px;
+    color: var(--text-color-medium, gray);
+    line-height: 1.2;
+}
+
+.pdk_manager-page__component__tag--success {
+    border-color: var(--success-color-medium, green);
+    color: var(--success-color-medium, green);
+}
+
+.pdk_manager-page__component__tag--warning {
+    border-color: var(--warn-color-medium, orange);
+    color: var(--warn-color-medium, orange);
+}
+
+.pdk_manager-page__component__actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+}
+
+.pdk_manager-page__component__actions > .pdk-partial-button {
+    margin-left: 0;
+}
+`;
+
+// src/netshift/tabs/manager/index.ts
+var ManagerTab = {
+  render: render3,
+  initController: initController3,
+  styles: styles5
+};
+
 // src/styles.ts
 var GlobalStyles = `
+/*
+ * NetShift design tokens (Stage 1 foundation \u2014 task-024).
+ * Each token layers over the LuCI theme var (with a hardcoded fallback) so
+ * themes still win. Reused by the custom tabs and the form redesigns
+ * (task-025/026). Keep these names stable.
+ */
+:root,
+.cbi-map {
+    --ns-card-border: var(--background-color-low, lightgray);
+    --ns-card-border-width: 2px;
+    --ns-card-radius: 4px;
+    --ns-gap: 10px;
+    --ns-card-padding: var(--ns-gap);
+    --ns-success: var(--success-color-medium, #28a745);
+    --ns-warning: var(--warn-color-medium, #f0ad4e);
+    --ns-error: var(--error-color-medium, #dc3545);
+    --ns-info: var(--primary-color-high, #2196f3);
+}
+
+/*
+ * Shared card primitive. Mirrors the Manager component card look
+ * (2px solid border, 4px radius, 10px padding, overflow-safe min-width:0).
+ * Defined BEFORE the per-tab styles so colored-border modifiers
+ * (e.g. .pdk_diagnostic_alert--warning) still win via source order.
+ */
+.card {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
 ${DashboardTab.styles}
 ${DiagnosticTab.styles}
+${ManagerTab.styles}
 ${PartialStyles}
 
 
 /* Hide extra H3 for settings tab */
-#cbi-podkop-settings > h3 {
+#cbi-netshift-settings > h3 {
     display: none;
 }
 
 /* Hide extra H3 for sections tab */
-#cbi-podkop-section > h3:nth-child(1) {
+#cbi-netshift-section > h3:nth-child(1) {
     display: none;
 }
 
 /* Vertical align for remove section action button */
-#cbi-podkop-section > .cbi-section-remove {
+#cbi-netshift-section > .cbi-section-remove {
     margin-bottom: -32px;
 }
 
+/*
+ * Sections (connection) form \u2014 native CBI option-group tabs styled as a
+ * card (task-025). Reuses task-024's --ns-* tokens. The tab strip
+ * (ul.cbi-tabmenu) sits on top; each tab pane (.cbi-section-node-tabbed)
+ * reads as the card body. depends()-driven auto-hide of tabs is unaffected.
+ */
+#cbi-netshift-section .cbi-section-node-tabbed {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
+#cbi-netshift-section ul.cbi-tabmenu {
+    margin-bottom: var(--ns-gap);
+}
+
+/*
+ * Settings form \u2014 native CBI option-group tabs styled as a card (task-026).
+ * Reuses task-024's --ns-* tokens and mirrors the #cbi-netshift-section
+ * pattern above. The tab strip (ul.cbi-tabmenu) sits on top; each tab pane
+ * (.cbi-section-node-tabbed) reads as the card body. depends()-driven
+ * auto-hide of tabs is unaffected. The existing
+ * #cbi-netshift-settings > h3 hide rule above stays valid.
+ */
+#cbi-netshift-settings .cbi-section-node-tabbed {
+    border: var(--ns-card-border-width) solid var(--ns-card-border);
+    border-radius: var(--ns-card-radius);
+    padding: var(--ns-card-padding);
+    min-width: 0;
+}
+
+#cbi-netshift-settings ul.cbi-tabmenu {
+    margin-bottom: var(--ns-gap);
+}
+
 /* Centered class helper */
 .centered {
     display: flex;
@@ -4728,11 +5948,19 @@ ${PartialStyles}
 }
 
 .toast-success {
-    background-color: #28a745;
+    background-color: var(--ns-success, #28a745);
 }
 
 .toast-error {
-    background-color: #dc3545;
+    background-color: var(--ns-error, #dc3545);
+}
+
+.toast-warning {
+    background-color: var(--ns-warning, #f0ad4e);
+}
+
+.toast-info {
+    background-color: var(--ns-info, #2196f3);
 }
 
 .toast.visible {
@@ -4887,7 +6115,7 @@ return baseclass.extend({
   CACHE_TIMEOUT,
   COMMAND_SCHEDULING,
   COMMAND_TIMEOUT,
-  CustomPodkopMethods,
+  CustomNetShiftMethods,
   DIAGNOSTICS_INITIAL_DELAY,
   DIAGNOSTICS_UPDATE_INTERVAL,
   DNS_SERVER_OPTIONS,
@@ -4899,11 +6127,13 @@ return baseclass.extend({
   FETCH_TIMEOUT,
   IP_CHECK_DOMAIN,
   Logger,
-  PODKOP_LUCI_APP_VERSION,
-  PodkopShellMethods,
+  ManagerTab,
+  NETSHIFT_LUCI_APP_VERSION,
+  NetShiftShellMethods,
   REGIONAL_OPTIONS,
   RemoteFakeIPMethods,
   STATUS_COLORS,
+  SUBSCRIPTION_UPDATE_INTERVAL_OPTIONS,
   TabService,
   TabServiceInstance,
   UPDATE_INTERVAL_OPTIONS,
@@ -4928,7 +6158,9 @@ return baseclass.extend({
   svgEl,
   validateDNS,
   validateDomain,
+  validateIP,
   validateIPV4,
+  validateIPV6,
   validateOutboundJson,
   validatePath,
   validateProxyUrl,
diff --git a/luci-app-netshift/htdocs/luci-static/resources/view/netshift/manager.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/manager.js
new file mode 100644
index 00000000..5d7617c9
--- /dev/null
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/manager.js
@@ -0,0 +1,22 @@
+"use strict";
+"require baseclass";
+"require form";
+"require ui";
+"require uci";
+"require fs";
+"require view.netshift.main as main";
+
+function createManagerContent(section) {
+  const o = section.option(form.DummyValue, "_mount_node");
+  o.rawhtml = true;
+  o.cfgvalue = () => {
+    main.ManagerTab.initController();
+    return main.ManagerTab.render();
+  };
+}
+
+const EntryPoint = {
+  createManagerContent,
+};
+
+return baseclass.extend(EntryPoint);
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js
similarity index 60%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js
index f699e173..59e3bb0a 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js
@@ -3,34 +3,52 @@
 "require form";
 "require baseclass";
 "require network";
-"require view.podkop.main as main";
+"require view.netshift.main as main";
 
 // Settings content
-"require view.podkop.settings as settings";
+"require view.netshift.settings as settings";
 
 // Sections content
-"require view.podkop.section as section";
+"require view.netshift.section as section";
 
 // Dashboard content
-"require view.podkop.dashboard as dashboard";
+"require view.netshift.dashboard as dashboard";
 
 // Diagnostic content
-"require view.podkop.diagnostic as diagnostic";
+"require view.netshift.diagnostic as diagnostic";
+
+// Component Manager content
+"require view.netshift.manager as manager";
 
 const EntryPoint = {
   async render() {
     main.injectGlobalStyles();
 
-    const podkopMap = new form.Map(
-      "podkop",
-      _("Podkop Settings"),
-      _("Configuration for Podkop service"),
+    const netshiftMap = new form.Map(
+      "netshift",
+      _("NetShift Settings"),
+      _("Configuration for NetShift service"),
     );
     // Enable tab views
-    podkopMap.tabbed = true;
+    netshiftMap.tabbed = true;
+
+    // Dashboard tab (first / landing tab)
+    const dashboardSection = netshiftMap.section(
+      form.TypedSection,
+      "dashboard",
+      _("Dashboard"),
+    );
+    dashboardSection.anonymous = true;
+    dashboardSection.addremove = false;
+    dashboardSection.cfgsections = function () {
+      return ["dashboard"];
+    };
+
+    // Render dashboard content
+    dashboard.createDashboardContent(dashboardSection);
 
     // Sections tab
-    const sectionsSection = podkopMap.section(
+    const sectionsSection = netshiftMap.section(
       form.TypedSection,
       "section",
       _("Sections"),
@@ -43,7 +61,7 @@ const EntryPoint = {
     section.createSectionContent(sectionsSection);
 
     // Settings tab
-    const settingsSection = podkopMap.section(
+    const settingsSection = netshiftMap.section(
       form.TypedSection,
       "settings",
       _("Settings"),
@@ -58,8 +76,23 @@ const EntryPoint = {
     // Render settings content
     settings.createSettingsContent(settingsSection);
 
+    // Component Manager tab
+    const managerSection = netshiftMap.section(
+      form.TypedSection,
+      "manager",
+      _("Component Manager"),
+    );
+    managerSection.anonymous = true;
+    managerSection.addremove = false;
+    managerSection.cfgsections = function () {
+      return ["manager"];
+    };
+
+    // Render Component Manager content
+    manager.createManagerContent(managerSection);
+
     // Diagnostic tab
-    const diagnosticSection = podkopMap.section(
+    const diagnosticSection = netshiftMap.section(
       form.TypedSection,
       "diagnostic",
       _("Diagnostics"),
@@ -73,25 +106,10 @@ const EntryPoint = {
     // Render diagnostic content
     diagnostic.createDiagnosticContent(diagnosticSection);
 
-    // Dashboard tab
-    const dashboardSection = podkopMap.section(
-      form.TypedSection,
-      "dashboard",
-      _("Dashboard"),
-    );
-    dashboardSection.anonymous = true;
-    dashboardSection.addremove = false;
-    dashboardSection.cfgsections = function () {
-      return ["dashboard"];
-    };
-
-    // Render dashboard content
-    dashboard.createDashboardContent(dashboardSection);
-
     // Inject core service
     main.coreService();
 
-    return podkopMap.render();
+    return netshiftMap.render();
   },
 };
 
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js
similarity index 63%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js
index 7dc8ccb9..a33fbffd 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js
@@ -3,10 +3,37 @@
 "require baseclass";
 "require ui";
 "require tools.widgets as widgets";
-"require view.podkop.main as main";
+"require view.netshift.main as main";
 
 function createSectionContent(section) {
-  let o = section.option(
+  // Group the 36 connection options into 4 native CBI option-group tabs.
+  // HARD RULE: once a section has tab(), every option MUST be added via
+  // taboption() — any leftover section.option(...) renders nothing.
+  // depends() works across tabs; a tab whose options are all depends-hidden
+  // auto-hides from the strip (desired, e.g. Subscription for proxy/url).
+  section.tab(
+    "connection",
+    _("Connection"),
+    _("Connection type, transport and DNS resolver for this section"),
+  );
+  section.tab(
+    "subscription",
+    _("Subscription"),
+    _("Subscription feeds, server filters and URLTest tuning"),
+  );
+  section.tab(
+    "routing",
+    _("Routing"),
+    _("Domain and subnet lists that decide which traffic uses this section"),
+  );
+  section.tab(
+    "advanced",
+    _("Advanced"),
+    _("Mixed proxy and DNS resolution tuning"),
+  );
+
+  let o = section.taboption(
+    "connection",
     form.ListValue,
     "connection_type",
     _("Connection Type"),
@@ -17,7 +44,8 @@ function createSectionContent(section) {
   o.value("block", "Block");
   o.value("exclusion", "Exclusion");
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.ListValue,
     "proxy_config_type",
     _("Configuration Type"),
@@ -26,17 +54,21 @@ function createSectionContent(section) {
   o.value("url", _("Connection URL"));
   o.value("selector", _("Selector"));
   o.value("urltest", _("URLTest"));
+  o.value("subscription", _("Subscription"));
   o.value("outbound", _("Outbound Config"));
   o.default = "url";
   o.depends("connection_type", "proxy");
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.TextValue,
     "proxy_string",
     _("Proxy Configuration URL"),
-    _("vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links")
+    _(
+      "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
+    ),
   );
-  o.depends("proxy_config_type", "url");
+  o.depends({ connection_type: "proxy", proxy_config_type: "url" });
   o.rows = 5;
   // Enable soft wrapping for multi-line proxy URLs (e.g., for URLTest proxy links)
   o.wrap = "soft";
@@ -59,13 +91,14 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.TextValue,
     "outbound_json",
     _("Outbound Configuration"),
     _("Enter complete outbound configuration in JSON format"),
   );
-  o.depends("proxy_config_type", "outbound");
+  o.depends({ connection_type: "proxy", proxy_config_type: "outbound" });
   o.rows = 10;
   o.validate = function (section_id, value) {
     // Optional
@@ -82,13 +115,144 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "subscription",
+    form.DynamicList,
+    "subscription_url",
+    _("Subscription URLs"),
+    _(
+      "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged.",
+    ),
+  );
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+  o.placeholder = "https://example.com/api/sub";
+  o.rmempty = true;
+  o.validate = function (section_id, value) {
+    if (!value || value.length === 0) {
+      return true;
+    }
+
+    const validation = main.validateUrl(value);
+
+    if (validation.valid) {
+      return true;
+    }
+
+    return validation.message;
+  };
+
+  o = section.taboption(
+    "subscription",
+    form.ListValue,
+    "subscription_format_preference",
+    _("Subscription format"),
+    _(
+      "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format.",
+    ),
+  );
+  o.value("auto", _("Auto"));
+  o.value("xray", _("Xray JSON (Happ)"));
+  o.value("singbox", _("Sing-box"));
+  o.default = "auto";
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+
+  o = section.taboption(
+    "subscription",
+    form.Flag,
+    "subscription_insecure",
+    _("Allow insecure TLS for subscription fetch"),
+    _("Disables TLS certificate verification when downloading the subscription.") +
+      " " +
+      _("Use only for IP-host panels that serve an invalid or self-signed certificate.") +
+      " " +
+      _("This is a security trade-off: an attacker could intercept the fetch."),
+  );
+  o.default = "0";
+  o.rmempty = false;
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+
+  o = section.taboption(
+    "subscription",
+    form.ListValue,
+    "subscription_update_interval",
+    _("Subscription Update Interval"),
+    _("How often to automatically update the subscription"),
+  );
+  o.value("30m", _("Every 30 minutes"));
+  o.value("1h", _("Every hour"));
+  o.value("3h", _("Every 3 hours"));
+  o.value("6h", _("Every 6 hours"));
+  o.value("12h", _("Every 12 hours"));
+  o.value("1d", _("Every day"));
+  o.default = "1h";
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+
+  o = section.taboption(
+    "subscription",
+    form.ListValue,
+    "subscription_group_mode",
+    _("Subscription grouping"),
+    _(
+      "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters.",
+    ),
+  );
+  o.value("off", _("Off"));
+  o.value("country", _("By country flag"));
+  o.value("prefix", _("By name prefix"));
+  o.default = "off";
+  o.rmempty = false;
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+
+  o = section.taboption(
+    "subscription",
+    form.Value,
+    "subscription_group_prefix_len",
+    _("Prefix length"),
+    _("Number of leading characters of each proxy name to group by."),
+  );
+  o.default = "2";
+  o.datatype = "and(uinteger,min(1))";
+  o.rmempty = false;
+  o.depends({
+    connection_type: "proxy",
+    proxy_config_type: "subscription",
+    subscription_group_mode: "prefix",
+  });
+
+  o = section.taboption(
+    "subscription",
+    form.DynamicList,
+    "subscription_filter_include_keywords",
+    _("Include servers by keyword"),
+    _(
+      "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all.",
+    ),
+  );
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+  o.rmempty = true;
+
+  o = section.taboption(
+    "subscription",
+    form.DynamicList,
+    "subscription_filter_exclude_keywords",
+    _("Exclude servers by keyword"),
+    _(
+      "Drop subscription servers whose name contains any of these keywords (case-insensitive).",
+    ),
+  );
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
+  o.rmempty = true;
+
+  o = section.taboption(
+    "connection",
     form.DynamicList,
     "selector_proxy_links",
     _("Selector Proxy Links"),
-    _("vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links")
+    _(
+      "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
+    ),
   );
-  o.depends("proxy_config_type", "selector");
+  o.depends({ connection_type: "proxy", proxy_config_type: "selector" });
   o.rmempty = false;
   o.validate = function (section_id, value) {
     // Optional
@@ -105,13 +269,16 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "subscription",
     form.DynamicList,
     "urltest_proxy_links",
     _("URLTest Proxy Links"),
-    _("vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links")
+    _(
+      "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links",
+    ),
   );
-  o.depends("proxy_config_type", "urltest");
+  o.depends({ connection_type: "proxy", proxy_config_type: "urltest" });
   o.rmempty = false;
   o.validate = function (section_id, value) {
     // Optional
@@ -128,28 +295,34 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "subscription",
     form.ListValue,
     "urltest_check_interval",
     _("URLTest Check Interval"),
-    _("The interval between connectivity tests")
+    _("The interval between connectivity tests"),
   );
   o.value("30s", _("Every 30 seconds"));
   o.value("1m", _("Every 1 minute"));
   o.value("3m", _("Every 3 minutes"));
   o.value("5m", _("Every 5 minutes"));
   o.default = "3m";
-  o.depends("proxy_config_type", "urltest");
+  o.depends({ connection_type: "proxy", proxy_config_type: "urltest" });
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
 
-  o = section.option(
+  o = section.taboption(
+    "subscription",
     form.Value,
     "urltest_tolerance",
     _("URLTest Tolerance"),
-    _("The maximum difference in response times (ms) allowed when comparing servers")
+    _(
+      "The maximum difference in response times (ms) allowed when comparing servers",
+    ),
   );
   o.default = "50";
   o.rmempty = false;
-  o.depends("proxy_config_type", "urltest");
+  o.depends({ connection_type: "proxy", proxy_config_type: "urltest" });
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
   o.validate = function (section_id, value) {
     if (!value || value.length === 0) {
       return true;
@@ -157,26 +330,43 @@ function createSectionContent(section) {
 
     const parsed = parseFloat(value);
 
-    if (/^[0-9]+$/.test(value) && !isNaN(parsed) && isFinite(parsed) && parsed >= 50 && parsed <= 1000) {
+    if (
+      /^[0-9]+$/.test(value) &&
+      !isNaN(parsed) &&
+      isFinite(parsed) &&
+      parsed >= 50 &&
+      parsed <= 1000
+    ) {
       return true;
     }
 
-    return _('Must be a number in the range of 50 - 1000');
+    return _("Must be a number in the range of 50 - 1000");
   };
 
-  o = section.option(
+  o = section.taboption(
+    "subscription",
     form.Value,
     "urltest_testing_url",
     _("URLTest Testing URL"),
-    _("The URL used to test server connectivity")
+    _("The URL used to test server connectivity"),
+  );
+  o.value(
+    "https://www.gstatic.com/generate_204",
+    "https://www.gstatic.com/generate_204 (Google)",
+  );
+  o.value(
+    "https://cp.cloudflare.com/generate_204",
+    "https://cp.cloudflare.com/generate_204 (Cloudflare)",
   );
-  o.value("https://www.gstatic.com/generate_204", "https://www.gstatic.com/generate_204 (Google)");
-  o.value("https://cp.cloudflare.com/generate_204", "https://cp.cloudflare.com/generate_204 (Cloudflare)");
   o.value("https://captive.apple.com", "https://captive.apple.com (Apple)");
-  o.value("https://connectivity-check.ubuntu.com", "https://connectivity-check.ubuntu.com (Ubuntu)")
+  o.value(
+    "https://connectivity-check.ubuntu.com",
+    "https://connectivity-check.ubuntu.com (Ubuntu)",
+  );
   o.default = "https://www.gstatic.com/generate_204";
   o.rmempty = false;
-  o.depends("proxy_config_type", "urltest");
+  o.depends({ connection_type: "proxy", proxy_config_type: "urltest" });
+  o.depends({ connection_type: "proxy", proxy_config_type: "subscription" });
 
   o.validate = function (section_id, value) {
     if (!value || value.length === 0) {
@@ -192,7 +382,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.Flag,
     "enable_udp_over_tcp",
     _("UDP over TCP"),
@@ -202,7 +393,26 @@ function createSectionContent(section) {
   o.depends("connection_type", "proxy");
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
+    form.Flag,
+    "global_proxy",
+    _("Global Proxy"),
+    _("Route all unmatched traffic through this section's outbound.") +
+      " " +
+      _(
+        "When enabled, traffic not matching any other section's lists will go through this proxy.",
+      ) +
+      " " +
+      _("Use with Exclusion sections to route specific domains directly.") +
+      " " +
+      _("Only one section can be global at a time."),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "connection",
     widgets.DeviceSelect,
     "interface",
     _("Network Interface"),
@@ -248,7 +458,8 @@ function createSectionContent(section) {
     return !isWireless;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.Flag,
     "domain_resolver_enabled",
     _("Domain Resolver"),
@@ -258,7 +469,8 @@ function createSectionContent(section) {
   o.rmempty = false;
   o.depends("connection_type", "vpn");
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.ListValue,
     "domain_resolver_dns_type",
     _("DNS Protocol Type"),
@@ -271,7 +483,8 @@ function createSectionContent(section) {
   o.rmempty = false;
   o.depends("domain_resolver_enabled", "1");
 
-  o = section.option(
+  o = section.taboption(
+    "connection",
     form.Value,
     "domain_resolver_dns_server",
     _("DNS Server"),
@@ -293,7 +506,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "community_lists",
     _("Community Lists"),
@@ -381,11 +595,18 @@ function createSectionContent(section) {
     }
   };
 
-  o = section.option(
+  // --- Custom domains group (mode selector + the matching input below) ---
+  // Three UCI keys kept (user_domain_list_type, user_domains,
+  // user_domains_text); depends() shows only the input for the chosen mode,
+  // so the trio reads as one "list-or-text" control.
+  o = section.taboption(
+    "routing",
     form.ListValue,
     "user_domain_list_type",
-    _("User Domain List Type"),
-    _("Select the list type for adding custom domains"),
+    _("Custom domains"),
+    _(
+      "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    ),
   );
   o.value("disabled", _("Disabled"));
   o.value("dynamic", _("Dynamic List"));
@@ -393,7 +614,8 @@ function createSectionContent(section) {
   o.default = "disabled";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "user_domains",
     _("User Domains"),
@@ -419,7 +641,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.TextValue,
     "user_domains_text",
     _("User Domains List"),
@@ -461,11 +684,17 @@ function createSectionContent(section) {
     return true;
   };
 
-  o = section.option(
+  // --- Custom subnets group (mode selector + the matching input below) ---
+  // Same pattern as the domains group; keeps user_subnet_list_type,
+  // user_subnets and user_subnets_text as separate UCI keys.
+  o = section.taboption(
+    "routing",
     form.ListValue,
     "user_subnet_list_type",
-    _("User Subnet List Type"),
-    _("Select the list type for adding custom subnets"),
+    _("Custom subnets"),
+    _(
+      "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip",
+    ),
   );
   o.value("disabled", _("Disabled"));
   o.value("dynamic", _("Dynamic List"));
@@ -473,7 +702,8 @@ function createSectionContent(section) {
   o.default = "disabled";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "user_subnets",
     _("User Subnets"),
@@ -499,7 +729,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.TextValue,
     "user_subnets_text",
     _("User Subnets List"),
@@ -540,7 +771,8 @@ function createSectionContent(section) {
     return true;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "local_domain_lists",
     _("Local Domain Lists"),
@@ -563,7 +795,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "local_subnet_lists",
     _("Local Subnet Lists"),
@@ -586,7 +819,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "remote_domain_lists",
     _("Remote Domain Lists"),
@@ -609,7 +843,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "remote_subnet_lists",
     _("Remote Subnet Lists"),
@@ -632,7 +867,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "routing",
     form.DynamicList,
     "fully_routed_ips",
     _("Fully Routed IPs"),
@@ -659,7 +895,8 @@ function createSectionContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
     form.Flag,
     "mixed_proxy_enabled",
     _("Enable Mixed Proxy"),
@@ -672,7 +909,8 @@ function createSectionContent(section) {
   o.depends("connection_type", "proxy");
   o.depends("connection_type", "vpn");
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
     form.Value,
     "mixed_proxy_port",
     _("Mixed Proxy Port"),
@@ -681,10 +919,14 @@ function createSectionContent(section) {
         "Make sure the selected port is not used by another service",
     ),
   );
-  o.rmempty = false;
+  o.default = "2080";
+  o.placeholder = "2080";
+  o.datatype = "port";
+  o.rmempty = true;
   o.depends("mixed_proxy_enabled", "1");
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
     form.Flag,
     "resolve_real_ip_for_routing",
     _("Resolve real IP for routing"),
diff --git a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js
similarity index 67%
rename from luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js
rename to luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js
index efe3c29f..0c40f085 100644
--- a/luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js
+++ b/luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js
@@ -3,10 +3,43 @@
 "require uci";
 "require baseclass";
 "require tools.widgets as widgets";
-"require view.podkop.main as main";
+"require view.netshift.main as main";
 
 function createSettingsContent(section) {
-  let o = section.option(
+  // Group the 27 settings options into 5 native CBI option-group tabs.
+  // HARD RULE: once a section has tab(), every option MUST be added via
+  // taboption() — any leftover section.option(...) renders nothing.
+  // depends() works across tabs; a tab whose options are all depends-hidden
+  // auto-hides from the strip.
+  section.tab(
+    "dns",
+    _("DNS"),
+    _("Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"),
+  );
+  section.tab(
+    "network",
+    _("Network"),
+    _("Source and output interfaces, and Bad WAN interface monitoring"),
+  );
+  section.tab(
+    "lists",
+    _("Lists & Updates"),
+    _("List update schedule, download routing, and routing exclusions"),
+  );
+  section.tab(
+    "yacd",
+    _("Dashboard"),
+    _("YACD web dashboard access and remote-access protection"),
+  );
+  section.tab(
+    "advanced",
+    _("Advanced"),
+    _("Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."),
+  );
+
+  // --- DNS tab ---
+  let o = section.taboption(
+    "dns",
     form.ListValue,
     "dns_type",
     _("DNS Protocol Type"),
@@ -18,7 +51,8 @@ function createSettingsContent(section) {
   o.default = "udp";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "dns",
     form.Value,
     "dns_server",
     _("DNS Server"),
@@ -39,7 +73,8 @@ function createSettingsContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "dns",
     form.Value,
     "bootstrap_dns_server",
     _("Bootstrap DNS server"),
@@ -62,7 +97,55 @@ function createSettingsContent(section) {
     return validation.message;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "dns",
+    form.Flag,
+    "dns_via_outbound",
+    _("Route main DNS through proxy/VPN"),
+    _(
+      "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct.",
+    ),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "dns",
+    form.ListValue,
+    "dns_outbound_section",
+    _("DNS outbound section"),
+    _(
+      "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound.",
+    ),
+  );
+  o.rmempty = true;
+  o.depends("dns_via_outbound", "1");
+  o.cfgvalue = function (section_id) {
+    return uci.get("netshift", section_id, "dns_outbound_section");
+  };
+  o.load = function () {
+    const sections = this.map?.data?.state?.values?.netshift ?? {};
+
+    this.keylist = [];
+    this.vallist = [];
+
+    for (const secName in sections) {
+      const sec = sections[secName];
+      if (
+        sec[".type"] === "section" &&
+        sec["connection_type"] !== "block" &&
+        sec["connection_type"] !== "exclusion"
+      ) {
+        this.keylist.push(secName);
+        this.vallist.push(secName);
+      }
+    }
+
+    return Promise.resolve();
+  };
+
+  o = section.taboption(
+    "dns",
     form.Value,
     "dns_rewrite_ttl",
     _("DNS Rewrite TTL"),
@@ -83,7 +166,9 @@ function createSettingsContent(section) {
     return true;
   };
 
-  o = section.option(
+  // --- Network tab ---
+  o = section.taboption(
+    "network",
     widgets.DeviceSelect,
     "source_network_interfaces",
     _("Source Network Interface"),
@@ -120,7 +205,8 @@ function createSettingsContent(section) {
     return !isWireless;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "network",
     form.Flag,
     "enable_output_network_interface",
     _("Enable Output Network Interface"),
@@ -129,7 +215,8 @@ function createSettingsContent(section) {
   o.default = "0";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "network",
     widgets.DeviceSelect,
     "output_network_interface",
     _("Output Network Interface"),
@@ -148,9 +235,7 @@ function createSettingsContent(section) {
     }
 
     // Reject lan*
-    if (
-        value.startsWith("lan")
-    ) {
+    if (value.startsWith("lan")) {
       return false;
     }
 
@@ -183,7 +268,8 @@ function createSettingsContent(section) {
     return !isWireless;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "network",
     form.Flag,
     "enable_badwan_interface_monitoring",
     _("Interface Monitoring"),
@@ -192,7 +278,8 @@ function createSettingsContent(section) {
   o.default = "0";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "network",
     widgets.NetworkSelect,
     "badwan_monitored_interfaces",
     _("Monitored Interfaces"),
@@ -215,11 +302,12 @@ function createSettingsContent(section) {
     return true;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "network",
     form.Value,
     "badwan_reload_delay",
     _("Interface Monitoring Delay"),
-    _("Delay in milliseconds before reloading podkop after interface UP"),
+    _("Delay in milliseconds before reloading NetShift after interface UP"),
   );
   o.depends("enable_badwan_interface_monitoring", "1");
   o.default = "2000";
@@ -231,46 +319,9 @@ function createSettingsContent(section) {
     return true;
   };
 
-  o = section.option(
-    form.Flag,
-    "enable_yacd",
-    _("Enable YACD"),
-    `<a href="${main.getClashUIUrl()}" target="_blank">${main.getClashUIUrl()}</a>`,
-  );
-  o.default = "0";
-  o.rmempty = false;
-
-  o = section.option(
-    form.Flag,
-    "enable_yacd_wan_access",
-    _("Enable YACD WAN Access"),
-    _("Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."),
-  );
-  o.depends("enable_yacd", "1");
-  o.default = "0";
-  o.rmempty = false;
-
-  o = section.option(
-    form.Value,
-    "yacd_secret_key",
-    _("YACD Secret Key"),
-    _("Secret key for authenticating remote access to YACD when WAN access is enabled."),
-  );
-  o.depends("enable_yacd_wan_access", "1");
-  o.rmempty = false;
-
-  o = section.option(
-    form.Flag,
-    "disable_quic",
-    _("Disable QUIC"),
-    _(
-      "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
-    ),
-  );
-  o.default = "0";
-  o.rmempty = false;
-
-  o = section.option(
+  // --- Lists & Updates tab ---
+  o = section.taboption(
+    "lists",
     form.ListValue,
     "update_interval",
     _("List Update Frequency"),
@@ -282,7 +333,8 @@ function createSettingsContent(section) {
   o.default = "1d";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "lists",
     form.Flag,
     "download_lists_via_proxy",
     _("Download Lists via Proxy/VPN"),
@@ -291,7 +343,8 @@ function createSettingsContent(section) {
   o.default = "0";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "lists",
     form.ListValue,
     "download_lists_via_proxy_section",
     _("Download Lists via specific proxy section"),
@@ -301,17 +354,21 @@ function createSettingsContent(section) {
   o.rmempty = false;
   o.depends("download_lists_via_proxy", "1");
   o.cfgvalue = function (section_id) {
-    return uci.get("podkop", section_id, "download_lists_via_proxy_section");
+    return uci.get("netshift", section_id, "download_lists_via_proxy_section");
   };
   o.load = function () {
-    const sections = this.map?.data?.state?.values?.podkop ?? {};
+    const sections = this.map?.data?.state?.values?.netshift ?? {};
 
     this.keylist = [];
     this.vallist = [];
 
     for (const secName in sections) {
       const sec = sections[secName];
-      if (sec[".type"] === "section" && sec['connection_type'] !== 'block' && sec['connection_type'] !== 'exclusion') {
+      if (
+        sec[".type"] === "section" &&
+        sec["connection_type"] !== "block" &&
+        sec["connection_type"] !== "exclusion"
+      ) {
         this.keylist.push(secName);
         this.vallist.push(secName);
       }
@@ -320,16 +377,127 @@ function createSettingsContent(section) {
     return Promise.resolve();
   };
 
-  o = section.option(
+  o = section.taboption(
+    "lists",
+    form.DynamicList,
+    "routing_excluded_ips",
+    _("Routing Excluded IPs"),
+    _("Specify a local IP address to be excluded from routing"),
+  );
+  o.placeholder = "IP";
+  o.rmempty = true;
+  o.validate = function (section_id, value) {
+    // Optional
+    if (!value || value.length === 0) {
+      return true;
+    }
+
+    const validation = main.validateIP(value);
+
+    if (validation.valid) {
+      return true;
+    }
+
+    return validation.message;
+  };
+
+  // --- Dashboard / YACD tab ---
+  o = section.taboption(
+    "yacd",
+    form.Flag,
+    "enable_yacd",
+    _("Enable YACD"),
+    `<a href="${main.getClashUIUrl()}" target="_blank">${main.getClashUIUrl()}</a>`,
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "yacd",
+    form.Flag,
+    "enable_yacd_wan_access",
+    _("Enable YACD WAN Access"),
+    _(
+      "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall.",
+    ),
+  );
+  o.depends("enable_yacd", "1");
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "yacd",
+    form.Value,
+    "yacd_secret_key",
+    _("YACD Secret Key"),
+    _(
+      "Secret key for authenticating remote access to YACD when WAN access is enabled.",
+    ),
+  );
+  o.depends("enable_yacd_wan_access", "1");
+  o.rmempty = false;
+
+  // --- Advanced tab ---
+  o = section.taboption(
+    "advanced",
+    form.Flag,
+    "disable_quic",
+    _("Disable QUIC"),
+    _(
+      "Disable the QUIC protocol to improve compatibility or fix issues with video streaming",
+    ),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "advanced",
     form.Flag,
     "dont_touch_dhcp",
     _("Dont Touch My DHCP!"),
-    _("Podkop will not modify your DHCP configuration"),
+    _("NetShift will not modify your DHCP configuration"),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "advanced",
+    form.Flag,
+    "exclude_ntp",
+    _("Exclude NTP"),
+    _(
+      "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
+    ),
   );
   o.default = "0";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
+    form.Flag,
+    "block_doh",
+    _("Block DoH Servers"),
+    _(
+      "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering.",
+    ),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "advanced",
+    form.Flag,
+    "enable_ipv6",
+    _("Enable IPv6 Support"),
+    _("Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support.") +
+      " " +
+      _("Use this only when the router has working IPv6 connectivity."),
+  );
+  o.default = "0";
+  o.rmempty = false;
+
+  o = section.taboption(
+    "advanced",
     form.ListValue,
     "config_path",
     _("Config File Path"),
@@ -342,7 +510,8 @@ function createSettingsContent(section) {
   o.default = "/etc/sing-box/config.json";
   o.rmempty = false;
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
     form.Value,
     "cache_path",
     _("Cache File Path"),
@@ -378,13 +547,12 @@ function createSettingsContent(section) {
     return true;
   };
 
-  o = section.option(
+  o = section.taboption(
+    "advanced",
     form.ListValue,
     "log_level",
     _("Log Level"),
-    _(
-      "Select the log level for sing-box",
-    ),
+    _("Select the log level for sing-box"),
   );
   o.value("trace", "Trace");
   o.value("debug", "Debug");
@@ -395,40 +563,6 @@ function createSettingsContent(section) {
   o.value("panic", "Panic");
   o.default = "warn";
   o.rmempty = false;
-
-  o = section.option(
-    form.Flag,
-    "exclude_ntp",
-    _("Exclude NTP"),
-    _(
-      "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN",
-    ),
-  );
-  o.default = "0";
-  o.rmempty = false;
-
-  o = section.option(
-    form.DynamicList,
-    "routing_excluded_ips",
-    _("Routing Excluded IPs"),
-    _("Specify a local IP address to be excluded from routing"),
-  );
-  o.placeholder = "IP";
-  o.rmempty = true;
-  o.validate = function (section_id, value) {
-    // Optional
-    if (!value || value.length === 0) {
-      return true;
-    }
-
-    const validation = main.validateIPV4(value);
-
-    if (validation.valid) {
-      return true;
-    }
-
-    return validation.message;
-  };
 }
 
 const EntryPoint = {
diff --git a/luci-app-podkop/msgmerge.sh b/luci-app-netshift/msgmerge.sh
similarity index 89%
rename from luci-app-podkop/msgmerge.sh
rename to luci-app-netshift/msgmerge.sh
index 06e57061..a4b4ddb8 100644
--- a/luci-app-podkop/msgmerge.sh
+++ b/luci-app-netshift/msgmerge.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 PODIR="po"
-POTFILE="$PODIR/templates/podkop.pot"
+POTFILE="$PODIR/templates/netshift.pot"
 WIDTH=120
 
 if [ $# -ne 1 ]; then
@@ -11,7 +11,7 @@ if [ $# -ne 1 ]; then
 fi
 
 LANG="$1"
-POFILE="$PODIR/$LANG/podkop.po"
+POFILE="$PODIR/$LANG/netshift.po"
 
 if [ ! -f "$POTFILE" ]; then
     echo "Template $POTFILE not found. Run xgettext first."
diff --git a/fe-app-podkop/locales/podkop.ru.po b/luci-app-netshift/po/ru/netshift.po
similarity index 63%
rename from fe-app-podkop/locales/podkop.ru.po
rename to luci-app-netshift/po/ru/netshift.po
index 77a33a4f..6c21c32c 100644
--- a/fe-app-podkop/locales/podkop.ru.po
+++ b/luci-app-netshift/po/ru/netshift.po
@@ -1,15 +1,15 @@
-# RU translations for PODKOP package.
-# Copyright (C) 2026 THE PODKOP'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PODKOP package.
-# divocatt, 2026.
+# RU translations for NETSHIFT package.
+# Copyright (C) 2026 THE NETSHIFT'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the NETSHIFT package.
+# yandexru45, 2026.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: PODKOP\n"
+"Project-Id-Version: NETSHIFT\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-29 16:40+0300\n"
-"PO-Revision-Date: 2026-05-29 16:40+0300\n"
-"Last-Translator: divocatt\n"
+"POT-Creation-Date: 2026-06-12 08:52+0300\n"
+"PO-Revision-Date: 2026-06-12 08:52+0300\n"
+"Last-Translator: yandexru45\n"
 "Language-Team: none\n"
 "Language: ru\n"
 "MIME-Version: 1.0\n"
@@ -32,9 +32,24 @@ msgstr "✘ Остановлен"
 msgid "Active Connections"
 msgstr "Активные соединения"
 
+msgid "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged."
+msgstr "Добавьте один или несколько URL подписок для получения конфигураций прокси. Все источники загружаются и объединяются."
+
+msgid "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои домены: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
+msgid "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои подсети или IP: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
 msgid "Additional marking rules found"
 msgstr "Найдены дополнительные правила маркировки"
 
+msgid "Advanced"
+msgstr "Дополнительно"
+
+msgid "Allow insecure TLS for subscription fetch"
+msgstr "Разрешить небезопасный TLS при загрузке подписки"
+
 msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
 msgstr "Обеспечивает доступ к YACD из WAN. Убедитесь, что в брандмауэре открыт соответствующий порт."
 
@@ -47,9 +62,18 @@ msgstr "Необходимо указать хотя бы один действ
 msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
 msgstr "Необходимо указать хотя бы одну действительную подсеть или IP. Только комментарии недопустимы."
 
+msgid "Auto"
+msgstr "Авто"
+
 msgid "Available actions"
 msgstr "Доступные действия"
 
+msgid "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering."
+msgstr "Блокировать прямые подключения к известным публичным DoH-серверам (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex), чтобы приложения не могли обойти DNS-фильтрацию роутера."
+
+msgid "Block DoH Servers"
+msgstr "Блокировать DoH-серверы"
+
 msgid "Bootsrap DNS"
 msgstr "Bootstrap DNS"
 
@@ -62,6 +86,12 @@ msgstr "Браузер не использует FakeIP"
 msgid "Browser is using FakeIP correctly"
 msgstr "Браузер использует FakeIP"
 
+msgid "By country flag"
+msgstr "По флагу страны"
+
+msgid "By name prefix"
+msgstr "По префиксу имени"
+
 msgid "Cache File Path"
 msgstr "Путь к файлу кэша"
 
@@ -71,6 +101,9 @@ msgstr "Путь к файлу кэша не может быть пустым"
 msgid "Cannot receive checks result"
 msgstr "Не удалось получить результаты проверки"
 
+msgid "Check update"
+msgstr "Проверить обновление"
+
 msgid "Checking, please wait"
 msgstr "Проверяем, пожалуйста подождите"
 
@@ -86,45 +119,75 @@ msgstr "Проверки пройдены"
 msgid "CIDR must be between 0 and 32"
 msgstr "CIDR должен быть между 0 и 32"
 
+msgid "Clear subscription cache"
+msgstr "Очистить кеш подписок"
+
+msgid "Clearing subscription cache and re-downloading… this may take a minute"
+msgstr "Очистка кеша подписок и повторная загрузка… это может занять минуту"
+
 msgid "Close"
 msgstr "Закрыть"
 
 msgid "Community Lists"
 msgstr "Списки сообщества"
 
+msgid "Component Manager"
+msgstr "Менеджер компонентов"
+
 msgid "Config File Path"
 msgstr "Путь к файлу конфигурации"
 
-msgid "Configuration for Podkop service"
-msgstr "Настройки сервиса Podkop"
+msgid "Configuration for NetShift service"
+msgstr "Конфигурация службы NetShift"
 
 msgid "Configuration Type"
 msgstr "Тип конфигурации"
 
+msgid "Connection"
+msgstr "Подключение"
+
 msgid "Connection Type"
 msgstr "Тип подключения"
 
+msgid "Connection type, transport and DNS resolver for this section"
+msgstr "Тип подключения, транспорт и DNS-резолвер для этой секции"
+
 msgid "Connection URL"
 msgstr "URL подключения"
 
 msgid "Copy"
 msgstr "Копировать"
 
+msgid "Core switch failed"
+msgstr "Не удалось переключить ядро"
+
+msgid "Core switch timed out"
+msgstr "Истекло время ожидания переключения ядра"
+
 msgid "Currently unavailable"
 msgstr "Временно недоступно"
 
+msgid "Custom domains"
+msgstr "Свои домены"
+
+msgid "Custom subnets"
+msgstr "Свои подсети"
+
 msgid "Dashboard"
 msgstr "Дашборд"
 
 msgid "Dashboard currently unavailable"
 msgstr "Дашборд сейчас недоступен"
 
-msgid "Delay in milliseconds before reloading podkop after interface UP"
-msgstr "Задержка в миллисекундах перед перезагрузкой podkop после поднятия интерфейса"
+msgid "Delay in milliseconds before reloading NetShift after interface UP"
+msgstr "Задержка в миллисекундах перед перезагрузкой NetShift после поднятия интерфейса"
 
 msgid "Delay value cannot be empty"
 msgstr "Значение задержки не может быть пустым"
 
+msgid "Dev"
+msgstr "Dev"
+
 msgid "DHCP has DNS server"
 msgstr "DHCP содержит DNS сервер"
 
@@ -143,9 +206,18 @@ msgstr "Отключить QUIC протокол для улучшения со
 msgid "Disabled"
 msgstr "Отключено"
 
+msgid "Disables TLS certificate verification when downloading the subscription."
+msgstr "Отключает проверку TLS-сертификата при загрузке подписки."
+
+msgid "DNS"
+msgstr "DNS"
+
 msgid "DNS on router"
 msgstr "DNS на роутере"
 
+msgid "DNS outbound section"
+msgstr "Секция outbound для DNS"
+
 msgid "DNS over HTTPS (DoH)"
 msgstr "DNS через HTTPS (DoH)"
 
@@ -167,6 +239,9 @@ msgstr "Адрес DNS-сервера не может быть пустым"
 msgid "Do not panic, everything can be fixed, just..."
 msgstr "Не паникуйте, всё можно исправить, просто..."
 
+msgid "Domain and subnet lists that decide which traffic uses this section"
+msgstr "Списки доменов и подсетей, определяющие, какой трафик идёт через эту секцию"
+
 msgid "Domain Resolver"
 msgstr "Резолвер доменов"
 
@@ -188,6 +263,9 @@ msgstr "Скачивать списки через выбранную секци
 msgid "Downloading all lists via specific Proxy/VPN"
 msgstr "Загрузка всех списков через указанный прокси/VPN"
 
+msgid "Drop subscription servers whose name contains any of these keywords (case-insensitive)."
+msgstr "Исключать серверы подписки, имя которых содержит любое из этих ключевых слов (без учёта регистра)."
+
 msgid "Dynamic List"
 msgstr "Динамический список"
 
@@ -200,6 +278,12 @@ msgstr "Включить встроенный DNS-резолвер для дом
 msgid "Enable DNS resolve to get real IP when routing"
 msgstr "Разрешать домены в реальные IP-адреса перед маршрутизацией в outbound"
 
+msgid "Enable IPv6 Support"
+msgstr "Включить поддержку IPv6"
+
+msgid "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support."
+msgstr "Включить маршрутизацию TProxy по IPv6, входящий DNS по IPv6 и поддержку FakeIP для IPv6."
+
 msgid "Enable Mixed Proxy"
 msgstr "Включить смешанный прокси"
 
@@ -230,21 +314,45 @@ msgstr "Введите подсети в нотации CIDR (например,
 msgid "Every 1 minute"
 msgstr "Каждую минуту"
 
+msgid "Every 12 hours"
+msgstr "Каждые 12 часов"
+
+msgid "Every 3 hours"
+msgstr "Каждые 3 часа"
+
 msgid "Every 3 minutes"
 msgstr "Каждые 3 минуты"
 
+msgid "Every 30 minutes"
+msgstr "Каждые 30 минут"
+
 msgid "Every 30 seconds"
 msgstr "Каждые 30 секунд"
 
 msgid "Every 5 minutes"
 msgstr "Каждые 5 минут"
 
+msgid "Every 6 hours"
+msgstr "Каждые 6 часов"
+
+msgid "Every day"
+msgstr "Каждый день"
+
+msgid "Every hour"
+msgstr "Каждый час"
+
 msgid "Exclude NTP"
 msgstr "Исключить NTP"
 
 msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
 msgstr "Исключите трафик протокола NTP из туннеля, чтобы предотвратить его маршрутизацию через прокси-сервер или VPN."
 
+msgid "Exclude servers by keyword"
+msgstr "Исключать серверы по ключевому слову"
+
+msgid "Failed to clear subscription cache"
+msgstr "Не удалось очистить кеш подписок"
+
 msgid "Failed to copy!"
 msgstr "Не удалось скопировать!"
 
@@ -263,9 +371,27 @@ msgstr "Получить глобальную проверку"
 msgid "Global check"
 msgstr "Глобальная проверка"
 
+msgid "Global Proxy"
+msgstr "Глобальный прокси"
+
+msgid "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters."
+msgstr "Группировать прокси из подписки в группы URLTest. «По флагу страны» использует эмодзи флага в начале каждого имени; «По префиксу имени» группирует по первым N символам."
+
+msgid "How often to automatically update the subscription"
+msgstr "Как часто автоматически обновлять подписку"
+
 msgid "HTTP error"
 msgstr "Ошибка HTTP"
 
+msgid "Include servers by keyword"
+msgstr "Включать серверы по ключевому слову"
+
+msgid "Install %s"
+msgstr "Установить %s"
+
+msgid "Installed version is newer than release"
+msgstr "Установленная версия новее релиза"
+
 msgid "Interface Monitoring"
 msgstr "Мониторинг интерфейса"
 
@@ -275,14 +401,14 @@ msgstr "Задержка при мониторинге интерфейсов"
 msgid "Interface monitoring for Bad WAN"
 msgstr "Мониторинг интерфейса для Bad WAN"
 
-msgid "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
-msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, dns.example.com или dns.example.com/nicedns для DoH"
+msgid "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
+msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, [::1], dns.example.com или dns.example.com/dns-query для DoH"
 
 msgid "Invalid domain address"
 msgstr "Неверный домен"
 
-msgid "Invalid format. Use X.X.X.X or X.X.X.X/Y"
-msgstr "Неверный формат. Используйте X.X.X.X или X.X.X.X/Y"
+msgid "Invalid format. Use X.X.X.X/Y or IPv6/Y"
+msgstr "Неверный формат. Используйте X.X.X.X/Y или IPv6/Y"
 
 msgid "Invalid HY2 URL: insecure must be 0 or 1"
 msgstr "Неверный URL Hysteria2: параметр insecure должен быть 0 или 1"
@@ -326,6 +452,9 @@ msgstr "Неверный URL Hysteria2: неподдерживаемый тип
 msgid "Invalid IP address"
 msgstr "Неверный IP-адрес"
 
+msgid "Invalid IPv6 address"
+msgstr "Неверный IPv6-адрес"
+
 msgid "Invalid JSON format"
 msgstr "Неверный формат JSON"
 
@@ -404,18 +533,54 @@ msgstr "Неверный формат URL"
 msgid "Invalid VLESS URL: parsing failed"
 msgstr "Неверный URL VLESS: ошибка разбора"
 
+msgid "Invalid VMess URL: invalid port"
+msgstr "Неверный URL VMess: недопустимый порт"
+
+msgid "Invalid VMess URL: malformed base64"
+msgstr "Неверный URL VMess: некорректный base64"
+
+msgid "Invalid VMess URL: malformed JSON"
+msgstr "Неверный URL VMess: некорректный JSON"
+
+msgid "Invalid VMess URL: missing address"
+msgstr "Неверный URL VMess: отсутствует адрес"
+
+msgid "Invalid VMess URL: missing id"
+msgstr "Неверный URL VMess: отсутствует id"
+
+msgid "Invalid VMess URL: must not contain spaces"
+msgstr "Неверный URL VMess: не должен содержать пробелы"
+
+msgid "Invalid VMess URL: must start with vmess://"
+msgstr "Неверный URL VMess: должен начинаться с vmess://"
+
 msgid "IP address 0.0.0.0 is not allowed"
 msgstr "IP-адрес 0.0.0.0 не допускается"
 
+msgid "IPv6 CIDR must be between 0 and 128"
+msgstr "IPv6 CIDR должен быть от 0 до 128"
+
 msgid "Issues detected"
 msgstr "Обнаружены проблемы"
 
+msgid "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all."
+msgstr "Оставлять только серверы подписки, имя которых содержит хотя бы одно из этих ключевых слов (без учёта регистра). Оставьте пустым, чтобы оставить все."
+
 msgid "Latest"
 msgstr "Последняя"
 
+msgid "Latest version is installed"
+msgstr "Установлена последняя версия"
+
 msgid "List Update Frequency"
 msgstr "Частота обновления списков"
 
+msgid "List update schedule, download routing, and routing exclusions"
+msgstr "Расписание обновления списков, маршрутизация загрузок и исключения из маршрутизации"
+
+msgid "Lists & Updates"
+msgstr "Списки и обновления"
+
 msgid "Local Domain Lists"
 msgstr "Локальные списки доменов"
 
@@ -428,9 +593,15 @@ msgstr "Уровень логов"
 msgid "Main DNS"
 msgstr "Основной DNS"
 
+msgid "Main DNS via outbound"
+msgstr "Основной DNS через outbound"
+
 msgid "Memory Usage"
 msgstr "Использование памяти"
 
+msgid "Mixed proxy and DNS resolution tuning"
+msgstr "Настройка смешанного прокси и разрешения DNS"
+
 msgid "Mixed Proxy Port"
 msgstr "Порт смешанного прокси"
 
@@ -440,6 +611,21 @@ msgstr "Наблюдаемые интерфейсы"
 msgid "Must be a number in the range of 50 - 1000"
 msgstr "Должно быть числом от 50 до 1000"
 
+msgid "NetShift"
+msgstr "NetShift"
+
+msgid "NetShift Settings"
+msgstr "Настройки NetShift"
+
+msgid "NetShift updated, version:"
+msgstr "NetShift обновлён, версия:"
+
+msgid "NetShift will not modify your DHCP configuration"
+msgstr "NetShift не будет изменять вашу конфигурацию DHCP"
+
+msgid "Network"
+msgstr "Сеть"
+
 msgid "Network Interface"
 msgstr "Сетевой интерфейс"
 
@@ -449,12 +635,24 @@ msgstr "Другие правила маркировки не найдены"
 msgid "Not implement yet"
 msgstr "Ещё не реализовано"
 
+msgid "Not installed"
+msgstr "Не установлено"
+
 msgid "Not responding"
 msgstr "Не отвечает"
 
 msgid "Not running"
 msgstr "Не запущено"
 
+msgid "Number of leading characters of each proxy name to group by."
+msgstr "Количество начальных символов имени каждого прокси для группировки."
+
+msgid "Off"
+msgstr "Выключено"
+
+msgid "Only one section can be global at a time."
+msgstr "Только одна секция может быть глобальной одновременно."
+
 msgid "Operation timed out"
 msgstr "Время ожидания истекло"
 
@@ -485,14 +683,11 @@ msgstr "Путь должен заканчиваться на cache.db"
 msgid "Pending"
 msgstr "Ожидает запуска"
 
-msgid "Podkop"
-msgstr "Podkop"
-
-msgid "Podkop Settings"
-msgstr "Настройки podkop"
+msgid "Prefix length"
+msgstr "Длина префикса"
 
-msgid "Podkop will not modify your DHCP configuration"
-msgstr "Podkop не будет изменять вашу конфигурацию DHCP."
+msgid "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."
+msgstr "Переключатели протоколов, пути к файлам и журналирование. Включайте блокировку DoH только после переключения вышестоящего DNS на UDP или DoT."
 
 msgid "Proxy Configuration URL"
 msgstr "URL конфигурации прокси"
@@ -515,8 +710,14 @@ msgstr "Внешние списки подсетей"
 msgid "Resolve real IP for routing"
 msgstr "Разрешение реальных IP-адресов"
 
-msgid "Restart podkop"
-msgstr "Перезапустить Podkop"
+msgid "Restart NetShift"
+msgstr "Перезапустить NetShift"
+
+msgid "Route all unmatched traffic through this section's outbound."
+msgstr "Направлять весь несовпавший трафик через outbound этой секции."
+
+msgid "Route main DNS through proxy/VPN"
+msgstr "Основной DNS через прокси/VPN"
 
 msgid "Router DNS is not routed through sing-box"
 msgstr "DNS роутера не проходит через sing-box"
@@ -524,6 +725,9 @@ msgstr "DNS роутера не проходит через sing-box"
 msgid "Router DNS is routed through sing-box"
 msgstr "DNS роутера проходит через sing-box"
 
+msgid "Routing"
+msgstr "Маршрутизация"
+
 msgid "Routing Excluded IPs"
 msgstr "Исключённые из маршрутизации IP-адреса"
 
@@ -533,9 +737,6 @@ msgstr "Счётчики правил mangle"
 msgid "Rules mangle exist"
 msgstr "Правила mangle существуют"
 
-msgid "Rules mangle output counters"
-msgstr "Счётчики правил mangle output"
-
 msgid "Rules mangle output exist"
 msgstr "Правила mangle output существуют"
 
@@ -587,12 +788,6 @@ msgstr "Выберите путь к файлу конфигурации sing-bo
 msgid "Select the DNS protocol type for the domain resolver"
 msgstr "Выберите тип протокола DNS для резолвера доменов"
 
-msgid "Select the list type for adding custom domains"
-msgstr "Выберите тип списка для добавления пользовательских доменов"
-
-msgid "Select the list type for adding custom subnets"
-msgstr "Выберите тип списка для добавления пользовательских подсетей"
-
 msgid "Select the log level for sing-box"
 msgstr "Выберите уровень логов для sing-box"
 
@@ -611,6 +806,12 @@ msgstr "Selector"
 msgid "Selector Proxy Links"
 msgstr "Ссылки прокси для Selector"
 
+msgid "Self-update failed"
+msgstr "Не удалось обновить"
+
+msgid "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct."
+msgstr "Отправлять запросы к основному DNS через outbound прокси/VPN вместо прямого подключения. Bootstrap DNS всегда остаётся прямым."
+
 msgid "Services info"
 msgstr "Информация о сервисах"
 
@@ -626,6 +827,9 @@ msgstr "Sing-box"
 msgid "Sing-box autostart disabled"
 msgstr "Автостарт sing-box отключен"
 
+msgid "Sing-box core changed, version:"
+msgstr "Ядро sing-box изменено, версия:"
+
 msgid "Sing-box installed"
 msgstr "Sing-box установлен"
 
@@ -641,6 +845,9 @@ msgstr "Сервис sing-box существует"
 msgid "Sing-box version is compatible (newer than 1.12.4)"
 msgstr "Версия Sing-box совместима (новее 1.12.4)"
 
+msgid "Source and output interfaces, and Bad WAN interface monitoring"
+msgstr "Входящий и исходящий интерфейсы, а также мониторинг интерфейсов Bad WAN"
+
 msgid "Source Network Interface"
 msgstr "Сетевой интерфейс источника"
 
@@ -659,15 +866,45 @@ msgstr "Укажите URL-адреса для загрузки и исполь
 msgid "Specify the path to the list file located on the router filesystem"
 msgstr "Укажите путь к файлу списка, расположенному в файловой системе маршрутизатора."
 
-msgid "Start podkop"
-msgstr "Запустить podkop"
+msgid "Start NetShift"
+msgstr "Запустить NetShift"
+
+msgid "Stop NetShift"
+msgstr "Остановить NetShift"
 
-msgid "Stop podkop"
-msgstr "Остановить podkop"
+msgid "Subscription"
+msgstr "Подписка"
+
+msgid "Subscription cache cleared and re-downloaded"
+msgstr "Кеш подписок очищен и загружен заново"
+
+msgid "Subscription feeds, server filters and URLTest tuning"
+msgstr "Источники подписок, фильтры серверов и настройка URLTest"
+
+msgid "Subscription format"
+msgstr "Формат подписки"
+
+msgid "Subscription grouping"
+msgstr "Группировка подписки"
+
+msgid "Subscription Update Interval"
+msgstr "Интервал обновления подписки"
+
+msgid "Subscription URLs"
+msgstr "URL подписок"
 
 msgid "Successfully copied!"
 msgstr "Успешно скопировано!"
 
+msgid "Switch to extended"
+msgstr "Переключить на extended"
+
+msgid "Switch to stable"
+msgstr "Переключить на stable"
+
+msgid "Switching sing-box core, this may take a few minutes…"
+msgstr "Переключение ядра sing-box, это может занять несколько минут…"
+
 msgid "System info"
 msgstr "Системная информация"
 
@@ -695,6 +932,9 @@ msgstr "Максимально допустимая разница во врем
 msgid "The URL used to test server connectivity"
 msgstr "URL-адрес, используемый для проверки подключения к серверу"
 
+msgid "This is a security trade-off: an attacker could intercept the fetch."
+msgstr "Это компромисс в безопасности: злоумышленник может перехватить загрузку."
+
 msgid "Time in seconds for DNS record caching (default: 60)"
 msgstr "Время в секундах для кэширования DNS записей (по умолчанию: 60)"
 
@@ -725,11 +965,26 @@ msgstr "неизвестно"
 msgid "Unknown error"
 msgstr "Неизвестная ошибка"
 
+msgid "Update"
+msgstr "Обновить"
+
+msgid "Update is available"
+msgstr "Доступно обновление"
+
+msgid "Update NetShift"
+msgstr "Обновить NetShift"
+
+msgid "Updating NetShift, this may take a few minutes; the page will reload…"
+msgstr "Обновление NetShift, это может занять несколько минут; страница перезагрузится…"
+
 msgid "Uplink"
 msgstr "Исходящий"
 
-msgid "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
-msgstr "URL должен начинаться с vless://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
+msgid "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"
+msgstr "Вышестоящий и начальный (bootstrap) DNS-резолверы и опциональный DNS через прокси"
+
+msgid "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+msgstr "URL должен начинаться с vless://, vmess://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
 
 msgid "URL must use one of the following protocols:"
 msgstr "URL должен использовать один из следующих протоколов:"
@@ -749,8 +1004,14 @@ msgstr "URLTest ссылка для проверки"
 msgid "URLTest Tolerance"
 msgstr "URLTest допустимое отклонение"
 
-msgid "User Domain List Type"
-msgstr "Тип пользовательского списка доменов"
+msgid "Use only for IP-host panels that serve an invalid or self-signed certificate."
+msgstr "Используйте только для панелей с IP-адресом, у которых недействительный или самоподписанный сертификат."
+
+msgid "Use this only when the router has working IPv6 connectivity."
+msgstr "Используйте это только если на роутере есть рабочее подключение по IPv6."
+
+msgid "Use with Exclusion sections to route specific domains directly."
+msgstr "Используйте вместе с секциями исключений для прямой маршрутизации определённых доменов."
 
 msgid "User Domains"
 msgstr "Пользовательские домены"
@@ -758,9 +1019,6 @@ msgstr "Пользовательские домены"
 msgid "User Domains List"
 msgstr "Список пользовательских доменов"
 
-msgid "User Subnet List Type"
-msgstr "Тип пользовательского списка подсетей"
-
 msgid "User Subnets"
 msgstr "Пользовательские подсети"
 
@@ -773,14 +1031,17 @@ msgstr "Валидно"
 msgid "Validation errors:"
 msgstr "Ошибки валидации:"
 
+msgid "Version"
+msgstr "Версия"
+
 msgid "View logs"
 msgstr "Посмотреть логи"
 
 msgid "Visit Wiki"
 msgstr "Перейти в wiki"
 
-msgid "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
-msgstr ""
+msgid "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
+msgstr "ссылки vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2://"
 
 msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
 msgstr "Предупреждение: %s нельзя использовать вместе с %s. Предыдущие варианты были удалены."
@@ -788,8 +1049,23 @@ msgstr "Предупреждение: %s нельзя использовать 
 msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
 msgstr "Предупреждение: Russia inside может быть использован только с %s. %s уже есть в Russia inside и будет удален из выбранных."
 
+msgid "When enabled, traffic not matching any other section's lists will go through this proxy."
+msgstr "Когда включено, трафик, не совпадающий со списками других секций, будет идти через этот прокси."
+
+msgid "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound."
+msgstr "Какая секция прокси/VPN обслуживает DNS. Оставьте пустым, чтобы использовать первый настроенный outbound."
+
+msgid "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format."
+msgstr "Какой формат подписки (клиент) запрашивать первым. «Авто» использует порядок по умолчанию. Выберите «Xray JSON (Happ)», если ваша панель отдаёт некоторые узлы (например, xhttp) только под клиентом вроде Happ, или «Sing-box», чтобы предпочесть формат sing-box."
+
+msgid "Xray JSON (Happ)"
+msgstr "Xray JSON (Happ)"
+
 msgid "YACD Secret Key"
 msgstr "Секретный ключ YACD"
 
+msgid "YACD web dashboard access and remote-access protection"
+msgstr "Доступ к веб-панели YACD и защита удалённого доступа"
+
 msgid "You can select Output Network Interface, by default autodetect"
 msgstr "Вы можете выбрать выходной сетевой интерфейс, по умолчанию он определяется автоматически."
diff --git a/luci-app-netshift/po/templates/netshift.pot b/luci-app-netshift/po/templates/netshift.pot
new file mode 100644
index 00000000..df59ccb2
--- /dev/null
+++ b/luci-app-netshift/po/templates/netshift.pot
@@ -0,0 +1,1523 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2026 THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the NETSHIFT package.
+# yandexru45 <>, 2026.
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: NETSHIFT\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-06-12 05:52+0300\n"
+"PO-Revision-Date: 2026-06-12 05:52+0300\n"
+"Last-Translator: yandexru45 <>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: src/netshift/tabs/dashboard/initController.ts:345
+msgid "✔ Enabled"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:356
+msgid "✔ Running"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:346
+msgid "✘ Disabled"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:357
+msgid "✘ Stopped"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:307
+msgid "Active Connections"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:123
+msgid "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:607
+msgid "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:695
+msgid "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:99
+msgid "Additional marking rules found"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:31
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:36
+msgid "Advanced"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:163
+msgid "Allow insecure TLS for subscription fetch"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:420
+msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:390
+msgid "Applicable for SOCKS and Shadowsocks proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:667
+msgid "At least one valid domain must be specified. Comments-only content is not allowed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:756
+msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:153
+msgid "Auto"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:45
+msgid "Available actions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:480
+msgid "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:479
+msgid "Block DoH Servers"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:65
+msgid "Bootsrap DNS"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:80
+msgid "Bootstrap DNS server"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:58
+msgid "Browser is not using FakeIP"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:57
+msgid "Browser is using FakeIP correctly"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:200
+msgid "By country flag"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:201
+msgid "By name prefix"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:517
+msgid "Cache File Path"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:531
+msgid "Cache file path cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:27
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:28
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:27
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:25
+msgid "Cannot receive checks result"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:144
+#: src/netshift/tabs/manager/cards.ts:181
+#: src/netshift/tabs/manager/cards.ts:227
+msgid "Check update"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:13
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:15
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:13
+msgid "Checking, please wait"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getCheckTitle.ts:2
+msgid "checks"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:26
+msgid "Checks failed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:13
+msgid "Checks passed"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:25
+msgid "CIDR must be between 0 and 32"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:127
+msgid "Clear subscription cache"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:329
+msgid "Clearing subscription cache and re-downloading… this may take a minute"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:26
+msgid "Close"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:513
+msgid "Community Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:83
+msgid "Component Manager"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:503
+msgid "Config File Path"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:30
+msgid "Configuration for NetShift service"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:51
+msgid "Configuration Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:16
+msgid "Connection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:39
+msgid "Connection Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:17
+msgid "Connection type, transport and DNS resolver for this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:54
+msgid "Connection URL"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:20
+msgid "Copy"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:159
+#: src/netshift/methods/shell/pollSingBoxComponentAction.ts:65
+msgid "Core switch failed"
+msgstr ""
+
+#: src/netshift/methods/shell/pollSingBoxComponentAction.ts:82
+msgid "Core switch timed out"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderWidget.ts:22
+msgid "Currently unavailable"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:606
+msgid "Custom domains"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:694
+msgid "Custom subnets"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:39
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:31
+msgid "Dashboard"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderSections.ts:20
+msgid "Dashboard currently unavailable"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:310
+msgid "Delay in milliseconds before reloading NetShift after interface UP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:317
+msgid "Delay value cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:101
+msgid "Dev"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:93
+msgid "DHCP has DNS server"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:98
+msgid "Diagnostics"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:81
+msgid "Disable autostart"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:445
+msgid "Disable QUIC"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:446
+msgid "Disable the QUIC protocol to improve compatibility or fix issues with video streaming"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:611
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:699
+msgid "Disabled"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:164
+msgid "Disables TLS certificate verification when downloading the subscription."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:16
+msgid "DNS"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:88
+msgid "DNS on router"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:116
+msgid "DNS outbound section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:479
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:48
+msgid "DNS over HTTPS (DoH)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:480
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:49
+msgid "DNS over TLS (DoT)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:476
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:45
+msgid "DNS Protocol Type"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:151
+msgid "DNS Rewrite TTL"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:490
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:58
+msgid "DNS Server"
+msgstr ""
+
+#: src/validators/validateDns.ts:7
+msgid "DNS server address cannot be empty"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:27
+msgid "Do not panic, everything can be fixed, just..."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:27
+msgid "Domain and subnet lists that decide which traffic uses this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:465
+msgid "Domain Resolver"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:457
+msgid "Dont Touch My DHCP!"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:241
+#: src/netshift/tabs/dashboard/initController.ts:275
+msgid "Downlink"
+msgstr ""
+
+#: src/partials/modal/renderModal.ts:15
+msgid "Download"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:340
+msgid "Download Lists via Proxy/VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:350
+msgid "Download Lists via specific proxy section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:341
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:351
+msgid "Downloading all lists via specific Proxy/VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:239
+msgid "Drop subscription servers whose name contains any of these keywords (case-insensitive)."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:612
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:700
+msgid "Dynamic List"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:91
+msgid "Enable autostart"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:466
+msgid "Enable built-in DNS resolver for domains handled by this section"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:933
+msgid "Enable DNS resolve to get real IP when routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:491
+msgid "Enable IPv6 Support"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:492
+msgid "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:902
+msgid "Enable Mixed Proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:212
+msgid "Enable Output Network Interface"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:903
+msgid "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:409
+msgid "Enable YACD"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:419
+msgid "Enable YACD WAN Access"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:99
+msgid "Enter complete outbound configuration in JSON format"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:649
+msgid "Enter domain names separated by commas, spaces, or newlines. You can add comments using //"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:622
+msgid "Enter domain names without protocols, e.g. example.com or sub.example.com"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:710
+msgid "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:306
+msgid "Every 1 minute"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:185
+msgid "Every 12 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:183
+msgid "Every 3 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:307
+msgid "Every 3 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:181
+msgid "Every 30 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:305
+msgid "Every 30 seconds"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:308
+msgid "Every 5 minutes"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:184
+msgid "Every 6 hours"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:186
+msgid "Every day"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:182
+msgid "Every hour"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:467
+msgid "Exclude NTP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:468
+msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:238
+msgid "Exclude servers by keyword"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:254
+#: src/netshift/tabs/diagnostic/initController.ts:344
+#: src/netshift/tabs/diagnostic/initController.ts:348
+msgid "Failed to clear subscription cache"
+msgstr ""
+
+#: src/helpers/copyToClipboard.ts:12
+msgid "Failed to copy!"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:122
+#: src/netshift/tabs/manager/initController.ts:132
+#: src/netshift/tabs/manager/initController.ts:150
+#: src/netshift/tabs/manager/initController.ts:160
+#: src/netshift/tabs/manager/initController.ts:188
+#: src/netshift/tabs/manager/initController.ts:192
+#: src/netshift/tabs/manager/initController.ts:225
+#: src/netshift/tabs/manager/initController.ts:229
+#: src/netshift/tabs/diagnostic/initController.ts:229
+#: src/netshift/tabs/diagnostic/initController.ts:233
+#: src/netshift/tabs/diagnostic/initController.ts:263
+#: src/netshift/tabs/diagnostic/initController.ts:267
+#: src/netshift/tabs/diagnostic/initController.ts:304
+#: src/netshift/tabs/diagnostic/initController.ts:308
+msgid "Failed to execute!"
+msgstr ""
+
+#: src/netshift/methods/custom/getDashboardSections.ts:150
+#: src/netshift/methods/custom/getDashboardSections.ts:181
+#: src/netshift/methods/custom/getDashboardSections.ts:218
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:58
+msgid "Fastest"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:874
+msgid "Fully Routed IPs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:100
+msgid "Get global check"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:224
+msgid "Global check"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:400
+msgid "Global Proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:195
+msgid "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:179
+msgid "How often to automatically update the subscription"
+msgstr ""
+
+#: src/netshift/api.ts:27
+msgid "HTTP error"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:226
+msgid "Include servers by keyword"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:136
+#: src/netshift/tabs/manager/cards.ts:174
+#: src/netshift/tabs/manager/cards.ts:220
+msgid "Install %s"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:96
+msgid "Installed version is newer than release"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:275
+msgid "Interface Monitoring"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:309
+msgid "Interface Monitoring Delay"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:276
+msgid "Interface monitoring for Bad WAN"
+msgstr ""
+
+#: src/validators/validateDns.ts:39
+msgid "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
+msgstr ""
+
+#: src/validators/validateDomain.ts:18
+#: src/validators/validateDomain.ts:27
+msgid "Invalid domain address"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:57
+msgid "Invalid format. Use X.X.X.X/Y or IPv6/Y"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:90
+msgid "Invalid HY2 URL: insecure must be 0 or 1"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:77
+msgid "Invalid HY2 URL: invalid port number"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:30
+msgid "Invalid HY2 URL: missing credentials/server"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:47
+msgid "Invalid HY2 URL: missing host"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:41
+msgid "Invalid HY2 URL: missing host & port"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:36
+msgid "Invalid HY2 URL: missing password"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:50
+msgid "Invalid HY2 URL: missing port"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:18
+msgid "Invalid HY2 URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:12
+msgid "Invalid HY2 URL: must start with hysteria2:// or hy2://"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:108
+msgid "Invalid HY2 URL: obfs-password required when obfs is set"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:122
+msgid "Invalid HY2 URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:116
+msgid "Invalid HY2 URL: sni cannot be empty"
+msgstr ""
+
+#: src/validators/validateHysteriaUrl.ts:98
+msgid "Invalid HY2 URL: unsupported obfs type"
+msgstr ""
+
+#: src/validators/validateIp.ts:11
+msgid "Invalid IP address"
+msgstr ""
+
+#: src/validators/validateIp.ts:66
+msgid "Invalid IPv6 address"
+msgstr ""
+
+#: src/validators/validateOutboundJson.ts:9
+msgid "Invalid JSON format"
+msgstr ""
+
+#: src/validators/validatePath.ts:22
+msgid "Invalid path format. Path must start with \"/\" and contain valid characters"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:85
+msgid "Invalid port number. Must be between 1 and 65535"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:37
+msgid "Invalid Shadowsocks URL: decoded credentials must contain method:password"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:27
+msgid "Invalid Shadowsocks URL: missing credentials"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:46
+msgid "Invalid Shadowsocks URL: missing method and password separator \":\""
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:76
+msgid "Invalid Shadowsocks URL: missing port"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:67
+msgid "Invalid Shadowsocks URL: missing server"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:58
+msgid "Invalid Shadowsocks URL: missing server address"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:16
+msgid "Invalid Shadowsocks URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:8
+msgid "Invalid Shadowsocks URL: must start with ss://"
+msgstr ""
+
+#: src/validators/validateShadowsocksUrl.ts:91
+msgid "Invalid Shadowsocks URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:73
+msgid "Invalid SOCKS URL: invalid host format"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:63
+msgid "Invalid SOCKS URL: invalid port number"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:42
+msgid "Invalid SOCKS URL: missing host and port"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:51
+msgid "Invalid SOCKS URL: missing hostname or IP"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:56
+msgid "Invalid SOCKS URL: missing port"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:34
+msgid "Invalid SOCKS URL: missing username"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:19
+msgid "Invalid SOCKS URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:10
+msgid "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://"
+msgstr ""
+
+#: src/validators/validateSocksUrl.ts:77
+msgid "Invalid SOCKS URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:15
+msgid "Invalid Trojan URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:8
+msgid "Invalid Trojan URL: must start with trojan://"
+msgstr ""
+
+#: src/validators/validateTrojanUrl.ts:56
+msgid "Invalid Trojan URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateUrl.ts:49
+#: src/validators/validateUrl.ts:66
+#: src/validators/validateUrl.ts:78
+msgid "Invalid URL format"
+msgstr ""
+
+#: src/validators/validateVlessUrl.ts:110
+msgid "Invalid VLESS URL: parsing failed"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:82
+msgid "Invalid VMess URL: invalid port"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:40
+msgid "Invalid VMess URL: malformed base64"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:50
+#: src/validators/validateVmessUrl.ts:57
+msgid "Invalid VMess URL: malformed JSON"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:66
+msgid "Invalid VMess URL: missing address"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:73
+msgid "Invalid VMess URL: missing id"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:25
+msgid "Invalid VMess URL: must not contain spaces"
+msgstr ""
+
+#: src/validators/validateVmessUrl.ts:7
+msgid "Invalid VMess URL: must start with vmess://"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:11
+msgid "IP address 0.0.0.0 is not allowed"
+msgstr ""
+
+#: src/validators/validateSubnet.ts:47
+msgid "IPv6 CIDR must be between 0 and 128"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/helpers/getMeta.ts:20
+msgid "Issues detected"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:227
+msgid "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all."
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:90
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:48
+msgid "Latest"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:103
+msgid "Latest version is installed"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:327
+msgid "List Update Frequency"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:27
+msgid "List update schedule, download routing, and routing exclusions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:26
+msgid "Lists & Updates"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:778
+msgid "Local Domain Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:802
+msgid "Local Subnet Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:554
+msgid "Log Level"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:72
+msgid "Main DNS"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runDnsCheck.ts:81
+msgid "Main DNS via outbound"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:311
+msgid "Memory Usage"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:32
+msgid "Mixed proxy and DNS resolution tuning"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:916
+msgid "Mixed Proxy Port"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:285
+msgid "Monitored Interfaces"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:343
+msgid "Must be a number in the range of 50 - 1000"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:343
+msgid "NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:29
+msgid "NetShift Settings"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:217
+msgid "NetShift updated, version:"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:458
+msgid "NetShift will not modify your DHCP configuration"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:21
+msgid "Network"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:418
+msgid "Network Interface"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:98
+msgid "No other marking rules found"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderCheckSection.ts:189
+msgid "Not implement yet"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:98
+#: src/netshift/tabs/manager/cards.ts:198
+#: src/netshift/tabs/manager/cards.ts:243
+#: src/netshift/tabs/manager/initController.ts:100
+msgid "Not installed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:74
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:80
+#: src/netshift/tabs/diagnostic/checks/runSectionsCheck.ts:99
+msgid "Not responding"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:59
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:67
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:75
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:83
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:91
+msgid "Not running"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:211
+msgid "Number of leading characters of each proxy name to group by."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:199
+msgid "Off"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:409
+msgid "Only one section can be global at a time."
+msgstr ""
+
+#: src/helpers/withTimeout.ts:7
+msgid "Operation timed out"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:58
+msgid "Outbound Config"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:98
+msgid "Outbound Configuration"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:94
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:38
+msgid "Outdated"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:222
+msgid "Output Network Interface"
+msgstr ""
+
+#: src/validators/validatePath.ts:7
+msgid "Path cannot be empty"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:535
+msgid "Path must be absolute (start with /)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:544
+msgid "Path must contain at least one directory (like /tmp/cache.db)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:539
+msgid "Path must end with cache.db"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:107
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:115
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:123
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:131
+#: src/netshift/tabs/diagnostic/diagnostic.store.ts:139
+msgid "Pending"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:210
+msgid "Prefix length"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:37
+msgid "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:66
+msgid "Proxy Configuration URL"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:66
+msgid "Proxy traffic is not routed via FakeIP"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:65
+msgid "Proxy traffic is routed via FakeIP"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:547
+msgid "Regional options cannot be used together"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:826
+msgid "Remote Domain Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:850
+msgid "Remote Subnet Lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:932
+msgid "Resolve real IP for routing"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:51
+msgid "Restart NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:401
+msgid "Route all unmatched traffic through this section's outbound."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:104
+msgid "Route main DNS through proxy/VPN"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:51
+msgid "Router DNS is not routed through sing-box"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runFakeIPCheck.ts:50
+msgid "Router DNS is routed through sing-box"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:26
+msgid "Routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:384
+msgid "Routing Excluded IPs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:77
+msgid "Rules mangle counters"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:72
+msgid "Rules mangle exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:82
+msgid "Rules mangle output exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:92
+msgid "Rules proxy counters"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:87
+msgid "Rules proxy exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderRunAction.ts:15
+msgid "Run Diagnostic"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:566
+msgid "Russia inside restrictions"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:433
+msgid "Secret key for authenticating remote access to YACD when WAN access is enabled."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:54
+msgid "Sections"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:514
+msgid "Select a predefined list for routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:40
+msgid "Select between VPN and Proxy connection methods for traffic routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:46
+msgid "Select DNS protocol to use"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:328
+msgid "Select how often the domain or subnet lists are updated automatically"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:52
+msgid "Select how to configure the proxy"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:419
+msgid "Select network interface for VPN connection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:491
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:59
+msgid "Select or enter DNS server address"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:518
+msgid "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:504
+msgid "Select path for sing-box config file. Change this ONLY if you know what you are doing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:477
+msgid "Select the DNS protocol type for the domain resolver"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:555
+msgid "Select the log level for sing-box"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:175
+msgid "Select the network interface from which the traffic will originate"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:223
+msgid "Select the network interface to which the traffic will originate"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:286
+msgid "Select the WAN interfaces to be monitored"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:55
+msgid "Selector"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:250
+msgid "Selector Proxy Links"
+msgstr ""
+
+#: src/netshift/methods/shell/index.ts:303
+msgid "Self-update failed"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:105
+msgid "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct."
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:340
+msgid "Services info"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/netshift.js:67
+msgid "Settings"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:292
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:118
+msgid "Show sing-box config"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:155
+#: src/netshift/tabs/dashboard/initController.ts:354
+msgid "Sing-box"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:77
+msgid "Sing-box autostart disabled"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:181
+msgid "Sing-box core changed, version:"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:62
+msgid "Sing-box installed"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:87
+msgid "Sing-box listening ports"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:82
+msgid "Sing-box process running"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:72
+msgid "Sing-box service exist"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runSingBoxCheck.ts:67
+msgid "Sing-box version is compatible (newer than 1.12.4)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:22
+msgid "Source and output interfaces, and Bad WAN interface monitoring"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:174
+msgid "Source Network Interface"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:385
+msgid "Specify a local IP address to be excluded from routing"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:875
+msgid "Specify local IP addresses or subnets whose traffic will always be routed through the configured route"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:827
+msgid "Specify remote URLs to download and use domain lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:851
+msgid "Specify remote URLs to download and use subnet lists"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:779
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:803
+msgid "Specify the path to the list file located on the router filesystem"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:71
+msgid "Start NetShift"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:61
+msgid "Stop NetShift"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:21
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:57
+msgid "Subscription"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:337
+msgid "Subscription cache cleared and re-downloaded"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:22
+msgid "Subscription feeds, server filters and URLTest tuning"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:148
+msgid "Subscription format"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:194
+msgid "Subscription grouping"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:178
+msgid "Subscription Update Interval"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:122
+msgid "Subscription URLs"
+msgstr ""
+
+#: src/helpers/copyToClipboard.ts:10
+msgid "Successfully copied!"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:235
+msgid "Switch to extended"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:190
+msgid "Switch to stable"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:171
+msgid "Switching sing-box core, this may take a few minutes…"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:304
+msgid "System info"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderSystemInfo.ts:24
+msgid "System information"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/checks/runNftCheck.ts:67
+msgid "Table exist"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/partials/renderSections.ts:104
+msgid "Test latency"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:613
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:701
+msgid "Text List"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:81
+msgid "The DNS server used to look up the IP address of an upstream DNS server"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:303
+msgid "The interval between connectivity tests"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:318
+msgid "The maximum difference in response times (ms) allowed when comparing servers"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:351
+msgid "The URL used to test server connectivity"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:168
+msgid "This is a security trade-off: an attacker could intercept the fetch."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:152
+msgid "Time in seconds for DNS record caching (default: 60)"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:238
+msgid "Traffic"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:268
+msgid "Traffic Total"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26
+msgid "Troubleshooting"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:163
+msgid "TTL must be a positive number"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:158
+msgid "TTL value cannot be empty"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:481
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:50
+msgid "UDP (Unprotected DNS)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:389
+msgid "UDP over TCP"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:37
+#: src/netshift/tabs/manager/initController.ts:38
+#: src/netshift/tabs/manager/initController.ts:39
+#: src/netshift/tabs/manager/initController.ts:40
+#: src/netshift/tabs/manager/initController.ts:41
+#: src/netshift/tabs/manager/initController.ts:42
+#: src/netshift/tabs/diagnostic/initController.ts:39
+#: src/netshift/tabs/diagnostic/initController.ts:40
+#: src/netshift/tabs/diagnostic/initController.ts:41
+#: src/netshift/tabs/diagnostic/initController.ts:42
+#: src/netshift/tabs/diagnostic/initController.ts:43
+#: src/netshift/tabs/diagnostic/initController.ts:44
+#: src/netshift/tabs/diagnostic/helpers/getNetshiftVersionRow.ts:7
+msgid "unknown"
+msgstr ""
+
+#: src/netshift/api.ts:40
+msgid "Unknown error"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:174
+#: src/netshift/tabs/manager/cards.ts:220
+msgid "Update"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:92
+msgid "Update is available"
+msgstr ""
+
+#: src/netshift/tabs/manager/cards.ts:137
+msgid "Update NetShift"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:208
+msgid "Updating NetShift, this may take a few minutes; the page will reload…"
+msgstr ""
+
+#: src/netshift/tabs/dashboard/initController.ts:240
+#: src/netshift/tabs/dashboard/initController.ts:271
+msgid "Uplink"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:17
+msgid "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"
+msgstr ""
+
+#: src/validators/validateProxyUrl.ts:42
+msgid "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+msgstr ""
+
+#: src/validators/validateUrl.ts:58
+msgid "URL must use one of the following protocols:"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:56
+msgid "URLTest"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:302
+msgid "URLTest Check Interval"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:276
+msgid "URLTest Proxy Links"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:350
+msgid "URLTest Testing URL"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:317
+msgid "URLTest Tolerance"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:166
+msgid "Use only for IP-host panels that serve an invalid or self-signed certificate."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:494
+msgid "Use this only when the router has working IPv6 connectivity."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:407
+msgid "Use with Exclusion sections to route specific domains directly."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:621
+msgid "User Domains"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:648
+msgid "User Domains List"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:709
+msgid "User Subnets"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:736
+msgid "User Subnets List"
+msgstr ""
+
+#: src/validators/validateDns.ts:26
+#: src/validators/validateDns.ts:30
+#: src/validators/validateDns.ts:34
+#: src/validators/validateDomain.ts:13
+#: src/validators/validateDomain.ts:30
+#: src/validators/validateHysteriaUrl.ts:120
+#: src/validators/validateIp.ts:8
+#: src/validators/validateIp.ts:91
+#: src/validators/validateIp.ts:97
+#: src/validators/validateOutboundJson.ts:7
+#: src/validators/validatePath.ts:16
+#: src/validators/validateShadowsocksUrl.ts:95
+#: src/validators/validateSocksUrl.ts:80
+#: src/validators/validateSubnet.ts:30
+#: src/validators/validateSubnet.ts:52
+#: src/validators/validateTrojanUrl.ts:59
+#: src/validators/validateUrl.ts:75
+#: src/validators/validateVlessUrl.ts:108
+#: src/validators/validateVmessUrl.ts:86
+msgid "Valid"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:681
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:768
+msgid "Validation errors:"
+msgstr ""
+
+#: src/netshift/tabs/manager/initController.ts:306
+msgid "Version"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/initController.ts:258
+#: src/netshift/tabs/diagnostic/partials/renderAvailableActions.ts:109
+msgid "View logs"
+msgstr ""
+
+#: src/netshift/tabs/diagnostic/partials/renderWikiDisclaimer.ts:32
+msgid "Visit Wiki"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:67
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:251
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:277
+msgid "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:549
+msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:568
+msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:403
+msgid "When enabled, traffic not matching any other section's lists will go through this proxy."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:117
+msgid "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:149
+msgid "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format."
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/section.js:154
+msgid "Xray JSON (Happ)"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:432
+msgid "YACD Secret Key"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:32
+msgid "YACD web dashboard access and remote-access protection"
+msgstr ""
+
+#: ../luci-app-netshift/htdocs/luci-static/resources/view/netshift/settings.js:213
+msgid "You can select Output Network Interface, by default autodetect"
+msgstr ""
diff --git a/luci-app-podkop/root/etc/uci-defaults/50_luci-podkop b/luci-app-netshift/root/etc/uci-defaults/50_luci-netshift
similarity index 66%
rename from luci-app-podkop/root/etc/uci-defaults/50_luci-podkop
rename to luci-app-netshift/root/etc/uci-defaults/50_luci-netshift
index 519c3581..67f6c1e1 100644
--- a/luci-app-podkop/root/etc/uci-defaults/50_luci-podkop
+++ b/luci-app-netshift/root/etc/uci-defaults/50_luci-netshift
@@ -5,6 +5,6 @@ rm -f /tmp/luci-indexcache*
 
 [ -x /etc/init.d/rpcd ] && /etc/init.d/rpcd reload
 
-logger -t "podkop" "$timestamp uci-defaults script executed"
+logger -t "netshift" "$timestamp uci-defaults script executed"
 
 exit 0
\ No newline at end of file
diff --git a/luci-app-netshift/root/usr/share/luci/menu.d/luci-app-netshift.json b/luci-app-netshift/root/usr/share/luci/menu.d/luci-app-netshift.json
new file mode 100644
index 00000000..455f866e
--- /dev/null
+++ b/luci-app-netshift/root/usr/share/luci/menu.d/luci-app-netshift.json
@@ -0,0 +1,14 @@
+{
+  "admin/services/netshift": {
+    "title": "NetShift",
+    "order": 42,
+    "action": {
+      "type": "view",
+      "path": "netshift/netshift"
+    },
+    "depends": {
+			"acl": [ "luci-app-netshift" ],
+			"uci": { "netshift": true }
+		}
+  }
+}
diff --git a/luci-app-podkop/root/usr/share/rpcd/acl.d/luci-app-podkop.json b/luci-app-netshift/root/usr/share/rpcd/acl.d/luci-app-netshift.json
similarity index 55%
rename from luci-app-podkop/root/usr/share/rpcd/acl.d/luci-app-podkop.json
rename to luci-app-netshift/root/usr/share/rpcd/acl.d/luci-app-netshift.json
index 6d0eabcb..26c097e7 100644
--- a/luci-app-podkop/root/usr/share/rpcd/acl.d/luci-app-podkop.json
+++ b/luci-app-netshift/root/usr/share/rpcd/acl.d/luci-app-netshift.json
@@ -1,12 +1,12 @@
 {
-  "luci-app-podkop": {
-    "description": "Grant UCI and RPC access to LuCI app podkop",
+  "luci-app-netshift": {
+    "description": "Grant UCI and RPC access to LuCI app NetShift",
     "read": {
       "file": {
-        "/etc/init.d/podkop": [
+        "/etc/init.d/netshift": [
           "exec"
         ],
-        "/usr/bin/podkop": [
+        "/usr/bin/netshift": [
           "exec"
         ]
       },
@@ -16,13 +16,13 @@
         ]
       },
       "uci": [
-        "podkop"
+        "netshift"
       ]
     },
     "write": {
       "uci": [
-        "podkop"
+        "netshift"
       ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/luci-app-podkop/xgettext.sh b/luci-app-netshift/xgettext.sh
similarity index 82%
rename from luci-app-podkop/xgettext.sh
rename to luci-app-netshift/xgettext.sh
index 0db78fbd..29d9dfb6 100644
--- a/luci-app-podkop/xgettext.sh
+++ b/luci-app-netshift/xgettext.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SRC_DIR="htdocs/luci-static/resources/view/podkop"
-OUT_POT="po/templates/podkop.pot"
+SRC_DIR="htdocs/luci-static/resources/view/netshift"
+OUT_POT="po/templates/netshift.pot"
 ENCODING="UTF-8"
 WIDTH=120
 
@@ -21,7 +21,7 @@ xgettext --language=JavaScript \
          --from-code="$ENCODING" \
          --output="$OUT_POT" \
          --width="$WIDTH" \
-         --package-name="PODKOP" \
+         --package-name="NETSHIFT" \
          "${FILES[@]}"
 
 echo "POT template generated: $OUT_POT"
\ No newline at end of file
diff --git a/luci-app-podkop/po/templates/podkop.pot b/luci-app-podkop/po/templates/podkop.pot
deleted file mode 100644
index d96b948e..00000000
--- a/luci-app-podkop/po/templates/podkop.pot
+++ /dev/null
@@ -1,1115 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) 2026 THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PODKOP package.
-# divocatt <210179590+divocatt@users.noreply.github.com>, 2026.
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PODKOP\n"
-"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-29 13:40+0300\n"
-"PO-Revision-Date: 2026-05-29 13:40+0300\n"
-"Last-Translator: divocatt <210179590+divocatt@users.noreply.github.com>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: src/podkop/tabs/dashboard/initController.ts:345
-msgid "✔ Enabled"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:356
-msgid "✔ Running"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:346
-msgid "✘ Disabled"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:357
-msgid "✘ Stopped"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:307
-msgid "Active Connections"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:106
-msgid "Additional marking rules found"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:247
-msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:199
-msgid "Applicable for SOCKS and Shadowsocks proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:444
-msgid "At least one valid domain must be specified. Comments-only content is not allowed."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:525
-msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:43
-msgid "Available actions"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:65
-msgid "Bootsrap DNS"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:45
-msgid "Bootstrap DNS server"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:58
-msgid "Browser is not using FakeIP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:57
-msgid "Browser is using FakeIP correctly"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:348
-msgid "Cache File Path"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:362
-msgid "Cache file path cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:27
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:28
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:27
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:25
-msgid "Cannot receive checks result"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:13
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:15
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:13
-msgid "Checking, please wait"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getCheckTitle.ts:2
-msgid "checks"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:26
-msgid "Checks failed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:13
-msgid "Checks passed"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:33
-msgid "CIDR must be between 0 and 32"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:26
-msgid "Close"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:299
-msgid "Community Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:335
-msgid "Config File Path"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:27
-msgid "Configuration for Podkop service"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:23
-msgid "Configuration Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:12
-msgid "Connection Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:26
-msgid "Connection URL"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:20
-msgid "Copy"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderWidget.ts:22
-msgid "Currently unavailable"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:80
-msgid "Dashboard"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderSections.ts:19
-msgid "Dashboard currently unavailable"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:222
-msgid "Delay in milliseconds before reloading podkop after interface UP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:229
-msgid "Delay value cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:82
-msgid "DHCP has DNS server"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:65
-msgid "Diagnostics"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:79
-msgid "Disable autostart"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:265
-msgid "Disable QUIC"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:266
-msgid "Disable the QUIC protocol to improve compatibility or fix issues with video streaming"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:390
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:470
-msgid "Disabled"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:77
-msgid "DNS on router"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:267
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:15
-msgid "DNS over HTTPS (DoH)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:268
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:16
-msgid "DNS over TLS (DoT)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:264
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:12
-msgid "DNS Protocol Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:68
-msgid "DNS Rewrite TTL"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:277
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:24
-msgid "DNS Server"
-msgstr ""
-
-#: src/validators/validateDns.ts:7
-msgid "DNS server address cannot be empty"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:26
-msgid "Do not panic, everything can be fixed, just..."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:254
-msgid "Domain Resolver"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:326
-msgid "Dont Touch My DHCP!"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:241
-#: src/podkop/tabs/dashboard/initController.ts:275
-msgid "Downlink"
-msgstr ""
-
-#: src/partials/modal/renderModal.ts:15
-msgid "Download"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:288
-msgid "Download Lists via Proxy/VPN"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:297
-msgid "Download Lists via specific proxy section"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:289
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:298
-msgid "Downloading all lists via specific Proxy/VPN"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:391
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:471
-msgid "Dynamic List"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:89
-msgid "Enable autostart"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:255
-msgid "Enable built-in DNS resolver for domains handled by this section"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:691
-msgid "Enable DNS resolve to get real IP when routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:665
-msgid "Enable Mixed Proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:126
-msgid "Enable Output Network Interface"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:666
-msgid "Enable the mixed proxy, allowing this section to route traffic through both HTTP and SOCKS proxies"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:237
-msgid "Enable YACD"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:246
-msgid "Enable YACD WAN Access"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:66
-msgid "Enter complete outbound configuration in JSON format"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:426
-msgid "Enter domain names separated by commas, spaces, or newlines. You can add comments using //"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:400
-msgid "Enter domain names without protocols, e.g. example.com or sub.example.com"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:480
-msgid "Enter subnets in CIDR notation (e.g. 103.21.244.0/22) or single IP addresses"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:138
-msgid "Every 1 minute"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:139
-msgid "Every 3 minutes"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:137
-msgid "Every 30 seconds"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:140
-msgid "Every 5 minutes"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:402
-msgid "Exclude NTP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:403
-msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
-msgstr ""
-
-#: src/helpers/copyToClipboard.ts:12
-msgid "Failed to copy!"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:227
-#: src/podkop/tabs/diagnostic/initController.ts:231
-#: src/podkop/tabs/diagnostic/initController.ts:261
-#: src/podkop/tabs/diagnostic/initController.ts:265
-#: src/podkop/tabs/diagnostic/initController.ts:302
-#: src/podkop/tabs/diagnostic/initController.ts:306
-msgid "Failed to execute!"
-msgstr ""
-
-#: src/podkop/methods/custom/getDashboardSections.ts:148
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:59
-msgid "Fastest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:638
-msgid "Fully Routed IPs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:98
-msgid "Get global check"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:222
-msgid "Global check"
-msgstr ""
-
-#: src/podkop/api.ts:27
-msgid "HTTP error"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:189
-msgid "Interface Monitoring"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:221
-msgid "Interface Monitoring Delay"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:190
-msgid "Interface monitoring for Bad WAN"
-msgstr ""
-
-#: src/validators/validateDns.ts:23
-msgid "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
-msgstr ""
-
-#: src/validators/validateDomain.ts:18
-#: src/validators/validateDomain.ts:27
-msgid "Invalid domain address"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:11
-msgid "Invalid format. Use X.X.X.X or X.X.X.X/Y"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:90
-msgid "Invalid HY2 URL: insecure must be 0 or 1"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:77
-msgid "Invalid HY2 URL: invalid port number"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:30
-msgid "Invalid HY2 URL: missing credentials/server"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:47
-msgid "Invalid HY2 URL: missing host"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:41
-msgid "Invalid HY2 URL: missing host & port"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:36
-msgid "Invalid HY2 URL: missing password"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:50
-msgid "Invalid HY2 URL: missing port"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:18
-msgid "Invalid HY2 URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:12
-msgid "Invalid HY2 URL: must start with hysteria2:// or hy2://"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:108
-msgid "Invalid HY2 URL: obfs-password required when obfs is set"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:122
-msgid "Invalid HY2 URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:116
-msgid "Invalid HY2 URL: sni cannot be empty"
-msgstr ""
-
-#: src/validators/validateHysteriaUrl.ts:98
-msgid "Invalid HY2 URL: unsupported obfs type"
-msgstr ""
-
-#: src/validators/validateIp.ts:11
-msgid "Invalid IP address"
-msgstr ""
-
-#: src/validators/validateOutboundJson.ts:9
-msgid "Invalid JSON format"
-msgstr ""
-
-#: src/validators/validatePath.ts:22
-msgid "Invalid path format. Path must start with \"/\" and contain valid characters"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:85
-msgid "Invalid port number. Must be between 1 and 65535"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:37
-msgid "Invalid Shadowsocks URL: decoded credentials must contain method:password"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:27
-msgid "Invalid Shadowsocks URL: missing credentials"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:46
-msgid "Invalid Shadowsocks URL: missing method and password separator \":\""
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:76
-msgid "Invalid Shadowsocks URL: missing port"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:67
-msgid "Invalid Shadowsocks URL: missing server"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:58
-msgid "Invalid Shadowsocks URL: missing server address"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:16
-msgid "Invalid Shadowsocks URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:8
-msgid "Invalid Shadowsocks URL: must start with ss://"
-msgstr ""
-
-#: src/validators/validateShadowsocksUrl.ts:91
-msgid "Invalid Shadowsocks URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:73
-msgid "Invalid SOCKS URL: invalid host format"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:63
-msgid "Invalid SOCKS URL: invalid port number"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:42
-msgid "Invalid SOCKS URL: missing host and port"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:51
-msgid "Invalid SOCKS URL: missing hostname or IP"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:56
-msgid "Invalid SOCKS URL: missing port"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:34
-msgid "Invalid SOCKS URL: missing username"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:19
-msgid "Invalid SOCKS URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:10
-msgid "Invalid SOCKS URL: must start with socks4://, socks4a://, or socks5://"
-msgstr ""
-
-#: src/validators/validateSocksUrl.ts:77
-msgid "Invalid SOCKS URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:15
-msgid "Invalid Trojan URL: must not contain spaces"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:8
-msgid "Invalid Trojan URL: must start with trojan://"
-msgstr ""
-
-#: src/validators/validateTrojanUrl.ts:56
-msgid "Invalid Trojan URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateUrl.ts:8
-#: src/validators/validateUrl.ts:31
-msgid "Invalid URL format"
-msgstr ""
-
-#: src/validators/validateVlessUrl.ts:110
-msgid "Invalid VLESS URL: parsing failed"
-msgstr ""
-
-#: src/validators/validateSubnet.ts:18
-msgid "IP address 0.0.0.0 is not allowed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getMeta.ts:20
-msgid "Issues detected"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:48
-msgid "Latest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:276
-msgid "List Update Frequency"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:546
-msgid "Local Domain Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:569
-msgid "Local Subnet Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:384
-msgid "Log Level"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runDnsCheck.ts:72
-msgid "Main DNS"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:311
-msgid "Memory Usage"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:678
-msgid "Mixed Proxy Port"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:198
-msgid "Monitored Interfaces"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:164
-msgid "Must be a number in the range of 50 - 1000"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:208
-msgid "Network Interface"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:105
-msgid "No other marking rules found"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderCheckSection.ts:189
-msgid "Not implement yet"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:75
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:81
-#: src/podkop/tabs/diagnostic/checks/runSectionsCheck.ts:100
-msgid "Not responding"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:55
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:63
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:71
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:79
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:87
-msgid "Not running"
-msgstr ""
-
-#: src/helpers/withTimeout.ts:7
-msgid "Operation timed out"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:29
-msgid "Outbound Config"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:65
-msgid "Outbound Configuration"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:38
-msgid "Outdated"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:135
-msgid "Output Network Interface"
-msgstr ""
-
-#: src/validators/validatePath.ts:7
-msgid "Path cannot be empty"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:366
-msgid "Path must be absolute (start with /)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:375
-msgid "Path must contain at least one directory (like /tmp/cache.db)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:370
-msgid "Path must end with cache.db"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:103
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:111
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:119
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:127
-#: src/podkop/tabs/diagnostic/diagnostic.store.ts:135
-msgid "Pending"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:343
-msgid "Podkop"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:26
-msgid "Podkop Settings"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:327
-msgid "Podkop will not modify your DHCP configuration"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:36
-msgid "Proxy Configuration URL"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:66
-msgid "Proxy traffic is not routed via FakeIP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:65
-msgid "Proxy traffic is routed via FakeIP"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:333
-msgid "Regional options cannot be used together"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:592
-msgid "Remote Domain Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:615
-msgid "Remote Subnet Lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:690
-msgid "Resolve real IP for routing"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:49
-msgid "Restart podkop"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:51
-msgid "Router DNS is not routed through sing-box"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runFakeIPCheck.ts:50
-msgid "Router DNS is routed through sing-box"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:413
-msgid "Routing Excluded IPs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:79
-msgid "Rules mangle counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:74
-msgid "Rules mangle exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:89
-msgid "Rules mangle output counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:84
-msgid "Rules mangle output exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:99
-msgid "Rules proxy counters"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:94
-msgid "Rules proxy exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderRunAction.ts:15
-msgid "Run Diagnostic"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:352
-msgid "Russia inside restrictions"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:257
-msgid "Secret key for authenticating remote access to YACD when WAN access is enabled."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:36
-msgid "Sections"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:300
-msgid "Select a predefined list for routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:13
-msgid "Select between VPN and Proxy connection methods for traffic routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:13
-msgid "Select DNS protocol to use"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:277
-msgid "Select how often the domain or subnet lists are updated automatically"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:24
-msgid "Select how to configure the proxy"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:209
-msgid "Select network interface for VPN connection"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:278
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:25
-msgid "Select or enter DNS server address"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:349
-msgid "Select or enter path for sing-box cache file. Change this ONLY if you know what you are doing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:336
-msgid "Select path for sing-box config file. Change this ONLY if you know what you are doing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:265
-msgid "Select the DNS protocol type for the domain resolver"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:388
-msgid "Select the list type for adding custom domains"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:468
-msgid "Select the list type for adding custom subnets"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:385
-msgid "Select the log level for sing-box"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:90
-msgid "Select the network interface from which the traffic will originate"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:136
-msgid "Select the network interface to which the traffic will originate"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:199
-msgid "Select the WAN interfaces to be monitored"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:27
-msgid "Selector"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:88
-msgid "Selector Proxy Links"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:340
-msgid "Services info"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/podkop.js:49
-msgid "Settings"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:290
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:116
-msgid "Show sing-box config"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:354
-msgid "Sing-box"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:77
-msgid "Sing-box autostart disabled"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:62
-msgid "Sing-box installed"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:87
-msgid "Sing-box listening ports"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:82
-msgid "Sing-box process running"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:72
-msgid "Sing-box service exist"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runSingBoxCheck.ts:67
-msgid "Sing-box version is compatible (newer than 1.12.4)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:89
-msgid "Source Network Interface"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:414
-msgid "Specify a local IP address to be excluded from routing"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:639
-msgid "Specify local IP addresses or subnets whose traffic will always be routed through the configured route"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:593
-msgid "Specify remote URLs to download and use domain lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:616
-msgid "Specify remote URLs to download and use subnet lists"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:547
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:570
-msgid "Specify the path to the list file located on the router filesystem"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:69
-msgid "Start podkop"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:59
-msgid "Stop podkop"
-msgstr ""
-
-#: src/helpers/copyToClipboard.ts:10
-msgid "Successfully copied!"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:304
-msgid "System info"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderSystemInfo.ts:21
-msgid "System information"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/checks/runNftCheck.ts:69
-msgid "Table exist"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/partials/renderSections.ts:108
-msgid "Test latency"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:392
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:472
-msgid "Text List"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:46
-msgid "The DNS server used to look up the IP address of an upstream DNS server"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:135
-msgid "The interval between connectivity tests"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:148
-msgid "The maximum difference in response times (ms) allowed when comparing servers"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:171
-msgid "The URL used to test server connectivity"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:69
-msgid "Time in seconds for DNS record caching (default: 60)"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:238
-msgid "Traffic"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:268
-msgid "Traffic Total"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:25
-msgid "Troubleshooting"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:80
-msgid "TTL must be a positive number"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:75
-msgid "TTL value cannot be empty"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:269
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:17
-msgid "UDP (Unprotected DNS)"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:198
-msgid "UDP over TCP"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:38
-#: src/podkop/tabs/diagnostic/initController.ts:39
-#: src/podkop/tabs/diagnostic/initController.ts:40
-#: src/podkop/tabs/diagnostic/initController.ts:41
-#: src/podkop/tabs/diagnostic/initController.ts:42
-#: src/podkop/tabs/diagnostic/initController.ts:43
-#: src/podkop/tabs/diagnostic/helpers/getPodkopVersionRow.ts:7
-msgid "unknown"
-msgstr ""
-
-#: src/podkop/api.ts:40
-msgid "Unknown error"
-msgstr ""
-
-#: src/podkop/tabs/dashboard/initController.ts:240
-#: src/podkop/tabs/dashboard/initController.ts:271
-msgid "Uplink"
-msgstr ""
-
-#: src/validators/validateProxyUrl.ts:37
-msgid "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
-msgstr ""
-
-#: src/validators/validateUrl.ts:17
-msgid "URL must use one of the following protocols:"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:28
-msgid "URLTest"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:134
-msgid "URLTest Check Interval"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:111
-msgid "URLTest Proxy Links"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:170
-msgid "URLTest Testing URL"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:147
-msgid "URLTest Tolerance"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:387
-msgid "User Domain List Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:399
-msgid "User Domains"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:425
-msgid "User Domains List"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:467
-msgid "User Subnet List Type"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:479
-msgid "User Subnets"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:505
-msgid "User Subnets List"
-msgstr ""
-
-#: src/validators/validateDns.ts:14
-#: src/validators/validateDns.ts:18
-#: src/validators/validateDomain.ts:13
-#: src/validators/validateDomain.ts:30
-#: src/validators/validateHysteriaUrl.ts:120
-#: src/validators/validateIp.ts:8
-#: src/validators/validateOutboundJson.ts:7
-#: src/validators/validatePath.ts:16
-#: src/validators/validateShadowsocksUrl.ts:95
-#: src/validators/validateSocksUrl.ts:80
-#: src/validators/validateSubnet.ts:38
-#: src/validators/validateTrojanUrl.ts:59
-#: src/validators/validateUrl.ts:28
-#: src/validators/validateVlessUrl.ts:108
-msgid "Valid"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:458
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:537
-msgid "Validation errors:"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/initController.ts:256
-#: src/podkop/tabs/diagnostic/partials/renderAvailableActions.ts:107
-msgid "View logs"
-msgstr ""
-
-#: src/podkop/tabs/diagnostic/partials/renderWikiDisclaimer.ts:31
-msgid "Visit Wiki"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:37
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:89
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:112
-msgid "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:335
-msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/section.js:354
-msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:256
-msgid "YACD Secret Key"
-msgstr ""
-
-#: ../luci-app-podkop/htdocs/luci-static/resources/view/podkop/settings.js:127
-msgid "You can select Output Network Interface, by default autodetect"
-msgstr ""
diff --git a/luci-app-podkop/root/usr/share/luci/menu.d/luci-app-podkop.json b/luci-app-podkop/root/usr/share/luci/menu.d/luci-app-podkop.json
deleted file mode 100644
index e7e6ffaf..00000000
--- a/luci-app-podkop/root/usr/share/luci/menu.d/luci-app-podkop.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "admin/services/podkop": {
-    "title": "Podkop",
-    "order": 42,
-    "action": {
-      "type": "view",
-      "path": "podkop/podkop"
-    },
-    "depends": {
-			"acl": [ "luci-app-podkop" ],
-			"uci": { "podkop": true }
-		}
-  }
-}
\ No newline at end of file
diff --git a/netshift/Makefile b/netshift/Makefile
new file mode 100644
index 00000000..593c9135
--- /dev/null
+++ b/netshift/Makefile
@@ -0,0 +1,64 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=netshift
+
+PKG_VERSION := $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(shell date +%d%m%Y))
+
+PKG_RELEASE:=1
+
+PKG_MAINTAINER:=ITDog <podkop@itdog.info>
+PKG_LICENSE:=GPL-2.0-or-later
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/netshift
+	SECTION:=net
+	CATEGORY:=Network
+	DEPENDS:=+sing-box +curl +jq +kmod-nft-tproxy +coreutils-base64 +bind-dig
+	CONFLICTS:=https-dns-proxy nextdns luci-app-passwall luci-app-passwall2
+	TITLE:=Domain routing app
+	URL:=https://podkop.net
+	PKGARCH:=all
+endef
+
+define Package/netshift/description
+	Domain routing. Use of VLESS, Shadowsocks technologies
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/netshift/prerm
+#!/bin/sh
+
+grep -q "105 netshift" /etc/iproute2/rt_tables && sed -i "/105 netshift/d" /etc/iproute2/rt_tables
+
+/etc/init.d/netshift stop
+
+exit 0
+endef
+
+define Package/netshift/conffiles
+/etc/config/netshift
+endef
+
+define Package/netshift/install
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/etc/init.d/netshift $(1)/etc/init.d/netshift
+
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/etc/config/netshift $(1)/etc/config/netshift
+
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) ./files/usr/bin/netshift $(1)/usr/bin/netshift
+
+	$(INSTALL_DIR) $(1)/usr/lib/netshift
+	$(CP) ./files/usr/lib/* $(1)/usr/lib/netshift/
+
+	sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' $(1)/usr/lib/netshift/constants.sh
+endef
+
+$(eval $(call BuildPackage,netshift))
diff --git a/netshift/files/etc/config/netshift b/netshift/files/etc/config/netshift
new file mode 100644
index 00000000..adeb9c98
--- /dev/null
+++ b/netshift/files/etc/config/netshift
@@ -0,0 +1,90 @@
+config settings 'settings'
+        option dns_type 'udp'
+        option dns_server '77.88.8.8'
+        option bootstrap_dns_server '77.88.8.8'
+        option dns_rewrite_ttl '60'
+        list source_network_interfaces 'br-lan'
+        option enable_output_network_interface '0'
+        #option output_network_interface 'wan'
+        option enable_badwan_interface_monitoring '0'
+        #list badwan_monitored_interfaces 'wan'
+        #option badwan_reload_delay '2000'
+        option enable_yacd '0'
+        option disable_quic '0'
+        option update_interval '1d'
+        option download_lists_via_proxy '0'
+        #option dns_via_outbound '0'
+        #option dns_outbound_section 'main'
+        option dont_touch_dhcp '0'
+        option config_path '/etc/sing-box/config.json'
+        option cache_path '/tmp/sing-box/cache.db'
+        option log_level 'warn'
+        option exclude_ntp '0'
+        option shutdown_correctly '0'
+        option block_doh '0'
+        option enable_ipv6 '0'
+        #list routing_excluded_ips '192.168.1.3'
+
+config section 'main'
+        option connection_type 'proxy'
+        option proxy_config_type 'url'
+        option proxy_string ''
+        option enable_udp_over_tcp '0'
+        option global_proxy '0'
+        list community_lists 'russia_inside'
+        #option user_domain_list_type 'dynamic'
+        #list user_domains '2ip.ru'
+        #option user_subnet_list_type 'dynamic'
+        #list user_subnets '1.1.1.1'
+        #list local_domain_lists '/tmp/domains.lst'
+        #list local_subnet_lists '/tmp/subnets.lst'
+        #list remote_domain_lists 'https://example.com/domains.srs'
+        #list remote_subnet_lists 'https://example.com/subnets.srs'
+        #list fully_routed_ips '192.168.1.2'
+        #option mixed_proxy_enabled '1'
+        #option mixed_proxy_port '2080'
+
+#config section 'subscription_example'
+#        option connection_type 'proxy'
+#        option proxy_config_type 'subscription'
+#        # subscription_url may be a single option (legacy, still supported) or a
+#        # UCI list of one or more feed URLs. With multiple URLs every feed is
+#        # downloaded/validated independently and all nodes are MERGED into one
+#        # selector/urltest group (same-named nodes auto-deduped). A dead feed
+#        # never breaks the others; the section is blocked only if ALL feeds fail.
+#        option subscription_url 'https://example.com/api/sub'
+#        #list subscription_url 'https://example.com/api/sub'
+#        #list subscription_url 'https://another-panel.example/api/sub'
+#        # Allow insecure TLS for the subscription fetch (default 0). Set to 1 to
+#        # add wget --no-check-certificate for IP-host panels whose HTTPS cert is
+#        # invalid/self-signed/missing-SAN. Disables certificate verification.
+#        #option subscription_insecure '0'
+#        # Force a specific client User-Agent for the fetch. When set, ONLY this
+#        # UA is used (no probing). Leave unset to auto-probe well-known clients.
+#        #option subscription_user_agent 'Happ'
+#        # Preferred body FORMAT to probe first (auto|xray|singbox, default auto).
+#        # Panels often serve a different config per User-Agent. 'xray' tries the
+#        # Xray-JSON UAs (Happ/v2rayN) FIRST to recover xhttp nodes a panel only
+#        # exposes in its Xray JSON; 'singbox' keeps the singbox/<ver> UA first;
+#        # 'auto' preserves the default order. Ignored when subscription_user_agent
+#        # is set (an explicit UA always wins).
+#        #option subscription_format_preference 'auto'
+#        option subscription_update_interval '1h'
+#        # Node grouping: off | country | prefix. 'country' clusters by leading
+#        # flag emoji; 'prefix' clusters by the first N codepoints of each node
+#        # name (N = subscription_group_prefix_len). subscription_group_mode
+#        # outranks the legacy subscription_group_by_countries boolean below.
+#        #option subscription_group_mode 'off'
+#        #option subscription_group_prefix_len '2'
+#        #option subscription_group_by_countries '0'
+#        #option urltest_check_interval '3m'
+#        #option urltest_tolerance '50'
+#        #option urltest_testing_url 'https://www.gstatic.com/generate_204'
+#        # Keyword whitelist: keep only nodes whose display name contains any of
+#        # these (OR). Empty/absent = keep all. Substring, ASCII case-insensitive.
+#        #list subscription_filter_include_keywords '🤖'
+#        #list subscription_filter_include_keywords 'grpc'
+#        # Keyword blacklist: drop any node whose display name contains any of
+#        # these (OR). Empty/absent = no exclusion.
+#        #list subscription_filter_exclude_keywords 'expired'
+#        list community_lists 'russia_inside'
diff --git a/podkop/files/etc/init.d/podkop b/netshift/files/etc/init.d/netshift
similarity index 88%
rename from podkop/files/etc/init.d/podkop
rename to netshift/files/etc/init.d/netshift
index 73825efe..e4e055ac 100755
--- a/podkop/files/etc/init.d/podkop
+++ b/netshift/files/etc/init.d/netshift
@@ -9,13 +9,13 @@ NAME="$(basename ${script:-$initscript})"
 config_load "$NAME"
 
 start_service() {
-    echo "Start podkop"
+    echo "Start netshift"
 
     config_get enable_badwan_interface_monitoring "settings" "enable_badwan_interface_monitoring"
     config_get badwan_monitored_interfaces "settings" "badwan_monitored_interfaces"
 
     procd_open_instance
-    procd_set_param command /usr/bin/podkop start
+    procd_set_param command /usr/bin/netshift start
     [ "$enable_badwan_interface_monitoring" = "1" ] && [ -n "$badwan_monitored_interfaces" ] &&
         procd_set_param netdev "$badwan_monitored_interfaces"
     procd_set_param stdout 1
@@ -24,11 +24,11 @@ start_service() {
 }
 
 stop_service() {
-    /usr/bin/podkop stop
+    /usr/bin/netshift stop
 }
 
 reload_service() {
-    /usr/bin/podkop reload > /dev/null 2>&1
+    /usr/bin/netshift reload > /dev/null 2>&1
 }
 
 service_triggers() {
@@ -45,7 +45,7 @@ service_triggers() {
 
     if [ "$enable_badwan_interface_monitoring" = "1" ]; then
         for iface in $badwan_monitored_interfaces; do
-            procd_add_interface_trigger "interface.*.up" "$iface" /etc/init.d/podkop reload
+            procd_add_interface_trigger "interface.*.up" "$iface" /etc/init.d/netshift reload
         done
     fi
     procd_close_trigger
diff --git a/netshift/files/usr/bin/netshift b/netshift/files/usr/bin/netshift
new file mode 100755
index 00000000..544b9695
--- /dev/null
+++ b/netshift/files/usr/bin/netshift
@@ -0,0 +1,5250 @@
+#!/bin/ash
+
+check_required_file() {
+    local file="$1"
+
+    if [ ! -r "$file" ]; then
+        echo "Error: required file '$file' is missing or not readable" >&2
+        exit 1
+    fi
+}
+
+NETSHIFT_LIB="/usr/lib/netshift"
+check_required_file /lib/functions.sh
+check_required_file /lib/config/uci.sh
+check_required_file /lib/functions/network.sh
+check_required_file "$NETSHIFT_LIB/constants.sh"
+check_required_file "$NETSHIFT_LIB/nft.sh"
+check_required_file "$NETSHIFT_LIB/helpers.sh"
+check_required_file "$NETSHIFT_LIB/sing_box_config_manager.sh"
+check_required_file "$NETSHIFT_LIB/sing_box_config_facade.sh"
+check_required_file "$NETSHIFT_LIB/logging.sh"
+check_required_file "$NETSHIFT_LIB/rulesets.sh"
+check_required_file "$NETSHIFT_LIB/updater.sh"
+. /lib/functions.sh
+. /lib/config/uci.sh
+. /lib/functions/network.sh
+. "$NETSHIFT_LIB/constants.sh"
+. "$NETSHIFT_LIB/nft.sh"
+. "$NETSHIFT_LIB/helpers.sh"
+. "$NETSHIFT_LIB/sing_box_config_manager.sh"
+. "$NETSHIFT_LIB/sing_box_config_facade.sh"
+. "$NETSHIFT_LIB/logging.sh"
+. "$NETSHIFT_LIB/rulesets.sh"
+. "$NETSHIFT_LIB/updater.sh"
+
+config_load "$NETSHIFT_CONFIG"
+
+check_requirements() {
+    log "Check Requirements"
+
+    local sing_box_version jq_version coreutils_base64_version
+    sing_box_version="$(sing-box version | head -n1 | awk '{print $3}')"
+    jq_version="$(jq --version | awk -F- '{print $2}')"
+    coreutils_base64_version="$(base64 --version | head -n1 | awk '{print $4}')"
+
+    if [ -z "$sing_box_version" ]; then
+        log "Package 'sing-box' is not installed. Aborted." "error"
+        exit 1
+    else
+        if ! is_min_package_version "$sing_box_version" "$SB_REQUIRED_VERSION"; then
+            log "Package 'sing-box' version ($sing_box_version) is lower than the required minimum ($SB_REQUIRED_VERSION). Update sing-box: opkg update && opkg remove sing-box && opkg install sing-box. Aborted." "error"
+            exit 1
+        fi
+
+        if ! service_exists "sing-box"; then
+            log "Service 'sing-box' is missing. Please install the official package to ensure the service is available. Aborted." "error"
+            exit 1
+        fi
+    fi
+
+    if [ -z "$jq_version" ]; then
+        log "Package 'jq' is not installed. Aborted." "error"
+        exit 1
+    elif ! is_min_package_version "$jq_version" "$JQ_REQUIRED_VERSION"; then
+        log "Package 'jq' version ($jq_version) is lower than the required minimum ($JQ_REQUIRED_VERSION). Aborted." "error"
+        exit 1
+    fi
+
+    if [ -z "$coreutils_base64_version" ]; then
+        log "Package 'coreutils-base64' is not installed. Aborted." "error"
+        exit 1
+    elif ! is_min_package_version "$coreutils_base64_version" "$COREUTILS_BASE64_REQUIRED_VERSION"; then
+        log "Package 'coreutils-base64' version ($coreutils_base64_version) is lower than the required minimum ($COREUTILS_BASE64_REQUIRED_VERSION). This may cause issues when decoding base64 streams with missing padding, as automatic padding support is not available in older versions." "warn"
+    fi
+
+    if grep -qE 'doh_backup_noresolv|doh_backup_server|doh_server' /etc/config/dhcp; then
+        log "Detected https-dns-proxy in DHCP config. Edit /etc/config/dhcp" "error"
+    fi
+
+    if has_outbound_section; then
+        log "Outbound section found" "debug"
+    else
+        log "Outbound section not found. Please check your configuration file (missing proxy_string, selector_proxy_links, urltest_proxy_links, subscription_url, outbound_json, or interface according to connection_type/proxy_config_type). Aborted." "error"
+        exit 1
+    fi
+}
+
+section_has_configured_outbound() {
+    local section="$1"
+    local connection_type proxy_config_type
+
+    config_get connection_type "$section" "connection_type"
+
+    case "$connection_type" in
+    proxy)
+        config_get proxy_config_type "$section" "proxy_config_type" "url"
+
+        case "$proxy_config_type" in
+        url)
+            local proxy_string
+            config_get proxy_string "$section" "proxy_string"
+            [ -n "$proxy_string" ] && return 0
+            ;;
+        selector)
+            local selector_proxy_links
+            config_get selector_proxy_links "$section" "selector_proxy_links"
+            [ -n "$selector_proxy_links" ] && return 0
+            ;;
+        urltest)
+            local urltest_proxy_links
+            config_get urltest_proxy_links "$section" "urltest_proxy_links"
+            [ -n "$urltest_proxy_links" ] && return 0
+            ;;
+        outbound)
+            local outbound_json
+            config_get outbound_json "$section" "outbound_json"
+            [ -n "$outbound_json" ] && return 0
+            ;;
+        subscription)
+            # get_subscription_urls_for_section handles both the UCI `list` shape
+            # (new UI configs) and a scalar `option` shape (legacy / CLI /
+            # migrated configs), so the section has a configured outbound if it
+            # returns at least one URL.
+            [ -n "$(get_subscription_urls_for_section "$section")" ] && return 0
+            ;;
+        esac
+        ;;
+    vpn)
+        local interface
+        config_get interface "$section" "interface"
+        [ -n "$interface" ] && return 0
+        ;;
+    esac
+
+    return 1
+}
+
+_check_outbound_section() {
+    local section="$1"
+
+    if section_has_configured_outbound "$section"; then
+        section_exists=0
+    fi
+}
+
+has_outbound_section() {
+    local section_exists=1
+
+    config_foreach _check_outbound_section "section"
+
+    return $section_exists
+}
+
+# Stable, filesystem-safe subkey for a subscription URL within a section. A
+# section may now list MULTIPLE subscription_url entries; each feed keeps its
+# own independent download/UA/rejected/json cache keyed by this hash so the
+# feeds never collide and one bad feed cannot poison another. md5sum is
+# busybox-safe and the URL bytes are opaque user text (never parsed here).
+get_subscription_url_hash() {
+    local url="$1"
+
+    printf '%s' "$url" | md5sum 2>/dev/null | awk '{print $1}'
+}
+
+# Subscription cache-path builders. The optional second argument is the per-URL
+# hash (see get_subscription_url_hash): when present the path is keyed
+# "${section}.<urlhash>.<ext>"; when absent it falls back to the legacy bare
+# "${section}.<ext>" path (still used by migrate_subscription_cache_from_tmp and
+# the legacy-cleanup reaper). Multi-URL feeds always pass a hash.
+get_subscription_json_path() {
+    local section="$1"
+    local urlhash="$2"
+
+    echo "$SUBSCRIPTION_CACHE_FOLDER/${section}${urlhash:+.$urlhash}.json"
+}
+
+get_subscription_url_cache_path() {
+    local section="$1"
+    local urlhash="$2"
+
+    echo "$SUBSCRIPTION_CACHE_FOLDER/${section}${urlhash:+.$urlhash}.url"
+}
+
+get_subscription_rejected_cache_path() {
+    local section="$1"
+    local urlhash="$2"
+
+    echo "$SUBSCRIPTION_CACHE_FOLDER/${section}${urlhash:+.$urlhash}.rejected"
+}
+
+# Path of the cached "winning" User-Agent for a subscription source: the first
+# candidate that previously produced valid outbounds. Tried first on the next
+# refresh so we don't re-probe the whole whitelist every time.
+get_subscription_user_agent_cache_path() {
+    local section="$1"
+    local urlhash="$2"
+
+    echo "$SUBSCRIPTION_CACHE_FOLDER/${section}${urlhash:+.$urlhash}.user_agent"
+}
+
+# Collect a section's subscription_url entries (a UCI list; a legacy / CLI /
+# migrated `option subscription_url` is a scalar that config_list_foreach does
+# NOT iterate — get_subscription_urls_for_section handles that shape with a
+# scalar fallback) into the newline-delimited global SUBSCRIPTION_URLS_COLLECTED.
+# URLs are opaque user text and may contain shell-special chars, so they are
+# accumulated newline-delimited (URLs cannot contain a newline) and consumers
+# read them with `while IFS= read -r`, never via word-splitting.
+_collect_subscription_url_handler() {
+    local url="$1"
+
+    [ -n "$url" ] || return 0
+    if [ -z "$SUBSCRIPTION_URLS_COLLECTED" ]; then
+        SUBSCRIPTION_URLS_COLLECTED="$url"
+    else
+        SUBSCRIPTION_URLS_COLLECTED="$SUBSCRIPTION_URLS_COLLECTED
+$url"
+    fi
+}
+
+get_subscription_urls_for_section() {
+    local section="$1"
+    local scalar_url
+
+    SUBSCRIPTION_URLS_COLLECTED=""
+    config_list_foreach "$section" "subscription_url" _collect_subscription_url_handler
+
+    # Backward compat: legacy / CLI / podkop-migrated configs store
+    # subscription_url as a scalar `option` (not a `list`). config_list_foreach
+    # iterates ONLY list values, so it returns nothing for a scalar option. Fall
+    # back to a scalar read and treat it as a 1-element list. (PROVEN on hardware:
+    # config_list_foreach over an option => empty; config_get => the value.) This
+    # is the load-bearing fix and must stand alone even when the option->list
+    # migration is skipped (read-only fs / uci failure).
+    if [ -z "$SUBSCRIPTION_URLS_COLLECTED" ]; then
+        config_get scalar_url "$section" "subscription_url"
+        [ -n "$scalar_url" ] && _collect_subscription_url_handler "$scalar_url"
+    fi
+
+    printf '%s' "$SUBSCRIPTION_URLS_COLLECTED"
+}
+
+# Remove any stale legacy bare-"${section}.<ext>" cache files left over from
+# before per-URL hashing. We now ALWAYS hash (uniform code path), so a bare file
+# is never read again; reaping it keeps the cache dir from accumulating orphans
+# and prevents subscription_cache_is_usable ever picking up a stale bare body.
+reap_legacy_subscription_cache_files() {
+    local section="$1"
+
+    rm -f \
+        "$(get_subscription_json_path "$section")" \
+        "$(get_subscription_url_cache_path "$section")" \
+        "$(get_subscription_rejected_cache_path "$section")" \
+        "$(get_subscription_user_agent_cache_path "$section")" \
+        2>/dev/null
+}
+
+ensure_subscription_cache_dir() {
+    local state_dir_created=0 cache_dir_created=0
+    local mkdir_errfile mkdir_rc
+
+    [ -d "$NETSHIFT_STATE_DIR" ] || state_dir_created=1
+    [ -d "$SUBSCRIPTION_CACHE_FOLDER" ] || cache_dir_created=1
+    mkdir_errfile="/tmp/netshift-subscription-cache-mkdir.$$"
+    if mkdir -p "$SUBSCRIPTION_CACHE_FOLDER" 2>"$mkdir_errfile"; then
+        rm -f "$mkdir_errfile"
+    else
+        mkdir_rc=$?
+        if [ -d "$SUBSCRIPTION_CACHE_FOLDER" ]; then
+            log "Subscription cache directory '$SUBSCRIPTION_CACHE_FOLDER' already exists; continuing after mkdir rc=$mkdir_rc" "warn"
+            rm -f "$mkdir_errfile"
+        else
+            local mkdir_err
+            mkdir_err="$(tr '\n' ' ' < "$mkdir_errfile" 2>/dev/null | sed 's/[[:space:]][[:space:]]*/ /g; s/^ //; s/ $//' | cut -c1-220)"
+            rm -f "$mkdir_errfile"
+            log "Failed to prepare subscription cache directory '$SUBSCRIPTION_CACHE_FOLDER': mkdir rc=$mkdir_rc, state_dir_created=$state_dir_created, cache_dir_created=$cache_dir_created, error=\"${mkdir_err:-no stderr}\"" "error"
+            return 1
+        fi
+    fi
+
+    if [ "$state_dir_created" -eq 1 ] || [ "$cache_dir_created" -eq 1 ]; then
+        chmod 700 "$NETSHIFT_STATE_DIR" 2>/dev/null
+        chmod 700 "$SUBSCRIPTION_CACHE_FOLDER" 2>/dev/null
+    fi
+}
+
+migrate_subscription_cache_from_tmp() {
+    local src_json src_url src_section src_url_value dst_url dst_json dst_url_cache urlhash
+
+    [ -d "$TMP_SUBSCRIPTION_FOLDER" ] || return 0
+    ensure_subscription_cache_dir || return 0
+
+    # Legacy tmp caches are bare-keyed "<section>.json" (one feed per section).
+    # We now always hash per URL, so migrate each usable tmp body to the hashed
+    # destination of the URL it belongs to: prefer the URL recorded in the tmp
+    # "<section>.url" sidecar, else fall back to the section's first configured
+    # subscription_url. This keeps a legacy single-feed section working across an
+    # upgrade without an immediate re-download.
+    for src_json in "$TMP_SUBSCRIPTION_FOLDER"/*.json; do
+        [ -e "$src_json" ] || continue
+        src_section="$(basename "${src_json%.json}")"
+        src_url="${src_json%.json}.url"
+
+        subscription_cache_is_usable "$src_json" || continue
+
+        src_url_value="$(cat "$src_url" 2>/dev/null)"
+        if [ -z "$src_url_value" ]; then
+            src_url_value="$(get_subscription_urls_for_section "$src_section" | head -n 1)"
+        fi
+        [ -n "$src_url_value" ] || continue
+
+        urlhash="$(get_subscription_url_hash "$src_url_value")"
+        [ -n "$urlhash" ] || continue
+        dst_json="$(get_subscription_json_path "$src_section" "$urlhash")"
+        dst_url_cache="$(get_subscription_url_cache_path "$src_section" "$urlhash")"
+
+        if [ ! -e "$dst_json" ]; then
+            cp "$src_json" "$dst_json" 2>/dev/null
+            printf '%s' "$src_url_value" > "$dst_url_cache" 2>/dev/null
+            chmod 600 "$dst_json" "$dst_url_cache" 2>/dev/null
+            log "Migrated subscription cache for section '$src_section' to per-URL persistent storage" "info"
+        fi
+    done
+}
+
+mark_subscription_outbound_unavailable() {
+    local section="$1"
+    local keyword_filter_active="${2:-0}"
+    local url urlhash subscription_json_path rejected_cache_path rejected_hash
+
+    case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+    *" $section "*) ;;
+    *) SUBSCRIPTION_UNAVAILABLE_SECTIONS="$SUBSCRIPTION_UNAVAILABLE_SECTIONS $section" ;;
+    esac
+
+    if [ "$keyword_filter_active" -eq 1 ]; then
+        # The empty result came from the user's keyword filter, not from a bad
+        # feed: the bodies themselves may be perfectly valid. Recording their
+        # hashes here would poison the per-URL caches and wedge future downloads
+        # (return 14 loop), and would survive the user loosening the filter. So
+        # never write the rejected-hash for this case, and proactively clear any
+        # stale per-URL rejected hash so a feed poisoned by an earlier
+        # empty-filter run self-heals on this pass.
+        get_subscription_urls_for_section "$section" | while IFS= read -r url; do
+            [ -n "$url" ] || continue
+            urlhash="$(get_subscription_url_hash "$url")"
+            rm -f "$(get_subscription_rejected_cache_path "$section" "$urlhash")"
+        done
+        log "Subscription keyword filter for section '$section' removed all nodes; matching traffic for this section will be rejected until the filter is loosened or a matching node appears (the feeds themselves are not rejected)" "warn"
+        subscription_startup_blocked=1
+        return 0
+    fi
+
+    log "Subscription cache for section '$section' is unavailable; matching traffic for this section will be rejected until refresh succeeds" "warn"
+    # A structurally valid subscription feed can still contain no sing-box usable
+    # proxy outbounds (e.g. all statically-unsupported). Remember each usable
+    # cached feed's hash PER-URL so the retry worker does not persist, restart
+    # and reject exactly the same unusable feed in a flash-writing loop; keeping
+    # this per-URL means one bad feed cannot poison another feed's retry state.
+    get_subscription_urls_for_section "$section" | while IFS= read -r url; do
+        [ -n "$url" ] || continue
+        urlhash="$(get_subscription_url_hash "$url")"
+        subscription_json_path="$(get_subscription_json_path "$section" "$urlhash")"
+        rejected_cache_path="$(get_subscription_rejected_cache_path "$section" "$urlhash")"
+        [ -s "$subscription_json_path" ] || continue
+        rejected_hash="$(md5sum "$subscription_json_path" 2>/dev/null | awk '{print $1}')"
+        if [ -n "$rejected_hash" ] && [ "$(cat "$rejected_cache_path" 2>/dev/null)" != "$rejected_hash" ]; then
+            printf '%s' "$rejected_hash" > "${rejected_cache_path}.tmp.$$" && mv "${rejected_cache_path}.tmp.$$" "$rejected_cache_path"
+            chmod 600 "$rejected_cache_path" 2>/dev/null
+        fi
+    done
+    subscription_startup_blocked=1
+}
+
+subscription_outbound_is_unavailable() {
+    local section="$1"
+
+    case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+    *" $section "*) return 0 ;;
+    esac
+    return 1
+}
+
+# Mark a non-subscription proxy section (url/selector/urltest) as having no
+# usable outbound, so sing_box_configure_route emits a reject route rule for it
+# (like the subscription-unavailable path) instead of a route rule pointing at a
+# never-created outbound tag. Used when every configured link for the section
+# was an unsupported scheme and got skipped by the facade. This reuses the
+# existing SUBSCRIPTION_UNAVAILABLE_SECTIONS mechanism (subscription_outbound_is_unavailable),
+# but does NOT touch any per-URL subscription rejected-hash cache (that is
+# subscription-only). The section degrades to "matching traffic rejected"
+# without aborting generation of the rest of the config.
+mark_section_outbound_unavailable() {
+    local section="$1"
+
+    case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+    *" $section "*) ;;
+    *) SUBSCRIPTION_UNAVAILABLE_SECTIONS="$SUBSCRIPTION_UNAVAILABLE_SECTIONS $section" ;;
+    esac
+}
+
+get_subscription_download_proxy_address() {
+    local section="$1"
+    local phase="$2"
+    local download_lists_via_proxy download_lists_via_proxy_section
+
+    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
+    [ "$download_lists_via_proxy" -eq 1 ] || return 0
+
+    config_get download_lists_via_proxy_section "settings" "download_lists_via_proxy_section"
+    if [ -z "$download_lists_via_proxy_section" ]; then
+        log "download_lists_via_proxy is enabled but no proxy section is selected; using direct mode for $phase subscription download" "warn"
+        return 0
+    fi
+
+    if [ "$phase" = "bootstrap" ]; then
+        if [ "$download_lists_via_proxy_section" = "$section" ]; then
+            log "Cannot bootstrap subscription for section '$section' through itself before cache exists; using direct mode" "warn"
+        else
+            log "download_lists_via_proxy is configured, but bootstrap subscription download for section '$section' must use direct mode until sing-box starts" "info"
+        fi
+        return 0
+    fi
+
+    if [ "$download_lists_via_proxy_section" = "$section" ]; then
+        if section_has_usable_subscription_cache "$section"; then
+            log "Updating subscription for section '$section' through its currently active cached proxy" "info"
+            echo "$(get_service_proxy_address 2>/dev/null || echo '')"
+            return 0
+        fi
+
+        log "Subscription section '$section' is selected as its own download proxy, but no usable cache exists yet; falling back to direct mode for bootstrap" "warn"
+        return 0
+    fi
+
+    local selected_connection_type selected_proxy_config_type
+    config_get selected_connection_type "$download_lists_via_proxy_section" "connection_type"
+    config_get selected_proxy_config_type "$download_lists_via_proxy_section" "proxy_config_type"
+    if [ "$selected_connection_type" = "proxy" ] && [ "$selected_proxy_config_type" = "subscription" ] && \
+        ! section_has_usable_subscription_cache "$download_lists_via_proxy_section"; then
+        log "Selected download proxy section '$download_lists_via_proxy_section' has no usable subscription cache; using direct mode for recovery of '$section'" "warn"
+        return 0
+    fi
+
+    echo "$(get_service_proxy_address 2>/dev/null || echo '')"
+}
+
+subscription_cache_is_usable() {
+    local subscription_json_path="$1"
+    local rejected_cache_path current_hash rejected_hash has_proxy_outbound
+
+    [ -s "$subscription_json_path" ] || return 1
+
+    validate_subscription_file "$subscription_json_path" || return 1
+
+    # The rejected-hash veto must only be able to reject a body that does NOT
+    # actually contain usable proxy outbounds (the genuine flash-loop guard). A
+    # structurally valid body with >=1 proxy outbound is a real subscription and
+    # is always usable, regardless of any stale rejected-hash (e.g. one poisoned
+    # by an over-strict keyword filter before task-011). Same predicate as the
+    # batch (candidate = not selector/urltest/direct/dns/block); no Oniguruma.
+    has_proxy_outbound="$(jq -e '
+        [.outbounds[]? | select(
+            .type != "selector" and
+            .type != "urltest" and
+            .type != "direct" and
+            .type != "dns" and
+            .type != "block"
+        )] | length > 0
+    ' "$subscription_json_path" >/dev/null 2>&1 && echo 1 || echo 0)"
+    [ "$has_proxy_outbound" = "1" ] && return 0
+
+    rejected_cache_path="${subscription_json_path%.json}.rejected"
+    if [ -s "$rejected_cache_path" ]; then
+        current_hash="$(md5sum "$subscription_json_path" 2>/dev/null | awk '{print $1}')"
+        rejected_hash="$(cat "$rejected_cache_path" 2>/dev/null)"
+        if [ -n "$current_hash" ] && [ "$current_hash" = "$rejected_hash" ]; then
+            return 1
+        fi
+    fi
+
+    return 0
+}
+
+# True (0) if ANY of the section's per-URL subscription caches is usable. Used
+# wherever a single-feed "section has a working cache" decision is needed (e.g.
+# download-proxy selection); the section is considered to have a usable cache as
+# soon as one feed does. URLs are written to a temp file and read with a plain
+# `while read` (NOT a pipe) so the `found` flag survives in this shell.
+section_has_usable_subscription_cache() {
+    local section="$1"
+    local url urlhash found urls_tmp
+
+    found=1
+    urls_tmp="$(mktemp "${TMPDIR:-/tmp}/netshift-sub-urls.XXXXXX")" || return 1
+    get_subscription_urls_for_section "$section" > "$urls_tmp"
+    while IFS= read -r url || [ -n "$url" ]; do
+        [ -n "$url" ] || continue
+        urlhash="$(get_subscription_url_hash "$url")"
+        if subscription_cache_is_usable "$(get_subscription_json_path "$section" "$urlhash")"; then
+            found=0
+            break
+        fi
+    done < "$urls_tmp"
+    rm -f "$urls_tmp"
+
+    return "$found"
+}
+
+wait_for_subscription_connectivity() {
+    local section="$1"
+    local subscription_url="$2"
+    local service_proxy_address="$3"
+    local attempts="${4:-12}"
+    local wait="${5:-5}"
+    local timeout="${6:-5}"
+    local attempt
+
+    for attempt in $(seq 1 "$attempts"); do
+        if check_subscription_connectivity "$subscription_url" "$service_proxy_address" 1 0 "$timeout"; then
+            log "Subscription connectivity check passed for section '$section'" "info"
+            return 0
+        fi
+
+        log "Subscription source is unavailable for section '$section' [$attempt/$attempts]" "warn"
+        [ "$attempt" -lt "$attempts" ] && sleep "$wait"
+    done
+
+    log "Subscription connectivity check failed for section '$section' after $attempts attempts" "error"
+    return 1
+}
+
+download_subscription_into_cache() {
+    local section="$1"
+    local subscription_url="$2"
+    local subscription_json_path="$3"
+    local subscription_url_cache_path="$4"
+    local service_proxy_address="$5"
+    # Optional per-URL hash subkey: keys the UA and rejected caches so each feed
+    # in a multi-URL section keeps independent state. Empty = legacy bare paths.
+    local urlhash="$6"
+    local tmpfile persist_tmpfile url_tmpfile rejected_cache_path tmp_hash rejected_hash validation_reason file_size fallback_tmp
+    local configured_user_agent user_agent_cache_path cached_user_agent candidates_file
+    local effective_user_agent download_ok winning_user_agent ua_tmpfile
+    local subscription_insecure subscription_format_preference
+
+    ensure_subscription_cache_dir || {
+        log "Failed to prepare persistent subscription cache directory '$SUBSCRIPTION_CACHE_FOLDER' for section '$section'" "error"
+        return 10
+    }
+    mkdir -p "$TMP_SUBSCRIPTION_DOWNLOAD_FOLDER" || {
+        log "Failed to create temporary subscription download directory '$TMP_SUBSCRIPTION_DOWNLOAD_FOLDER' for section '$section'" "error"
+        return 11
+    }
+    tmpfile="$(mktemp "$TMP_SUBSCRIPTION_DOWNLOAD_FOLDER/${section}.download.XXXXXX")" || {
+        log "Failed to create temporary subscription download file in '$TMP_SUBSCRIPTION_DOWNLOAD_FOLDER' for section '$section'" "error"
+        return 11
+    }
+
+    # User-Agent fallback. Panels often key the returned body format off the
+    # client User-Agent, so when none is configured we probe a whitelist of
+    # well-known clients and keep the first that yields valid outbounds. The
+    # previously successful UA (cached) is tried first to avoid re-probing.
+    user_agent_cache_path="$(get_subscription_user_agent_cache_path "$section" "$urlhash")"
+    configured_user_agent="$(uci -q get "netshift.${section}.subscription_user_agent" 2>/dev/null)"
+    cached_user_agent="$(cat "$user_agent_cache_path" 2>/dev/null)"
+    # Per-section format preference reorders the UA probe (auto|xray|singbox).
+    # Empty/unset -> auto (today's order); unknown values are treated as auto by
+    # the builder. The probe loop still keeps the first body with valid outbounds.
+    subscription_format_preference="$(uci -q get "netshift.${section}.subscription_format_preference" 2>/dev/null)"
+    [ -n "$subscription_format_preference" ] || subscription_format_preference="auto"
+    candidates_file="${tmpfile}.ua"
+    if ! build_subscription_user_agent_candidates "$configured_user_agent" "$cached_user_agent" "$subscription_format_preference" > "$candidates_file"; then
+        log "Failed to build subscription User-Agent candidate list for section '$section'" "error"
+        rm -f "$tmpfile" "$candidates_file"
+        return 11
+    fi
+
+    # Opt-in per-section insecure TLS fetch (default OFF = secure). When enabled
+    # download_subscription adds wget --no-check-certificate so IP-host panels
+    # with invalid/self-signed/missing-SAN certs work. Log once (redacted).
+    subscription_insecure="$(uci -q get "netshift.${section}.subscription_insecure" 2>/dev/null)"
+    [ -n "$subscription_insecure" ] || subscription_insecure=0
+    if [ "$subscription_insecure" = "1" ]; then
+        log "Subscription fetch for section '$section' uses --no-check-certificate (TLS verification disabled): url=$(redact_url_for_log "$subscription_url")" "warn"
+    fi
+
+    download_ok=0
+    winning_user_agent=""
+    fallback_tmp="${tmpfile}.fb"
+    # Each candidate gets the full download (with its own retries) + validate +
+    # fallback-normalize pipeline. First success wins.
+    while IFS= read -r effective_user_agent || [ -n "$effective_user_agent" ]; do
+        [ -n "$effective_user_agent" ] || continue
+
+        log "Trying subscription User-Agent for section '$section': $effective_user_agent" "info"
+
+        if ! download_subscription "$subscription_url" "$tmpfile" "$service_proxy_address" 3 2 10 "$effective_user_agent" "$subscription_insecure"; then
+            log "Subscription download failed for section '$section' with User-Agent '$effective_user_agent'; trying next candidate" "warn"
+            continue
+        fi
+
+        # Some panels return a gzip-compressed body unconditionally (we send no
+        # Accept-Encoding and busybox wget does not transparently decompress).
+        # Decompress in place before validate/normalize so every consumer sees
+        # text. Best-effort: a plain-text body is left untouched.
+        maybe_gunzip_subscription_file "$tmpfile"
+        if subscription_body_is_binary "$tmpfile"; then
+            log "Subscription body for section '$section' is binary/undecodable after gzip handling (not text, not gzip) with User-Agent '$effective_user_agent'; trying next candidate" "warn"
+            continue
+        fi
+
+        file_size="$(wc -c < "$tmpfile" 2>/dev/null | tr -d ' ')"
+        log "Downloaded subscription body for section '$section': bytes=${file_size:-unknown}, User-Agent='$effective_user_agent'" "debug"
+
+        if validate_subscription_file "$tmpfile"; then
+            download_ok=1
+            winning_user_agent="$effective_user_agent"
+            break
+        fi
+
+        # Fallback: provider returned base64 / plaintext key list or Xray JSON
+        # instead of a sing-box config.
+        if normalize_subscription_to_singbox "$tmpfile" "$fallback_tmp" "$section" && validate_subscription_file "$fallback_tmp"; then
+            mv -f "$fallback_tmp" "$tmpfile"
+            log "Subscription for section '$section' parsed via fallback with User-Agent '$effective_user_agent'" "info"
+            download_ok=1
+            winning_user_agent="$effective_user_agent"
+            break
+        fi
+        rm -f "$fallback_tmp"
+
+        validation_reason="$(describe_subscription_validation_failure "$tmpfile")"
+        log "Downloaded subscription for section '$section' is invalid with User-Agent '$effective_user_agent': ${validation_reason:-unknown validation error}; trying next candidate" "warn"
+    done < "$candidates_file"
+    rm -f "$candidates_file"
+
+    if [ "$download_ok" -ne 1 ]; then
+        log "No subscription User-Agent candidate produced valid outbounds for section '$section'" "error"
+        rm -f "$tmpfile" "$fallback_tmp"
+        return 13
+    fi
+
+    # Persist the winning User-Agent so the next refresh tries it first.
+    if [ -n "$winning_user_agent" ]; then
+        ua_tmpfile="${user_agent_cache_path}.tmp.$$"
+        if printf '%s' "$winning_user_agent" > "$ua_tmpfile" && mv "$ua_tmpfile" "$user_agent_cache_path"; then
+            chmod 600 "$user_agent_cache_path" 2>/dev/null
+        else
+            rm -f "$ua_tmpfile"
+        fi
+    fi
+
+    rejected_cache_path="$(get_subscription_rejected_cache_path "$section" "$urlhash")"
+    tmp_hash="$(md5sum "$tmpfile" 2>/dev/null | awk '{print $1}')"
+    rejected_hash="$(cat "$rejected_cache_path" 2>/dev/null)"
+    if [ -n "$tmp_hash" ] && [ "$tmp_hash" = "$rejected_hash" ]; then
+        log "Downloaded subscription for section '$section' is unchanged and was previously rejected because it contains no usable sing-box outbounds" "warn"
+        rm -f "$tmpfile"
+        return 14
+    fi
+
+    if [ -f "$subscription_json_path" ] && cmp -s "$tmpfile" "$subscription_json_path"; then
+        rm -f "$tmpfile"
+        if [ "$(cat "$subscription_url_cache_path" 2>/dev/null)" != "$subscription_url" ]; then
+            url_tmpfile="${subscription_url_cache_path}.tmp.$$"
+            if printf '%s' "$subscription_url" > "$url_tmpfile" && mv "$url_tmpfile" "$subscription_url_cache_path"; then
+                chmod 600 "$subscription_url_cache_path" 2>/dev/null
+            else
+                log "Subscription content for section '$section' is unchanged, but URL metadata could not be persisted; the next refresh may download it again" "warn"
+                rm -f "$url_tmpfile"
+            fi
+        fi
+        log "Subscription for section '$section' is unchanged" "info"
+        return 2
+    fi
+
+    persist_tmpfile="${subscription_json_path}.tmp.$$"
+    cp "$tmpfile" "$persist_tmpfile" && mv "$persist_tmpfile" "$subscription_json_path" || {
+        log "Failed to persist subscription cache for section '$section' to '$subscription_json_path'" "error"
+        rm -f "$tmpfile" "$persist_tmpfile"
+        return 15
+    }
+    rm -f "$tmpfile"
+    rm -f "$rejected_cache_path"
+
+    url_tmpfile="${subscription_url_cache_path}.tmp.$$"
+    printf '%s' "$subscription_url" > "$url_tmpfile" && mv "$url_tmpfile" "$subscription_url_cache_path" || {
+        # The valid JSON cache has already been atomically installed. Treat
+        # metadata failure as non-fatal so recovery reloads and applies it;
+        # only refresh deduplication is degraded until metadata can be written.
+        log "Subscription cache for section '$section' was updated, but URL metadata could not be persisted; applying the cache and retrying metadata on a later refresh" "warn"
+        rm -f "$url_tmpfile"
+    }
+    chmod 600 "$subscription_json_path" "$subscription_url_cache_path" 2>/dev/null
+    return 0
+}
+
+prepare_subscription_cache_for_startup() {
+    local section="$1"
+    local connection_type proxy_config_type urls_tmp url urlhash
+    local subscription_json_path subscription_url_cache_path cached_subscription_url
+    local service_proxy_address had_usable_cache cache_needs_refresh
+    local _download_lists_via_proxy section_any_usable url_count
+
+    config_get connection_type "$section" "connection_type"
+    [ "$connection_type" = "proxy" ] || return 0
+
+    config_get proxy_config_type "$section" "proxy_config_type"
+    [ "$proxy_config_type" = "subscription" ] || return 0
+
+    ensure_subscription_cache_dir || true
+    migrate_subscription_cache_from_tmp
+    # Reap any stale legacy bare-"${section}.<ext>" cache so it can never be read
+    # again (we always hash now).
+    reap_legacy_subscription_cache_files "$section"
+
+    urls_tmp="$(mktemp "${TMPDIR:-/tmp}/netshift-startup-urls.XXXXXX")" || {
+        log "Failed to create temporary URL list for section '$section'" "error"
+        return 0
+    }
+    get_subscription_urls_for_section "$section" > "$urls_tmp"
+    url_count=0
+    while IFS= read -r url || [ -n "$url" ]; do
+        [ -n "$url" ] && url_count=$((url_count + 1))
+    done < "$urls_tmp"
+
+    if [ "$url_count" -eq 0 ]; then
+        rm -f "$urls_tmp"
+        log "Subscription URL is not set for section '$section'. Aborted." "fatal"
+        exit 1
+    fi
+
+    config_get_bool _download_lists_via_proxy "settings" "download_lists_via_proxy" 0
+    if [ "$_download_lists_via_proxy" -eq 1 ]; then
+        log "download_lists_via_proxy is set, but sing-box is not running yet during startup. Bootstrapping subscription for section '$section' over a direct connection" "info"
+    fi
+
+    # Best-effort: each URL is downloaded independently; a single dead feed must
+    # not abort the others. The section is "available" if at least one feed has
+    # a usable cache after this pass.
+    section_any_usable=0
+    while IFS= read -r url || [ -n "$url" ]; do
+        [ -n "$url" ] || continue
+        urlhash="$(get_subscription_url_hash "$url")"
+        subscription_json_path="$(get_subscription_json_path "$section" "$urlhash")"
+        subscription_url_cache_path="$(get_subscription_url_cache_path "$section" "$urlhash")"
+
+        had_usable_cache=0
+        if subscription_cache_is_usable "$subscription_json_path"; then
+            had_usable_cache=1
+        else
+            rm -f "$subscription_json_path"
+        fi
+
+        cached_subscription_url=""
+        [ -f "$subscription_url_cache_path" ] && cached_subscription_url="$(cat "$subscription_url_cache_path" 2>/dev/null)"
+
+        cache_needs_refresh=0
+        if [ "$had_usable_cache" -eq 0 ] || [ "$cached_subscription_url" != "$url" ]; then
+            cache_needs_refresh=1
+        fi
+
+        if [ "$cache_needs_refresh" -eq 0 ]; then
+            section_any_usable=1
+            continue
+        fi
+
+        # Bootstrap directly: sing-box (and its service proxy) is not running yet.
+        service_proxy_address=""
+        if wait_for_subscription_connectivity "$section" "$url" "$service_proxy_address" 2 2 5 &&
+            download_subscription_into_cache \
+                "$section" "$url" "$subscription_json_path" "$subscription_url_cache_path" "$service_proxy_address" "$urlhash"; then
+            section_any_usable=1
+            continue
+        fi
+
+        if [ "$had_usable_cache" -eq 1 ]; then
+            log "Keeping cached subscription feed for section '$section' (url=$(redact_url_for_log "$url")) until a fresh download succeeds" "warn"
+            section_any_usable=1
+        else
+            log "Subscription feed for section '$section' (url=$(redact_url_for_log "$url")) is not reachable and has no usable cache yet" "warn"
+        fi
+    done < "$urls_tmp"
+    rm -f "$urls_tmp"
+
+    if [ "$section_any_usable" -eq 0 ]; then
+        log "No usable subscription cache for any feed of section '$section'; startup will continue with a temporary blocked outbound until a subscription becomes reachable" "warn"
+        subscription_startup_blocked=1
+    fi
+
+    return 0
+}
+
+prepare_subscription_caches_for_startup() {
+    subscription_startup_blocked=0
+    config_foreach prepare_subscription_cache_for_startup "section"
+
+    [ "$subscription_startup_blocked" -eq 0 ]
+}
+
+stop_subscription_startup_retry_worker() {
+    local pidfile="/var/run/netshift_subscription_retry.pid"
+
+    if [ -f "$pidfile" ]; then
+        pid="$(cat "$pidfile" 2> /dev/null)"
+        if [ -n "$pid" ] && kill -0 "$pid" 2> /dev/null; then
+            kill "$pid" 2> /dev/null
+            log "Stopped deferred startup recovery worker"
+        fi
+        rm -f "$pidfile"
+    fi
+}
+
+start_subscription_startup_retry_worker() {
+    local pidfile="/var/run/netshift_subscription_retry.pid"
+
+    if [ -f "$pidfile" ]; then
+        pid="$(cat "$pidfile" 2> /dev/null)"
+        if [ -n "$pid" ] && kill -0 "$pid" 2> /dev/null; then
+            log "Deferred startup recovery worker is already running" "debug"
+            return 0
+        fi
+        rm -f "$pidfile"
+    fi
+
+    (
+        trap 'rm -f "'"$pidfile"'"' EXIT INT TERM
+
+        # Let the primary sing-box instance come up first, so a configured
+        # service proxy can be used for the post-bootstrap refresh.
+        sleep 10
+
+        while true; do
+            config_load "$NETSHIFT_CONFIG"
+
+            # Run in a child process: a successful subscription_update performs
+            # its own restart, which stops this worker via the pidfile safely.
+            # Keep diagnostics visible in syslog; subscription URLs are redacted
+            # in the lower-level download helpers.
+            if /usr/bin/netshift subscription_update; then
+                log "Deferred subscription refresh succeeded; updated configuration is being applied" "info"
+                rm -f "$pidfile"
+                exit 0
+            fi
+
+            log "Deferred subscription refresh has not completed yet; retrying in background" "warn"
+            sleep 30
+        done
+    ) &
+
+    echo $! > "$pidfile"
+    log "Started deferred startup recovery worker with PID $!" "warn"
+}
+
+start_main() {
+    log "Starting netshift"
+
+    # Normalize legacy scalar `option subscription_url` to the canonical `list`
+    # shape BEFORE check_requirements / config generation read the URLs. The
+    # read-fallback in get_subscription_urls_for_section already covers
+    # correctness; this is hygiene that converges stored configs to a list.
+    migrate_legacy_subscription_url_option
+
+    check_requirements
+
+    migration
+
+    config_foreach process_validate_service "section"
+
+    br_netfilter_disable
+
+    # Sync time for DoH/DoT
+    /usr/sbin/ntpd -q -p 194.190.168.1 -p 216.239.35.0 -p 216.239.35.4 -p 162.159.200.1 -p 162.159.200.123
+
+    sleep 1
+
+    mkdir -p "$TMP_SING_BOX_FOLDER"
+    mkdir -p "$TMP_RULESET_FOLDER"
+    mkdir -p "$TMP_SUBSCRIPTION_FOLDER"
+    ensure_subscription_cache_dir
+    migrate_subscription_cache_from_tmp
+
+    prepare_subscription_caches_for_startup
+    if [ "$subscription_startup_blocked" -ne 0 ]; then
+        log "NetShift startup continues with temporary blocked subscription outbounds until sources become reachable" "warn"
+    fi
+    stop_subscription_startup_retry_worker
+
+    # base
+    route_table_rule_mark
+    create_nft_rules
+    sing_box_configure_service
+
+    # sing-box
+    sing_box_init_config
+    config_foreach add_cron_job "section"
+    config_foreach add_subscription_cron_job "section"
+    /etc/init.d/sing-box start
+
+    if [ "$subscription_startup_blocked" -ne 0 ]; then
+        start_subscription_startup_retry_worker
+    fi
+
+    log "Nice"
+    list_update &
+    echo $! > /var/run/netshift_list_update.pid
+}
+
+stop_main() {
+    log "Stopping the netshift"
+
+    stop_subscription_startup_retry_worker
+
+    if [ -f /var/run/netshift_list_update.pid ]; then
+        pid=$(cat /var/run/netshift_list_update.pid)
+        if kill -0 "$pid" 2> /dev/null; then
+            kill "$pid" 2> /dev/null
+            log "Stopped list_update"
+        fi
+        rm -f /var/run/netshift_list_update.pid
+    fi
+
+    remove_cron_job
+
+    rm -f "$TMP_RULESET_FOLDER"/*
+
+    log "Flush nft"
+    if nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
+        nft delete table inet "$NFT_TABLE_NAME"
+    fi
+
+    log "Flush ip rule"
+    ip -4 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+    ip -6 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+
+    log "Flush ip route"
+    ip -4 route flush table "$RT_TABLE_NAME" 2>/dev/null
+    ip -6 route flush table "$RT_TABLE_NAME" 2>/dev/null
+
+    log "Stop sing-box"
+    /etc/init.d/sing-box stop
+}
+
+start() {
+    local start_rc dont_touch_dhcp
+    start_main
+    start_rc=$?
+
+    if [ "$start_rc" -eq 2 ]; then
+        return 0
+    fi
+
+    if [ "$start_rc" -ne 0 ]; then
+        return "$start_rc"
+    fi
+
+    config_get_bool dont_touch_dhcp "settings" "dont_touch_dhcp" 0
+    if [ "$dont_touch_dhcp" -eq 0 ]; then
+        dnsmasq_configure force
+    fi
+
+    uci_set "netshift" "settings" "shutdown_correctly" 0
+    uci commit "netshift" && config_load "$NETSHIFT_CONFIG"
+
+    start_sing_box_monitor
+}
+
+_kill_stale_sing_box_monitors() {
+    # task-036: kill ALL detached health-monitor processes, not just the one
+    # currently named in MONITOR_PIDFILE.
+    #
+    # Why this is needed: each monitor self-writes its OWN $$ to MONITOR_PIDFILE
+    # at the top of monitor_sing_box (task-035), so the pidfile only ever
+    # remembers the LATEST monitor. A monitor spawned by a PRIOR reload whose pid
+    # was overwritten in the pidfile is invisible to stop() (which kills only the
+    # pidfile pid) → since the monitor is detached via setsid (own session,
+    # reparented to init) it survives stop()/reload forever → monitors leak
+    # (2-3 live monitors instead of exactly 1) after repeated reloads.
+    #
+    # The hidden `__monitor` subcommand is a unique, stable marker that matches
+    # ONLY the detached monitor (the re-exec'd argv is
+    # `/bin/ash /usr/bin/netshift __monitor`) and never the main netshift process
+    # or any other invocation. We MUST exclude our OWN pid ($$) and our parent
+    # ($PPID): the recovery path inside monitor_sing_box calls stop_main/start_main
+    # (NOT stop()/start_sing_box_monitor), so this helper is never reached from
+    # recovery — but excluding self is the belt that guarantees a monitor can
+    # never kill ITSELF even if a future caller wires this into a monitor-reachable
+    # path.
+    local selector="/usr/bin/netshift __monitor"
+    local self="$$"
+    local parent="${PPID:-0}"
+    local mpids mpid killed=0
+
+    if command -v pgrep > /dev/null 2>&1; then
+        # busybox pgrep supports -f (full-command-line match); already used by
+        # get_system_info (`pgrep -f "sing-box"`). Capture into a var and iterate
+        # with a counted `for` (no pipe) so the killed counter survives.
+        mpids="$(pgrep -f "$selector" 2> /dev/null)"
+    else
+        # Fallback for the rare box without pgrep: ps | grep, busybox-safe. Match
+        # the unique `__monitor` marker, drop the grep line itself.
+        mpids="$(ps w 2> /dev/null | grep "$selector" | grep -v grep | awk '{print $1}')"
+    fi
+
+    for mpid in $mpids; do
+        [ -n "$mpid" ] || continue
+        # Numeric guard (defensive: ps formats vary across busybox builds).
+        case "$mpid" in
+            *[!0-9]*) continue ;;
+        esac
+        # Never kill ourselves or our parent (the init/reload action).
+        [ "$mpid" = "$self" ] && continue
+        [ "$mpid" = "$parent" ] && continue
+        if kill -0 "$mpid" 2> /dev/null; then
+            kill "$mpid" 2> /dev/null
+            killed=$((killed + 1))
+        fi
+    done
+
+    if [ "$killed" -gt 0 ]; then
+        log "Terminated $killed stale sing-box health monitor(s)" "info"
+    fi
+}
+
+start_sing_box_monitor() {
+    local pidfile="$MONITOR_PIDFILE"
+    local pid waited
+
+    # task-036: reliably terminate EVERY prior monitor before spawning a new one,
+    # so exactly ONE monitor exists after any number of reloads/restarts. The old
+    # "return 0 if the pidfile pid is alive" guard was insufficient: a reload runs
+    # stop() (kills only the pidfile pid) then start() → here. Because each
+    # monitor overwrites the pidfile with its own pid, monitors from prior reloads
+    # were never recorded → never killed → leaked (orphaned, reparented to init by
+    # setsid). Killing ALL `__monitor` procs (excluding self/parent) closes that
+    # gap. We then ALWAYS spawn a fresh monitor bound to the just-(re)started
+    # sing-box, instead of skipping — a stale monitor from a prior config is not a
+    # valid substitute for one bound to the new run.
+    _kill_stale_sing_box_monitors
+    rm -f "$pidfile"
+
+    # CRITICAL (task-035): the health monitor is a long-lived `while true` loop.
+    # When start_main runs on the reload/restart path, procd holds its init
+    # service lock on fd 1000 (/tmp/lock/procd_<name>.lock). A bare
+    # `monitor_sing_box &` inherits ALL open fds, including fd 1000, so the
+    # monitor would hold the procd lock FOREVER and the NEXT reload/restart
+    # would block on `flock 1000` indefinitely (settings never re-applied).
+    #
+    # Detach the monitor from procd entirely:
+    #   - `setsid` puts it in its own session (no controlling terminal, not in
+    #     procd's process group), and re-execs /usr/bin/netshift fresh.
+    #   - `exec 1000>&-` closes the inherited procd lock fd in the child before
+    #     the re-exec, so even though exec does NOT close non-CLOEXEC fds, fd
+    #     1000 is already gone (harmless no-op on the plain start/boot path
+    #     where the lock fd is absent).
+    #   - `</dev/null >/dev/null 2>&1` drops the inherited stdio (procd's
+    #     stdout/stderr pipes) so the monitor never keeps those open either.
+    # The re-exec runs the hidden `__monitor` subcommand, which calls the
+    # existing monitor_sing_box function (detection/recovery logic unchanged)
+    # and writes its OWN pid to the pidfile (so stop() can still kill it
+    # regardless of how setsid forks/execs the chain).
+    setsid /bin/sh -c 'exec 1000>&- 2>/dev/null; exec /usr/bin/netshift __monitor' < /dev/null > /dev/null 2>&1 &
+
+    # The monitor child writes its real pid to the pidfile itself; wait briefly
+    # for it to appear so callers/diagnostics see a populated pidfile.
+    waited=0
+    while [ ! -s "$pidfile" ] && [ "$waited" -lt 20 ]; do
+        sleep 0.1 2> /dev/null || sleep 1
+        waited=$((waited + 1))
+    done
+
+    if [ -s "$pidfile" ]; then
+        pid="$(cat "$pidfile" 2> /dev/null)"
+        log "Started sing-box health monitor with PID $pid" "info"
+    else
+        log "Started sing-box health monitor (pid pending)" "info"
+    fi
+}
+
+stop() {
+    if [ -f "$MONITOR_PIDFILE" ]; then
+        local monitor_pid
+        monitor_pid="$(cat "$MONITOR_PIDFILE" 2>/dev/null)"
+        if [ -n "$monitor_pid" ] && kill -0 "$monitor_pid" 2>/dev/null; then
+            kill "$monitor_pid" 2>/dev/null
+            log "Stopped sing-box health monitor" "info"
+        fi
+        rm -f "$MONITOR_PIDFILE"
+    fi
+
+    # task-036: the pidfile only ever names the LATEST monitor, so a leaked
+    # monitor from a prior reload (detached via setsid, reparented to init) is
+    # invisible above. Reap ALL detached `__monitor` processes here so a clean
+    # stop leaves zero monitors running. Excludes self/parent.
+    _kill_stale_sing_box_monitors
+
+    local dont_touch_dhcp
+    config_get_bool dont_touch_dhcp "settings" "dont_touch_dhcp" 0
+    if [ "$dont_touch_dhcp" -eq 0 ]; then
+        dnsmasq_restore
+    fi
+
+    stop_main
+
+    uci_set "netshift" "settings" "shutdown_correctly" 1
+    uci commit "netshift" && config_load "$NETSHIFT_CONFIG"
+}
+
+monitor_sing_box() {
+    local crash_count=0
+    local backoff=0
+    local dont_touch_dhcp
+
+    # Record our OWN pid (task-035): the monitor runs detached via setsid, so
+    # the launcher cannot reliably capture the final pid of the exec/setsid
+    # chain. Writing $$ here is authoritative for stop()/diagnostics.
+    echo $$ > "$MONITOR_PIDFILE"
+
+    while true; do
+        sleep "$MONITOR_CHECK_INTERVAL"
+
+        if sing_box_process_exists; then
+            crash_count=0
+            backoff=0
+            continue
+        fi
+
+        config_load "$NETSHIFT_CONFIG"
+        local shutdown_correctly
+        config_get shutdown_correctly "settings" "shutdown_correctly"
+        if [ "$shutdown_correctly" -eq 1 ]; then
+            log "sing-box shutdown detected, exiting monitor" "info"
+            break
+        fi
+
+        crash_count=$((crash_count + 1))
+        log "sing-box process died unexpectedly (crash #$crash_count), restoring DNS" "warn"
+
+        dnsmasq_restore
+
+        if [ "$crash_count" -ge "$MONITOR_MAX_CRASHES" ]; then
+            log "sing-box crashed $crash_count times consecutively, giving up. DNS has been restored." "error"
+            break
+        fi
+
+        backoff=$((MONITOR_BACKOFF_BASE * (1 << (crash_count - 1))))
+        [ "$backoff" -gt "$MONITOR_BACKOFF_MAX" ] && backoff="$MONITOR_BACKOFF_MAX"
+        log "Waiting ${backoff}s before attempting sing-box restart" "warn"
+        sleep "$backoff"
+
+        config_load "$NETSHIFT_CONFIG"
+        config_get shutdown_correctly "settings" "shutdown_correctly"
+        if [ "$shutdown_correctly" -eq 1 ]; then
+            log "Clean shutdown requested, exiting monitor" "info"
+            break
+        fi
+
+        log "Attempting sing-box recovery restart" "warn"
+        stop_main
+        if start_main; then
+            config_get_bool dont_touch_dhcp "settings" "dont_touch_dhcp" 0
+            if [ "$dont_touch_dhcp" -eq 0 ]; then
+                dnsmasq_configure force
+            fi
+            log "NetShift recovered successfully after sing-box crash" "info"
+        else
+            log "Recovery restart failed, will retry" "error"
+        fi
+    done
+
+    rm -f "$MONITOR_PIDFILE"
+}
+
+sing_box_process_exists() {
+    pgrep "sing-box" > /dev/null 2>&1 || pidof sing-box > /dev/null 2>&1
+}
+
+reload() {
+    log "NetShift reload"
+    stop
+    start
+}
+
+restart() {
+    log "NetShift restart"
+    stop
+    start
+}
+
+# Migrations and validation funcs
+migration() {
+    :
+}
+
+# config_foreach callback for migrate_legacy_subscription_url_option. For a
+# subscription section whose subscription_url is stored as a scalar `option`
+# (legacy / CLI / podkop-migrated configs) rather than a UCI `list`, rewrite it
+# in place as a `list` via uci. Detects the broken shape robustly: the LIST read
+# (config_list_foreach) yields nothing AND a scalar config_get is non-empty —
+# exactly the option-only shape, so an already-correct list is never touched.
+# Sets the module-level SUBSCRIPTION_URL_OPTION_MIGRATED flag when it changes
+# anything so the caller commits + reloads exactly once. Never exits: any uci
+# failure is logged at warn and skipped (the read-fallback in
+# get_subscription_urls_for_section covers correctness regardless).
+_migrate_legacy_subscription_url_option_handler() {
+    local section="$1"
+    local connection_type proxy_config_type scalar_url
+
+    config_get connection_type "$section" "connection_type"
+    [ "$connection_type" = "proxy" ] || return 0
+
+    config_get proxy_config_type "$section" "proxy_config_type" "url"
+    [ "$proxy_config_type" = "subscription" ] || return 0
+
+    # Only the broken shape: empty via the list path but present as a scalar.
+    SUBSCRIPTION_URLS_COLLECTED=""
+    config_list_foreach "$section" "subscription_url" _collect_subscription_url_handler
+    [ -z "$SUBSCRIPTION_URLS_COLLECTED" ] || return 0
+
+    config_get scalar_url "$section" "subscription_url"
+    [ -n "$scalar_url" ] || return 0
+
+    # Rewrite the scalar option as a list. Use the uci_add_list SHELL HELPER
+    # (from /lib/functions.sh), NOT the `uci add_list "key=value"` CLI form: the
+    # CLI form splits on the FIRST `=`, so a URL with a query string (very common,
+    # e.g. "...?token=abc&x=1") makes the CLI add_list fail and lose the value.
+    # The helper passes the value as a separate argument, preserving `=`/`&`
+    # byte-for-byte. Delete the scalar first so the result is a CLEAN single-
+    # element list (adding while the scalar option still exists would duplicate
+    # it into a 2-element list); if the add then fails, RESTORE the scalar option
+    # so a failed migration can never leave the section with NO url. Never exits.
+    uci -q delete "netshift.${section}.subscription_url" 2>/dev/null
+    if uci_add_list netshift "$section" subscription_url "$scalar_url" 2>/dev/null; then
+        SUBSCRIPTION_URL_OPTION_MIGRATED=1
+        log "Migrated legacy scalar subscription_url to list for section '$section'" "info"
+    else
+        uci_set netshift "$section" subscription_url "$scalar_url"
+        log "Failed to migrate scalar subscription_url to list for section '$section'; restored the original option and continuing (read fallback covers correctness)" "warn"
+    fi
+}
+
+# One-time, idempotent normalization of a legacy scalar `option subscription_url`
+# into the canonical `list subscription_url`. Runs once at startup AFTER
+# config_load and BEFORE config generation reads the URLs. Idempotent: a config
+# already using `list` is left untouched (no commit, no churn). Never exits.
+migrate_legacy_subscription_url_option() {
+    SUBSCRIPTION_URL_OPTION_MIGRATED=0
+
+    config_foreach _migrate_legacy_subscription_url_option_handler "section"
+
+    if [ "$SUBSCRIPTION_URL_OPTION_MIGRATED" -eq 1 ]; then
+        if uci commit "netshift" 2>/dev/null; then
+            config_load "$NETSHIFT_CONFIG"
+        else
+            log "Failed to commit subscription_url option->list migration; continuing (read fallback covers correctness)" "warn"
+        fi
+    fi
+}
+
+validate_service() {
+    local service="$1"
+
+    for community_service in $COMMUNITY_SERVICES; do
+        if [ "$service" = "$community_service" ]; then
+            return 0
+        fi
+    done
+
+    log "Invalid service in community lists: $service. Check config and LuCI cache. Aborted." "fatal"
+    exit 1
+}
+
+process_validate_service() {
+    local section="$1"
+    local community_lists
+    config_get community_lists "$section" "community_lists"
+    if [ -n "$community_lists" ]; then
+        config_list_foreach "$section" "community_lists" validate_service
+    fi
+}
+
+br_netfilter_disable() {
+    if lsmod | grep -q br_netfilter && [ "$(sysctl -n net.bridge.bridge-nf-call-iptables 2> /dev/null)" = "1" ]; then
+        log "br_netfilter enabled detected. Disabling"
+        sysctl -w net.bridge.bridge-nf-call-iptables=0
+        sysctl -w net.bridge.bridge-nf-call-ip6tables=0
+    fi
+}
+
+# Main funcs
+
+route_table_rule_mark() {
+    grep -q "105 $RT_TABLE_NAME" /etc/iproute2/rt_tables || echo "105 $RT_TABLE_NAME" >> /etc/iproute2/rt_tables
+
+    log "Configure IPv4 route for tproxy" "debug"
+    ip -4 route replace local 0.0.0.0/0 dev lo table "$RT_TABLE_NAME" 2>/dev/null || \
+        ip -4 route add local 0.0.0.0/0 dev lo table "$RT_TABLE_NAME" 2>/dev/null
+
+    if netshift_ipv6_enabled; then
+        log "Configure IPv6 route for tproxy" "debug"
+        ip -6 route replace local ::/0 dev lo table "$RT_TABLE_NAME" 2>/dev/null || \
+            ip -6 route add local ::/0 dev lo table "$RT_TABLE_NAME" 2>/dev/null
+    fi
+
+    log "Configure IPv4 marking rule" "debug"
+    ip -4 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+    ip -4 rule add fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+
+    if netshift_ipv6_enabled; then
+        log "Configure IPv6 marking rule" "debug"
+        ip -6 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+        ip -6 rule add fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105 2>/dev/null
+    fi
+}
+
+netshift_ipv6_enabled() {
+    local enable_ipv6
+    config_get_bool enable_ipv6 "settings" "enable_ipv6" 0
+
+    [ "$enable_ipv6" -eq 1 ] || return 1
+    ip -6 addr show dev lo 2>/dev/null | grep -q '::1'
+}
+
+nft_init_interfaces_set() {
+    nft_create_ifname_set "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME"
+
+    local source_network_interfaces
+    config_get source_network_interfaces "settings" "source_network_interfaces" "br-lan"
+
+    for interface in $source_network_interfaces; do
+        nft add element inet "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME" "{ $interface }"
+    done
+}
+
+# ── task-034: destination-selective marking population ──────────────────────
+# The prerouting `mangle` chain marks ONLY proxied destinations into tproxy.
+# Those destinations live in the union nft set NFT_COMMON_SET_NAME (IPv4) and
+# its IPv6 mirror NFT_COMMON_SET_NAME_V6. These two helpers are the SINGLE
+# centralized population point: every place that adds an ip_cidr to a sing-box
+# route rule_set ALSO calls one of these so the nft set and the sing-box
+# rule_set cannot drift (the historical 0.8.5 two-sources-of-truth fragility).
+#
+# Fail-open: if the set does not exist yet (table not built) or a line is
+# malformed, that subnet simply isn't marked (goes direct) — never a blackhole.
+
+# Add the IPv4/IPv6 CIDRs found in a file into the union destination set(s).
+populate_netshift_subnets_from_file() {
+    local filepath="$1"
+
+    [ -f "$filepath" ] || return 0
+
+    if nft list set inet "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME" > /dev/null 2>&1; then
+        nft_add_set_elements_from_file_chunked "$filepath" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
+    fi
+
+    if netshift_ipv6_enabled &&
+        nft list set inet "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME_V6" > /dev/null 2>&1; then
+        nft_add_set_elements_from_file_chunked_v6 "$filepath" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME_V6"
+    fi
+}
+
+# Add a comma/space-separated string of CIDRs into the union destination set(s).
+# Items are written to a temp file and routed through the file-based path so the
+# v4/v6 split logic is shared.
+populate_netshift_subnets_from_string() {
+    local items="$1"
+    local tmpfile
+
+    [ -n "$items" ] || return 0
+
+    tmpfile="$(mktemp)" || return 0
+    printf '%s\n' "$items" | tr ', ' '\n\n' > "$tmpfile"
+    populate_netshift_subnets_from_file "$tmpfile"
+    rm -f "$tmpfile"
+}
+
+# task-034: add source-based mark-all rules for every section's fully_routed_ips
+# (LAN clients whose ALL traffic must enter sing-box, regardless of destination).
+# Only used in the destination-selective default mode; under global_proxy ALL
+# traffic is already marked. Fail-open: a missing/empty list adds no rule.
+nft_mark_fully_routed_source_ips() {
+    config_foreach _nft_mark_fully_routed_ips_for_section "section"
+}
+
+_nft_mark_fully_routed_ips_for_section() {
+    local section="$1"
+    local connection_type fully_routed_ips ip
+
+    config_get connection_type "$section" "connection_type"
+    case "$connection_type" in
+    proxy | vpn) ;;
+    *) return 0 ;;
+    esac
+
+    config_get fully_routed_ips "$section" "fully_routed_ips"
+    [ -n "$fully_routed_ips" ] || return 0
+
+    _nft_fully_routed_list_seen=""
+    config_list_foreach "$section" "fully_routed_ips" _nft_mark_fully_routed_ip_handler
+    # Fallback for option-form (space-separated) values.
+    if [ -z "$_nft_fully_routed_list_seen" ]; then
+        for ip in $fully_routed_ips; do
+            _nft_mark_fully_routed_ip_handler "$ip"
+        done
+    fi
+}
+
+_nft_mark_fully_routed_ip_handler() {
+    local ip="$1"
+
+    _nft_fully_routed_list_seen=1
+    [ -n "$ip" ] || return 0
+
+    case "$ip" in
+    *:*)
+        if netshift_ipv6_enabled; then
+            nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip6 saddr "$ip" meta mark set "$NFT_FAKEIP_MARK" counter
+        fi
+        ;;
+    *)
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip saddr "$ip" meta mark set "$NFT_FAKEIP_MARK" counter
+        ;;
+    esac
+}
+
+create_nft_rules() {
+    # Rebuild the table deterministically. `nft add chain`/`nft add rule` only
+    # ever APPEND, so if a NetShiftTable was left behind by a previous start
+    # that was not cleanly stopped (procd respawn, in-place package upgrade, or
+    # a crash), its STALE rules survive and the new rules pile on top. A leftover
+    # mark-EVERYTHING rule would then sit at the top of the prerouting chain and
+    # mark all traffic before the destination-selective rules below ever run —
+    # re-introducing the 100% CPU regression even though the selective code is
+    # present. Flush first so create_nft_rules always yields exactly this chain.
+    log "Flush stale nft table before rebuild"
+    nft_delete_table "$NFT_TABLE_NAME"
+
+    log "Create nft table"
+    nft_create_table "$NFT_TABLE_NAME"
+
+    log "Create localv4 set"
+    nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_LOCALV4_SET_NAME"
+    nft add element inet "$NFT_TABLE_NAME" localv4 '{
+        0.0.0.0/8,
+        10.0.0.0/8,
+        127.0.0.0/8,
+        169.254.0.0/16,
+        172.16.0.0/12,
+        192.0.0.0/24,
+        192.0.2.0/24,
+        192.88.99.0/24,
+        192.168.0.0/16,
+        198.51.100.0/24,
+        203.0.113.0/24,
+        224.0.0.0/4,
+        240.0.0.0-255.255.255.255
+    }'
+
+    if netshift_ipv6_enabled; then
+        log "Create localv6 set"
+        nft_create_ipv6_set "$NFT_TABLE_NAME" "$NFT_LOCALV6_SET_NAME"
+        nft add element inet "$NFT_TABLE_NAME" localv6 '{
+            ::1,
+            fc00::/7,
+            fe80::/10,
+            ff00::/8
+        }'
+    fi
+
+    log "Create proxied-subnets union set"
+    nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
+    if netshift_ipv6_enabled; then
+        nft_create_ipv6_set "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME_V6"
+    fi
+
+    log "Create interface set"
+    nft_init_interfaces_set
+
+    log "Create nft rules"
+    nft add chain inet "$NFT_TABLE_NAME" mangle '{ type filter hook prerouting priority -150; policy accept; }'
+    nft add chain inet "$NFT_TABLE_NAME" mangle_output '{ type route hook output priority -150; policy accept; }'
+    nft add chain inet "$NFT_TABLE_NAME" proxy '{ type filter hook prerouting priority -100; policy accept; }'
+
+    nft add rule inet "$NFT_TABLE_NAME" mangle ct status dnat return
+    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "@$NFT_LOCALV4_SET_NAME" return
+    if netshift_ipv6_enabled; then
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip6 daddr "@$NFT_LOCALV6_SET_NAME" return
+    fi
+
+    # task-034: destination-selective marking.
+    #
+    # DEFAULT (no global_proxy section): mark ONLY traffic whose DESTINATION is
+    #   - a proxied subnet (@NFT_COMMON_SET_NAME / its v6 mirror), or
+    #   - the FakeIP range (proxied DOMAINS resolve to FakeIPs via the dns-in
+    #     inbound, so marking the FakeIP range carries domain routing in), or
+    #   - a DoH-block CIDR (when block_doh is on, so DoH probes are forced into
+    #     sing-box where the route-level reject rule drops them).
+    # Everything else (a torrent/4K stream to a random direct IP) is NEVER
+    # marked -> never enters sing-box -> CPU stays at 0.8.5 levels.
+    # `fully_routed_ips` are SOURCE clients whose ALL traffic must be proxied,
+    # so they are marked by source regardless of destination.
+    #
+    # GLOBAL_PROXY OVERRIDE: when a global_proxy section is active, ALL LAN
+    # tcp/udp is legitimately wanted inside sing-box (it routes every unmatched
+    # flow through the proxy), so we keep the mark-EVERYTHING rules. The same
+    # condition is read independently here (UCI only, via get_global_proxy_section)
+    # because create_nft_rules runs separately from sing_box_configure_route.
+    local nft_global_proxy_section
+    nft_global_proxy_section="$(get_global_proxy_section)"
+    if [ -n "$nft_global_proxy_section" ]; then
+        log "Global proxy section '$nft_global_proxy_section' active: marking ALL LAN traffic into sing-box" "info"
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
+    else
+        # Source-based mark-all for fully_routed_ips clients (regardless of dest).
+        nft_mark_fully_routed_source_ips
+
+        # Destination-selective: proxied subnets (union set).
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "@$NFT_COMMON_SET_NAME" meta mark set "$NFT_FAKEIP_MARK" counter
+        # Destination-selective: FakeIP range (proxied domains).
+        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "$SB_FAKEIP_INET4_RANGE" meta mark set "$NFT_FAKEIP_MARK" counter
+        if netshift_ipv6_enabled; then
+            nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip6 daddr "@$NFT_COMMON_SET_NAME_V6" meta mark set "$NFT_FAKEIP_MARK" counter
+            nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip6 daddr "$SB_FAKEIP_INET6_RANGE" meta mark set "$NFT_FAKEIP_MARK" counter
+        fi
+
+        # DoH-block CIDRs (when enabled): force well-known DoH resolver IPs into
+        # sing-box so the route-level DoH reject rule can drop them.
+        local nft_block_doh
+        config_get_bool nft_block_doh "settings" "block_doh" 0
+        if [ "$nft_block_doh" -eq 1 ]; then
+            log "DoH blocking enabled: marking DoH resolver CIDRs into sing-box" "info"
+            local doh_cidr
+            for doh_cidr in $DOH_BLOCK_IPV4_CIDRS; do
+                nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "$doh_cidr" meta mark set "$NFT_FAKEIP_MARK" counter
+            done
+            if netshift_ipv6_enabled; then
+                for doh_cidr in $DOH_BLOCK_IPV6_CIDRS; do
+                    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip6 daddr "$doh_cidr" meta mark set "$NFT_FAKEIP_MARK" counter
+                done
+            fi
+        fi
+    fi
+
+    nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto tcp tproxy ip to "$SB_TPROXY_INBOUND_ADDRESS:$SB_TPROXY_INBOUND_PORT" counter
+    nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto udp tproxy ip to "$SB_TPROXY_INBOUND_ADDRESS:$SB_TPROXY_INBOUND_PORT" counter
+    if netshift_ipv6_enabled; then
+        nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto tcp tproxy ip6 to "[$SB_TPROXY_INBOUND_ADDRESS_V6]:$SB_TPROXY_INBOUND_PORT_V6" counter
+        nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto udp tproxy ip6 to "[$SB_TPROXY_INBOUND_ADDRESS_V6]:$SB_TPROXY_INBOUND_PORT_V6" counter
+    fi
+
+    # Router-originated (locally generated) traffic is left DIRECT on purpose.
+    # The model marks only LAN/forwarded traffic in `mangle` (prerouting) above
+    # and delegates the proxy/direct split to sing-box route rules; the router's
+    # own outgoing traffic is NOT proxied. These mangle_output rules only handle
+    # the returns needed to keep that traffic direct: local/loopback daddr returns
+    # and the outbound-mark return (sing-box-originated packets carrying
+    # NFT_OUTBOUND_MARK must not be re-marked into the tproxy path -> avoids a
+    # routing loop). Proxying router-originated traffic (the old mangle_output
+    # @common/FakeIP daddr marking) was dropped deliberately to avoid such loops.
+    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "@$NFT_LOCALV4_SET_NAME" return
+    if netshift_ipv6_enabled; then
+        nft add rule inet "$NFT_TABLE_NAME" mangle_output ip6 daddr "@$NFT_LOCALV6_SET_NAME" return
+    fi
+    nft add rule inet "$NFT_TABLE_NAME" mangle_output meta mark "$NFT_OUTBOUND_MARK" counter return
+
+    local exclude_ntp
+    config_get_bool exclude_ntp "settings" "exclude_ntp" "0"
+    if [ "$exclude_ntp" -eq 1 ]; then
+        log "NTP traffic exclude for proxy"
+        nft insert rule inet "$NFT_TABLE_NAME" mangle udp dport 123 return
+    fi
+}
+
+backup_dnsmasq_config_option() {
+    local key="$1"
+    local backup_key="$2"
+    local value
+    value="$(uci_get "dhcp" "@dnsmasq[0]" "$key")"
+
+    if [ -n "$value" ]; then
+        uci_set "dhcp" "@dnsmasq[0]" "$backup_key" "$value"
+    fi
+}
+
+uci_remove_quiet() {
+    local config="$1"
+    local section="$2"
+    local option="$3"
+
+    uci -q delete "$config.$section.$option" 2>/dev/null
+}
+
+dnsmasq_is_configured_for_netshift() {
+    local configured
+
+    # The authoritative "netshift owns this dnsmasq config" flag is the
+    # netshift_configured sentinel that dnsmasq_configure sets unconditionally
+    # AFTER applying our config, and dnsmasq_restore clears on teardown. We do
+    # NOT infer ownership from the live server/noresolv/cachesize values: on a
+    # stock dnsmasq with no original server/noresolv/cachesize, dnsmasq_configure
+    # writes no backup markers, and after it runs the live values ARE netshift's
+    # own (noresolv=1, cachesize=0) — so a value-based or marker-based check
+    # could not distinguish "we configured it" from "an admin coincidentally set
+    # the same values", and the redundant `dnsmasq_configure force` path (monitor
+    # recovery / double-start) would re-run "backup" and capture netshift's own
+    # values as the backup, corrupting the later restore. The sentinel is the
+    # single source of truth.
+    configured="$(uci_get "dhcp" "@dnsmasq[0]" "netshift_configured")"
+    [ "$configured" = "1" ]
+}
+
+dnsmasq_configure() {
+    local force shutdown_correctly
+    force="$1"
+    config_get shutdown_correctly "settings" "shutdown_correctly"
+    if [ "$force" != "force" ] && [ "$shutdown_correctly" -eq 0 ]; then
+        log "Previous shutdown of netshift was not correct, reconfiguration of dnsmasq is not required"
+        return 0
+    fi
+
+    if dnsmasq_is_configured_for_netshift; then
+        log "dnsmasq is already configured for sing-box"
+        return 0
+    fi
+
+    log "Backup dnsmasq configuration"
+    current_servers="$(uci_get "dhcp" "@dnsmasq[0]" "server")"
+    if [ -n "$current_servers" ]; then
+        for server in $(uci_get "dhcp" "@dnsmasq[0]" "server"); do
+            if ! [ "$server" = "$SB_DNS_INBOUND_ADDRESS" ]; then
+                uci_add_list "dhcp" "@dnsmasq[0]" "netshift_server" "$server"
+            fi
+        done
+        uci_remove_quiet "dhcp" "@dnsmasq[0]" "server"
+    fi
+
+    backup_dnsmasq_config_option "noresolv" "netshift_noresolv"
+    backup_dnsmasq_config_option "cachesize" "netshift_cachesize"
+
+    log "Configure dnsmasq for sing-box"
+    uci_add_list "dhcp" "@dnsmasq[0]" "server" "$SB_DNS_INBOUND_ADDRESS"
+    uci_set "dhcp" "@dnsmasq[0]" "noresolv" 1
+    uci_set "dhcp" "@dnsmasq[0]" "cachesize" 0
+    # Authoritative ownership sentinel (see dnsmasq_is_configured_for_netshift):
+    # marks that netshift, not the admin, applied this dnsmasq config. Set
+    # unconditionally after our config is applied; cleared in dnsmasq_restore.
+    uci_set "dhcp" "@dnsmasq[0]" "netshift_configured" 1
+    uci_commit "dhcp"
+
+    /etc/init.d/dnsmasq restart
+}
+
+dnsmasq_restore() {
+    log "Restoring the dnsmasq configuration"
+    local shutdown_correctly
+    config_get shutdown_correctly "settings" "shutdown_correctly"
+    if [ "$shutdown_correctly" -eq 1 ]; then
+        log "Previous shutdown of netshift was correct, reconfiguration of dnsmasq is not required"
+        return 0
+    fi
+
+    local cachesize noresolv backup_servers resolvfile
+    log "Restoring cachesize" "debug"
+    cachesize="$(uci_get "dhcp" "@dnsmasq[0]" "netshift_cachesize")"
+    if [ -z "$cachesize" ]; then
+        uci_remove_quiet "dhcp" "@dnsmasq[0]" "cachesize"
+        uci_set "dhcp" "@dnsmasq[0]" "cachesize" 150
+    else
+        uci_set "dhcp" "@dnsmasq[0]" "cachesize" "$cachesize"
+        uci_remove_quiet "dhcp" "@dnsmasq[0]" "netshift_cachesize"
+    fi
+
+    log "Restoring noresolv" "debug"
+    noresolv="$(uci_get "dhcp" "@dnsmasq[0]" "netshift_noresolv")"
+    if [ -z "$noresolv" ]; then
+        uci_set "dhcp" "@dnsmasq[0]" "noresolv" 0
+    else
+        uci_set "dhcp" "@dnsmasq[0]" "noresolv" "$noresolv"
+        uci_remove_quiet "dhcp" "@dnsmasq[0]" "netshift_noresolv"
+    fi
+
+    log "Restoring DNS servers" "debug"
+    uci_remove_quiet "dhcp" "@dnsmasq[0]" "server"
+    resolvfile="/tmp/resolv.conf.d/resolv.conf.auto"
+    backup_servers="$(uci_get "dhcp" "@dnsmasq[0]" "netshift_server")"
+    if [ -n "$backup_servers" ]; then
+        for server in $backup_servers; do
+            uci_add_list "dhcp" "@dnsmasq[0]" "server" "$server"
+        done
+        uci_remove_quiet "dhcp" "@dnsmasq[0]" "netshift_server"
+    elif file_exists "$resolvfile"; then
+        log "Backup DNS servers not found, using default resolvfile" "debug"
+        uci_set "dhcp" "@dnsmasq[0]" "resolvfile" "$resolvfile"
+        if [ -n "$noresolv" ] && [ "$noresolv" -eq 1 ]; then
+            log "Disabling noresolv option to use system resolvfile" "debug"
+            uci_set "dhcp" "@dnsmasq[0]" "noresolv" 0
+        fi
+    else
+        log "Backup DNS servers and default resolvfile not found, possible resolving issues" "warn"
+    fi
+
+    # Clear the ownership sentinel so a fresh future dnsmasq_configure
+    # re-establishes ownership cleanly (and dnsmasq_is_configured_for_netshift
+    # no longer short-circuits once we have torn down).
+    uci_remove_quiet "dhcp" "@dnsmasq[0]" "netshift_configured"
+
+    uci_commit "dhcp"
+
+    /etc/init.d/dnsmasq restart
+}
+
+add_cron_job() {
+    ## Future: make a check so that it doesn't recreate many times
+    local community_lists remote_domain_lists remote_subnet_lists update_interval
+    config_get community_lists "$section" "community_lists"
+    config_get remote_domain_lists "$section" "remote_domain_lists"
+    config_get remote_subnet_lists "$section" "remote_subnet_lists"
+    config_get update_interval "settings" "update_interval"
+
+    case "$update_interval" in
+    "1h")
+        cron_job="13 * * * * /usr/bin/netshift list_update"
+        ;;
+    "3h")
+        cron_job="13 */3 * * * /usr/bin/netshift list_update"
+        ;;
+    "12h")
+        cron_job="13 */12 * * * /usr/bin/netshift list_update"
+        ;;
+    "1d")
+        cron_job="13 9 * * * /usr/bin/netshift list_update"
+        ;;
+    "3d")
+        cron_job="13 9 */3 * * /usr/bin/netshift list_update"
+        ;;
+    *)
+        log "Invalid update_interval value: $update_interval"
+        return
+        ;;
+    esac
+
+    if [ -n "$community_lists" ] ||
+        [ -n "$remote_domain_lists" ] ||
+        [ -n "$remote_subnet_lists" ]; then
+        remove_cron_job
+        crontab -l | {
+            cat
+            echo "$cron_job"
+        } | crontab -
+        log "The cron job has been created: $cron_job"
+    fi
+}
+
+remove_cron_job() {
+    (crontab -l | grep -v "/usr/bin/netshift list_update" | grep -v "/usr/bin/netshift subscription_update") | crontab -
+    log "The cron job removed"
+}
+
+add_subscription_cron_job() {
+    local section="$1"
+    local connection_type proxy_config_type subscription_update_interval cron_job
+
+    config_get connection_type "$section" "connection_type"
+    if [ "$connection_type" != "proxy" ]; then
+        return
+    fi
+
+    config_get proxy_config_type "$section" "proxy_config_type"
+    if [ "$proxy_config_type" != "subscription" ]; then
+        return
+    fi
+
+    config_get subscription_update_interval "$section" "subscription_update_interval" "1h"
+
+    case "$subscription_update_interval" in
+    "30m")
+        cron_job="*/30 * * * * /usr/bin/netshift subscription_update"
+        ;;
+    "1h")
+        cron_job="17 * * * * /usr/bin/netshift subscription_update"
+        ;;
+    "3h")
+        cron_job="17 */3 * * * /usr/bin/netshift subscription_update"
+        ;;
+    "6h")
+        cron_job="17 */6 * * * /usr/bin/netshift subscription_update"
+        ;;
+    "12h")
+        cron_job="17 */12 * * * /usr/bin/netshift subscription_update"
+        ;;
+    "1d")
+        cron_job="17 9 * * * /usr/bin/netshift subscription_update"
+        ;;
+    *)
+        log "Invalid subscription_update_interval value: $subscription_update_interval"
+        return
+        ;;
+    esac
+
+    # Avoid duplicate subscription cron
+    (crontab -l | grep -v "/usr/bin/netshift subscription_update") | {
+        cat
+        echo "$cron_job"
+    } | crontab -
+    log "The subscription cron job has been created: $cron_job"
+}
+ensure_nft_ready_for_list_update() {
+    if nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
+        return 0
+    fi
+
+    log "NFT table '$NFT_TABLE_NAME' is missing before lists update, recreating nft rules" "warn"
+    route_table_rule_mark
+    create_nft_rules
+
+    if ! nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
+        log "Failed to recreate NFT table '$NFT_TABLE_NAME'" "error"
+        return 1
+    fi
+
+    return 0
+}
+
+
+list_update() {
+    echolog "🔄 Starting lists update..."
+
+    local nslookup_timeout=3
+    local nslookup_attempts=10
+    local curl_timeout=5
+    local curl_attempts=10
+    local curl_max_timeout=10
+    local delay=3
+    local i
+
+    # DNS Check
+    for i in $(seq 1 $nslookup_attempts); do
+        if nslookup -timeout=$nslookup_timeout openwrt.org > /dev/null 2>&1; then
+            echolog "✅ DNS check passed"
+            break
+        fi
+        echolog "DNS is unavailable [$i/$nslookup_attempts]"
+        sleep $delay
+    done
+
+    if [ "$i" -eq $nslookup_attempts ]; then
+        echolog "❌ DNS check failed after $nslookup_attempts attempts"
+        return 1
+    fi
+
+    # Github Check
+    for i in $(seq 1 $curl_attempts); do
+        local service_proxy_address
+        service_proxy_address="$(get_service_proxy_address)"
+
+        if [ -n "$service_proxy_address" ]; then
+            if curl -s -x "http://$service_proxy_address" -m $curl_timeout https://github.com > /dev/null; then
+                echolog "✅ GitHub connection check passed (via proxy)"
+                break
+            fi
+        else
+            if curl -s -m $curl_timeout https://github.com > /dev/null; then
+                echolog "✅ GitHub connection check passed"
+                break
+            fi
+        fi
+
+        echolog "GitHub is unavailable [$i/$curl_attempts] (max-timeout=$curl_timeout)"
+        if [ "$curl_timeout" -lt $curl_max_timeout ]; then
+            curl_timeout=$((curl_timeout + 1))
+        fi
+        sleep $delay
+    done
+
+    if [ "$i" -eq $curl_attempts ]; then
+        echolog "❌ GitHub connection check failed after $curl_attempts attempts"
+        return 1
+    fi
+
+    if ! ensure_nft_ready_for_list_update; then
+        echolog "❌ NFT table is unavailable, cannot update lists"
+        return 1
+    fi
+
+    echolog "📥 Downloading and processing lists..."
+
+    local update_failed=0
+    config_foreach import_community_subnet_lists "section" || update_failed=1
+    config_foreach import_domains_from_remote_domain_lists "section" || update_failed=1
+    config_foreach import_subnets_from_remote_subnet_lists "section" || update_failed=1
+
+    if [ "$update_failed" -eq 0 ]; then
+        echolog "✅ Lists update completed successfully"
+    else
+        echolog "❌ Lists update failed"
+        return 1
+    fi
+}
+
+subscription_update() {
+    echolog "🔄 Starting subscription update..."
+
+    local has_subscription=0
+    local updated_sections=0
+    local failed_sections=0
+
+    _check_subscription_section() {
+        local section="$1"
+        local connection_type proxy_config_type
+
+        config_get connection_type "$section" "connection_type"
+        if [ "$connection_type" != "proxy" ]; then
+            return
+        fi
+
+        config_get proxy_config_type "$section" "proxy_config_type"
+        if [ "$proxy_config_type" = "subscription" ]; then
+            has_subscription=1
+        fi
+    }
+    config_foreach _check_subscription_section "section"
+
+    if [ "$has_subscription" -eq 0 ]; then
+        echolog "ℹ️ No subscription sections found, nothing to update"
+        return 0
+    fi
+
+    _update_subscription_for_section() {
+        local section="$1"
+        local connection_type proxy_config_type url urlhash subscription_json_path
+        local subscription_url_cache_path service_proxy_address update_result outbounds_count
+        local urls_tmp url_count section_changed feed_usable_count feed_failed_count
+
+        config_get connection_type "$section" "connection_type"
+        if [ "$connection_type" != "proxy" ]; then
+            return
+        fi
+
+
+        config_get proxy_config_type "$section" "proxy_config_type"
+        if [ "$proxy_config_type" != "subscription" ]; then
+            return
+        fi
+
+        mkdir -p "$TMP_SUBSCRIPTION_FOLDER"
+        if ! ensure_subscription_cache_dir; then
+            echolog "❌ Subscription cache directory is unavailable for section '$section'"
+            failed_sections=$((failed_sections + 1))
+            return
+        fi
+        reap_legacy_subscription_cache_files "$section"
+
+        urls_tmp="$(mktemp "${TMPDIR:-/tmp}/netshift-refresh-urls.XXXXXX")" || {
+            echolog "❌ Failed to enumerate subscription URLs for section '$section'"
+            failed_sections=$((failed_sections + 1))
+            return
+        }
+        get_subscription_urls_for_section "$section" > "$urls_tmp"
+        url_count=0
+        while IFS= read -r url || [ -n "$url" ]; do
+            [ -n "$url" ] && url_count=$((url_count + 1))
+        done < "$urls_tmp"
+
+        if [ "$url_count" -eq 0 ]; then
+            rm -f "$urls_tmp"
+            echolog "❌ Subscription URL not set for section '$section'"
+            failed_sections=$((failed_sections + 1))
+            return
+        fi
+
+        echolog "📥 Updating subscription for section '$section' ($url_count feed(s))..."
+
+        # Best-effort per-feed download. The section is "changed" (→ restart) if
+        # ANY feed changed; the section "failed" only if ALL feeds failed AND none
+        # has a usable cache. One dead feed never aborts the others.
+        section_changed=0
+        feed_usable_count=0
+        feed_failed_count=0
+        while IFS= read -r url || [ -n "$url" ]; do
+            [ -n "$url" ] || continue
+            urlhash="$(get_subscription_url_hash "$url")"
+            subscription_json_path="$(get_subscription_json_path "$section" "$urlhash")"
+            subscription_url_cache_path="$(get_subscription_url_cache_path "$section" "$urlhash")"
+
+            service_proxy_address="$(get_subscription_download_proxy_address "$section" "runtime" || echo '')"
+            if [ -n "$service_proxy_address" ]; then
+                log "Updating subscription feed for section '$section' (url=$(redact_url_for_log "$url")) via service proxy $service_proxy_address" "info"
+            else
+                log "Updating subscription feed for section '$section' (url=$(redact_url_for_log "$url")) directly" "info"
+            fi
+
+            if ! wait_for_subscription_connectivity "$section" "$url" "$service_proxy_address" 6 5 5; then
+                echolog "⚠️ Subscription feed not reachable for section '$section': url=$(redact_url_for_log "$url")"
+                feed_failed_count=$((feed_failed_count + 1))
+                subscription_cache_is_usable "$subscription_json_path" && feed_usable_count=$((feed_usable_count + 1))
+                continue
+            fi
+
+            download_subscription_into_cache \
+                "$section" "$url" "$subscription_json_path" "$subscription_url_cache_path" "$service_proxy_address" "$urlhash"
+            update_result=$?
+
+            case "$update_result" in
+            0)
+                section_changed=1
+                feed_usable_count=$((feed_usable_count + 1))
+                outbounds_count=$(jq -r '[.outbounds[] | select(
+                    .type != "selector" and
+                    .type != "urltest" and
+                    .type != "direct" and
+                    .type != "dns" and
+                    .type != "block"
+                )] | length' "$subscription_json_path" 2>/dev/null)
+                echolog "✅ Subscription feed updated for section '$section': $outbounds_count outbounds (url=$(redact_url_for_log "$url"))"
+                ;;
+            2)
+                feed_usable_count=$((feed_usable_count + 1))
+                echolog "ℹ️ Subscription feed for section '$section' is unchanged (url=$(redact_url_for_log "$url"))"
+                ;;
+            *)
+                feed_failed_count=$((feed_failed_count + 1))
+                # A previously cached body for this feed still counts as usable.
+                subscription_cache_is_usable "$subscription_json_path" && feed_usable_count=$((feed_usable_count + 1))
+                echolog "⚠️ Subscription feed failed for section '$section' (rc=$update_result): url=$(redact_url_for_log "$url")"
+                ;;
+            esac
+        done < "$urls_tmp"
+        rm -f "$urls_tmp"
+
+        if [ "$section_changed" -eq 1 ]; then
+            updated_sections=$((updated_sections + 1))
+            if [ "$feed_failed_count" -gt 0 ]; then
+                echolog "✅ Subscription updated for section '$section' ($feed_failed_count feed(s) failed and kept their previous cache)"
+            else
+                echolog "✅ Subscription updated for section '$section'"
+            fi
+            return
+        fi
+
+        if [ "$feed_usable_count" -eq 0 ]; then
+            echolog "❌ Failed to update any subscription feed for section '$section'"
+            failed_sections=$((failed_sections + 1))
+            return
+        fi
+
+        echolog "ℹ️ Subscription for section '$section' is unchanged"
+    }
+    config_foreach _update_subscription_for_section "section"
+
+    if [ "$updated_sections" -eq 0 ]; then
+        if [ "$failed_sections" -gt 0 ]; then
+            echolog "❌ Subscription update finished with errors; keeping the last working cache"
+            return 1
+        fi
+
+        echolog "ℹ️ Subscription update completed: no changes detected"
+        return 0
+    fi
+
+    echolog "🔄 Restarting netshift to apply updated subscriptions..."
+    restart
+    restart_rc=$?
+    if [ "$restart_rc" -ne 0 ]; then
+        echolog "❌ Subscription was downloaded, but netshift restart failed"
+        return "$restart_rc"
+    fi
+
+    if [ "$failed_sections" -gt 0 ]; then
+        echolog "✅ Subscription update applied for changed sections; failed sections kept their previous cache"
+    else
+        echolog "✅ Subscription update completed"
+    fi
+}
+
+# Worker for `component_action subscription clear_cache` (updater.sh router).
+# Wipes ALL per-feed subscription cache files under SUBSCRIPTION_CACHE_FOLDER
+# (the four "${section}.<md5(url)>.{json,url,rejected,user_agent}" sidecars per
+# feed), then re-runs subscription_update verbatim so every feed is re-downloaded
+# fresh, re-validated, and the service restarts on change. Deleting the .json
+# defeats the unchanged guard and deleting the .rejected defeats the rejected-hash
+# veto, so the redownload is a genuine full reset.
+#
+# CRITICAL: this runs inside the component_action async fork (component_action_async
+# → "$0" component_action subscription clear_cache). It MUST echo a single JSON
+# result and `return N` — NEVER `exit` (an exit would kill the fork before the
+# finished-state file is written). Mirrors the updates_* workers' echo+return
+# discipline.
+#
+# SAFETY: the globbed delete is guarded so a mistyped/empty SUBSCRIPTION_CACHE_FOLDER
+# can never become `rm -f /*`. We require a non-empty constant AND an existing
+# directory before `rm -f "$SUBSCRIPTION_CACHE_FOLDER"/*`, and only ever remove the
+# directory CONTENTS — never `rm -rf` the directory itself.
+subscription_clear_cache_and_redownload() {
+    local has_subscription removed cache_file update_rc
+
+    # Detect whether any subscription section is configured at all. If none,
+    # there is nothing to clear or redownload — succeed gracefully.
+    has_subscription=0
+    _detect_subscription_section_for_clear() {
+        local section="$1"
+        local connection_type proxy_config_type
+
+        config_get connection_type "$section" "connection_type"
+        [ "$connection_type" = "proxy" ] || return 0
+
+        config_get proxy_config_type "$section" "proxy_config_type"
+        [ "$proxy_config_type" = "subscription" ] && has_subscription=1
+    }
+    config_foreach _detect_subscription_section_for_clear "section"
+
+    # Guarded full-reset delete of the cache directory CONTENTS. The two guards
+    # (non-empty constant AND existing directory) make a wild `rm -f /*`
+    # impossible. No error when the directory is empty or missing.
+    removed=0
+    if [ -n "$SUBSCRIPTION_CACHE_FOLDER" ] && [ -d "$SUBSCRIPTION_CACHE_FOLDER" ]; then
+        for cache_file in "$SUBSCRIPTION_CACHE_FOLDER"/*; do
+            [ -e "$cache_file" ] || continue
+            rm -f "$cache_file" 2>/dev/null && removed=$((removed + 1))
+        done
+    fi
+    log "Cleared subscription cache: removed $removed file(s) from '$SUBSCRIPTION_CACHE_FOLDER'" "info"
+
+    if [ "$has_subscription" -eq 0 ]; then
+        echo "{\"success\":true,\"message\":\"No subscriptions configured; cleared $removed cache file(s), nothing to redownload\"}"
+        return 0
+    fi
+
+    # Reuse subscription_update ENTIRELY for the redownload + re-validate + restart.
+    subscription_update
+    update_rc=$?
+
+    if [ "$update_rc" -eq 0 ]; then
+        echo "{\"success\":true,\"message\":\"Cleared $removed subscription cache file(s) and re-downloaded all feeds\"}"
+        return 0
+    fi
+
+    echo "{\"success\":false,\"message\":\"Cleared $removed subscription cache file(s) but the redownload failed (rc=$update_rc); kept the last working cache\"}"
+    return "$update_rc"
+}
+
+# sing-box funcs
+sing_box_configure_service() {
+    local sing_box_enabled sing_box_user sing_box_config_path sing_box_conffile
+    sing_box_enabled="$(uci_get "sing-box" "main" "enabled")"
+    sing_box_user="$(uci_get "sing-box" "main" "user")"
+
+    if [ "$sing_box_enabled" -ne 1 ]; then
+        uci_set "sing-box" "main" "enabled" 1
+        uci_commit "sing-box"
+        log "sing-box service has been enabled"
+    fi
+
+    if [ "$sing_box_user" != "root" ]; then
+        uci_set "sing-box" "main" "user" "root"
+        uci_commit "sing-box"
+        log "sing-box service user has been changed to root"
+    fi
+
+    config_get sing_box_config_path "settings" "config_path"
+    sing_box_conffile="$(uci_get "sing-box" "main" "conffile")"
+    log "sing-box config path: $sing_box_config_path" "debug"
+    log "sing-box service conffile: $sing_box_conffile" "debug"
+    if [ "$sing_box_conffile" != "$sing_box_config_path" ]; then
+        uci_set "sing-box" "main" "conffile" "$sing_box_config_path"
+        uci_commit "sing-box"
+        log "Configuration file path has been set to $sing_box_config_path"
+    fi
+
+    [ -f /etc/rc.d/S99sing-box ] && log "Disable sing-box" && /etc/init.d/sing-box disable
+}
+
+sing_box_init_config() {
+    local config='{"log":{},"dns":{},"ntp":{},"certificate":{},"endpoints":[],"inbounds":[],"outbounds":[],"route":{},"services":[],"experimental":{}}'
+
+    sing_box_configure_log
+    sing_box_configure_inbounds
+    sing_box_configure_outbounds
+    sing_box_configure_dns
+    sing_box_configure_route
+    sing_box_configure_experimental
+    sing_box_additional_inbounds
+    sing_box_save_config
+}
+
+sing_box_configure_log() {
+    log "Configure the log section of a sing-box JSON configuration"
+
+    local log_level
+    config_get log_level "settings" "log_level" "warn"
+    config=$(sing_box_cm_configure_log "$config" false "$log_level" false)
+}
+
+sing_box_configure_inbounds() {
+    log "Configure the inbounds section of a sing-box JSON configuration"
+
+    config=$(
+        sing_box_cm_add_tproxy_inbound \
+            "$config" "$SB_TPROXY_INBOUND_TAG" "$SB_TPROXY_INBOUND_ADDRESS" "$SB_TPROXY_INBOUND_PORT" true true
+    )
+    config=$(
+        sing_box_cm_add_direct_inbound "$config" "$SB_DNS_INBOUND_TAG" "$SB_DNS_INBOUND_ADDRESS" "$SB_DNS_INBOUND_PORT"
+    )
+    if netshift_ipv6_enabled; then
+        config=$(
+            sing_box_cm_add_tproxy_inbound \
+                "$config" "${SB_TPROXY_INBOUND_TAG}-v6" "$SB_TPROXY_INBOUND_ADDRESS_V6" "$SB_TPROXY_INBOUND_PORT_V6" true true
+        )
+        # Local processes may query this inbound directly via [::1]:5354.
+        # dnsmasq intentionally keeps using 127.0.0.42:53: router clients cannot
+        # reach loopback ::1, and the IPv4 DNS inbound resolves AAAA records too.
+        config=$(
+            sing_box_cm_add_direct_inbound "$config" "${SB_DNS_INBOUND_TAG}-v6" "$SB_DNS_INBOUND_ADDRESS_V6" "$SB_DNS_INBOUND_PORT_V6"
+        )
+    fi
+}
+
+sing_box_configure_outbounds() {
+    log "Configure the outbounds section of a sing-box JSON configuration"
+
+    SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+    config=$(sing_box_cm_add_direct_outbound "$config" "$SB_DIRECT_OUTBOUND_TAG")
+
+    config_foreach configure_outbound_handler "section"
+}
+
+sing_box_get_unique_outbound_tag() {
+    local config="$1"
+    local base_tag="$2"
+    local candidate="$base_tag"
+    local tag_suffix=1
+
+    while printf '%s' "$config" | jq -e --arg tag "$candidate" '.outbounds[]? | select(.tag == $tag)' > /dev/null 2>&1; do
+        candidate="${base_tag}-${tag_suffix}"
+        tag_suffix=$((tag_suffix + 1))
+    done
+
+    echo "$candidate"
+}
+
+# Mode-aware subscription group-key builder (task-044). Generalizes the former
+# country-only grouper into off/country/prefix modes. Returns the shape
+# {group_order: [...], groups: {key: [tags]}, ungrouped: [...]}.
+#   - mode=country: byte-identical to the legacy flag extractor (regional-
+#     indicator gate; non-flag tags -> ungrouped).
+#   - mode=prefix: group key = first N codepoints of the tag (N = $3). A tag
+#     shorter than N codepoints keys by its WHOLE tag (still groups with
+#     identical short tags); an empty tag -> ungrouped. $3 is coerced via
+#     tonumber, floored to 1; bad/0/empty -> default 2.
+# No Oniguruma jq (explode/implode/slice/index/reduce only).
+sing_box_build_subscription_groups() {
+    local subscription_outbound_tags_json="$1"
+    local mode="$2"
+    local prefix_len="$3"
+
+    printf '%s' "$subscription_outbound_tags_json" | jq -c \
+        --arg mode "$mode" \
+        --arg prefix_len "$prefix_len" \
+        --argjson default_len "$SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN" '
+        def is_regional_indicator: . >= 127462 and . <= 127487;
+        def extract_country_flag:
+            (. | explode) as $codepoints
+            | if ($codepoints | length) >= 2
+                and ($codepoints[0] | is_regional_indicator)
+                and ($codepoints[1] | is_regional_indicator)
+              then ($codepoints[0:2] | implode)
+              else ""
+              end;
+        # extract_prefix($n): group key = first $n codepoints, or "" (ungrouped)
+        # for an empty tag. A short tag keys by its whole self.
+        def extract_prefix($n):
+            (. | explode) as $codepoints
+            | if ($codepoints | length) == 0
+              then ""
+              else ($codepoints[0:$n] | implode)
+              end;
+
+        # Effective prefix length: coerce, floor to 1, fall back to default.
+        (try ($prefix_len | tonumber) catch $default_len) as $raw_len
+        | (if ($raw_len | type) != "number" or $raw_len < 1
+            then $default_len
+            else ($raw_len | floor)
+            end) as $n
+
+        | (if type == "array" then . else [] end) as $tags
+        | reduce $tags[] as $tag (
+            {group_order: [], groups: {}, ungrouped: []};
+            (if $mode == "prefix" then ($tag | extract_prefix($n))
+             else ($tag | extract_country_flag) end) as $key
+            | if $key == "" then
+                .ungrouped += [$tag]
+              else
+                .groups[$key] = ((.groups[$key] // []) + [$tag])
+                | if (.group_order | index($key)) == null then
+                    .group_order += [$key]
+                  else
+                    .
+                  end
+              end
+        )
+    ' 2>/dev/null
+}
+
+is_truthy_option() {
+    local value="$1"
+
+    case "$value" in
+    1|true|TRUE|True|on|ON|yes|YES|enabled|ENABLED)
+        return 0
+        ;;
+    *)
+        return 1
+        ;;
+    esac
+}
+
+configure_outbound_handler() {
+    local section="$1"
+
+    local connection_type
+    config_get connection_type "$section" "connection_type"
+    case "$connection_type" in
+    proxy)
+        log "Configuring outbound in proxy connection type for the $section section"
+        local proxy_config_type
+        config_get proxy_config_type "$section" "proxy_config_type"
+
+        case "$proxy_config_type" in
+        url)
+            log "Detected proxy configuration type: url" "debug"
+            local proxy_string udp_over_tcp
+            config_get proxy_string "$section" "proxy_string"
+            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
+
+            if [ -z "$proxy_string" ]; then
+                log "Proxy string is not set. Aborted." "fatal"
+                exit 1
+            fi
+            # The facade returns non-zero (config echoed UNCHANGED) when the link
+            # uses an unsupported scheme. For a single-URL section that is the
+            # only node, so there is no outbound to fall back to: surface a clear
+            # error and mark the section unavailable (reject route rule) instead
+            # of exiting — the rest of the config still generates and the service
+            # still starts. Reassign $config only on a non-empty result so a
+            # skip (or a defensively-empty echo) never wipes the config.
+            local _new_config
+            if _new_config="$(sing_box_cf_add_proxy_outbound "$config" "$section" "$proxy_string" "$udp_over_tcp")" \
+                && [ -n "$_new_config" ]; then
+                config="$_new_config"
+            else
+                echolog "Proxy link for section '$section' uses an unsupported scheme and was skipped; this section has no usable outbound and its traffic will be rejected until a supported link is configured" "error"
+                mark_section_outbound_unavailable "$section"
+            fi
+            ;;
+        outbound)
+            log "Detected proxy configuration type: outbound" "debug"
+            local json_outbound
+            config_get json_outbound "$section" "outbound_json"
+            config=$(sing_box_cf_add_json_outbound "$config" "$section" "$json_outbound")
+            ;;
+        selector)
+            log "Detected proxy configuration type: selector" "debug"
+            local selector_proxy_links udp_over_tcp i outbound_tags outbound_tag default_outbound _new_config
+            config_get selector_proxy_links "$section" "selector_proxy_links"
+            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
+
+            if [ -z "$selector_proxy_links" ]; then
+                log "URLTest proxy links is not set. Aborted." "fatal"
+                exit 1
+            fi
+
+            i=1
+            for link in $selector_proxy_links; do
+                # The facade returns non-zero (config echoed UNCHANGED) for an
+                # unsupported scheme. Only add the member tag when the outbound
+                # was actually created, so the selector never references a
+                # non-existent outbound; a single bad link is skipped and the
+                # remaining links still build. Reassign $config only on a
+                # non-empty result so a skip never wipes the config.
+                if _new_config="$(sing_box_cf_add_proxy_outbound "$config" "$section-$i" "$link" "$udp_over_tcp")" \
+                    && [ -n "$_new_config" ]; then
+                    config="$_new_config"
+                    outbound_tag="$(get_outbound_tag_by_section "$section-$i")"
+                    if [ -z "$outbound_tags" ]; then
+                        outbound_tags="$outbound_tag"
+                        default_outbound="$outbound_tag"
+                    else
+                        outbound_tags="$outbound_tags,$outbound_tag"
+                    fi
+                else
+                    log "Selector section '$section' link #$i uses an unsupported scheme; skipping it" "warn"
+                fi
+                i=$((i + 1))
+            done
+
+            if [ -z "$outbound_tags" ]; then
+                echolog "Selector section '$section' has no usable links (all unsupported); its traffic will be rejected until a supported link is configured" "error"
+                mark_section_outbound_unavailable "$section"
+            else
+                selector_tag="$(get_outbound_tag_by_section "$section")"
+                selector_outbounds="$(comma_string_to_json_array "$outbound_tags")"
+                config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" \
+                    "$default_outbound" "true")"
+            fi
+            ;;
+        urltest)
+            log "Detected proxy configuration type: urltest" "debug"
+            local urltest_proxy_links udp_over_tcp i urltest_tag selector_tag outbound_tag outbound_tags \
+                urltest_outbounds selector_outbounds urltest_check_interval urltest_tolerance urltest_testing_url _new_config
+            config_get urltest_proxy_links "$section" "urltest_proxy_links"
+            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
+            config_get urltest_check_interval "$section" "urltest_check_interval" "3m"
+            config_get urltest_tolerance "$section" "urltest_tolerance" 50
+            config_get urltest_testing_url "$section" "urltest_testing_url" "https://www.gstatic.com/generate_204"
+
+            if [ -z "$urltest_proxy_links" ]; then
+                log "URLTest proxy links is not set. Aborted." "fatal"
+                exit 1
+            fi
+
+            i=1
+            for link in $urltest_proxy_links; do
+                # The facade returns non-zero (config echoed UNCHANGED) for an
+                # unsupported scheme. Only add the member tag when the outbound
+                # was actually created, so the urltest/selector never references
+                # a non-existent outbound; a single bad link is skipped and the
+                # remaining links still build. Reassign $config only on a
+                # non-empty result so a skip never wipes the config.
+                if _new_config="$(sing_box_cf_add_proxy_outbound "$config" "$section-$i" "$link" "$udp_over_tcp")" \
+                    && [ -n "$_new_config" ]; then
+                    config="$_new_config"
+                    outbound_tag="$(get_outbound_tag_by_section "$section-$i")"
+                    if [ -z "$outbound_tags" ]; then
+                        outbound_tags="$outbound_tag"
+                    else
+                        outbound_tags="$outbound_tags,$outbound_tag"
+                    fi
+                else
+                    log "URLTest section '$section' link #$i uses an unsupported scheme; skipping it" "warn"
+                fi
+                i=$((i + 1))
+            done
+
+            if [ -z "$outbound_tags" ]; then
+                echolog "URLTest section '$section' has no usable links (all unsupported); its traffic will be rejected until a supported link is configured" "error"
+                mark_section_outbound_unavailable "$section"
+            else
+                urltest_tag="$(get_outbound_tag_by_section "$section-urltest")"
+                selector_tag="$(get_outbound_tag_by_section "$section")"
+                urltest_outbounds="$(comma_string_to_json_array "$outbound_tags")"
+                selector_outbounds="$(comma_string_to_json_array "$outbound_tags,$urltest_tag")"
+                config="$(sing_box_cm_add_urltest_outbound "$config" "$urltest_tag" "$urltest_outbounds" \
+                    "$urltest_testing_url" "$urltest_check_interval" "$urltest_tolerance")"
+                config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" "$urltest_tag" "true")"
+            fi
+            ;;
+        subscription)
+            log "Detected proxy configuration type: subscription" "debug"
+            local subscription_urls_tmp subscription_url subscription_url_count urltest_tag selector_tag \
+                urltest_outbounds selector_outbounds urltest_check_interval urltest_tolerance \
+                urltest_testing_url group_mode group_mode_raw prefix_len prefix_len_raw legacy_group_raw \
+                subscription_outbound_tags_json service_proxy_address subscription_ready \
+                subscription_filter_include_keywords_json subscription_filter_exclude_keywords_json \
+                subscription_keyword_filter_active urlhash subscription_json_path subscription_url_cache_path \
+                cached_subscription_url should_download had_usable_cache merged_json_path merged_node_count \
+                usable_feed_count feed_node_count merged_tmp
+
+            config_get urltest_check_interval "$section" "urltest_check_interval" "3m"
+            config_get urltest_tolerance "$section" "urltest_tolerance" 50
+            config_get urltest_testing_url "$section" "urltest_testing_url" "https://www.gstatic.com/generate_204"
+            # Grouping mode (task-044): off | country | prefix. The new
+            # subscription_group_mode option OUTRANKS the legacy boolean. When
+            # the new option is absent we fall back to the legacy boolean
+            # subscription_group_by_countries (and its older alias
+            # group_by_countries): truthy => country, else off.
+            config_get group_mode_raw "$section" "subscription_group_mode" ""
+            config_get prefix_len_raw "$section" "subscription_group_prefix_len" "$SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN"
+
+            if [ -z "$group_mode_raw" ]; then
+                config_get legacy_group_raw "$section" "subscription_group_by_countries" ""
+                if [ -z "$legacy_group_raw" ]; then
+                    config_get legacy_group_raw "$section" "group_by_countries" ""
+                fi
+                if is_truthy_option "$legacy_group_raw"; then
+                    group_mode="country"
+                else
+                    group_mode="off"
+                fi
+            else
+                case "$group_mode_raw" in
+                off | country | prefix)
+                    group_mode="$group_mode_raw"
+                    ;;
+                *)
+                    group_mode="off"
+                    ;;
+                esac
+            fi
+
+            # Sanitize the prefix length: positive integer only, else default.
+            case "$prefix_len_raw" in
+            '' | *[!0-9]*)
+                prefix_len="$SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN"
+                ;;
+            *)
+                if [ "$prefix_len_raw" -ge 1 ] 2>/dev/null; then
+                    prefix_len="$prefix_len_raw"
+                else
+                    prefix_len="$SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN"
+                fi
+                ;;
+            esac
+
+            if [ "$group_mode" = "prefix" ]; then
+                log "Subscription grouping for section '$section': mode=$group_mode, prefix_len=$prefix_len" "debug"
+            else
+                log "Subscription grouping for section '$section': mode=$group_mode" "debug"
+            fi
+
+            # Keyword whitelist/blacklist filtering of subscription nodes by
+            # display name. Both are optional UCI lists of opaque match strings.
+            subscription_filter_include_keywords_json="$(build_subscription_filter_keywords_json "$section" "subscription_filter_include_keywords")"
+            subscription_filter_exclude_keywords_json="$(build_subscription_filter_keywords_json "$section" "subscription_filter_exclude_keywords")"
+            subscription_keyword_filter_active=0
+            if [ "$subscription_filter_include_keywords_json" != "[]" ] || [ "$subscription_filter_exclude_keywords_json" != "[]" ]; then
+                subscription_keyword_filter_active=1
+                log "Subscription keyword filter enabled for section '$section': include=$subscription_filter_include_keywords_json, exclude=$subscription_filter_exclude_keywords_json" "debug"
+            fi
+
+            mkdir -p "$TMP_SUBSCRIPTION_FOLDER"
+            ensure_subscription_cache_dir || true
+            migrate_subscription_cache_from_tmp
+            # Always hash per URL; reap any stale legacy bare-"${section}.<ext>".
+            reap_legacy_subscription_cache_files "$section"
+
+            subscription_urls_tmp="$(mktemp "${TMPDIR:-/tmp}/netshift-cfg-urls.XXXXXX")" || {
+                log "Failed to enumerate subscription URLs for section '$section'. Aborted." "fatal"
+                exit 1
+            }
+            get_subscription_urls_for_section "$section" > "$subscription_urls_tmp"
+            subscription_url_count=0
+            while IFS= read -r subscription_url || [ -n "$subscription_url" ]; do
+                [ -n "$subscription_url" ] && subscription_url_count=$((subscription_url_count + 1))
+            done < "$subscription_urls_tmp"
+
+            if [ "$subscription_url_count" -eq 0 ]; then
+                rm -f "$subscription_urls_tmp"
+                log "Subscription URL is not set. Aborted." "fatal"
+                exit 1
+            fi
+
+            log "Section '$section' has $subscription_url_count subscription feed(s)" "debug"
+
+            # ── Per-feed download (best-effort) ─────────────────────────────
+            # Each URL is downloaded/validated/normalized into its own per-URL
+            # cache. One dead/empty feed must NOT abort the others.
+            while IFS= read -r subscription_url || [ -n "$subscription_url" ]; do
+                [ -n "$subscription_url" ] || continue
+                urlhash="$(get_subscription_url_hash "$subscription_url")"
+                subscription_json_path="$(get_subscription_json_path "$section" "$urlhash")"
+                subscription_url_cache_path="$(get_subscription_url_cache_path "$section" "$urlhash")"
+                should_download=0
+                had_usable_cache=0
+
+                if subscription_cache_is_usable "$subscription_json_path"; then
+                    had_usable_cache=1
+                else
+                    rm -f "$subscription_json_path"
+                    should_download=1
+                fi
+
+                if [ -f "$subscription_url_cache_path" ]; then
+                    cached_subscription_url="$(cat "$subscription_url_cache_path" 2>/dev/null)"
+                else
+                    cached_subscription_url=""
+                fi
+
+                if [ "$cached_subscription_url" != "$subscription_url" ]; then
+                    if [ "$had_usable_cache" -eq 0 ]; then
+                        should_download=1
+                    else
+                        log "Using cached subscription feed for section '$section' (url=$(redact_url_for_log "$subscription_url")) until a fresh download succeeds" "warn"
+                    fi
+                fi
+
+                if [ "$should_download" -eq 1 ]; then
+                    log "Downloading subscription feed for section '$section' (url=$(redact_url_for_log "$subscription_url"))"
+                    # Config generation runs before sing-box is started. Never
+                    # use its local download proxy here; runtime refresh will.
+                    service_proxy_address="$(get_subscription_download_proxy_address "$section" "bootstrap" 2>/dev/null || echo '')"
+
+                    if ! wait_for_subscription_connectivity "$section" "$subscription_url" "$service_proxy_address" 1 0 5 ||
+                        ! download_subscription_into_cache \
+                            "$section" "$subscription_url" "$subscription_json_path" "$subscription_url_cache_path" "$service_proxy_address" "$urlhash"; then
+                        if [ "$had_usable_cache" -eq 1 ]; then
+                            log "Failed to refresh subscription feed for section '$section' (url=$(redact_url_for_log "$subscription_url")), continuing with cached data" "warn"
+                        else
+                            log "Failed to download subscription feed for section '$section' (url=$(redact_url_for_log "$subscription_url"))" "warn"
+                        fi
+                    fi
+                fi
+            done < "$subscription_urls_tmp"
+
+            # ── Merge all usable per-URL caches into one JSON ───────────────
+            # Concatenate the proxy .outbounds[] of every usable feed into a
+            # single { "outbounds": [...] } temp file, then run the existing
+            # facade ONCE so its keyword filter + global tag-dedup (auto -2/-3
+            # for same-named nodes across feeds) + per-batch sing-box check
+            # bisection + the country-group/selector builder all operate over
+            # the MERGED union, exactly as for a single feed.
+            mkdir -p "$TMP_SUBSCRIPTION_MERGE_FOLDER"
+            merged_json_path="$(mktemp "$TMP_SUBSCRIPTION_MERGE_FOLDER/${section}.merged.XXXXXX")" || {
+                rm -f "$subscription_urls_tmp"
+                log "Failed to create merged subscription file for section '$section'. Aborted." "fatal"
+                exit 1
+            }
+            printf '%s' '{"outbounds":[]}' > "$merged_json_path"
+            usable_feed_count=0
+            while IFS= read -r subscription_url || [ -n "$subscription_url" ]; do
+                [ -n "$subscription_url" ] || continue
+                urlhash="$(get_subscription_url_hash "$subscription_url")"
+                subscription_json_path="$(get_subscription_json_path "$section" "$urlhash")"
+                subscription_cache_is_usable "$subscription_json_path" || {
+                    log "Subscription feed for section '$section' has no usable cache; skipping (url=$(redact_url_for_log "$subscription_url"))" "warn"
+                    continue
+                }
+
+                feed_node_count="$(jq -r '[.outbounds[]? | select(
+                    .type != "selector" and .type != "urltest" and
+                    .type != "direct" and .type != "dns" and .type != "block"
+                )] | length' "$subscription_json_path" 2>/dev/null)"
+                [ -n "$feed_node_count" ] || feed_node_count=0
+
+                # Append this feed's proxy outbounds onto the merged set. No
+                # Oniguruma: pure array concat with --slurpfile.
+                merged_tmp="${merged_json_path}.tmp.$$"
+                if jq -c --slurpfile feed "$subscription_json_path" '
+                    .outbounds += [ $feed[0].outbounds[]? | select(
+                        .type != "selector" and .type != "urltest" and
+                        .type != "direct" and .type != "dns" and .type != "block"
+                    ) ]
+                ' "$merged_json_path" > "$merged_tmp" 2>/dev/null && [ -s "$merged_tmp" ]; then
+                    mv "$merged_tmp" "$merged_json_path"
+                    usable_feed_count=$((usable_feed_count + 1))
+                    log "Subscription feed for section '$section' contributed $feed_node_count node(s) (url=$(redact_url_for_log "$subscription_url"))" "info"
+                else
+                    rm -f "$merged_tmp"
+                    log "Failed to merge subscription feed for section '$section' (url=$(redact_url_for_log "$subscription_url"))" "warn"
+                fi
+            done < "$subscription_urls_tmp"
+            rm -f "$subscription_urls_tmp"
+
+            merged_node_count="$(jq -r '.outbounds | length' "$merged_json_path" 2>/dev/null)"
+            [ -n "$merged_node_count" ] || merged_node_count=0
+            log "Subscription for section '$section': merged $merged_node_count node(s) from $usable_feed_count usable feed(s)" "info"
+
+            subscription_ready=0
+            # A merged file with >=1 proxy outbound is a real subscription set.
+            if [ "$usable_feed_count" -gt 0 ] && [ "$merged_node_count" -gt 0 ]; then
+                chmod 600 "$merged_json_path" 2>/dev/null
+                if sing_box_cf_add_subscription_outbounds "$config" "$section" "$merged_json_path" \
+                    "$subscription_filter_include_keywords_json" "$subscription_filter_exclude_keywords_json" > /dev/null; then
+                    if [ -n "$SUBSCRIPTION_OUTBOUND_TAGS" ]; then
+                        config="$SING_BOX_CF_LAST_CONFIG"
+                        subscription_ready=1
+                    fi
+                fi
+            fi
+            rm -f "$merged_json_path"
+
+            if [ "$subscription_ready" -eq 0 ]; then
+                # When the keyword filter empties the set, the precise cause is
+                # already logged facade-side (only on the cache-usable branch
+                # where add_subscription_outbounds actually ran the filter), so we
+                # do not re-warn here to avoid misattribution / double-warning.
+                log "Subscription cache for section '$section' is unavailable or empty; using a temporary blocked outbound" "warn"
+                mark_subscription_outbound_unavailable "$section" "$subscription_keyword_filter_active"
+            else
+                selector_tag="$(get_outbound_tag_by_section "$section")"
+                subscription_outbound_tags_json="$SUBSCRIPTION_OUTBOUND_TAGS_JSON"
+                if [ -z "$subscription_outbound_tags_json" ] || [ "$subscription_outbound_tags_json" = "[]" ]; then
+                    subscription_outbound_tags_json="$(comma_string_to_json_array "$SUBSCRIPTION_OUTBOUND_TAGS")"
+                fi
+
+                if [ "$group_mode" != "off" ]; then
+                    local grouping_json group_key group_outbounds group_tag group_keys_tmp \
+                        selector_outbounds_json selector_default ungrouped_outbounds_json grouped_count ungrouped_count
+
+                    grouping_json="$(sing_box_build_subscription_groups "$subscription_outbound_tags_json" "$group_mode" "$prefix_len")"
+                    if [ -z "$grouping_json" ]; then
+                        log "Failed to build grouped subscription outbounds for section '$section'. Aborted." "fatal"
+                        exit 1
+                    fi
+
+                    grouped_count="$(echo "$grouping_json" | jq -r '.group_order | length' 2>/dev/null)"
+                    ungrouped_count="$(echo "$grouping_json" | jq -r '.ungrouped | length' 2>/dev/null)"
+                    log "Subscription grouping prepared for section '$section' (mode=$group_mode): groups=$grouped_count, ungrouped=$ungrouped_count" "debug"
+
+                    selector_outbounds_json="[]"
+
+                    # Iterate group keys WITHOUT word-splitting: prefix-mode keys
+                    # can legitimately contain spaces (e.g. a "letter+space"
+                    # prefix), which a `for k in $(...)` loop would shatter. Use
+                    # the same mktemp + `while read < file` pattern as the URL
+                    # loop above so the body runs in the CURRENT shell and its
+                    # mutations to $config / $selector_outbounds_json survive
+                    # (a `... | while read` body would run in a subshell and lose
+                    # them). One key per line; group keys never contain newlines.
+                    group_keys_tmp="$(mktemp "${TMPDIR:-/tmp}/netshift-cfg-groupkeys.XXXXXX")" || {
+                        log "Failed to enumerate subscription group keys for section '$section'. Aborted." "fatal"
+                        exit 1
+                    }
+                    echo "$grouping_json" | jq -r '.group_order[]' 2>/dev/null > "$group_keys_tmp"
+                    while IFS= read -r group_key || [ -n "$group_key" ]; do
+                        group_outbounds="$(echo "$grouping_json" | jq -c --arg group_key "$group_key" '.groups[$group_key] // []' 2>/dev/null)"
+                        if [ -z "$group_outbounds" ] || [ "$group_outbounds" = "[]" ]; then
+                            continue
+                        fi
+
+                        group_tag="$(sing_box_get_unique_outbound_tag "$config" "$group_key Fastest")"
+                        config="$(sing_box_cm_add_urltest_outbound "$config" "$group_tag" "$group_outbounds" \
+                            "$urltest_testing_url" "$urltest_check_interval" "$urltest_tolerance")"
+
+                        selector_outbounds_json=$(
+                            printf '%s' "$selector_outbounds_json" | jq -ac --arg tag "$group_tag" '. + [$tag]' 2>/dev/null
+                        )
+                    done < "$group_keys_tmp"
+                    rm -f "$group_keys_tmp"
+
+                    if [ -z "$selector_outbounds_json" ]; then
+                        selector_outbounds_json="[]"
+                    fi
+
+                    ungrouped_outbounds_json="$(echo "$grouping_json" | jq -c '.ungrouped // []' 2>/dev/null)"
+                    if [ -n "$ungrouped_outbounds_json" ] && [ "$ungrouped_outbounds_json" != "[]" ]; then
+                        selector_outbounds_json=$(
+                            jq -acn --argjson selector "$selector_outbounds_json" --argjson ungrouped "$ungrouped_outbounds_json" \
+                                '$selector + $ungrouped' 2>/dev/null
+                        )
+                    fi
+
+                    if [ -z "$selector_outbounds_json" ] || [ "$selector_outbounds_json" = "[]" ]; then
+                        log "No selector outbounds available after grouping subscription outbounds for section '$section'. Aborted." "fatal"
+                        exit 1
+                    fi
+
+                    selector_default="$(echo "$selector_outbounds_json" | jq -r '.[0] // ""' 2>/dev/null)"
+                    if [ -z "$selector_default" ] || [ "$selector_default" = "null" ]; then
+                        log "Unable to determine default selector outbound for section '$section'. Aborted." "fatal"
+                        exit 1
+                    fi
+
+                    selector_outbounds="$selector_outbounds_json"
+                    config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" "$selector_default" "true")"
+                else
+                    # Create urltest + selector (default subscription behaviour)
+                    urltest_tag="$(get_outbound_tag_by_section "$section-urltest")"
+                    urltest_outbounds="$subscription_outbound_tags_json"
+                    selector_outbounds=$(
+                        jq -acn --argjson outbounds "$subscription_outbound_tags_json" --arg tag "$urltest_tag" \
+                            '$outbounds + [$tag]' 2>/dev/null
+                    )
+                    if [ -z "$selector_outbounds" ]; then
+                        log "Failed to build selector outbounds for subscription section '$section'. Aborted." "fatal"
+                        exit 1
+                    fi
+                    config="$(sing_box_cm_add_urltest_outbound "$config" "$urltest_tag" "$urltest_outbounds" \
+                        "$urltest_testing_url" "$urltest_check_interval" "$urltest_tolerance")"
+                    config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" "$urltest_tag" "true")"
+                fi
+            fi
+            ;;
+        *)
+            log "Unknown proxy configuration type: '$proxy_config_type'. Aborted." "fatal"
+            exit 1
+            ;;
+        esac
+        ;;
+    vpn)
+        log "Configuring outbound in VPN connection type for the $section section"
+        local interface_name domain_resolver_enabled domain_resolver_dns_type domain_resolver_dns_server \
+            domain_resolver_dns_server_address outbound_tag domain_resolver_tag dns_domain_resolver
+
+        config_get interface_name "$section" "interface"
+        config_get domain_resolver_enabled "$section" "domain_resolver_enabled"
+        config_get domain_resolver_dns_type "$section" "domain_resolver_dns_type"
+        config_get domain_resolver_dns_server "$section" "domain_resolver_dns_server"
+
+        if [ -z "$interface_name" ]; then
+            log "VPN interface is not set. Aborted." "fatal"
+            exit 1
+        fi
+
+        local outbound_tag
+        outbound_tag="$(get_outbound_tag_by_section "$section")"
+
+        if [ "$domain_resolver_enabled" -eq 1 ]; then
+            domain_resolver_dns_server_address="$(url_get_host "$dns_server")"
+            if ! is_ipv4 "$domain_resolver_dns_server_address"; then
+                dns_domain_resolver=$SB_BOOTSTRAP_SERVER_TAG
+            fi
+            domain_resolver_tag="$(get_domain_resolver_tag "$section")"
+            config=$(sing_box_cf_add_dns_server "$config" "$domain_resolver_dns_type" "$domain_resolver_tag" \
+                "$domain_resolver_dns_server" "$dns_domain_resolver" "$outbound_tag")
+        fi
+
+        config=$(sing_box_cm_add_interface_outbound "$config" "$outbound_tag" "$interface_name" "$domain_resolver_tag")
+        ;;
+    block)
+        log "Connection type 'block' detected for the $section section – no outbound will be created (handled via reject route rules)"
+        ;;
+    exclusion)
+        log "Connection type 'exclusion' detected for the $section section – no outbound will be created (handled via route rules)"
+        ;;
+    *)
+        log "Unknown connection type '$connection_type' for the $section section. Aborted." "fatal"
+        exit 1
+        ;;
+    esac
+}
+
+sing_box_configure_dns() {
+    log "Configure the DNS section of a sing-box JSON configuration"
+    local dns_strategy
+    if netshift_ipv6_enabled; then
+        dns_strategy="prefer_ipv4"
+    else
+        dns_strategy="ipv4_only"
+    fi
+    config=$(sing_box_cm_configure_dns "$config" "$SB_DNS_SERVER_TAG" "$dns_strategy" true)
+
+    log "Adding DNS Servers" "debug"
+    local dns_type dns_server bootstrap_dns_server dns_domain_resolver dns_server_address
+    config_get dns_type "settings" "dns_type" "doh"
+    config_get dns_server "settings" "dns_server" "1.1.1.1"
+    config_get bootstrap_dns_server "settings" "bootstrap_dns_server" "77.88.8.8"
+
+    local block_doh
+    config_get_bool block_doh "settings" "block_doh" 0
+    if [ "$block_doh" -eq 1 ] && [ "$dns_type" = "doh" ]; then
+        log "DoH blocking is enabled but upstream DNS type is 'doh'. Your own DNS queries will be blocked." "warn"
+        log "Switch dns_type to 'udp' or 'dot' in NetShift settings to avoid self-blocking." "warn"
+    fi
+
+    dns_server_address="$(url_get_host "$dns_server")"
+    if ! is_ipv4 "$dns_server_address"; then
+        dns_domain_resolver=$SB_BOOTSTRAP_SERVER_TAG
+    fi
+
+    # Only the MAIN DNS server may carry a detour. Bootstrap stays direct (it
+    # resolves the DoH/DoT hostname before the tunnel is up) and FakeIP stays
+    # direct. An empty tag means no detour -> byte-identical to the off path.
+    local dns_detour_tag
+    dns_detour_tag="$(_get_dns_detour_tag)"
+
+    config=$(sing_box_cm_add_udp_dns_server "$config" "$SB_BOOTSTRAP_SERVER_TAG" "$bootstrap_dns_server" 53)
+    config=$(sing_box_cf_add_dns_server "$config" "$dns_type" "$SB_DNS_SERVER_TAG" "$dns_server" "$dns_domain_resolver" "$dns_detour_tag")
+    if netshift_ipv6_enabled; then
+        config=$(sing_box_cm_add_fakeip_dns_server "$config" "$SB_FAKEIP_DNS_SERVER_TAG" "$SB_FAKEIP_INET4_RANGE" "$SB_FAKEIP_INET6_RANGE")
+    else
+        config=$(sing_box_cm_add_fakeip_dns_server "$config" "$SB_FAKEIP_DNS_SERVER_TAG" "$SB_FAKEIP_INET4_RANGE" "")
+    fi
+
+    log "Adding DNS Rules"
+    local rewrite_ttl service_domains
+    config_get rewrite_ttl "settings" "dns_rewrite_ttl" "60"
+
+    log "Adding DNS-level DoH prevention rules" "debug"
+    config=$(sing_box_cm_add_dns_reject_rule "$config" "query_type" "HTTPS")
+    config=$(sing_box_cm_add_dns_reject_rule "$config" "domain_suffix" '"use-application-dns.net"')
+    config=$(sing_box_cm_add_dns_route_rule "$config" "$SB_FAKEIP_DNS_SERVER_TAG" "$SB_FAKEIP_DNS_RULE_TAG")
+    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rewrite_ttl" "$rewrite_ttl")
+    service_domains=$(comma_string_to_json_array "$FAKEIP_TEST_DOMAIN,$CHECK_PROXY_IP_DOMAIN")
+    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "domain" "$service_domains")
+}
+
+sing_box_configure_route() {
+    log "Configure the route section of a sing-box JSON configuration"
+
+    local route_final global_proxy_section
+    route_final="$SB_DIRECT_OUTBOUND_TAG"
+    global_proxy_section="$(get_global_proxy_section)"
+    if [ -n "$global_proxy_section" ]; then
+        if subscription_outbound_is_unavailable "$global_proxy_section"; then
+            log "Global proxy section '$global_proxy_section' is unavailable; routing unmatched traffic directly until it recovers" "warn"
+        else
+            route_final="$(get_outbound_tag_by_section "$global_proxy_section")"
+            log "Global proxy mode enabled: routing all unmatched traffic through section '$global_proxy_section' (outbound: $route_final)" "info"
+        fi
+    fi
+
+    # Stamp every sing-box-originated egress connection with NFT_OUTBOUND_MARK
+    # (route.default_mark). The nft mangle prerouting chain marks ALL LAN traffic
+    # with NFT_FAKEIP_MARK and `ip rule ... fwmark NFT_FAKEIP_MARK lookup
+    # netshift` redirects it to the tproxy path. Without an egress mark,
+    # sing-box's own outbound sockets (especially direct-out, which carries ALL
+    # unmatched traffic) inherit the tproxy SO_MARK (NFT_FAKEIP_MARK), so the
+    # `ip rule` re-captures them into `local default dev lo` -> they loop back
+    # into tproxy and never reach the internet (the 0.8.6 "direct-out i/o
+    # timeout" regression). Marking egress with NFT_OUTBOUND_MARK makes the
+    # `ip rule` (which matches only NFT_FAKEIP_MARK) skip these packets so they
+    # egress via the main table, and the existing `mangle_output meta mark
+    # NFT_OUTBOUND_MARK return` rule keeps them out of the proxy chain. This is
+    # fail-open: unmatched/unproxied traffic always reaches the internet even
+    # when a section's outbound is unreachable. sing-box default_mark is an
+    # integer; convert the hex constant to decimal via ash arithmetic.
+    local default_egress_mark
+    default_egress_mark=$(( NFT_OUTBOUND_MARK ))
+
+    local output_network_interface
+    config_get output_network_interface "settings" "output_network_interface"
+    if [ -z "$output_network_interface" ]; then
+        config=$(sing_box_cm_configure_route "$config" "$route_final" true "$SB_DNS_SERVER_TAG" "" \
+            "$default_egress_mark")
+    else
+        config=$(sing_box_cm_configure_route "$config" "$route_final" false "$SB_DNS_SERVER_TAG" \
+            "$output_network_interface" "$default_egress_mark")
+    fi
+
+    local sniff_inbounds sniff_inbounds_csv
+    sniff_inbounds_csv="$SB_TPROXY_INBOUND_TAG,$SB_DNS_INBOUND_TAG"
+    if netshift_ipv6_enabled; then
+        sniff_inbounds_csv="$sniff_inbounds_csv,${SB_TPROXY_INBOUND_TAG}-v6,${SB_DNS_INBOUND_TAG}-v6"
+    fi
+    sniff_inbounds=$(comma_string_to_json_array "$sniff_inbounds_csv")
+    config=$(sing_box_cm_sniff_route_rule "$config" "inbound" "$sniff_inbounds")
+
+    config=$(sing_box_cm_add_hijack_dns_route_rule "$config" "protocol" "dns")
+
+    local disable_quic
+    config_get_bool disable_quic "settings" "disable_quic" 0
+    if [ "$disable_quic" -eq 1 ]; then
+        config=$(sing_box_cf_add_single_key_reject_rule "$config" "$SB_TPROXY_INBOUND_TAG" "protocol" "quic")
+    fi
+
+    local block_doh
+    config_get_bool block_doh "settings" "block_doh" 0
+    if [ "$block_doh" -eq 1 ]; then
+        log "DoH blocking enabled: adding route-level DoH IP block rules" "info"
+        config=$(sing_box_cm_add_doh_block_route_rule "$config" "$SB_DOH_BLOCK_RULE_TAG" "$SB_TPROXY_INBOUND_TAG" \
+            "$DOH_BLOCK_IPV4_CIDRS" "$DOH_BLOCK_IPV6_CIDRS")
+    fi
+
+    local first_outbound_section
+    first_outbound_section="$(get_first_outbound_section)"
+    if subscription_outbound_is_unavailable "$first_outbound_section"; then
+        log "First configured outbound section '$first_outbound_section' is unavailable; proxy test traffic will be rejected until its subscription refresh succeeds" "warn"
+        first_outbound_tag=""
+    else
+        first_outbound_tag="$(get_outbound_tag_by_section "$first_outbound_section")"
+    fi
+    if [ -n "$first_outbound_tag" ]; then
+        config=$(sing_box_cf_proxy_domain "$config" "$SB_TPROXY_INBOUND_TAG" "$CHECK_PROXY_IP_DOMAIN" "$first_outbound_tag")
+    else
+        config=$(sing_box_cf_add_single_key_reject_rule "$config" "$SB_TPROXY_INBOUND_TAG" "domain" "$CHECK_PROXY_IP_DOMAIN")
+    fi
+    config=$(sing_box_cf_override_domain_port "$config" "$FAKEIP_TEST_DOMAIN" 8443)
+
+    configure_common_reject_route_rule
+    configure_common_direct_route_rule
+
+    local routing_excluded_ips
+    config_get routing_excluded_ips "settings" "routing_excluded_ips"
+    if [ -n "$routing_excluded_ips" ]; then
+        rule_tag="$(gen_id)"
+        config=$(sing_box_cm_add_route_rule "$config" "$rule_tag" "$SB_TPROXY_INBOUND_TAG" "$SB_DIRECT_OUTBOUND_TAG")
+        config_list_foreach "settings" "routing_excluded_ips" exclude_source_ip_from_routing_handler "$rule_tag"
+    fi
+
+    config_foreach include_source_ips_in_routing_handler "section"
+
+    config_foreach configure_routing_for_section_lists "section"
+}
+
+include_source_ips_in_routing_handler() {
+    local section="$1"
+
+    local fully_routed_ips rule_tag
+    config_get fully_routed_ips "$section" "fully_routed_ips"
+    if [ -n "$fully_routed_ips" ]; then
+        rule_tag="$(gen_id)"
+        if subscription_outbound_is_unavailable "$section"; then
+            config="$(sing_box_cm_add_reject_route_rule "$config" "$rule_tag" "$SB_TPROXY_INBOUND_TAG")"
+        else
+            config=$(
+                sing_box_cm_add_route_rule \
+                    "$config" "$rule_tag" "$SB_TPROXY_INBOUND_TAG" "$(get_outbound_tag_by_section "$section")"
+            )
+        fi
+        config_list_foreach "$section" "fully_routed_ips" include_source_ip_in_routing_handler "$rule_tag"
+    fi
+}
+
+configure_common_reject_route_rule() {
+    local block_sections block_section_lists_enabled
+    block_sections="$(get_sections_by_connection_type "block")"
+    block_section_lists_enabled=0
+
+    if [ -n "$block_sections" ]; then
+        for block_section in $block_sections; do
+            if section_has_enabled_lists "$block_section"; then
+                block_section_lists_enabled=1
+                break
+            fi
+        done
+        if [ "$block_section_lists_enabled" -eq 1 ]; then
+            config=$(sing_box_cm_add_reject_route_rule "$config" "$SB_REJECT_RULE_TAG" "$SB_TPROXY_INBOUND_TAG")
+        else
+            log "Block sections does not have any enabled list, reject rule is not required" "warn"
+        fi
+    fi
+}
+
+configure_common_direct_route_rule() {
+    local exclusion_sections exclusion_section_list_enabled global_proxy_direct_needed
+    exclusion_sections="$(get_sections_by_connection_type "exclusion")"
+    exclusion_section_list_enabled=0
+
+    if [ -n "$exclusion_sections" ]; then
+        for exclusion_section in $exclusion_sections; do
+            if section_has_enabled_lists "$exclusion_section"; then
+                exclusion_section_list_enabled=1
+                break
+            fi
+        done
+    fi
+
+    global_proxy_direct_needed=0
+    if [ "$exclusion_section_list_enabled" -eq 0 ]; then
+        config_foreach _check_global_proxy_direct_needed "section"
+    fi
+
+    if [ "$exclusion_section_list_enabled" -eq 1 ] || [ "$global_proxy_direct_needed" -eq 1 ]; then
+        config=$(sing_box_cm_add_route_rule "$config" "$SB_EXCLUSION_RULE_TAG" "$SB_TPROXY_INBOUND_TAG" \
+            "$SB_DIRECT_OUTBOUND_TAG")
+    else
+        log "No direct exclusion rules required" "warn"
+    fi
+}
+
+_check_global_proxy_direct_needed() {
+    local section="$1"
+    local global_proxy
+
+    config_get_bool global_proxy "$section" "global_proxy" 0
+    if [ "$global_proxy" -eq 1 ] && section_has_enabled_lists "$section"; then
+        global_proxy_direct_needed=1
+    fi
+}
+
+include_source_ip_in_routing_handler() {
+    local source_ip="$1"
+    local rule_tag="$2"
+
+    config=$(sing_box_cm_patch_route_rule "$config" "$rule_tag" "source_ip_cidr" "$source_ip")
+}
+
+exclude_source_ip_from_routing_handler() {
+    local source_ip="$1"
+    local rule_tag="$2"
+
+    config=$(sing_box_cm_patch_route_rule "$config" "$rule_tag" "source_ip_cidr" "$source_ip")
+}
+
+# config_list_foreach callback that appends a raw keyword (opaque user text:
+# may contain spaces, emoji, Cyrillic, &?#%) onto the JSON array carried in the
+# global SUBSCRIPTION_FILTER_KEYWORDS_JSON. Items are appended verbatim; the
+# facade's jq filter later drops empty ("") items via select(length > 0). A
+# whitespace-only item is NOT trimmed and stays a literal match string
+# (intentional opaque match semantics per the spec). Uses jq --arg so every byte
+# survives intact (no URL/query parsing).
+append_subscription_filter_keyword_handler() {
+    local keyword="$1"
+    local next
+
+    next=$(printf '%s' "$SUBSCRIPTION_FILTER_KEYWORDS_JSON" |
+        jq -c --arg kw "$keyword" '. + [$kw]' 2>/dev/null)
+    [ -n "$next" ] && SUBSCRIPTION_FILTER_KEYWORDS_JSON="$next"
+}
+
+# Read a per-section UCI list of keyword filter values into a JSON array string.
+# Arguments:
+#   section: string, the UCI section name
+#   list_name: string, the UCI list option name
+# Outputs:
+#   Writes the JSON array (e.g. ["grpc","\ud83e\udd16"]) to stdout; "[]" if empty.
+build_subscription_filter_keywords_json() {
+    local section="$1"
+    local list_name="$2"
+
+    SUBSCRIPTION_FILTER_KEYWORDS_JSON="[]"
+    config_list_foreach "$section" "$list_name" append_subscription_filter_keyword_handler
+    printf '%s' "$SUBSCRIPTION_FILTER_KEYWORDS_JSON"
+}
+
+configure_routing_for_section_lists() {
+    local section="$1"
+
+    log "Configuring routing for '$section' section"
+    if ! section_has_enabled_lists "$section"; then
+        log "Section '$section' does not have any enabled list, skipping..." "warn"
+        return 0
+    fi
+
+    local community_lists user_domain_list_type user_subnet_list_type local_domain_lists local_subnet_lists \
+        remote_domain_lists remote_subnet_lists section_connection_type route_rule_tag resolve_real_ip_for_routing outbound_tag
+    config_get community_lists "$section" "community_lists"
+    config_get user_domain_list_type "$section" "user_domain_list_type" "disabled"
+    config_get user_subnet_list_type "$section" "user_subnet_list_type" "disabled"
+    config_get local_domain_lists "$section" "local_domain_lists"
+    config_get local_subnet_lists "$section" "local_subnet_lists"
+    config_get remote_domain_lists "$section" "remote_domain_lists"
+    config_get remote_subnet_lists "$section" "remote_subnet_lists"
+    config_get section_connection_type "$section" "connection_type"
+    config_get_bool resolve_real_ip_for_routing "$section" "resolve_real_ip_for_routing" 0
+
+    case "$section_connection_type" in
+    proxy | vpn)
+        local global_proxy
+        config_get_bool global_proxy "$section" "global_proxy" 0
+        if [ "$global_proxy" -eq 1 ]; then
+            route_rule_tag="$SB_EXCLUSION_RULE_TAG"
+        else
+            route_rule_tag="$(gen_id)"
+            if subscription_outbound_is_unavailable "$section"; then
+                config="$(sing_box_cm_add_reject_route_rule "$config" "$route_rule_tag" "$SB_TPROXY_INBOUND_TAG")"
+            else
+                outbound_tag=$(get_outbound_tag_by_section "$section")
+                config=$(sing_box_cm_add_route_rule "$config" "$route_rule_tag" "$SB_TPROXY_INBOUND_TAG" "$outbound_tag")
+            fi
+        fi
+        ;;
+    block)
+        route_rule_tag="$SB_REJECT_RULE_TAG"
+        ;;
+    exclusion)
+        route_rule_tag="$SB_EXCLUSION_RULE_TAG"
+        ;;
+    *)
+        log "Unsupported '$section_connection_type' connection type. Skipping routing for '$section' section" "fatal"
+        exit 1
+        ;;
+    esac
+
+    if [ -n "$community_lists" ]; then
+        log "Processing community list routing rules for '$section' section"
+        config_list_foreach "$section" "community_lists" configure_community_list_handler "$section" "$route_rule_tag"
+    fi
+
+    if [ "$user_domain_list_type" != "disabled" ]; then
+        log "Processing user domains routing rules for '$section' section"
+        configure_user_domain_list "$section" "$route_rule_tag"
+    fi
+
+    if [ "$user_subnet_list_type" != "disabled" ]; then
+        log "Processing user subnets routing rules for '$section' section"
+        configure_user_subnet_list "$section" "$route_rule_tag"
+    fi
+
+    if [ -n "$local_domain_lists" ]; then
+        log "Processing local domains routing rules for '$section' section"
+        configure_local_domain_lists "$section" "$route_rule_tag"
+    fi
+
+    if [ -n "$local_subnet_lists" ]; then
+        log "Processing local subnets routing rules for '$section' section"
+        configure_local_subnet_lists "$section" "$route_rule_tag"
+    fi
+
+    if [ -n "$remote_domain_lists" ]; then
+        log "Processing remote domains routing rules for '$section' section"
+        config_list_foreach "$section" "remote_domain_lists" configure_remote_domain_or_subnet_list_handler \
+            "domains" "$section" "$route_rule_tag"
+    fi
+
+    if [ -n "$remote_subnet_lists" ]; then
+        log "Processing remote subnets routing rules for '$section' section"
+        config_list_foreach "$section" "remote_subnet_lists" configure_remote_domain_or_subnet_list_handler \
+            "subnets" "$section" "$route_rule_tag"
+    fi
+
+    if [ "$resolve_real_ip_for_routing" -eq 1 ]; then
+        config=$(sing_box_cm_add_resolve_rule "$config" "$route_rule_tag" "$(gen_id)" "$SB_DNS_SERVER_TAG")
+        log "Added resolve rule for '$section' section" "debug"
+    fi
+}
+
+configure_community_list_handler() {
+    local tag="$1"
+    local section="$2"
+    local route_rule_tag="$3"
+
+    local ruleset_tag format url update_interval detour
+    ruleset_tag="$(get_ruleset_tag "$section" "$tag" "community")"
+    format="binary"
+    url="$SRS_MAIN_URL/$tag.srs"
+    detour="$(get_download_detour_tag)"
+    config_get update_interval "settings" "update_interval" "1d"
+
+    config=$(sing_box_cm_add_remote_ruleset "$config" "$ruleset_tag" "$format" "$url" "$detour" "$update_interval")
+    config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
+    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
+}
+
+prepare_source_ruleset() {
+    local section="$1"
+    local name="$2"
+    local type="$3"
+    local route_rule_tag="$4"
+
+    log "Preparing a $name $type rule set for '$section' section" "debug"
+    ruleset_tag=$(get_ruleset_tag "$section" "$name" "$type")
+    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
+    create_source_rule_set "$ruleset_filepath"
+    case $? in
+    0)
+        config=$(sing_box_cm_add_local_ruleset "$config" "$ruleset_tag" "source" "$ruleset_filepath")
+        config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
+        case "$type" in
+        domains)
+            config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
+            ;;
+        subnets) ;;
+        *)
+            log "Unsupported remote rule set type: $type" "error"
+            return 1
+            ;;
+        esac
+        ;;
+    3) log "Source rule set $ruleset_filepath already exists, skipping." "debug" ;;
+    esac
+}
+
+configure_user_domain_list() {
+    local section="$1"
+    local route_rule_tag="$2"
+
+    prepare_source_ruleset "$section" "user" "domains" "$route_rule_tag"
+
+    local user_domain_list_type items json_array
+    config_get user_domain_list_type "$section" "user_domain_list_type"
+    case "$user_domain_list_type" in
+    dynamic) config_get items "$section" "user_domains" ;;
+    text) config_get items "$section" "user_domains_text" ;;
+    esac
+
+    items="$(parse_domain_or_subnet_string_to_commas_string "$items" "domains")"
+    json_array="$(comma_string_to_json_array "$items")"
+    patch_source_ruleset_rules "$ruleset_filepath" "domain_suffix" "$json_array"
+}
+
+configure_user_subnet_list() {
+    local section="$1"
+    local route_rule_tag="$2"
+
+    prepare_source_ruleset "$section" "user" "subnets" "$route_rule_tag"
+
+    local user_subnet_list_type items json_array
+    config_get user_subnet_list_type "$section" "user_subnet_list_type"
+    case "$user_subnet_list_type" in
+    dynamic) config_get items "$section" "user_subnets" ;;
+    text) config_get items "$section" "user_subnets_text" ;;
+    esac
+
+    items="$(parse_domain_or_subnet_string_to_commas_string "$items" "subnets")"
+    json_array="$(comma_string_to_json_array "$items")"
+    patch_source_ruleset_rules "$ruleset_filepath" "ip_cidr" "$json_array"
+    # task-034: feed the same subnets into the nft union set so the prerouting
+    # mangle chain marks them into sing-box (centralized alongside the rule_set).
+    populate_netshift_subnets_from_string "$items"
+}
+
+configure_local_domain_lists() {
+    local section="$1"
+    local route_rule_tag="$2"
+
+    prepare_source_ruleset "$section" "local" "domains" "$route_rule_tag"
+
+    config_list_foreach "$section" "local_domain_lists" import_local_domain_list_handler "$ruleset_filepath"
+}
+
+import_local_domain_list_handler() {
+    local local_domain_list_filepath="$1"
+    local ruleset_filepath="$2"
+
+    if ! file_exists "$local_domain_list_filepath"; then
+        log "Local domain list file $local_domain_list_filepath not found" "error"
+        return 1
+    fi
+
+    import_plain_domain_list_to_local_source_ruleset_chunked "$local_domain_list_filepath" "$ruleset_filepath"
+}
+
+configure_local_subnet_lists() {
+    local section="$1"
+    local route_rule_tag="$2"
+
+    prepare_source_ruleset "$section" "local" "subnets" "$route_rule_tag"
+
+    config_list_foreach "$section" "local_subnet_lists" import_local_subnets_list_handler "$ruleset_filepath"
+}
+
+import_local_subnets_list_handler() {
+    local local_subnet_list_filepath="$1"
+    local ruleset_filepath="$2"
+
+    if ! file_exists "$local_subnet_list_filepath"; then
+        log "Local subnet list file $local_subnet_list_filepath not found" "error"
+        return 1
+    fi
+
+    import_plain_subnet_list_to_local_source_ruleset_chunked "$local_subnet_list_filepath" "$ruleset_filepath"
+    # task-034: also feed the nft union set (centralized alongside the rule_set).
+    populate_netshift_subnets_from_file "$local_subnet_list_filepath"
+}
+
+configure_remote_domain_or_subnet_list_handler() {
+    local url="$1"
+    local type="$2"
+    local section="$3"
+    local route_rule_tag="$4"
+
+    local file_extension
+    file_extension=$(url_get_file_extension "$url")
+    log "Detected file extension: '$file_extension'" "debug"
+    case "$file_extension" in
+    json | srs)
+        log "Creating a remote $type ruleset from the source URL" "info"
+        local basename ruleset_tag format detour update_interval
+        basename=$(url_get_basename "$url")
+        ruleset_tag=$(get_ruleset_tag "$section" "$basename" "remote-$type")
+        format="$(get_ruleset_format_by_file_extension "$file_extension")"
+        detour="$(get_download_detour_tag)"
+        config_get update_interval "settings" "update_interval" "1d"
+
+        config=$(sing_box_cm_add_remote_ruleset "$config" "$ruleset_tag" "$format" "$url" "$detour" "$update_interval")
+        config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
+        case "$type" in
+        domains)
+            config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
+            ;;
+        subnets) ;;
+        *) log "Unsupported remote rule set type: $type" "error" ;;
+        esac
+        ;;
+    *)
+        prepare_source_ruleset "$section" "remote" "$type" "$route_rule_tag"
+        ;;
+    esac
+}
+
+sing_box_configure_experimental() {
+    log "Configure the experimental section of a sing-box JSON configuration"
+
+    log "Configuring cache database"
+    local cache_file
+    config_get cache_file "settings" "cache_path" "/tmp/sing-box/cache.db"
+    config=$(sing_box_cm_configure_cache_file "$config" true "$cache_file" true)
+
+    log "Configuring Clash API"
+    local enable_yacd enable_yacd_wan_access clash_api_controller_address
+    config_get_bool enable_yacd "settings" "enable_yacd" 0
+    config_get_bool enable_yacd_wan_access "settings" "enable_yacd_wan_access" 0
+
+    if [ "$enable_yacd" -eq 1 ] && [ "$enable_yacd_wan_access" -eq 1 ]; then
+        clash_api_controller_address="0.0.0.0"
+    else
+        clash_api_controller_address="$(get_service_listen_address)"
+        if [ -z "$clash_api_controller_address" ]; then
+            log "Could not determine the listening IP address for the Clash API controller. It will run only on localhost." "warn"
+            clash_api_controller_address="127.0.0.1"
+        fi
+    fi
+
+    if [ "$enable_yacd" -eq 1 ]; then
+        log "YACD is enabled, enabling Clash API with downloadable YACD" "debug"
+        local yacd_secret_key external_controller_ui
+        config_get yacd_secret_key "settings" "yacd_secret_key"
+        external_controller_ui="ui"
+
+        config=$(
+            sing_box_cm_configure_clash_api \
+                "$config" \
+                "$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT" \
+                "$external_controller_ui" \
+                "$yacd_secret_key"
+        )
+    else
+        log "YACD is disabled, enabling Clash API in online mode" "debug"
+        config=$(
+            sing_box_cm_configure_clash_api "$config" "$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT"
+        )
+    fi
+}
+
+sing_box_additional_inbounds() {
+    log "Configure the additional inbounds of a sing-box JSON configuration"
+
+    local download_lists_via_proxy
+    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
+    if [ "$download_lists_via_proxy" -eq 1 ]; then
+        local download_lists_via_proxy_section section_outbound_tag
+        config_get download_lists_via_proxy_section "settings" "download_lists_via_proxy_section"
+        if subscription_outbound_is_unavailable "$download_lists_via_proxy_section"; then
+            log "Service download proxy section '$download_lists_via_proxy_section' is unavailable; rejecting proxy requests until its subscription refresh succeeds" "warn"
+            config="$(sing_box_cm_add_mixed_inbound "$config" "$SB_SERVICE_MIXED_INBOUND_TAG" "$SB_SERVICE_MIXED_INBOUND_ADDRESS" "$SB_SERVICE_MIXED_INBOUND_PORT")"
+            config="$(sing_box_cm_add_reject_route_rule "$config" "$(gen_id)" "$SB_SERVICE_MIXED_INBOUND_TAG")"
+        else
+            section_outbound_tag="$(get_outbound_tag_by_section "$download_lists_via_proxy_section")"
+            config=$(
+                sing_box_cf_add_mixed_inbound_and_route_rule \
+                    "$config" \
+                    "$SB_SERVICE_MIXED_INBOUND_TAG" \
+                    "$SB_SERVICE_MIXED_INBOUND_ADDRESS" \
+                    "$SB_SERVICE_MIXED_INBOUND_PORT" \
+                    "$section_outbound_tag"
+            )
+        fi
+    fi
+
+    config_foreach configure_section_mixed_proxy "section"
+}
+
+configure_section_mixed_proxy() {
+    local section="$1"
+
+    local mixed_inbound_enabled mixed_proxy_port mixed_inbound_tag mixed_outbound_tag mixed_proxy_address
+    config_get_bool mixed_inbound_enabled "$section" "mixed_proxy_enabled" 0
+    mixed_proxy_address="$(get_service_listen_address)"
+    if [ -z "$mixed_proxy_address" ]; then
+        log "Could not determine the listening IP address for the Mixed Proxy. The proxy will not be created." "warn"
+        return 1
+    fi
+    config_get mixed_proxy_port "$section" "mixed_proxy_port" "2080"
+
+    case "$mixed_proxy_port" in
+    '' | *[!0-9]*)
+        log "Invalid mixed_proxy_port '$mixed_proxy_port' for section '$section'. Falling back to 2080." "warn"
+        mixed_proxy_port="2080"
+        ;;
+    esac
+
+    if [ "$mixed_proxy_port" -lt 1 ] || [ "$mixed_proxy_port" -gt 65535 ]; then
+        log "mixed_proxy_port '$mixed_proxy_port' for section '$section' is out of range (1-65535). Falling back to 2080." "warn"
+        mixed_proxy_port="2080"
+    fi
+    if [ "$mixed_inbound_enabled" -eq 1 ]; then
+        mixed_inbound_tag="$(get_inbound_tag_by_section "$section-mixed")"
+        if subscription_outbound_is_unavailable "$section"; then
+            config="$(sing_box_cm_add_mixed_inbound "$config" "$mixed_inbound_tag" "$mixed_proxy_address" "$mixed_proxy_port")"
+            config="$(sing_box_cm_add_reject_route_rule "$config" "$(gen_id)" "$mixed_inbound_tag")"
+        else
+            mixed_outbound_tag="$(get_outbound_tag_by_section "$section")"
+            config=$(
+                sing_box_cf_add_mixed_inbound_and_route_rule \
+                    "$config" \
+                    "$mixed_inbound_tag" \
+                    "$mixed_proxy_address" \
+                    "$mixed_proxy_port" \
+                    "$mixed_outbound_tag"
+            )
+        fi
+    fi
+}
+
+sing_box_save_config() {
+    local sing_box_config_path temp_file_path current_config_hash temp_config_hash
+    config_get sing_box_config_path "settings" "config_path"
+    temp_file_path="$(mktemp)"
+
+    log "Save sing-box temporary config to $temp_file_path" "debug"
+    sing_box_cm_save_config_to_file "$config" "$temp_file_path"
+
+    sing_box_config_check "$temp_file_path"
+
+    current_config_hash=$(md5sum "$sing_box_config_path" 2> /dev/null | awk '{print $1}')
+    temp_config_hash=$(md5sum "$temp_file_path" | awk '{print $1}')
+    log "Current sing-box config hash: $current_config_hash" "debug"
+    log "Temporary sing-box config hash: $temp_config_hash" "debug"
+    if [ "$current_config_hash" != "$temp_config_hash" ]; then
+        log "sing-box configuration has changed and will be updated"
+        mv "$temp_file_path" "$sing_box_config_path"
+    else
+        log "sing-box configuration is unchanged"
+        rm "$temp_file_path"
+    fi
+}
+
+sing_box_config_check() {
+    local config_path="$1"
+
+    if ! sing-box -c "$config_path" check > /dev/null 2>&1; then
+        log "Sing-box configuration $config_path is invalid. Aborted." "fatal"
+        exit 1
+    fi
+}
+
+import_community_subnet_lists() {
+    local section="$1"
+    local community_lists
+    config_get community_lists "$section" "community_lists"
+    if [ -n "$community_lists" ]; then
+        log "Importing community subnet lists for '$section' section"
+        config_list_foreach "$section" "community_lists" import_community_service_subnet_list_handler
+    fi
+}
+
+import_community_service_subnet_list_handler() {
+    local service="$1"
+
+    # Routing for every community service is carried by a sing-box remote rule
+    # set (see configure_community_list_handler -> $SRS_MAIN_URL/<service>.srs).
+    # task-034: the SUBNET-based community services (twitter/meta/telegram/
+    # cloudflare/hetzner/ovh/digitalocean/cloudfront/roblox/discord) route by IP,
+    # not by domain, so their destination IPs would NOT be covered by the FakeIP
+    # mark rule. We therefore (re)populate the nft union set NFT_COMMON_SET_NAME
+    # so the prerouting mangle chain marks them into sing-box. Domain-based
+    # services (youtube, russia_inside, ...) are carried by the FakeIP range
+    # mark rule and need no nft set population here.
+    #
+    # discord is special: it ALSO needs its own dport-restricted mangle rule
+    # (@netshift_discord_subnets udp dport {...}) that a sing-box route rule
+    # cannot express, so its subnets populate BOTH the discord set (for the
+    # dport rule) and the general union set (so TCP/other-UDP discord traffic
+    # is marked too, without the dport restriction).
+    local url is_discord
+    is_discord=0
+    case "$service" in
+    "twitter") url=$SUBNETS_TWITTER ;;
+    "meta") url=$SUBNETS_META ;;
+    "telegram") url=$SUBNETS_TELERAM ;;
+    "cloudflare") url=$SUBNETS_CLOUDFLARE ;;
+    "hetzner") url=$SUBNETS_HETZNER ;;
+    "ovh") url=$SUBNETS_OVH ;;
+    "digitalocean") url=$SUBNETS_DIGITALOCEAN ;;
+    "cloudfront") url=$SUBNETS_CLOUDFRONT ;;
+    "roblox") url=$SUBNETS_ROBLOX ;;
+    "discord")
+        url=$SUBNETS_DISCORD
+        is_discord=1
+        if ! nft list set inet "$NFT_TABLE_NAME" "$NFT_DISCORD_SET_NAME" > /dev/null 2>&1; then
+            nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_DISCORD_SET_NAME"
+        fi
+        if ! nft list chain inet "$NFT_TABLE_NAME" mangle 2> /dev/null | \
+            grep -Fq "@$NFT_DISCORD_SET_NAME udp dport { 19000-20000, 50000-65535 }"; then
+            nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr \
+                "@$NFT_DISCORD_SET_NAME" udp dport '{ 19000-20000, 50000-65535 }' meta mark set "$NFT_FAKEIP_MARK" counter
+        fi
+        ;;
+    *) return 0 ;;
+    esac
+
+    local tmpfile http_proxy_address
+    tmpfile=$(mktemp)
+    http_proxy_address="$(get_service_proxy_address)"
+
+    download_to_file "$url" "$tmpfile" "$http_proxy_address"
+
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        log "Download $service list failed" "error"
+        return 1
+    fi
+
+    if [ "$is_discord" -eq 1 ]; then
+        nft_add_set_elements_from_file_chunked "$tmpfile" "$NFT_TABLE_NAME" "$NFT_DISCORD_SET_NAME"
+    fi
+    # task-034: feed the union set (centralized with the sing-box .srs rule_set).
+    populate_netshift_subnets_from_file "$tmpfile"
+
+    rm -f "$tmpfile"
+}
+
+import_domains_from_remote_domain_lists() {
+    local section="$1"
+    local remote_domain_lists
+    config_get remote_domain_lists "$section" "remote_domain_lists"
+    if [ -n "$remote_domain_lists" ]; then
+        log "Importing domains from remote domain lists for '$section' section"
+        config_list_foreach "$section" "remote_domain_lists" import_domains_from_remote_domain_list_handler "$section"
+    fi
+}
+
+import_domains_from_remote_domain_list_handler() {
+    local url="$1"
+    local section="$2"
+
+    log "Importing domains from URL: $url"
+
+    local file_extension
+    file_extension=$(url_get_file_extension "$url")
+    log "Detected file extension: '$file_extension'" "debug"
+    case "$file_extension" in
+    json | srs)
+        log "No update needed - sing-box manages updates automatically."
+        ;;
+    *)
+        log "Import domains from a remote plain-text list"
+        import_domains_from_remote_plain_file "$url" "$section"
+        ;;
+    esac
+}
+
+import_domains_from_remote_plain_file() {
+    local url="$1"
+    local section="$2"
+
+    local tmpfile http_proxy_address items json_array
+    tmpfile=$(mktemp)
+    http_proxy_address="$(get_service_proxy_address)"
+
+    download_to_file "$url" "$tmpfile" "$http_proxy_address"
+
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        log "Download $url list failed" "error"
+        return 1
+    fi
+
+    convert_crlf_to_lf "$tmpfile"
+    ruleset_tag=$(get_ruleset_tag "$section" "remote" "domains")
+    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
+    import_plain_domain_list_to_local_source_ruleset_chunked "$tmpfile" "$ruleset_filepath"
+
+    rm -f "$tmpfile"
+}
+
+import_subnets_from_remote_subnet_lists() {
+    local section="$1"
+    local remote_subnet_lists
+    config_get remote_subnet_lists "$section" "remote_subnet_lists"
+    if [ -n "$remote_subnet_lists" ]; then
+        log "Importing subnets from remote subnet lists for '$section' section"
+        config_list_foreach "$section" "remote_subnet_lists" import_subnets_from_remote_subnet_list_handler "$section"
+    fi
+}
+
+import_subnets_from_remote_subnet_list_handler() {
+    local url="$1"
+    local section="$2"
+
+    log "Importing subnets from URL: $url"
+
+    local file_extension
+    file_extension="$(url_get_file_extension "$url")"
+    log "Detected file extension: '$file_extension'" "debug"
+    case "$file_extension" in
+    json)
+        # JSON/SRS remote subnet lists are ROUTED via a sing-box remote rule set
+        # (configure_remote_domain_or_subnet_list_handler -> sing_box_cm_add_remote_ruleset),
+        # and sing-box manages their updates automatically. But task-034 needs
+        # their destination IPs in the nft union set so the prerouting mangle
+        # chain marks them into sing-box (an .srs/.json ruleset matches IPs that
+        # are NOT in the FakeIP range). So we extract the ip_cidr entries and
+        # feed the union set here.
+        log "Import subnets from a remote JSON list (for nft selective marking)" "info"
+        import_subnets_from_remote_json_file "$url"
+        ;;
+    srs)
+        log "Import subnets from a remote SRS list (for nft selective marking)" "info"
+        import_subnets_from_remote_srs_file "$url"
+        ;;
+    *)
+        log "Import subnets from a remote plain-text list" "info"
+        import_subnets_from_remote_plain_file "$url" "$section"
+        ;;
+    esac
+}
+
+# task-034: download a remote JSON sing-box ruleset, extract its ip_cidr entries
+# and feed the nft union set. Routing is still done by the sing-box remote rule
+# set; this only adds the nft-layer ingress gating. Fail-open on download error.
+import_subnets_from_remote_json_file() {
+    local url="$1"
+    local json_tmpfile subnets_tmpfile http_proxy_address
+    json_tmpfile="$(mktemp)"
+    subnets_tmpfile="$(mktemp)"
+    http_proxy_address="$(get_service_proxy_address)"
+
+    download_to_file "$url" "$json_tmpfile" "$http_proxy_address"
+
+    if [ $? -ne 0 ] || [ ! -s "$json_tmpfile" ]; then
+        log "Download $url list failed" "error"
+        rm -f "$json_tmpfile" "$subnets_tmpfile"
+        return 1
+    fi
+
+    extract_ip_cidr_from_json_ruleset_to_file "$json_tmpfile" "$subnets_tmpfile"
+    populate_netshift_subnets_from_file "$subnets_tmpfile"
+    rm -f "$json_tmpfile" "$subnets_tmpfile"
+}
+
+# task-034: download a remote binary (.srs) ruleset, decompile to JSON, extract
+# its ip_cidr entries and feed the nft union set. Fail-open on download/decompile.
+import_subnets_from_remote_srs_file() {
+    local url="$1"
+    local binary_tmpfile json_tmpfile subnets_tmpfile http_proxy_address
+    binary_tmpfile="$(mktemp)"
+    json_tmpfile="$(mktemp)"
+    subnets_tmpfile="$(mktemp)"
+    http_proxy_address="$(get_service_proxy_address)"
+
+    download_to_file "$url" "$binary_tmpfile" "$http_proxy_address"
+
+    if [ $? -ne 0 ] || [ ! -s "$binary_tmpfile" ]; then
+        log "Download $url list failed" "error"
+        rm -f "$binary_tmpfile" "$json_tmpfile" "$subnets_tmpfile"
+        return 1
+    fi
+
+    if ! decompile_binary_ruleset "$binary_tmpfile" "$json_tmpfile"; then
+        log "Failed to decompile binary rule set file" "error"
+        rm -f "$binary_tmpfile" "$json_tmpfile" "$subnets_tmpfile"
+        return 1
+    fi
+
+    extract_ip_cidr_from_json_ruleset_to_file "$json_tmpfile" "$subnets_tmpfile"
+    populate_netshift_subnets_from_file "$subnets_tmpfile"
+    rm -f "$binary_tmpfile" "$json_tmpfile" "$subnets_tmpfile"
+}
+
+import_subnets_from_remote_plain_file() {
+    local url="$1"
+    local section="$2"
+
+    local tmpfile http_proxy_address items json_array
+    tmpfile=$(mktemp)
+    http_proxy_address="$(get_service_proxy_address)"
+
+    download_to_file "$url" "$tmpfile" "$http_proxy_address"
+
+    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
+        log "Download $url list failed" "error"
+        return 1
+    fi
+
+    convert_crlf_to_lf "$tmpfile"
+
+    ruleset_tag=$(get_ruleset_tag "$section" "remote" "subnets")
+    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
+    import_plain_subnet_list_to_local_source_ruleset_chunked "$tmpfile" "$ruleset_filepath"
+    # task-034: also feed the nft union set (centralized with the rule_set).
+    populate_netshift_subnets_from_file "$tmpfile"
+
+    rm -f "$tmpfile"
+}
+
+## Support functions
+get_service_proxy_address() {
+    local download_lists_via_proxy
+    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
+    if [ "$download_lists_via_proxy" -eq 1 ]; then
+        echo "$SB_SERVICE_MIXED_INBOUND_ADDRESS:$SB_SERVICE_MIXED_INBOUND_PORT"
+    else
+        echo ""
+    fi
+}
+
+get_download_detour_tag() {
+    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
+    if [ "$download_lists_via_proxy" -eq 1 ]; then
+        local download_lists_via_proxy_section section_outbound_tag
+        config_get download_lists_via_proxy_section "settings" "download_lists_via_proxy_section"
+        if subscription_outbound_is_unavailable "$download_lists_via_proxy_section"; then
+            log "Download detour section '$download_lists_via_proxy_section' is unavailable; using direct detour until subscription refresh succeeds" "warn"
+            echo ""
+            return 0
+        fi
+        section_outbound_tag="$(get_outbound_tag_by_section "$download_lists_via_proxy_section")"
+        echo "$section_outbound_tag"
+    else
+        echo ""
+    fi
+}
+
+_determine_first_outbound_section() {
+    local section="$1"
+
+    if section_has_configured_outbound "$section"; then
+        [ -z "$first_section" ] && first_section="$section"
+    fi
+}
+
+# Resolve the outbound tag the MAIN sing-box DNS server should detour through.
+# Echoes the tag, or an EMPTY string meaning "no detour / direct DNS" (the safe
+# default). NEVER exits: every failure path logs the reason and falls back to
+# direct DNS so the service always starts and resolves. Mirrors the toggle +
+# optional section selector model of get_subscription_download_proxy_address.
+_get_dns_detour_tag() {
+    local dns_via_outbound dns_outbound_section candidate
+    local candidate_connection_type
+
+    # Step 1: feature off -> direct (silent).
+    config_get_bool dns_via_outbound "settings" "dns_via_outbound" 0
+    [ "$dns_via_outbound" -eq 1 ] || return 0
+
+    config_get dns_outbound_section "settings" "dns_outbound_section"
+
+    # Step 2: resolve the candidate section.
+    if [ -n "$dns_outbound_section" ] && \
+        config_get candidate_connection_type "$dns_outbound_section" "connection_type" && \
+        [ -n "$candidate_connection_type" ] && \
+        section_has_configured_outbound "$dns_outbound_section"; then
+        candidate="$dns_outbound_section"
+    else
+        if [ -n "$dns_outbound_section" ]; then
+            log "DNS-via-outbound section '$dns_outbound_section' is invalid or has no configured outbound; falling back to the first outbound section" "warn"
+        fi
+        candidate="$(get_first_outbound_section)"
+    fi
+
+    # Step 3: no candidate section at all -> direct.
+    if [ -z "$candidate" ]; then
+        log "DNS-via-outbound is enabled but no outbound section is configured; using direct DNS" "warn"
+        return 0
+    fi
+
+    # Step 4: block/exclusion sections produce no real outbound -> direct.
+    config_get candidate_connection_type "$candidate" "connection_type"
+    case "$candidate_connection_type" in
+    block | exclusion)
+        log "DNS-via-outbound candidate section '$candidate' has connection_type '$candidate_connection_type' (no real outbound); using direct DNS" "warn"
+        return 0
+        ;;
+    esac
+
+    # Step 5: subscription outbound not built yet / failed refresh -> direct (self-heal).
+    if subscription_outbound_is_unavailable "$candidate"; then
+        log "DNS-via-outbound selected section '$candidate' has no usable outbound yet; using direct DNS until it recovers" "warn"
+        return 0
+    fi
+
+    # Step 6: use the candidate section's outbound tag.
+    get_outbound_tag_by_section "$candidate"
+}
+
+get_first_outbound_section() {
+    local first_section=""
+
+    config_foreach _determine_first_outbound_section "section"
+
+    echo "$first_section"
+}
+
+_determine_global_proxy_section() {
+    local section="$1"
+    local global_proxy
+
+    config_get_bool global_proxy "$section" "global_proxy" 0
+    if [ "$global_proxy" -eq 1 ] && section_has_configured_outbound "$section"; then
+        [ -z "$global_section" ] && global_section="$section"
+    fi
+}
+
+get_global_proxy_section() {
+    local global_section=""
+
+    config_foreach _determine_global_proxy_section "section"
+
+    echo "$global_section"
+}
+
+get_sections_by_connection_type() {
+    local connection_type="$1"
+
+    uci show netshift | grep "\.connection_type='$connection_type'" | cut -d'.' -f2
+}
+
+section_by_connection_type_exists() {
+    local connection_type="$1"
+
+    if uci show netshift | grep -q "\.connection_type='$connection_type'"; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+section_has_enabled_lists() {
+    local section="$1"
+    local community_lists user_domain_list_type user_subnet_list_type local_domain_lists local_subnet_lists \
+        remote_domain_lists remote_subnet_lists
+
+    config_get community_lists "$section" "community_lists"
+    config_get user_domain_list_type "$section" "user_domain_list_type" "disabled"
+    config_get user_subnet_list_type "$section" "user_subnet_list_type" "disabled"
+    config_get local_domain_lists "$section" "local_domain_lists"
+    config_get local_subnet_lists "$section" "local_subnet_lists"
+    config_get remote_domain_lists "$section" "remote_domain_lists"
+    config_get remote_subnet_lists "$section" "remote_subnet_lists"
+
+    if [ -n "$community_lists" ] ||
+        [ "$user_domain_list_type" != "disabled" ] ||
+        [ "$user_subnet_list_type" != "disabled" ] ||
+        [ -n "$local_domain_lists" ] ||
+        [ -n "$local_subnet_lists" ] ||
+        [ -n "$remote_domain_lists" ] ||
+        [ -n "$remote_subnet_lists" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+get_service_listen_address() {
+    local service_listen_address
+
+    config_get service_listen_address "settings" "service_listen_address"
+    if [ -n "$service_listen_address" ]; then
+        log "Attention! The service_listen_address option is being used, overriding the automatic detection of the listening IP address!" "warn"
+        echo "$service_listen_address"
+        return 0
+    fi
+
+    local interface="lan"
+    network_get_ipaddr service_listen_address "$interface"
+
+    if [ -z "$service_listen_address" ]; then
+        log "Failed to determine the listening IP address. Please open an issue to report this problem: https://github.com/yandexru45/netshift/issues" "error"
+        return 1
+    fi
+
+    echo "$service_listen_address"
+}
+
+# Diagnostics
+sing_box_fetch_ifconfig_with_timeout() {
+    local config_dir="$1"
+    local config_path="$2"
+    local outbound_tag="$3"
+    local output_file fetch_pid watchdog_pid fetch_status
+
+    output_file="$(mktemp /tmp/netshift-check-proxy-response.XXXXXX)" || return 1
+
+    sing-box tools fetch -D "$config_dir" -c "$config_path" --outbound "$outbound_tag" ifconfig.me \
+        > "$output_file" 2>/dev/null &
+    fetch_pid=$!
+
+    (
+        sleep 20
+        kill "$fetch_pid" 2>/dev/null
+    ) &
+    watchdog_pid=$!
+
+    wait "$fetch_pid" 2>/dev/null
+    fetch_status=$?
+
+    kill "$watchdog_pid" 2>/dev/null
+    wait "$watchdog_pid" 2>/dev/null
+
+    cat "$output_file"
+    rm -f "$output_file"
+    return "$fetch_status"
+}
+
+get_clash_selected_outbound_tag() {
+    local outbound_tag="$1"
+    local controller_address encoded_tag selected_tag i
+
+    controller_address="$(get_service_listen_address 2>/dev/null)"
+    [ -z "$controller_address" ] && controller_address="127.0.0.1"
+
+    i=0
+    while [ "$i" -lt 5 ]; do
+        encoded_tag="$(printf '%s' "$outbound_tag" | jq -sRr @uri 2>/dev/null)"
+        selected_tag="$(curl -m 3 -s "http://$controller_address:$SB_CLASH_API_CONTROLLER_PORT/proxies/$encoded_tag" \
+            | jq -r '.now // ""' 2>/dev/null)"
+
+        if [ -z "$selected_tag" ] || [ "$selected_tag" = "$outbound_tag" ]; then
+            echo "$outbound_tag"
+            return 0
+        fi
+
+        outbound_tag="$selected_tag"
+        i=$((i + 1))
+    done
+
+    echo "$outbound_tag"
+}
+
+check_proxy() {
+    local sing_box_config_path check_config_path config_dir first_outbound_section outbound_tag response ip
+    config_get sing_box_config_path "settings" "config_path"
+
+    if ! command -v sing-box > /dev/null 2>&1; then
+        nolog "sing-box is not installed"
+        return 1
+    fi
+
+    if [ ! -f "$sing_box_config_path" ]; then
+        nolog "Configuration file not found"
+        return 1
+    fi
+
+    nolog "Checking sing-box configuration..."
+
+    if ! sing-box -c "$sing_box_config_path" check > /dev/null; then
+        nolog "Invalid configuration"
+        return 1
+    fi
+
+    jq '
+    walk(
+        if type == "object" then
+            with_entries(
+                if .key == "uuid" then
+                    .value = "MASKED"
+                elif .key == "server" then
+                    .value = "MASKED"
+                elif .key == "server_name" then
+                    .value = "MASKED"
+                elif .key == "password" then
+                    .value = "MASKED"
+                elif .key == "public_key" then
+                    .value = "MASKED"
+                elif .key == "short_id" then
+                    .value = "MASKED"
+                elif .key == "fingerprint" then
+                    .value = "MASKED"
+                elif .key == "server_port" then
+                    .value = "MASKED"
+                else . end
+            )
+        else . end
+    )' "$sing_box_config_path"
+
+    nolog "Checking proxy connection..."
+
+    first_outbound_section="$(get_first_outbound_section)"
+    if [ -z "$first_outbound_section" ]; then
+        nolog "No outbound section configured"
+        return 1
+    fi
+
+    outbound_tag="$(get_outbound_tag_by_section "$first_outbound_section")"
+    config_dir="${sing_box_config_path%/*}"
+    [ "$config_dir" = "$sing_box_config_path" ] && config_dir="."
+
+    check_config_path="$(mktemp /tmp/netshift-check-proxy.XXXXXX)" || {
+        nolog "Failed to create temporary sing-box configuration"
+        return 1
+    }
+
+    if ! jq '
+        if .experimental.cache_file then .experimental.cache_file.enabled = false else . end
+        | .dns.rules = []
+        | .route.rules = []
+        | .route.rule_set = []
+    ' "$sing_box_config_path" > "$check_config_path"; then
+        rm -f "$check_config_path"
+        nolog "Failed to prepare temporary sing-box configuration"
+        return 1
+    fi
+
+    if ! jq -e --arg tag "$outbound_tag" '.outbounds[]? | select(.tag == $tag)' \
+        "$check_config_path" > /dev/null; then
+        rm -f "$check_config_path"
+        nolog "Outbound '$outbound_tag' not found in sing-box configuration"
+        return 1
+    fi
+
+    if jq -e --arg tag "$outbound_tag" \
+        '.outbounds[]? | select(.tag == $tag and (.type == "selector" or .type == "urltest"))' \
+        "$check_config_path" > /dev/null; then
+        outbound_tag="$(get_clash_selected_outbound_tag "$outbound_tag")"
+    fi
+
+    if [ -z "$outbound_tag" ]; then
+        rm -f "$check_config_path"
+        nolog "No testable proxy outbound found in sing-box configuration"
+        return 1
+    fi
+
+    for attempt in $(seq 1 5); do
+        response="$(sing_box_fetch_ifconfig_with_timeout "$config_dir" "$check_config_path" "$outbound_tag")"
+        if echo "$response" | grep -q "^<html\|403 Forbidden"; then
+            if [ "$attempt" -eq 5 ]; then
+                nolog "Failed to get valid IP address after 5 attempts"
+                nolog "Error response: $response"
+                rm -f "$check_config_path"
+                return 1
+            fi
+            continue
+        fi
+        if echo "$response" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+            ip="$(echo "$response" | sed -n 's/^[0-9]\+\.[0-9]\+\.[0-9]\+\.\([0-9]\+\)$/X.X.X.\1/p')"
+            nolog "$ip - should match proxy IP"
+            rm -f "$check_config_path"
+            return 0
+        elif echo "$response" | grep -Eq '^([0-9a-fA-F]*:)[0-9a-fA-F:]+$'; then
+            ip="$(echo "$response" | sed 's/\([0-9a-fA-F]\+:[0-9a-fA-F]\+:[0-9a-fA-F]\+\):.*/\1:XXXX:XXXX:XXXX/')"
+            nolog "$ip - should match proxy IP"
+            rm -f "$check_config_path"
+            return 0
+        fi
+        if [ "$attempt" -eq 5 ]; then
+            nolog "Failed to get valid IP address after 5 attempts"
+            if [ -z "$response" ]; then
+                nolog "Error: Empty response"
+            else
+                nolog "Error response: $response"
+            fi
+            rm -f "$check_config_path"
+            return 1
+        fi
+    done
+
+    rm -f "$check_config_path"
+    return 1
+}
+
+check_nft() {
+    if ! command -v nft > /dev/null 2>&1; then
+        nolog "nft is not installed"
+        return 1
+    fi
+
+    nolog "Checking $NFT_TABLE_NAME rules..."
+
+    # Check if table exists
+    if ! nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
+        nolog "❌ $NFT_TABLE_NAME not found"
+        return 1
+    fi
+
+    local found_hetzner=0
+    local found_ovh=0
+
+    check_domain_list_contains() {
+        local section="$1"
+
+        config_get_bool domain_list_enabled "$section" "domain_list_enabled" "0"
+        if [ "$domain_list_enabled" -eq 1 ]; then
+            config_list_foreach "$section" "domain_list" check_domain_value
+        fi
+    }
+
+    check_domain_value() {
+        local domain_value="$1"
+
+        if [ "$domain_value" = "hetzner" ]; then
+            found_hetzner=1
+        elif [ "$domain_value" = "ovh" ]; then
+            found_ovh=1
+        fi
+    }
+
+    config_foreach check_domain_list_contains
+
+    if [ "$found_hetzner" -eq 1 ] || [ "$found_ovh" -eq 1 ]; then
+
+        local sets="netshift_domains interfaces netshift_discord_subnets localv4"
+
+        nolog "Sets statistics:"
+        for set_name in $sets; do
+            if nft list set inet "$NFT_TABLE_NAME" $set_name > /dev/null 2>&1; then
+                # Count elements using grep to count commas and add 1 (last element has no comma)
+                local count=$(nft list set inet "$NFT_TABLE_NAME" $set_name 2> /dev/null | grep -o ',\|{' | wc -l)
+                echo "- $set_name: $count elements"
+            fi
+        done
+
+        nolog "Chain configurations:"
+
+        # Create a temporary file for processing
+        local tmp_file=$(mktemp)
+        nft list table inet "$NFT_TABLE_NAME" > "$tmp_file"
+
+        # Extract chain configurations without element listings
+        sed -n '/chain mangle {/,/}/p' "$tmp_file" | grep -v "elements" | grep -v "^[[:space:]]*[0-9]"
+        sed -n '/chain proxy {/,/}/p' "$tmp_file" | grep -v "elements" | grep -v "^[[:space:]]*[0-9]"
+
+        # Clean up
+        rm -f "$tmp_file"
+    else
+        # Simple view as originally implemented
+        nolog "Sets configuration:"
+        nft list table inet "$NFT_TABLE_NAME"
+    fi
+
+    nolog "NFT check completed"
+}
+
+check_logs() {
+    if ! command -v logread > /dev/null 2>&1; then
+        nolog "Error: logread command not found"
+        return 1
+    fi
+
+    local logs
+    logs=$(logread | grep -E "netshift|sing-box")
+
+    if [ -z "$logs" ]; then
+        nolog "Logs not found"
+        return 1
+    fi
+
+    # Find the last occurrence of "Starting netshift"
+    local start_line
+    start_line=$(echo "$logs" | grep -n "netshift.*Starting netshift" | tail -n 1 | cut -d: -f1)
+
+    if [ -n "$start_line" ]; then
+        echo "$logs" | tail -n +"$start_line"
+    else
+        nolog "No 'Starting netshift' message found, showing last 100 lines"
+        echo "$logs" | tail -n 100
+    fi
+}
+
+show_sing_box_config() {
+    local sing_box_config_path
+    config_get sing_box_config_path "settings" "config_path"
+    nolog "Current sing-box configuration:"
+
+    if [ ! -f "$sing_box_config_path" ]; then
+        nolog "Configuration file not found"
+        return 1
+    fi
+
+    jq '
+    walk(
+        if type == "object" then
+            with_entries(
+                if .key == "uuid" then
+                    .value = "MASKED"
+                elif .key == "server" then
+                    .value = "MASKED"
+                elif .key == "server_name" then
+                    .value = "MASKED"
+                elif .key == "password" then
+                    .value = "MASKED"
+                elif .key == "public_key" then
+                    .value = "MASKED"
+                elif .key == "short_id" then
+                    .value = "MASKED"
+                elif .key == "fingerprint" then
+                    .value = "MASKED"
+                elif .key == "server_port" then
+                    .value = "MASKED"
+                else . end
+            )
+        else . end
+    )' "$sing_box_config_path"
+}
+
+show_config() {
+    if [ ! -f "$NETSHIFT_CONFIG" ]; then
+        nolog "Configuration file not found"
+        return 1
+    fi
+
+    tmp_config=$(mktemp)
+
+    sed -e 's/\(option proxy_string\).*/\1 '\''MASKED'\''/g' \
+        -e '/option outbound_json/,/^}/c\	option outbound_json '\''MASKED'\''' \
+        -e 's/\(list urltest_proxy_links\).*/\1 '\''MASKED'\''/g' \
+        -e 's/\(list selector_proxy_links\).*/\1 '\''MASKED'\''/g' \
+        -e "s@\\(option dns_server '[^/]*\\)/[^']*'@\\1/MASKED'@g" \
+        -e "s@\\(option domain_resolver_dns_server '[^/]*\\)/[^']*'@\\1/MASKED'@g" \
+        -e 's/\(option yacd_secret_key\).*/\1 '\''MASKED'\''/g' \
+        "$NETSHIFT_CONFIG" > "$tmp_config"
+
+    cat "$tmp_config"
+    rm -f "$tmp_config"
+}
+
+show_version() {
+    echo "$NETSHIFT_VERSION"
+}
+
+show_sing_box_version() {
+    local version
+    version=$(sing-box version | head -n 1 | awk '{print $3}')
+    echo "$version"
+}
+
+show_system_info() {
+    echo "=== OpenWrt Version ==="
+    grep OPENWRT_RELEASE /etc/os-release | cut -d'"' -f2
+    echo
+    echo "=== Device Model ==="
+    cat /tmp/sysinfo/model
+}
+
+get_system_info() {
+    local netshift_version netshift_latest_version luci_app_version sing_box_version openwrt_version device_model sing_box_extended
+
+    netshift_version="$NETSHIFT_VERSION"
+
+    # On-demand only: get_system_info must do NO network I/O (the UI calls it on
+    # every Manager/Diagnostic mount). The real latest is fetched only by the
+    # on-demand "component_action netshift check_update" action (and by
+    # global_check, the one-shot SSH diagnostic). The key is kept for backward
+    # compatibility (frontend type + global_check jq read it); "unknown" is the
+    # zero-network sentinel the UI already understands.
+    netshift_latest_version="unknown"
+
+    if [ -f /www/luci-static/resources/view/netshift/main.js ]; then
+        luci_app_version=$(grep 'var NETSHIFT_LUCI_APP_VERSION' /www/luci-static/resources/view/netshift/main.js | cut -d'"' -f2)
+    else
+        luci_app_version="not installed"
+    fi
+
+    if command -v sing-box > /dev/null 2>&1; then
+        sing_box_version=$(sing-box version 2> /dev/null | head -n 1 | awk '{print $3}')
+        [ -z "$sing_box_version" ] && sing_box_version="unknown"
+    else
+        sing_box_version="not installed"
+    fi
+
+    sing_box_extended=0
+    if command -v sing-box > /dev/null 2>&1 && is_sing_box_extended "$sing_box_version"; then
+        sing_box_extended=1
+    fi
+
+    if [ -f /etc/os-release ]; then
+        openwrt_version=$(grep OPENWRT_RELEASE /etc/os-release | cut -d'"' -f2)
+        [ -z "$openwrt_version" ] && openwrt_version="unknown"
+    else
+        openwrt_version="unknown"
+    fi
+
+    if [ -f /tmp/sysinfo/model ]; then
+        device_model=$(cat /tmp/sysinfo/model)
+        [ -z "$device_model" ] && device_model="unknown"
+    else
+        device_model="unknown"
+    fi
+
+    echo "{\"netshift_version\": \"$netshift_version\", \"netshift_latest_version\": \"$netshift_latest_version\", \"luci_app_version\": \"$luci_app_version\", \"sing_box_version\": \"$sing_box_version\", \"sing_box_extended\": $sing_box_extended, \"openwrt_version\": \"$openwrt_version\", \"device_model\": \"$device_model\"}" | jq .
+}
+
+get_sing_box_status() {
+    local running=0
+    local enabled=0
+    local status=""
+    local version=""
+    local dns_configured=0
+
+    # Check if service is enabled
+    if [ -x /etc/rc.d/S99sing-box ]; then
+        enabled=1
+    fi
+
+    # Check if service is running
+    if pgrep -f "sing-box" > /dev/null; then
+        running=1
+        version=$(sing-box version | head -n 1 | awk '{print $3}')
+    fi
+
+    # Check DNS configuration
+    local dns_server
+    dns_server=$(uci get dhcp.@dnsmasq[0].server 2> /dev/null)
+    if [ "$dns_server" = "127.0.0.42" ]; then
+        dns_configured=1
+    fi
+
+    # Format status message
+    if [ $running -eq 1 ]; then
+        if [ $enabled -eq 1 ]; then
+            status="running & enabled"
+        else
+            status="running but disabled"
+        fi
+    else
+        if [ $enabled -eq 1 ]; then
+            status="stopped but enabled"
+        else
+            status="stopped & disabled"
+        fi
+    fi
+
+    echo "{\"running\":$running,\"enabled\":$enabled,\"status\":\"$status\",\"dns_configured\":$dns_configured}"
+}
+
+get_status() {
+    local enabled=0
+    local status=""
+
+    # Check if service is enabled
+    if [ -x /etc/rc.d/S99netshift ]; then
+        enabled=1
+        status="enabled"
+    else
+        status="disabled"
+    fi
+
+    echo "{\"enabled\":$enabled,\"status\":\"$status\"}"
+}
+
+check_dns_available() {
+    local dns_type dns_server bootstrap_dns_server
+    config_get dns_type "settings" "dns_type"
+    config_get dns_server "settings" "dns_server"
+    config_get bootstrap_dns_server "settings" "bootstrap_dns_server"
+
+    local dns_status=0
+    local dns_on_router=0
+    local bootstrap_dns_status=0
+    local dhcp_config_status=1
+    local domain="google.com"
+
+    # Mask NextDNS ID if present
+    local display_dns_server="$dns_server"
+    if echo "$dns_server" | grep -q "\.dns\.nextdns\.io$"; then
+        local nextdns_id
+        nextdns_id=$(echo "$dns_server" | cut -d'.' -f1)
+        display_dns_server="$(echo "$nextdns_id" | sed 's/./*/g').dns.nextdns.io"
+    elif echo "$dns_server" | grep -q "^dns\.nextdns\.io/"; then
+        local masked_path
+        masked_path=$(echo "$dns_server" | cut -d'/' -f2- | sed 's/./*/g')
+        display_dns_server="dns.nextdns.io/$masked_path"
+    fi
+
+    if [ "$dns_type" = "doh" ]; then
+        # Check if dns_server already contains a path
+        local doh_path="/dns-query"
+        if echo "$dns_server" | grep -q "/"; then
+            # Path is already present, extract it
+            doh_path="/$(echo "$dns_server" | cut -d'/' -f2-)"
+            dns_server="$(echo "$dns_server" | cut -d'/' -f1)"
+        fi
+
+        if dig @"$dns_server" "$domain" +https="$doh_path" +timeout=2 +tries=1 > /dev/null 2>&1; then
+            dns_status=1
+        fi
+    elif [ "$dns_type" = "dot" ]; then
+        if dig @"$dns_server" "$domain" +tls +timeout=2 +tries=1 > /dev/null 2>&1; then
+            dns_status=1
+        fi
+    elif [ "$dns_type" = "udp" ]; then
+        if dig @"$dns_server" "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
+            dns_status=1
+        fi
+    fi
+
+    # Check if local DNS resolver is working
+    if dig @127.0.0.1 "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
+        dns_on_router=1
+    fi
+
+    # Check bootstrap DNS server
+    if [ -n "$bootstrap_dns_server" ]; then
+        if dig @"$bootstrap_dns_server" "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
+            bootstrap_dns_status=1
+        fi
+    fi
+
+    # Check if /etc/config/dhcp has server 127.0.0.42
+    config_load dhcp
+    config_foreach check_dhcp_has_netshift_dns dnsmasq
+    config_load "$NETSHIFT_CONFIG"
+
+    # Effective detour tag the main DNS would use (empty string = direct DNS).
+    local dns_via_outbound_tag
+    dns_via_outbound_tag="$(_get_dns_detour_tag)"
+
+    echo "{\"dns_type\":\"$dns_type\",\"dns_server\":\"$display_dns_server\",\"dns_status\":$dns_status,\"dns_on_router\":$dns_on_router,\"bootstrap_dns_server\":\"$bootstrap_dns_server\",\"bootstrap_dns_status\":$bootstrap_dns_status,\"dhcp_config_status\":$dhcp_config_status,\"dns_via_outbound_tag\":\"$dns_via_outbound_tag\"}" | jq .
+}
+
+check_dhcp_has_netshift_dns() {
+    local server_list cachesize noresolv server_found
+    config_get server_list "$1" "server"
+    config_get cachesize "$1" "cachesize"
+    config_get noresolv "$1" "noresolv"
+
+    server_found=0
+
+    if [ -n "$server_list" ]; then
+        for server in $server_list; do
+            if [ "$server" = "127.0.0.42" ]; then
+                server_found=1
+                break
+            fi
+        done
+    fi
+
+    if [ "$cachesize" != "0" ] || [ "$noresolv" != "1" ] || [ "$server_found" != "1" ]; then
+        dhcp_config_status=0
+    fi
+}
+
+check_nft_rules() {
+    local table_exist=0
+    local rules_mangle_exist=0
+    local rules_mangle_counters=0
+    local rules_mangle_output_exist=0
+    local rules_proxy_exist=0
+    local rules_proxy_counters=0
+    local rules_other_mark_exist=0
+
+    # Generate traffic through NetShiftTable
+    curl -m 3 -s "https://$CHECK_PROXY_IP_DOMAIN/check" > /dev/null 2>&1 &
+    local pid1=$!
+    curl -m 3 -s "https://$FAKEIP_TEST_DOMAIN/check" > /dev/null 2>&1 &
+    local pid2=$!
+
+    wait $pid1 2> /dev/null
+    wait $pid2 2> /dev/null
+    sleep 1
+
+    # Check if NetShiftTable exists
+    if nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
+        table_exist=1
+
+        # Check mangle chain rules
+        if nft list chain inet "$NFT_TABLE_NAME" mangle > /dev/null 2>&1; then
+            local mangle_output
+            mangle_output=$(nft list chain inet "$NFT_TABLE_NAME" mangle)
+            if echo "$mangle_output" | grep -q "counter"; then
+                rules_mangle_exist=1
+
+                if echo "$mangle_output" | grep "counter" | grep -qv "packets 0 bytes 0"; then
+                    rules_mangle_counters=1
+                fi
+            fi
+        fi
+
+        # Check mangle_output chain rules
+        if nft list chain inet "$NFT_TABLE_NAME" mangle_output > /dev/null 2>&1; then
+            local mangle_output_output
+            mangle_output_output=$(nft list chain inet "$NFT_TABLE_NAME" mangle_output)
+            if echo "$mangle_output_output" | grep -q "counter"; then
+                rules_mangle_output_exist=1
+            fi
+        fi
+
+        # Check proxy chain rules
+        if nft list chain inet "$NFT_TABLE_NAME" proxy > /dev/null 2>&1; then
+            local proxy_output
+            proxy_output=$(nft list chain inet "$NFT_TABLE_NAME" proxy)
+            if echo "$proxy_output" | grep -q "counter"; then
+                rules_proxy_exist=1
+
+                if echo "$proxy_output" | grep "counter" | grep -qv "packets 0 bytes 0"; then
+                    rules_proxy_counters=1
+                fi
+            fi
+        fi
+    fi
+
+    # Check for other mark rules outside NetShiftTable
+    nft list tables 2> /dev/null | while read -r _ family table_name; do
+        [ -z "$table_name" ] && continue
+
+        [ "$table_name" = "$NFT_TABLE_NAME" ] && continue
+
+        if nft list table "$family" "$table_name" 2> /dev/null | grep -q "meta mark set"; then
+            touch /tmp/netshift_mark_check.$$
+            break
+        fi
+    done
+
+    if [ -f /tmp/netshift_mark_check.$$ ]; then
+        rules_other_mark_exist=1
+        rm -f /tmp/netshift_mark_check.$$
+    fi
+
+    echo "{\"table_exist\":$table_exist,\"rules_mangle_exist\":$rules_mangle_exist,\"rules_mangle_counters\":$rules_mangle_counters,\"rules_mangle_output_exist\":$rules_mangle_output_exist,\"rules_proxy_exist\":$rules_proxy_exist,\"rules_proxy_counters\":$rules_proxy_counters,\"rules_other_mark_exist\":$rules_other_mark_exist}" | jq .
+}
+
+check_sing_box() {
+    local sing_box_installed=0
+    local sing_box_version_ok=0
+    local sing_box_service_exist=0
+    local sing_box_autostart_disabled=0
+    local sing_box_process_running=0
+    local sing_box_ports_listening=0
+
+    # Check if sing-box is installed
+    if command -v sing-box > /dev/null 2>&1; then
+        sing_box_installed=1
+
+        # Check version (must be >= 1.12.4)
+        local version
+        version=$(sing-box version 2> /dev/null | head -n 1 | awk '{print $3}')
+        if [ -n "$version" ]; then
+            version=$(echo "$version" | sed 's/^v//')
+            # Extended cores report e.g. "1.13.12-extended-2.3.2"; the author only changes
+            # the trailing "-extended-X.Y.Z" while the leading semver is the true upstream
+            # sing-box version. Strip everything from the first '-' so the numeric compare
+            # below works for both stock and extended builds.
+            version=${version%%-*}
+            local major
+            local minor
+            local patch
+            major=$(echo "$version" | cut -d. -f1)
+            minor=$(echo "$version" | cut -d. -f2)
+            patch=$(echo "$version" | cut -d. -f3)
+
+            # Compare version: must be >= 1.12.4. Each AND-term is grouped in
+            # { ...; } so the || branches are independent — POSIX list operators
+            # && / || are equal-precedence/left-associative, so without grouping
+            # the trailing minor/patch tests would wrongly gate every branch
+            # (e.g. 1.13.x and 2.0.0 would evaluate as not-compatible).
+            if [ "$major" -gt 1 ] ||
+                { [ "$major" -eq 1 ] && [ "$minor" -gt 12 ]; } ||
+                { [ "$major" -eq 1 ] && [ "$minor" -eq 12 ] && [ "$patch" -ge 4 ]; }; then
+                sing_box_version_ok=1
+            fi
+        fi
+    fi
+
+    # Check if service exists
+    if [ -f /etc/init.d/sing-box ]; then
+        sing_box_service_exist=1
+
+        if ! /etc/init.d/sing-box enabled 2> /dev/null; then
+            sing_box_autostart_disabled=1
+        fi
+    fi
+
+    # Check if process is running
+    if sing_box_process_exists; then
+        sing_box_process_running=1
+    fi
+
+    # Check if sing-box is listening on required ports
+    local port_53_ok=0
+    local port_1602_ok=0
+
+    if netstat -ln 2> /dev/null | grep -q "127.0.0.42:53"; then
+        port_53_ok=1
+    fi
+
+    if netstat -ln 2> /dev/null | grep -q "127.0.0.1:1602"; then
+        port_1602_ok=1
+    fi
+
+    # Both ports must be listening
+    if [ "$port_53_ok" = "1" ] && [ "$port_1602_ok" = "1" ]; then
+        sing_box_ports_listening=1
+    fi
+
+    echo "{\"sing_box_installed\":$sing_box_installed,\"sing_box_version_ok\":$sing_box_version_ok,\"sing_box_service_exist\":$sing_box_service_exist,\"sing_box_autostart_disabled\":$sing_box_autostart_disabled,\"sing_box_process_running\":$sing_box_process_running,\"sing_box_ports_listening\":$sing_box_ports_listening}" | jq .
+}
+
+check_fakeip() {
+    local fakeip_address
+
+    fakeip_address="$(dig +short @"$SB_DNS_INBOUND_ADDRESS" "$FAKEIP_TEST_DOMAIN" 2>/dev/null | sed -n '1p')"
+    if echo "$fakeip_address" | grep -q '^198\.18\.'; then
+        jq -n --arg ip "$fakeip_address" '{fakeip: true, IP: $ip}'
+        return 0
+    fi
+
+    jq -n --arg ip "$fakeip_address" '{fakeip: false, IP: $ip}'
+}
+
+#######################################
+# Clash API interface for managing proxies and groups
+# Arguments:
+#   $1 - Action: get_proxies, get_proxy_latency, get_group_latency, set_group_proxy
+#   $2 - Proxy/Group tag (required for latency and set operations)
+#   $3 - Timeout in ms (optional, defaults: 2000 for proxy, 5000 for group) or target proxy tag for set_group_proxy
+# Outputs:
+#   JSON formatted response
+# Usage:
+#   clash_api get_proxies
+#   clash_api get_proxy_latency <proxy_tag> [timeout]
+#   clash_api get_group_latency <group_tag> [timeout]
+#   clash_api set_group_proxy <group_tag> <proxy_tag>
+#######################################
+
+clash_api() {
+    local action="$1"
+    local clash_api_controller_address CLASH_URL TEST_URL
+    clash_api_controller_address="$(get_service_listen_address)"
+    if [ -z "$clash_api_controller_address" ]; then
+        clash_api_controller_address="127.0.0.1"
+    fi
+    CLASH_URL="$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT"
+    TEST_URL="https://www.gstatic.com/generate_204"
+
+    local enable_yacd_wan_access yacd_secret_key auth_header
+    config_get_bool enable_yacd_wan_access "settings" "enable_yacd_wan_access" 0
+    config_get yacd_secret_key "settings" "yacd_secret_key"
+
+    if [ "$enable_yacd_wan_access" -eq 1 ]; then
+        auth_header="Authorization: Bearer $yacd_secret_key"
+    else
+        auth_header=""
+    fi
+
+    case "$action" in
+    get_proxies)
+        curl -s --header "$auth_header" "$CLASH_URL/proxies" | jq .
+        ;;
+
+    get_proxy_latency)
+        local proxy_tag="$2"
+        local encoded_proxy_tag
+        local timeout="${3:-2000}"
+
+        if [ -z "$proxy_tag" ]; then
+            echo '{"error":"proxy_tag required"}' | jq .
+            return 1
+        fi
+
+        encoded_proxy_tag=$(printf '%s' "$proxy_tag" | jq -sRr @uri)
+
+        curl -G -s "$CLASH_URL/proxies/$encoded_proxy_tag/delay" \
+            --header "$auth_header" \
+            --data-urlencode "url=$TEST_URL" \
+            --data-urlencode "timeout=$timeout" | jq .
+        ;;
+
+    get_group_latency)
+        local group_tag="$2"
+        local encoded_group_tag
+        local timeout="${3:-5000}"
+
+        if [ -z "$group_tag" ]; then
+            echo '{"error":"group_tag required"}' | jq .
+            return 1
+        fi
+
+        encoded_group_tag=$(printf '%s' "$group_tag" | jq -sRr @uri)
+
+        curl -G -s "$CLASH_URL/group/$encoded_group_tag/delay" \
+            --header "$auth_header" \
+            --data-urlencode "url=$TEST_URL" \
+            --data-urlencode "timeout=$timeout" | jq .
+        ;;
+
+    set_group_proxy)
+        local group_tag="$2"
+        local proxy_tag="$3"
+
+        local encoded_group_tag payload
+        encoded_group_tag=$(printf '%s' "$group_tag" | jq -sRr @uri)
+        payload=$(jq -cn --arg name "$proxy_tag" '{name:$name}')
+
+        if [ -z "$group_tag" ] || [ -z "$proxy_tag" ]; then
+            echo '{"error":"group_tag and proxy_tag required"}' | jq .
+            return 1
+        fi
+
+        local response
+        response=$(
+            curl -X PUT -s -w "\n%{http_code}" "$CLASH_URL/proxies/$encoded_group_tag" \
+                --header "$auth_header" \
+                --header "Content-Type: application/json" \
+                --data-raw "$payload"
+        )
+
+        local http_code
+        local body
+        http_code=$(echo "$response" | tail -n 1)
+        body=$(echo "$response" | sed '$d')
+
+        case "$http_code" in
+        204)
+            jq -n --arg group "$group_tag" --arg proxy "$proxy_tag" '{success:true,group:$group,proxy:$proxy}'
+            ;;
+        404)
+            jq -n --arg group "$group_tag" '{success:false,error:"group_not_found",message:($group + " does not exist")}'
+            return 1
+            ;;
+        400)
+            if echo "$body" | grep -q "not found"; then
+                jq -n --arg proxy "$proxy_tag" --arg group "$group_tag" '{success:false,error:"proxy_not_found",message:($proxy + " not found in group " + $group)}'
+            else
+                echo '{"success":false,"error":"bad_request","message":"Invalid request"}' | jq .
+            fi
+            return 1
+            ;;
+        *)
+            if [ -n "$body" ]; then
+                local body_json
+                body_json=$(echo "$body" | jq -c .)
+                echo "{\"success\":false,\"http_code\":$http_code,\"body\":$body_json}" | jq .
+            else
+                echo "{\"success\":false,\"http_code\":$http_code}" | jq .
+            fi
+            return 1
+            ;;
+        esac
+        ;;
+
+    *)
+        echo '{"error":"unknown action","available":["get_proxies","get_proxy_latency","get_group_latency","set_group_proxy"]}' | jq .
+        return 1
+        ;;
+    esac
+}
+
+print_global() {
+    local message="$1"
+    echo "$message"
+}
+
+global_check() {
+    local NETSHIFT_LUCI_VERSION="Unknown"
+    [ -n "$1" ] && NETSHIFT_LUCI_VERSION="$1"
+
+    print_global "📡 Global check run!"
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🛠️ System info"
+
+    local system_info_json
+    system_info_json=$(get_system_info)
+
+    if [ -n "$system_info_json" ]; then
+    local netshift_version netshift_latest_version luci_app_version sing_box_version openwrt_version device_model sing_box_extended
+
+        netshift_version=$(echo "$system_info_json" | jq -r '.netshift_version // "unknown"')
+        # get_system_info no longer fetches the latest (it does no network I/O).
+        # global_check is a one-shot SSH diagnostic, so fetch the real latest here
+        # itself (shared helper); fall back to "unknown" if GitHub is unreachable.
+        netshift_latest_version=$(updates_netshift_latest_tag)
+        [ -z "$netshift_latest_version" ] && netshift_latest_version="unknown"
+        luci_app_version=$(echo "$system_info_json" | jq -r '.luci_app_version // "unknown"')
+        sing_box_version=$(echo "$system_info_json" | jq -r '.sing_box_version // "unknown"')
+        openwrt_version=$(echo "$system_info_json" | jq -r '.openwrt_version // "unknown"')
+        device_model=$(echo "$system_info_json" | jq -r '.device_model // "unknown"')
+
+        print_global "🕳️ NetShift:      $netshift_version (latest: $netshift_latest_version)"
+        print_global "🕳️ LuCI App:      $luci_app_version"
+        print_global "📦 Sing-box:      $sing_box_version"
+        print_global "🛜 OpenWrt:       $openwrt_version"
+        print_global "🛜 Device:        $device_model"
+    else
+        print_global "❌ Failed to get system info"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "➡️ DNS status"
+
+    local dns_check_json
+    dns_check_json=$(check_dns_available)
+
+    if [ -n "$dns_check_json" ]; then
+        local dns_type dns_server dns_status dns_on_router bootstrap_dns_server bootstrap_dns_status dhcp_config_status
+        local dns_via_outbound_tag
+
+        dns_type=$(echo "$dns_check_json" | jq -r '.dns_type // "unknown"')
+        dns_server=$(echo "$dns_check_json" | jq -r '.dns_server // "unknown"')
+        dns_status=$(echo "$dns_check_json" | jq -r '.dns_status // 0')
+        dns_on_router=$(echo "$dns_check_json" | jq -r '.dns_on_router // 0')
+        bootstrap_dns_server=$(echo "$dns_check_json" | jq -r '.bootstrap_dns_server // ""')
+        bootstrap_dns_status=$(echo "$dns_check_json" | jq -r '.bootstrap_dns_status // 0')
+        dhcp_config_status=$(echo "$dns_check_json" | jq -r '.dhcp_config_status // 0')
+        dns_via_outbound_tag=$(echo "$dns_check_json" | jq -r '.dns_via_outbound_tag // ""')
+
+        # Bootstrap DNS
+        if [ -n "$bootstrap_dns_server" ]; then
+            if [ "$bootstrap_dns_status" -eq 1 ]; then
+                print_global "✅ Bootstrap DNS: $bootstrap_dns_server"
+            else
+                print_global "❌ Bootstrap DNS: $bootstrap_dns_server"
+            fi
+        fi
+
+        # DNS server status
+        if [ "$dns_status" -eq 1 ]; then
+            print_global "✅ Main DNS: $dns_server [$dns_type]"
+        else
+            print_global "❌ Main DNS: $dns_server [$dns_type]"
+        fi
+
+        # Main DNS detour (DNS-via-outbound)
+        if [ -n "$dns_via_outbound_tag" ]; then
+            print_global "ℹ️ Main DNS via outbound: $dns_via_outbound_tag"
+        else
+            print_global "ℹ️ Main DNS: direct"
+        fi
+
+        # DNS on router
+        if [ "$dns_on_router" -eq 1 ]; then
+            print_global "✅ DNS on router"
+        else
+            print_global "❌ DNS on router"
+        fi
+
+        # DHCP configuration check
+        local dont_touch_dhcp
+        config_get dont_touch_dhcp "settings" "dont_touch_dhcp"
+
+        if [ "$dont_touch_dhcp" = "1" ]; then
+            print_global "⚠️ dont_touch_dhcp is enabled. 📄 DHCP config:"
+            awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
+        elif [ "$dhcp_config_status" -eq 0 ]; then
+            print_global "❌ DHCP configuration differs from template. 📄 DHCP config:"
+            awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
+        else
+            print_global "✅ /etc/config/dhcp"
+        fi
+    else
+        print_global "❌ Failed to get DNS info"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "📦 Sing-box status"
+
+    local singbox_check_json
+    singbox_check_json=$(check_sing_box)
+
+    if [ -n "$singbox_check_json" ]; then
+        local sing_box_installed sing_box_version_ok sing_box_service_exist sing_box_autostart_disabled sing_box_process_running sing_box_ports_listening
+
+        sing_box_installed=$(echo "$singbox_check_json" | jq -r '.sing_box_installed // 0')
+        sing_box_version_ok=$(echo "$singbox_check_json" | jq -r '.sing_box_version_ok // 0')
+        sing_box_service_exist=$(echo "$singbox_check_json" | jq -r '.sing_box_service_exist // 0')
+        sing_box_autostart_disabled=$(echo "$singbox_check_json" | jq -r '.sing_box_autostart_disabled // 0')
+        sing_box_process_running=$(echo "$singbox_check_json" | jq -r '.sing_box_process_running // 0')
+        sing_box_ports_listening=$(echo "$singbox_check_json" | jq -r '.sing_box_ports_listening // 0')
+
+        if [ "$sing_box_installed" -eq 1 ]; then
+            print_global "✅ Sing-box installed"
+        else
+            print_global "❌ Sing-box installed"
+        fi
+
+        if [ "$sing_box_version_ok" -eq 1 ]; then
+            print_global "✅ Sing-box version is compatible (newer than 1.12.4)"
+        else
+            print_global "❌ Sing-box version is not compatible (older than 1.12.4)"
+        fi
+
+        if [ "$sing_box_service_exist" -eq 1 ]; then
+            print_global "✅ Sing-box service exist"
+        else
+            print_global "❌ Sing-box service exist"
+        fi
+
+        if [ "$sing_box_autostart_disabled" -eq 1 ]; then
+            print_global "✅ Sing-box autostart disabled"
+        else
+            print_global "❌ Sing-box autostart disabled"
+        fi
+
+        if [ "$sing_box_process_running" -eq 1 ]; then
+            print_global "✅ Sing-box process running"
+        else
+            print_global "❌ Sing-box process running"
+        fi
+
+        if [ "$sing_box_ports_listening" -eq 1 ]; then
+            print_global "✅ Sing-box listening ports"
+        else
+            print_global "❌ Sing-box listening ports"
+        fi
+    else
+        print_global "❌ Failed to get sing-box info"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🧱 NFT rules status"
+
+    local nft_check_json
+    nft_check_json=$(check_nft_rules)
+
+    if [ -n "$nft_check_json" ]; then
+        local table_exist rules_mangle_exist rules_mangle_counters rules_mangle_output_exist rules_proxy_exist rules_proxy_counters rules_other_mark_exist
+
+        table_exist=$(echo "$nft_check_json" | jq -r '.table_exist // 0')
+        rules_mangle_exist=$(echo "$nft_check_json" | jq -r '.rules_mangle_exist // 0')
+        rules_mangle_counters=$(echo "$nft_check_json" | jq -r '.rules_mangle_counters // 0')
+        rules_mangle_output_exist=$(echo "$nft_check_json" | jq -r '.rules_mangle_output_exist // 0')
+        rules_proxy_exist=$(echo "$nft_check_json" | jq -r '.rules_proxy_exist // 0')
+        rules_proxy_counters=$(echo "$nft_check_json" | jq -r '.rules_proxy_counters // 0')
+        rules_other_mark_exist=$(echo "$nft_check_json" | jq -r '.rules_other_mark_exist // 0')
+
+        if [ "$table_exist" -eq 1 ]; then
+            print_global "✅ Table exist"
+        else
+            print_global "❌ Table exist"
+        fi
+
+        if [ "$rules_mangle_exist" -eq 1 ]; then
+            print_global "✅ Rules mangle exist"
+        else
+            print_global "❌ Rules mangle exist"
+        fi
+
+        if [ "$rules_mangle_counters" -eq 1 ]; then
+            print_global "✅ Rules mangle counters"
+        else
+            print_global "⚠️  Rules mangle counters"
+        fi
+
+        if [ "$rules_mangle_output_exist" -eq 1 ]; then
+            print_global "✅ Rules mangle output exist"
+        else
+            print_global "❌ Rules mangle output exist"
+        fi
+
+        if [ "$rules_proxy_exist" -eq 1 ]; then
+            print_global "✅ Rules proxy exist"
+        else
+            print_global "❌ Rules proxy exist"
+        fi
+
+        if [ "$rules_proxy_counters" -eq 1 ]; then
+            print_global "✅ Rules proxy counters"
+        else
+            print_global "⚠️  Rules proxy counters"
+        fi
+
+        if [ "$rules_other_mark_exist" -eq 1 ]; then
+            print_global "⚠️  Additional marking rules found:"
+            nft list ruleset | awk '/table inet '"$NFT_TABLE_NAME"'/{flag=1; next} /^table/{flag=0} !flag' | grep -E "mark set|meta mark"
+        else
+            print_global "✅ Additional marking rules found"
+        fi
+    else
+        print_global "❌ Failed to get NFT rules info"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "📄 NetShift config"
+    show_config
+
+    # print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    # print_global "🔧 System check"
+
+    # if grep -E "^nameserver\s+([0-9]{1,3}\.){3}[0-9]{1,3}" "$RESOLV_CONF" | grep -vqE "127\.0\.0\.1|0\.0\.0\.0"; then
+    #     print_global "❌ /etc/resolv.conf contains external nameserver:"
+    #     cat /etc/resolv.conf
+    #     echo ""
+    # else
+    #     print_global "✅ /etc/resolv.conf"
+    # fi
+
+    # print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    # print_global "🧱 NFT table"
+    # check_nft
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "📄 WAN config"
+    if uci show network.wan > /dev/null 2>&1; then
+        awk '
+            /^config / {
+                p = ($2 == "interface" && $3 == "'\''wan'\''")
+                proto = ""
+            }
+            p {
+                if ($1 == "option" && $2 == "proto") {
+                    proto = $3
+                    print
+                } else if (proto == "'\''static'\''" && $1 == "option" && ($2 == "ipaddr" || $2 == "netmask" || $2 == "gateway")) {
+                    print "        option", $2, "'\''******'\''"
+                } else if (proto == "'\''pppoe'\''" && $1 == "option" && ($2 == "username" || $2 == "password")) {
+                    print "        option", $2, "'\''******'\''"
+                } else {
+                    print
+                }
+            }
+        ' /etc/config/network
+    else
+        print_global "❌ WAN configuration not found"
+    fi
+
+    if uci show network | grep -q endpoint_host; then
+        uci show network | grep endpoint_host | cut -d'=' -f2 | tr -d "'\" " | while read -r host; do
+            if [ "$host" = "engage.cloudflareclient.com" ]; then
+                print_global "⚠️ WARP detected: $host"
+                continue
+            fi
+
+            ip_prefix=$(echo "$host" | cut -d'.' -f1,2)
+            if echo "$CLOUDFLARE_OCTETS" | grep -wq "$ip_prefix"; then
+                print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+                print_global "⚠️ WARP detected: $host"
+            fi
+        done
+    fi
+
+    if uci show network | grep -q route_allowed_ips; then
+        uci show network | grep "wireguard_.*\.route_allowed_ips='1'" | cut -d'.' -f1-2 | while read -r peer_section; do
+            local allowed_ips
+            allowed_ips=$(uci get "${peer_section}.allowed_ips" 2> /dev/null)
+
+            if [ "$allowed_ips" = "0.0.0.0/0" ]; then
+                print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+                print_global "⚠️ WG Route allowed IP enabled with 0.0.0.0/0"
+            fi
+        done
+    fi
+
+    if [ -f "/etc/init.d/zapret" ]; then
+        print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        print_global "⚠️ Zapret detected"
+    fi
+
+    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    print_global "🥸 FakeIP status"
+
+    local fakeip_check_json
+    fakeip_check_json=$(check_fakeip)
+
+    if [ -n "$fakeip_check_json" ]; then
+        local fakeip_status
+
+        fakeip_status=$(echo "$fakeip_check_json" | jq -r '.fakeip // false')
+
+        if [ "$fakeip_status" = "true" ]; then
+            print_global "✅ Router DNS is routed through sing-box"
+        else
+            print_global "⚠️ Router DNS is NOT routed through sing-box"
+        fi
+    else
+        print_global "❌ Failed to get FakeIP info"
+    fi
+
+    local fakeip_address
+    fakeip_address=$(dig +short @127.0.0.42 $FAKEIP_TEST_DOMAIN)
+
+    if echo "$fakeip_address" | grep -q "^198\.18\."; then
+        print_global "✅ Sing-box works with FakeIP: $fakeip_address"
+    else
+        print_global "❌ Sing-box does NOT work with FakeIP: $fakeip_address"
+    fi
+}
+
+show_help() {
+    cat << EOF
+Usage: $0 COMMAND
+
+Available commands:
+    start                   Start NetShift service
+    stop                    Stop NetShift service
+    reload                  Reload NetShift configuration
+    restart                 Restart NetShift service
+    main                    Run main NetShift process
+    list_update             Update domain lists
+    subscription_update     Update subscription proxies
+    check_proxy             Check proxy connectivity
+    check_nft               Check NFT rules
+    check_nft_rules         Check NFT rules status
+    check_sing_box          Check sing-box installation and status
+    check_logs              Show NetShift logs from system journal
+    check_sing_box_logs     Show sing-box logs
+    check_fakeip            Test FakeIP on router
+    clash_api               Clash API interface for managing proxies and groups
+    show_config             Display current NetShift configuration
+    show_version            Show NetShift version
+    show_sing_box_config    Show sing-box configuration
+    show_sing_box_version   Show sing-box version
+    show_system_info        Show system information
+    get_status              Get NetShift service status
+    get_sing_box_status     Get sing-box service status
+    get_system_info         Get system information in JSON format
+    check_dns_available     Check DNS server availability
+    global_check            Run global system check
+    component_action        Run component action: <component> <action>
+                            (e.g. sing_box install_extended|install_stable|check_update,
+                            subscription clear_cache to wipe all caches + redownload)
+    component_action_async  Start component_action in background; echoes a job_id
+                            (use with component_action_status to poll the outcome)
+    component_action_status Report an async component action by job_id: <job_id>
+EOF
+}
+
+case "$1" in
+start)
+    start
+    ;;
+stop)
+    stop
+    ;;
+reload)
+    reload
+    ;;
+restart)
+    restart
+    ;;
+main)
+    main
+    ;;
+__monitor)
+    # Hidden subcommand (task-035): runs the detached sing-box health monitor.
+    # Launched only by start_sing_box_monitor via setsid with the procd lock fd
+    # (1000) closed, so the long-lived monitor never holds the procd service
+    # lock. Not part of the public CLI / help.
+    monitor_sing_box
+    ;;
+list_update)
+    list_update
+    ;;
+subscription_update)
+    subscription_update
+    ;;
+check_proxy)
+    check_proxy
+    ;;
+check_nft)
+    check_nft
+    ;;
+check_nft_rules)
+    check_nft_rules
+    ;;
+check_sing_box)
+    check_sing_box
+    ;;
+check_logs)
+    check_logs
+    ;;
+check_sing_box_logs)
+    check_sing_box_logs
+    ;;
+check_fakeip)
+    check_fakeip
+    ;;
+clash_api)
+    clash_api "$2" "$3" "$4"
+    ;;
+show_config)
+    show_config
+    ;;
+show_version)
+    show_version
+    ;;
+show_sing_box_config)
+    show_sing_box_config
+    ;;
+show_sing_box_version)
+    show_sing_box_version
+    ;;
+show_system_info)
+    show_system_info
+    ;;
+get_status)
+    get_status
+    ;;
+get_sing_box_status)
+    get_sing_box_status
+    ;;
+get_system_info)
+    get_system_info
+    ;;
+check_dns_available)
+    check_dns_available
+    ;;
+global_check)
+    global_check "${2:-}"
+    ;;
+component_action)
+    component_action "$2" "$3"
+    ;;
+component_action_async)
+    component_action_async "$2" "$3"
+    ;;
+component_action_status)
+    component_action_status "$2"
+    ;;
+*)
+    show_help
+    exit 1
+    ;;
+esac
diff --git a/netshift/files/usr/lib/constants.sh b/netshift/files/usr/lib/constants.sh
new file mode 100644
index 00000000..9cd5fb0f
--- /dev/null
+++ b/netshift/files/usr/lib/constants.sh
@@ -0,0 +1,166 @@
+# shellcheck shell=ash
+# shellcheck disable=SC2034
+
+NETSHIFT_VERSION="__COMPILED_VERSION_VARIABLE__"
+## Common
+NETSHIFT_CONFIG="/etc/config/netshift"
+NETSHIFT_STATE_DIR="/etc/netshift"
+RESOLV_CONF="/etc/resolv.conf"
+DNS_RESOLVERS="1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 9.9.9.9 9.9.9.11 94.140.14.14 94.140.15.15 208.67.220.220 208.67.222.222 77.88.8.1 77.88.8.8"
+CHECK_PROXY_IP_DOMAIN="ip.podkop.fyi"
+FAKEIP_TEST_DOMAIN="fakeip.podkop.fyi"
+TMP_SING_BOX_FOLDER="/tmp/sing-box"
+TMP_RULESET_FOLDER="$TMP_SING_BOX_FOLDER/rulesets"
+TMP_SUBSCRIPTION_FOLDER="$TMP_SING_BOX_FOLDER/subscriptions"
+SUBSCRIPTION_CACHE_FOLDER="$NETSHIFT_STATE_DIR/subscriptions"
+TMP_SUBSCRIPTION_DOWNLOAD_FOLDER="$TMP_SING_BOX_FOLDER/subscription-downloads"
+# A section may list MULTIPLE subscription_url feeds. At config generation the
+# usable per-URL caches are concatenated into one merged subscription JSON in
+# this folder, then passed ONCE through the facade (keyword filter + global
+# tag-dedup + sing-box check bisection). Per-feed cache files are keyed
+# "${section}.<md5(url)>.<ext>" under SUBSCRIPTION_CACHE_FOLDER.
+TMP_SUBSCRIPTION_MERGE_FOLDER="$TMP_SING_BOX_FOLDER/subscription-merge"
+# Subscription User-Agent fallback. Many panels return a DIFFERENT body format
+# depending on the client User-Agent (sing-box JSON vs base64 URI list vs Clash
+# vs Xray JSON, or an HTML/403 stub for unknown clients). When no User-Agent is
+# configured for a source, the backend tries these candidates in order and
+# keeps the first one that yields valid sing-box outbounds. The default
+# "singbox/<version>" candidate is prepended at runtime (it depends on the
+# installed sing-box). Order matters: most-likely-to-work first.
+SUBSCRIPTION_USER_AGENT_CANDIDATES="v2rayN Happ Hiddify Clash.Meta ClashMetaForAndroid"
+# Versioned client UAs that well-known panels answer with an Xray JSON body
+# (which carries xhttp/transport nodes the default sing-box JSON may omit). Used
+# by build_subscription_user_agent_candidates when a section's
+# subscription_format_preference is "xray": these UAs are probed FIRST so an
+# Xray-JSON feed is recovered before a sing-box JSON under the default UA wins.
+# Panels commonly gate their Xray branch on a "<client>/<version>" UA shape, so
+# these are VERSIONED (a bare/version-less UA can be rejected, e.g. with a 502).
+# Order matters: a versioned Happ is first (empirically yields the Xray-JSON
+# array body), then versioned v2rayN/v2rayNG forms as panel-agnostic fallbacks.
+SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES="Happ/1.0.0 v2rayN/7.0.0 v2rayNG/1.9.0"
+CLOUDFLARE_OCTETS="8.47 162.159 188.114" # Endpoints https://github.com/ampetelin/warp-endpoint-checker
+JQ_REQUIRED_VERSION="1.7.1"
+COREUTILS_BASE64_REQUIRED_VERSION="9.7"
+RT_TABLE_NAME="netshift"
+# Pidfile of the detached sing-box health monitor (task-035). The monitor is a
+# long-lived `while true` loop launched via setsid with the procd lock fd (1000)
+# closed, so it does NOT hold the procd service lock and consecutive
+# reload/restart never block on flock. The monitor writes its own pid here.
+MONITOR_PIDFILE="/var/run/netshift_monitor.pid"
+
+## nft
+NFT_TABLE_NAME="NetShiftTable"
+NFT_LOCALV4_SET_NAME="localv4"
+NFT_LOCALV6_SET_NAME="localv6"
+# Destination set holding the UNION of every proxy section's proxied IPv4
+# subnets (user/local/remote/community subnet lists). Used by the prerouting
+# `mangle` chain to mark ONLY proxied destinations into the tproxy path, so
+# non-proxied traffic (e.g. a torrent to a random direct IP) never enters
+# sing-box (task-034). The per-section outbound is still selected by sing-box
+# route rules — nft only decides enter-or-not, so a single union set is enough.
+NFT_COMMON_SET_NAME="netshift_subnets"
+# IPv6 mirror of NFT_COMMON_SET_NAME (only created/used when IPv6 is enabled).
+NFT_COMMON_SET_NAME_V6="netshift_subnets_v6"
+NFT_DISCORD_SET_NAME="netshift_discord_subnets"
+NFT_INTERFACE_SET_NAME="interfaces"
+NFT_FAKEIP_MARK="0x00100000"
+NFT_OUTBOUND_MARK="0x00200000"
+
+## sing-box
+SB_REQUIRED_VERSION="1.12.0"
+# Monitoring
+MONITOR_CHECK_INTERVAL=10
+MONITOR_MAX_CRASHES=5
+MONITOR_BACKOFF_BASE=10
+MONITOR_BACKOFF_MAX=300
+# Core-switch connectivity self-heal (task-009). Hosts probed before a core
+# swap, depending on direction: the stable (stock) install pulls from the
+# OpenWrt package feeds, the extended install pulls from the GitHub API.
+UPDATES_FEED_PROBE_HOST="downloads.openwrt.org"
+UPDATES_GITHUB_PROBE_HOST="api.github.com"
+# Temporary public resolvers written to /etc/resolv.conf when DNS healing is
+# needed (the user's upstream may itself be the now-dead VPN).
+UPDATES_HEAL_RESOLVERS="1.1.1.1 9.9.9.9"
+# tmpfs backup path for the original /etc/resolv.conf during a heal.
+UPDATES_RESOLV_BACKUP="/tmp/netshift-resolv.conf.bak"
+# Installed core paths (indirected so the stable backup/rollback path is unit
+# testable without clobbering the real binary). These are the real on-device
+# locations; tests override them.
+UPDATES_SING_BOX_BIN="/usr/bin/sing-box"
+UPDATES_LIBCRONET_LIB="/usr/lib/libcronet.so"
+# Component Manager — NetShift self-update (task-017). The GitHub latest-release
+# API for NetShift itself (same endpoint install.sh and get_system_info use);
+# the self-update worker downloads the release .ipk/.apk assets from it.
+NETSHIFT_RELEASE_API_URL="https://api.github.com/repos/yandexru45/netshift/releases/latest"
+# GitHub FRONTEND (github.com, NOT the rate-limited api.github.com) redirect path
+# for the NetShift repo. /releases/latest 302-redirects to /releases/tag/<tag>
+# (resolve with curl -w '%{redirect_url}' — no API hit, not subject to the
+# 60/hour/IP anonymous API limit); /releases/download/<tag>/<asset> 302s to the
+# CDN for direct asset download. Primary path for version-check + self-update;
+# NETSHIFT_RELEASE_API_URL stays as the graceful fallback. Repo slug lives here
+# only — do not hardcode it elsewhere.
+NETSHIFT_REPO_RELEASES_LATEST_URL="https://github.com/yandexru45/netshift/releases/latest"
+NETSHIFT_REPO_RELEASES_DOWNLOAD_BASE="https://github.com/yandexru45/netshift/releases/download"
+# tmpfs scratch dir for the self-update download (release packages) — RAM, never
+# the tiny overlay; reaped on success and on reboot.
+UPDATES_NETSHIFT_DOWNLOAD_DIR="/tmp/netshift/selfupdate"
+# tmpfs backup of /etc/config/netshift taken before the self-update package
+# install (conffiles normally preserve it; this is the defensive belt).
+UPDATES_NETSHIFT_CONFIG_BACKUP="/tmp/netshift/config.bak"
+# NetShift package names handled by the self-update (in install order). The RU
+# i18n package is upgraded ONLY if already installed (never newly installed).
+UPDATES_NETSHIFT_PKG_CORE="netshift"
+UPDATES_NETSHIFT_PKG_LUCI="luci-app-netshift"
+UPDATES_NETSHIFT_PKG_I18N_RU="luci-i18n-netshift-ru"
+# DNS
+SB_DNS_SERVER_TAG="dns-server"
+SB_FAKEIP_DNS_SERVER_TAG="fakeip-server"
+SB_FAKEIP_INET4_RANGE="198.18.0.0/15"
+SB_FAKEIP_INET6_RANGE="fd00:ec3a::/32"
+SB_BOOTSTRAP_SERVER_TAG="bootstrap-dns-server"
+SB_FAKEIP_DNS_RULE_TAG="fakeip-dns-rule-tag"
+SB_INVERT_FAKEIP_DNS_RULE_TAG="invert-fakeip-dns-rule-tag"
+# Inbounds
+SB_TPROXY_INBOUND_TAG="tproxy-in"
+SB_TPROXY_INBOUND_ADDRESS="127.0.0.1"
+SB_TPROXY_INBOUND_PORT=1602
+SB_TPROXY_INBOUND_ADDRESS_V6="::1"
+SB_TPROXY_INBOUND_PORT_V6=1603
+SB_DNS_INBOUND_TAG="dns-in"
+SB_DNS_INBOUND_ADDRESS="127.0.0.42"
+SB_DNS_INBOUND_PORT=53
+SB_DNS_INBOUND_ADDRESS_V6="::1"
+SB_DNS_INBOUND_PORT_V6=5354
+SB_SERVICE_MIXED_INBOUND_TAG="service-mixed-in"
+SB_SERVICE_MIXED_INBOUND_ADDRESS="127.0.0.1"
+SB_SERVICE_MIXED_INBOUND_PORT=4534
+# Outbounds
+SB_DIRECT_OUTBOUND_TAG="direct-out"
+# Subscription grouping (task-044). Default codepoint count for prefix-mode
+# grouping when subscription_group_prefix_len is unset/invalid.
+SUBSCRIPTION_GROUP_DEFAULT_PREFIX_LEN=2
+# Route
+SB_REJECT_RULE_TAG="reject-rule-tag"
+SB_EXCLUSION_RULE_TAG="exclusion-rule-tag"
+SB_DOH_BLOCK_RULE_TAG="doh-block-rule-tag"
+# Experimental
+SB_CLASH_API_CONTROLLER_PORT=9090
+
+## DoH blocking
+DOH_BLOCK_IPV4_CIDRS="1.1.1.1/32 1.0.0.1/32 8.8.8.8/32 8.8.4.4/32 9.9.9.9/32 9.9.9.11/32 149.112.112.112/32 208.67.222.222/32 208.67.220.220/32 94.140.14.14/32 94.140.15.15/32 77.88.8.8/32 77.88.8.1/32"
+DOH_BLOCK_IPV6_CIDRS="2606:4700:4700::1111/128 2606:4700:4700::1001/128 2001:4860:4860::8888/128 2001:4860:4860::8844/128 2620:fe::fe/128 2620:fe::9/128 2620:119:35::35/128 2620:119:53::53/128 2a10:50c0::ad1:ff/128 2a10:50c0::ad2:ff/128 2a02:6b8::feed:0ff/128 2a02:6b8:0:1::feed:0ff/128"
+
+## Lists
+GITHUB_RAW_URL="https://raw.githubusercontent.com/itdoginfo/allow-domains/main"
+SRS_MAIN_URL="https://github.com/itdoginfo/allow-domains/releases/latest/download"
+SUBNETS_TWITTER="${GITHUB_RAW_URL}/Subnets/IPv4/twitter.lst"
+SUBNETS_META="${GITHUB_RAW_URL}/Subnets/IPv4/meta.lst"
+SUBNETS_DISCORD="${GITHUB_RAW_URL}/Subnets/IPv4/discord.lst"
+SUBNETS_ROBLOX="${GITHUB_RAW_URL}/Subnets/IPv4/roblox.lst"
+SUBNETS_TELERAM="${GITHUB_RAW_URL}/Subnets/IPv4/telegram.lst"
+SUBNETS_CLOUDFLARE="${GITHUB_RAW_URL}/Subnets/IPv4/cloudflare.lst"
+SUBNETS_HETZNER="${GITHUB_RAW_URL}/Subnets/IPv4/hetzner.lst"
+SUBNETS_OVH="${GITHUB_RAW_URL}/Subnets/IPv4/ovh.lst"
+SUBNETS_DIGITALOCEAN="${GITHUB_RAW_URL}/Subnets/IPv4/digitalocean.lst"
+SUBNETS_CLOUDFRONT="${GITHUB_RAW_URL}/Subnets/IPv4/cloudfront.lst"
+COMMUNITY_SERVICES="russia_inside russia_outside ukraine_inside geoblock block porn news anime youtube hdrezka tiktok google_ai google_play hodca discord meta twitter cloudflare cloudfront digitalocean hetzner ovh telegram roblox"
diff --git a/podkop/files/usr/lib/helpers.jq b/netshift/files/usr/lib/helpers.jq
similarity index 100%
rename from podkop/files/usr/lib/helpers.jq
rename to netshift/files/usr/lib/helpers.jq
diff --git a/netshift/files/usr/lib/helpers.sh b/netshift/files/usr/lib/helpers.sh
new file mode 100644
index 00000000..36ec2b64
--- /dev/null
+++ b/netshift/files/usr/lib/helpers.sh
@@ -0,0 +1,1612 @@
+# shellcheck shell=ash
+# Check if string is valid IPv4
+is_ipv4() {
+    local ip="$1"
+    local regex='^((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.?){4}$'
+    echo "$ip" | grep -Eq "$regex"
+}
+
+# Check if string is valid IPv4 with CIDR mask
+is_ipv4_cidr() {
+    local ip="$1"
+    local regex='^((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.?){4}(/(3[0-2]|2[0-9]|1[0-9]|[0-9]))$'
+    echo "$ip" | grep -Eq "$regex"
+}
+
+is_ipv4_ip_or_ipv4_cidr() {
+    is_ipv4 "$1" || is_ipv4_cidr "$1"
+}
+
+is_domain() {
+    local str="$1"
+    local regex='^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$'
+
+    echo "$str" | grep -Eq "$regex"
+}
+
+is_domain_suffix() {
+    local str="$1"
+    local normalized="${str#.}"
+
+    is_domain "$normalized"
+}
+
+# Checks if the given string is a valid base64-encoded sequence
+is_base64() {
+    local str="$1"
+
+    if echo "$str" | base64 -d > /dev/null 2>&1; then
+        return 0
+    fi
+    return 1
+}
+
+# Checks if the given string looks like a Shadowsocks userinfo
+is_shadowsocks_userinfo_format() {
+    local str="$1"
+    local regex='^[^:]+:[^:]+(:[^:]+)?$'
+
+    echo "$str" | grep -Eq "$regex"
+}
+
+# Compares the current package version with the required minimum
+is_min_package_version() {
+    local current="$1"
+    local required="$2"
+
+    local lowest
+    lowest="$(printf '%s\n' "$current" "$required" | sort -V | head -n1)"
+
+    [ "$lowest" = "$required" ]
+}
+
+# Checks if the given file exists
+file_exists() {
+    local filepath="$1"
+
+    if [ -f "$filepath" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Checks if a service script exists in /etc/init.d
+service_exists() {
+    local service="$1"
+
+    if [ -x "/etc/init.d/$service" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Returns the inbound tag name by appending the postfix to the given section
+get_inbound_tag_by_section() {
+    local section="$1"
+    local postfix="in"
+
+    echo "$section-$postfix"
+}
+
+# Returns the outbound tag name by appending the postfix to the given section
+get_outbound_tag_by_section() {
+    local section="$1"
+    local postfix="out"
+
+    echo "$section-$postfix"
+}
+
+# Constructs and returns a domain resolver tag by appending a fixed postfix to the given section
+get_domain_resolver_tag() {
+    local section="$1"
+    local postfix="domain-resolver"
+
+    echo "$section-$postfix"
+}
+
+# Converts a comma-separated string into a JSON array string
+comma_string_to_json_array() {
+    local input="$1"
+
+    if [ -z "$input" ]; then
+        echo "[]"
+        return
+    fi
+
+    local replaced
+    replaced=$(printf '%s' "$input" | sed 's/,/","/g')
+
+    echo "[\"$replaced\"]"
+}
+
+# Decodes a URL-encoded string
+url_decode() {
+    local encoded="$1"
+    printf '%b' "$(echo "$encoded" | sed 's/+/ /g; s/%/\\x/g')"
+}
+
+# Returns the scheme (protocol) part of a URL
+url_get_scheme() {
+    local url="$1"
+    echo "${url%%://*}"
+}
+
+# Extracts the userinfo (username[:password]) part from a URL
+url_get_userinfo() {
+    local url="$1"
+    echo "$url" | sed -n -e 's#^[^:/?]*://##' -e '/@/!d' -e 's/@.*//p'
+}
+
+# Extracts the host part from a URL
+url_get_host() {
+    local url="$1"
+
+    url="${url#*://}"
+    url="${url#*@}"
+    url="${url%%[/?#]*}"
+
+    case "$url" in
+    \[*\]) echo "${url#\[}" | sed 's/\]$//' ;;
+    \[*\]*) echo "${url#\[}" | sed 's/\].*//' ;;
+    *) echo "${url%%:*}" ;;
+    esac
+}
+
+# Extracts the port number from a URL
+url_get_port() {
+    local url="$1"
+
+    url="${url#*://}"
+    url="${url#*@}"
+    url="${url%%[/?#]*}"
+
+    case "$url" in
+    \[*\]:*) echo "${url##*]:}" ;;
+    *:*) echo "${url#*:}" ;;
+    *) echo "" ;;
+    esac
+}
+
+# Extracts the path from a URL (without query or fragment; returns "/" if empty)
+url_get_path() {
+    local url="$1"
+    echo "$url" | sed -n -e 's#^[^:/?]*://##' -e 's#^[^/]*##' -e 's#\([^?]*\).*#\1#p'
+}
+
+# Extracts the value of a specific query parameter from a URL
+url_get_query_param() {
+    local url="$1"
+    local param="$2"
+
+    local raw
+    raw=$(echo "$url" | sed -n "s/.*[?&]$param=\([^&?#]*\).*/\1/p")
+
+    [ -z "$raw" ] && echo "" && return
+
+    echo "$raw"
+}
+
+# Extracts the basename (filename without extension) from a URL
+url_get_basename() {
+    local url="$1"
+
+    local filename="${url##*/}"
+    local basename="${filename%%.*}"
+
+    echo "$basename"
+}
+
+# Extracts and returns the file extension from the given URL
+url_get_file_extension() {
+    local url="$1"
+
+    local basename="${url##*/}"
+    case "$basename" in
+    *.*) echo "${basename##*.}" ;;
+    *) echo "" ;;
+    esac
+}
+
+# Remove url fragment (everything after the first '#')
+url_strip_fragment() {
+    local url="$1"
+
+    echo "${url%%#*}"
+}
+
+# Decodes and returns a base64-encoded string
+base64_decode() {
+    local str="$1"
+    local decoded_url
+
+    decoded_url="$(echo "$str" | base64 -d 2> /dev/null)"
+
+    echo "$decoded_url"
+}
+
+# Decodes a vmess:// share link (V2RayN base64(JSON) form) into its JSON object.
+# Strips the vmess:// scheme prefix, base64-decodes the remainder, and echoes the
+# decoded text (expected to be a JSON object; the caller validates with jq -e).
+# Returns empty output when the input is not a base64(JSON) VMess link.
+#
+# IMPORTANT: this decodes the WHOLE payload as STANDARD base64 (alphabet
+# includes '+'), so the caller MUST pass the RAW pre-url_decode link — passing a
+# url_decode'd link rewrites '+'->space and corrupts the body.
+# Arguments:
+#   $1 - the vmess:// link (raw, pre-url_decode)
+vmess_link_to_json() {
+    local url="$1"
+    local payload decoded pad_len
+
+    payload="${url#vmess://}"
+    # Strip a trailing '#fragment' (server display name / remark, like vless/ss/
+    # trojan). The base64 body never contains '#', so cutting at the FIRST '#'
+    # is safe; a fragment-less payload is a no-op. The canonical VMess name lives
+    # in the decoded JSON `ps` field, so we only need to drop the fragment here.
+    payload="${payload%%#*}"
+    [ -n "$payload" ] || return 0
+
+    # Normalize: strip whitespace (space, tab, CR, LF via octal escapes — busybox
+    # `tr` does NOT understand the POSIX `[:space:]` class and would instead
+    # delete those literal characters, corrupting the base64), then right-pad to
+    # a multiple of 4 with '=' so BusyBox `base64 -d` (which can reject missing
+    # padding) accepts real-world unpadded links.
+    payload="$(printf '%s' "$payload" | tr -d ' \011\012\015')"
+    pad_len=$(( ${#payload} % 4 ))
+    if [ "$pad_len" -ne 0 ]; then
+        pad_len=$(( 4 - pad_len ))
+        while [ "$pad_len" -gt 0 ]; do
+            payload="${payload}="
+            pad_len=$(( pad_len - 1 ))
+        done
+    fi
+
+    decoded="$(base64_decode "$payload")"
+    echo "$decoded"
+}
+
+# Generates a unique 16-character ID based on the current timestamp and a random number
+gen_id() {
+    { date +%s; head -c 16 /dev/urandom; } | md5sum | cut -c1-16
+}
+
+# Adds a missing UCI option with the given value if it does not exist
+migration_add_new_option() {
+    local package="$1"
+    local section="$2"
+    local option="$3"
+    local value="$4"
+
+    local current
+    current="$(uci -q get "$package.$section.$option")"
+    if [ -z "$current" ]; then
+        log "Adding missing option '$option' with value '$value'"
+        uci set "$package.$section.$option=$value"
+        uci commit "$package"
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Migrates a configuration key in an OpenWrt config file from old_key_name to new_key_name
+migration_rename_config_key() {
+    local config="$1"
+    local key_type="$2"
+    local old_key_name="$3"
+    local new_key_name="$4"
+
+    if grep -q "$key_type $old_key_name" "$config"; then
+        log "Deprecated $key_type found: $old_key_name migrating to $new_key_name"
+        sed -i "s/$key_type $old_key_name/$key_type $new_key_name/g" "$config"
+    fi
+}
+
+# Download URL to file
+redact_url_for_log() {
+    local url="$1"
+    local scheme rest authority suffix userinfo_flag path_flag query_flag fragment_flag
+
+    scheme=""
+    rest="$url"
+    userinfo_flag=0
+    path_flag=0
+    query_flag=0
+    fragment_flag=0
+
+    case "$url" in
+    *'#'*) fragment_flag=1 ;;
+    esac
+    rest="${rest%%#*}"
+
+    case "$url" in
+    *\?*) query_flag=1 ;;
+    esac
+    rest="${rest%%\?*}"
+
+    case "$rest" in
+    *://*)
+        scheme="${rest%%://*}://"
+        rest="${rest#*://}"
+        ;;
+    esac
+
+    authority="${rest%%/*}"
+    if [ "$authority" != "$rest" ]; then
+        path_flag=1
+    fi
+
+    case "$authority" in
+    *@*)
+        userinfo_flag=1
+        authority="${authority##*@}"
+        ;;
+    esac
+
+    suffix=""
+    [ "$path_flag" -eq 1 ] && suffix="$suffix/<redacted>"
+    [ "$query_flag" -eq 1 ] && suffix="$suffix?<redacted>"
+    [ "$fragment_flag" -eq 1 ] && suffix="$suffix#<redacted>"
+
+    if [ -z "$authority" ]; then
+        printf 'redacted-url(has_path=%s,has_query=%s,has_userinfo=%s,has_fragment=%s)\n' \
+            "$path_flag" "$query_flag" "$userinfo_flag" "$fragment_flag"
+        return 0
+    fi
+
+    printf '%s%s%s(has_path=%s,has_query=%s,has_userinfo=%s,has_fragment=%s)\n' \
+        "$scheme" "$authority" "$suffix" "$path_flag" "$query_flag" "$userinfo_flag" "$fragment_flag"
+}
+
+url_host_for_log() {
+    local url="$1"
+    local host
+
+    host="${url#*://}"
+    host="${host%%/*}"
+    host="${host%%\?*}"
+    host="${host%%#*}"
+    host="${host##*@}"
+
+    case "$host" in
+    \[*\]*)
+        host="${host#\[}"
+        host="${host%%\]*}"
+        ;;
+    *)
+        host="${host%%:*}"
+        ;;
+    esac
+
+    printf '%s\n' "$host"
+}
+
+url_is_ipv6_literal() {
+    case "$1" in
+    *://\[*\]*) return 0 ;;
+    esac
+    return 1
+}
+
+wget_supports_ipv4_flag() {
+    wget --help 2>&1 | grep -Eq -- 'Use IPv4 only|(^|[[:space:]])-4([[:space:],]|$)'
+}
+
+has_ipv4_default_route() {
+    ip -4 route show default 2>/dev/null | grep -q '^default'
+}
+
+has_ipv6_default_route() {
+    ip -6 route show default 2>/dev/null | grep -q '^default'
+}
+
+has_global_ipv6_addr() {
+    ip -6 addr show scope global 2>/dev/null | grep -q 'inet6 '
+}
+
+ipv6_route_usable() {
+    ip -6 route get 2606:4700:4700::1111 >/dev/null 2>&1
+}
+
+ipv6_appears_usable() {
+    has_ipv6_default_route && has_global_ipv6_addr && ipv6_route_usable
+}
+
+get_wget_ipv4_mode() {
+    local mode
+    config_get mode "settings" "wget_ipv4_mode" "auto" 2>/dev/null
+    case "$mode" in
+    off | force | auto) echo "$mode" ;;
+    *) echo "auto" ;;
+    esac
+}
+
+should_force_wget_ipv4() {
+    local url="$1"
+    local mode
+
+    url_is_ipv6_literal "$url" && return 1
+    wget_supports_ipv4_flag || return 1
+
+    mode="$(get_wget_ipv4_mode)"
+    case "$mode" in
+    off)
+        return 1
+        ;;
+    force)
+        has_ipv4_default_route
+        return $?
+        ;;
+    auto | *)
+        has_ipv4_default_route || return 1
+        ipv6_appears_usable && return 1
+        return 0
+        ;;
+    esac
+}
+
+format_wget_error() {
+    local errfile="$1"
+    local url="$2"
+    local message
+
+    message="$(tr '\n' ' ' < "$errfile" 2>/dev/null | sed 's/[[:space:]][[:space:]]*/ /g; s/^ //; s/ $//' | cut -c1-220)"
+    message="$(printf '%s' "$message" | sed 's#[Hh][Tt][Tt][Pp][Ss]\{0,1\}://[^[:space:]]*#<redacted-url>#g')"
+    [ -n "$message" ] || message="no stderr from wget"
+    printf '%s\n' "$message"
+}
+
+wget_error_class() {
+    local err="$1"
+
+    if echo "$err" | grep -qi 'Operation not permitted'; then
+        echo "operation_not_permitted"
+    elif echo "$err" | grep -qi 'not an http or ftp url\|bad address\|unable to resolve\|Name or service not known'; then
+        echo "dns_or_bad_url"
+    elif echo "$err" | grep -qi 'timed out\|timeout'; then
+        echo "timeout"
+    elif echo "$err" | grep -qi 'certificate\|SSL\|TLS'; then
+        echo "tls"
+    elif echo "$err" | grep -qi '404\|403\|401\|500\|502\|503\|HTTP'; then
+        echo "http"
+    else
+        echo "unknown"
+    fi
+}
+
+log_wget_failure() {
+    local operation="$1"
+    local url="$2"
+    local errfile="$3"
+    local rc="$4"
+    local attempt="$5"
+    local retries="$6"
+    local timeout="$7"
+    local http_proxy_address="$8"
+    local family="$9"
+    local mode err host err_class
+
+    if [ -n "$http_proxy_address" ]; then
+        mode="proxy $http_proxy_address"
+    else
+        mode="direct"
+    fi
+
+    err="$(format_wget_error "$errfile" "$url")"
+    host="$(url_host_for_log "$url")"
+    err_class="$(wget_error_class "$err")"
+
+    log "$operation failed [$attempt/$retries]: wget rc=$rc, mode=$mode, family=$family, timeout=${timeout}s, host=${host:-unknown}, url=$(redact_url_for_log "$url"), error_class=$err_class, error=\"$err\"" "warn"
+    if echo "$err" | grep -qi 'Operation not permitted'; then
+        log "$operation got 'Operation not permitted'. On OpenWrt this can indicate firewall, routing, or IPv6 preference issues; netshift will retry with IPv4 when supported." "warn"
+    fi
+}
+
+download_to_file() {
+    local url="$1"
+    local filepath="$2"
+    local http_proxy_address="$3"
+    local retries="${4:-3}"
+    local wait="${5:-2}"
+    local timeout="${6:-10}"
+    local attempt errfile rc family
+
+    for attempt in $(seq 1 "$retries"); do
+        errfile="${filepath}.wget.err.$$"
+        family="any"
+        if should_force_wget_ipv4 "$url"; then
+            family="ipv4"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" wget -4 -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+            else
+                wget -4 -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+            fi
+        elif [ -n "$http_proxy_address" ]; then
+            http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" wget -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+        else
+            wget -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+        fi
+        rc=$?
+        if [ "$rc" -eq 0 ]; then
+            rm -f "$errfile"
+            return 0
+        fi
+
+        log_wget_failure "Download" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "$family"
+        rm -f "$errfile"
+
+        if [ "$family" != "ipv4" ] && has_ipv4_default_route && wget_supports_ipv4_flag; then
+            errfile="${filepath}.wget.err.$$"
+            log "Retrying download over IPv4-only after generic wget failure" "warn"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" wget -4 -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+            else
+                wget -4 -T "$timeout" -O "$filepath" "$url" 2>"$errfile"
+            fi
+            rc=$?
+            if [ "$rc" -eq 0 ]; then
+                rm -f "$errfile"
+                return 0
+            fi
+            log_wget_failure "Download IPv4 retry" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "ipv4"
+            rm -f "$errfile"
+        fi
+
+        [ "$attempt" -lt "$retries" ] && sleep "$wait"
+    done
+
+    return 1
+}
+
+# Converts Windows-style line endings (CRLF) to Unix-style (LF)
+convert_crlf_to_lf() {
+    local filepath="$1"
+
+    if grep -q "$(printf '\r')" "$filepath"; then
+        log "File '$filepath' contains CRLF line endings. Converting to LF..." "debug"
+        local tmpfile
+        tmpfile=$(mktemp)
+        tr -d '\r' < "$filepath" > "$tmpfile" && mv "$tmpfile" "$filepath" || rm -f "$tmpfile"
+    fi
+}
+
+# Best-effort, in-place gzip decompression of a downloaded subscription body.
+#
+# Some panels unconditionally return a gzip-compressed HTTP body (busybox wget
+# does NOT transparently decompress and we send no Accept-Encoding), so the raw
+# bytes are binary and every downstream consumer (validate/normalize) chokes.
+# This decompresses once at download time so all consumers see text.
+#
+# Detection is attempt-based (no od/hexdump/xxd, none of which exist on device):
+# we try `gzip -dc` (busybox built-in) into a temp file and accept the result
+# ONLY if (a) gzip returned 0, (b) the result is non-empty, and (c) the result
+# is NUL-free. gzip -dc on plain-text input returns rc!=0 cleanly, so a
+# plain-text body is left byte-for-byte untouched; this can never corrupt text.
+# Modeled on convert_crlf_to_lf: mktemp -> transform -> mv on success / rm on
+# failure. Best-effort: always returns 0 (never aborts the caller).
+maybe_gunzip_subscription_file() {
+    local filepath="$1"
+    local tmpfile
+
+    [ -s "$filepath" ] || return 0
+
+    tmpfile=$(mktemp)
+    if gzip -dc "$filepath" > "$tmpfile" 2>/dev/null &&
+        [ -s "$tmpfile" ] &&
+        ! subscription_body_is_binary "$tmpfile"; then
+        log "Decompressed gzip subscription body for '$filepath'" "debug"
+        mv "$tmpfile" "$filepath"
+    else
+        rm -f "$tmpfile"
+    fi
+
+    return 0
+}
+
+# Returns 0 (true) if the file contains at least one NUL byte (i.e. it is
+# binary / undecodable, not text). Busybox-safe, no od/hexdump/xxd: `tr -d`
+# strips NUL bytes and we compare the resulting byte count to the original; a
+# difference means a NUL was present. All vars local.
+subscription_body_is_binary() {
+    local filepath="$1"
+    local raw_count stripped_count
+
+    [ -s "$filepath" ] || return 1
+
+    raw_count="$(wc -c < "$filepath" 2>/dev/null | tr -d ' ')"
+    stripped_count="$(tr -d '\000' < "$filepath" 2>/dev/null | wc -c 2>/dev/null | tr -d ' ')"
+
+    [ -n "$raw_count" ] || raw_count=0
+    [ -n "$stripped_count" ] || stripped_count=0
+
+    [ "$raw_count" != "$stripped_count" ]
+}
+
+#######################################
+# Parses a whitespace-separated string, validates items as either domains
+# or IPv4 addresses/subnets, and returns a comma-separated string of valid items.
+# Arguments:
+#   $1 - Input string (space-separated list of items)
+#   $2 - Type of validation ("domains" or "subnets")
+# Outputs:
+#   Comma-separated string of valid domains or subnets
+#######################################
+parse_domain_or_subnet_string_to_commas_string() {
+    local string="$1"
+    local type="$2"
+
+    tmpfile=$(mktemp)
+    printf "%s\n" "$string" | sed 's/\/\/.*//' | tr ', ' '\n' | grep -v '^$' > "$tmpfile"
+
+    result="$(parse_domain_or_subnet_file_to_comma_string "$tmpfile" "$type")"
+    rm -f "$tmpfile"
+
+    echo "$result"
+}
+
+#######################################
+# Parses a file line by line, validates entries as either domains or subnets,
+# and returns a single comma-separated string of valid items.
+# Arguments:
+#   $1 - Path to the input file
+#   $2 - Type of validation ("domains" or "subnets")
+# Outputs:
+#   Comma-separated string of valid domains or subnets
+#######################################
+parse_domain_or_subnet_file_to_comma_string() {
+    local filepath="$1"
+    local type="$2"
+
+    local result
+    while IFS= read -r line; do
+        line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+
+        [ -z "$line" ] && continue
+
+        case "$type" in
+        domains)
+            if ! is_domain_suffix "$line"; then
+                log "'$line' is not a valid domain" "debug"
+                continue
+            fi
+            ;;
+        subnets)
+            if ! is_ipv4 "$line" && ! is_ipv4_cidr "$line"; then
+                log "'$line' is not IPv4 or IPv4 CIDR" "debug"
+                continue
+            fi
+            ;;
+        *)
+            log "Unknown type: $type" "error"
+            return 1
+            ;;
+        esac
+
+        if [ -z "$result" ]; then
+            result="$line"
+        else
+            result="$result,$line"
+        fi
+    done < "$filepath"
+
+    echo "$result"
+}
+
+# Returns the device model from OpenWrt sysinfo, or "OpenWrt Router" as fallback
+get_device_model() {
+    local model=""
+    if [ -f /tmp/sysinfo/model ]; then
+        model="$(cat /tmp/sysinfo/model 2>/dev/null)"
+    fi
+    echo "${model:-OpenWrt Router}"
+}
+
+# Returns the Linux kernel version
+get_kernel_version() {
+    uname -r
+}
+
+# Returns the sing-box version number (e.g. "1.12.0")
+get_sing_box_version() {
+    local version=""
+    if command -v sing-box >/dev/null 2>&1; then
+        version="$(sing-box version 2>/dev/null | head -n1 | awk '{print $NF}')"
+    fi
+    echo "${version:-1.0}"
+}
+
+# Returns 0 if the given (or detected) sing-box version is an "extended" build
+# Arguments:
+#   $1 - optional sing-box version string (defaults to get_sing_box_version)
+is_sing_box_extended() {
+    local version="${1:-}"
+
+    [ -n "$version" ] || version="$(get_sing_box_version)"
+
+    case "$version" in
+    *extended*) return 0 ;;
+    esac
+
+    return 1
+}
+
+# Generates a deterministic HWID based on WAN MAC address and device model
+# Format: xxxx-xxxx-xxxx-xxxx
+# Same router always produces the same HWID
+generate_hwid() {
+    local mac="" model="" raw_hash=""
+
+    # Try to get WAN MAC address
+    if [ -f /sys/class/net/eth0/address ]; then
+        mac="$(cat /sys/class/net/eth0/address 2>/dev/null)"
+    elif [ -f /sys/class/net/br-lan/address ]; then
+        mac="$(cat /sys/class/net/br-lan/address 2>/dev/null)"
+    fi
+
+    model="$(get_device_model)"
+
+    # Generate hash from MAC + model
+    raw_hash="$(printf '%s-%s' "$mac" "$model" | md5sum | cut -c1-16)"
+
+    # Format as xxxx-xxxx-xxxx-xxxx
+    printf '%s-%s-%s-%s' \
+        "$(echo "$raw_hash" | cut -c1-4)" \
+        "$(echo "$raw_hash" | cut -c5-8)" \
+        "$(echo "$raw_hash" | cut -c9-12)" \
+        "$(echo "$raw_hash" | cut -c13-16)"
+}
+
+# Resolves the effective subscription User-Agent: the explicit value when one
+# is given, otherwise the default "singbox/<version>" string. Centralizes the
+# default so download_subscription and the candidate builder agree.
+get_subscription_user_agent() {
+    local custom_user_agent="${1:-}"
+
+    if [ -n "$custom_user_agent" ]; then
+        printf '%s' "$custom_user_agent"
+        return 0
+    fi
+
+    printf 'singbox/%s' "$(get_sing_box_version)"
+}
+
+# Emits the ordered, de-duplicated list of User-Agent candidates (one per line)
+# to try for a subscription source when no User-Agent is explicitly configured.
+# Different panels key the returned body format off the User-Agent, so we probe
+# a whitelist of well-known clients and let the caller keep the first that
+# yields valid outbounds.
+#
+# Arguments:
+#   $1 - configured User-Agent (empty for auto mode)
+#   $2 - preferred User-Agent (e.g. the previously cached winner; tried early)
+#   $3 - format preference: "auto" (default) | "xray" | "singbox". Reorders the
+#        auto-mode candidates so the preferred FORMAT's UA is probed first; the
+#        probe loop still keeps the first body that yields valid outbounds.
+# Behavior:
+#   - configured non-empty: emit ONLY that value (respect the user's choice;
+#     an explicit UA always outranks the format preference).
+#   - auto/empty/unrecognised: emit "singbox/<ver>", then the preferred one,
+#     then the whitelist (SUBSCRIPTION_USER_AGENT_CANDIDATES) — today's order.
+#   - xray: emit the Xray-JSON UAs (SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES)
+#     FIRST (outranking the cached winner + default), then "singbox/<ver>",
+#     then the preferred one, then the rest of the whitelist.
+#   - singbox: same as auto (singbox/<ver> first); the explicit name for the
+#     current default ordering.
+#   All orderings are de-duplicated with the newline "seen" set below.
+build_subscription_user_agent_candidates() {
+    local configured_user_agent="${1:-}"
+    local preferred_user_agent="${2:-}"
+    local format_preference="${3:-}"
+    local default_user_agent candidate seen
+
+    if [ -n "$configured_user_agent" ]; then
+        printf '%s\n' "$configured_user_agent"
+        return 0
+    fi
+
+    default_user_agent="$(get_subscription_user_agent)"
+    seen=""
+
+    # Order the auto-mode candidate stream by the requested format preference.
+    # "xray" front-loads the Xray-JSON-yielding UAs (so they outrank the cached
+    # winner and the default); "singbox"/"auto"/empty/unknown keep today's order
+    # (default UA -> cached winner -> whitelist). Any unknown value falls through
+    # to the default ordering (forward-compatible).
+    if [ "$format_preference" = "xray" ]; then
+        # shellcheck disable=SC2086 # word-splitting of the candidate lists is intentional
+        set -- $SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES "$default_user_agent" "$preferred_user_agent" $SUBSCRIPTION_USER_AGENT_CANDIDATES
+    else
+        # shellcheck disable=SC2086 # word-splitting of the candidate list is intentional
+        set -- "$default_user_agent" "$preferred_user_agent" $SUBSCRIPTION_USER_AGENT_CANDIDATES
+    fi
+
+    for candidate in "$@"; do
+        [ -n "$candidate" ] || continue
+        # Skip a candidate already emitted. Wrap stored names in newlines so the
+        # substring test matches whole entries only.
+        case "$seen" in
+        *"
+$candidate
+"*) continue ;;
+        esac
+        seen="${seen}
+$candidate
+"
+        printf '%s\n' "$candidate"
+    done
+}
+
+# Runs a single wget subscription request with the shared client-mimicking
+# headers and an optional --no-check-certificate flag, so all branches of
+# download_subscription stay byte-identical.
+# Arguments:
+#   $1       - cert flag ("" or "--no-check-certificate")
+#   $2       - User-Agent header value
+#   $3       - X-HWID header value
+#   $4       - X-Device-Model header value
+#   $5       - X-Ver-OS header value
+#   $6       - output file path (passed to wget -O)
+#   $7       - error file path (wget stderr is redirected here)
+#   $8       - subscription URL
+#   $9..     - leading wget flags (e.g. -4, -T, <timeout>)
+# Caller is responsible for exporting http_proxy/https_proxy when needed.
+_wget_subscription_request() {
+    local cert_flag="$1"
+    local req_user_agent="$2"
+    local req_hwid="$3"
+    local req_device_model="$4"
+    local req_kernel_version="$5"
+    local req_outfile="$6"
+    local req_errfile="$7"
+    local req_url="$8"
+    shift 8
+
+    # shellcheck disable=SC2086
+    wget $cert_flag "$@" -O "$req_outfile" \
+        --header "User-Agent: $req_user_agent" \
+        --header "X-HWID: $req_hwid" \
+        --header "X-Device-OS: OpenWrt Linux" \
+        --header "X-Device-Model: $req_device_model" \
+        --header "X-Ver-OS: $req_kernel_version" \
+        --header "Accept-Language: ru-RU,en,*" \
+        --header "X-Device-Locale: EN" \
+        "$req_url" 2>"$req_errfile"
+}
+
+# Downloads a subscription body from the given URL with client-mimicking headers
+# Arguments:
+#   $1 - subscription URL
+#   $2 - output file path
+#   $3 - http proxy address (optional)
+#   $4 - retries (optional, default 3)
+#   $5 - wait between retries (optional, default 2)
+#   $6 - timeout seconds (optional, default 10)
+#   $7 - User-Agent (optional; default "singbox/<version>")
+#   $8 - insecure (optional, default 0; when 1 adds --no-check-certificate)
+download_subscription() {
+    local url="$1"
+    local filepath="$2"
+    local http_proxy_address="$3"
+    local retries="${4:-3}"
+    local wait="${5:-2}"
+    local timeout="${6:-10}"
+    local user_agent="${7:-}"
+    local insecure="${8:-0}"
+
+    local sb_version device_model kernel_version hwid
+    sb_version="$(get_sing_box_version)"
+    device_model="$(get_device_model)"
+    kernel_version="$(get_kernel_version)"
+    hwid="$(generate_hwid)"
+    [ -n "$user_agent" ] || user_agent="$(get_subscription_user_agent)"
+
+    # Optional TLS-verification bypass for IP-host panels with broken certs.
+    # Empty string keeps the secure default; word-splitting it into the wget
+    # argv (via _wget_subscription_request) yields zero extra args when off.
+    local cert_flag=""
+    if [ "$insecure" = "1" ]; then
+        cert_flag="--no-check-certificate"
+    fi
+
+    local tmpfile errfile rc family
+    tmpfile="${filepath}.part.$$"
+    errfile="${filepath}.err.$$"
+    rm -f "$tmpfile" "$errfile"
+
+    for attempt in $(seq 1 "$retries"); do
+        family="any"
+        if should_force_wget_ipv4 "$url"; then
+            family="ipv4"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                        "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                        -4 -T "$timeout"
+            else
+                _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                    "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                    -4 -T "$timeout"
+            fi
+        else
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                        "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                        -T "$timeout"
+            else
+                _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                    "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                    -T "$timeout"
+            fi
+        fi
+
+        rc=$?
+        if [ "$rc" -eq 0 ] && [ -s "$tmpfile" ]; then
+            if ! mv "$tmpfile" "$filepath"; then
+                log "Subscription download succeeded but failed to move temporary file to destination" "error"
+                rm -f "$tmpfile" "$errfile"
+                return 1
+            fi
+            rm -f "$errfile"
+            return 0
+        fi
+
+        if [ "$rc" -eq 0 ] && [ ! -s "$tmpfile" ]; then
+            log "Subscription download returned success but produced an empty file: host=$(url_host_for_log "$url"), url=$(redact_url_for_log "$url")" "warn"
+        fi
+
+        rm -f "$tmpfile"
+        log_wget_failure "Subscription download" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "$family"
+
+        if [ "$family" != "ipv4" ] && has_ipv4_default_route && wget_supports_ipv4_flag; then
+            family="ipv4"
+            log "Retrying subscription download over IPv4-only" "warn"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                        "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                        -4 -T "$timeout"
+            else
+                _wget_subscription_request "$cert_flag" "$user_agent" "$hwid" \
+                    "$device_model" "$kernel_version" "$tmpfile" "$errfile" "$url" \
+                    -4 -T "$timeout"
+            fi
+            rc=$?
+            if [ "$rc" -eq 0 ] && [ -s "$tmpfile" ]; then
+                if ! mv "$tmpfile" "$filepath"; then
+                    log "Subscription download IPv4 retry succeeded but failed to move temporary file to destination" "error"
+                    rm -f "$tmpfile" "$errfile"
+                    return 1
+                fi
+                rm -f "$errfile"
+                return 0
+            fi
+            if [ "$rc" -eq 0 ] && [ ! -s "$tmpfile" ]; then
+                log "Subscription download IPv4 retry returned success but produced an empty file: host=$(url_host_for_log "$url"), url=$(redact_url_for_log "$url")" "warn"
+            fi
+            log_wget_failure "Subscription download IPv4 retry" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "$family"
+        fi
+
+        sleep "$wait"
+    done
+
+    rm -f "$tmpfile"
+    rm -f "$errfile"
+    log "Subscription download failed after $retries attempts: host=$(url_host_for_log "$url"), url=$(redact_url_for_log "$url")" "error"
+    return 1
+}
+
+check_subscription_connectivity() {
+    local url="$1"
+    local http_proxy_address="$2"
+    local retries="${3:-3}"
+    local wait="${4:-2}"
+    local timeout="${5:-5}"
+
+    local sb_version device_model kernel_version hwid
+    sb_version="$(get_sing_box_version)"
+    device_model="$(get_device_model)"
+    kernel_version="$(get_kernel_version)"
+    hwid="$(generate_hwid)"
+
+    local attempt errfile rc family
+    errfile="/tmp/netshift-subscription-check.$$"
+    rm -f "$errfile"
+    for attempt in $(seq 1 "$retries"); do
+        family="any"
+        if should_force_wget_ipv4 "$url"; then
+            family="ipv4"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    wget -q -4 -T "$timeout" -O /dev/null \
+                        --header "User-Agent: singbox/$sb_version" \
+                        --header "X-HWID: $hwid" \
+                        --header "X-Device-OS: OpenWrt Linux" \
+                        --header "X-Device-Model: $device_model" \
+                        --header "X-Ver-OS: $kernel_version" \
+                        --header "Accept-Language: ru-RU,en,*" \
+                        --header "X-Device-Locale: EN" \
+                        "$url" 2>"$errfile"
+            else
+                wget -q -4 -T "$timeout" -O /dev/null \
+                    --header "User-Agent: singbox/$sb_version" \
+                    --header "X-HWID: $hwid" \
+                    --header "X-Device-OS: OpenWrt Linux" \
+                    --header "X-Device-Model: $device_model" \
+                    --header "X-Ver-OS: $kernel_version" \
+                    --header "Accept-Language: ru-RU,en,*" \
+                    --header "X-Device-Locale: EN" \
+                    "$url" 2>"$errfile"
+            fi
+        else
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    wget -q -T "$timeout" -O /dev/null \
+                        --header "User-Agent: singbox/$sb_version" \
+                        --header "X-HWID: $hwid" \
+                        --header "X-Device-OS: OpenWrt Linux" \
+                        --header "X-Device-Model: $device_model" \
+                        --header "X-Ver-OS: $kernel_version" \
+                        --header "Accept-Language: ru-RU,en,*" \
+                        --header "X-Device-Locale: EN" \
+                        "$url" 2>"$errfile"
+            else
+                wget -q -T "$timeout" -O /dev/null \
+                    --header "User-Agent: singbox/$sb_version" \
+                    --header "X-HWID: $hwid" \
+                    --header "X-Device-OS: OpenWrt Linux" \
+                    --header "X-Device-Model: $device_model" \
+                    --header "X-Ver-OS: $kernel_version" \
+                    --header "Accept-Language: ru-RU,en,*" \
+                    --header "X-Device-Locale: EN" \
+                    "$url" 2>"$errfile"
+            fi
+        fi
+
+        rc=$?
+        if [ "$rc" -eq 0 ]; then
+            rm -f "$errfile"
+            return 0
+        fi
+
+        log_wget_failure "Subscription connectivity" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "$family"
+
+        if [ "$family" != "ipv4" ] && has_ipv4_default_route && wget_supports_ipv4_flag; then
+            family="ipv4"
+            if [ -n "$http_proxy_address" ]; then
+                http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" \
+                    wget -q -4 -T "$timeout" -O /dev/null \
+                        --header "User-Agent: singbox/$sb_version" \
+                        --header "X-HWID: $hwid" \
+                        --header "X-Device-OS: OpenWrt Linux" \
+                        --header "X-Device-Model: $device_model" \
+                        --header "X-Ver-OS: $kernel_version" \
+                        --header "Accept-Language: ru-RU,en,*" \
+                        --header "X-Device-Locale: EN" \
+                        "$url" 2>"$errfile"
+            else
+                wget -q -4 -T "$timeout" -O /dev/null \
+                    --header "User-Agent: singbox/$sb_version" \
+                    --header "X-HWID: $hwid" \
+                    --header "X-Device-OS: OpenWrt Linux" \
+                    --header "X-Device-Model: $device_model" \
+                    --header "X-Ver-OS: $kernel_version" \
+                    --header "Accept-Language: ru-RU,en,*" \
+                    --header "X-Device-Locale: EN" \
+                    "$url" 2>"$errfile"
+            fi
+            rc=$?
+            if [ "$rc" -eq 0 ]; then
+                rm -f "$errfile"
+                return 0
+            fi
+            log_wget_failure "Subscription connectivity IPv4 retry" "$url" "$errfile" "$rc" "$attempt" "$retries" "$timeout" "$http_proxy_address" "$family"
+        fi
+
+        [ "$attempt" -lt "$retries" ] && sleep "$wait"
+    done
+
+    rm -f "$errfile"
+    return 1
+}
+
+validate_subscription_file() {
+    local filepath="$1"
+
+    [ -s "$filepath" ] || return 1
+
+    jq -e '
+        type == "object" and
+        (.outbounds | type == "array") and
+        ([.outbounds[] | select(
+            .type != "selector" and
+            .type != "urltest" and
+            .type != "direct" and
+            .type != "dns" and
+            .type != "block"
+        )] | length > 0)
+    ' "$filepath" > /dev/null 2>&1
+}
+
+describe_subscription_validation_failure() {
+    local filepath="$1"
+    local total usable
+
+    if [ ! -s "$filepath" ]; then
+        echo "downloaded file is empty"
+        return 0
+    fi
+
+    if ! jq -e '.' "$filepath" >/dev/null 2>&1; then
+        echo "downloaded file is not valid JSON"
+        return 0
+    fi
+
+    if ! jq -e 'type == "object"' "$filepath" >/dev/null 2>&1; then
+        echo "subscription root is not a JSON object"
+        return 0
+    fi
+
+    if ! jq -e '.outbounds | type == "array"' "$filepath" >/dev/null 2>&1; then
+        echo "subscription has no outbounds array"
+        return 0
+    fi
+
+    total="$(jq -r '.outbounds | length' "$filepath" 2>/dev/null)"
+    usable="$(jq -r '[.outbounds[] | select(
+        .type != "selector" and
+        .type != "urltest" and
+        .type != "direct" and
+        .type != "dns" and
+        .type != "block"
+    )] | length' "$filepath" 2>/dev/null)"
+    echo "subscription contains no usable proxy outbounds: total=${total:-unknown}, usable=${usable:-unknown}"
+}
+
+# Convert an "Xray JSON" subscription body into a newline-separated list of
+# proxy share URIs (one per line) that the fallback parser's URI loop can
+# consume.
+#
+# An "Xray JSON" body is what several panels (e.g. the Xray/v2rayN ecosystem)
+# hand out instead of a sing-box config: either a single Xray client config
+# object or, more commonly, a JSON ARRAY of such objects. Each object carries
+# an `outbounds` array whose proxy members use the Xray schema
+# (`protocol` + `settings.vnext`/`settings.servers` + `streamSettings`), which
+# is NOT the sing-box outbound schema. validate_subscription_file() rejects it
+# (its outbounds have no sing-box `type`), so without this converter the whole
+# subscription is unusable.
+#
+# Strategy: for every config object we emit one `vless://` / `trojan://` /
+# `ss://` share URI per *directly usable* proxy outbound, i.e. one that does
+# NOT declare `streamSettings.sockopt.dialerProxy` (a chained / multi-hop
+# upstream that cannot be expressed as a single share link). The resulting URIs
+# carry the standard query params the facade already understands
+# (security/sni/fp/pbk/sid/flow/type/path/host/mode/alpn), so they flow through
+# the existing sing_box_cf_add_proxy_outbound path unchanged. The outbound tag
+# (or the config `remarks`) becomes the URI fragment so the node keeps a
+# human-readable name.
+#
+# CRITICAL: OpenWRT's jq has no Oniguruma, so the program below uses only
+# explicit string operations (no test/match/sub/gsub). It also keeps every
+# query VALUE free of '& ? # %' and whitespace, because url_get_query_param()
+# (helpers.sh) stops a value at the first such delimiter.
+#
+# Arguments:
+#   src_file: path to the raw downloaded subscription body
+# Returns:
+#   0 and prints the URI lines to stdout when at least one outbound converted;
+#   1 (and prints nothing) otherwise.
+xray_json_to_uri_lines() {
+    local src_file="$1"
+
+    [ -s "$src_file" ] || return 1
+
+    # Quick structural gate before invoking jq: the body must be valid JSON
+    # whose (array element | object) carries Xray-style proxy outbounds. We let
+    # jq make the authoritative decision and emit the URIs in one pass.
+    jq -er '
+        # Normalize the document to an array of Xray config objects.
+        (if type == "array" then . else [.] end) as $configs
+
+        # A query value is only safe for url_get_query_param when it is present
+        # (not JSON null) and carries none of these delimiters/whitespace;
+        # otherwise drop the param entirely. NB: a missing Xray field reads as
+        # JSON null, and (null | tostring) == "null" — we must treat that as
+        # absent, never emit a literal "null" value (e.g. sid=null).
+        | def safe($v):
+            if $v == null then ""
+            else
+              ($v | tostring) as $s
+              | if ($s == "") then ""
+                elif ($s | (index("&") // index("?") // index("#")
+                            // index(" ") // index("%")
+                            // index("\t") // index("\n"))) != null then ""
+                else $s end
+            end;
+
+        # Build "key=value" only when value is present and delimiter-safe.
+        def kv($k; $v):
+            safe($v) as $s
+            | if $s == "" then empty else ($k + "=" + $s) end;
+
+        [ $configs[]
+          | (.remarks // "") as $cfg_name
+          | (.outbounds // [])[]
+          | select(type == "object")
+          | select(.protocol == "vless" or .protocol == "trojan"
+                   or .protocol == "shadowsocks"
+                   or .protocol == "hysteria")
+          # Skip chained / multi-hop outbounds: not representable as one URI.
+          | select((.streamSettings.sockopt.dialerProxy // "") == "")
+          # Hysteria here is always Hysteria2 (hysteriaSettings.version == 2);
+          # the facade has no Hysteria v1 parser, so skip v1/missing-version
+          # silently (no fatal). vless/trojan/shadowsocks are unaffected.
+          | select(.protocol != "hysteria"
+                   or ((.streamSettings.hysteriaSettings.version // 0) == 2))
+          | . as $ob
+          | (.streamSettings // {}) as $ss
+          # splithttp is the pre-rename name of the xhttp transport (sing-box
+          # renamed it). Normalize it to xhttp so the emitted URI uses the modern
+          # name and the facade xhttp branch handles it. No regex.
+          | ($ss.network // "tcp") as $net_raw
+          | (if $net_raw == "splithttp" then "xhttp" else $net_raw end) as $net
+          # xhttp transport settings live under xhttpSettings, or the pre-rename
+          # splithttpSettings alias.
+          | ($ss.xhttpSettings // $ss.splithttpSettings // {}) as $xs
+          | ($ss.security // "") as $sec
+          | ($ss.realitySettings // {}) as $reality
+          | ($ss.tlsSettings // $ss.realitySettings // {}) as $tls
+          # Addressing: vnext (vless/vmess) vs servers (trojan/shadowsocks);
+          # hysteria carries the peer directly in settings.address/settings.port
+          # (no vnext/servers), so branch the peer derivation on protocol.
+          | (if $ob.protocol == "hysteria"
+             then {address: $ob.settings.address, port: $ob.settings.port}
+             else ($ob.settings.vnext[0] // $ob.settings.servers[0] // {}) end) as $peer
+          | ($peer.users[0] // {}) as $user
+          | ($peer.address // "") as $host
+          | ($peer.port // "") as $port
+          | select($host != "" and ($port | tostring) != "")
+          | ($ob.tag // $cfg_name) as $name
+          # Build the query param list per protocol, dropping empties.
+          | (
+              if $ob.protocol == "vless" then
+                ([ "encryption=none",
+                   ("type=" + $net),
+                   kv("flow"; $user.flow),
+                   (if $sec != "" then ("security=" + $sec) else empty end),
+                   kv("sni"; ($tls.serverName // "")) ])
+                + (if $sec == "reality" then
+                     [ kv("pbk"; $reality.publicKey),
+                       kv("sid"; $reality.shortId),
+                       kv("fp"; ($reality.fingerprint // "chrome")) ]
+                   else
+                     [ kv("fp"; ($tls.fingerprint // "")) ]
+                   end)
+              elif $ob.protocol == "trojan" then
+                [ ("type=" + $net),
+                  (if $sec != "" then ("security=" + ($sec)) else "security=tls" end),
+                  kv("sni"; ($tls.serverName // "")),
+                  kv("fp"; ($tls.fingerprint // "")) ]
+              elif $ob.protocol == "hysteria" then
+                # Hysteria2: no stream transport, so DO NOT emit type=. The
+                # facade defaults security to tls for hysteria2 and reads
+                # sni/insecure (via _add_outbound_security), obfs/obfs-password.
+                ($ss.hysteriaSettings // {}) as $hy
+                | [ kv("sni"; ($tls.serverName // "")),
+                    (if (($tls.allowInsecure // $tls.insecure // false) == true)
+                     then "insecure=1" else empty end) ]
+                  + (if ($hy.obfs // "") != "" then
+                       [ "obfs=salamander",
+                         kv("obfs-password"; ($hy.obfsPassword // $hy.obfs_password // "")) ]
+                     else [] end)
+              else
+                [ ("type=" + $net) ]
+              end
+            ) as $base
+          # Transport-specific params (ws / xhttp / grpc).
+          | (
+              if $net == "ws" then
+                [ kv("path"; ($ss.wsSettings.path // "")),
+                  kv("host"; ($ss.wsSettings.headers.Host // "")) ]
+              elif $net == "xhttp" then
+                # Accept both the modern xhttpSettings and the pre-rename
+                # splithttpSettings key (network was normalized to xhttp above).
+                # $xs binds to whichever settings object is present.
+                [ kv("path"; ($xs.path // "")),
+                  kv("host"; ($xs.host // "")),
+                  kv("mode"; ($xs.mode // "")) ]
+              elif $net == "grpc" then
+                [ kv("serviceName"; ($ss.grpcSettings.serviceName // "")) ]
+              else [] end
+            ) as $transport
+          # alpn is a JSON array in Xray; flatten to a comma string (no spaces).
+          | ([ ($tls.alpn // [])[] | tostring ] | join(",")) as $alpn_str
+          | ($base + $transport
+             + (if $alpn_str != "" then [ kv("alpn"; $alpn_str) ] else [] end)
+             | map(select(. != null and . != ""))) as $query
+          # Credential: uuid for vless, hysteriaSettings.auth for hysteria,
+          # password for trojan/shadowsocks.
+          | (if $ob.protocol == "vless" then ($user.id // "")
+             elif $ob.protocol == "hysteria" then
+               ($ss.hysteriaSettings.auth // "")
+             else ($peer.password // $ob.settings.password // "") end) as $cred
+          | select($cred != "")
+          | ($ob.protocol
+             | if . == "shadowsocks" then "ss"
+               elif . == "hysteria" then "hysteria2"
+               else . end) as $scheme
+          # The connection part (no #fragment) is the dedup key: providers that
+          # ship one server set across many "profiles" repeat identical nodes
+          # with only the display name differing, which would otherwise inflate
+          # the list into thousands of duplicates.
+          | ($scheme + "://" + $cred + "@" + $host + ":" + ($port | tostring)
+             + (if ($query | length) > 0 then "?" + ($query | join("&")) else "" end)
+            ) as $conn
+          | { conn: $conn,
+              uri: ($conn + (if $name != "" then "#" + $name else "" end)) }
+        ]
+        # Deduplicate on $conn, preserving first-seen order (no sort): a
+        # label/break reduce over already-seen keys. Avoids unique_by (which
+        # reorders) and stays within the no-regex jq subset on OpenWRT.
+        | reduce .[] as $e ({ seen: [], out: [] };
+            if (.seen | index($e.conn)) != null then .
+            else .seen += [$e.conn] | .out += [$e.uri] end)
+        | .out
+        | select(length > 0)
+        | .[]
+    ' "$src_file" 2>/dev/null
+}
+
+# Count the Xray-JSON proxy outbounds that look like real nodes but use a
+# protocol the NetShift facade cannot build (today: vmess — the facade has no
+# vmess outbound). These are silently dropped by xray_json_to_uri_lines, so we
+# count them separately to surface an explicit warning to the user instead of
+# leaving them to wonder why a node count came up short. Chained (dialerProxy)
+# outbounds are NOT counted here — those are deliberately collapsed, not
+# "unsupported". Prints a single integer (0 when none / on any error).
+xray_json_count_unsupported() {
+    local src_file="$1"
+
+    [ -s "$src_file" ] || {
+        echo 0
+        return 0
+    }
+
+    jq -er '
+        [ (if type == "array" then . else [.] end)[]
+          | (.outbounds // [])[]
+          | select(type == "object")
+          | select((.streamSettings.sockopt.dialerProxy // "") == "")
+          | select(.protocol == "vmess")
+        ] | length
+    ' "$src_file" 2>/dev/null || echo 0
+}
+
+# Fallback subscription parser.
+#
+# Many providers do not return a sing-box JSON config. Instead they return
+# either (a) a base64-encoded list of proxy URIs, or (b) a plaintext list of
+# proxy URIs (one per line), possibly interspersed with '#comment' metadata
+# lines, or (c) an "Xray JSON" config (object or array of objects, handled via
+# xray_json_to_uri_lines above). This function decodes/parses such a body into
+# a minimal sing-box configuration ({"outbounds":[...]}) so the normal persist
+# + merge path can consume it unchanged.
+#
+# It lives in helpers.sh (alongside validate_subscription_file). It calls
+# sing_box_cf_add_proxy_outbound, which is defined later in
+# sing_box_config_facade.sh. Shell resolves function names at call time, and
+# bin/netshift sources both helpers.sh and the facade before any subscription
+# work runs, so both the base64 helpers (defined here) and the URI->outbound
+# builder are available when this function is invoked.
+#
+# Arguments:
+#   src_file: path to the raw downloaded subscription body
+#   out_file: path to write the normalized sing-box JSON to
+#   section:  UCI section name (used to derive outbound tags)
+# Returns:
+#   0 and writes out_file when at least one outbound was parsed; 1 otherwise.
+normalize_subscription_to_singbox() {
+    local src_file="$1"
+    local out_file="$2"
+    local section="$3"
+
+    local raw stripped candidate pad_len decoded bom
+    local udp_over_tcp config new_config lines_file
+    local line scheme idx kept skipped before_count after_count final_count
+    local fragment display_name first_char xray_uris xray_unsupported
+
+    [ -s "$src_file" ] || return 1
+    # Strip a leading UTF-8 BOM (EF BB BF) if present; it would otherwise break
+    # base64 charset detection and decoding. busybox sed lacks \x hex escapes,
+    # so build the BOM literally with printf octal escapes.
+    bom="$(printf '\357\273\277')"
+    raw="$(sed "1s/^${bom}//" "$src_file" 2>/dev/null)"
+    [ -n "$raw" ] || raw="$(cat "$src_file" 2>/dev/null)"
+    [ -n "$raw" ] || return 1
+
+    # Xray-JSON detection (before base64/URI handling). When the body is a JSON
+    # object/array of Xray client configs, convert its proxy outbounds to share
+    # URIs and feed those through the URI loop below. Only attempt this when the
+    # first non-whitespace byte is '{' or '[' (cheap pre-gate) so plaintext URI
+    # lists never pay the jq cost.
+    first_char="$(printf '%s' "$raw" | sed -n '1{s/^[[:space:]]*//;s/\(.\).*/\1/p;};1q' 2>/dev/null)"
+    case "$first_char" in
+    '{' | '[')
+        xray_uris="$(xray_json_to_uri_lines "$src_file" 2>/dev/null)"
+        if [ -n "$xray_uris" ]; then
+            log "Detected Xray JSON subscription for '$section'; converting proxy outbounds to share URIs" "debug"
+            raw="$xray_uris"
+            # Surface unsupported protocols (vmess) explicitly: they are dropped
+            # by the converter because the facade cannot build them, and a silent
+            # drop looks like a bug to the user.
+            xray_unsupported="$(xray_json_count_unsupported "$src_file")"
+            case "$xray_unsupported" in
+            '' | *[!0-9]*) xray_unsupported=0 ;;
+            esac
+            if [ "$xray_unsupported" -gt 0 ]; then
+                log "Xray JSON subscription for '$section' has $xray_unsupported VMess node(s); VMess is not supported and they were skipped" "warn"
+            fi
+        fi
+        ;;
+    esac
+
+    # Decide whether the body is a base64 blob or already plaintext URIs.
+    # Be conservative: only treat as base64 when the raw body has NO '://'
+    # substring (a plaintext URI list always contains '://') but the decoded
+    # body does contain '://'.
+    candidate="$raw"
+    case "$raw" in
+    *"://"*)
+        # Raw already contains URIs -> treat as plaintext.
+        :
+        ;;
+    *)
+        # Strip all whitespace and check the remaining charset is base64-only.
+        stripped="$(printf '%s' "$raw" | tr -d ' \t\r\n')"
+        if [ -n "$stripped" ] && [ -z "$(printf '%s' "$stripped" | tr -d 'A-Za-z0-9+/=')" ]; then
+            # Add '=' padding to a multiple of 4 (older coreutils-base64 lacks
+            # auto-padding).
+            pad_len=$(( ${#stripped} % 4 ))
+            if [ "$pad_len" -eq 2 ]; then
+                stripped="${stripped}=="
+            elif [ "$pad_len" -eq 3 ]; then
+                stripped="${stripped}="
+            elif [ "$pad_len" -eq 1 ]; then
+                # Length 1 mod 4 is not valid base64; leave as-is and let
+                # decode fail.
+                :
+            fi
+            decoded="$(base64_decode "$stripped")"
+            case "$decoded" in
+            *"://"*)
+                candidate="$decoded"
+                ;;
+            esac
+        fi
+        ;;
+    esac
+
+    # udp_over_tcp from the section if present, else empty.
+    udp_over_tcp="$(uci -q get "netshift.${section}.udp_over_tcp" 2>/dev/null)"
+
+    config='{"outbounds":[]}'
+    idx=0
+    kept=0
+    skipped=0
+
+    # Write candidate lines to a temp file and feed the loop via redirect rather
+    # than a heredoc/pipe. The builder calls helpers that read stdin (e.g.
+    # base64 pipelines); feeding the loop from the same stdin would let them
+    # consume subsequent lines. A file redirect keeps the loop's stdin isolated.
+    lines_file="$(mktemp 2>/dev/null)" || lines_file="/tmp/netshift-sub-fb.$$"
+    printf '%s\n' "$candidate" > "$lines_file"
+
+    while IFS= read -r line; do
+        # Trim leading/trailing whitespace.
+        line="$(printf '%s' "$line" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+        [ -n "$line" ] || continue
+        # Skip metadata/comment lines.
+        case "$line" in
+        '#'*)
+            continue
+            ;;
+        esac
+        # Pre-filter: only attempt known schemes so an unknown scheme never
+        # reaches the builder's fatal path.
+        scheme="$(url_get_scheme "$line")"
+        case "$scheme" in
+        vless | trojan | ss | hysteria2 | hy2 | socks5 | socks4 | socks4a) ;;
+        *)
+            skipped=$(( skipped + 1 ))
+            continue
+            ;;
+        esac
+
+        # Extract the human-readable name from the URI fragment (the part after
+        # the first '#', e.g. vless://...#🇩🇪 Frankfurt). The builder strips the
+        # fragment, so we capture it here and re-apply it as the outbound tag
+        # below. Fall back to a synthetic name when the fragment is absent.
+        case "$line" in
+        *"#"*) fragment="${line##*#}" ;;
+        *) fragment="" ;;
+        esac
+        display_name=""
+        if [ -n "$fragment" ]; then
+            # url_decode handles %20 / percent-escaped UTF-8 (flag emoji etc.).
+            display_name="$(url_decode "$fragment" 2>/dev/null)"
+            # Drop control characters/newlines that would corrupt the tag.
+            display_name="$(printf '%s' "$display_name" | tr -d '\r\n\t')"
+        fi
+        [ -n "$display_name" ] || display_name="${section}-fb${idx}"
+
+        before_count="$(printf '%s' "$config" | jq -r '.outbounds | length' 2>/dev/null)"
+        [ -n "$before_count" ] || before_count=0
+
+        # Second guard: run the builder in a subshell (command substitution) so
+        # an unexpected exit 1 (e.g. malformed URI) is contained and surfaced as
+        # a non-zero rc. Redirect its stdin from /dev/null so its internal
+        # pipelines cannot consume the loop's input.
+        new_config="$(sing_box_cf_add_proxy_outbound "$config" "${section}-fb${idx}" "$line" "$udp_over_tcp" </dev/null 2>/dev/null)" || {
+            log "skip unparsable subscription key #$idx for '$section'" "debug"
+            idx=$(( idx + 1 ))
+            continue
+        }
+        idx=$(( idx + 1 ))
+
+        # Validate the result parses as JSON and the outbound count increased.
+        if [ -z "$new_config" ] || ! printf '%s' "$new_config" | jq -e . >/dev/null 2>&1; then
+            log "skip subscription key (invalid JSON result) for '$section'" "debug"
+            continue
+        fi
+        after_count="$(printf '%s' "$new_config" | jq -r '.outbounds | length' 2>/dev/null)"
+        [ -n "$after_count" ] || after_count=0
+        if [ "$after_count" -le "$before_count" ]; then
+            log "skip subscription key (no outbound added) for '$section'" "debug"
+            continue
+        fi
+
+        # Re-apply the human-readable name as the tag of the just-added outbound
+        # (the builder appends it last). Deduplicate against tags already present
+        # so identical remarks across keys stay unique and valid for sing-box and
+        # the dashboard (which displays the tag verbatim via the Clash API).
+        new_config="$(
+            printf '%s' "$new_config" | jq -c --arg name "$display_name" '
+                ([.outbounds[:-1][].tag // empty]) as $existing
+                | (
+                    if ($existing | index($name) | not) then $name
+                    else
+                        (label $found
+                            | (range(1; 1000001)
+                                | ($name + "-" + (. | tostring)) as $cand
+                                | if ($existing | index($cand) | not) then $cand, break $found else empty end))
+                    end
+                  ) as $tag
+                | .outbounds[-1].tag = $tag
+            ' 2>/dev/null
+        )"
+        if [ -z "$new_config" ] || ! printf '%s' "$new_config" | jq -e . >/dev/null 2>&1; then
+            log "skip subscription key (tag rename failed) for '$section'" "debug"
+            continue
+        fi
+
+        config="$new_config"
+        kept=$(( kept + 1 ))
+    done < "$lines_file"
+    rm -f "$lines_file"
+
+    if [ "$skipped" -gt 0 ]; then
+        log "Fallback subscription parser for '$section' skipped $skipped key(s) with unknown/unsupported schemes" "debug"
+    fi
+
+    final_count="$(printf '%s' "$config" | jq -r '.outbounds | length' 2>/dev/null)"
+    [ -n "$final_count" ] || final_count=0
+    log "Fallback subscription parser for '$section' produced $final_count outbound(s) from $kept accepted key(s)" "debug"
+    if [ "$final_count" -le 0 ]; then
+        return 1
+    fi
+
+    printf '%s' "$config" | jq '.' > "$out_file" 2>/dev/null || return 1
+    return 0
+}
diff --git a/podkop/files/usr/lib/logging.sh b/netshift/files/usr/lib/logging.sh
similarity index 66%
rename from podkop/files/usr/lib/logging.sh
rename to netshift/files/usr/lib/logging.sh
index 3a529ad5..7b5dd1b6 100644
--- a/podkop/files/usr/lib/logging.sh
+++ b/netshift/files/usr/lib/logging.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=ash
 COLOR_CYAN="\033[0;36m"
 COLOR_GREEN="\033[0;32m"
 COLOR_RESET="\033[0m"
@@ -6,11 +7,11 @@ log() {
     local message="$1"
     local level="$2"
 
-    if [ "$level" == "" ]; then
+    if [ "$level" = "" ]; then
         level="info"
     fi
 
-    logger -t "podkop" "[$level] $message"
+    logger -t "netshift" "[$level] $message"
 }
 
 nolog() {
@@ -19,7 +20,7 @@ nolog() {
     timestamp=$(date +"%Y-%m-%d %H:%M:%S")
 
     if [ -t 1 ]; then
-        echo -e "${COLOR_CYAN}[$timestamp]${COLOR_RESET} ${COLOR_GREEN}$message${COLOR_RESET}"
+        printf '%b\n' "${COLOR_CYAN}[$timestamp]${COLOR_RESET} ${COLOR_GREEN}$message${COLOR_RESET}"
     fi
 }
 
diff --git a/netshift/files/usr/lib/nft.sh b/netshift/files/usr/lib/nft.sh
new file mode 100644
index 00000000..65c1f612
--- /dev/null
+++ b/netshift/files/usr/lib/nft.sh
@@ -0,0 +1,144 @@
+# shellcheck shell=ash
+# Create an nftables table in the inet family
+nft_create_table() {
+    local name="$1"
+
+    nft add table inet "$name"
+}
+
+# Delete an nftables inet table if it exists (idempotent, fail-open).
+# create_nft_rules rebuilds the whole table from scratch, so it MUST start from
+# a clean slate: `nft add table` is idempotent but `nft add rule`/`nft add
+# chain` only ever APPEND. Without this flush, a table left behind by a previous
+# start that was not cleanly stopped (a procd respawn, an in-place package
+# upgrade, or a crash) keeps its stale rules and the freshly-added rules pile on
+# top of them. In particular a stale mark-EVERYTHING rule (from global_proxy or
+# an older mark-all build) would sit at the top of the prerouting chain and mark
+# all traffic before the new destination-selective rules are ever evaluated,
+# silently re-introducing the "everything proxied / 100% CPU" regression.
+nft_delete_table() {
+    local name="$1"
+
+    if nft list table inet "$name" > /dev/null 2>&1; then
+        nft delete table inet "$name" 2>/dev/null
+    fi
+}
+
+# Create a set within a table for storing IPv4 addresses
+nft_create_ipv4_set() {
+    local table="$1"
+    local name="$2"
+
+    nft add set inet "$table" "$name" '{ type ipv4_addr; flags interval; auto-merge; }'
+}
+
+nft_create_ipv6_set() {
+    local table="$1"
+    local name="$2"
+
+    nft add set inet "$table" "$name" '{ type ipv6_addr; flags interval; auto-merge; }'
+}
+
+nft_create_ifname_set() {
+    local table="$1"
+    local name="$2"
+
+    nft add set inet "$table" "$name" '{ type ifname; flags interval; }'
+}
+
+# Add one or more elements to a set
+nft_add_set_elements() {
+    local table="$1"
+    local set="$2"
+    local elements="$3"
+
+    nft add element inet "$table" "$set" "{ $elements }"
+}
+
+nft_add_set_elements_from_file_chunked() {
+    local filepath="$1"
+    local nft_table_name="$2"
+    local nft_set_name="$3"
+    local chunk_size="${4:-5000}"
+
+    local array count
+    count=0
+    while IFS= read -r line; do
+        line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+
+        [ -z "$line" ] && continue
+
+        if ! is_ipv4 "$line" && ! is_ipv4_cidr "$line"; then
+            log "'$line' is not IPv4 or IPv4 CIDR" "debug"
+            continue
+        fi
+
+        if [ -z "$array" ]; then
+            array="$line"
+        else
+            array="$array,$line"
+        fi
+
+        count=$((count + 1))
+
+        if [ "$count" = "$chunk_size" ]; then
+            log "Adding $count elements to nft set $nft_set_name" "debug"
+            nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
+            array=""
+            count=0
+        fi
+    done < "$filepath"
+
+    if [ -n "$array" ]; then
+        log "Adding $count elements to nft set $nft_set_name" "debug"
+        nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
+    fi
+}
+
+# IPv6 counterpart of nft_add_set_elements_from_file_chunked. Adds only the
+# IPv6 / IPv6-CIDR lines from the file into an ipv6_addr set. A line is treated
+# as IPv6 when it contains a ':' (after trimming); anything else (IPv4, blank,
+# comment) is skipped. Fail-open: a malformed line is simply not added, so the
+# corresponding traffic goes direct rather than blackholing.
+nft_add_set_elements_from_file_chunked_v6() {
+    local filepath="$1"
+    local nft_table_name="$2"
+    local nft_set_name="$3"
+    local chunk_size="${4:-5000}"
+
+    local array count
+    count=0
+    while IFS= read -r line; do
+        line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+
+        [ -z "$line" ] && continue
+
+        case "$line" in
+        *:*) ;;
+        *)
+            log "'$line' is not IPv6 or IPv6 CIDR" "debug"
+            continue
+            ;;
+        esac
+
+        if [ -z "$array" ]; then
+            array="$line"
+        else
+            array="$array,$line"
+        fi
+
+        count=$((count + 1))
+
+        if [ "$count" = "$chunk_size" ]; then
+            log "Adding $count elements to nft set $nft_set_name" "debug"
+            nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
+            array=""
+            count=0
+        fi
+    done < "$filepath"
+
+    if [ -n "$array" ]; then
+        log "Adding $count elements to nft set $nft_set_name" "debug"
+        nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
+    fi
+}
diff --git a/podkop/files/usr/lib/rulesets.sh b/netshift/files/usr/lib/rulesets.sh
similarity index 98%
rename from podkop/files/usr/lib/rulesets.sh
rename to netshift/files/usr/lib/rulesets.sh
index c79beb27..b4a82ec9 100644
--- a/podkop/files/usr/lib/rulesets.sh
+++ b/netshift/files/usr/lib/rulesets.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=ash
 # Constructs and returns a ruleset tag using section, name, optional type, and a fixed postfix
 get_ruleset_tag() {
     local section="$1"
@@ -163,8 +164,7 @@ decompile_binary_ruleset() {
     local output_filepath="$2"
 
     log "Decompiling $binary_filepath to $output_filepath" "debug"
-    sing-box rule-set decompile "$binary_filepath" -o "$output_filepath"
-    if [[ $? -ne 0 ]]; then
+    if ! sing-box rule-set decompile "$binary_filepath" -o "$output_filepath"; then
         log "Decompilation command failed for $binary_filepath" "error"
         return 1
     fi
diff --git a/netshift/files/usr/lib/sing_box_config_facade.sh b/netshift/files/usr/lib/sing_box_config_facade.sh
new file mode 100644
index 00000000..d1f77b93
--- /dev/null
+++ b/netshift/files/usr/lib/sing_box_config_facade.sh
@@ -0,0 +1,900 @@
+# shellcheck shell=ash
+NETSHIFT_LIB="/usr/lib/netshift"
+. "$NETSHIFT_LIB/helpers.sh"
+. "$NETSHIFT_LIB/sing_box_config_manager.sh"
+
+sing_box_cf_add_dns_server() {
+    local config="$1"
+    local type="$2"
+    local tag="$3"
+    local server="$4"
+    local domain_resolver="$5"
+    local detour="$6"
+
+    local server_address server_port
+    server_address=$(url_get_host "$server")
+    server_port=$(url_get_port "$server")
+
+    case "$type" in
+    udp)
+        [ -z "$server_port" ] && server_port=53
+        config=$(sing_box_cm_add_udp_dns_server "$config" "$tag" "$server_address" "$server_port" "$domain_resolver" \
+            "$detour")
+        ;;
+    dot)
+        [ -z "$server_port" ] && server_port=853
+        config=$(sing_box_cm_add_tls_dns_server "$config" "$tag" "$server_address" "$server_port" "$domain_resolver" \
+            "$detour")
+        ;;
+    doh)
+        [ -z "$server_port" ] && server_port=443
+        local path headers
+        path=$(url_get_path "$server")
+        headers="" # TODO(ampetelin): implement it if necessary
+        config=$(sing_box_cm_add_https_dns_server "$config" "$tag" "$server_address" "$server_port" "$path" "$headers" \
+            "$domain_resolver" "$detour")
+        ;;
+    *)
+        log "Unsupported DNS server type: $type. Aborted." "fatal"
+        exit 1
+        ;;
+    esac
+
+    echo "$config"
+}
+
+sing_box_cf_add_mixed_inbound_and_route_rule() {
+    local config="$1"
+    local tag="$2"
+    local listen_address="$3"
+    local listen_port="$4"
+    local outbound="$5"
+
+    config=$(sing_box_cm_add_mixed_inbound "$config" "$tag" "$listen_address" "$listen_port")
+    config=$(sing_box_cm_add_route_rule "$config" "" "$tag" "$outbound")
+
+    echo "$config"
+}
+
+sing_box_cf_add_proxy_outbound() {
+    local config="$1"
+    local section="$2"
+    local url="$3"
+    local udp_over_tcp="$4"
+
+    # Keep the RAW (pre-url_decode) link for schemes that base64-decode the
+    # WHOLE payload (vmess). url_decode rewrites '+'->space, which corrupts
+    # standard base64 bodies (the '+' is in the base64 alphabet). See the
+    # vmess) case below.
+    local raw_url="$3"
+
+    url=$(url_decode "$url")
+    url=$(url_strip_fragment "$url")
+
+    local scheme
+    scheme="$(url_get_scheme "$url")"
+    case "$scheme" in
+    socks4 | socks4a | socks5)
+        local tag host port version userinfo username password udp_over_tcp
+
+        tag=$(get_outbound_tag_by_section "$section")
+        host=$(url_get_host "$url")
+        port=$(url_get_port "$url")
+        version="${scheme#socks}"
+        if [ "$scheme" = "socks5" ]; then
+            userinfo=$(url_get_userinfo "$url")
+            if [ -n "$userinfo" ]; then
+                username="${userinfo%%:*}"
+                password="${userinfo#*:}"
+            fi
+        fi
+        config="$(sing_box_cm_add_socks_outbound \
+            "$config" \
+            "$tag" \
+            "$host" \
+            "$port" \
+            "$version" \
+            "$username" \
+            "$password" \
+            "" \
+            "$([ "$udp_over_tcp" = "1" ] && echo 2)" # if udp_over_tcp is enabled, enable version 2
+        )"
+        ;;
+    vless)
+        local tag host port uuid flow packet_encoding
+        tag=$(get_outbound_tag_by_section "$section")
+        host=$(url_get_host "$url")
+        port=$(url_get_port "$url")
+        uuid=$(url_get_userinfo "$url")
+        flow=$(url_get_query_param "$url" "flow")
+        packet_encoding=$(url_get_query_param "$url" "packetEncoding")
+
+        config=$(sing_box_cm_add_vless_outbound "$config" "$tag" "$host" "$port" "$uuid" "$flow" "" "$packet_encoding")
+        config=$(_add_outbound_security "$config" "$tag" "$url")
+        config=$(_add_outbound_transport "$config" "$tag" "$url")
+        ;;
+    ss)
+        local userinfo tag host port method password udp_over_tcp
+
+        userinfo=$(url_get_userinfo "$url")
+        if ! is_shadowsocks_userinfo_format "$userinfo"; then
+            userinfo=$(base64_decode "$userinfo")
+            if [ $? -ne 0 ]; then
+                log "Cannot decode shadowsocks userinfo or it does not match the expected format. Aborted." "fatal"
+                exit 1
+            fi
+        fi
+
+        tag=$(get_outbound_tag_by_section "$section")
+        host=$(url_get_host "$url")
+        port=$(url_get_port "$url")
+        method="${userinfo%%:*}"
+        password="${userinfo#*:}"
+
+        config=$(
+            sing_box_cm_add_shadowsocks_outbound \
+                "$config" \
+                "$tag" \
+                "$host" \
+                "$port" \
+                "$method" \
+                "$password" \
+                "" \
+                "$([ "$udp_over_tcp" = "1" ] && echo 2)" # if udp_over_tcp is enabled, enable version 2
+        )
+        ;;
+    trojan)
+        local tag host port password
+        tag=$(get_outbound_tag_by_section "$section")
+        host=$(url_get_host "$url")
+        port=$(url_get_port "$url")
+        password=$(url_get_userinfo "$url")
+
+        config=$(sing_box_cm_add_trojan_outbound "$config" "$tag" "$host" "$port" "$password")
+        config=$(_add_outbound_security "$config" "$tag" "$url")
+        config=$(_add_outbound_transport "$config" "$tag" "$url")
+        ;;
+    hysteria2 | hy2)
+        local tag host port password obfuscator_type obfuscator_password upload_mbps download_mbps
+        tag=$(get_outbound_tag_by_section "$section")
+        host=$(url_get_host "$url")
+        port="$(url_get_port "$url")"
+        password=$(url_get_userinfo "$url")
+        obfuscator_type=$(url_get_query_param "$url" "obfs")
+        obfuscator_password=$(url_get_query_param "$url" "obfs-password")
+        upload_mbps=$(url_get_query_param "$url" "upmbps")
+        download_mbps=$(url_get_query_param "$url" "downmbps")
+
+        config=$(sing_box_cm_add_hysteria2_outbound "$config" "$tag" "$host" "$port" "$password" "$obfuscator_type" \
+            "$obfuscator_password" "$upload_mbps" "$download_mbps")
+        config=$(_add_outbound_security "$config" "$tag" "$url")
+        ;;
+    vmess)
+        # ─── REFERENCE EXTENDED-GATING PATTERN (Tier-1 protocols copy this) ───
+        # Generation is gated behind sing-box-extended. On a stock sing-box build
+        # we log a clear message and return the config UNCHANGED (no exit 1, no
+        # outbound added) so generation degrades safely and keeps the last-good
+        # config.
+        #
+        # Schemes this dispatcher PARSES: socks4/socks4a/socks5, vless, ss,
+        # trojan, hysteria2/hy2, and vmess (vmess is extended-gated above). Any
+        # OTHER scheme (tuic, hysteria v1, anytls, shadowtls, wireguard, http,
+        # or a typo) is NOT parsed here: it hits the default `*)` arm below,
+        # which logs a WARNING and returns the config UNCHANGED (rc 1, skip) so a
+        # single bad link in a url/selector/urltest input never aborts the whole
+        # config. Such schemes are reachable only via a raw `outbound_json`
+        # connection (proxy_config_type=outbound) or a native sing-box-JSON
+        # subscription, which bypass this URL dispatcher entirely.
+        if ! is_sing_box_extended; then
+            log "VMess requires sing-box-extended. Install sing-box-extended and retry." "error"
+            echo "$config"
+            return 0
+        fi
+        # ─────────────────────────────────────────────────────────────────────
+
+        local tag vmess_json vm_server vm_port vm_uuid vm_security vm_alter_id
+        local vm_net vm_host vm_path vm_tls vm_sni vm_alpn vm_fp
+
+        tag=$(get_outbound_tag_by_section "$section")
+
+        # Primary format: vmess://base64(JSON) (V2RayN). The URL form
+        # (vmess://<uuid>@<host>:<port>?...) is a phase-2 follow-on; not handled here.
+        #
+        # CRITICAL: VMess base64-decodes the WHOLE payload, so it MUST use the
+        # RAW pre-url_decode link ($raw_url, NOT $url). url_decode rewrites
+        # '+'->space, which would corrupt standard base64 bodies containing '+'.
+        # Future Tier-1 copiers (tuic/etc.) that base64-decode a whole payload
+        # MUST also use $raw_url for the same reason.
+        vmess_json=$(vmess_link_to_json "$raw_url")
+        if [ -z "$vmess_json" ] || ! echo "$vmess_json" | jq -e 'type == "object"' > /dev/null 2>&1; then
+            log "Cannot decode VMess link or it does not match the expected base64(JSON) format. Aborted." "fatal"
+            exit 1
+        fi
+
+        # Numbers-as-strings are tolerated: extract every field as a string.
+        vm_server=$(echo "$vmess_json" | jq -r '.add // ""')
+        vm_port=$(echo "$vmess_json" | jq -r '.port // "" | tostring')
+        vm_uuid=$(echo "$vmess_json" | jq -r '.id // ""')
+        vm_security=$(echo "$vmess_json" | jq -r '.scy // "" | tostring')
+        vm_alter_id=$(echo "$vmess_json" | jq -r '.aid // "" | tostring')
+        vm_net=$(echo "$vmess_json" | jq -r '.net // "" | tostring')
+        vm_host=$(echo "$vmess_json" | jq -r '.host // "" | tostring')
+        vm_path=$(echo "$vmess_json" | jq -r '.path // "" | tostring')
+        vm_tls=$(echo "$vmess_json" | jq -r '.tls // "" | tostring')
+        vm_sni=$(echo "$vmess_json" | jq -r '.sni // "" | tostring')
+        vm_alpn=$(echo "$vmess_json" | jq -r '.alpn // "" | tostring')
+        vm_fp=$(echo "$vmess_json" | jq -r '.fp // "" | tostring')
+
+        config=$(sing_box_cm_add_vmess_outbound "$config" "$tag" "$vm_server" "$vm_port" "$vm_uuid" \
+            "$vm_security" "$vm_alter_id")
+        config=$(_add_vmess_transport_and_security "$config" "$tag" "$vm_net" "$vm_host" "$vm_path" \
+            "$vm_tls" "$vm_sni" "$vm_alpn" "$vm_fp" "$vm_server")
+        ;;
+    *)
+        # Unsupported scheme: downgrade from fatal to a WARNING + skip. This
+        # dispatcher is shared by the single-URL, selector-loop and urltest-loop
+        # callers, so a single unsupported/typo'd link must NOT abort generation
+        # of the whole config. Echo the input config UNCHANGED (never empty — an
+        # empty echo would wipe the caller's `config=$(...)`) and return non-zero
+        # so the caller knows no outbound was added and can skip this node and
+        # continue with the remaining links. The subscription normalize caller
+        # already understands this non-zero "skip" contract.
+        log "Unsupported proxy scheme '$scheme'; skipping this link (supported: socks/vless/ss/trojan/hysteria2/vmess)" "warn"
+        echo "$config"
+        return 1
+        ;;
+    esac
+
+    echo "$config"
+}
+
+_add_outbound_security() {
+    local config="$1"
+    local outbound_tag="$2"
+    local url="$3"
+
+    local security scheme
+    security=$(url_get_query_param "$url" "security")
+    scheme="$(url_get_scheme "$url")"
+
+    if [ -z "$security" ]; then
+        if [ "$scheme" = "hysteria2" ] || [ "$scheme" = "hy2" ]; then
+            security="tls"
+        fi
+    fi
+
+    case "$security" in
+    tls | reality)
+        local sni insecure alpn fingerprint public_key short_id transport_type
+        sni=$(url_get_query_param "$url" "sni")
+        insecure=$(_get_insecure_query_param_from_url "$url")
+        alpn=$(comma_string_to_json_array "$(url_get_query_param "$url" "alpn")")
+        fingerprint=$(url_get_query_param "$url" "fp")
+        public_key=$(url_get_query_param "$url" "pbk")
+        short_id=$(url_get_query_param "$url" "sid")
+
+        # XHTTP transport defaults its ALPN to h2/http/1.1 when none is provided.
+        # `splithttp` is the pre-rename alias of `xhttp` (see _add_outbound_transport).
+        transport_type=$(url_get_query_param "$url" "type")
+        if { [ "$transport_type" = "xhttp" ] || [ "$transport_type" = "splithttp" ]; } && [ "$alpn" = "[]" ]; then
+            alpn='["h2","http/1.1"]'
+        fi
+
+        if [ "$scheme" = "hysteria2" ] || [ "$scheme" = "hy2" ]; then
+                fingerprint=""
+        fi
+
+        config=$(
+            sing_box_cm_set_tls_for_outbound \
+                "$config" \
+                "$outbound_tag" \
+                "$sni" \
+                "$([ "$insecure" = "1" ] && echo true)" \
+                "$([ "$alpn" = "[]" ] && echo null || echo "$alpn")" \
+                "$fingerprint" \
+                "$public_key" \
+                "$short_id"
+        )
+        ;;
+    none) ;;
+    *)
+        log "Unknown security '$security' detected." "error"
+        ;;
+    esac
+
+    echo "$config"
+}
+
+_get_insecure_query_param_from_url() {
+    local url="$1"
+
+    local insecure
+    insecure=$(url_get_query_param "$url" "allowInsecure")
+    if [ -z "$insecure" ]; then
+        insecure=$(url_get_query_param "$url" "insecure")
+    fi
+
+    echo "$insecure"
+}
+
+_add_outbound_transport() {
+    local config="$1"
+    local outbound_tag="$2"
+    local url="$3"
+
+    local transport
+    transport=$(url_get_query_param "$url" "type")
+    case "$transport" in
+    tcp | raw) ;;
+    ws)
+        local ws_path ws_host ws_early_data
+        ws_path=$(url_get_query_param "$url" "path")
+        ws_host=$(url_get_query_param "$url" "host")
+        ws_early_data=$(url_get_query_param "$url" "ed")
+
+        config=$(
+            sing_box_cm_set_ws_transport_for_outbound "$config" "$outbound_tag" "$ws_path" "$ws_host" "$ws_early_data"
+        )
+        ;;
+    grpc)
+        # TODO(ampetelin): Add handling of optional gRPC parameters; example links are needed.
+        local grpc_service_name
+        grpc_service_name=$(url_get_query_param "$url" "serviceName")
+
+        config=$(
+            sing_box_cm_set_grpc_transport_for_outbound "$config" "$outbound_tag" "$grpc_service_name"
+        )
+        ;;
+    xhttp | splithttp)
+        # `splithttp` is the pre-rename name of the `xhttp` transport (sing-box
+        # renamed it). Accept it as an alias and normalize to xhttp downstream:
+        # sing_box_cm_set_xhttp_transport_for_outbound emits the modern `xhttp`
+        # key, so the config sing-box sees always uses the current name.
+        if ! is_sing_box_extended; then
+            log "XHTTP transport requires sing-box-extended. Install sing-box-extended and retry." "error"
+            echo "$config"
+            return 0
+        fi
+        local xhttp_path xhttp_host xhttp_sni xhttp_mode
+        xhttp_path=$(url_get_query_param "$url" "path")
+        xhttp_host=$(url_get_query_param "$url" "host")
+        xhttp_sni=$(url_get_query_param "$url" "sni")
+        [ -n "$xhttp_host" ] || xhttp_host="$xhttp_sni"
+        xhttp_mode=$(url_get_query_param "$url" "mode")
+        config=$(sing_box_cm_set_xhttp_transport_for_outbound "$config" "$outbound_tag" "$xhttp_path" "$xhttp_host" "$xhttp_mode")
+        ;;
+    *)
+        log "Unknown transport '$transport' detected." "error"
+        ;;
+    esac
+
+    echo "$config"
+}
+
+#######################################
+# Apply VMess TLS + transport to an already-added vmess outbound.
+# VMess (V2RayN base64-JSON) carries transport in the JSON `net` field and TLS
+# in `tls`/`sni`/`alpn`/`fp` — NOT in URL query params. So we do NOT route
+# through _add_outbound_security / _add_outbound_transport (which read
+# url_get_query_param); we set everything from the decoded-JSON values here.
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   tag: string, outbound tag to mutate
+#   net: string, vmess `net` (ws|grpc|h2|tcp|"")
+#   host: string, vmess `host`
+#   path: string, vmess `path`
+#   tls: string, vmess `tls` ("tls"/"1"/"true" enables TLS)
+#   sni: string, vmess `sni`
+#   alpn: string, vmess `alpn` (comma-separated)
+#   fp: string, vmess `fp` (uTLS fingerprint)
+#   server: string, vmess `add` (TLS server_name fallback when sni is empty)
+# Outputs:
+#   Writes updated JSON configuration to stdout
+#######################################
+_add_vmess_transport_and_security() {
+    local config="$1"
+    local outbound_tag="$2"
+    local net="$3"
+    local host="$4"
+    local path="$5"
+    local tls="$6"
+    local sni="$7"
+    local alpn="$8"
+    local fp="$9"
+    local server="${10}"
+
+    # Transport from `net` (NOT a query `type`).
+    local tls_required=0
+    case "$net" in
+    ws)
+        config=$(sing_box_cm_set_ws_transport_for_outbound "$config" "$outbound_tag" "$path" "$host")
+        ;;
+    grpc)
+        # The core derives the gRPC serviceName from `path` (falls back to `host`).
+        local grpc_service_name="$path"
+        [ -n "$grpc_service_name" ] || grpc_service_name="$host"
+        config=$(sing_box_cm_set_grpc_transport_for_outbound "$config" "$outbound_tag" "$grpc_service_name")
+        ;;
+    h2)
+        # HTTP/2 transport mandates TLS.
+        config=$(sing_box_cm_set_http_transport_for_outbound "$config" "$outbound_tag" "$path" "$host")
+        tls_required=1
+        ;;
+    tcp | "") ;;
+    *)
+        log "Unknown VMess transport '$net' detected." "error"
+        ;;
+    esac
+
+    # TLS from `tls` (or forced by h2 transport).
+    local tls_enabled=0
+    case "$tls" in
+    tls | 1 | true) tls_enabled=1 ;;
+    esac
+    [ "$tls_required" -eq 1 ] && tls_enabled=1
+
+    if [ "$tls_enabled" -eq 1 ]; then
+        local server_name alpn_json
+        server_name="$sni"
+        [ -n "$server_name" ] || server_name="$server"
+        alpn_json=$(comma_string_to_json_array "$alpn")
+        config=$(
+            sing_box_cm_set_tls_for_outbound \
+                "$config" \
+                "$outbound_tag" \
+                "$server_name" \
+                "" \
+                "$([ "$alpn_json" = "[]" ] && echo null || echo "$alpn_json")" \
+                "$fp" \
+                "" \
+                ""
+        )
+    fi
+
+    echo "$config"
+}
+
+sing_box_cf_add_json_outbound() {
+    local config="$1"
+    local section="$2"
+    local json_outbound="$3"
+
+    local tag
+    tag=$(get_outbound_tag_by_section "$section")
+
+    config=$(sing_box_cm_add_raw_outbound "$config" "$tag" "$json_outbound")
+
+    echo "$config"
+}
+
+sing_box_cf_add_interface_outbound() {
+    local config="$1"
+    local section="$2"
+    local interface_name="$3"
+
+    local tag
+    tag=$(get_outbound_tag_by_section "$section")
+
+    config=$(sing_box_cm_add_interface_outbound "$config" "$tag" "$interface_name")
+
+    echo "$config"
+}
+
+sing_box_cf_proxy_domain() {
+    local config="$1"
+    local inbound="$2"
+    local domain="$3"
+    local outbound="$4"
+
+    tag="$(gen_id)"
+    config=$(sing_box_cm_add_route_rule "$config" "$tag" "$inbound" "$outbound")
+    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "domain" "$domain")
+
+    echo "$config"
+}
+
+sing_box_cf_override_domain_port() {
+    local config="$1"
+    local domain="$2"
+    local port="$3"
+
+    tag="$(gen_id)"
+    config=$(sing_box_cm_add_options_route_rule "$config" "$tag")
+    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "domain" "$domain")
+    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "override_port" "$port")
+
+    echo "$config"
+}
+
+sing_box_cf_add_single_key_reject_rule() {
+    local config="$1"
+    local inbound="$2"
+    local key="$3"
+    local value="$4"
+
+    tag="$(gen_id)"
+    config=$(sing_box_cm_add_reject_route_rule "$config" "$tag" "$inbound")
+    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "$key" "$value")
+
+    echo "$config"
+}
+
+#######################################
+# Build a prepared subscription batch in a SINGLE jq pass.
+# Filters out non-proxy types (selector, urltest, direct, dns, block), statically
+# drops outbounds unsupported by the current sing-box build (shadowsocks+tls and,
+# unless running sing-box-extended, xhttp transport), assigns a unique tag to each
+# outbound (deduplicating against tags already present in $config and against tags
+# chosen earlier in the same batch) and records a human-readable display name.
+# Arguments:
+#   config: string (JSON), sing-box configuration the batch will be merged into
+#   subscription_json_path: string, path to the downloaded subscription JSON file
+#   include_keywords_json: string (JSON array), keep only nodes whose display name
+#       contains at least one of these (OR). Empty array ([]) = keep all.
+#   exclude_keywords_json: string (JSON array), drop any node whose display name
+#       contains at least one of these (OR). Empty array ([]) = no exclusion.
+# Outputs:
+#   Writes a JSON object to stdout:
+#     { outbounds: [ {type,...,tag} ... ], tags: [..], names: [..],
+#       count: <kept>, skipped: <statically dropped> }
+#######################################
+sing_box_cf_prepare_subscription_batch() {
+    local config="$1"
+    local subscription_json_path="$2"
+    local include_keywords_json="${3:-[]}"
+    local exclude_keywords_json="${4:-[]}"
+    local sing_box_extended="false"
+
+    [ -n "$include_keywords_json" ] || include_keywords_json="[]"
+    [ -n "$exclude_keywords_json" ] || exclude_keywords_json="[]"
+
+    if is_sing_box_extended; then
+        sing_box_extended="true"
+    fi
+
+    # The working config is fed on stdin (POSIX-safe, no process substitution);
+    # the subscription JSON is slurped from its file path.
+    printf '%s' "$config" | jq -c \
+        --slurpfile sub "$subscription_json_path" \
+        --argjson extended "$sing_box_extended" \
+        --argjson include_keywords "$include_keywords_json" \
+        --argjson exclude_keywords "$exclude_keywords_json" '
+        # Codepoint-based case fold. OpenWrt jq has no Oniguruma and ascii_downcase
+        # only maps ASCII A-Z (leaving Cyrillic mixed-case), so define an inline
+        # fold (this jq program does NOT import helpers.jq). It lowercases ASCII
+        # AND Cyrillic (incl. the Yo letter outside the contiguous block); emoji
+        # and all other scripts pass through unchanged and thus match as exact
+        # codepoint substrings.
+        def ucfold:
+          explode
+          | map(
+              if   (. >= 65   and . <= 90)   then . + 32     # ASCII A-Z -> a-z
+              elif (. >= 1040 and . <= 1071) then . + 32     # Cyrillic А-Я -> а-я
+              elif (. == 1025)               then 1105       # Ё -> ё
+              else . end)
+          | implode;
+        # Normalise the keyword lists: drop empty items and precompute the
+        # case-folded form once. ucfold folds ASCII and Cyrillic; emoji/other
+        # scripts are matched as exact codepoint substrings.
+        # NB: "include"/"exclude" are reserved jq keywords, hence $inc/$exc.
+        ([$include_keywords[]? | tostring | select(length > 0) | ucfold]) as $inc
+        | ([$exclude_keywords[]? | tostring | select(length > 0) | ucfold]) as $exc
+        # A node "matches" a normalised keyword list when its case-folded name
+        # contains any of the keywords (substring via index, NO regex/Oniguruma).
+        # Bind each keyword to $kw so index() receives the keyword, not the name.
+        | def name_passes_keywords($lc):
+            (($inc | length) == 0 or any($inc[]; . as $kw | ($lc | index($kw)) != null))
+            and (($exc | length) == 0 or all($exc[]; . as $kw | ($lc | index($kw)) == null));
+        # Reserved tags already used by the working config (stdin is the config).
+        ([.outbounds[]?.tag // empty]) as $existing
+        # Candidate proxy outbounds from the subscription (preserve order).
+        | [$sub[0].outbounds[]? | select(
+            .type != "selector" and
+            .type != "urltest" and
+            .type != "direct" and
+            .type != "dns" and
+            .type != "block"
+          )] as $all_candidates
+        # Keyword whitelist/blacklist filter on the display name. Runs BEFORE the
+        # static-unsupported filter and tag dedup, so dropped nodes never get
+        # tags and never reach sing-box check. Covers native + fallback-parsed
+        # subscriptions (both consume this batch).
+        | [$all_candidates[]
+            | . as $ob
+            | (($ob.remark // $ob.tag // "") | tostring) as $name
+            | select(name_passes_keywords($name | ucfold))
+          ] as $candidates
+        | ($candidates | length) as $total
+        # Statically reject outbounds the current sing-box build cannot load.
+        | [ $candidates[]
+            | . as $ob
+            | (($ob.remark // $ob.tag // "") | tostring) as $name
+            | if ($ob.type == "shadowsocks" and ($ob.tls.enabled == true)) then
+                empty
+              elif (($ob.transport.type // "") == "xhttp" and ($extended | not)) then
+                empty
+              else
+                {ob: $ob, name: $name}
+              end
+          ] as $kept
+        # Assign unique tags using a deterministic dedup pass. $state.used is a
+        # set (object) of tags already taken, seeded with the existing config tags.
+        | reduce range(0; ($kept | length)) as $i (
+            {used: ($existing | map({(.): true}) | add // {}), out: []};
+            . as $state
+            | $kept[$i] as $entry
+            | ($entry.ob) as $ob
+            | (($ob.tag // $ob.remark // "") | tostring) as $raw
+            | (if ($raw | length) > 0 then $raw else ("server-" + (($i + 1) | tostring)) end) as $base
+            # Pick $base if free, else the first $base-N (N>=1) that is not taken.
+            | (
+                if ($state.used[$base] | not) then $base
+                else
+                    (label $found
+                        | (range(1; 1000001)
+                            | ($base + "-" + (. | tostring)) as $cand
+                            | if ($state.used[$cand] | not) then $cand, break $found else empty end))
+                end
+              ) as $tag
+            | .used[$tag] = true
+            | .out += [{
+                tag: $tag,
+                name: (if ($entry.name | length) > 0 then $entry.name else $tag end),
+                outbound: ($ob | del(.tag) | del(.remark) | . + {tag: $tag})
+              }]
+          ) as $resolved
+        | {
+            outbounds: [$resolved.out[].outbound],
+            tags: [$resolved.out[].tag],
+            names: [$resolved.out[].name],
+            count: ($resolved.out | length),
+            skipped: ($total - ($resolved.out | length))
+          }
+    ' 2>/dev/null
+}
+
+#######################################
+# Try to append a slice of prepared outbounds to the config and validate it once
+# with a single `sing-box check`. On success the validated config (including the
+# appended outbounds) is exposed via SING_BOX_CF_TRY_CONFIG.
+# Arguments:
+#   config: string (JSON), base configuration to append to
+#   outbounds_json: string (JSON array), outbound objects to append (already tagged)
+# Returns:
+#   0 on success (SING_BOX_CF_TRY_CONFIG set), non-zero on validation failure
+#######################################
+sing_box_cf_try_subscription_batch() {
+    local config="$1"
+    local outbounds_json="$2"
+    local updated_config validation_tmp
+
+    SING_BOX_CF_TRY_CONFIG=""
+
+    updated_config=$(printf '%s' "$config" | jq -c --argjson new "$outbounds_json" '.outbounds += $new' 2>/dev/null)
+    if [ -z "$updated_config" ]; then
+        return 1
+    fi
+
+    validation_tmp="$(mktemp)" || return 1
+    sing_box_cm_save_config_to_file "$updated_config" "$validation_tmp"
+    if ! sing-box -c "$validation_tmp" check > /dev/null 2>&1; then
+        rm -f "$validation_tmp"
+        return 1
+    fi
+    rm -f "$validation_tmp"
+
+    SING_BOX_CF_TRY_CONFIG="$updated_config"
+    return 0
+}
+
+#######################################
+# Recursively validate a range of prepared outbounds, isolating and skipping the
+# ones the current sing-box build rejects. Mirrors podkop-plus' bisection design:
+# a clean range costs a single `sing-box check`; only ranges containing a bad
+# outbound are split further (groups <= 8 are probed one-by-one).
+# Reads/updates the SING_BOX_CF_BATCH_* globals set up by the caller.
+# Arguments:
+#   start: integer, first index (0-based) into SING_BOX_CF_BATCH_OUTBOUNDS
+#   count: integer, number of outbounds in the range
+#######################################
+sing_box_cf_apply_subscription_range() {
+    local start="$1"
+    local count="$2"
+    local slice display_name half rest index
+
+    [ "$count" -gt 0 ] || return 0
+
+    slice=$(printf '%s' "$SING_BOX_CF_BATCH_OUTBOUNDS" |
+        jq -c --argjson start "$start" --argjson count "$count" '.[$start:($start + $count)]' 2>/dev/null)
+    if [ -z "$slice" ] || [ "$slice" = "[]" ]; then
+        SING_BOX_CF_BATCH_SKIPPED=$((SING_BOX_CF_BATCH_SKIPPED + count))
+        return 0
+    fi
+
+    if sing_box_cf_try_subscription_batch "$SING_BOX_CF_BATCH_CONFIG" "$slice"; then
+        SING_BOX_CF_BATCH_CONFIG="$SING_BOX_CF_TRY_CONFIG"
+        SING_BOX_CF_BATCH_KEPT=$((SING_BOX_CF_BATCH_KEPT + count))
+        SING_BOX_CF_BATCH_KEPT_RANGES="$SING_BOX_CF_BATCH_KEPT_RANGES $start:$count"
+        return 0
+    fi
+
+    if [ "$count" -eq 1 ]; then
+        display_name=$(printf '%s' "$SING_BOX_CF_BATCH_NAMES" |
+            jq -r --argjson start "$start" '.[$start] // "unknown"' 2>/dev/null)
+        [ -n "$display_name" ] || display_name="unknown"
+        log "Skip unsupported outbound for current sing-box: '$display_name'" "warn"
+        SING_BOX_CF_BATCH_SKIPPED=$((SING_BOX_CF_BATCH_SKIPPED + 1))
+        return 0
+    fi
+
+    if [ "$count" -le 8 ]; then
+        index=0
+        while [ "$index" -lt "$count" ]; do
+            sing_box_cf_apply_subscription_range $((start + index)) 1
+            index=$((index + 1))
+        done
+        return 0
+    fi
+
+    half=$((count / 2))
+    [ "$half" -gt 0 ] || half=1
+    rest=$((count - half))
+    sing_box_cf_apply_subscription_range "$start" "$half"
+    sing_box_cf_apply_subscription_range $((start + half)) "$rest"
+}
+
+#######################################
+# Parse a sing-box subscription JSON and add all proxy outbounds to the configuration.
+# Filters out non-proxy types (selector, urltest, direct, dns, block).
+# Uses 'tag' field (or 'remark' if present) as display name for each outbound.
+#
+# Validation strategy: build every outbound in a single jq pass, then validate the
+# whole batch with one `sing-box check`. If that passes (the common case) the run
+# costs O(1) sing-box invocations instead of O(n). If it fails, recursively bisect
+# the batch to isolate and skip only the outbounds the current sing-box build
+# cannot load, preserving the previous "skip unsupported outbound" behaviour. A
+# final full-config validation still happens later in sing_box_save_config().
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   section: string, the UCI section name
+#   subscription_json_path: string, path to the downloaded subscription JSON file
+#   include_keywords_json: string (JSON array, optional), keyword whitelist (OR);
+#       empty/[] keeps all nodes. Forwarded to the prepare batch.
+#   exclude_keywords_json: string (JSON array, optional), keyword blacklist (OR);
+#       empty/[] excludes nothing. Forwarded to the prepare batch.
+# Outputs:
+#   Writes updated JSON configuration to stdout
+#   Sets global variable SUBSCRIPTION_OUTBOUND_TAGS (comma-separated list of tags)
+#   Sets global variable SUBSCRIPTION_OUTBOUND_TAGS_JSON (JSON array of tags, ASCII-escaped)
+#   Sets global variable SUBSCRIPTION_OUTBOUND_NAMES (newline-separated list of display names)
+#######################################
+sing_box_cf_add_subscription_outbounds() {
+    local config="$1"
+    local section="$2"
+    local subscription_json_path="$3"
+    local include_keywords_json="${4:-[]}"
+    local exclude_keywords_json="${5:-[]}"
+
+    [ -n "$include_keywords_json" ] || include_keywords_json="[]"
+    [ -n "$exclude_keywords_json" ] || exclude_keywords_json="[]"
+
+    SUBSCRIPTION_OUTBOUND_TAGS=""
+    SUBSCRIPTION_OUTBOUND_TAGS_JSON="[]"
+    SUBSCRIPTION_OUTBOUND_NAMES=""
+    SING_BOX_CF_LAST_CONFIG="$config"
+
+    if [ ! -f "$subscription_json_path" ]; then
+        log "Subscription JSON file not found: $subscription_json_path" "error"
+        echo "$config"
+        return 1
+    fi
+
+    # Whether keyword filtering is active (for distinct empty-result logging).
+    local keyword_filter_active=0
+    if [ "$include_keywords_json" != "[]" ] || [ "$exclude_keywords_json" != "[]" ]; then
+        keyword_filter_active=1
+    fi
+
+    # Build the entire batch (keyword filter + static filter + dedup tags) in one
+    # jq pass.
+    local prepared
+    prepared=$(sing_box_cf_prepare_subscription_batch "$config" "$subscription_json_path" \
+        "$include_keywords_json" "$exclude_keywords_json")
+    if [ -z "$prepared" ]; then
+        log "Failed to parse subscription outbounds JSON" "error"
+        echo "$config"
+        return 1
+    fi
+
+    local candidate_total kept_count statically_skipped
+    candidate_total=$(printf '%s' "$prepared" | jq -r '(.count // 0) + (.skipped // 0)' 2>/dev/null)
+    kept_count=$(printf '%s' "$prepared" | jq -r '.count // 0' 2>/dev/null)
+    statically_skipped=$(printf '%s' "$prepared" | jq -r '.skipped // 0' 2>/dev/null)
+
+    if [ "$keyword_filter_active" -eq 1 ]; then
+        # candidate_total here is the post-keyword-filter candidate count; report
+        # kept vs. filtered_out so an over-strict filter is diagnosable.
+        local raw_candidate_total filtered_out
+        raw_candidate_total=$(printf '%s' "$config" | jq -c \
+            --slurpfile sub "$subscription_json_path" \
+            '[$sub[0].outbounds[]? | select(.type != "selector" and .type != "urltest" and .type != "direct" and .type != "dns" and .type != "block")] | length' 2>/dev/null)
+        [ -n "$raw_candidate_total" ] || raw_candidate_total=0
+        filtered_out=$((raw_candidate_total - candidate_total))
+        [ "$filtered_out" -ge 0 ] || filtered_out=0
+        log "Subscription keyword filter for section '$section': kept=$candidate_total, filtered_out=$filtered_out" "info"
+    fi
+
+    if [ -z "$candidate_total" ] || [ "$candidate_total" -eq 0 ]; then
+        if [ "$keyword_filter_active" -eq 1 ]; then
+            log "Subscription keyword filter for section '$section' removed all nodes; using a temporary blocked outbound" "warn"
+        fi
+        log "No proxy outbounds found in subscription JSON" "error"
+        echo "$config"
+        return 1
+    fi
+
+    log "Found $candidate_total proxy outbounds in subscription" "info"
+
+    if [ "${statically_skipped:-0}" -gt 0 ]; then
+        log "Skip $statically_skipped subscription outbound(s) unsupported by current sing-box build" "warn"
+    fi
+
+    if [ -z "$kept_count" ] || [ "$kept_count" -eq 0 ]; then
+        log "No supported proxy outbounds remained in subscription JSON" "error"
+        echo "$config"
+        return 1
+    fi
+
+    # Set up shared state for the (possibly recursive) batch validation.
+    SING_BOX_CF_BATCH_CONFIG="$config"
+    SING_BOX_CF_BATCH_OUTBOUNDS=$(printf '%s' "$prepared" | jq -c '.outbounds' 2>/dev/null)
+    SING_BOX_CF_BATCH_NAMES=$(printf '%s' "$prepared" | jq -c '.names' 2>/dev/null)
+    SING_BOX_CF_BATCH_KEPT=0
+    SING_BOX_CF_BATCH_SKIPPED=0
+    SING_BOX_CF_BATCH_KEPT_RANGES=""
+
+    sing_box_cf_apply_subscription_range 0 "$kept_count"
+
+    if [ "$SING_BOX_CF_BATCH_KEPT" -eq 0 ]; then
+        log "No valid subscription outbounds remained after validation for section '$section'" "error"
+        echo "$config"
+        return 1
+    fi
+
+    config="$SING_BOX_CF_BATCH_CONFIG"
+
+    if [ "$SING_BOX_CF_BATCH_SKIPPED" -gt 0 ]; then
+        log "Skipped $SING_BOX_CF_BATCH_SKIPPED unsupported subscription outbound(s) during validation" "warn"
+    fi
+
+    # Derive the public tag/name globals from the outbounds that were actually
+    # added (the ranges accepted during bisection), preserving original order.
+    local kept_ranges_json
+    kept_ranges_json=$(
+        printf '%s' "$SING_BOX_CF_BATCH_KEPT_RANGES" |
+            tr ' ' '\n' |
+            jq -R 'select(length > 0) | split(":") | {start: (.[0] | tonumber), count: (.[1] | tonumber)}' |
+            jq -sc '.'
+    )
+    [ -n "$kept_ranges_json" ] || kept_ranges_json="[]"
+
+    SUBSCRIPTION_OUTBOUND_TAGS_JSON=$(
+        printf '%s' "$prepared" | jq -c --argjson ranges "$kept_ranges_json" \
+            '[.tags as $t | $ranges[] | range(.start; .start + .count) | $t[.]]' 2>/dev/null
+    )
+    [ -n "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" ] || SUBSCRIPTION_OUTBOUND_TAGS_JSON="[]"
+
+    SUBSCRIPTION_OUTBOUND_TAGS=$(
+        printf '%s' "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" | jq -r 'join(",")' 2>/dev/null
+    )
+
+    SUBSCRIPTION_OUTBOUND_NAMES=$(
+        printf '%s' "$prepared" | jq -r --argjson ranges "$kept_ranges_json" \
+            '[.names as $n | $ranges[] | range(.start; .start + .count) | $n[.]] | join("\n")' 2>/dev/null
+    )
+
+    log "Added $SING_BOX_CF_BATCH_KEPT subscription outbounds for section '$section'" "info"
+    SING_BOX_CF_LAST_CONFIG="$config"
+
+    echo "$config"
+}
diff --git a/podkop/files/usr/lib/sing_box_config_manager.sh b/netshift/files/usr/lib/sing_box_config_manager.sh
similarity index 87%
rename from podkop/files/usr/lib/sing_box_config_manager.sh
rename to netshift/files/usr/lib/sing_box_config_manager.sh
index c1a2943b..2baccd5a 100644
--- a/podkop/files/usr/lib/sing_box_config_manager.sh
+++ b/netshift/files/usr/lib/sing_box_config_manager.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=ash
 #
 # Module: sing_box_config_manager.sh
 #
@@ -11,7 +12,7 @@
 #
 # Usage:
 #   Include this script in your ash script with:
-#     . /usr/lib/podkop/sing_box_config_manager.sh
+#     . /usr/lib/netshift/sing_box_config_manager.sh
 #
 #   After that, sing_box_cm_* functions are available for generating
 #   and modifying sing-box JSON configuration.
@@ -222,15 +223,20 @@ sing_box_cm_add_fakeip_dns_server() {
     local config="$1"
     local tag="$2"
     local inet4_range="$3"
+    local inet6_range="$4"
 
     echo "$config" | jq \
         --arg tag "$tag" \
         --arg inet4_range "$inet4_range" \
-        '.dns.servers += [{
-			type: "fakeip",
-			tag: $tag,
-			inet4_range: $inet4_range,
-		}]'
+        --arg inet6_range "$inet6_range" \
+        '.dns.servers += [(
+            {
+                type: "fakeip",
+                tag: $tag,
+                inet4_range: $inet4_range
+            }
+            + (if $inet6_range != "" then { inet6_range: $inet6_range } else {} end)
+        )]'
 }
 
 #######################################
@@ -287,7 +293,7 @@ sing_box_cm_patch_dns_route_rule() {
         --arg tag "$tag" \
         --arg key "$key" \
         --argjson value "$value" \
-        'import "helpers" as h {"search": "/usr/lib/podkop"};
+        'import "helpers" as h {"search": "/usr/lib/netshift"};
         .dns.rules |= map(
             if .[$service_tag] == $tag then
                 if has($key) then
@@ -621,6 +627,56 @@ sing_box_cm_add_vless_outbound() {
         )]'
 }
 
+#######################################
+# Add a VMess outbound to the outbounds section of a sing-box JSON configuration.
+# Requires sing-box-extended on the router (gated by the facade).
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   tag: string, identifier for the outbound
+#   server_address: string, IP address or hostname of the VMess server
+#   server_port: integer, port of the VMess server
+#   uuid: string, user UUID
+#   security: string, encryption method (optional; defaults to "auto" when empty)
+#   alter_id: integer, alterId (optional; omitted when empty or 0)
+# Outputs:
+#   Writes updated JSON configuration to stdout
+# Example:
+#   CONFIG=$(
+#       sing_box_cm_add_vmess_outbound "$CONFIG" "vmess-out" "example.com" 443 \
+#       "bf000d23-0752-40b4-affe-68f7707a9661" "auto" "0"
+#   )
+#######################################
+sing_box_cm_add_vmess_outbound() {
+    local config="$1"
+    local tag="$2"
+    local server_address="$3"
+    local server_port="$4"
+    local uuid="$5"
+    local security="$6"
+    local alter_id="$7"
+
+    [ -n "$security" ] || security="auto"
+
+    echo "$config" | jq \
+        --arg tag "$tag" \
+        --arg server_address "$server_address" \
+        --arg server_port "$server_port" \
+        --arg uuid "$uuid" \
+        --arg security "$security" \
+        --arg alter_id "$alter_id" \
+        '.outbounds += [(
+            {
+              type: "vmess",
+              tag: $tag,
+              server: $server_address,
+              server_port: ($server_port | tonumber),
+              uuid: $uuid,
+              security: $security
+            }
+            + (if $alter_id != "" and $alter_id != "0" then {alter_id: ($alter_id | tonumber)} else {} end)
+        )]'
+}
+
 #######################################
 # Add a Trojan outbound to the outbounds section of a sing-box JSON configuration.
 # Arguments:
@@ -833,6 +889,100 @@ sing_box_cm_set_ws_transport_for_outbound() {
         )'
 }
 
+#######################################
+# Set HTTP/2 transport settings for an outbound in a sing-box JSON configuration.
+# Used for VMess net=h2 links (sing-box "http" transport). HTTP/2 transport
+# mandates TLS, so the caller must also set TLS on the outbound.
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   tag: string, identifier of the outbound to modify
+#   path: string, HTTP path (optional)
+#   host: string, Host header (single host; optional)
+# Outputs:
+#   Writes updated JSON configuration to stdout
+# Example:
+#   CONFIG=$(sing_box_cm_set_http_transport_for_outbound "$CONFIG" "vmess-out" "/path" "example.com")
+#######################################
+sing_box_cm_set_http_transport_for_outbound() {
+    local config="$1"
+    local tag="$2"
+    local path="$3"
+    local host="$4"
+
+    echo "$config" | jq \
+        --arg tag "$tag" \
+        --arg path "$path" \
+        --arg host "$host" \
+        '.outbounds |= map(
+            if .tag == $tag then
+                . + {
+                    transport: (
+                        { type: "http" }
+                        + (if $path != "" then {path: $path} else {} end)
+                        + (if $host != "" then {host: [$host]} else {} end)
+                    )
+                }
+            else
+                .
+            end
+        )'
+}
+
+#######################################
+# Set XHTTP transport settings for an outbound in a sing-box JSON configuration.
+# Requires sing-box-extended on the router.
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   tag: string, identifier of the outbound to modify
+#   path: string, XHTTP path (defaults to "/" if empty)
+#   host: string, Host header for XHTTP (optional)
+#   mode: string, XHTTP mode (auto|packet-up|stream-up|stream-one; defaults to "auto")
+# Outputs:
+#   Writes updated JSON configuration to stdout
+# Example:
+#   CONFIG=$(sing_box_cm_set_xhttp_transport_for_outbound "$CONFIG" "vless-xhttp-out" "/path" "example.com" "auto")
+#######################################
+sing_box_cm_set_xhttp_transport_for_outbound() {
+    local config="$1"
+    local tag="$2"
+    local path="$3"
+    local host="$4"
+    local mode="$5"
+
+    case "$mode" in
+    auto | packet-up | stream-up | stream-one) ;;
+    *) mode="auto" ;;
+    esac
+
+    [ -n "$path" ] || path="/"
+
+    echo "$config" | jq \
+        --arg tag "$tag" \
+        --arg path "$path" \
+        --arg host "$host" \
+        --arg mode "$mode" \
+        '.outbounds |= map(
+            if .tag == $tag then
+                . + {
+                    transport: (
+                        {
+                            type: "xhttp",
+                            mode: $mode,
+                            path: $path,
+                            x_padding_bytes: "100-1000",
+                            no_grpc_header: false,
+                            sc_max_each_post_bytes: 1000000,
+                            sc_min_posts_interval_ms: 30
+                        }
+                        + (if $host != "" then {host: $host} else {} end)
+                    )
+                }
+            else
+                .
+            end
+        )'
+}
+
 #######################################
 # Set TLS settings for an outbound in a sing-box JSON configuration.
 # Arguments:
@@ -1047,10 +1197,13 @@ sing_box_cm_add_selector_outbound() {
 #   auto_detect_interface: boolean, enable or disable automatic interface detection
 #   default_domain_resolver: string, default DNS resolver for domain-based routing
 #   default_interface: string, default network interface to use when auto detection is disabled (optional)
+#   default_mark: integer, routing mark stamped on sing-box's own egress
+#       connections so the nft/ip-rule tproxy path does not re-capture them
+#       (optional; empty -> omitted, byte-identical to the no-mark output)
 # Outputs:
 #   Writes updated JSON configuration to stdout
 # Example:
-#   CONFIG=$(sing_box_cm_configure_route "$CONFIG" "direct-out" true "udp-server")
+#   CONFIG=$(sing_box_cm_configure_route "$CONFIG" "direct-out" true "udp-server" "" 2097152)
 #######################################
 sing_box_cm_configure_route() {
     local config="$1"
@@ -1058,12 +1211,14 @@ sing_box_cm_configure_route() {
     local auto_detect_interface="$3"
     local default_domain_resolver="$4"
     local default_interface="$5"
+    local default_mark="$6"
 
     echo "$config" | jq \
         --arg final "$final" \
         --argjson auto_detect_interface "$auto_detect_interface" \
         --arg default_domain_resolver "$default_domain_resolver" \
         --arg default_interface "$default_interface" \
+        --arg default_mark "$default_mark" \
         '.route = {
             rules: (.route.rules // []),
             rule_set: (.route.rule_set // []),
@@ -1072,6 +1227,7 @@ sing_box_cm_configure_route() {
             default_domain_resolver: $default_domain_resolver
         }
         + (if $default_interface != "" then { default_interface: $default_interface } else {} end)
+        + (if $default_mark != "" then { default_mark: ($default_mark | tonumber) } else {} end)
         '
 }
 
@@ -1167,7 +1323,7 @@ sing_box_cm_patch_route_rule() {
         --arg tag "$tag" \
         --arg key "$key" \
         --argjson value "$value" \
-        'import "helpers" as h {"search": "/usr/lib/podkop"};
+        'import "helpers" as h {"search": "/usr/lib/netshift"};
         .route.rules |= map(
             if .[$service_tag] == $tag then
                 if has($key) then
@@ -1208,6 +1364,51 @@ sing_box_cm_add_reject_route_rule() {
         }]'
 }
 
+#######################################
+# Add a DoH blocking reject route rule with an inline ruleset containing known
+# public DoH server IP ranges.
+# Arguments:
+#   config: string (JSON), sing-box configuration to modify
+#   tag: string, identifier for the route rule and ruleset
+#   inbound: string, inbound tag to match
+#   doh_ipv4_cidrs: string, space-separated IPv4 CIDRs to block
+#   doh_ipv6_cidrs: string, space-separated IPv6 CIDRs to block
+# Outputs:
+#   Writes updated JSON configuration to stdout
+#######################################
+sing_box_cm_add_doh_block_route_rule() {
+    local config="$1"
+    local tag="$2"
+    local inbound="$3"
+    local doh_ipv4_cidrs="$4"
+    local doh_ipv6_cidrs="${5:-}"
+
+    local ruleset_tag cidrs_json
+    ruleset_tag="${tag}-ruleset"
+    cidrs_json=$(printf '%s %s' "$doh_ipv4_cidrs" "$doh_ipv6_cidrs" | jq -R 'split(" ") | map(select(. != ""))')
+
+    config=$(echo "$config" | jq \
+        --arg tag "$ruleset_tag" \
+        --argjson ip_cidr "$cidrs_json" \
+        '.route.rule_set += [{
+            type: "inline",
+            tag: $tag,
+            rules: [{ ip_cidr: $ip_cidr }]
+        }]')
+
+    echo "$config" | jq \
+        --arg service_tag "$SERVICE_TAG" \
+        --arg tag "$tag" \
+        --arg inbound "$inbound" \
+        --arg ruleset_tag "$ruleset_tag" \
+        '.route.rules += [{
+            action: "reject",
+            inbound: $inbound,
+            rule_set: $ruleset_tag,
+            $service_tag: $tag
+        }]'
+}
+
 #######################################
 # Add a hijack-dns rule to the route section of a sing-box JSON configuration.
 # Arguments:
@@ -1330,11 +1531,11 @@ sing_box_cm_add_inline_ruleset_rule() {
 
     value=$(_normalize_arg "$value")
 
-    echo "$config" | jq -L /usr/lib/podkop \
+    echo "$config" | jq -L /usr/lib/netshift \
         --arg tag "$tag" \
         --arg key "$key" \
         --argjson value "$value" \
-        'import "helpers" as h {"search": "/usr/lib/podkop"};
+        'import "helpers" as h {"search": "/usr/lib/netshift"};
         .route.rule_set |= map(
             if .tag == $tag then
                 if has($key) then
diff --git a/netshift/files/usr/lib/updater.sh b/netshift/files/usr/lib/updater.sh
new file mode 100644
index 00000000..0c904a42
--- /dev/null
+++ b/netshift/files/usr/lib/updater.sh
@@ -0,0 +1,1958 @@
+# shellcheck shell=ash
+
+# Runtime updater for sing-box-extended and stock sing-box.
+# JSON parsing is done with jq (no ucode, no extra package deps).
+# This file is sourced from /usr/bin/netshift, so log() is available.
+
+SB_EXT_ARCH_SUFFIX=""
+UPDATES_SING_BOX_EXTENDED_REPO="shtorm-7/sing-box-extended"
+
+# Async component-action job state. State lives on tmpfs (/var/run): it survives
+# the rpcd call that started the worker but is intentionally transient (cleared
+# on reboot — a reboot mid-job simply loses the job, which is acceptable since
+# the install either already landed on disk or will be redone).
+UPDATES_JOB_DIR="/var/run/netshift/component-actions"
+# Finished state/.out files older than this are garbage-collected (minutes).
+UPDATES_JOB_FINISHED_TTL_MINUTES=60
+# Orphaned worker .out files older than this are reaped (minutes).
+UPDATES_JOB_ORPHAN_OUTPUT_TTL_MINUTES=60
+# Grace window after start before a running job whose pid is dead is declared
+# stale (seconds) — covers the race between fork and the pid being recorded.
+UPDATES_JOB_STALE_GRACE_SECONDS=15
+
+updates_log() {
+    local message="$1"
+    local level="${2:-info}"
+
+    log "Updater: $message" "$level"
+}
+
+# Verify that a backup copy is byte-complete, guarding the core-swap rollback
+# against a TRUNCATED backup written under tmpfs ENOSPC (busybox `cp` does not
+# reliably return non-zero on a partial write). Returns 0 iff $dst exists and
+# its byte size equals $src's size. A size match is sufficient here: this is a
+# same-machine copy of the same file and we are guarding truncation, not bit-rot
+# — do NOT md5/sha a ~40 MB binary on a slow armv7 router. If $src is absent
+# there is nothing to back up, so verification trivially succeeds (0).
+updates_verify_copy() {
+    local src="$1"
+    local dst="$2"
+    local ssz dsz
+
+    [ -f "$src" ] || return 0
+    [ -f "$dst" ] || return 1
+    ssz="$(wc -c < "$src" 2>/dev/null)" || return 1
+    dsz="$(wc -c < "$dst" 2>/dev/null)" || return 1
+    [ -n "$ssz" ] && [ "$ssz" = "$dsz" ]
+}
+
+# Verify that a stashed backup is still byte-complete BEFORE a rollback restores
+# it over the live path. Compares the backup's current byte size against the
+# expected source size recorded at backup time. Returns 0 iff $backup exists and
+# its size equals $expected_size. Refusing to restore a truncated backup is
+# safer than installing a segfaulting core as the "safe" fallback.
+updates_backup_is_complete() {
+    local backup="$1"
+    local expected_size="$2"
+    local bsz
+
+    [ -n "$backup" ] || return 1
+    [ -f "$backup" ] || return 1
+    [ -n "$expected_size" ] || return 1
+    bsz="$(wc -c < "$backup" 2>/dev/null)" || return 1
+    [ -n "$bsz" ] && [ "$bsz" = "$expected_size" ]
+}
+
+# ── Async component-action job state (jq, atomic) ───────────────────
+#
+# The UI starts long-running component actions (e.g. switching the sing-box
+# core) via `component_action_async`, which forks the real worker
+# (`component_action`) into a detached background process and returns a job_id
+# immediately — staying well under the rpcd 30s call timeout. The UI then polls
+# `component_action_status <job_id>`. State is small JSON objects written
+# atomically (`*.tmp.$$` + mv) and built with jq `--arg`/`--argjson` only (no
+# Oniguruma anywhere).
+#
+# State object contract (STABLE — consumed by the frontend, task-008):
+#   { success, running, component, action, message, pid,
+#     started_at, updated_at, exit_code, version, latest_version }
+#   * running state : running:true,  success:true,  exit_code:null
+#   * finished state: running:false, success/version/message parsed from the
+#     worker's captured stdout JSON, exit_code from the worker's $?.
+
+# Echoes the on-disk state path for a job id, or returns 1 for an unsafe id.
+# Rejecting anything outside [A-Za-z0-9._-] (and empty/./..) prevents path
+# traversal — the id reaches us straight from the (ACL-gated) UI.
+updates_job_state_path() {
+    local job_id="$1"
+
+    case "$job_id" in
+    "" | "." | "..") return 1 ;;
+    *[!A-Za-z0-9._-]*) return 1 ;;
+    esac
+
+    printf '%s/%s.json\n' "$UPDATES_JOB_DIR" "$job_id"
+}
+
+# Emits a small {"success","job_id","message"} response for the async call.
+updates_job_json_response() {
+    local success="$1"
+    local job_id="$2"
+    local message="${3:-}"
+
+    jq -nc \
+        --argjson success "$success" \
+        --arg job_id "$job_id" \
+        --arg message "$message" \
+        '{success: $success, job_id: $job_id, message: $message}'
+}
+
+# Emits a self-contained status object (used for invalid-id / not-found / error
+# replies that have no state file to cat).
+updates_job_status_response() {
+    local success="$1"
+    local running="$2"
+    local message="$3"
+
+    jq -nc \
+        --argjson success "$success" \
+        --argjson running "$running" \
+        --arg message "$message" \
+        '{success: $success, running: $running, component: "sing_box",
+          action: "", message: $message, pid: null, started_at: 0,
+          updated_at: 0, exit_code: null, version: "", latest_version: ""}'
+}
+
+# Returns a monotonic-ish wall clock as an integer (0 on failure).
+updates_now_seconds() {
+    local now
+
+    now="$(date +%s 2>/dev/null)"
+    case "$now" in
+    "" | *[!0-9]*) now=0 ;;
+    esac
+    printf '%s\n' "$now"
+}
+
+# Writes the "running" state for a job. pid may be empty (recorded as null and
+# patched in later once the worker is forked).
+updates_write_running_job_state() {
+    local state_file="$1"
+    local component="$2"
+    local action="$3"
+    local pid="${4:-}"
+    local tmp_file started_at pid_json rc
+
+    mkdir -p "$UPDATES_JOB_DIR" || return 1
+    started_at="$(updates_now_seconds)"
+    tmp_file="${state_file}.tmp.$$"
+
+    case "$pid" in
+    "" | *[!0-9]*) pid_json="null" ;;
+    *) pid_json="$pid" ;;
+    esac
+
+    jq -nc \
+        --arg component "$component" \
+        --arg action "$action" \
+        --argjson pid "$pid_json" \
+        --argjson started_at "$started_at" \
+        '{success: true, running: true, component: $component,
+          action: $action, message: "Component action is running",
+          pid: $pid, started_at: $started_at, updated_at: $started_at,
+          exit_code: null, version: "", latest_version: ""}' \
+        >"$tmp_file" && mv "$tmp_file" "$state_file"
+    rc=$?
+
+    rm -f "$tmp_file" 2>/dev/null
+    return $rc
+}
+
+# Patches the pid into an existing running state file.
+updates_update_running_job_pid() {
+    local state_file="$1"
+    local pid="$2"
+    local tmp_file rc
+
+    case "$pid" in
+    "" | *[!0-9]*) return 1 ;;
+    esac
+
+    [ -f "$state_file" ] || return 1
+    tmp_file="${state_file}.tmp.$$"
+
+    jq -c \
+        --argjson pid "$pid" \
+        '.pid = $pid' \
+        "$state_file" >"$tmp_file" && mv "$tmp_file" "$state_file"
+    rc=$?
+
+    rm -f "$tmp_file" 2>/dev/null
+    return $rc
+}
+
+# Rewrites a running state file as a failed/stale finished state.
+updates_mark_stale_job_state() {
+    local state_file="$1"
+    local tmp_file updated_at rc
+
+    [ -f "$state_file" ] || return 1
+    updated_at="$(updates_now_seconds)"
+    tmp_file="${state_file}.tmp.$$"
+
+    jq -c \
+        --argjson updated_at "$updated_at" \
+        '. + {success: false, running: false,
+              message: "Component action worker is no longer running",
+              updated_at: $updated_at,
+              exit_code: (if (.exit_code == null) then -1 else .exit_code end)}' \
+        "$state_file" >"$tmp_file" && mv "$tmp_file" "$state_file"
+    rc=$?
+
+    rm -f "$tmp_file" 2>/dev/null
+    return $rc
+}
+
+# 0 if the recorded start time is still inside the stale grace window.
+updates_started_at_is_within_stale_grace() {
+    local started_at="$1"
+    local now age
+
+    case "$started_at" in
+    "" | *[!0-9]*) return 1 ;;
+    esac
+    [ "$started_at" -gt 0 ] || return 1
+
+    now="$(updates_now_seconds)"
+    [ "$now" -gt 0 ] || return 1
+
+    age=$((now - started_at))
+    [ "$age" -lt "$UPDATES_JOB_STALE_GRACE_SECONDS" ]
+}
+
+# 0 if the state file is currently flagged running:true.
+updates_job_state_is_running() {
+    local state_file="$1"
+
+    [ -f "$state_file" ] || return 1
+    jq -e '.running == true' "$state_file" >/dev/null 2>&1
+}
+
+# If a job claims running:true but its pid is gone (past the grace window),
+# rewrite it as a stale finished state so the UI never polls a dead worker
+# forever.
+updates_refresh_running_job_state() {
+    local state_file="$1"
+    local pid started_at
+
+    updates_job_state_is_running "$state_file" || return 0
+
+    pid="$(jq -r '.pid // ""' "$state_file" 2>/dev/null)"
+    started_at="$(jq -r '.started_at // 0' "$state_file" 2>/dev/null)"
+
+    case "$pid" in
+    "" | *[!0-9]*)
+        updates_started_at_is_within_stale_grace "$started_at" && return 0
+        updates_mark_stale_job_state "$state_file"
+        return 0
+        ;;
+    esac
+
+    if kill -0 "$pid" 2>/dev/null; then
+        return 0
+    fi
+
+    updates_started_at_is_within_stale_grace "$started_at" && return 0
+    # Re-check under the (rare) race where the worker finished and rewrote the
+    # state between our running check and here.
+    updates_job_state_is_running "$state_file" || return 0
+    updates_mark_stale_job_state "$state_file"
+}
+
+# Garbage-collects old job artifacts. Never removes a still-running job.
+updates_cleanup_component_jobs() {
+    local output_file state_file
+
+    [ -d "$UPDATES_JOB_DIR" ] || return 0
+
+    # Reap orphan worker outputs whose state is finished (or missing).
+    find "$UPDATES_JOB_DIR" -type f -name '*.out' -mmin "+$UPDATES_JOB_ORPHAN_OUTPUT_TTL_MINUTES" 2>/dev/null |
+        while IFS= read -r output_file; do
+            [ -f "$output_file" ] || continue
+            state_file="${output_file%.out}.json"
+            if [ -f "$state_file" ]; then
+                updates_refresh_running_job_state "$state_file"
+                if updates_job_state_is_running "$state_file"; then
+                    continue
+                fi
+            fi
+            rm -f "$output_file" 2>/dev/null || true
+        done
+
+    # Remove old finished state files (running ones are kept).
+    find "$UPDATES_JOB_DIR" -type f -name '*.json' -mmin "+$UPDATES_JOB_FINISHED_TTL_MINUTES" 2>/dev/null |
+        while IFS= read -r state_file; do
+            [ -f "$state_file" ] || continue
+            updates_refresh_running_job_state "$state_file"
+            updates_job_state_is_running "$state_file" && continue
+            rm -f "$state_file" 2>/dev/null || true
+        done
+}
+
+# Extracts the LAST well-formed JSON object from the worker's captured stdout
+# into $dest. The worker echoes one JSON object, but updates_log/echolog may
+# also have written plain log lines to the same stream, so:
+#   1. if the WHOLE file is valid JSON, use it;
+#   2. else fall back to the last line that, after stripping any leading
+#      non-`{` prefix, parses as a JSON object.
+# busybox-safe sed, jq for validation — NO Oniguruma.
+updates_extract_worker_json() {
+    local output_file="$1"
+    local dest="$2"
+
+    [ -s "$output_file" ] || return 1
+
+    if jq -e . "$output_file" >/dev/null 2>&1; then
+        cp "$output_file" "$dest" 2>/dev/null || return 1
+        return 0
+    fi
+
+    sed -n 's/^[^{]*\({.*\)$/\1/p' "$output_file" 2>/dev/null | tail -n 1 >"$dest"
+    if [ -s "$dest" ] && jq -e . "$dest" >/dev/null 2>&1; then
+        return 0
+    fi
+
+    rm -f "$dest" 2>/dev/null
+    return 1
+}
+
+# Builds the finished state from the worker's captured stdout + its exit code.
+updates_write_finished_job_state() {
+    local state_file="$1"
+    local component="$2"
+    local action="$3"
+    local exit_code="$4"
+    local output_file="$5"
+    local tmp_file json_file updated_at raw_output rc
+
+    updated_at="$(updates_now_seconds)"
+    tmp_file="${state_file}.tmp.$$"
+    json_file="${output_file}.json"
+
+    case "$exit_code" in
+    "" | *[!0-9]*) exit_code=1 ;;
+    esac
+
+    if updates_extract_worker_json "$output_file" "$json_file"; then
+        # Worker JSON shape: {success, message?, version?, current_version?,
+        # latest_version?, status?}. Surface what is present; fall back
+        # sensibly. success also derives from a zero exit code if the worker
+        # JSON omitted it.
+        jq -nc \
+            --slurpfile worker "$json_file" \
+            --arg component "$component" \
+            --arg action "$action" \
+            --argjson exit_code "$exit_code" \
+            --argjson updated_at "$updated_at" \
+            '($worker[0]) as $w
+             | {success: ($w.success // ($exit_code == 0)),
+                running: false,
+                component: $component,
+                action: $action,
+                message: ($w.message // ""),
+                pid: null,
+                started_at: 0,
+                updated_at: $updated_at,
+                exit_code: $exit_code,
+                version: ($w.version // $w.current_version // ""),
+                latest_version: ($w.latest_version // "")}' \
+            >"$tmp_file" && mv "$tmp_file" "$state_file"
+        rc=$?
+        rm -f "$tmp_file" "$json_file" "$output_file" 2>/dev/null
+        return $rc
+    fi
+    rm -f "$json_file" 2>/dev/null
+
+    # No parseable worker JSON: record a generic failure, surfacing a trimmed
+    # snippet of whatever the worker printed.
+    raw_output="$(tr '\n' ' ' <"$output_file" 2>/dev/null | cut -c1-240)"
+    [ -n "$raw_output" ] || raw_output="Component action failed"
+
+    jq -nc \
+        --arg component "$component" \
+        --arg action "$action" \
+        --arg message "$raw_output" \
+        --argjson exit_code "$exit_code" \
+        --argjson updated_at "$updated_at" \
+        '{success: false, running: false, component: $component,
+          action: $action, message: $message, pid: null, started_at: 0,
+          updated_at: $updated_at, exit_code: $exit_code, version: "",
+          latest_version: ""}' \
+        >"$tmp_file" && mv "$tmp_file" "$state_file"
+    rc=$?
+
+    rm -f "$tmp_file" "$output_file" 2>/dev/null
+    return $rc
+}
+
+# Starts `component_action` in a detached, HUP-proof background process and
+# returns a job_id immediately. Never `exit 1`s on a worker failure — the
+# worker's outcome is captured into the finished state for polling.
+component_action_async() {
+    local component="$1"
+    local action="$2"
+    local job_id state_file output_file job_pid
+
+    if ! mkdir -p "$UPDATES_JOB_DIR"; then
+        updates_job_json_response false "" "Failed to create component action state directory"
+        return 1
+    fi
+
+    updates_cleanup_component_jobs
+
+    job_id="$(updates_now_seconds)-$$"
+    state_file="$(updates_job_state_path "$job_id")" || {
+        updates_job_json_response false "" "Failed to prepare component action job"
+        return 1
+    }
+    output_file="$UPDATES_JOB_DIR/$job_id.out"
+
+    if ! updates_write_running_job_state "$state_file" "$component" "$action"; then
+        updates_job_json_response false "" "Failed to write component action state"
+        return 1
+    fi
+
+    # Detached + HUP-proof: trap '' HUP so the rpcd session close (SIGHUP on the
+    # process group) does not kill the worker. The worker's single JSON object
+    # is captured to $output_file; on completion we transcribe it (+ exit code)
+    # into the finished state.
+    (
+        trap '' HUP
+        "$0" component_action "$component" "$action" >"$output_file" 2>&1
+        updates_write_finished_job_state "$state_file" "$component" "$action" "$?" "$output_file"
+    ) >/dev/null 2>&1 &
+    job_pid="$!"
+
+    if ! updates_update_running_job_pid "$state_file" "$job_pid"; then
+        kill "$job_pid" 2>/dev/null || true
+        updates_job_json_response false "" "Failed to record component action worker pid"
+        return 1
+    fi
+
+    updates_job_json_response true "$job_id" "Component action started"
+    return 0
+}
+
+# Reports the status of an async component-action job by job_id.
+component_action_status() {
+    local job_id="$1"
+    local state_file
+
+    mkdir -p "$UPDATES_JOB_DIR" 2>/dev/null || true
+    updates_cleanup_component_jobs
+
+    state_file="$(updates_job_state_path "$job_id")" || {
+        updates_job_status_response false false "Invalid component action job id"
+        return 1
+    }
+
+    if [ ! -f "$state_file" ]; then
+        updates_job_status_response false false "Component action job was not found"
+        return 1
+    fi
+
+    updates_refresh_running_job_state "$state_file"
+    cat "$state_file"
+    return 0
+}
+
+# Returns 0 if the system uses musl libc.
+updates_system_uses_musl() {
+    ls /lib/ld-musl-*.so* >/dev/null 2>&1 && return 0
+
+    ldd --version 2>&1 | grep -qi 'musl'
+}
+
+# Reads a value from /etc/openwrt_release (e.g. DISTRIB_ARCH).
+updates_read_openwrt_release_value() {
+    local key="$1"
+
+    [ -f /etc/openwrt_release ] || return 0
+    sed -n "s/^${key}='\(.*\)'/\1/p" /etc/openwrt_release 2>/dev/null | head -n 1
+}
+
+# Resolves the sing-box-extended release asset arch suffix into SB_EXT_ARCH_SUFFIX.
+# Returns 1 if the architecture is unsupported.
+updates_resolve_sing_box_extended_arch_suffix() {
+    local host_arch distrib_arch
+
+    host_arch="$(uname -m 2>/dev/null || true)"
+    distrib_arch="$(updates_read_openwrt_release_value "DISTRIB_ARCH")"
+
+    case "$distrib_arch" in
+    *mipsel* | *mipsle*) host_arch="mipsel" ;;
+    *mips64el* | *mips64le*) host_arch="mips64el" ;;
+    esac
+
+    case "$host_arch" in
+    aarch64) SB_EXT_ARCH_SUFFIX="arm64" ;;
+    armv7*) SB_EXT_ARCH_SUFFIX="armv7" ;;
+    armv6*) SB_EXT_ARCH_SUFFIX="armv6" ;;
+    x86_64) SB_EXT_ARCH_SUFFIX="amd64" ;;
+    i386 | i686) SB_EXT_ARCH_SUFFIX="386" ;;
+    mips) SB_EXT_ARCH_SUFFIX="mips-softfloat" ;;
+    mipsel | mipsle) SB_EXT_ARCH_SUFFIX="mipsle-softfloat" ;;
+    mips64) SB_EXT_ARCH_SUFFIX="mips64" ;;
+    mips64el | mips64le) SB_EXT_ARCH_SUFFIX="mips64le" ;;
+    riscv64) SB_EXT_ARCH_SUFFIX="riscv64" ;;
+    s390x) SB_EXT_ARCH_SUFFIX="s390x" ;;
+    *) return 1 ;;
+    esac
+}
+
+# Performs a single HTTP GET, optionally through an http proxy. Sends a
+# User-Agent (the GitHub API rejects requests without one) and uses curl's
+# -f/--fail so HTTP errors (403 rate-limit, 404, ...) become a non-zero exit
+# with NO body, instead of returning the error JSON as if it succeeded.
+# Echoes the body to stdout; returns non-zero on any HTTP/transport error.
+updates_http_get_once() {
+    local url="$1"
+    local proxy="${2:-}"
+    local ua="netshift-updater"
+
+    if command -v curl >/dev/null 2>&1; then
+        if [ -n "$proxy" ]; then
+            curl --connect-timeout 5 -m 15 -fsSL -A "$ua" -x "http://$proxy" "$url" 2>/dev/null
+        else
+            curl --connect-timeout 5 -m 15 -fsSL -A "$ua" "$url" 2>/dev/null
+        fi
+        return $?
+    fi
+
+    if command -v wget >/dev/null 2>&1; then
+        if [ -n "$proxy" ]; then
+            http_proxy="http://$proxy" https_proxy="http://$proxy" \
+                wget -T 15 -q -U "$ua" -O- "$url" 2>/dev/null
+        else
+            wget -T 15 -q -U "$ua" -O- "$url" 2>/dev/null
+        fi
+        return $?
+    fi
+
+    return 1
+}
+
+# Fetches the sing-box-extended GitHub releases JSON (echoes to stdout).
+# Tries a direct request first, then falls back through the VPN service proxy
+# (the router's own IP is often rate-limited or geo-blocked by GitHub). The
+# response is validated to be a JSON ARRAY: GitHub returns an OBJECT like
+# {"message":"API rate limit exceeded ..."} on 403/429, which must NOT be
+# mistaken for a releases list.
+updates_fetch_sing_box_extended_releases() {
+    local url response proxy
+    url="https://api.github.com/repos/${UPDATES_SING_BOX_EXTENDED_REPO}/releases?per_page=30"
+
+    response="$(updates_http_get_once "$url" "")"
+    if updates_response_is_release_array "$response"; then
+        printf '%s' "$response"
+        return 0
+    fi
+
+    proxy="$(get_service_proxy_address 2>/dev/null || true)"
+    if [ -n "$proxy" ]; then
+        updates_log "Direct GitHub API request failed; retrying via service proxy $proxy" "warn"
+        response="$(updates_http_get_once "$url" "$proxy")"
+        if updates_response_is_release_array "$response"; then
+            printf '%s' "$response"
+            return 0
+        fi
+    fi
+
+    return 1
+}
+
+# Returns 0 only if the given body parses as a non-empty JSON array (a releases
+# list). Rejects empty bodies and GitHub error objects.
+updates_response_is_release_array() {
+    local body="$1"
+
+    [ -n "$body" ] || return 1
+    printf '%s' "$body" | jq -e 'type == "array" and length > 0' >/dev/null 2>&1
+}
+
+# Picks the newest non-draft, non-prerelease, stable tag. Pre-release tags carry
+# a "-alpha"/"-beta"/"-rc" marker (e.g. v1.13.2-extended-2.0.0-rc.8).
+#
+# IMPORTANT: OpenWrt's jq is built WITHOUT the Oniguruma regex library, so
+# test()/match()/sub() are unavailable and error out (which, swallowed by
+# 2>/dev/null, silently emptied the whole pipeline). We therefore use plain
+# string containment (ascii_downcase + contains) instead of a regex.
+updates_extended_release_tag() {
+    local json="$1"
+
+    printf '%s' "$json" | jq -r '
+        map(select((.draft != true) and (.prerelease != true)))
+        | map(.tag_name)
+        | map(select(. != null and . != ""))
+        | map(select(
+            (ascii_downcase) as $t
+            | ($t | contains("-alpha") or contains("-beta") or contains("-rc")) | not
+          ))
+        | .[0] // empty
+    ' 2>/dev/null
+}
+
+# Extracts the release object matching the given tag.
+updates_extended_release_object() {
+    local json="$1"
+    local tag="$2"
+
+    printf '%s' "$json" | jq -c --arg t "$tag" '
+        map(select((.draft != true) and (.prerelease != true) and (.tag_name == $t)))
+        | .[0] // empty
+    ' 2>/dev/null
+}
+
+# Resolves the download URL for the matching asset of a release object.
+updates_extended_asset_url() {
+    local rel="$1"
+    local suffix url
+
+    if updates_system_uses_musl; then
+        suffix="linux-${SB_EXT_ARCH_SUFFIX}-musl.tar.gz"
+        url="$(printf '%s' "$rel" | jq -r --arg s "$suffix" '
+            .assets // []
+            | map(select(.name != null and (.name | endswith($s))))
+            | .[0].browser_download_url // empty
+        ' 2>/dev/null)"
+        if [ -n "$url" ]; then
+            printf '%s' "$url"
+            return 0
+        fi
+    fi
+
+    suffix="linux-${SB_EXT_ARCH_SUFFIX}.tar.gz"
+    url="$(printf '%s' "$rel" | jq -r --arg s "$suffix" '
+        .assets // []
+        | map(select(.name != null and (.name | endswith($s))))
+        | .[0].browser_download_url // empty
+    ' 2>/dev/null)"
+    if [ -n "$url" ]; then
+        printf '%s' "$url"
+        return 0
+    fi
+
+    return 1
+}
+
+# Downloads a URL to a file path (curl, fall back to wget). Returns 0 on success.
+updates_download_to_file() {
+    local url="$1"
+    local dest="$2"
+
+    if command -v curl >/dev/null 2>&1; then
+        curl -m 120 -fsSL "$url" -o "$dest" && [ -s "$dest" ] && return 0
+    fi
+    if command -v wget >/dev/null 2>&1; then
+        wget -q -O "$dest" "$url" && [ -s "$dest" ] && return 0
+    fi
+
+    return 1
+}
+
+# Restarts netshift if its init script is present (best-effort).
+updates_restart_netshift() {
+    if [ -x /etc/init.d/netshift ]; then
+        updates_log "Restarting netshift after component change"
+        /etc/init.d/netshift restart >/dev/null 2>&1 || true
+    fi
+}
+
+# ── Core-switch connectivity self-heal + restore (task-009) ─────────
+#
+# Switching the core needs working internet (package feeds for the stable
+# install, the GitHub API for the extended install). On the operator's router
+# the only egress was THROUGH the now-dead VPN, so the swap deadlocked behind
+# NetShift's own kill-switch (nft tproxy + dnsmasq -> dead sing-box) and bricked
+# the box: the stock binary was removed with no way to fetch a replacement.
+#
+# The fix encodes the manual rescue as self-healing with active connectivity
+# repair: pre-flight a connectivity probe; if it fails, heal (a working
+# temporary resolver, then tear down the redirect via the EXISTING
+# `/etc/init.d/netshift stop`) and re-check; only swap once a feed is reachable;
+# ALWAYS restore the original resolv.conf and the redirect afterwards.
+#
+# What the heal changed is recorded in two module-level flags so the restore
+# epilogue touches back EXACTLY what was changed (and nothing leaks):
+#   UPDATES_HEAL_RESOLV_REPLACED=1  -> /etc/resolv.conf was overwritten
+#   UPDATES_HEAL_REDIRECT_DOWN=1    -> the NetShift redirect was torn down
+UPDATES_HEAL_RESOLV_REPLACED=0
+UPDATES_HEAL_REDIRECT_DOWN=0
+
+# Resolves the probe host for a swap direction.
+#   stable   -> OpenWrt package feeds host
+#   extended -> GitHub API host
+updates_preflight_host_for_direction() {
+    local direction="$1"
+
+    case "$direction" in
+    stable) printf '%s\n' "$UPDATES_FEED_PROBE_HOST" ;;
+    extended) printf '%s\n' "$UPDATES_GITHUB_PROBE_HOST" ;;
+    *) return 1 ;;
+    esac
+}
+
+# Returns 0 if a DNS lookup of $host resolves, using bind-dig (a dependency)
+# with an nslookup fallback. Small timeouts; logs the outcome.
+updates_dns_resolves() {
+    local host="$1"
+
+    if command -v dig >/dev/null 2>&1; then
+        if dig +time=3 +tries=1 +short "$host" 2>/dev/null | grep -q '[0-9a-fA-F]'; then
+            return 0
+        fi
+        return 1
+    fi
+
+    if command -v nslookup >/dev/null 2>&1; then
+        # busybox nslookup: any "Address" line beyond the server line means a
+        # successful resolution. Avoid jq/regex; plain grep is fine here.
+        if nslookup "$host" 2>/dev/null | grep -q 'Address'; then
+            return 0
+        fi
+        return 1
+    fi
+
+    return 1
+}
+
+# Returns 0 if an HTTPS reachability check to $host succeeds within a short
+# connect timeout (curl HEAD --fail, wget --spider fallback).
+updates_host_reachable() {
+    local host="$1"
+    local url="https://$host"
+
+    if command -v curl >/dev/null 2>&1; then
+        curl --connect-timeout 5 -m 8 -fsSI -A "netshift-updater" "$url" >/dev/null 2>&1 && return 0
+        return 1
+    fi
+
+    if command -v wget >/dev/null 2>&1; then
+        wget -T 8 -q --spider "$url" >/dev/null 2>&1 && return 0
+        return 1
+    fi
+
+    return 1
+}
+
+# Direction-aware connectivity pre-flight. Returns 0 if the host needed for the
+# CURRENT swap direction is both resolvable AND reachable, non-zero otherwise.
+# Logs each probe so the outcome is visible via the job message / syslog.
+updates_preflight_connectivity() {
+    local direction="$1"
+    local host
+
+    host="$(updates_preflight_host_for_direction "$direction")" || {
+        updates_log "Connectivity pre-flight: unknown direction '$direction'" "error"
+        return 1
+    }
+
+    if ! updates_dns_resolves "$host"; then
+        updates_log "Connectivity pre-flight: DNS resolve of $host FAILED" "warn"
+        return 1
+    fi
+    updates_log "Connectivity pre-flight: DNS resolve of $host ok"
+
+    if ! updates_host_reachable "$host"; then
+        updates_log "Connectivity pre-flight: HTTPS reachability of $host FAILED" "warn"
+        return 1
+    fi
+    updates_log "Connectivity pre-flight: HTTPS reachability of $host ok"
+
+    return 0
+}
+
+# Writes a temporary working resolver to /etc/resolv.conf, backing up the
+# original to tmpfs first. Records UPDATES_HEAL_RESOLV_REPLACED so the epilogue
+# restores it. Atomic write (*.tmp.$$ + mv).
+updates_write_temp_resolver() {
+    local resolver tmp_file
+
+    # Back up the original exactly once.
+    if [ "$UPDATES_HEAL_RESOLV_REPLACED" -eq 0 ]; then
+        if [ -e "$RESOLV_CONF" ]; then
+            cp -p "$RESOLV_CONF" "$UPDATES_RESOLV_BACKUP" 2>/dev/null || true
+        else
+            # No original to restore; mark the backup absent so the epilogue
+            # removes the temp file rather than restoring a phantom.
+            rm -f "$UPDATES_RESOLV_BACKUP" 2>/dev/null || true
+        fi
+    fi
+
+    tmp_file="${RESOLV_CONF}.netshift.tmp.$$"
+    : >"$tmp_file" 2>/dev/null || return 1
+    for resolver in $UPDATES_HEAL_RESOLVERS; do
+        printf 'nameserver %s\n' "$resolver" >>"$tmp_file" 2>/dev/null || {
+            rm -f "$tmp_file" 2>/dev/null
+            return 1
+        }
+    done
+
+    if mv -f "$tmp_file" "$RESOLV_CONF" 2>/dev/null; then
+        UPDATES_HEAL_RESOLV_REPLACED=1
+        updates_log "Self-heal: wrote temporary resolver ($UPDATES_HEAL_RESOLVERS) to $RESOLV_CONF"
+        return 0
+    fi
+
+    rm -f "$tmp_file" 2>/dev/null
+    return 1
+}
+
+# Tears down the NetShift redirect (kill-switch) by invoking the EXISTING
+# `/etc/init.d/netshift stop` — this runs dnsmasq_restore + stop_main (nft
+# table delete + ip rule/route flush + sing-box stop) and flips
+# shutdown_correctly so the dnsmasq UCI bookkeeping stays consistent. Records
+# UPDATES_HEAL_REDIRECT_DOWN so the epilogue brings it back.
+updates_teardown_redirect() {
+    if [ ! -x /etc/init.d/netshift ]; then
+        updates_log "Self-heal: /etc/init.d/netshift not present; cannot tear down redirect" "warn"
+        return 1
+    fi
+
+    updates_log "Self-heal: tearing down the NetShift redirect via /etc/init.d/netshift stop"
+    /etc/init.d/netshift stop >/dev/null 2>&1 || true
+    UPDATES_HEAL_REDIRECT_DOWN=1
+    return 0
+}
+
+# Variant B self-heal — only invoked when pre-flight fails. Reversible steps,
+# each logged and each recorded in UPDATES_HEAL_* so the epilogue restores
+# precisely what was touched:
+#   1. temp resolver -> re-check
+#   2. still failing -> tear down the redirect -> re-check
+# Returns 0 when connectivity is restored, non-zero when healing failed.
+updates_selfheal_connectivity() {
+    local direction="$1"
+
+    updates_log "Connectivity pre-flight failed; attempting self-heal (variant B)" "warn"
+
+    # Step 1: temporary resolver, then re-check.
+    if updates_write_temp_resolver; then
+        if updates_preflight_connectivity "$direction"; then
+            updates_log "Self-heal: connectivity restored by temporary resolver (dns_healed)"
+            return 0
+        fi
+    else
+        updates_log "Self-heal: failed to write temporary resolver" "warn"
+    fi
+
+    # Step 2: tear down the redirect (kill-switch), then re-check.
+    if updates_teardown_redirect; then
+        if updates_preflight_connectivity "$direction"; then
+            updates_log "Self-heal: connectivity restored after redirect teardown (redirect_down)"
+            return 0
+        fi
+    fi
+
+    updates_log "Self-heal: connectivity could NOT be restored" "error"
+    return 1
+}
+
+# Restore epilogue — MUST run on EVERY exit path of an install (success, install
+# failure, heal failure). Restores exactly what the heal changed:
+#   * resolv.conf replaced -> restore the backed-up original (or drop the temp
+#     file if there was no original);
+#   * redirect torn down   -> bring NetShift back up via `/etc/init.d/netshift
+#     start` so nft/dnsmasq/routing + shutdown_correctly are reinstated.
+# Idempotent: clears the flags so a second call is a no-op.
+updates_restore_after_swap() {
+    if [ "$UPDATES_HEAL_RESOLV_REPLACED" -eq 1 ]; then
+        if [ -e "$UPDATES_RESOLV_BACKUP" ]; then
+            if mv -f "$UPDATES_RESOLV_BACKUP" "$RESOLV_CONF" 2>/dev/null; then
+                updates_log "Restore: original $RESOLV_CONF reinstated"
+            else
+                updates_log "Restore: failed to reinstate original $RESOLV_CONF" "warn"
+            fi
+        else
+            # No original existed: remove our temporary resolver.
+            rm -f "$RESOLV_CONF" 2>/dev/null || true
+            updates_log "Restore: removed temporary $RESOLV_CONF (no original to restore)"
+        fi
+        UPDATES_HEAL_RESOLV_REPLACED=0
+    fi
+
+    if [ "$UPDATES_HEAL_REDIRECT_DOWN" -eq 1 ]; then
+        if [ -x /etc/init.d/netshift ]; then
+            updates_log "Restore: bringing the NetShift redirect back up via /etc/init.d/netshift start"
+            /etc/init.d/netshift start >/dev/null 2>&1 || true
+        fi
+        UPDATES_HEAL_REDIRECT_DOWN=0
+    fi
+}
+
+# Runs pre-flight for a direction and, on failure, the self-heal. Returns 0 when
+# connectivity is confirmed (possibly after healing), non-zero when it could not
+# be established. Callers MUST run updates_restore_after_swap on every exit path
+# regardless of this function's result.
+updates_ensure_connectivity() {
+    local direction="$1"
+
+    if updates_preflight_connectivity "$direction"; then
+        return 0
+    fi
+
+    updates_selfheal_connectivity "$direction"
+}
+
+# Public entry: install sing-box-extended with the connectivity self-heal
+# preamble + the always-run restore epilogue around the real worker.
+#
+# The epilogue is guaranteed via a SINGLE cleanup path: the core worker echoes
+# its JSON to a capture file and returns an rc; we then ALWAYS call
+# updates_restore_after_swap once, re-emit the captured JSON, and return the rc.
+# No early `return` skips the restore.
+updates_install_sing_box_extended() {
+    local rc out json
+
+    UPDATES_HEAL_RESOLV_REPLACED=0
+    UPDATES_HEAL_REDIRECT_DOWN=0
+
+    if ! updates_ensure_connectivity "extended"; then
+        # Heal failed: nothing was removed (extended only touches the binary
+        # AFTER a reachable feed), so the router keeps its working core.
+        updates_restore_after_swap
+        updates_log "Aborting extended install: GitHub unreachable and self-heal failed (existing core left intact)" "error"
+        echo "{\"success\":false,\"message\":\"GitHub API unreachable and connectivity self-heal failed; core switch aborted (existing sing-box left intact)\"}"
+        return 1
+    fi
+
+    out="/tmp/netshift-sbext-result.$$"
+    _updates_install_sing_box_extended_core >"$out" 2>/dev/null
+    rc=$?
+    json="$(cat "$out" 2>/dev/null)"
+    rm -f "$out" 2>/dev/null
+
+    updates_restore_after_swap
+
+    [ -n "$json" ] && printf '%s\n' "$json"
+    return "$rc"
+}
+
+# Downloads and installs sing-box-extended, replacing /usr/bin/sing-box.
+# Echoes a JSON result on stdout.
+#
+# Disk-space strategy (validated on real hardware, mirrors podkop-plus):
+#   * /tmp is tmpfs (RAM) and usually the ROOMIEST writable fs (~100 MB), while
+#     the persistent overlay that holds /usr/bin is TINY (e.g. 16 MB free).
+#     The extracted binary (~50 MB) does NOT fit on overlay alongside the
+#     existing ~40 MB stock binary, so we must never keep both at once.
+#   * Therefore: keep the archive AND the backup on tmpfs (/tmp); remove the
+#     live binary FIRST to reclaim overlay space; then stream-extract the new
+#     member directly onto the final path so only ONE binary ever occupies
+#     overlay. On any failure the tmpfs backup is moved back into place.
+_updates_install_sing_box_extended_core() {
+    local tmp_dir archive releases tag rel asset_url
+    local binary_path cronet_path
+    local backup_binary="" backup_cronet="" new_version
+    local backup_binary_size="" backup_cronet_size=""
+
+    # Interruption-tolerant heal: a run killed mid-flight (e.g. the old rpcd 30s
+    # timeout) could leave a non-executable /usr/bin/sing-box behind. Such a
+    # partial artifact must NOT be trusted (e.g. backed up as if it were a real
+    # binary) — the install below replaces it anyway, but we drop it up front so
+    # the tmpfs backup never preserves a broken binary and the version probe
+    # never reads garbage from it.
+    if [ -e /usr/bin/sing-box ] && {
+        [ ! -x /usr/bin/sing-box ] ||
+            ! LD_LIBRARY_PATH=/usr/lib /usr/bin/sing-box version >/dev/null 2>&1
+    }; then
+        updates_log "Found a non-runnable /usr/bin/sing-box (likely a partial install); discarding it before reinstall" "warn"
+        rm -f /usr/bin/sing-box
+    fi
+
+    if ! updates_resolve_sing_box_extended_arch_suffix; then
+        updates_log "Unsupported architecture for sing-box-extended" "error"
+        echo "{\"success\":false,\"message\":\"Unsupported architecture for sing-box-extended\"}"
+        return 1
+    fi
+
+    releases="$(updates_fetch_sing_box_extended_releases)"
+    if [ -z "$releases" ]; then
+        updates_log "Failed to fetch sing-box-extended releases (GitHub API unreachable or rate-limited; a proxy/VPN may be required)" "error"
+        echo "{\"success\":false,\"message\":\"Failed to fetch sing-box-extended releases (GitHub API unreachable or rate-limited; try again later or enable a proxy)\"}"
+        return 1
+    fi
+
+    tag="$(updates_extended_release_tag "$releases")"
+    if [ -z "$tag" ]; then
+        updates_log "No stable sing-box-extended release tag found in the GitHub response" "error"
+        echo "{\"success\":false,\"message\":\"No stable sing-box-extended release found\"}"
+        return 1
+    fi
+
+    rel="$(updates_extended_release_object "$releases" "$tag")"
+    asset_url="$(updates_extended_asset_url "$rel")"
+    if [ -z "$asset_url" ]; then
+        updates_log "Failed to resolve sing-box-extended asset for arch $SB_EXT_ARCH_SUFFIX" "error"
+        echo "{\"success\":false,\"message\":\"Failed to resolve sing-box-extended asset\"}"
+        return 1
+    fi
+
+    # Remove any stale temp dirs left behind by an interrupted earlier run.
+    # tmpfs is small; a leftover ~40 MB backup would otherwise make the fresh
+    # backup `cp` below fail with ENOSPC ("Failed to backup current sing-box
+    # binary") even though the install itself is fine.
+    rm -rf /tmp/netshift-sbext.* 2>/dev/null
+
+    tmp_dir="$(mktemp -d /tmp/netshift-sbext.XXXXXX 2>/dev/null)"
+    if [ -z "$tmp_dir" ]; then
+        updates_log "Failed to create temporary directory" "error"
+        echo "{\"success\":false,\"message\":\"Failed to create temporary directory\"}"
+        return 1
+    fi
+
+    archive="$tmp_dir/sing-box-extended.tar.gz"
+    updates_log "Downloading sing-box-extended $tag ($SB_EXT_ARCH_SUFFIX)"
+    if ! updates_download_to_file "$asset_url" "$archive"; then
+        rm -rf "$tmp_dir"
+        updates_log "Failed to download sing-box-extended" "error"
+        echo "{\"success\":false,\"message\":\"Failed to download sing-box-extended\"}"
+        return 1
+    fi
+
+    binary_path="$(tar -tzf "$archive" 2>/dev/null | grep -E '(^|/)sing-box$' | sed -n '1p')"
+    if [ -z "$binary_path" ]; then
+        rm -rf "$tmp_dir"
+        updates_log "sing-box binary not found in archive" "error"
+        echo "{\"success\":false,\"message\":\"sing-box binary not found in archive\"}"
+        return 1
+    fi
+    cronet_path="$(tar -tzf "$archive" 2>/dev/null | grep -E '(^|/)libcronet\.so$' | sed -n '1p')"
+
+    # Back up the current binary/lib ON TMPFS (/tmp), not overlay — overlay has
+    # no room for a second copy of the binary.
+    if [ -e /usr/bin/sing-box ]; then
+        backup_binary="$tmp_dir/sing-box.backup"
+        # Gate on a byte-complete backup, not just cp's exit code: a partial
+        # write under tmpfs ENOSPC could otherwise pass and later be restored as
+        # a truncated, segfaulting "safe" fallback. Abort here — the live binary
+        # has NOT been touched yet, so the working core is left intact.
+        if ! cp -p /usr/bin/sing-box "$backup_binary" 2>/dev/null ||
+            ! updates_verify_copy /usr/bin/sing-box "$backup_binary"; then
+            rm -rf "$tmp_dir"
+            updates_log "Failed to backup current sing-box binary" "error"
+            echo "{\"success\":false,\"message\":\"Failed to backup current sing-box binary\"}"
+            return 1
+        fi
+        backup_binary_size="$(wc -c < "$backup_binary" 2>/dev/null)"
+    fi
+    if [ -n "$cronet_path" ] && [ -e /usr/lib/libcronet.so ]; then
+        backup_cronet="$tmp_dir/libcronet.so.backup"
+        if ! cp -p /usr/lib/libcronet.so "$backup_cronet" 2>/dev/null ||
+            ! updates_verify_copy /usr/lib/libcronet.so "$backup_cronet"; then
+            rm -rf "$tmp_dir"
+            updates_log "Failed to backup current libcronet.so" "error"
+            echo "{\"success\":false,\"message\":\"Failed to backup current libcronet.so\"}"
+            return 1
+        fi
+        backup_cronet_size="$(wc -c < "$backup_cronet" 2>/dev/null)"
+    fi
+
+    # Free overlay space by removing the live binary BEFORE extracting, then
+    # stream the new member straight onto the final path (never two binaries
+    # on overlay at once). Restore from the tmpfs backup on any failure.
+    rm -f /usr/bin/sing-box
+    if ! tar -xzf "$archive" -O "$binary_path" > /usr/bin/sing-box 2>/dev/null || [ ! -s /usr/bin/sing-box ]; then
+        rm -f /usr/bin/sing-box
+        # Only restore from a backup that is still byte-complete — restoring a
+        # truncated backup would install a segfaulting core as the "safe"
+        # fallback (worse than leaving the path absent).
+        if [ -n "$backup_binary" ]; then
+            if updates_backup_is_complete "$backup_binary" "$backup_binary_size"; then
+                mv -f "$backup_binary" /usr/bin/sing-box
+            else
+                updates_log "Rollback: sing-box backup is corrupt/incomplete; NOT restoring to avoid installing a broken core" "error"
+            fi
+        fi
+        rm -rf "$tmp_dir"
+        updates_log "Failed to extract sing-box-extended binary (out of space on overlay?)" "error"
+        echo "{\"success\":false,\"message\":\"Failed to extract sing-box-extended binary (not enough free space on the router?)\"}"
+        return 1
+    fi
+    chmod 0755 /usr/bin/sing-box
+
+    if [ -n "$cronet_path" ]; then
+        rm -f /usr/lib/libcronet.so
+        if ! tar -xzf "$archive" -O "$cronet_path" > /usr/lib/libcronet.so 2>/dev/null || [ ! -s /usr/lib/libcronet.so ]; then
+            rm -f /usr/bin/sing-box /usr/lib/libcronet.so
+            if [ -n "$backup_binary" ]; then
+                if updates_backup_is_complete "$backup_binary" "$backup_binary_size"; then
+                    mv -f "$backup_binary" /usr/bin/sing-box
+                else
+                    updates_log "Rollback: sing-box backup is corrupt/incomplete; NOT restoring to avoid installing a broken core" "error"
+                fi
+            fi
+            if [ -n "$backup_cronet" ]; then
+                if updates_backup_is_complete "$backup_cronet" "$backup_cronet_size"; then
+                    mv -f "$backup_cronet" /usr/lib/libcronet.so
+                else
+                    updates_log "Rollback: libcronet.so backup is corrupt/incomplete; NOT restoring" "error"
+                fi
+            fi
+            rm -rf "$tmp_dir"
+            updates_log "Failed to extract libcronet.so" "error"
+            echo "{\"success\":false,\"message\":\"Failed to extract libcronet.so\"}"
+            return 1
+        fi
+        chmod 0644 /usr/lib/libcronet.so
+    fi
+
+    # Archive no longer needed; reclaim tmpfs before validation.
+    rm -f "$archive"
+
+    new_version="$(LD_LIBRARY_PATH=/usr/lib /usr/bin/sing-box version 2>/dev/null | head -1 | awk '{print $NF}')"
+    case "$new_version" in
+    *extended*) ;;
+    *)
+        rm -f /usr/bin/sing-box
+        if [ -n "$backup_binary" ]; then
+            if updates_backup_is_complete "$backup_binary" "$backup_binary_size"; then
+                mv -f "$backup_binary" /usr/bin/sing-box
+            else
+                updates_log "Rollback: sing-box backup is corrupt/incomplete; NOT restoring to avoid installing a broken core" "error"
+            fi
+        fi
+        [ -n "$cronet_path" ] && rm -f /usr/lib/libcronet.so
+        if [ -n "$backup_cronet" ]; then
+            if updates_backup_is_complete "$backup_cronet" "$backup_cronet_size"; then
+                mv -f "$backup_cronet" /usr/lib/libcronet.so
+            else
+                updates_log "Rollback: libcronet.so backup is corrupt/incomplete; NOT restoring" "error"
+            fi
+        fi
+        rm -rf "$tmp_dir"
+        updates_log "Installed sing-box failed extended validation; previous binary restored" "error"
+        echo "{\"success\":false,\"message\":\"Installed sing-box failed extended validation; previous binary restored\"}"
+        return 1
+        ;;
+    esac
+
+    rm -rf "$tmp_dir"
+    updates_restart_netshift
+    updates_log "Installed sing-box-extended $new_version"
+    echo "{\"success\":true,\"version\":\"$new_version\"}"
+    return 0
+}
+
+# Public entry: install the stock (stable) sing-box with the connectivity
+# self-heal preamble + the always-run restore epilogue around the real worker.
+#
+# CRITICAL ordering (learned from the on-hardware brick): the stable path
+# removes/replaces the binary via the package manager, which needs working feed
+# connectivity. So we MUST confirm a reachable feed (pre-flight, then self-heal)
+# BEFORE the worker touches the binary. If the heal fails, we abort here —
+# nothing has been removed, so the router keeps its working (extended) core.
+#
+# The epilogue is guaranteed via a SINGLE cleanup path: the core worker echoes
+# its JSON to a capture file and returns an rc; we then ALWAYS call
+# updates_restore_after_swap once, re-emit the captured JSON, and return the rc.
+updates_install_sing_box_stable() {
+    local rc out json
+
+    UPDATES_HEAL_RESOLV_REPLACED=0
+    UPDATES_HEAL_REDIRECT_DOWN=0
+
+    if ! updates_ensure_connectivity "stable"; then
+        # Heal failed BEFORE the binary was touched: do NOT proceed to the
+        # package install. The router keeps its current working core.
+        updates_restore_after_swap
+        updates_log "Aborting stable install: package feeds unreachable and self-heal failed (binary NOT removed; existing core left intact)" "error"
+        echo "{\"success\":false,\"message\":\"Package feeds unreachable and connectivity self-heal failed; core switch aborted (existing sing-box left intact)\"}"
+        return 1
+    fi
+
+    out="/tmp/netshift-sbstable-result.$$"
+    _updates_install_sing_box_stable_core >"$out" 2>/dev/null
+    rc=$?
+    json="$(cat "$out" 2>/dev/null)"
+    rm -f "$out" 2>/dev/null
+
+    updates_restore_after_swap
+
+    [ -n "$json" ] && printf '%s\n' "$json"
+    return "$rc"
+}
+
+# Reinstalls the stock (stable) sing-box via the system package manager,
+# reverting an "extended" install. Unlike the extended path this never touches
+# the GitHub API. Echoes a JSON result on stdout.
+#
+# Backup/rollback parity with the extended path (task-009): the current binary
+# (and libcronet.so if present) is backed up to TMPFS before the install. If
+# the package install fails OR the post-install non-extended validation fails,
+# the tmpfs backup is restored so the router keeps a working core (it stays on
+# the extended build rather than ending core-less). The backup is dropped only
+# after a confirmed-good install.
+#
+# The install result is checked (no silent "|| true" that always reports
+# success), and the outcome is validated to be a NON-extended build so a failed
+# downgrade is surfaced honestly instead of masquerading as success.
+_updates_install_sing_box_stable_core() {
+    local new_version installed=1
+    local tmp_dir backup_binary="" backup_cronet=""
+    local backup_binary_size="" backup_cronet_size=""
+
+    # Remove stale temp dirs from an interrupted earlier run (tmpfs is small).
+    rm -rf /tmp/netshift-sbstable.* 2>/dev/null
+
+    tmp_dir="$(mktemp -d /tmp/netshift-sbstable.XXXXXX 2>/dev/null)"
+    if [ -z "$tmp_dir" ]; then
+        updates_log "Failed to create temporary directory" "error"
+        echo "{\"success\":false,\"message\":\"Failed to create temporary directory\"}"
+        return 1
+    fi
+
+    # Back up the current binary/lib ON TMPFS (/tmp) BEFORE the package manager
+    # touches anything, so a failed install can be rolled back to a working core.
+    if [ -e "$UPDATES_SING_BOX_BIN" ]; then
+        backup_binary="$tmp_dir/sing-box.backup"
+        # Gate on a byte-complete backup, not just cp's exit code (busybox cp can
+        # truncate under tmpfs ENOSPC and still return 0). Abort here — the
+        # package manager has not touched the binary yet, so the working core
+        # stays intact.
+        if ! cp -p "$UPDATES_SING_BOX_BIN" "$backup_binary" 2>/dev/null ||
+            ! updates_verify_copy "$UPDATES_SING_BOX_BIN" "$backup_binary"; then
+            rm -rf "$tmp_dir"
+            updates_log "Failed to backup current sing-box binary" "error"
+            echo "{\"success\":false,\"message\":\"Failed to backup current sing-box binary\"}"
+            return 1
+        fi
+        backup_binary_size="$(wc -c < "$backup_binary" 2>/dev/null)"
+    fi
+    if [ -e "$UPDATES_LIBCRONET_LIB" ]; then
+        backup_cronet="$tmp_dir/libcronet.so.backup"
+        if ! cp -p "$UPDATES_LIBCRONET_LIB" "$backup_cronet" 2>/dev/null ||
+            ! updates_verify_copy "$UPDATES_LIBCRONET_LIB" "$backup_cronet"; then
+            rm -rf "$tmp_dir"
+            updates_log "Failed to backup current libcronet.so" "error"
+            echo "{\"success\":false,\"message\":\"Failed to backup current libcronet.so\"}"
+            return 1
+        fi
+        backup_cronet_size="$(wc -c < "$backup_cronet" 2>/dev/null)"
+    fi
+
+    if command -v apk >/dev/null 2>&1; then
+        updates_log "Updating apk package lists"
+        apk update </dev/null >/dev/null 2>&1 || true
+        updates_log "Installing stable sing-box via apk"
+        if ! apk add --allow-downgrade sing-box </dev/null >/dev/null 2>&1; then
+            # apk fix is a best-effort recovery; its result still decides success.
+            apk fix sing-box </dev/null >/dev/null 2>&1 || installed=0
+        fi
+    elif command -v opkg >/dev/null 2>&1; then
+        updates_log "Updating opkg package lists"
+        opkg update </dev/null >/dev/null 2>&1 || true
+        updates_log "Installing stable sing-box via opkg"
+        if ! opkg install --force-reinstall --force-downgrade sing-box </dev/null >/dev/null 2>&1; then
+            opkg install --force-downgrade sing-box </dev/null >/dev/null 2>&1 || installed=0
+        fi
+    else
+        rm -rf "$tmp_dir"
+        updates_log "No supported package manager (apk/opkg) found" "error"
+        echo "{\"success\":false,\"message\":\"No supported package manager found\"}"
+        return 1
+    fi
+
+    if [ "$installed" -eq 0 ]; then
+        # Package install failed (it may have already removed/half-replaced the
+        # binary). Restore the tmpfs backup so a working core remains.
+        updates_stable_rollback "$backup_binary" "$backup_cronet" "$backup_binary_size" "$backup_cronet_size"
+        rm -rf "$tmp_dir"
+        updates_log "Failed to install stable sing-box via package manager; previous binary restored" "error"
+        echo "{\"success\":false,\"message\":\"Failed to install stable sing-box (package manager error); previous binary restored\"}"
+        return 1
+    fi
+
+    updates_restart_netshift
+    new_version="$(get_sing_box_version)"
+
+    # Validate the rollback actually took effect: the running binary must no
+    # longer be an "extended" build. If it still is, the install did not land —
+    # restore the backup so the router keeps a known-good core.
+    if is_sing_box_extended "$new_version"; then
+        updates_stable_rollback "$backup_binary" "$backup_cronet" "$backup_binary_size" "$backup_cronet_size"
+        rm -rf "$tmp_dir"
+        updates_log "Stable install reported success but sing-box is still extended ($new_version); previous binary restored" "error"
+        echo "{\"success\":false,\"message\":\"sing-box is still the extended build after install; rollback did not take effect (previous binary restored)\"}"
+        return 1
+    fi
+
+    # Confirmed-good install. The extended path side-loads /usr/lib/libcronet.so
+    # next to the binary; stock sing-box does not use it, so drop the leftover.
+    if [ -e "$UPDATES_LIBCRONET_LIB" ]; then
+        updates_log "Removing leftover libcronet.so from extended install"
+        rm -f "$UPDATES_LIBCRONET_LIB" 2>/dev/null || true
+    fi
+
+    # Drop the backup only now that the install is confirmed good.
+    rm -rf "$tmp_dir"
+    updates_log "Stable sing-box installed: ${new_version:-unknown}"
+    echo "{\"success\":true,\"version\":\"$new_version\"}"
+    return 0
+}
+
+# Restores the tmpfs backup of /usr/bin/sing-box (and libcronet.so) into place.
+# Used by the stable path when the package install or validation fails so the
+# router never ends core-less. Best-effort; logs the outcome.
+#
+# Args 3/4 are the byte sizes recorded at backup time. The restore is performed
+# ONLY if the backup is still byte-complete (size match) — a truncated backup
+# (tmpfs ENOSPC) is refused rather than restored as a segfaulting core.
+updates_stable_rollback() {
+    local backup_binary="$1"
+    local backup_cronet="$2"
+    local backup_binary_size="$3"
+    local backup_cronet_size="$4"
+
+    if [ -n "$backup_binary" ]; then
+        # Only restore a byte-complete backup: a truncated backup (tmpfs ENOSPC)
+        # would otherwise be installed as a segfaulting "safe" core, which is
+        # worse than not restoring. Surface a loud error and leave the live path.
+        if updates_backup_is_complete "$backup_binary" "$backup_binary_size"; then
+            rm -f "$UPDATES_SING_BOX_BIN" 2>/dev/null
+            if mv -f "$backup_binary" "$UPDATES_SING_BOX_BIN" 2>/dev/null; then
+                chmod 0755 "$UPDATES_SING_BOX_BIN" 2>/dev/null || true
+                updates_log "Rollback: restored previous sing-box binary from tmpfs backup"
+            else
+                updates_log "Rollback: FAILED to restore sing-box binary from backup" "error"
+            fi
+        else
+            updates_log "Rollback: sing-box backup is corrupt/incomplete; NOT restoring to avoid installing a broken core" "error"
+        fi
+    fi
+
+    if [ -n "$backup_cronet" ]; then
+        if updates_backup_is_complete "$backup_cronet" "$backup_cronet_size"; then
+            rm -f "$UPDATES_LIBCRONET_LIB" 2>/dev/null
+            if mv -f "$backup_cronet" "$UPDATES_LIBCRONET_LIB" 2>/dev/null; then
+                chmod 0644 "$UPDATES_LIBCRONET_LIB" 2>/dev/null || true
+                updates_log "Rollback: restored previous libcronet.so from tmpfs backup"
+            fi
+        else
+            updates_log "Rollback: libcronet.so backup is corrupt/incomplete; NOT restoring" "error"
+        fi
+    fi
+}
+
+# Checks whether a newer sing-box-extended release is available.
+# Echoes a JSON status (latest|outdated) on stdout.
+updates_check_sing_box_extended() {
+    local current_version releases tag status cur_norm tag_norm
+
+    current_version="$(get_sing_box_version)"
+
+    releases="$(updates_fetch_sing_box_extended_releases)"
+    if [ -z "$releases" ]; then
+        echo "{\"success\":false,\"message\":\"Failed to fetch sing-box-extended releases (GitHub API unreachable or rate-limited; try again later or enable a proxy)\"}"
+        return 1
+    fi
+
+    tag="$(updates_extended_release_tag "$releases")"
+    if [ -z "$tag" ]; then
+        echo "{\"success\":false,\"message\":\"No stable sing-box-extended release found\"}"
+        return 1
+    fi
+
+    # Normalize a single leading "v" off BOTH sides before comparing/emitting.
+    # get_sing_box_version yields "1.13.12-extended-2.3.2" (no v) while the
+    # GitHub .tag_name is "v1.13.12-extended-2.3.2" (with v), so the old
+    # substring match never fired and reported a false "outdated". ${x#v} strips
+    # exactly one leading "v" if present and leaves the string otherwise — safe
+    # for both forms. NB: `tag` itself (with v) is untouched and is NOT used by
+    # the install/asset path here; the installer re-derives its own tag.
+    cur_norm="${current_version#v}"
+    tag_norm="${tag#v}"
+
+    # EXACT equality after the v-strip: the extended version string is the full
+    # token (e.g. "1.13.12-extended-2.3.2"), so an exact match is correct and
+    # avoids the accidental partial matches the old `case *"$tag"*` form allowed.
+    status="outdated"
+    if [ "$cur_norm" = "$tag_norm" ]; then
+        status="latest"
+    fi
+
+    # Emit BOTH versions v-stripped so the UI shows a consistent string.
+    echo "{\"success\":true,\"current_version\":\"$cur_norm\",\"latest_version\":\"$tag_norm\",\"status\":\"$status\"}"
+    return 0
+}
+
+# ── Package-manager abstraction (Component Manager, task-017) ───────
+#
+# updater.sh does NOT source install.sh, so these are the tiny `updates_`-prefixed
+# equivalents of install.sh's pkg_is_apk / pkg_install / pkg_is_installed. On a
+# real device exactly ONE of apk/opkg exists. Package output is parsed with
+# cut/awk/grep only — NEVER Oniguruma jq.
+
+# Returns 0 if the device uses apk (the apk binary is present), non-zero for opkg.
+updates_pkg_is_apk() {
+    command -v apk >/dev/null 2>&1
+}
+
+# Installs a package FILE (downloaded .ipk/.apk) non-interactively. Returns the
+# package manager's exit status. apk needs --allow-untrusted for self-built
+# packages; opkg install handles the local file path directly.
+updates_pkg_install_file() {
+    local pkg_file="$1"
+
+    if updates_pkg_is_apk; then
+        apk add --allow-untrusted "$pkg_file" </dev/null >/dev/null 2>&1
+    else
+        # --force-downgrade: a legacy v-prefixed build (e.g. v0.8.6) sorts ABOVE
+        # the no-v target (0.8.7) in opkg's dpkg-style compare, so a plain
+        # `opkg install` returns rc=0 and refuses ("Not downgrading ..."). The
+        # flag forces the v->no-v transition to actually land.
+        # --force-reinstall: covers the "already installed at this exact version"
+        # no-op. opkg rc is NOT a reliable success signal either way — the
+        # verify-after-install belt in _updates_self_update_netshift_core is the
+        # authoritative check.
+        opkg install --force-downgrade --force-reinstall "$pkg_file" </dev/null >/dev/null 2>&1
+    fi
+}
+
+# Returns 0 if a package NAME is currently installed. Mirrors install.sh's
+# pkg_is_installed grep-based detection (busybox-safe; no regex needed).
+updates_pkg_is_installed() {
+    local pkg_name="$1"
+
+    if updates_pkg_is_apk; then
+        apk list --installed 2>/dev/null | grep -q "$pkg_name"
+    else
+        opkg list-installed 2>/dev/null | grep -q "$pkg_name"
+    fi
+}
+
+# Echoes the FEED/candidate version of a package (the version the package
+# manager would install), or nothing if unavailable. Parsed with cut/awk only.
+#   opkg list <pkg> -> "<name> - <version>"   (field after " - ")
+#   apk  list <pkg> -> "<name>-<version> <arch> {...} ..."  (strip "<name>-")
+updates_pkg_candidate_version() {
+    local pkg_name="$1"
+    local line version=""
+
+    if updates_pkg_is_apk; then
+        # First matching list line; the token is "<name>-<version>". Strip the
+        # leading "<pkg>-" so only the version (e.g. "1.12.22-r1") remains.
+        line="$(apk list "$pkg_name" 2>/dev/null | grep -v '\[installed\]' | awk '{print $1}' | head -n1)"
+        [ -n "$line" ] || line="$(apk list "$pkg_name" 2>/dev/null | awk '{print $1}' | head -n1)"
+        case "$line" in
+        "$pkg_name"-*) version="${line#"$pkg_name"-}" ;;
+        esac
+    else
+        # opkg list prints "<name> - <version>"; take the field after " - ".
+        version="$(opkg list "$pkg_name" 2>/dev/null | grep "^${pkg_name} " | head -n1 | awk -F' - ' '{print $2}')"
+    fi
+
+    printf '%s' "$version"
+}
+
+# Echoes the INSTALLED version of a package (what is on the system right now),
+# or nothing if the package is not installed. Distinct from
+# updates_pkg_candidate_version (that reads the FEED candidate). Parsed with
+# grep/awk only — NEVER Oniguruma jq. Mirrors updates_pkg_is_installed.
+#   opkg list-installed -> "<name> - <version>"   (field after " - ")
+#   apk  list --installed <pkg> -> "<name>-<version> <arch> {...} ..."  (strip "<name>-")
+updates_pkg_installed_version() {
+    local pkg_name="$1"
+    local line version=""
+
+    if updates_pkg_is_apk; then
+        # First installed-list token is "<name>-<version>"; strip the leading
+        # "<pkg>-" so only the version (e.g. "0.8.7-r1") remains.
+        line="$(apk list --installed "$pkg_name" 2>/dev/null | awk '{print $1}' | head -n1)"
+        case "$line" in
+        "$pkg_name"-*) version="${line#"$pkg_name"-}" ;;
+        esac
+    else
+        # opkg list-installed prints "<name> - <version>"; take the field after
+        # " - " for the exact package name.
+        version="$(opkg list-installed 2>/dev/null | grep "^${pkg_name} " | head -n1 | awk -F' - ' '{print $2}')"
+    fi
+
+    printf '%s' "$version"
+}
+
+# Checks whether a newer STOCK (stable) sing-box is available via the system
+# package manager. SYNC (quick call → stays on the synchronous component_action
+# path). Graceful on an unreachable feed / parse failure: echoes
+# {"success":false,"message":"..."} and returns non-zero. NEVER exits.
+#
+# Output (STABLE, mirrors updates_check_sing_box_extended):
+#   {"success":true,"current_version":"...","latest_version":"...",
+#    "status":"latest"|"outdated"|"not_installed"}
+updates_check_sing_box_stable() {
+    local current_version candidate cur_semver cand_semver status
+
+    # Refresh the package index so the candidate version reflects the feed.
+    # Best-effort: a failure here just means we compare against whatever index
+    # is cached; the candidate-empty branch below reports the unreachable feed.
+    if updates_pkg_is_apk; then
+        apk update </dev/null >/dev/null 2>&1 || true
+    else
+        opkg update </dev/null >/dev/null 2>&1 || true
+    fi
+
+    candidate="$(updates_pkg_candidate_version "sing-box")"
+    if [ -z "$candidate" ]; then
+        echo "{\"success\":false,\"message\":\"Could not determine the stock sing-box version from the package feed (feed unreachable or package not found)\"}"
+        return 1
+    fi
+
+    # sing-box absent → not_installed (no running binary to compare).
+    if ! command -v sing-box >/dev/null 2>&1; then
+        echo "{\"success\":true,\"current_version\":\"not installed\",\"latest_version\":\"$candidate\",\"status\":\"not_installed\"}"
+        return 0
+    fi
+
+    current_version="$(get_sing_box_version)"
+
+    # Compare on the leading semver only (drop any "-r1"/"-extended-..." suffix)
+    # so the sort -V based >= test in is_min_package_version is well-defined.
+    cur_semver="${current_version%%-*}"
+    cand_semver="${candidate%%-*}"
+
+    if is_min_package_version "$cur_semver" "$cand_semver"; then
+        status="latest"
+    else
+        status="outdated"
+    fi
+
+    echo "{\"success\":true,\"current_version\":\"$current_version\",\"latest_version\":\"$candidate\",\"status\":\"$status\"}"
+    return 0
+}
+
+# Checks whether a newer NetShift release is available on GitHub. ON-DEMAND
+# (the "Check for updates" button) — mirrors the sing-box cores so get_system_info
+# never touches the network. SYNC (quick call → component_action path). Graceful
+# on an unreachable/rate-limited API: echoes {"success":false,"message":"..."}
+# and returns non-zero. NEVER exits (runs via component_action → JSON + rc).
+#
+# Output (mirrors updates_check_sing_box_stable):
+#   {"success":true,"current_version":"...","latest_version":"...",
+#    "status":"latest"|"outdated"}
+#
+# v-normalization: a single leading "v" is stripped from BOTH the installed
+# version and the GitHub tag before comparing (task-028 dropped the v from the
+# build, but a v-tagged release would still break a raw compare). The compare is
+# on the leading semver (drop any "-..." suffix) via the same sort -V based
+# is_min_package_version the cores use.
+updates_check_netshift() {
+    local current_version latest cur_norm latest_norm cur_semver latest_semver status
+
+    current_version="$NETSHIFT_VERSION"
+
+    # Dev/unstamped build: the placeholder __COMPILED_VERSION_VARIABLE__ contains
+    # "COMPILED" and is not a real semver. Report it honestly as "latest" (a dev
+    # build is never "outdated"; the UI also guards dev separately) and still fetch
+    # the real latest tag for display.
+    case "$current_version" in
+    *COMPILED*)
+        latest="$(updates_netshift_latest_tag)"
+        if [ -z "$latest" ]; then
+            echo "{\"success\":false,\"message\":\"Could not determine the latest NetShift release (GitHub API unreachable or rate-limited)\"}"
+            return 1
+        fi
+        echo "{\"success\":true,\"current_version\":\"$current_version\",\"latest_version\":\"$latest\",\"status\":\"latest\"}"
+        return 0
+        ;;
+    esac
+
+    latest="$(updates_netshift_latest_tag)"
+    if [ -z "$latest" ]; then
+        echo "{\"success\":false,\"message\":\"Could not determine the latest NetShift release (GitHub API unreachable or rate-limited)\"}"
+        return 1
+    fi
+
+    # Strip a single leading "v" from both sides (no-op if absent), then compare
+    # on the leading semver only.
+    cur_norm="${current_version#v}"
+    latest_norm="${latest#v}"
+    cur_semver="${cur_norm%%-*}"
+    latest_semver="${latest_norm%%-*}"
+
+    if is_min_package_version "$cur_semver" "$latest_semver"; then
+        status="latest"
+    else
+        status="outdated"
+    fi
+
+    echo "{\"success\":true,\"current_version\":\"$current_version\",\"latest_version\":\"$latest\",\"status\":\"$status\"}"
+    return 0
+}
+
+# ── NetShift self-update (Component Manager, task-017) ──────────────
+#
+# Variant A: a targeted package upgrade (download the release .ipk/.apk from
+# GitHub and pkg_install them) — NOT install.sh (interactive). Runs as the async
+# worker `component_action netshift self_update`.
+#
+# Public wrapper — EXACTLY mirrors the updates_install_sing_box_extended epilogue
+# (single cleanup path): reset heal flags → ensure GitHub connectivity (preflight
+# + self-heal) → run the private core capturing JSON to a tmpfs file + rc →
+# ALWAYS updates_restore_after_swap → re-emit the JSON → return rc. No early
+# return skips the restore; no trap needed.
+updates_self_update_netshift() {
+    local rc out json
+
+    UPDATES_HEAL_RESOLV_REPLACED=0
+    UPDATES_HEAL_REDIRECT_DOWN=0
+
+    if ! updates_ensure_connectivity "extended"; then
+        # Heal failed BEFORE anything was touched: NetShift is left fully intact.
+        updates_restore_after_swap
+        updates_log "Aborting NetShift self-update: GitHub unreachable and self-heal failed (NetShift left intact)" "error"
+        echo '{"success":false,"message":"GitHub unreachable and self-heal failed; self-update aborted (NetShift left intact)"}'
+        return 1
+    fi
+
+    out="/tmp/netshift-selfupdate-result.$$"
+    _updates_self_update_netshift_core >"$out" 2>/dev/null
+    rc=$?
+    json="$(cat "$out" 2>/dev/null)"
+    rm -f "$out" 2>/dev/null
+
+    updates_restore_after_swap
+
+    [ -n "$json" ] && printf '%s\n' "$json"
+    return "$rc"
+}
+
+# Resolve a URL's HTTP redirect target via curl WITHOUT hitting the rate-limited
+# API or downloading the body. Echoes the redirect URL (empty if curl absent or
+# no redirect). Stubbable in tests.
+updates_github_resolve_redirect() {
+    local url="$1"
+    command -v curl >/dev/null 2>&1 || return 1
+    curl -sI -o /dev/null -w '%{redirect_url}' --connect-timeout 5 -m 15 -A 'netshift-updater' "$url" 2>/dev/null
+}
+
+# Echoes the GitHub latest-release tag for NetShift (e.g. "0.8.8"), or nothing.
+# PRIMARY: resolve the github.com frontend redirect of /releases/latest — it
+# 302s to /releases/tag/<tag>. That frontend is NOT the 60/hour-per-IP
+# api.github.com, so it sidesteps the anonymous rate limit entirely (the common
+# failure on CGNAT / shared-IP / shared-VPN-egress routers). FALLBACK: the
+# api.github.com release object parsed with jq (task-047) so a curl-less box or a
+# changed-redirect github still degrades gracefully instead of hard-failing.
+# jq is format-independent (minified or pretty); a field-positional grep|cut
+# grabbed the wrong key on minified JSON, causing a false "outdated".
+# Bare tag on success / non-zero otherwise (contract consumed by
+# updates_check_netshift and the self-update worker).
+updates_netshift_latest_tag() {
+    local response tag redirect
+
+    # PRIMARY: github.com/<repo>/releases/latest 302-redirects to
+    # /releases/tag/<tag>. Parse with case/param-expansion (no Oniguruma).
+    redirect="$(updates_github_resolve_redirect "$NETSHIFT_REPO_RELEASES_LATEST_URL")"
+    case "$redirect" in
+    */releases/tag/*)
+        tag="${redirect##*/releases/tag/}"
+        case "$tag" in '' | */*) tag="" ;; esac
+        ;;
+    *) tag="" ;;
+    esac
+    if [ -n "$tag" ]; then
+        printf '%s' "$tag"
+        return 0
+    fi
+
+    # FALLBACK: api.github.com (rate-limited) parsed with jq.
+    response="$(updates_http_get_once "$NETSHIFT_RELEASE_API_URL" "")"
+    if [ -z "$response" ]; then
+        return 1
+    fi
+
+    tag="$(printf '%s' "$response" | jq -r '.tag_name // empty' 2>/dev/null)"
+    [ -n "$tag" ] || return 1
+    printf '%s' "$tag"
+}
+
+# Echo the deterministic release asset filename for a package + tag + ext.
+# ipk core/luci carry "-r1-all"; apk core/luci carry "-r1"; the i18n package
+# carries neither suffix (just "<pkg>-<tag>.<ext>"). Single source of the asset
+# naming pattern so it lives in one place, not scattered.
+updates_netshift_asset_filename() {
+    local pkg="$1" tag="$2" ext="$3"
+    case "$pkg" in
+    "$UPDATES_NETSHIFT_PKG_I18N_RU") printf '%s-%s.%s' "$pkg" "$tag" "$ext" ;;
+    *)
+        if [ "$ext" = "ipk" ]; then
+            printf '%s-%s-r1-all.%s' "$pkg" "$tag" "$ext"
+        else
+            printf '%s-%s-r1.%s' "$pkg" "$tag" "$ext"
+        fi
+        ;;
+    esac
+}
+
+# Downloads the NetShift release assets for the active package manager into $dir.
+# Echoes nothing; returns 0 if at least the core "netshift" package was
+# downloaded, non-zero otherwise.
+# PRIMARY: resolve the latest tag (redirect-based, rate-limit-free) and build the
+# deterministic github.com/<repo>/releases/download/<tag>/<asset> URLs — the
+# CDN 302 is followed by updates_download_to_file (curl -L / wget both follow it).
+# FALLBACK: if the tag can't be resolved, scrape the api.github.com release JSON
+# for .ipk/.apk URLs (busybox grep -o) as before, so a curl-less box still works.
+_updates_self_update_download_assets() {
+    local dir="$1"
+    local response ext pattern url filename dest attempt got_core=0
+    local tag pkg
+
+    if updates_pkg_is_apk; then
+        ext="apk"
+    else
+        ext="ipk"
+    fi
+
+    tag="$(updates_netshift_latest_tag)"
+    if [ -n "$tag" ]; then
+        # Direct deterministic asset URLs (no API). Core + luci always; the RU
+        # i18n package only if already installed.
+        for pkg in "$UPDATES_NETSHIFT_PKG_CORE" "$UPDATES_NETSHIFT_PKG_LUCI" "$UPDATES_NETSHIFT_PKG_I18N_RU"; do
+            if [ "$pkg" = "$UPDATES_NETSHIFT_PKG_I18N_RU" ]; then
+                updates_pkg_is_installed "$UPDATES_NETSHIFT_PKG_I18N_RU" || continue
+            fi
+            filename="$(updates_netshift_asset_filename "$pkg" "$tag" "$ext")"
+            url="$NETSHIFT_REPO_RELEASES_DOWNLOAD_BASE/$tag/$filename"
+            dest="$dir/$filename"
+            attempt=0
+            while [ "$attempt" -lt 3 ]; do
+                if updates_download_to_file "$url" "$dest"; then
+                    break
+                fi
+                rm -f "$dest" 2>/dev/null
+                attempt=$((attempt + 1))
+            done
+            if [ "$pkg" = "$UPDATES_NETSHIFT_PKG_CORE" ] && [ -s "$dest" ]; then
+                got_core=1
+            fi
+        done
+        [ "$got_core" -eq 1 ]
+        return $?
+    fi
+
+    # FALLBACK: scrape the API release JSON for direct asset URLs.
+    response="$(updates_http_get_once "$NETSHIFT_RELEASE_API_URL" "")"
+    if [ -z "$response" ]; then
+        return 1
+    fi
+    pattern="https://[^\"[:space:]]*\.${ext}"
+
+    # Iterate the matching browser_download_url values. Only keep assets whose
+    # filename starts with one of the NetShift package-name prefixes; the RU
+    # i18n package is kept ONLY if already installed.
+    printf '%s' "$response" | grep -o "$pattern" | while read -r url; do
+        filename="$(basename "$url")"
+        case "$filename" in
+        "$UPDATES_NETSHIFT_PKG_CORE"* | "$UPDATES_NETSHIFT_PKG_LUCI"*) ;;
+        "$UPDATES_NETSHIFT_PKG_I18N_RU"*)
+            updates_pkg_is_installed "$UPDATES_NETSHIFT_PKG_I18N_RU" || continue
+            ;;
+        *) continue ;;
+        esac
+
+        dest="$dir/$filename"
+        attempt=0
+        while [ "$attempt" -lt 3 ]; do
+            if updates_download_to_file "$url" "$dest"; then
+                break
+            fi
+            rm -f "$dest" 2>/dev/null
+            attempt=$((attempt + 1))
+        done
+    done
+
+    # Verify the core package landed (the subshell-piped loop can't set a parent
+    # var, so re-check the directory contents here).
+    if ls "$dir/$UPDATES_NETSHIFT_PKG_CORE"* >/dev/null 2>&1; then
+        got_core=1
+    fi
+    [ "$got_core" -eq 1 ]
+}
+
+# Private core of the self-update. Runs NON-interactively; every variable local.
+# Echoes a single JSON object; NEVER exits (returns non-zero on recoverable
+# failure so the wrapper still runs the restore epilogue).
+_updates_self_update_netshift_core() {
+    local installed latest pkg file_path candidate_file
+    local core_installed core_installed_semver latest_semver
+    local backup_made=0
+
+    installed="$NETSHIFT_VERSION"
+
+    latest="$(updates_netshift_latest_tag)"
+    if [ -z "$latest" ]; then
+        updates_log "Self-update: could not determine the latest NetShift release tag" "error"
+        echo '{"success":false,"message":"Could not determine the latest NetShift release (GitHub API unreachable or rate-limited)"}'
+        return 1
+    fi
+
+    # Idempotent defense: compare ignoring a leading "v" so "v0.8.1" vs "0.8.1"
+    # still match (the UI also gates on the "outdated" status).
+    if [ "${installed#v}" = "${latest#v}" ]; then
+        updates_log "Self-update: NetShift already at the latest version ($installed)"
+        echo "{\"success\":true,\"message\":\"Already up to date\",\"version\":\"$installed\"}"
+        return 0
+    fi
+
+    # Minimal backup: /etc/config/netshift to tmpfs (conffiles normally preserve
+    # it; this is the defensive belt).
+    rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR" 2>/dev/null
+    if ! mkdir -p "$UPDATES_NETSHIFT_DOWNLOAD_DIR"; then
+        updates_log "Self-update: failed to create download directory" "error"
+        echo '{"success":false,"message":"Failed to create the self-update download directory"}'
+        return 1
+    fi
+    mkdir -p "$(dirname "$UPDATES_NETSHIFT_CONFIG_BACKUP")" 2>/dev/null || true
+    if [ -f "$NETSHIFT_CONFIG" ]; then
+        if cp -p "$NETSHIFT_CONFIG" "$UPDATES_NETSHIFT_CONFIG_BACKUP" 2>/dev/null; then
+            backup_made=1
+        else
+            updates_log "Self-update: failed to back up $NETSHIFT_CONFIG (continuing; conffiles preserve it)" "warn"
+        fi
+    fi
+
+    # Download the release assets (.ipk/.apk) for this package manager.
+    updates_log "Self-update: downloading NetShift $latest release packages"
+    if ! _updates_self_update_download_assets "$UPDATES_NETSHIFT_DOWNLOAD_DIR"; then
+        rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR" 2>/dev/null
+        updates_log "Self-update: failed to download the NetShift release packages" "error"
+        echo '{"success":false,"message":"Failed to download the NetShift release packages (GitHub unreachable or no matching assets)"}'
+        return 1
+    fi
+
+    # Install core, then LuCI app, then RU i18n if applicable (already filtered
+    # to "installed-only" at download time). NON-interactive. The netshift
+    # package replaces /usr/bin/netshift (this very script) — busybox ash has
+    # already read the whole script into memory, so the in-flight worker and the
+    # subsequent updates_write_finished_job_state complete from memory. We MUST
+    # NOT re-exec /usr/bin/netshift after this install (no updates_restart that
+    # re-runs the CLI; only /etc/init.d/netshift restart, which spawns a fresh
+    # process that may safely load the new binary).
+    for pkg in "$UPDATES_NETSHIFT_PKG_CORE" "$UPDATES_NETSHIFT_PKG_LUCI" "$UPDATES_NETSHIFT_PKG_I18N_RU"; do
+        file_path=""
+        for candidate_file in "$UPDATES_NETSHIFT_DOWNLOAD_DIR/$pkg"*; do
+            if [ -f "$candidate_file" ]; then
+                file_path="$candidate_file"
+                break
+            fi
+        done
+        [ -n "$file_path" ] || continue
+
+        updates_log "Self-update: installing $(basename "$file_path")"
+        if ! updates_pkg_install_file "$file_path"; then
+            # The core is the critical package; if it fails, surface the failure.
+            # conffiles preserve /etc/config/netshift; restore defensively below.
+            if [ "$pkg" = "$UPDATES_NETSHIFT_PKG_CORE" ]; then
+                _updates_self_update_restore_config "$backup_made"
+                rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR" 2>/dev/null
+                updates_log "Self-update: failed to install the NetShift core package" "error"
+                echo '{"success":false,"message":"Failed to install the NetShift core package; configuration preserved"}'
+                return 1
+            fi
+            updates_log "Self-update: failed to install $pkg (non-critical; continuing)" "warn"
+        fi
+    done
+
+    # Verify-after-install for the CORE package (authoritative success signal).
+    # opkg returns rc=0 for "already installed"/"up to date"/"Not downgrading",
+    # so the install rc above is NOT trustworthy. RE-READ the installed version
+    # and confirm it actually became the target before declaring success. apk's
+    # equal-version no-overwrite quirk is caught by this same belt.
+    core_installed="$(updates_pkg_installed_version "$UPDATES_NETSHIFT_PKG_CORE")"
+    # Normalize with the SAME rules the version-decision uses: drop a leading "v"
+    # and any "-rN"/"-suffix" so we compare semver-to-semver.
+    core_installed_semver="${core_installed#v}"
+    core_installed_semver="${core_installed_semver%%-*}"
+    latest_semver="${latest#v}"
+    latest_semver="${latest_semver%%-*}"
+
+    # The install took iff the installed semver equals the target, OR the
+    # installed semver is now >= the target (is_min_package_version current
+    # required → 0 when current >= required).
+    if [ "$core_installed_semver" != "$latest_semver" ] \
+        && ! is_min_package_version "$core_installed_semver" "$latest_semver"; then
+        _updates_self_update_restore_config "$backup_made"
+        rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR" 2>/dev/null
+        updates_log "Self-update: core package version did not change after install (package manager reported success but no upgrade occurred)" "error"
+        echo '{"success":false,"message":"NetShift core package did not upgrade (package manager refused or no-op); configuration preserved"}'
+        return 1
+    fi
+
+    # Defensive: if the config got clobbered/emptied, restore from the backup.
+    _updates_self_update_restore_config "$backup_made"
+
+    # Success cleanup: drop the download dir and the config backup.
+    rm -rf "$UPDATES_NETSHIFT_DOWNLOAD_DIR" 2>/dev/null
+    [ "$backup_made" -eq 1 ] && rm -f "$UPDATES_NETSHIFT_CONFIG_BACKUP" 2>/dev/null
+
+    updates_log "Self-update: NetShift updated to $latest"
+    echo "{\"success\":true,\"version\":\"$latest\",\"message\":\"NetShift updated to $latest\"}"
+    return 0
+}
+
+# Restores /etc/config/netshift from the tmpfs backup IF the live file is missing
+# or empty (conffiles normally keep it; this is the defensive belt). $1 = 1 when
+# a backup was taken.
+_updates_self_update_restore_config() {
+    local backup_made="$1"
+
+    [ "$backup_made" -eq 1 ] || return 0
+    [ -f "$UPDATES_NETSHIFT_CONFIG_BACKUP" ] || return 0
+
+    if [ ! -s "$NETSHIFT_CONFIG" ]; then
+        if cp -p "$UPDATES_NETSHIFT_CONFIG_BACKUP" "$NETSHIFT_CONFIG" 2>/dev/null; then
+            updates_log "Self-update: restored $NETSHIFT_CONFIG from backup (live file was missing/empty)" "warn"
+        else
+            updates_log "Self-update: FAILED to restore $NETSHIFT_CONFIG from backup" "error"
+        fi
+    fi
+}
+
+# Dispatcher for component-related actions.
+component_action() {
+    local component="$1"
+    local action="$2"
+
+    case "$component:$action" in
+    sing_box:install_extended)
+        updates_install_sing_box_extended
+        ;;
+    sing_box:install_stable)
+        updates_install_sing_box_stable
+        ;;
+    sing_box:check_update)
+        updates_check_sing_box_extended
+        ;;
+    sing_box:check_update_stable)
+        updates_check_sing_box_stable
+        ;;
+    netshift:check_update)
+        updates_check_netshift
+        ;;
+    netshift:self_update)
+        updates_self_update_netshift
+        ;;
+    subscription:clear_cache)
+        # Worker lives in bin/netshift (where subscription_update + the cache-path
+        # builders + SUBSCRIPTION_CACHE_FOLDER are in scope). updater.sh is sourced
+        # by bin/netshift, and the async fork re-execs "$0" component_action ...,
+        # so the function is always defined when this arm dispatches. Reachable via
+        # BOTH the sync `component_action subscription clear_cache` and the async
+        # component_action_async/component_action_status paths.
+        subscription_clear_cache_and_redownload
+        ;;
+    *)
+        echo '{"success":false,"message":"Unknown component action"}'
+        return 1
+        ;;
+    esac
+}
diff --git a/opencode.json b/opencode.json
new file mode 100644
index 00000000..2ecf11d4
--- /dev/null
+++ b/opencode.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": [
+    "AGENTS.md",
+    "docs/agent-rules/project-core.md",
+    "docs/agent-rules/backend-shell.md",
+    "docs/agent-rules/frontend-luci.md",
+    "docs/agent-rules/packaging.md"
+  ]
+}
diff --git a/podkop/Makefile b/podkop/Makefile
deleted file mode 100644
index 5cef0c1e..00000000
--- a/podkop/Makefile
+++ /dev/null
@@ -1,64 +0,0 @@
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=podkop
-
-PKG_VERSION := $(if $(PODKOP_VERSION),$(PODKOP_VERSION),0.$(shell date +%d%m%Y))
-
-PKG_RELEASE:=1
-
-PKG_MAINTAINER:=ITDog <podkop@itdog.info>
-PKG_LICENSE:=GPL-2.0-or-later
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/podkop
-	SECTION:=net
-	CATEGORY:=Network
-	DEPENDS:=+sing-box +curl +jq +kmod-nft-tproxy +coreutils-base64 +bind-dig
-	CONFLICTS:=https-dns-proxy nextdns luci-app-passwall luci-app-passwall2
-	TITLE:=Domain routing app
-	URL:=https://podkop.net
-	PKGARCH:=all
-endef
-
-define Package/podkop/description
-	Domain routing. Use of VLESS, Shadowsocks technologies
-endef
-
-define Build/Configure
-endef
-
-define Build/Compile
-endef
-
-define Package/podkop/prerm
-#!/bin/sh
-
-grep -q "105 podkop" /etc/iproute2/rt_tables && sed -i "/105 podkop/d" /etc/iproute2/rt_tables
-
-/etc/init.d/podkop stop
-
-exit 0
-endef
-
-define Package/podkop/conffiles
-/etc/config/podkop
-endef
-
-define Package/podkop/install
-	$(INSTALL_DIR) $(1)/etc/init.d
-	$(INSTALL_BIN) ./files/etc/init.d/podkop $(1)/etc/init.d/podkop
-
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) ./files/etc/config/podkop $(1)/etc/config/podkop
-
-	$(INSTALL_DIR) $(1)/usr/bin
-	$(INSTALL_BIN) ./files/usr/bin/podkop $(1)/usr/bin/podkop
-
-	$(INSTALL_DIR) $(1)/usr/lib/podkop
-	$(CP) ./files/usr/lib/* $(1)/usr/lib/podkop/
-
-	sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' $(1)/usr/lib/podkop/constants.sh
-endef
-
-$(eval $(call BuildPackage,podkop))
diff --git a/podkop/files/etc/config/podkop b/podkop/files/etc/config/podkop
deleted file mode 100644
index 27003cfa..00000000
--- a/podkop/files/etc/config/podkop
+++ /dev/null
@@ -1,40 +0,0 @@
-config settings 'settings'
-        option dns_type 'udp'
-        option dns_server '77.88.8.8'
-        option bootstrap_dns_server '77.88.8.8'
-        option dns_rewrite_ttl '60'
-        list source_network_interfaces 'br-lan'
-        option enable_output_network_interface '0'
-        #option output_network_interface 'wan'
-        option enable_badwan_interface_monitoring '0'
-        #list badwan_monitored_interfaces 'wan'
-        #option badwan_reload_delay '2000'
-        option enable_yacd '0'
-        option disable_quic '0'
-        option update_interval '1d'
-        option download_lists_via_proxy '0'
-        option dont_touch_dhcp '0'
-        option config_path '/etc/sing-box/config.json'
-        option cache_path '/tmp/sing-box/cache.db'
-        option log_level 'warn'
-        option exclude_ntp '0'
-        option shutdown_correctly '0'
-        #list routing_excluded_ips '192.168.1.3'
-
-config section 'main'
-        option connection_type 'proxy'
-        option proxy_config_type 'url'
-        option proxy_string ''
-        option enable_udp_over_tcp '0'
-        list community_lists 'russia_inside'
-        #option user_domain_list_type 'dynamic'
-        #list user_domains '2ip.ru'
-        #option user_subnet_list_type 'dynamic'
-        #list user_subnets '1.1.1.1'
-        #list local_domain_lists '/tmp/domains.lst'
-        #list local_subnet_lists '/tmp/subnets.lst'
-        #list remote_domain_lists 'https://example.com/domains.srs'
-        #list remote_subnet_lists 'https://example.com/subnets.srs'
-        #list fully_routed_ips '192.168.1.2'
-        #option mixed_proxy_enabled '1'
-        #option mixed_proxy_port '2080'
\ No newline at end of file
diff --git a/podkop/files/usr/bin/podkop b/podkop/files/usr/bin/podkop
deleted file mode 100755
index e3af7c06..00000000
--- a/podkop/files/usr/bin/podkop
+++ /dev/null
@@ -1,2770 +0,0 @@
-#!/bin/ash
-
-check_required_file() {
-    local file="$1"
-
-    if [ ! -r "$file" ]; then
-        echo "Error: required file '$file' is missing or not readable" >&2
-        exit 1
-    fi
-}
-
-PODKOP_LIB="/usr/lib/podkop"
-check_required_file /lib/functions.sh
-check_required_file /lib/config/uci.sh
-check_required_file /lib/functions/network.sh
-check_required_file "$PODKOP_LIB/constants.sh"
-check_required_file "$PODKOP_LIB/nft.sh"
-check_required_file "$PODKOP_LIB/helpers.sh"
-check_required_file "$PODKOP_LIB/sing_box_config_manager.sh"
-check_required_file "$PODKOP_LIB/sing_box_config_facade.sh"
-check_required_file "$PODKOP_LIB/logging.sh"
-check_required_file "$PODKOP_LIB/rulesets.sh"
-. /lib/functions.sh
-. /lib/config/uci.sh
-. /lib/functions/network.sh
-. "$PODKOP_LIB/constants.sh"
-. "$PODKOP_LIB/nft.sh"
-. "$PODKOP_LIB/helpers.sh"
-. "$PODKOP_LIB/sing_box_config_manager.sh"
-. "$PODKOP_LIB/sing_box_config_facade.sh"
-. "$PODKOP_LIB/logging.sh"
-. "$PODKOP_LIB/rulesets.sh"
-
-config_load "$PODKOP_CONFIG"
-
-check_requirements() {
-    log "Check Requirements"
-
-    local sing_box_version jq_version coreutils_base64_version
-    sing_box_version="$(sing-box version | head -n1 | awk '{print $3}')"
-    jq_version="$(jq --version | awk -F- '{print $2}')"
-    coreutils_base64_version="$(base64 --version | head -n1 | awk '{print $4}')"
-
-    if [ -z "$sing_box_version" ]; then
-        log "Package 'sing-box' is not installed. Aborted." "error"
-        exit 1
-    else
-        if ! is_min_package_version "$sing_box_version" "$SB_REQUIRED_VERSION"; then
-            log "Package 'sing-box' version ($sing_box_version) is lower than the required minimum ($SB_REQUIRED_VERSION). Update sing-box: opkg update && opkg remove sing-box && opkg install sing-box. Aborted." "error"
-            exit 1
-        fi
-
-        if ! service_exists "sing-box"; then
-            log "Service 'sing-box' is missing. Please install the official package to ensure the service is available. Aborted." "error"
-            exit 1
-        fi
-    fi
-
-    if [ -z "$jq_version" ]; then
-        log "Package 'jq' is not installed. Aborted." "error"
-        exit 1
-    elif ! is_min_package_version "$jq_version" "$JQ_REQUIRED_VERSION"; then
-        log "Package 'jq' version ($jq_version) is lower than the required minimum ($JQ_REQUIRED_VERSION). Aborted." "error"
-        exit 1
-    fi
-
-    if [ -z "$coreutils_base64_version" ]; then
-        log "Package 'coreutils-base64' is not installed. Aborted." "error"
-        exit 1
-    elif ! is_min_package_version "$coreutils_base64_version" "$COREUTILS_BASE64_REQUIRED_VERSION"; then
-        log "Package 'coreutils-base64' version ($coreutils_base64_version) is lower than the required minimum ($COREUTILS_BASE64_REQUIRED_VERSION). This may cause issues when decoding base64 streams with missing padding, as automatic padding support is not available in older versions." "warn"
-    fi
-
-    if grep -qE 'doh_backup_noresolv|doh_backup_server|doh_server' /etc/config/dhcp; then
-        log "Detected https-dns-proxy in DHCP config. Edit /etc/config/dhcp" "error"
-    fi
-
-    if has_outbound_section; then
-        log "Outbound section found" "debug"
-    else
-        log "Outbound section not found. Please check your configuration file (missing proxy_string, selector_proxy_links, urltest_proxy_links, outbound_json, or interface). Aborted." "error"
-        exit 1
-    fi
-}
-
-_check_outbound_section() {
-    local section="$1"
-    local proxy_string interface outbound_json urltest_proxy_links
-
-    config_get proxy_string "$section" "proxy_string"
-    config_get selector_proxy_links "$section" "selector_proxy_links"
-    config_get urltest_proxy_links "$section" "urltest_proxy_links"
-    config_get outbound_json "$section" "outbound_json"
-    config_get interface "$section" "interface"
-
-    if [ -n "$proxy_string" ] || [ -n "$selector_proxy_links" ] || [ -n "$urltest_proxy_links" ] ||
-        [ -n "$outbound_json" ] || [ -n "$interface" ]; then
-        section_exists=0
-    fi
-}
-
-has_outbound_section() {
-    local section_exists=1
-
-    config_foreach _check_outbound_section "section"
-
-    return $section_exists
-}
-
-start_main() {
-    log "Starting podkop"
-
-    check_requirements
-
-    migration
-
-    config_foreach process_validate_service "section"
-
-    br_netfilter_disable
-
-    # Sync time for DoH/DoT
-    /usr/sbin/ntpd -q -p 194.190.168.1 -p 216.239.35.0 -p 216.239.35.4 -p 162.159.200.1 -p 162.159.200.123
-
-    sleep 1
-
-    mkdir -p "$TMP_SING_BOX_FOLDER"
-    mkdir -p "$TMP_RULESET_FOLDER"
-
-    # base
-    route_table_rule_mark
-    create_nft_rules
-    sing_box_configure_service
-
-    # sing-box
-    sing_box_init_config
-    config_foreach add_cron_job "section"
-    /etc/init.d/sing-box start
-
-    log "Nice"
-    list_update &
-    echo $! > /var/run/podkop_list_update.pid
-}
-
-stop_main() {
-    log "Stopping the podkop"
-
-    if [ -f /var/run/podkop_list_update.pid ]; then
-        pid=$(cat /var/run/podkop_list_update.pid)
-        if kill -0 "$pid" 2> /dev/null; then
-            kill "$pid" 2> /dev/null
-            log "Stopped list_update"
-        fi
-        rm -f /var/run/podkop_list_update.pid
-    fi
-
-    remove_cron_job
-
-    rm -f "$TMP_RULESET_FOLDER"/*
-
-    log "Flush nft"
-    if nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
-        nft delete table inet "$NFT_TABLE_NAME"
-    fi
-
-    log "Flush ip rule"
-    if ip rule list | grep -q "podkop"; then
-        ip rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105
-    fi
-
-    log "Flush ip route"
-    if ip route list table "$RT_TABLE_NAME" > /dev/null 2>&1; then
-        ip route flush table "$RT_TABLE_NAME"
-    fi
-
-    log "Stop sing-box"
-    /etc/init.d/sing-box stop
-}
-
-start() {
-    start_main
-
-    config_get_bool dont_touch_dhcp "settings" "dont_touch_dhcp" 0
-    if [ "$dont_touch_dhcp" -eq 0 ]; then
-        dnsmasq_configure
-    fi
-
-    uci_set "podkop" "settings" "shutdown_correctly" 0
-    uci commit "podkop" && config_load "$PODKOP_CONFIG"
-}
-
-stop() {
-    local dont_touch_dhcp
-    config_get_bool dont_touch_dhcp "settings" "dont_touch_dhcp" 0
-    if [ "$dont_touch_dhcp" -eq 0 ]; then
-        dnsmasq_restore
-    fi
-
-    stop_main
-
-    uci_set "podkop" "settings" "shutdown_correctly" 1
-    uci commit "podkop" && config_load "$PODKOP_CONFIG"
-}
-
-reload() {
-    log "Podkop reload"
-    stop_main
-    start_main
-}
-
-restart() {
-    log "Podkop restart"
-    stop
-    start
-}
-
-# Migrations and validation funcs
-migration() {
-    :
-}
-
-validate_service() {
-    local service="$1"
-
-    for community_service in $COMMUNITY_SERVICES; do
-        if [ "$service" = "$community_service" ]; then
-            return 0
-        fi
-    done
-
-    log "Invalid service in community lists: $service. Check config and LuCI cache. Aborted." "fatal"
-    exit 1
-}
-
-process_validate_service() {
-    local section="$1"
-    local community_lists
-    config_get community_lists "$section" "community_lists"
-    if [ -n "$community_lists" ]; then
-        config_list_foreach "$section" "community_lists" validate_service
-    fi
-}
-
-br_netfilter_disable() {
-    if lsmod | grep -q br_netfilter && [ "$(sysctl -n net.bridge.bridge-nf-call-iptables 2> /dev/null)" = "1" ]; then
-        log "br_netfilter enabled detected. Disabling"
-        sysctl -w net.bridge.bridge-nf-call-iptables=0
-        sysctl -w net.bridge.bridge-nf-call-ip6tables=0
-    fi
-}
-
-# Main funcs
-
-route_table_rule_mark() {
-    grep -q "105 $RT_TABLE_NAME" /etc/iproute2/rt_tables || echo "105 $RT_TABLE_NAME" >> /etc/iproute2/rt_tables
-
-    if ! ip route list table "$RT_TABLE_NAME" 2> /dev/null | grep -q "local default dev lo scope host"; then
-        log "Added route for tproxy" "debug"
-        ip route add local 0.0.0.0/0 dev lo table "$RT_TABLE_NAME"
-    else
-        log "Route for tproxy exists" "debug"
-    fi
-
-    if ! ip rule list | grep -q "from all fwmark $NFT_FAKEIP_MARK/$NFT_FAKEIP_MARK lookup $RT_TABLE_NAME"; then
-        log "Create marking rule" "debug"
-        ip -4 rule add fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table "$RT_TABLE_NAME" priority 105
-    else
-        log "Marking rule exist" "debug"
-    fi
-}
-
-nft_init_interfaces_set() {
-    nft_create_ifname_set "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME"
-
-    local source_network_interfaces
-    config_get source_network_interfaces "settings" "source_network_interfaces" "br-lan"
-
-    for interface in $source_network_interfaces; do
-        nft add element inet "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME" "{ $interface }"
-    done
-}
-
-create_nft_rules() {
-    log "Create nft table"
-    nft_create_table "$NFT_TABLE_NAME"
-
-    log "Create localv4 set"
-    nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_LOCALV4_SET_NAME"
-    nft add element inet "$NFT_TABLE_NAME" localv4 '{
-        0.0.0.0/8,
-        10.0.0.0/8,
-        127.0.0.0/8,
-        169.254.0.0/16,
-        172.16.0.0/12,
-        192.0.0.0/24,
-        192.0.2.0/24,
-        192.88.99.0/24,
-        192.168.0.0/16,
-        198.51.100.0/24,
-        203.0.113.0/24,
-        224.0.0.0/4,
-        240.0.0.0-255.255.255.255
-    }'
-
-    log "Create common set"
-    nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-
-    log "Create interface set"
-    nft_init_interfaces_set
-
-    log "Create nft rules"
-    nft add chain inet "$NFT_TABLE_NAME" mangle '{ type filter hook prerouting priority -150; policy accept; }'
-    nft add chain inet "$NFT_TABLE_NAME" mangle_output '{ type route hook output priority -150; policy accept; }'
-    nft add chain inet "$NFT_TABLE_NAME" proxy '{ type filter hook prerouting priority -100; policy accept; }'
-
-    nft add rule inet "$NFT_TABLE_NAME" mangle ct status dnat return
-    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "@$NFT_COMMON_SET_NAME" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "@$NFT_COMMON_SET_NAME" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "$SB_FAKEIP_INET4_RANGE" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "$SB_FAKEIP_INET4_RANGE" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
-
-    nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto tcp tproxy ip to 127.0.0.1:1602 counter
-    nft add rule inet "$NFT_TABLE_NAME" proxy meta mark \& "$NFT_FAKEIP_MARK" == "$NFT_FAKEIP_MARK" meta l4proto udp tproxy ip to 127.0.0.1:1602 counter
-
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "@$NFT_LOCALV4_SET_NAME" return
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output meta mark "$NFT_OUTBOUND_MARK" counter return
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "@$NFT_COMMON_SET_NAME" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "@$NFT_COMMON_SET_NAME" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "$SB_FAKEIP_INET4_RANGE" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
-    nft add rule inet "$NFT_TABLE_NAME" mangle_output ip daddr "$SB_FAKEIP_INET4_RANGE" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
-
-    local exclude_ntp
-    config_get_bool exclude_ntp "settings" "exclude_ntp" "0"
-    if [ "$exclude_ntp" -eq 1 ]; then
-        log "NTP traffic exclude for proxy"
-        nft insert rule inet "$NFT_TABLE_NAME" mangle udp dport 123 return
-    fi
-}
-
-backup_dnsmasq_config_option() {
-    local key="$1"
-    local backup_key="$2"
-    local value
-    value="$(uci_get "dhcp" "@dnsmasq[0]" "$key")"
-
-    if [ -n "$value" ]; then
-        uci_set "dhcp" "@dnsmasq[0]" "$backup_key" "$value"
-    fi
-}
-
-dnsmasq_configure() {
-    local shutdown_correctly
-    config_get shutdown_correctly "settings" "shutdown_correctly"
-    if [ "$shutdown_correctly" -eq 0 ]; then
-        log "Previous shutdown of podkop was not correct, reconfiguration of dnsmasq is not required"
-        return 0
-    fi
-
-    log "Backup dnsmasq configuration"
-    current_servers="$(uci_get "dhcp" "@dnsmasq[0]" "server")"
-    if [ -n "$current_servers" ]; then
-        for server in $(uci_get "dhcp" "@dnsmasq[0]" "server"); do
-            if ! [ "$server" == "$SB_DNS_INBOUND_ADDRESS" ]; then
-                uci_add_list "dhcp" "@dnsmasq[0]" "podkop_server" "$server"
-            fi
-        done
-        uci_remove "dhcp" "@dnsmasq[0]" "server"
-    fi
-
-    backup_dnsmasq_config_option "noresolv" "podkop_noresolv"
-    backup_dnsmasq_config_option "cachesize" "podkop_cachesize"
-
-    log "Configure dnsmasq for sing-box"
-    uci_add_list "dhcp" "@dnsmasq[0]" "server" "$SB_DNS_INBOUND_ADDRESS"
-    uci_set "dhcp" "@dnsmasq[0]" "noresolv" 1
-    uci_set "dhcp" "@dnsmasq[0]" "cachesize" 0
-    uci_commit "dhcp"
-
-    /etc/init.d/dnsmasq restart
-}
-
-dnsmasq_restore() {
-    log "Restoring the dnsmasq configuration"
-    local shutdown_correctly
-    config_get shutdown_correctly "settings" "shutdown_correctly"
-    if [ "$shutdown_correctly" -eq 1 ]; then
-        log "Previous shutdown of podkop was correct, reconfiguration of dnsmasq is not required"
-        return 0
-    fi
-
-    local cachesize noresolv backup_servers resolvfile
-    log "Restoring cachesize" "debug"
-    cachesize="$(uci_get "dhcp" "@dnsmasq[0]" "podkop_cachesize")"
-    if [ -z "$cachesize" ]; then
-        uci_remove "dhcp" "@dnsmasq[0]" "cachesize"
-        uci_set "dhcp" "@dnsmasq[0]" "cachesize" 150
-    else
-        uci_set "dhcp" "@dnsmasq[0]" "cachesize" "$cachesize"
-        uci_remove "dhcp" "@dnsmasq[0]" "podkop_cachesize"
-    fi
-
-    log "Restoring noresolv" "debug"
-    noresolv="$(uci_get "dhcp" "@dnsmasq[0]" "podkop_noresolv")"
-    if [ -z "$noresolv" ]; then
-        uci_set "dhcp" "@dnsmasq[0]" "noresolv" 0
-    else
-        uci_set "dhcp" "@dnsmasq[0]" "noresolv" "$noresolv"
-        uci_remove "dhcp" "@dnsmasq[0]" "podkop_noresolv"
-    fi
-
-    log "Restoring DNS servers" "debug"
-    uci_remove "dhcp" "@dnsmasq[0]" "server"
-    resolvfile="/tmp/resolv.conf.d/resolv.conf.auto"
-    backup_servers="$(uci_get "dhcp" "@dnsmasq[0]" "podkop_server")"
-    if [ -n "$backup_servers" ]; then
-        for server in $backup_servers; do
-            uci_add_list "dhcp" "@dnsmasq[0]" "server" "$server"
-        done
-        uci_remove "dhcp" "@dnsmasq[0]" "podkop_server"
-    elif file_exists "$resolvfile"; then
-        log "Backup DNS servers not found, using default resolvfile" "debug"
-        uci_set "dhcp" "@dnsmasq[0]" "resolvfile" "$resolvfile"
-        if [ -n "$noresolv" ] && [ "$noresolv" -eq 1 ]; then
-            log "Disabling noresolv option to use system resolvfile" "debug"
-            uci_set "dhcp" "@dnsmasq[0]" "noresolv" 0
-        fi
-    else
-        log "Backup DNS servers and default resolvfile not found, possible resolving issues" "warn"
-    fi
-
-    uci_commit "dhcp"
-
-    /etc/init.d/dnsmasq restart
-}
-
-add_cron_job() {
-    ## Future: make a check so that it doesn't recreate many times
-    local community_lists remote_domain_lists remote_subnet_lists update_interval
-    config_get community_lists "$section" "community_lists"
-    config_get remote_domain_lists "$section" "remote_domain_lists"
-    config_get remote_subnet_lists "$section" "remote_subnet_lists"
-    config_get update_interval "settings" "update_interval"
-
-    case "$update_interval" in
-    "1h")
-        cron_job="13 * * * * /usr/bin/podkop list_update"
-        ;;
-    "3h")
-        cron_job="13 */3 * * * /usr/bin/podkop list_update"
-        ;;
-    "12h")
-        cron_job="13 */12 * * * /usr/bin/podkop list_update"
-        ;;
-    "1d")
-        cron_job="13 9 * * * /usr/bin/podkop list_update"
-        ;;
-    "3d")
-        cron_job="13 9 */3 * * /usr/bin/podkop list_update"
-        ;;
-    *)
-        log "Invalid update_interval value: $update_interval"
-        return
-        ;;
-    esac
-
-    if [ -n "$community_lists" ] ||
-        [ -n "$remote_domain_lists" ] ||
-        [ -n "$remote_subnet_lists" ]; then
-        remove_cron_job
-        crontab -l | {
-            cat
-            echo "$cron_job"
-        } | crontab -
-        log "The cron job has been created: $cron_job"
-    fi
-}
-
-remove_cron_job() {
-    (crontab -l | grep -v "/usr/bin/podkop list_update") | crontab -
-    log "The cron job removed"
-}
-
-list_update() {
-    echolog "🔄 Starting lists update..."
-
-    local nslookup_timeout=3
-    local nslookup_attempts=10
-    local curl_timeout=5
-    local curl_attempts=10
-    local curl_max_timeout=10
-    local delay=3
-    local i
-
-    # DNS Check
-    for i in $(seq 1 $nslookup_attempts); do
-        if nslookup -timeout=$nslookup_timeout openwrt.org > /dev/null 2>&1; then
-            echolog "✅ DNS check passed"
-            break
-        fi
-        echolog "DNS is unavailable [$i/$nslookup_attempts]"
-        sleep $delay
-    done
-
-    if [ "$i" -eq $nslookup_attempts ]; then
-        echolog "❌ DNS check failed after $nslookup_attempts attempts"
-        return 1
-    fi
-
-    # Github Check
-    for i in $(seq 1 $curl_attempts); do
-        local service_proxy_address
-        service_proxy_address="$(get_service_proxy_address)"
-
-        if [ -n "$http_proxy_address" ]; then
-            if curl -s -x "http://$service_proxy_address" -m $curl_timeout https://github.com > /dev/null; then
-                echolog "✅ GitHub connection check passed (via proxy)"
-                break
-            fi
-        else
-            if curl -s -m $curl_timeout https://github.com > /dev/null; then
-                echolog "✅ GitHub connection check passed"
-                break
-            fi
-        fi
-
-        echolog "GitHub is unavailable [$i/$curl_attempts] (max-timeout=$curl_timeout)"
-        if [ "$curl_timeout" -lt $curl_max_timeout ]; then
-            curl_timeout=$((curl_timeout + 1))
-        fi
-        sleep $delay
-    done
-
-    if [ "$i" -eq $curl_attempts ]; then
-        echolog "❌ GitHub connection check failed after $curl_attempts attempts"
-        return 1
-    fi
-
-    echolog "📥 Downloading and processing lists..."
-
-    config_foreach import_community_subnet_lists "section"
-    config_foreach import_domains_from_remote_domain_lists "section"
-    config_foreach import_subnets_from_remote_subnet_lists "section"
-
-    if [ $? -eq 0 ]; then
-        echolog "✅ Lists update completed successfully"
-    else
-        echolog "❌ Lists update failed"
-    fi
-}
-
-# sing-box funcs
-sing_box_configure_service() {
-    local sing_box_enabled sing_box_user sing_box_config_path sing_box_conffile
-    sing_box_enabled="$(uci_get "sing-box" "main" "enabled")"
-    sing_box_user="$(uci_get "sing-box" "main" "user")"
-
-    if [ "$sing_box_enabled" -ne 1 ]; then
-        uci_set "sing-box" "main" "enabled" 1
-        uci_commit "sing-box"
-        log "sing-box service has been enabled"
-    fi
-
-    if [ "$sing_box_user" != "root" ]; then
-        uci_set "sing-box" "main" "user" "root"
-        uci_commit "sing-box"
-        log "sing-box service user has been changed to root"
-    fi
-
-    config_get sing_box_config_path "settings" "config_path"
-    sing_box_conffile="$(uci_get "sing-box" "main" "conffile")"
-    log "sing-box config path: $sing_box_config_path" "debug"
-    log "sing-box service conffile: $sing_box_conffile" "debug"
-    if [ "$sing_box_conffile" != "$sing_box_config_path" ]; then
-        uci_set "sing-box" "main" "conffile" "$sing_box_config_path"
-        uci_commit "sing-box"
-        log "Configuration file path has been set to $sing_box_config_path"
-    fi
-
-    [ -f /etc/rc.d/S99sing-box ] && log "Disable sing-box" && /etc/init.d/sing-box disable
-}
-
-sing_box_init_config() {
-    local config='{"log":{},"dns":{},"ntp":{},"certificate":{},"endpoints":[],"inbounds":[],"outbounds":[],"route":{},"services":[],"experimental":{}}'
-
-    sing_box_configure_log
-    sing_box_configure_inbounds
-    sing_box_configure_outbounds
-    sing_box_configure_dns
-    sing_box_configure_route
-    sing_box_configure_experimental
-    sing_box_additional_inbounds
-    sing_box_save_config
-}
-
-sing_box_configure_log() {
-    log "Configure the log section of a sing-box JSON configuration"
-
-    local log_level
-    config_get log_level "settings" "log_level" "warn"
-    config=$(sing_box_cm_configure_log "$config" false "$log_level" false)
-}
-
-sing_box_configure_inbounds() {
-    log "Configure the inbounds section of a sing-box JSON configuration"
-
-    config=$(
-        sing_box_cm_add_tproxy_inbound \
-            "$config" "$SB_TPROXY_INBOUND_TAG" "$SB_TPROXY_INBOUND_ADDRESS" "$SB_TPROXY_INBOUND_PORT" true true
-    )
-    config=$(
-        sing_box_cm_add_direct_inbound "$config" "$SB_DNS_INBOUND_TAG" "$SB_DNS_INBOUND_ADDRESS" "$SB_DNS_INBOUND_PORT"
-    )
-}
-
-sing_box_configure_outbounds() {
-    log "Configure the outbounds section of a sing-box JSON configuration"
-
-    config=$(sing_box_cm_add_direct_outbound "$config" "$SB_DIRECT_OUTBOUND_TAG")
-
-    config_foreach configure_outbound_handler "section"
-}
-
-configure_outbound_handler() {
-    local section="$1"
-
-    local connection_type
-    config_get connection_type "$section" "connection_type"
-    case "$connection_type" in
-    proxy)
-        log "Configuring outbound in proxy connection type for the $section section"
-        local proxy_config_type
-        config_get proxy_config_type "$section" "proxy_config_type"
-
-        case "$proxy_config_type" in
-        url)
-            log "Detected proxy configuration type: url" "debug"
-            local proxy_string udp_over_tcp
-            config_get proxy_string "$section" "proxy_string"
-            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
-
-            if [ -z "$proxy_string" ]; then
-                log "Proxy string is not set. Aborted." "fatal"
-                exit 1
-            fi
-            config=$(sing_box_cf_add_proxy_outbound "$config" "$section" "$proxy_string" "$udp_over_tcp")
-            ;;
-        outbound)
-            log "Detected proxy configuration type: outbound" "debug"
-            local json_outbound
-            config_get json_outbound "$section" "outbound_json"
-            config=$(sing_box_cf_add_json_outbound "$config" "$section" "$json_outbound")
-            ;;
-        selector)
-            log "Detected proxy configuration type: selector" "debug"
-            local selector_proxy_links udp_over_tcp i outbound_tags outbound_tag default_outbound
-            config_get selector_proxy_links "$section" "selector_proxy_links"
-            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
-
-            if [ -z "$selector_proxy_links" ]; then
-                log "URLTest proxy links is not set. Aborted." "fatal"
-                exit 1
-            fi
-
-            i=1
-            for link in $selector_proxy_links; do
-                config="$(sing_box_cf_add_proxy_outbound "$config" "$section-$i" "$link" "$udp_over_tcp")"
-                outbound_tag="$(get_outbound_tag_by_section "$section-$i")"
-                if [ -z "$outbound_tags" ]; then
-                    outbound_tags="$outbound_tag"
-                    default_outbound="$outbound_tag"
-                else
-                    outbound_tags="$outbound_tags,$outbound_tag"
-                fi
-                i=$((i + 1))
-            done
-
-            selector_tag="$(get_outbound_tag_by_section "$section")"
-            selector_outbounds="$(comma_string_to_json_array "$outbound_tags")"
-            config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" \
-                "$default_outbound")"
-            ;;
-        urltest)
-            log "Detected proxy configuration type: urltest" "debug"
-            local urltest_proxy_links udp_over_tcp i urltest_tag selector_tag outbound_tag outbound_tags \
-                urltest_outbounds selector_outbounds urltest_check_interval urltest_tolerance urltest_testing_url
-            config_get urltest_proxy_links "$section" "urltest_proxy_links"
-            config_get udp_over_tcp "$section" "enable_udp_over_tcp"
-            config_get urltest_check_interval "$section" "urltest_check_interval" "3m"
-            config_get urltest_tolerance "$section" "urltest_tolerance" 50
-            config_get urltest_testing_url "$section" "urltest_testing_url" "https://www.gstatic.com/generate_204"
-
-            if [ -z "$urltest_proxy_links" ]; then
-                log "URLTest proxy links is not set. Aborted." "fatal"
-                exit 1
-            fi
-
-            i=1
-            for link in $urltest_proxy_links; do
-                config="$(sing_box_cf_add_proxy_outbound "$config" "$section-$i" "$link" "$udp_over_tcp")"
-                outbound_tag="$(get_outbound_tag_by_section "$section-$i")"
-                if [ -z "$outbound_tags" ]; then
-                    outbound_tags="$outbound_tag"
-                else
-                    outbound_tags="$outbound_tags,$outbound_tag"
-                fi
-                i=$((i + 1))
-            done
-
-            urltest_tag="$(get_outbound_tag_by_section "$section-urltest")"
-            selector_tag="$(get_outbound_tag_by_section "$section")"
-            urltest_outbounds="$(comma_string_to_json_array "$outbound_tags")"
-            selector_outbounds="$(comma_string_to_json_array "$outbound_tags,$urltest_tag")"
-            config="$(sing_box_cm_add_urltest_outbound "$config" "$urltest_tag" "$urltest_outbounds" \
-                "$urltest_testing_url" "$urltest_check_interval" "$urltest_tolerance")"
-            config="$(sing_box_cm_add_selector_outbound "$config" "$selector_tag" "$selector_outbounds" "$urltest_tag")"
-            ;;
-        *)
-            log "Unknown proxy configuration type: '$proxy_config_type'. Aborted." "fatal"
-            exit 1
-            ;;
-        esac
-        ;;
-    vpn)
-        log "Configuring outbound in VPN connection type for the $section section"
-        local interface_name domain_resolver_enabled domain_resolver_dns_type domain_resolver_dns_server \
-            domain_resolver_dns_server_address outbound_tag domain_resolver_tag dns_domain_resolver
-
-        config_get interface_name "$section" "interface"
-        config_get domain_resolver_enabled "$section" "domain_resolver_enabled"
-        config_get domain_resolver_dns_type "$section" "domain_resolver_dns_type"
-        config_get domain_resolver_dns_server "$section" "domain_resolver_dns_server"
-
-        if [ -z "$interface_name" ]; then
-            log "VPN interface is not set. Aborted." "fatal"
-            exit 1
-        fi
-
-        local outbound_tag
-        outbound_tag="$(get_outbound_tag_by_section "$section")"
-
-        if [ "$domain_resolver_enabled" -eq 1 ]; then
-            domain_resolver_dns_server_address="$(url_get_host "$dns_server")"
-            if ! is_ipv4 "$domain_resolver_dns_server_address"; then
-                dns_domain_resolver=$SB_BOOTSTRAP_SERVER_TAG
-            fi
-            domain_resolver_tag="$(get_domain_resolver_tag "$section")"
-            config=$(sing_box_cf_add_dns_server "$config" "$domain_resolver_dns_type" "$domain_resolver_tag" \
-                "$domain_resolver_dns_server" "$dns_domain_resolver" "$outbound_tag")
-        fi
-
-        config=$(sing_box_cm_add_interface_outbound "$config" "$outbound_tag" "$interface_name" "$domain_resolver_tag")
-        ;;
-    block)
-        log "Connection type 'block' detected for the $section section – no outbound will be created (handled via reject route rules)"
-        ;;
-    exclusion)
-        log "Connection type 'exclusion' detected for the $section section – no outbound will be created (handled via route rules)"
-        ;;
-    *)
-        log "Unknown connection type '$connection_type' for the $section section. Aborted." "fatal"
-        exit 1
-        ;;
-    esac
-}
-
-sing_box_configure_dns() {
-    log "Configure the DNS section of a sing-box JSON configuration"
-    config=$(sing_box_cm_configure_dns "$config" "$SB_DNS_SERVER_TAG" "ipv4_only" true)
-
-    log "Adding DNS Servers" "debug"
-    local dns_type dns_server bootstrap_dns_server dns_domain_resolver dns_server_address
-    config_get dns_type "settings" "dns_type" "doh"
-    config_get dns_server "settings" "dns_server" "1.1.1.1"
-    config_get bootstrap_dns_server "settings" "bootstrap_dns_server" "77.88.8.8"
-
-    dns_server_address="$(url_get_host "$dns_server")"
-    if ! is_ipv4 "$dns_server_address"; then
-        dns_domain_resolver=$SB_BOOTSTRAP_SERVER_TAG
-    fi
-
-    config=$(sing_box_cm_add_udp_dns_server "$config" "$SB_BOOTSTRAP_SERVER_TAG" "$bootstrap_dns_server" 53)
-    config=$(sing_box_cf_add_dns_server "$config" "$dns_type" "$SB_DNS_SERVER_TAG" "$dns_server" "$dns_domain_resolver")
-    config=$(sing_box_cm_add_fakeip_dns_server "$config" "$SB_FAKEIP_DNS_SERVER_TAG" "$SB_FAKEIP_INET4_RANGE")
-
-    log "Adding DNS Rules"
-    local rewrite_ttl service_domains
-    config_get rewrite_ttl "settings" "dns_rewrite_ttl" "60"
-
-    config=$(sing_box_cm_add_dns_reject_rule "$config" "query_type" "HTTPS")
-    config=$(sing_box_cm_add_dns_reject_rule "$config" "domain_suffix" '"use-application-dns.net"')
-    config=$(sing_box_cm_add_dns_route_rule "$config" "$SB_FAKEIP_DNS_SERVER_TAG" "$SB_FAKEIP_DNS_RULE_TAG")
-    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rewrite_ttl" "$rewrite_ttl")
-    service_domains=$(comma_string_to_json_array "$FAKEIP_TEST_DOMAIN,$CHECK_PROXY_IP_DOMAIN")
-    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "domain" "$service_domains")
-}
-
-sing_box_configure_route() {
-    log "Configure the route section of a sing-box JSON configuration"
-
-    local output_network_interface
-    config_get output_network_interface "settings" "output_network_interface"
-    if [ -z "$output_network_interface" ]; then
-        config=$(sing_box_cm_configure_route "$config" "$SB_DIRECT_OUTBOUND_TAG" true "$SB_DNS_SERVER_TAG")
-    else
-        config=$(sing_box_cm_configure_route "$config" "$SB_DIRECT_OUTBOUND_TAG" false "$SB_DNS_SERVER_TAG" \
-            "$output_network_interface")
-    fi
-
-    local sniff_inbounds
-    sniff_inbounds=$(comma_string_to_json_array "$SB_TPROXY_INBOUND_TAG,$SB_DNS_INBOUND_TAG")
-    config=$(sing_box_cm_sniff_route_rule "$config" "inbound" "$sniff_inbounds")
-
-    config=$(sing_box_cm_add_hijack_dns_route_rule "$config" "protocol" "dns")
-
-    local disable_quic
-    config_get_bool disable_quic "settings" "disable_quic" 0
-    if [ "$disable_quic" -eq 1 ]; then
-        config=$(sing_box_cf_add_single_key_reject_rule "$config" "$SB_TPROXY_INBOUND_TAG" "protocol" "quic")
-    fi
-
-    local first_outbound_section
-    first_outbound_section="$(get_first_outbound_section)"
-    first_outbound_tag="$(get_outbound_tag_by_section "$first_outbound_section")"
-    config=$(sing_box_cf_proxy_domain "$config" "$SB_TPROXY_INBOUND_TAG" "$CHECK_PROXY_IP_DOMAIN" "$first_outbound_tag")
-    config=$(sing_box_cf_override_domain_port "$config" "$FAKEIP_TEST_DOMAIN" 8443)
-
-    configure_common_reject_route_rule
-    configure_common_direct_route_rule
-
-    local routing_excluded_ips
-    config_get routing_excluded_ips "settings" "routing_excluded_ips"
-    if [ -n "$routing_excluded_ips" ]; then
-        rule_tag="$(gen_id)"
-        config=$(sing_box_cm_add_route_rule "$config" "$rule_tag" "$SB_TPROXY_INBOUND_TAG" "$SB_DIRECT_OUTBOUND_TAG")
-        config_list_foreach "settings" "routing_excluded_ips" exclude_source_ip_from_routing_handler "$rule_tag"
-    fi
-
-    config_foreach include_source_ips_in_routing_handler "section"
-
-    config_foreach configure_routing_for_section_lists "section"
-}
-
-include_source_ips_in_routing_handler() {
-    local section="$1"
-
-    local fully_routed_ips rule_tag
-    config_get fully_routed_ips "$section" "fully_routed_ips"
-    if [ -n "$fully_routed_ips" ]; then
-        rule_tag="$(gen_id)"
-        config=$(
-            sing_box_cm_add_route_rule \
-                "$config" "$rule_tag" "$SB_TPROXY_INBOUND_TAG" "$(get_outbound_tag_by_section "$section")"
-        )
-        config_list_foreach "$section" "fully_routed_ips" include_source_ip_in_routing_handler "$rule_tag"
-    fi
-}
-
-configure_common_reject_route_rule() {
-    local block_sections block_section_lists_enabled
-    block_sections="$(get_sections_by_connection_type "block")"
-    block_section_lists_enabled=0
-
-    if [ -n "$block_sections" ]; then
-        for block_section in $block_sections; do
-            if section_has_enabled_lists "$block_section"; then
-                block_section_lists_enabled=1
-                break
-            fi
-        done
-        if [ "$block_section_lists_enabled" -eq 1 ]; then
-            config=$(sing_box_cm_add_reject_route_rule "$config" "$SB_REJECT_RULE_TAG" "$SB_TPROXY_INBOUND_TAG")
-        else
-            log "Block sections does not have any enabled list, reject rule is not required" "warn"
-        fi
-    fi
-}
-
-configure_common_direct_route_rule() {
-    local exclusion_sections exclusion_section_list_enabled
-    exclusion_sections="$(get_sections_by_connection_type "exclusion")"
-    exclusion_section_list_enabled=0
-
-    if [ -n "$exclusion_sections" ]; then
-        for exclusion_section in $exclusion_sections; do
-            if section_has_enabled_lists "$exclusion_section"; then
-                exclusion_section_list_enabled=1
-                break
-            fi
-        done
-        if [ "$exclusion_section_list_enabled" -eq 1 ]; then
-            config=$(sing_box_cm_add_route_rule "$config" "$SB_EXCLUSION_RULE_TAG" "$SB_TPROXY_INBOUND_TAG" \
-                "$SB_DIRECT_OUTBOUND_TAG")
-        else
-            log "Exclusion sections does not have any enabled list, route rule is not required" "warn"
-        fi
-    fi
-}
-
-include_source_ip_in_routing_handler() {
-    local source_ip="$1"
-    local rule_tag="$2"
-    nft_list_all_traffic_from_ip "$source_ip"
-    config=$(sing_box_cm_patch_route_rule "$config" "$rule_tag" "source_ip_cidr" "$source_ip")
-}
-
-exclude_source_ip_from_routing_handler() {
-    local source_ip="$1"
-    local rule_tag="$2"
-
-    config=$(sing_box_cm_patch_route_rule "$config" "$rule_tag" "source_ip_cidr" "$source_ip")
-}
-
-configure_routing_for_section_lists() {
-    local section="$1"
-
-    log "Configuring routing for '$section' section"
-    if ! section_has_enabled_lists "$section"; then
-        log "Section '$section' does not have any enabled list, skipping..." "warn"
-        return 0
-    fi
-
-    local community_lists user_domain_list_type user_subnet_list_type local_domain_lists local_subnet_lists \
-        remote_domain_lists remote_subnet_lists section_connection_type route_rule_tag resolve_real_ip_for_routing
-    config_get community_lists "$section" "community_lists"
-    config_get user_domain_list_type "$section" "user_domain_list_type" "disabled"
-    config_get user_subnet_list_type "$section" "user_subnet_list_type" "disabled"
-    config_get local_domain_lists "$section" "local_domain_lists"
-    config_get local_subnet_lists "$section" "local_subnet_lists"
-    config_get remote_domain_lists "$section" "remote_domain_lists"
-    config_get remote_subnet_lists "$section" "remote_subnet_lists"
-    config_get section_connection_type "$section" "connection_type"
-    config_get_bool resolve_real_ip_for_routing "$section" "resolve_real_ip_for_routing" 0
-
-    case "$section_connection_type" in
-    proxy | vpn)
-        route_rule_tag="$(gen_id)"
-        outbound_tag=$(get_outbound_tag_by_section "$section")
-        config=$(sing_box_cm_add_route_rule "$config" "$route_rule_tag" "$SB_TPROXY_INBOUND_TAG" "$outbound_tag")
-        ;;
-    block)
-        route_rule_tag="$SB_REJECT_RULE_TAG"
-        ;;
-    exclusion)
-        route_rule_tag="$SB_EXCLUSION_RULE_TAG"
-        ;;
-    *)
-        log "Unsupported '$section_connection_type' connection type. Skipping routing for '$section' section" "fatal"
-        exit 1
-        ;;
-    esac
-
-    if [ -n "$community_lists" ]; then
-        log "Processing community list routing rules for '$section' section"
-        config_list_foreach "$section" "community_lists" configure_community_list_handler "$section" "$route_rule_tag"
-    fi
-
-    if [ "$user_domain_list_type" != "disabled" ]; then
-        log "Processing user domains routing rules for '$section' section"
-        configure_user_domain_list "$section" "$route_rule_tag"
-    fi
-
-    if [ "$user_subnet_list_type" != "disabled" ]; then
-        log "Processing user subnets routing rules for '$section' section"
-        configure_user_subnet_list "$section" "$route_rule_tag"
-    fi
-
-    if [ -n "$local_domain_lists" ]; then
-        log "Processing local domains routing rules for '$section' section"
-        configure_local_domain_lists "$section" "$route_rule_tag"
-    fi
-
-    if [ -n "$local_subnet_lists" ]; then
-        log "Processing local subnets routing rules for '$section' section"
-        configure_local_subnet_lists "$section" "$route_rule_tag"
-    fi
-
-    if [ -n "$remote_domain_lists" ]; then
-        log "Processing remote domains routing rules for '$section' section"
-        config_list_foreach "$section" "remote_domain_lists" configure_remote_domain_or_subnet_list_handler \
-            "domains" "$section" "$route_rule_tag"
-    fi
-
-    if [ -n "$remote_subnet_lists" ]; then
-        log "Processing remote subnets routing rules for '$section' section"
-        config_list_foreach "$section" "remote_subnet_lists" configure_remote_domain_or_subnet_list_handler \
-            "subnets" "$section" "$route_rule_tag"
-    fi
-
-    if [ "$resolve_real_ip_for_routing" -eq 1 ]; then
-        config=$(sing_box_cm_add_resolve_rule "$config" "$route_rule_tag" "$(gen_id)" "$SB_DNS_SERVER_TAG")
-        log "Added resolve rule for '$section' section" "debug"
-    fi
-}
-
-configure_community_list_handler() {
-    local tag="$1"
-    local section="$2"
-    local route_rule_tag="$3"
-
-    local ruleset_tag format url update_interval detour
-    ruleset_tag="$(get_ruleset_tag "$section" "$tag" "community")"
-    format="binary"
-    url="$SRS_MAIN_URL/$tag.srs"
-    detour="$(get_download_detour_tag)"
-    config_get update_interval "settings" "update_interval" "1d"
-
-    config=$(sing_box_cm_add_remote_ruleset "$config" "$ruleset_tag" "$format" "$url" "$detour" "$update_interval")
-    config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
-    config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
-}
-
-prepare_source_ruleset() {
-    local section="$1"
-    local name="$2"
-    local type="$3"
-    local route_rule_tag="$4"
-
-    log "Preparing a $name $type rule set for '$section' section" "debug"
-    ruleset_tag=$(get_ruleset_tag "$section" "$name" "$type")
-    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
-    create_source_rule_set "$ruleset_filepath"
-    case $? in
-    0)
-        config=$(sing_box_cm_add_local_ruleset "$config" "$ruleset_tag" "source" "$ruleset_filepath")
-        config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
-        case "$type" in
-        domains)
-            config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
-            ;;
-        subnets) ;;
-        *)
-            log "Unsupported remote rule set type: $type" "error"
-            return 1
-            ;;
-        esac
-        ;;
-    3) log "Source rule set $ruleset_filepath already exists, skipping." "debug" ;;
-    esac
-}
-
-configure_user_domain_list() {
-    local section="$1"
-    local route_rule_tag="$2"
-
-    prepare_source_ruleset "$section" "user" "domains" "$route_rule_tag"
-
-    local user_domain_list_type items json_array
-    config_get user_domain_list_type "$section" "user_domain_list_type"
-    case "$user_domain_list_type" in
-    dynamic) config_get items "$section" "user_domains" ;;
-    text) config_get items "$section" "user_domains_text" ;;
-    esac
-
-    items="$(parse_domain_or_subnet_string_to_commas_string "$items" "domains")"
-    json_array="$(comma_string_to_json_array "$items")"
-    patch_source_ruleset_rules "$ruleset_filepath" "domain_suffix" "$json_array"
-}
-
-configure_user_subnet_list() {
-    local section="$1"
-    local route_rule_tag="$2"
-
-    prepare_source_ruleset "$section" "user" "subnets" "$route_rule_tag"
-
-    local user_subnet_list_type items json_array
-    config_get user_subnet_list_type "$section" "user_subnet_list_type"
-    case "$user_subnet_list_type" in
-    dynamic) config_get items "$section" "user_subnets" ;;
-    text) config_get items "$section" "user_subnets_text" ;;
-    esac
-
-    items="$(parse_domain_or_subnet_string_to_commas_string "$items" "subnets")"
-    json_array="$(comma_string_to_json_array "$items")"
-    patch_source_ruleset_rules "$ruleset_filepath" "ip_cidr" "$json_array"
-    nft_add_set_elements "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME" "$items"
-}
-
-configure_local_domain_lists() {
-    local section="$1"
-    local route_rule_tag="$2"
-
-    prepare_source_ruleset "$section" "local" "domains" "$route_rule_tag"
-
-    config_list_foreach "$section" "local_domain_lists" import_local_domain_list_handler "$ruleset_filepath"
-}
-
-import_local_domain_list_handler() {
-    local local_domain_list_filepath="$1"
-    local ruleset_filepath="$2"
-
-    if ! file_exists "$local_domain_list_filepath"; then
-        log "Local domain list file $local_domain_list_filepath not found" "error"
-        return 1
-    fi
-
-    import_plain_domain_list_to_local_source_ruleset_chunked "$local_domain_list_filepath" "$ruleset_filepath"
-}
-
-configure_local_subnet_lists() {
-    local section="$1"
-    local route_rule_tag="$2"
-
-    prepare_source_ruleset "$section" "local" "subnets" "$route_rule_tag"
-
-    config_list_foreach "$section" "local_subnet_lists" import_local_subnets_list_handler "$ruleset_filepath"
-}
-
-import_local_subnets_list_handler() {
-    local local_subnet_list_filepath="$1"
-    local ruleset_filepath="$2"
-
-    if ! file_exists "$local_subnet_list_filepath"; then
-        log "Local subnet list file $local_subnet_list_filepath not found" "error"
-        return 1
-    fi
-
-    import_plain_subnet_list_to_local_source_ruleset_chunked "$local_subnet_list_filepath" "$ruleset_filepath"
-    nft_add_set_elements_from_file_chunked "$local_subnet_list_filepath" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-}
-
-configure_remote_domain_or_subnet_list_handler() {
-    local url="$1"
-    local type="$2"
-    local section="$3"
-    local route_rule_tag="$4"
-
-    local file_extension
-    file_extension=$(url_get_file_extension "$url")
-    log "Detected file extension: '$file_extension'" "debug"
-    case "$file_extension" in
-    json | srs)
-        log "Creating a remote $type ruleset from the source URL" "info"
-        local basename ruleset_tag format detour update_interval
-        basename=$(url_get_basename "$url")
-        ruleset_tag=$(get_ruleset_tag "$section" "$basename" "remote-$type")
-        format="$(get_ruleset_format_by_file_extension "$file_extension")"
-        detour="$(get_download_detour_tag)"
-        config_get update_interval "settings" "update_interval" "1d"
-
-        config=$(sing_box_cm_add_remote_ruleset "$config" "$ruleset_tag" "$format" "$url" "$detour" "$update_interval")
-        config=$(sing_box_cm_patch_route_rule "$config" "$route_rule_tag" "rule_set" "$ruleset_tag")
-        case "$type" in
-        domains)
-            config=$(sing_box_cm_patch_dns_route_rule "$config" "$SB_FAKEIP_DNS_RULE_TAG" "rule_set" "$ruleset_tag")
-            ;;
-        subnets) ;;
-        *) log "Unsupported remote rule set type: $type" "error" ;;
-        esac
-        ;;
-    *)
-        prepare_source_ruleset "$section" "remote" "$type" "$route_rule_tag"
-        ;;
-    esac
-}
-
-sing_box_configure_experimental() {
-    log "Configure the experimental section of a sing-box JSON configuration"
-
-    log "Configuring cache database"
-    local cache_file
-    config_get cache_file "settings" "cache_path" "/tmp/sing-box/cache.db"
-    config=$(sing_box_cm_configure_cache_file "$config" true "$cache_file" true)
-
-    log "Configuring Clash API"
-    local enable_yacd enable_yacd_wan_access clash_api_controller_address
-    config_get_bool enable_yacd "settings" "enable_yacd" 0
-    config_get_bool enable_yacd_wan_access "settings" "enable_yacd_wan_access" 0
-
-    if [ "$enable_yacd" -eq 1 ] && [ "$enable_yacd_wan_access" -eq 1 ]; then
-        clash_api_controller_address="0.0.0.0"
-    else
-        clash_api_controller_address="$(get_service_listen_address)"
-        if [ -z "$clash_api_controller_address" ]; then
-            log "Could not determine the listening IP address for the Clash API controller. It will run only on localhost." "warn"
-            clash_api_controller_address="127.0.0.1"
-        fi
-    fi
-
-    if [ "$enable_yacd" -eq 1 ]; then
-        log "YACD is enabled, enabling Clash API with downloadable YACD" "debug"
-        local yacd_secret_key external_controller_ui
-        config_get yacd_secret_key "settings" "yacd_secret_key"
-        external_controller_ui="ui"
-
-        config=$(
-            sing_box_cm_configure_clash_api \
-                "$config" \
-                "$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT" \
-                "$external_controller_ui" \
-                "$yacd_secret_key"
-        )
-    else
-        log "YACD is disabled, enabling Clash API in online mode" "debug"
-        config=$(
-            sing_box_cm_configure_clash_api "$config" "$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT"
-        )
-    fi
-}
-
-sing_box_additional_inbounds() {
-    log "Configure the additional inbounds of a sing-box JSON configuration"
-
-    local download_lists_via_proxy
-    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
-    if [ "$download_lists_via_proxy" -eq 1 ]; then
-        local download_lists_via_proxy_section section_outbound_tag
-        config_get download_lists_via_proxy_section "settings" "download_lists_via_proxy_section"
-        section_outbound_tag="$(get_outbound_tag_by_section "$download_lists_via_proxy_section")"
-        config=$(
-            sing_box_cf_add_mixed_inbound_and_route_rule \
-                "$config" \
-                "$SB_SERVICE_MIXED_INBOUND_TAG" \
-                "$SB_SERVICE_MIXED_INBOUND_ADDRESS" \
-                "$SB_SERVICE_MIXED_INBOUND_PORT" \
-                "$section_outbound_tag"
-        )
-    fi
-
-    config_foreach configure_section_mixed_proxy "section"
-}
-
-configure_section_mixed_proxy() {
-    local section="$1"
-
-    local mixed_inbound_enabled mixed_proxy_port mixed_inbound_tag mixed_outbound_tag mixed_proxy_address
-    config_get_bool mixed_inbound_enabled "$section" "mixed_proxy_enabled" 0
-    mixed_proxy_address="$(get_service_listen_address)"
-    if [ -z "$mixed_proxy_address" ]; then
-        log "Could not determine the listening IP address for the Mixed Proxy. The proxy will not be created." "warn"
-        return 1
-    fi
-    config_get mixed_proxy_port "$section" "mixed_proxy_port"
-    if [ "$mixed_inbound_enabled" -eq 1 ]; then
-        mixed_inbound_tag="$(get_inbound_tag_by_section "$section-mixed")"
-        mixed_outbound_tag="$(get_outbound_tag_by_section "$section")"
-        config=$(
-            sing_box_cf_add_mixed_inbound_and_route_rule \
-                "$config" \
-                "$mixed_inbound_tag" \
-                "$mixed_proxy_address" \
-                "$mixed_proxy_port" \
-                "$mixed_outbound_tag"
-        )
-    fi
-}
-
-sing_box_save_config() {
-    local sing_box_config_path temp_file_path current_config_hash temp_config_hash
-    config_get sing_box_config_path "settings" "config_path"
-    temp_file_path="$(mktemp)"
-
-    log "Save sing-box temporary config to $temp_file_path" "debug"
-    sing_box_cm_save_config_to_file "$config" "$temp_file_path"
-
-    sing_box_config_check "$temp_file_path"
-
-    current_config_hash=$(md5sum "$sing_box_config_path" 2> /dev/null | awk '{print $1}')
-    temp_config_hash=$(md5sum "$temp_file_path" | awk '{print $1}')
-    log "Current sing-box config hash: $current_config_hash" "debug"
-    log "Temporary sing-box config hash: $temp_config_hash" "debug"
-    if [ "$current_config_hash" != "$temp_config_hash" ]; then
-        log "sing-box configuration has changed and will be updated"
-        mv "$temp_file_path" "$sing_box_config_path"
-    else
-        log "sing-box configuration is unchanged"
-        rm "$temp_file_path"
-    fi
-}
-
-sing_box_config_check() {
-    local config_path="$1"
-
-    if ! sing-box -c "$config_path" check > /dev/null 2>&1; then
-        log "Sing-box configuration $config_path is invalid. Aborted." "fatal"
-        exit 1
-    fi
-}
-
-import_community_subnet_lists() {
-    local section="$1"
-    local community_lists
-    config_get community_lists "$section" "community_lists"
-    if [ -n "$community_lists" ]; then
-        log "Importing community subnet lists for '$section' section"
-        config_list_foreach "$section" "community_lists" import_community_service_subnet_list_handler
-    fi
-}
-
-import_community_service_subnet_list_handler() {
-    local service="$1"
-
-    case "$service" in
-    "twitter")
-        URL=$SUBNETS_TWITTER
-        ;;
-    "meta")
-        URL=$SUBNETS_META
-        ;;
-    "telegram")
-        URL=$SUBNETS_TELERAM
-        ;;
-    "cloudflare")
-        URL=$SUBNETS_CLOUDFLARE
-        ;;
-    "hetzner")
-        URL=$SUBNETS_HETZNER
-        ;;
-    "ovh")
-        URL=$SUBNETS_OVH
-        ;;
-    "digitalocean")
-        URL=$SUBNETS_DIGITALOCEAN
-        ;;
-    "cloudfront")
-        URL=$SUBNETS_CLOUDFRONT
-        ;;
-    "discord")
-        URL=$SUBNETS_DISCORD
-        nft_create_ipv4_set "$NFT_TABLE_NAME" "$NFT_DISCORD_SET_NAME"
-        nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr \
-            "@$NFT_DISCORD_SET_NAME" udp dport '{ 19000-20000, 50000-65535 }' meta mark set "$NFT_FAKEIP_MARK" counter
-        ;;
-    "roblox")
-        URL=$SUBNETS_ROBLOX
-        ;;
-    *) return 0 ;;
-    esac
-
-    local tmpfile http_proxy_address
-    tmpfile=$(mktemp)
-    http_proxy_address="$(get_service_proxy_address)"
-
-    download_to_file "$URL" "$tmpfile" "$http_proxy_address"
-
-    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
-        log "Download $service list failed" "error"
-        return 1
-    fi
-
-    if [ "$service" = "discord" ]; then
-        nft_add_set_elements_from_file_chunked "$tmpfile" "$NFT_TABLE_NAME" "$NFT_DISCORD_SET_NAME"
-    else
-        nft_add_set_elements_from_file_chunked "$tmpfile" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-    fi
-
-    rm -f "$tmpfile"
-}
-
-import_domains_from_remote_domain_lists() {
-    local section="$1"
-    local remote_domain_lists
-    config_get remote_domain_lists "$section" "remote_domain_lists"
-    if [ -n "$remote_domain_lists" ]; then
-        log "Importing domains from remote domain lists for '$section' section"
-        config_list_foreach "$section" "remote_domain_lists" import_domains_from_remote_domain_list_handler "$section"
-    fi
-}
-
-import_domains_from_remote_domain_list_handler() {
-    local url="$1"
-    local section="$2"
-
-    log "Importing domains from URL: $url"
-
-    local file_extension
-    file_extension=$(url_get_file_extension "$url")
-    log "Detected file extension: '$file_extension'" "debug"
-    case "$file_extension" in
-    json | srs)
-        log "No update needed - sing-box manages updates automatically."
-        ;;
-    *)
-        log "Import domains from a remote plain-text list"
-        import_domains_from_remote_plain_file "$url" "$section"
-        ;;
-    esac
-}
-
-import_domains_from_remote_plain_file() {
-    local url="$1"
-    local section="$2"
-
-    local tmpfile http_proxy_address items json_array
-    tmpfile=$(mktemp)
-    http_proxy_address="$(get_service_proxy_address)"
-
-    download_to_file "$url" "$tmpfile" "$http_proxy_address"
-
-    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
-        log "Download $url list failed" "error"
-        return 1
-    fi
-
-    convert_crlf_to_lf "$tmpfile"
-    ruleset_tag=$(get_ruleset_tag "$section" "remote" "domains")
-    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
-    import_plain_domain_list_to_local_source_ruleset_chunked "$tmpfile" "$ruleset_filepath"
-
-    rm -f "$tmpfile"
-}
-
-import_subnets_from_remote_subnet_lists() {
-    local section="$1"
-    local remote_subnet_lists
-    config_get remote_subnet_lists "$section" "remote_subnet_lists"
-    if [ -n "$remote_subnet_lists" ]; then
-        log "Importing subnets from remote subnet lists for '$section' section"
-        config_list_foreach "$section" "remote_subnet_lists" import_subnets_from_remote_subnet_list_handler "$section"
-    fi
-}
-
-import_subnets_from_remote_subnet_list_handler() {
-    local url="$1"
-    local section="$2"
-
-    log "Importing subnets from URL: $url"
-
-    local file_extension
-    file_extension="$(url_get_file_extension "$url")"
-    log "Detected file extension: '$file_extension'" "debug"
-    case "$file_extension" in
-    json)
-        log "Import subnets from a remote JSON list" "info"
-        import_subnets_from_remote_json_file "$url"
-        ;;
-    srs)
-        log "Import subnets from a remote SRS list" "info"
-        import_subnets_from_remote_srs_file "$url"
-        ;;
-    *)
-        log "Import subnets from a remote plain-text list" "info"
-        import_subnets_from_remote_plain_file "$url" "$section"
-        ;;
-    esac
-}
-
-import_subnets_from_remote_json_file() {
-    local url="$1"
-    local json_tmpfile subnets_tmpfile http_proxy_address
-    json_tmpfile="$(mktemp)"
-    subnets_tmpfile="$(mktemp)"
-    http_proxy_address="$(get_service_proxy_address)"
-
-    download_to_file "$url" "$json_tmpfile" "$http_proxy_address"
-
-    if [ $? -ne 0 ] || [ ! -s "$json_tmpfile" ]; then
-        log "Download $url list failed" "error"
-        return 1
-    fi
-
-    extract_ip_cidr_from_json_ruleset_to_file "$json_tmpfile" "$subnets_tmpfile"
-    nft_add_set_elements_from_file_chunked "$subnets_tmpfile" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-    rm -f "$json_tmpfile" "$subnets_tmpfile"
-}
-
-import_subnets_from_remote_srs_file() {
-    local url="$1"
-
-    local binary_tmpfile json_tmpfile subnets_tmpfile http_proxy_address
-    binary_tmpfile="$(mktemp)"
-    json_tmpfile="$(mktemp)"
-    subnets_tmpfile="$(mktemp)"
-    http_proxy_address="$(get_service_proxy_address)"
-
-    download_to_file "$url" "$binary_tmpfile" "$http_proxy_address"
-
-    if [ $? -ne 0 ] || [ ! -s "$binary_tmpfile" ]; then
-        log "Download $url list failed" "error"
-        return 1
-    fi
-
-    if ! decompile_binary_ruleset "$binary_tmpfile" "$json_tmpfile"; then
-        log "Failed to decompile binary rule set file" "error"
-        return 1
-    fi
-
-    extract_ip_cidr_from_json_ruleset_to_file "$json_tmpfile" "$subnets_tmpfile"
-    nft_add_set_elements_from_file_chunked "$subnets_tmpfile" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-    rm -f "$binary_tmpfile" "$json_tmpfile" "$subnets_tmpfile"
-}
-
-import_subnets_from_remote_plain_file() {
-    local url="$1"
-    local section="$2"
-
-    local tmpfile http_proxy_address items json_array
-    tmpfile=$(mktemp)
-    http_proxy_address="$(get_service_proxy_address)"
-
-    download_to_file "$url" "$tmpfile" "$http_proxy_address"
-
-    if [ $? -ne 0 ] || [ ! -s "$tmpfile" ]; then
-        log "Download $url list failed" "error"
-        return 1
-    fi
-
-    convert_crlf_to_lf "$tmpfile"
-
-    ruleset_tag=$(get_ruleset_tag "$section" "remote" "subnets")
-    ruleset_filepath="$TMP_RULESET_FOLDER/$ruleset_tag.json"
-    import_plain_subnet_list_to_local_source_ruleset_chunked "$tmpfile" "$ruleset_filepath"
-    nft_add_set_elements_from_file_chunked "$tmpfile" "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME"
-
-    rm -f "$tmpfile"
-}
-
-## Support functions
-get_service_proxy_address() {
-    local download_lists_via_proxy
-    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
-    if [ "$download_lists_via_proxy" -eq 1 ]; then
-        echo "$SB_SERVICE_MIXED_INBOUND_ADDRESS:$SB_SERVICE_MIXED_INBOUND_PORT"
-    else
-        echo ""
-    fi
-}
-
-get_download_detour_tag() {
-    config_get_bool download_lists_via_proxy "settings" "download_lists_via_proxy" 0
-    if [ "$download_lists_via_proxy" -eq 1 ]; then
-        local download_lists_via_proxy_section section_outbound_tag
-        config_get download_lists_via_proxy_section "settings" "download_lists_via_proxy_section"
-        section_outbound_tag="$(get_outbound_tag_by_section "$download_lists_via_proxy_section")"
-        echo "$section_outbound_tag"
-    else
-        echo ""
-    fi
-}
-
-_determine_first_outbound_section() {
-    local section="$1"
-
-    local connection_type
-    config_get connection_type "$section" "connection_type"
-
-    if [ "$connection_type" = "proxy" ] || [ "$connection_type" = "vpn" ]; then
-        [ -z "$first_section" ] && first_section="$1"
-    fi
-}
-
-get_first_outbound_section() {
-    local first_section=""
-
-    config_foreach _determine_first_outbound_section "section"
-
-    echo "$first_section"
-}
-
-get_sections_by_connection_type() {
-    local connection_type="$1"
-
-    uci show podkop | grep "\.connection_type='$connection_type'" | cut -d'.' -f2
-}
-
-section_by_connection_type_exists() {
-    local connection_type="$1"
-
-    if uci show podkop | grep -q "\.connection_type='$connection_type'"; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-section_has_enabled_lists() {
-    local section="$1"
-    local community_lists user_domain_list_type user_subnet_list_type local_domain_lists local_subnet_lists \
-        remote_domain_lists remote_subnet_lists
-
-    config_get community_lists "$section" "community_lists"
-    config_get user_domain_list_type "$section" "user_domain_list_type" "disabled"
-    config_get user_subnet_list_type "$section" "user_subnet_list_type" "disabled"
-    config_get local_domain_lists "$section" "local_domain_lists"
-    config_get local_subnet_lists "$section" "local_subnet_lists"
-    config_get remote_domain_lists "$section" "remote_domain_lists"
-    config_get remote_subnet_lists "$section" "remote_subnet_lists"
-
-    if [ -n "$community_lists" ] ||
-        [ "$user_domain_list_type" != "disabled" ] ||
-        [ "$user_subnet_list_type" != "disabled" ] ||
-        [ -n "$local_domain_lists" ] ||
-        [ -n "$local_subnet_lists" ] ||
-        [ -n "$remote_domain_lists" ] ||
-        [ -n "$remote_subnet_lists" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-get_service_listen_address() {
-    local service_listen_address
-
-    config_get service_listen_address "settings" "service_listen_address"
-    if [ -n "$service_listen_address" ]; then
-        log "Attention! The service_listen_address option is being used, overriding the automatic detection of the listening IP address!" "warn"
-        echo "$service_listen_address"
-        return 0
-    fi
-
-    local interface="lan"
-    network_get_ipaddr service_listen_address "$interface"
-
-    if [ -z "$service_listen_address" ]; then
-        log "Failed to determine the listening IP address. Please open an issue to report this problem: https://github.com/itdoginfo/podkop/issues" "error"
-        return 1
-    fi
-
-    echo "$service_listen_address"
-}
-
-## nftables
-nft_list_all_traffic_from_ip() {
-    local ip="$1"
-
-    if ! nft list chain inet "$NFT_TABLE_NAME" mangle | grep -q "ip saddr $ip"; then
-        nft insert rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip saddr "$ip" \
-            meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
-        nft insert rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip saddr "$ip" \
-            meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
-        nft insert rule inet "$NFT_TABLE_NAME" mangle ip saddr "$ip" ip daddr @localv4 return
-    fi
-}
-
-# Diagnotics
-check_proxy() {
-    local sing_box_config_path
-    config_get sing_box_config_path "settings" "config_path"
-
-    if ! command -v sing-box > /dev/null 2>&1; then
-        nolog "sing-box is not installed"
-        return 1
-    fi
-
-    if [ ! -f "$sing_box_config_path" ]; then
-        nolog "Configuration file not found"
-        return 1
-    fi
-
-    nolog "Checking sing-box configuration..."
-
-    if ! sing-box -c "$sing_box_config_path" check > /dev/null; then
-        nolog "Invalid configuration"
-        return 1
-    fi
-
-    jq '
-    walk(
-        if type == "object" then
-            with_entries(
-                if .key == "uuid" then
-                    .value = "MASKED"
-                elif .key == "server" then
-                    .value = "MASKED"
-                elif .key == "server_name" then
-                    .value = "MASKED"
-                elif .key == "password" then
-                    .value = "MASKED"
-                elif .key == "public_key" then
-                    .value = "MASKED"
-                elif .key == "short_id" then
-                    .value = "MASKED"
-                elif .key == "fingerprint" then
-                    .value = "MASKED"
-                elif .key == "server_port" then
-                    .value = "MASKED"
-                else . end
-            )
-        else . end
-    )' "$sing_box_config_path"
-
-    nolog "Checking proxy connection..."
-
-    for attempt in $(seq 1 5); do
-        response=$(sing-box tools fetch ifconfig.me -D /etc/sing-box 2> /dev/null)
-        if echo "$response" | grep -q "^<html\|403 Forbidden"; then
-            continue
-        fi
-        if [[ $response =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            ip=$(echo "$response" | sed -n 's/^[0-9]\+\.[0-9]\+\.[0-9]\+\.\([0-9]\+\)$/X.X.X.\1/p')
-            nolog "$ip - should match proxy IP"
-            return 0
-        elif echo "$response" | grep -q "^[0-9a-fA-F:]*::[0-9a-fA-F:]*$\|^[0-9a-fA-F:]\+$"; then
-            ip=$(echo "$response" | sed 's/\([0-9a-fA-F]\+:[0-9a-fA-F]\+:[0-9a-fA-F]\+\):.*/\1:XXXX:XXXX:XXXX/')
-            nolog "$ip - should match proxy IP"
-            return 0
-        fi
-        if [ $attempt -eq 5 ]; then
-            nolog "Failed to get valid IP address after 5 attempts"
-            if [ -z "$response" ]; then
-                nolog "Error: Empty response"
-            else
-                nolog "Error response: $response"
-            fi
-            return 1
-        fi
-    done
-}
-
-check_nft() {
-    if ! command -v nft > /dev/null 2>&1; then
-        nolog "nft is not installed"
-        return 1
-    fi
-
-    nolog "Checking $NFT_TABLE_NAME rules..."
-
-    # Check if table exists
-    if ! nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
-        nolog "❌ $NFT_TABLE_NAME not found"
-        return 1
-    fi
-
-    local found_hetzner=0
-    local found_ovh=0
-
-    check_domain_list_contains() {
-        local section="$1"
-
-        config_get_bool domain_list_enabled "$section" "domain_list_enabled" "0"
-        if [ "$domain_list_enabled" -eq 1 ]; then
-            config_list_foreach "$section" "domain_list" check_domain_value
-        fi
-    }
-
-    check_domain_value() {
-        local domain_value="$1"
-
-        if [ "$domain_value" = "hetzner" ]; then
-            found_hetzner=1
-        elif [ "$domain_value" = "ovh" ]; then
-            found_ovh=1
-        fi
-    }
-
-    config_foreach check_domain_list_contains
-
-    if [ "$found_hetzner" -eq 1 ] || [ "$found_ovh" -eq 1 ]; then
-
-        local sets="podkop_subnets podkop_domains interfaces podkop_discord_subnets localv4"
-
-        nolog "Sets statistics:"
-        for set_name in $sets; do
-            if nft list set inet "$NFT_TABLE_NAME" $set_name > /dev/null 2>&1; then
-                # Count elements using grep to count commas and add 1 (last element has no comma)
-                local count=$(nft list set inet "$NFT_TABLE_NAME" $set_name 2> /dev/null | grep -o ',\|{' | wc -l)
-                echo "- $set_name: $count elements"
-            fi
-        done
-
-        nolog "Chain configurations:"
-
-        # Create a temporary file for processing
-        local tmp_file=$(mktemp)
-        nft list table inet "$NFT_TABLE_NAME" > "$tmp_file"
-
-        # Extract chain configurations without element listings
-        sed -n '/chain mangle {/,/}/p' "$tmp_file" | grep -v "elements" | grep -v "^[[:space:]]*[0-9]"
-        sed -n '/chain proxy {/,/}/p' "$tmp_file" | grep -v "elements" | grep -v "^[[:space:]]*[0-9]"
-
-        # Clean up
-        rm -f "$tmp_file"
-    else
-        # Simple view as originally implemented
-        nolog "Sets configuration:"
-        nft list table inet "$NFT_TABLE_NAME"
-    fi
-
-    nolog "NFT check completed"
-}
-
-check_logs() {
-    if ! command -v logread > /dev/null 2>&1; then
-        nolog "Error: logread command not found"
-        return 1
-    fi
-
-    local logs
-    logs=$(logread | grep -E "podkop|sing-box")
-
-    if [ -z "$logs" ]; then
-        nolog "Logs not found"
-        return 1
-    fi
-
-    # Find the last occurrence of "Starting podkop"
-    local start_line
-    start_line=$(echo "$logs" | grep -n "podkop.*Starting podkop" | tail -n 1 | cut -d: -f1)
-
-    if [ -n "$start_line" ]; then
-        echo "$logs" | tail -n +"$start_line"
-    else
-        nolog "No 'Starting podkop' message found, showing last 100 lines"
-        echo "$logs" | tail -n 100
-    fi
-}
-
-show_sing_box_config() {
-    local sing_box_config_path
-    config_get sing_box_config_path "settings" "config_path"
-    nolog "Current sing-box configuration:"
-
-    if [ ! -f "$sing_box_config_path" ]; then
-        nolog "Configuration file not found"
-        return 1
-    fi
-
-    jq '
-    walk(
-        if type == "object" then
-            with_entries(
-                if .key == "uuid" then
-                    .value = "MASKED"
-                elif .key == "server" then
-                    .value = "MASKED"
-                elif .key == "server_name" then
-                    .value = "MASKED"
-                elif .key == "password" then
-                    .value = "MASKED"
-                elif .key == "public_key" then
-                    .value = "MASKED"
-                elif .key == "short_id" then
-                    .value = "MASKED"
-                elif .key == "fingerprint" then
-                    .value = "MASKED"
-                elif .key == "server_port" then
-                    .value = "MASKED"
-                else . end
-            )
-        else . end
-    )' "$sing_box_config_path"
-}
-
-show_config() {
-    if [ ! -f "$PODKOP_CONFIG" ]; then
-        nolog "Configuration file not found"
-        return 1
-    fi
-
-    tmp_config=$(mktemp)
-
-    sed -e 's/\(option proxy_string\).*/\1 '\''MASKED'\''/g' \
-        -e '/option outbound_json/,/^}/c\	option outbound_json '\''MASKED'\''' \
-        -e 's/\(list urltest_proxy_links\).*/\1 '\''MASKED'\''/g' \
-        -e 's/\(list selector_proxy_links\).*/\1 '\''MASKED'\''/g' \
-        -e "s@\\(option dns_server '[^/]*\\)/[^']*'@\\1/MASKED'@g" \
-        -e "s@\\(option domain_resolver_dns_server '[^/]*\\)/[^']*'@\\1/MASKED'@g" \
-        -e 's/\(option yacd_secret_key\).*/\1 '\''MASKED'\''/g' \
-        "$PODKOP_CONFIG" > "$tmp_config"
-
-    cat "$tmp_config"
-    rm -f "$tmp_config"
-}
-
-show_version() {
-    echo "$PODKOP_VERSION"
-}
-
-show_sing_box_version() {
-    local version
-    version=$(sing-box version | head -n 1 | awk '{print $3}')
-    echo "$version"
-}
-
-show_system_info() {
-    echo "=== OpenWrt Version ==="
-    grep OPENWRT_RELEASE /etc/os-release | cut -d'"' -f2
-    echo
-    echo "=== Device Model ==="
-    cat /tmp/sysinfo/model
-}
-
-get_system_info() {
-    local podkop_version podkop_latest_version luci_app_version sing_box_version openwrt_version device_model
-
-    podkop_version="$PODKOP_VERSION"
-
-    podkop_latest_version=$(curl -m 3 -s https://api.github.com/repos/itdoginfo/podkop/releases/latest | grep '"tag_name":' | cut -d'"' -f4)
-    [ -z "$podkop_latest_version" ] && podkop_latest_version="unknown"
-
-    if [ -f /www/luci-static/resources/view/podkop/main.js ]; then
-        luci_app_version=$(grep 'var PODKOP_LUCI_APP_VERSION' /www/luci-static/resources/view/podkop/main.js | cut -d'"' -f2)
-    else
-        luci_app_version="not installed"
-    fi
-
-    if command -v sing-box > /dev/null 2>&1; then
-        sing_box_version=$(sing-box version 2> /dev/null | head -n 1 | awk '{print $3}')
-        [ -z "$sing_box_version" ] && sing_box_version="unknown"
-    else
-        sing_box_version="not installed"
-    fi
-
-    if [ -f /etc/os-release ]; then
-        openwrt_version=$(grep OPENWRT_RELEASE /etc/os-release | cut -d'"' -f2)
-        [ -z "$openwrt_version" ] && openwrt_version="unknown"
-    else
-        openwrt_version="unknown"
-    fi
-
-    if [ -f /tmp/sysinfo/model ]; then
-        device_model=$(cat /tmp/sysinfo/model)
-        [ -z "$device_model" ] && device_model="unknown"
-    else
-        device_model="unknown"
-    fi
-
-    echo "{\"podkop_version\": \"$podkop_version\", \"podkop_latest_version\": \"$podkop_latest_version\", \"luci_app_version\": \"$luci_app_version\", \"sing_box_version\": \"$sing_box_version\", \"openwrt_version\": \"$openwrt_version\", \"device_model\": \"$device_model\"}" | jq .
-}
-
-get_sing_box_status() {
-    local running=0
-    local enabled=0
-    local status=""
-    local version=""
-    local dns_configured=0
-
-    # Check if service is enabled
-    if [ -x /etc/rc.d/S99sing-box ]; then
-        enabled=1
-    fi
-
-    # Check if service is running
-    if pgrep -f "sing-box" > /dev/null; then
-        running=1
-        version=$(sing-box version | head -n 1 | awk '{print $3}')
-    fi
-
-    # Check DNS configuration
-    local dns_server
-    dns_server=$(uci get dhcp.@dnsmasq[0].server 2> /dev/null)
-    if [ "$dns_server" = "127.0.0.42" ]; then
-        dns_configured=1
-    fi
-
-    # Format status message
-    if [ $running -eq 1 ]; then
-        if [ $enabled -eq 1 ]; then
-            status="running & enabled"
-        else
-            status="running but disabled"
-        fi
-    else
-        if [ $enabled -eq 1 ]; then
-            status="stopped but enabled"
-        else
-            status="stopped & disabled"
-        fi
-    fi
-
-    echo "{\"running\":$running,\"enabled\":$enabled,\"status\":\"$status\",\"dns_configured\":$dns_configured}"
-}
-
-get_status() {
-    local enabled=0
-    local status=""
-
-    # Check if service is enabled
-    if [ -x /etc/rc.d/S99podkop ]; then
-        enabled=1
-        status="enabled"
-    else
-        status="disabled"
-    fi
-
-    echo "{\"enabled\":$enabled,\"status\":\"$status\"}"
-}
-
-check_dns_available() {
-    local dns_type dns_server bootstrap_dns_server
-    config_get dns_type "settings" "dns_type"
-    config_get dns_server "settings" "dns_server"
-    config_get bootstrap_dns_server "settings" "bootstrap_dns_server"
-
-    local dns_status=0
-    local dns_on_router=0
-    local bootstrap_dns_status=0
-    local dhcp_config_status=1
-    local domain="google.com"
-
-    # Mask NextDNS ID if present
-    local display_dns_server="$dns_server"
-    if echo "$dns_server" | grep -q "\.dns\.nextdns\.io$"; then
-        local nextdns_id
-        nextdns_id=$(echo "$dns_server" | cut -d'.' -f1)
-        display_dns_server="$(echo "$nextdns_id" | sed 's/./*/g').dns.nextdns.io"
-    elif echo "$dns_server" | grep -q "^dns\.nextdns\.io/"; then
-        local masked_path
-        masked_path=$(echo "$dns_server" | cut -d'/' -f2- | sed 's/./*/g')
-        display_dns_server="dns.nextdns.io/$masked_path"
-    fi
-
-    if [ "$dns_type" = "doh" ]; then
-        # Check if dns_server already contains a path
-        local doh_path="/dns-query"
-        if echo "$dns_server" | grep -q "/"; then
-            # Path is already present, extract it
-            doh_path="/$(echo "$dns_server" | cut -d'/' -f2-)"
-            dns_server="$(echo "$dns_server" | cut -d'/' -f1)"
-        fi
-
-        if dig @"$dns_server" "$domain" +https="$doh_path" +timeout=2 +tries=1 > /dev/null 2>&1; then
-            dns_status=1
-        fi
-    elif [ "$dns_type" = "dot" ]; then
-        if dig @"$dns_server" "$domain" +tls +timeout=2 +tries=1 > /dev/null 2>&1; then
-            dns_status=1
-        fi
-    elif [ "$dns_type" = "udp" ]; then
-        if dig @"$dns_server" "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
-            dns_status=1
-        fi
-    fi
-
-    # Check if local DNS resolver is working
-    if dig @127.0.0.1 "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
-        dns_on_router=1
-    fi
-
-    # Check bootstrap DNS server
-    if [ -n "$bootstrap_dns_server" ]; then
-        if dig @"$bootstrap_dns_server" "$domain" +timeout=2 +tries=1 > /dev/null 2>&1; then
-            bootstrap_dns_status=1
-        fi
-    fi
-
-    # Check if /etc/config/dhcp has server 127.0.0.42
-    config_load dhcp
-    config_foreach check_dhcp_has_podkop_dns dnsmasq
-    config_load "$PODKOP_CONFIG"
-
-    echo "{\"dns_type\":\"$dns_type\",\"dns_server\":\"$display_dns_server\",\"dns_status\":$dns_status,\"dns_on_router\":$dns_on_router,\"bootstrap_dns_server\":\"$bootstrap_dns_server\",\"bootstrap_dns_status\":$bootstrap_dns_status,\"dhcp_config_status\":$dhcp_config_status}" | jq .
-}
-
-check_dhcp_has_podkop_dns() {
-    local server_list cachesize noresolv server_found
-    config_get server_list "$1" "server"
-    config_get cachesize "$1" "cachesize"
-    config_get noresolv "$1" "noresolv"
-
-    server_found=0
-
-    if [ -n "$server_list" ]; then
-        for server in $server_list; do
-            if [ "$server" = "127.0.0.42" ]; then
-                server_found=1
-                break
-            fi
-        done
-    fi
-
-    if [ "$cachesize" != "0" ] || [ "$noresolv" != "1" ] || [ "$server_found" != "1" ]; then
-        dhcp_config_status=0
-    fi
-}
-
-check_nft_rules() {
-    local table_exist=0
-    local rules_mangle_exist=0
-    local rules_mangle_counters=0
-    local rules_mangle_output_exist=0
-    local rules_mangle_output_counters=0
-    local rules_proxy_exist=0
-    local rules_proxy_counters=0
-    local rules_other_mark_exist=0
-
-    # Generate traffic through PodkopTable
-    curl -m 3 -s "https://$CHECK_PROXY_IP_DOMAIN/check" > /dev/null 2>&1 &
-    local pid1=$!
-    curl -m 3 -s "https://$FAKEIP_TEST_DOMAIN/check" > /dev/null 2>&1 &
-    local pid2=$!
-
-    wait $pid1 2> /dev/null
-    wait $pid2 2> /dev/null
-    sleep 1
-
-    # Check if PodkopTable exists
-    if nft list table inet "$NFT_TABLE_NAME" > /dev/null 2>&1; then
-        table_exist=1
-
-        # Check mangle chain rules
-        if nft list chain inet "$NFT_TABLE_NAME" mangle > /dev/null 2>&1; then
-            local mangle_output
-            mangle_output=$(nft list chain inet "$NFT_TABLE_NAME" mangle)
-            if echo "$mangle_output" | grep -q "counter"; then
-                rules_mangle_exist=1
-
-                if echo "$mangle_output" | grep "counter" | grep -qv "packets 0 bytes 0"; then
-                    rules_mangle_counters=1
-                fi
-            fi
-        fi
-
-        # Check mangle_output chain rules
-        if nft list chain inet "$NFT_TABLE_NAME" mangle_output > /dev/null 2>&1; then
-            local mangle_output_output
-            mangle_output_output=$(nft list chain inet "$NFT_TABLE_NAME" mangle_output)
-            if echo "$mangle_output_output" | grep -q "counter"; then
-                rules_mangle_output_exist=1
-
-                if echo "$mangle_output_output" | grep "counter" | grep -qv "packets 0 bytes 0"; then
-                    rules_mangle_output_counters=1
-                fi
-            fi
-        fi
-
-        # Check proxy chain rules
-        if nft list chain inet "$NFT_TABLE_NAME" proxy > /dev/null 2>&1; then
-            local proxy_output
-            proxy_output=$(nft list chain inet "$NFT_TABLE_NAME" proxy)
-            if echo "$proxy_output" | grep -q "counter"; then
-                rules_proxy_exist=1
-
-                if echo "$proxy_output" | grep "counter" | grep -qv "packets 0 bytes 0"; then
-                    rules_proxy_counters=1
-                fi
-            fi
-        fi
-    fi
-
-    # Check for other mark rules outside PodkopTable
-    nft list tables 2> /dev/null | while read -r _ family table_name; do
-        [ -z "$table_name" ] && continue
-
-        [ "$table_name" = "$NFT_TABLE_NAME" ] && continue
-
-        if nft list table "$family" "$table_name" 2> /dev/null | grep -q "meta mark set"; then
-            touch /tmp/podkop_mark_check.$$
-            break
-        fi
-    done
-
-    if [ -f /tmp/podkop_mark_check.$$ ]; then
-        rules_other_mark_exist=1
-        rm -f /tmp/podkop_mark_check.$$
-    fi
-
-    echo "{\"table_exist\":$table_exist,\"rules_mangle_exist\":$rules_mangle_exist,\"rules_mangle_counters\":$rules_mangle_counters,\"rules_mangle_output_exist\":$rules_mangle_output_exist,\"rules_mangle_output_counters\":$rules_mangle_output_counters,\"rules_proxy_exist\":$rules_proxy_exist,\"rules_proxy_counters\":$rules_proxy_counters,\"rules_other_mark_exist\":$rules_other_mark_exist}" | jq .
-}
-
-check_sing_box() {
-    local sing_box_installed=0
-    local sing_box_version_ok=0
-    local sing_box_service_exist=0
-    local sing_box_autostart_disabled=0
-    local sing_box_process_running=0
-    local sing_box_ports_listening=0
-
-    # Check if sing-box is installed
-    if command -v sing-box > /dev/null 2>&1; then
-        sing_box_installed=1
-
-        # Check version (must be >= 1.12.4)
-        local version
-        version=$(sing-box version 2> /dev/null | head -n 1 | awk '{print $3}')
-        if [ -n "$version" ]; then
-            version=$(echo "$version" | sed 's/^v//')
-            local major
-            local minor
-            local patch
-            major=$(echo "$version" | cut -d. -f1)
-            minor=$(echo "$version" | cut -d. -f2)
-            patch=$(echo "$version" | cut -d. -f3)
-
-            # Compare version: must be >= 1.12.4
-            if [ "$major" -gt 1 ] ||
-                [ "$major" -eq 1 ] && [ "$minor" -gt 12 ] ||
-                [ "$major" -eq 1 ] && [ "$minor" -eq 12 ] && [ "$patch" -ge 4 ]; then
-                sing_box_version_ok=1
-            fi
-        fi
-    fi
-
-    # Check if service exists
-    if [ -f /etc/init.d/sing-box ]; then
-        sing_box_service_exist=1
-
-        if ! /etc/init.d/sing-box enabled 2> /dev/null; then
-            sing_box_autostart_disabled=1
-        fi
-    fi
-
-    # Check if process is running
-    if pgrep "sing-box" > /dev/null 2>&1; then
-        sing_box_process_running=1
-    fi
-
-    # Check if sing-box is listening on required ports
-    local port_53_ok=0
-    local port_1602_ok=0
-
-    if netstat -ln 2> /dev/null | grep -q "127.0.0.42:53"; then
-        port_53_ok=1
-    fi
-
-    if netstat -ln 2> /dev/null | grep -q "127.0.0.1:1602"; then
-        port_1602_ok=1
-    fi
-
-    # Both ports must be listening
-    if [ "$port_53_ok" = "1" ] && [ "$port_1602_ok" = "1" ]; then
-        sing_box_ports_listening=1
-    fi
-
-    echo "{\"sing_box_installed\":$sing_box_installed,\"sing_box_version_ok\":$sing_box_version_ok,\"sing_box_service_exist\":$sing_box_service_exist,\"sing_box_autostart_disabled\":$sing_box_autostart_disabled,\"sing_box_process_running\":$sing_box_process_running,\"sing_box_ports_listening\":$sing_box_ports_listening}" | jq .
-}
-
-check_fakeip() {
-    curl -m 3 -s "https://$FAKEIP_TEST_DOMAIN/check" | jq .
-}
-
-#######################################
-# Clash API interface for managing proxies and groups
-# Arguments:
-#   $1 - Action: get_proxies, get_proxy_latency, get_group_latency, set_group_proxy
-#   $2 - Proxy/Group tag (required for latency and set operations)
-#   $3 - Timeout in ms (optional, defaults: 2000 for proxy, 5000 for group) or target proxy tag for set_group_proxy
-# Outputs:
-#   JSON formatted response
-# Usage:
-#   clash_api get_proxies
-#   clash_api get_proxy_latency <proxy_tag> [timeout]
-#   clash_api get_group_latency <group_tag> [timeout]
-#   clash_api set_group_proxy <group_tag> <proxy_tag>
-#######################################
-
-clash_api() {
-    local action="$1"
-    local clash_api_controller_address CLASH_URL TEST_URL
-    clash_api_controller_address="$(get_service_listen_address)"
-    if [ -z "$clash_api_controller_address" ]; then
-        clash_api_controller_address="127.0.0.1"
-    fi
-    CLASH_URL="$clash_api_controller_address:$SB_CLASH_API_CONTROLLER_PORT"
-    TEST_URL="https://www.gstatic.com/generate_204"
-
-    local enable_yacd_wan_access yacd_secret_key auth_header
-    config_get_bool enable_yacd_wan_access "settings" "enable_yacd_wan_access" 0
-    config_get yacd_secret_key "settings" "yacd_secret_key"
-
-    if [ "$enable_yacd_wan_access" -eq 1 ]; then
-        auth_header="Authorization: Bearer $yacd_secret_key"
-    else
-        auth_header=""
-    fi
-
-    case "$action" in
-    get_proxies)
-        curl -s --header "$auth_header" "$CLASH_URL/proxies" | jq .
-        ;;
-
-    get_proxy_latency)
-        local proxy_tag="$2"
-        local timeout="${3:-2000}"
-
-        if [ -z "$proxy_tag" ]; then
-            echo '{"error":"proxy_tag required"}' | jq .
-            return 1
-        fi
-
-        curl -G -s "$CLASH_URL/proxies/$proxy_tag/delay" \
-            --header "$auth_header" \
-            --data-urlencode "url=$TEST_URL" \
-            --data-urlencode "timeout=$timeout" | jq .
-        ;;
-
-    get_group_latency)
-        local group_tag="$2"
-        local timeout="${3:-5000}"
-
-        if [ -z "$group_tag" ]; then
-            echo '{"error":"group_tag required"}' | jq .
-            return 1
-        fi
-
-        curl -G -s "$CLASH_URL/group/$group_tag/delay" \
-            --header "$auth_header" \
-            --data-urlencode "url=$TEST_URL" \
-            --data-urlencode "timeout=$timeout" | jq .
-        ;;
-
-    set_group_proxy)
-        local group_tag="$2"
-        local proxy_tag="$3"
-
-        if [ -z "$group_tag" ] || [ -z "$proxy_tag" ]; then
-            echo '{"error":"group_tag and proxy_tag required"}' | jq .
-            return 1
-        fi
-
-        local response
-        response=$(
-            curl -X PUT -s -w "\n%{http_code}" "$CLASH_URL/proxies/$group_tag" \
-                --header "$auth_header" \
-                --data-raw "{\"name\":\"$proxy_tag\"}"
-        )
-
-        local http_code
-        local body
-        http_code=$(echo "$response" | tail -n 1)
-        body=$(echo "$response" | sed '$d')
-
-        case "$http_code" in
-        204)
-            echo "{\"success\":true,\"group\":\"$group_tag\",\"proxy\":\"$proxy_tag\"}" | jq .
-            ;;
-        404)
-            echo "{\"success\":false,\"error\":\"group_not_found\",\"message\":\"$group_tag does not exist\"}" | jq .
-            return 1
-            ;;
-        400)
-            if echo "$body" | grep -q "not found"; then
-                echo "{\"success\":false,\"error\":\"proxy_not_found\",\"message\":\"$proxy_tag not found in group $group_tag\"}" | jq .
-            else
-                echo '{"success":false,"error":"bad_request","message":"Invalid request"}' | jq .
-            fi
-            return 1
-            ;;
-        *)
-            if [ -n "$body" ]; then
-                local body_json
-                body_json=$(echo "$body" | jq -c .)
-                echo "{\"success\":false,\"http_code\":$http_code,\"body\":$body_json}" | jq .
-            else
-                echo "{\"success\":false,\"http_code\":$http_code}" | jq .
-            fi
-            return 1
-            ;;
-        esac
-        ;;
-
-    *)
-        echo '{"error":"unknown action","available":["get_proxies","get_proxy_latency","get_group_latency","set_group_proxy"]}' | jq .
-        return 1
-        ;;
-    esac
-}
-
-print_global() {
-    local message="$1"
-    echo "$message"
-}
-
-global_check() {
-    local PODKOP_LUCI_VERSION="Unknown"
-    [ -n "$1" ] && PODKOP_LUCI_VERSION="$1"
-
-    print_global "📡 Global check run!"
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "🛠️ System info"
-
-    local system_info_json
-    system_info_json=$(get_system_info)
-
-    if [ -n "$system_info_json" ]; then
-        local podkop_version podkop_latest_version luci_app_version sing_box_version openwrt_version device_model
-
-        podkop_version=$(echo "$system_info_json" | jq -r '.podkop_version // "unknown"')
-        podkop_latest_version=$(echo "$system_info_json" | jq -r '.podkop_latest_version // "unknown"')
-        luci_app_version=$(echo "$system_info_json" | jq -r '.luci_app_version // "unknown"')
-        sing_box_version=$(echo "$system_info_json" | jq -r '.sing_box_version // "unknown"')
-        openwrt_version=$(echo "$system_info_json" | jq -r '.openwrt_version // "unknown"')
-        device_model=$(echo "$system_info_json" | jq -r '.device_model // "unknown"')
-
-        print_global "🕳️ Podkop:        $podkop_version (latest: $podkop_latest_version)"
-        print_global "🕳️ LuCI App:      $luci_app_version"
-        print_global "📦 Sing-box:      $sing_box_version"
-        print_global "🛜 OpenWrt:       $openwrt_version"
-        print_global "🛜 Device:        $device_model"
-    else
-        print_global "❌ Failed to get system info"
-    fi
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "➡️ DNS status"
-
-    local dns_check_json
-    dns_check_json=$(check_dns_available)
-
-    if [ -n "$dns_check_json" ]; then
-        local dns_type dns_server dns_status dns_on_router bootstrap_dns_server bootstrap_dns_status dhcp_config_status
-
-        dns_type=$(echo "$dns_check_json" | jq -r '.dns_type // "unknown"')
-        dns_server=$(echo "$dns_check_json" | jq -r '.dns_server // "unknown"')
-        dns_status=$(echo "$dns_check_json" | jq -r '.dns_status // 0')
-        dns_on_router=$(echo "$dns_check_json" | jq -r '.dns_on_router // 0')
-        bootstrap_dns_server=$(echo "$dns_check_json" | jq -r '.bootstrap_dns_server // ""')
-        bootstrap_dns_status=$(echo "$dns_check_json" | jq -r '.bootstrap_dns_status // 0')
-        dhcp_config_status=$(echo "$dns_check_json" | jq -r '.dhcp_config_status // 0')
-
-        # Bootstrap DNS
-        if [ -n "$bootstrap_dns_server" ]; then
-            if [ "$bootstrap_dns_status" -eq 1 ]; then
-                print_global "✅ Bootstrap DNS: $bootstrap_dns_server"
-            else
-                print_global "❌ Bootstrap DNS: $bootstrap_dns_server"
-            fi
-        fi
-
-        # DNS server status
-        if [ "$dns_status" -eq 1 ]; then
-            print_global "✅ Main DNS: $dns_server [$dns_type]"
-        else
-            print_global "❌ Main DNS: $dns_server [$dns_type]"
-        fi
-
-        # DNS on router
-        if [ "$dns_on_router" -eq 1 ]; then
-            print_global "✅ DNS on router"
-        else
-            print_global "❌ DNS on router"
-        fi
-
-        # DHCP configuration check
-        local dont_touch_dhcp
-        config_get dont_touch_dhcp "settings" "dont_touch_dhcp"
-
-        if [ "$dont_touch_dhcp" = "1" ]; then
-            print_global "⚠️ dont_touch_dhcp is enabled. 📄 DHCP config:"
-            awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
-        elif [ "$dhcp_config_status" -eq 0 ]; then
-            print_global "❌ DHCP configuration differs from template. 📄 DHCP config:"
-            awk '/^config /{p=($2=="dnsmasq")} p' /etc/config/dhcp
-        else
-            print_global "✅ /etc/config/dhcp"
-        fi
-    else
-        print_global "❌ Failed to get DNS info"
-    fi
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "📦 Sing-box status"
-
-    local singbox_check_json
-    singbox_check_json=$(check_sing_box)
-
-    if [ -n "$singbox_check_json" ]; then
-        local sing_box_installed sing_box_version_ok sing_box_service_exist sing_box_autostart_disabled sing_box_process_running sing_box_ports_listening
-
-        sing_box_installed=$(echo "$singbox_check_json" | jq -r '.sing_box_installed // 0')
-        sing_box_version_ok=$(echo "$singbox_check_json" | jq -r '.sing_box_version_ok // 0')
-        sing_box_service_exist=$(echo "$singbox_check_json" | jq -r '.sing_box_service_exist // 0')
-        sing_box_autostart_disabled=$(echo "$singbox_check_json" | jq -r '.sing_box_autostart_disabled // 0')
-        sing_box_process_running=$(echo "$singbox_check_json" | jq -r '.sing_box_process_running // 0')
-        sing_box_ports_listening=$(echo "$singbox_check_json" | jq -r '.sing_box_ports_listening // 0')
-
-        if [ "$sing_box_installed" -eq 1 ]; then
-            print_global "✅ Sing-box installed"
-        else
-            print_global "❌ Sing-box installed"
-        fi
-
-        if [ "$sing_box_version_ok" -eq 1 ]; then
-            print_global "✅ Sing-box version is compatible (newer than 1.12.4)"
-        else
-            print_global "❌ Sing-box version is not compatible (older than 1.12.4)"
-        fi
-
-        if [ "$sing_box_service_exist" -eq 1 ]; then
-            print_global "✅ Sing-box service exist"
-        else
-            print_global "❌ Sing-box service exist"
-        fi
-
-        if [ "$sing_box_autostart_disabled" -eq 1 ]; then
-            print_global "✅ Sing-box autostart disabled"
-        else
-            print_global "❌ Sing-box autostart disabled"
-        fi
-
-        if [ "$sing_box_process_running" -eq 1 ]; then
-            print_global "✅ Sing-box process running"
-        else
-            print_global "❌ Sing-box process running"
-        fi
-
-        if [ "$sing_box_ports_listening" -eq 1 ]; then
-            print_global "✅ Sing-box listening ports"
-        else
-            print_global "❌ Sing-box listening ports"
-        fi
-    else
-        print_global "❌ Failed to get sing-box info"
-    fi
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "🧱 NFT rules status"
-
-    local nft_check_json
-    nft_check_json=$(check_nft_rules)
-
-    if [ -n "$nft_check_json" ]; then
-        local table_exist rules_mangle_exist rules_mangle_counters rules_mangle_output_exist rules_mangle_output_counters rules_proxy_exist rules_proxy_counters rules_other_mark_exist
-
-        table_exist=$(echo "$nft_check_json" | jq -r '.table_exist // 0')
-        rules_mangle_exist=$(echo "$nft_check_json" | jq -r '.rules_mangle_exist // 0')
-        rules_mangle_counters=$(echo "$nft_check_json" | jq -r '.rules_mangle_counters // 0')
-        rules_mangle_output_exist=$(echo "$nft_check_json" | jq -r '.rules_mangle_output_exist // 0')
-        rules_mangle_output_counters=$(echo "$nft_check_json" | jq -r '.rules_mangle_output_counters // 0')
-        rules_proxy_exist=$(echo "$nft_check_json" | jq -r '.rules_proxy_exist // 0')
-        rules_proxy_counters=$(echo "$nft_check_json" | jq -r '.rules_proxy_counters // 0')
-        rules_other_mark_exist=$(echo "$nft_check_json" | jq -r '.rules_other_mark_exist // 0')
-
-        if [ "$table_exist" -eq 1 ]; then
-            print_global "✅ Table exist"
-        else
-            print_global "❌ Table exist"
-        fi
-
-        if [ "$rules_mangle_exist" -eq 1 ]; then
-            print_global "✅ Rules mangle exist"
-        else
-            print_global "❌ Rules mangle exist"
-        fi
-
-        if [ "$rules_mangle_counters" -eq 1 ]; then
-            print_global "✅ Rules mangle counters"
-        else
-            print_global "⚠️  Rules mangle counters"
-        fi
-
-        if [ "$rules_mangle_output_exist" -eq 1 ]; then
-            print_global "✅ Rules mangle output exist"
-        else
-            print_global "❌ Rules mangle output exist"
-        fi
-
-        if [ "$rules_mangle_output_counters" -eq 1 ]; then
-            print_global "✅ Rules mangle output counters"
-        else
-            print_global "⚠️  Rules mangle output counters"
-        fi
-
-        if [ "$rules_proxy_exist" -eq 1 ]; then
-            print_global "✅ Rules proxy exist"
-        else
-            print_global "❌ Rules proxy exist"
-        fi
-
-        if [ "$rules_proxy_counters" -eq 1 ]; then
-            print_global "✅ Rules proxy counters"
-        else
-            print_global "⚠️  Rules proxy counters"
-        fi
-
-        if [ "$rules_other_mark_exist" -eq 1 ]; then
-            print_global "⚠️  Additional marking rules found:"
-            nft list ruleset | awk '/table inet '"$NFT_TABLE_NAME"'/{flag=1; next} /^table/{flag=0} !flag' | grep -E "mark set|meta mark"
-        else
-            print_global "✅ Additional marking rules found"
-        fi
-    else
-        print_global "❌ Failed to get NFT rules info"
-    fi
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "📄 Podkop config"
-    show_config
-
-    # print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    # print_global "🔧 System check"
-
-    # if grep -E "^nameserver\s+([0-9]{1,3}\.){3}[0-9]{1,3}" "$RESOLV_CONF" | grep -vqE "127\.0\.0\.1|0\.0\.0\.0"; then
-    #     print_global "❌ /etc/resolv.conf contains external nameserver:"
-    #     cat /etc/resolv.conf
-    #     echo ""
-    # else
-    #     print_global "✅ /etc/resolv.conf"
-    # fi
-
-    # print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    # print_global "🧱 NFT table"
-    # check_nft
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "📄 WAN config"
-    if uci show network.wan > /dev/null 2>&1; then
-        awk '
-            /^config / {
-                p = ($2 == "interface" && $3 == "'\''wan'\''")
-                proto = ""
-            }
-            p {
-                if ($1 == "option" && $2 == "proto") {
-                    proto = $3
-                    print
-                } else if (proto == "'\''static'\''" && $1 == "option" && ($2 == "ipaddr" || $2 == "netmask" || $2 == "gateway")) {
-                    print "        option", $2, "'\''******'\''"
-                } else if (proto == "'\''pppoe'\''" && $1 == "option" && ($2 == "username" || $2 == "password")) {
-                    print "        option", $2, "'\''******'\''"
-                } else {
-                    print
-                }
-            }
-        ' /etc/config/network
-    else
-        print_global "❌ WAN configuration not found"
-    fi
-
-    if uci show network | grep -q endpoint_host; then
-        uci show network | grep endpoint_host | cut -d'=' -f2 | tr -d "'\" " | while read -r host; do
-            if [ "$host" = "engage.cloudflareclient.com" ]; then
-                print_global "⚠️ WARP detected: $host"
-                continue
-            fi
-
-            ip_prefix=$(echo "$host" | cut -d'.' -f1,2)
-            if echo "$CLOUDFLARE_OCTETS" | grep -wq "$ip_prefix"; then
-                print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-                print_global "⚠️ WARP detected: $host"
-            fi
-        done
-    fi
-
-    if uci show network | grep -q route_allowed_ips; then
-        uci show network | grep "wireguard_.*\.route_allowed_ips='1'" | cut -d'.' -f1-2 | while read -r peer_section; do
-            local allowed_ips
-            allowed_ips=$(uci get "${peer_section}.allowed_ips" 2> /dev/null)
-
-            if [ "$allowed_ips" = "0.0.0.0/0" ]; then
-                print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-                print_global "⚠️ WG Route allowed IP enabled with 0.0.0.0/0"
-            fi
-        done
-    fi
-
-    if [ -f "/etc/init.d/zapret" ]; then
-        print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        print_global "⚠️ Zapret detected"
-    fi
-
-    print_global "━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-    print_global "🥸 FakeIP status"
-
-    local fakeip_check_json
-    fakeip_check_json=$(check_fakeip)
-
-    if [ -n "$fakeip_check_json" ]; then
-        local fakeip_status
-
-        fakeip_status=$(echo "$fakeip_check_json" | jq -r '.fakeip // false')
-
-        if [ "$fakeip_status" = "true" ]; then
-            print_global "✅ Router DNS is routed through sing-box"
-        else
-            print_global "⚠️ Router DNS is NOT routed through sing-box"
-        fi
-    else
-        print_global "❌ Failed to get FakeIP info"
-    fi
-
-    local fakeip_address
-    fakeip_address=$(dig +short @127.0.0.42 $FAKEIP_TEST_DOMAIN)
-
-    if echo "$fakeip_address" | grep -q "^198\.18\."; then
-        print_global "✅ Sing-box works with FakeIP: $fakeip_address"
-    else
-        print_global "❌ Sing-box does NOT work with FakeIP: $fakeip_address"
-    fi
-}
-
-show_help() {
-    cat << EOF
-Usage: $0 COMMAND
-
-Available commands:
-    start                   Start podkop service
-    stop                    Stop podkop service
-    reload                  Reload podkop configuration
-    restart                 Restart podkop service
-    main                    Run main podkop process
-    list_update             Update domain lists
-    check_proxy             Check proxy connectivity
-    check_nft               Check NFT rules
-    check_nft_rules         Check NFT rules status
-    check_sing_box          Check sing-box installation and status
-    check_logs              Show podkop logs from system journal
-    check_sing_box_logs     Show sing-box logs
-    check_fakeip            Test FakeIP on router
-    clash_api               Clash API interface for managing proxies and groups
-    show_config             Display current podkop configuration
-    show_version            Show podkop version
-    show_sing_box_config    Show sing-box configuration
-    show_sing_box_version   Show sing-box version
-    show_system_info        Show system information
-    get_status              Get podkop service status
-    get_sing_box_status     Get sing-box service status
-    get_system_info         Get system information in JSON format
-    check_dns_available     Check DNS server availability
-    global_check            Run global system check
-EOF
-}
-
-case "$1" in
-start)
-    start
-    ;;
-stop)
-    stop
-    ;;
-reload)
-    reload
-    ;;
-restart)
-    restart
-    ;;
-main)
-    main
-    ;;
-list_update)
-    list_update
-    ;;
-check_proxy)
-    check_proxy
-    ;;
-check_nft)
-    check_nft
-    ;;
-check_nft_rules)
-    check_nft_rules
-    ;;
-check_sing_box)
-    check_sing_box
-    ;;
-check_logs)
-    check_logs
-    ;;
-check_sing_box_logs)
-    check_sing_box_logs
-    ;;
-check_fakeip)
-    check_fakeip
-    ;;
-clash_api)
-    clash_api "$2" "$3" "$4"
-    ;;
-show_config)
-    show_config
-    ;;
-show_version)
-    show_version
-    ;;
-show_sing_box_config)
-    show_sing_box_config
-    ;;
-show_sing_box_version)
-    show_sing_box_version
-    ;;
-show_system_info)
-    show_system_info
-    ;;
-get_status)
-    get_status
-    ;;
-get_sing_box_status)
-    get_sing_box_status
-    ;;
-get_system_info)
-    get_system_info
-    ;;
-check_dns_available)
-    check_dns_available
-    ;;
-global_check)
-    global_check "${2:-}"
-    ;;
-*)
-    show_help
-    exit 1
-    ;;
-esac
diff --git a/podkop/files/usr/lib/constants.sh b/podkop/files/usr/lib/constants.sh
deleted file mode 100644
index 563ad0c5..00000000
--- a/podkop/files/usr/lib/constants.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-# shellcheck disable=SC2034
-
-PODKOP_VERSION="__COMPILED_VERSION_VARIABLE__"
-## Common
-PODKOP_CONFIG="/etc/config/podkop"
-RESOLV_CONF="/etc/resolv.conf"
-DNS_RESOLVERS="1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 9.9.9.9 9.9.9.11 94.140.14.14 94.140.15.15 208.67.220.220 208.67.222.222 77.88.8.1 77.88.8.8"
-CHECK_PROXY_IP_DOMAIN="ip.podkop.fyi"
-FAKEIP_TEST_DOMAIN="fakeip.podkop.fyi"
-TMP_SING_BOX_FOLDER="/tmp/sing-box"
-TMP_RULESET_FOLDER="$TMP_SING_BOX_FOLDER/rulesets"
-CLOUDFLARE_OCTETS="8.47 162.159 188.114" # Endpoints https://github.com/ampetelin/warp-endpoint-checker
-JQ_REQUIRED_VERSION="1.7.1"
-COREUTILS_BASE64_REQUIRED_VERSION="9.7"
-RT_TABLE_NAME="podkop"
-
-## nft
-NFT_TABLE_NAME="PodkopTable"
-NFT_LOCALV4_SET_NAME="localv4"
-NFT_COMMON_SET_NAME="podkop_subnets"
-NFT_DISCORD_SET_NAME="podkop_discord_subnets"
-NFT_INTERFACE_SET_NAME="interfaces"
-NFT_FAKEIP_MARK="0x00100000"
-NFT_OUTBOUND_MARK="0x00200000"
-
-## sing-box
-SB_REQUIRED_VERSION="1.12.0"
-# DNS
-SB_DNS_SERVER_TAG="dns-server"
-SB_FAKEIP_DNS_SERVER_TAG="fakeip-server"
-SB_FAKEIP_INET4_RANGE="198.18.0.0/15"
-SB_BOOTSTRAP_SERVER_TAG="bootstrap-dns-server"
-SB_FAKEIP_DNS_RULE_TAG="fakeip-dns-rule-tag"
-SB_INVERT_FAKEIP_DNS_RULE_TAG="invert-fakeip-dns-rule-tag"
-# Inbounds
-SB_TPROXY_INBOUND_TAG="tproxy-in"
-SB_TPROXY_INBOUND_ADDRESS="127.0.0.1"
-SB_TPROXY_INBOUND_PORT=1602
-SB_DNS_INBOUND_TAG="dns-in"
-SB_DNS_INBOUND_ADDRESS="127.0.0.42"
-SB_DNS_INBOUND_PORT=53
-SB_SERVICE_MIXED_INBOUND_TAG="service-mixed-in"
-SB_SERVICE_MIXED_INBOUND_ADDRESS="127.0.0.1"
-SB_SERVICE_MIXED_INBOUND_PORT=4534
-# Outbounds
-SB_DIRECT_OUTBOUND_TAG="direct-out"
-# Route
-SB_REJECT_RULE_TAG="reject-rule-tag"
-SB_EXCLUSION_RULE_TAG="exclusion-rule-tag"
-# Experimental
-SB_CLASH_API_CONTROLLER_PORT=9090
-
-## Lists
-GITHUB_RAW_URL="https://raw.githubusercontent.com/itdoginfo/allow-domains/main"
-SRS_MAIN_URL="https://github.com/itdoginfo/allow-domains/releases/latest/download"
-SUBNETS_TWITTER="${GITHUB_RAW_URL}/Subnets/IPv4/twitter.lst"
-SUBNETS_META="${GITHUB_RAW_URL}/Subnets/IPv4/meta.lst"
-SUBNETS_DISCORD="${GITHUB_RAW_URL}/Subnets/IPv4/discord.lst"
-SUBNETS_ROBLOX="${GITHUB_RAW_URL}/Subnets/IPv4/roblox.lst"
-SUBNETS_TELERAM="${GITHUB_RAW_URL}/Subnets/IPv4/telegram.lst"
-SUBNETS_CLOUDFLARE="${GITHUB_RAW_URL}/Subnets/IPv4/cloudflare.lst"
-SUBNETS_HETZNER="${GITHUB_RAW_URL}/Subnets/IPv4/hetzner.lst"
-SUBNETS_OVH="${GITHUB_RAW_URL}/Subnets/IPv4/ovh.lst"
-SUBNETS_DIGITALOCEAN="${GITHUB_RAW_URL}/Subnets/IPv4/digitalocean.lst"
-SUBNETS_CLOUDFRONT="${GITHUB_RAW_URL}/Subnets/IPv4/cloudfront.lst"
-COMMUNITY_SERVICES="russia_inside russia_outside ukraine_inside geoblock block porn news anime youtube hdrezka tiktok google_ai google_play hodca discord meta twitter cloudflare cloudfront digitalocean hetzner ovh telegram roblox"
\ No newline at end of file
diff --git a/podkop/files/usr/lib/helpers.sh b/podkop/files/usr/lib/helpers.sh
deleted file mode 100644
index c25edb89..00000000
--- a/podkop/files/usr/lib/helpers.sh
+++ /dev/null
@@ -1,356 +0,0 @@
-# Check if string is valid IPv4
-is_ipv4() {
-    local ip="$1"
-    local regex="^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$"
-    [[ "$ip" =~ $regex ]]
-}
-
-# Check if string is valid IPv4 with CIDR mask
-is_ipv4_cidr() {
-    local ip="$1"
-    local regex="^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}(\/(3[0-2]|2[0-9]|1[0-9]|[0-9]))$"
-    [[ "$ip" =~ $regex ]]
-}
-
-is_ipv4_ip_or_ipv4_cidr() {
-    is_ipv4 "$1" || is_ipv4_cidr "$1"
-}
-
-is_domain() {
-    local str="$1"
-    local regex='^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$'
-
-    [[ "$str" =~ $regex ]]
-}
-
-is_domain_suffix() {
-    local str="$1"
-    local normalized="${str#.}"
-
-    is_domain "$normalized"
-}
-
-# Checks if the given string is a valid base64-encoded sequence
-is_base64() {
-    local str="$1"
-
-    if echo "$str" | base64 -d > /dev/null 2>&1; then
-        return 0
-    fi
-    return 1
-}
-
-# Checks if the given string looks like a Shadowsocks userinfo
-is_shadowsocks_userinfo_format() {
-    local str="$1"
-    local regex='^[^:]+:[^:]+(:[^:]+)?$'
-
-    [[ "$str" =~ $regex ]]
-}
-
-# Compares the current package version with the required minimum
-is_min_package_version() {
-    local current="$1"
-    local required="$2"
-
-    local lowest
-    lowest="$(printf '%s\n' "$current" "$required" | sort -V | head -n1)"
-
-    [ "$lowest" = "$required" ]
-}
-
-# Checks if the given file exists
-file_exists() {
-    local filepath="$1"
-
-    if [[ -f "$filepath" ]]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-# Checks if a service script exists in /etc/init.d
-service_exists() {
-    local service="$1"
-
-    if [ -x "/etc/init.d/$service" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-# Returns the inbound tag name by appending the postfix to the given section
-get_inbound_tag_by_section() {
-    local section="$1"
-    local postfix="in"
-
-    echo "$section-$postfix"
-}
-
-# Returns the outbound tag name by appending the postfix to the given section
-get_outbound_tag_by_section() {
-    local section="$1"
-    local postfix="out"
-
-    echo "$section-$postfix"
-}
-
-# Constructs and returns a domain resolver tag by appending a fixed postfix to the given section
-get_domain_resolver_tag() {
-    local section="$1"
-    local postfix="domain-resolver"
-
-    echo "$section-$postfix"
-}
-
-# Converts a comma-separated string into a JSON array string
-comma_string_to_json_array() {
-    local input="$1"
-
-    if [ -z "$input" ]; then
-        echo "[]"
-        return
-    fi
-
-    local replaced="${input//,/\",\"}"
-
-    echo "[\"$replaced\"]"
-}
-
-# Decodes a URL-encoded string
-url_decode() {
-    local encoded="$1"
-    printf '%b' "$(echo "$encoded" | sed 's/+/ /g; s/%/\\x/g')"
-}
-
-# Returns the scheme (protocol) part of a URL
-url_get_scheme() {
-    local url="$1"
-    echo "${url%%://*}"
-}
-
-# Extracts the userinfo (username[:password]) part from a URL
-url_get_userinfo() {
-    local url="$1"
-    echo "$url" | sed -n -e 's#^[^:/?]*://##' -e '/@/!d' -e 's/@.*//p'
-}
-
-# Extracts the host part from a URL
-url_get_host() {
-    local url="$1"
-
-    url="${url#*://}"
-    url="${url#*@}"
-    url="${url%%[/?#]*}"
-
-    echo "${url%%:*}"
-}
-
-# Extracts the port number from a URL
-url_get_port() {
-    local url="$1"
-
-    url="${url#*://}"
-    url="${url#*@}"
-    url="${url%%[/?#]*}"
-
-    [[ "$url" == *:* ]] && echo "${url#*:}" || echo ""
-}
-
-# Extracts the path from a URL (without query or fragment; returns "/" if empty)
-url_get_path() {
-    local url="$1"
-    echo "$url" | sed -n -e 's#^[^:/?]*://##' -e 's#^[^/]*##' -e 's#\([^?]*\).*#\1#p'
-}
-
-# Extracts the value of a specific query parameter from a URL
-url_get_query_param() {
-    local url="$1"
-    local param="$2"
-
-    local raw
-    raw=$(echo "$url" | sed -n "s/.*[?&]$param=\([^&?#]*\).*/\1/p")
-
-    [ -z "$raw" ] && echo "" && return
-
-    echo "$raw"
-}
-
-# Extracts the basename (filename without extension) from a URL
-url_get_basename() {
-    local url="$1"
-
-    local filename="${url##*/}"
-    local basename="${filename%%.*}"
-
-    echo "$basename"
-}
-
-# Extracts and returns the file extension from the given URL
-url_get_file_extension() {
-    local url="$1"
-
-    local basename="${url##*/}"
-    case "$basename" in
-    *.*) echo "${basename##*.}" ;;
-    *) echo "" ;;
-    esac
-}
-
-# Remove url fragment (everything after the first '#')
-url_strip_fragment() {
-    local url="$1"
-
-    echo "${url%%#*}"
-}
-
-# Decodes and returns a base64-encoded string
-base64_decode() {
-    local str="$1"
-    local decoded_url
-
-    decoded_url="$(echo "$str" | base64 -d 2> /dev/null)"
-
-    echo "$decoded_url"
-}
-
-# Generates a unique 16-character ID based on the current timestamp and a random number
-gen_id() {
-    printf '%s%s' "$(date +%s)" "$RANDOM" | md5sum | cut -c1-16
-}
-
-# Adds a missing UCI option with the given value if it does not exist
-migration_add_new_option() {
-    local package="$1"
-    local section="$2"
-    local option="$3"
-    local value="$4"
-
-    local current
-    current="$(uci -q get "$package.$section.$option")"
-    if [ -z "$current" ]; then
-        log "Adding missing option '$option' with value '$value'"
-        uci set "$package.$section.$option=$value"
-        uci commit "$package"
-        return 0
-    else
-        return 1
-    fi
-}
-
-# Migrates a configuration key in an OpenWrt config file from old_key_name to new_key_name
-migration_rename_config_key() {
-    local config="$1"
-    local key_type="$2"
-    local old_key_name="$3"
-    local new_key_name="$4"
-
-    if grep -q "$key_type $old_key_name" "$config"; then
-        log "Deprecated $key_type found: $old_key_name migrating to $new_key_name"
-        sed -i "s/$key_type $old_key_name/$key_type $new_key_name/g" "$config"
-    fi
-}
-
-# Download URL to file
-download_to_file() {
-    local url="$1"
-    local filepath="$2"
-    local http_proxy_address="$3"
-    local retries="${4:-3}"
-    local wait="${5:-2}"
-
-    for attempt in $(seq 1 "$retries"); do
-        if [ -n "$http_proxy_address" ]; then
-            http_proxy="http://$http_proxy_address" https_proxy="http://$http_proxy_address" wget -O "$filepath" "$url" && break
-        else
-            wget -O "$filepath" "$url" && break
-        fi
-
-        log "Attempt $attempt/$retries to download $url failed" "warn"
-        sleep "$wait"
-    done
-}
-
-# Converts Windows-style line endings (CRLF) to Unix-style (LF)
-convert_crlf_to_lf() {
-    local filepath="$1"
-
-    if grep -q $'\r' "$filepath"; then
-        log "File '$filepath' contains CRLF line endings. Converting to LF..." "debug"
-        local tmpfile
-        tmpfile=$(mktemp)
-        tr -d '\r' < "$filepath" > "$tmpfile" && mv "$tmpfile" "$filepath" || rm -f "$tmpfile"
-    fi
-}
-
-#######################################
-# Parses a whitespace-separated string, validates items as either domains
-# or IPv4 addresses/subnets, and returns a comma-separated string of valid items.
-# Arguments:
-#   $1 - Input string (space-separated list of items)
-#   $2 - Type of validation ("domains" or "subnets")
-# Outputs:
-#   Comma-separated string of valid domains or subnets
-#######################################
-parse_domain_or_subnet_string_to_commas_string() {
-    local string="$1"
-    local type="$2"
-
-    tmpfile=$(mktemp)
-    printf "%s\n" "$string" | sed 's/\/\/.*//' | tr ', ' '\n' | grep -v '^$' > "$tmpfile"
-
-    result="$(parse_domain_or_subnet_file_to_comma_string "$tmpfile" "$type")"
-    rm -f "$tmpfile"
-
-    echo "$result"
-}
-
-#######################################
-# Parses a file line by line, validates entries as either domains or subnets,
-# and returns a single comma-separated string of valid items.
-# Arguments:
-#   $1 - Path to the input file
-#   $2 - Type of validation ("domains" or "subnets")
-# Outputs:
-#   Comma-separated string of valid domains or subnets
-#######################################
-parse_domain_or_subnet_file_to_comma_string() {
-    local filepath="$1"
-    local type="$2"
-
-    local result
-    while IFS= read -r line; do
-        line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-
-        [ -z "$line" ] && continue
-
-        case "$type" in
-        domains)
-            if ! is_domain_suffix "$line"; then
-                log "'$line' is not a valid domain" "debug"
-                continue
-            fi
-            ;;
-        subnets)
-            if ! is_ipv4 "$line" && ! is_ipv4_cidr "$line"; then
-                log "'$line' is not IPv4 or IPv4 CIDR" "debug"
-                continue
-            fi
-            ;;
-        *)
-            log "Unknown type: $type" "error"
-            return 1
-            ;;
-        esac
-
-        if [ -z "$result" ]; then
-            result="$line"
-        else
-            result="$result,$line"
-        fi
-    done < "$filepath"
-
-    echo "$result"
-}
\ No newline at end of file
diff --git a/podkop/files/usr/lib/nft.sh b/podkop/files/usr/lib/nft.sh
deleted file mode 100644
index 8cbcc6ae..00000000
--- a/podkop/files/usr/lib/nft.sh
+++ /dev/null
@@ -1,70 +0,0 @@
-# Create an nftables table in the inet family
-nft_create_table() {
-    local name="$1"
-
-    nft add table inet "$name"
-}
-
-# Create a set within a table for storing IPv4 addresses
-nft_create_ipv4_set() {
-    local table="$1"
-    local name="$2"
-
-    nft add set inet "$table" "$name" '{ type ipv4_addr; flags interval; auto-merge; }'
-}
-
-nft_create_ifname_set() {
-    local table="$1"
-    local name="$2"
-
-    nft add set inet "$table" "$name" '{ type ifname; flags interval; }'
-}
-
-# Add one or more elements to a set
-nft_add_set_elements() {
-    local table="$1"
-    local set="$2"
-    local elements="$3"
-
-    nft add element inet "$table" "$set" "{ $elements }"
-}
-
-nft_add_set_elements_from_file_chunked() {
-    local filepath="$1"
-    local nft_table_name="$2"
-    local nft_set_name="$3"
-    local chunk_size="${4:-5000}"
-
-    local array count
-    count=0
-    while IFS= read -r line; do
-        line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-
-        [ -z "$line" ] && continue
-
-        if ! is_ipv4 "$line" && ! is_ipv4_cidr "$line"; then
-            log "'$line' is not IPv4 or IPv4 CIDR" "debug"
-            continue
-        fi
-
-        if [ -z "$array" ]; then
-            array="$line"
-        else
-            array="$array,$line"
-        fi
-
-        count=$((count + 1))
-
-        if [ "$count" = "$chunk_size" ]; then
-            log "Adding $count elements to nft set $nft_set_name" "debug"
-            nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
-            array=""
-            count=0
-        fi
-    done < "$filepath"
-
-    if [ -n "$array" ]; then
-        log "Adding $count elements to nft set $nft_set_name" "debug"
-        nft_add_set_elements "$nft_table_name" "$nft_set_name" "$array"
-    fi
-}
\ No newline at end of file
diff --git a/podkop/files/usr/lib/sing_box_config_facade.sh b/podkop/files/usr/lib/sing_box_config_facade.sh
deleted file mode 100644
index 7641673e..00000000
--- a/podkop/files/usr/lib/sing_box_config_facade.sh
+++ /dev/null
@@ -1,335 +0,0 @@
-PODKOP_LIB="/usr/lib/podkop"
-. "$PODKOP_LIB/helpers.sh"
-. "$PODKOP_LIB/sing_box_config_manager.sh"
-
-sing_box_cf_add_dns_server() {
-    local config="$1"
-    local type="$2"
-    local tag="$3"
-    local server="$4"
-    local domain_resolver="$5"
-    local detour="$6"
-
-    local server_address server_port
-    server_address=$(url_get_host "$server")
-    server_port=$(url_get_port "$server")
-
-    case "$type" in
-    udp)
-        [ -z "$server_port" ] && server_port=53
-        config=$(sing_box_cm_add_udp_dns_server "$config" "$tag" "$server_address" "$server_port" "$domain_resolver" \
-            "$detour")
-        ;;
-    dot)
-        [ -z "$server_port" ] && server_port=853
-        config=$(sing_box_cm_add_tls_dns_server "$config" "$tag" "$server_address" "$server_port" "$domain_resolver" \
-            "$detour")
-        ;;
-    doh)
-        [ -z "$server_port" ] && server_port=443
-        local path headers
-        path=$(url_get_path "$server")
-        headers="" # TODO(ampetelin): implement it if necessary
-        config=$(sing_box_cm_add_https_dns_server "$config" "$tag" "$server_address" "$server_port" "$path" "$headers" \
-            "$domain_resolver" "$detour")
-        ;;
-    *)
-        log "Unsupported DNS server type: $type. Aborted." "fatal"
-        exit 1
-        ;;
-    esac
-
-    echo "$config"
-}
-
-sing_box_cf_add_mixed_inbound_and_route_rule() {
-    local config="$1"
-    local tag="$2"
-    local listen_address="$3"
-    local listen_port="$4"
-    local outbound="$5"
-
-    config=$(sing_box_cm_add_mixed_inbound "$config" "$tag" "$listen_address" "$listen_port")
-    config=$(sing_box_cm_add_route_rule "$config" "" "$tag" "$outbound")
-
-    echo "$config"
-}
-
-sing_box_cf_add_proxy_outbound() {
-    local config="$1"
-    local section="$2"
-    local url="$3"
-    local udp_over_tcp="$4"
-
-    url=$(url_decode "$url")
-    url=$(url_strip_fragment "$url")
-
-    local scheme
-    scheme="$(url_get_scheme "$url")"
-    case "$scheme" in
-    socks4 | socks4a | socks5)
-        local tag host port version userinfo username password udp_over_tcp
-
-        tag=$(get_outbound_tag_by_section "$section")
-        host=$(url_get_host "$url")
-        port=$(url_get_port "$url")
-        version="${scheme#socks}"
-        if [ "$scheme" = "socks5" ]; then
-            userinfo=$(url_get_userinfo "$url")
-            if [ -n "$userinfo" ]; then
-                username="${userinfo%%:*}"
-                password="${userinfo#*:}"
-            fi
-        fi
-        config="$(sing_box_cm_add_socks_outbound \
-            "$config" \
-            "$tag" \
-            "$host" \
-            "$port" \
-            "$version" \
-            "$username" \
-            "$password" \
-            "" \
-            "$([ "$udp_over_tcp" == "1" ] && echo 2)" # if udp_over_tcp is enabled, enable version 2
-        )"
-        ;;
-    vless)
-        local tag host port uuid flow packet_encoding
-        tag=$(get_outbound_tag_by_section "$section")
-        host=$(url_get_host "$url")
-        port=$(url_get_port "$url")
-        uuid=$(url_get_userinfo "$url")
-        flow=$(url_get_query_param "$url" "flow")
-        packet_encoding=$(url_get_query_param "$url" "packetEncoding")
-
-        config=$(sing_box_cm_add_vless_outbound "$config" "$tag" "$host" "$port" "$uuid" "$flow" "" "$packet_encoding")
-        config=$(_add_outbound_security "$config" "$tag" "$url")
-        config=$(_add_outbound_transport "$config" "$tag" "$url")
-        ;;
-    ss)
-        local userinfo tag host port method password udp_over_tcp
-
-        userinfo=$(url_get_userinfo "$url")
-        if ! is_shadowsocks_userinfo_format "$userinfo"; then
-            userinfo=$(base64_decode "$userinfo")
-            if [ $? -ne 0 ]; then
-                log "Cannot decode shadowsocks userinfo or it does not match the expected format. Aborted." "fatal"
-                exit 1
-            fi
-        fi
-
-        tag=$(get_outbound_tag_by_section "$section")
-        host=$(url_get_host "$url")
-        port=$(url_get_port "$url")
-        method="${userinfo%%:*}"
-        password="${userinfo#*:}"
-
-        config=$(
-            sing_box_cm_add_shadowsocks_outbound \
-                "$config" \
-                "$tag" \
-                "$host" \
-                "$port" \
-                "$method" \
-                "$password" \
-                "" \
-                "$([ "$udp_over_tcp" == "1" ] && echo 2)" # if udp_over_tcp is enabled, enable version 2
-        )
-        ;;
-    trojan)
-        local tag host port password
-        tag=$(get_outbound_tag_by_section "$section")
-        host=$(url_get_host "$url")
-        port=$(url_get_port "$url")
-        password=$(url_get_userinfo "$url")
-
-        config=$(sing_box_cm_add_trojan_outbound "$config" "$tag" "$host" "$port" "$password")
-        config=$(_add_outbound_security "$config" "$tag" "$url")
-        config=$(_add_outbound_transport "$config" "$tag" "$url")
-        ;;
-    hysteria2 | hy2)
-        local tag host port password obfuscator_type obfuscator_password upload_mbps download_mbps
-        tag=$(get_outbound_tag_by_section "$section")
-        host=$(url_get_host "$url")
-        port="$(url_get_port "$url")"
-        password=$(url_get_userinfo "$url")
-        obfuscator_type=$(url_get_query_param "$url" "obfs")
-        obfuscator_password=$(url_get_query_param "$url" "obfs-password")
-        upload_mbps=$(url_get_query_param "$url" "upmbps")
-        download_mbps=$(url_get_query_param "$url" "downmbps")
-
-        config=$(sing_box_cm_add_hysteria2_outbound "$config" "$tag" "$host" "$port" "$password" "$obfuscator_type" \
-            "$obfuscator_password" "$upload_mbps" "$download_mbps")
-        config=$(_add_outbound_security "$config" "$tag" "$url")
-        ;;
-    *)
-        log "Unsupported proxy $scheme type. Aborted." "fatal"
-        exit 1
-        ;;
-    esac
-
-    echo "$config"
-}
-
-_add_outbound_security() {
-    local config="$1"
-    local outbound_tag="$2"
-    local url="$3"
-
-    local security scheme
-    security=$(url_get_query_param "$url" "security")
-    scheme="$(url_get_scheme "$url")"
-
-    if [ -z "$security" ]; then
-        if [ "$scheme" = "hysteria2" ] || [ "$scheme" = "hy2" ]; then
-            security="tls"
-        fi
-    fi
-
-    case "$security" in
-    tls | reality)
-        local sni insecure alpn fingerprint public_key short_id
-        sni=$(url_get_query_param "$url" "sni")
-        insecure=$(_get_insecure_query_param_from_url "$url")
-        alpn=$(comma_string_to_json_array "$(url_get_query_param "$url" "alpn")")
-        fingerprint=$(url_get_query_param "$url" "fp")
-        public_key=$(url_get_query_param "$url" "pbk")
-        short_id=$(url_get_query_param "$url" "sid")
-
-        if [ "$scheme" = "hysteria2" ] || [ "$scheme" = "hy2" ]; then
-                fingerprint=""
-        fi
-
-        config=$(
-            sing_box_cm_set_tls_for_outbound \
-                "$config" \
-                "$outbound_tag" \
-                "$sni" \
-                "$([ "$insecure" == "1" ] && echo true)" \
-                "$([ "$alpn" == "[]" ] && echo null || echo "$alpn")" \
-                "$fingerprint" \
-                "$public_key" \
-                "$short_id"
-        )
-        ;;
-    none) ;;
-    *)
-        log "Unknown security '$security' detected." "error"
-        ;;
-    esac
-
-    echo "$config"
-}
-
-_get_insecure_query_param_from_url() {
-    local url="$1"
-
-    local insecure
-    insecure=$(url_get_query_param "$url" "allowInsecure")
-    if [ -z "$insecure" ]; then
-        insecure=$(url_get_query_param "$url" "insecure")
-    fi
-
-    echo "$insecure"
-}
-
-_add_outbound_transport() {
-    local config="$1"
-    local outbound_tag="$2"
-    local url="$3"
-
-    local transport
-    transport=$(url_get_query_param "$url" "type")
-    case "$transport" in
-    tcp | raw) ;;
-    ws)
-        local ws_path ws_host ws_early_data
-        ws_path=$(url_get_query_param "$url" "path")
-        ws_host=$(url_get_query_param "$url" "host")
-        ws_early_data=$(url_get_query_param "$url" "ed")
-
-        config=$(
-            sing_box_cm_set_ws_transport_for_outbound "$config" "$outbound_tag" "$ws_path" "$ws_host" "$ws_early_data"
-        )
-        ;;
-    grpc)
-        # TODO(ampetelin): Add handling of optional gRPC parameters; example links are needed.
-        local grpc_service_name
-        grpc_service_name=$(url_get_query_param "$url" "serviceName")
-
-        config=$(
-            sing_box_cm_set_grpc_transport_for_outbound "$config" "$outbound_tag" "$grpc_service_name"
-        )
-        ;;
-    *)
-        log "Unknown transport '$transport' detected." "error"
-        ;;
-    esac
-
-    echo "$config"
-}
-
-sing_box_cf_add_json_outbound() {
-    local config="$1"
-    local section="$2"
-    local json_outbound="$3"
-
-    local tag
-    tag=$(get_outbound_tag_by_section "$section")
-
-    config=$(sing_box_cm_add_raw_outbound "$config" "$tag" "$json_outbound")
-
-    echo "$config"
-}
-
-sing_box_cf_add_interface_outbound() {
-    local config="$1"
-    local section="$2"
-    local interface_name="$3"
-
-    local tag
-    tag=$(get_outbound_tag_by_section "$section")
-
-    config=$(sing_box_cm_add_interface_outbound "$config" "$tag" "$interface_name")
-
-    echo "$config"
-}
-
-sing_box_cf_proxy_domain() {
-    local config="$1"
-    local inbound="$2"
-    local domain="$3"
-    local outbound="$4"
-
-    tag="$(gen_id)"
-    config=$(sing_box_cm_add_route_rule "$config" "$tag" "$inbound" "$outbound")
-    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "domain" "$domain")
-
-    echo "$config"
-}
-
-sing_box_cf_override_domain_port() {
-    local config="$1"
-    local domain="$2"
-    local port="$3"
-
-    tag="$(gen_id)"
-    config=$(sing_box_cm_add_options_route_rule "$config" "$tag")
-    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "domain" "$domain")
-    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "override_port" "$port")
-
-    echo "$config"
-}
-
-sing_box_cf_add_single_key_reject_rule() {
-    local config="$1"
-    local inbound="$2"
-    local key="$3"
-    local value="$4"
-
-    tag="$(gen_id)"
-    config=$(sing_box_cm_add_reject_route_rule "$config" "$tag" "$inbound")
-    config=$(sing_box_cm_patch_route_rule "$config" "$tag" "$key" "$value")
-
-    echo "$config"
-}
diff --git a/tests/Dockerfile b/tests/Dockerfile
new file mode 100644
index 00000000..f80a73ef
--- /dev/null
+++ b/tests/Dockerfile
@@ -0,0 +1,85 @@
+# syntax=docker/dockerfile:1
+# ──────────────────────────────────────────────────────────────────
+# Netshift Evolution — OpenWrt Smoke Test Container
+#
+# Purpose:
+#   Run netshift in an OpenWrt rootfs container to verify functionality
+#   BEFORE deploying to a physical router.
+#
+# What this tests:
+#   ✓ Dependency availability (sing-box, curl, jq, base64, dig)
+#   ✓ UCI config parsing and validation
+#   ✓ Shell script syntax (ash) — all sourced libraries
+#   ✓ sing-box config generation (dry run)
+#   ✓ Helper functions (HWID, URL parsing, IP validation)
+#   ✓ Subscription URL handling
+#   ✓ nftables rules syntax (table creation, rule generation)
+#   ✓ dnsmasq config backup/restore
+#   ✓ Service lifecycle (start/stop/reload)
+#   ✓ Diagnostics (check_sing_box, check_nft_rules, global_check)
+#
+# Limitations (kernel-level features):
+#   ✗ TProxy packet interception (needs real kernel + kmod-nft-tproxy)
+#   ✗ Full sing-box runtime (needs real network interfaces)
+#   ✗ Clash API WebSocket (needs running sing-box process)
+#
+# Usage:
+#   docker compose -f tests/docker-compose.yml up --build
+#   docker compose -f tests/docker-compose.yml run --rm netshift-test
+# ──────────────────────────────────────────────────────────────────
+
+# ── Stage 1: Загрузка официального чистого rootfs ─────────────────
+FROM --platform=linux/amd64 alpine:latest AS builder
+WORKDIR /rootfs
+# Скачиваем и распаковываем оригинальный OpenWrt 24.10.6
+RUN apk add --no-cache curl tar gzip && \
+    curl -sSL https://downloads.openwrt.org/releases/24.10.6/targets/x86/64/openwrt-24.10.6-x86-64-rootfs.tar.gz | tar -xz
+
+# ── Stage 2: Сборка финального контейнера ─────────────────────────
+FROM scratch
+# Переносим настоящую систему OpenWrt
+COPY --from=builder /rootfs /
+
+LABEL org.opencontainers.image.title="Netshift Evolution Test"
+LABEL org.opencontainers.image.description="Official OpenWrt 24.10.6 rootfs for Netshift testing"
+
+# Для корректной работы opkg внутри пустого Docker нужна эта директория
+RUN mkdir -p /var/lock
+
+# ── Install runtime dependencies ─────────────────────────────────
+RUN opkg update && \
+    opkg install \
+        sing-box \
+        curl \
+        jq \
+        coreutils-base64 \
+        bind-dig \
+        nftables \
+    && rm -rf /var/opkg-lists/*
+
+# ── Create netshift directory structure ───────────────────────────
+RUN mkdir -p /usr/lib/netshift \
+    /tmp/sing-box/rulesets \
+    /tmp/sing-box/subscriptions \
+    /var/run
+
+# ── Copy netshift source files ────────────────────────────────────
+# All shell scripts, config, and init files are mounted at runtime
+# via docker-compose volumes. This image contains only the base OS
+# and dependencies. See docker-compose.yml for bind mounts.
+
+# ── Prepare a minimal /etc/config/netshift for testing ────────────
+# (real config will be mounted by docker-compose or entrypoint)
+COPY netshift/files/etc/config/netshift /etc/config/netshift.test
+
+# ── Pre-create /lib/functions paths (OpenWrt UCI stubs) ───────────
+# The rootfs image may not include the full UCI subsystem.
+# The entrypoint script handles this gracefully.
+
+# ── Set up entrypoint ────────────────────────────────────────────
+COPY tests/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+WORKDIR /netshift
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["all"]
diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml
new file mode 100644
index 00000000..6387be8d
--- /dev/null
+++ b/tests/docker-compose.yml
@@ -0,0 +1,66 @@
+# ──────────────────────────────────────────────────────────────────
+# Netshift Evolution — Docker Compose Test Environment
+#
+# Launch:
+#   docker compose -f tests/docker-compose.yml build
+#   docker compose -f tests/docker-compose.yml up
+#
+# Run specific test:
+#   docker compose -f tests/docker-compose.yml run --rm netshift-test <test-name>
+#
+# Test names: all, deps, syntax, config, helpers, jq, cm, sb, nft,
+#             nftv6, selmark, isolation, monfd, unsupported, diagnostics, subscription, insecure, rejected,
+#             jobstate, selfheal, dnsdetour, suburlopt, globalproxy, stablecheck,
+#             extcheck, netshiftcheck, latesttag, ghredirect, selfupdate,
+#             backupguard
+# ──────────────────────────────────────────────────────────────────
+
+services:
+  netshift-test:
+    build:
+      context: ..
+      dockerfile: tests/Dockerfile
+      args:
+        - NETSHIFT_VERSION=test
+    image: netshift-evolution:test
+    container_name: netshift-test
+    hostname: OpenWrt
+
+    # ── Kernel capabilities for nftables ────────────────────────
+    cap_add:
+      - NET_ADMIN      # nftables table/rule management
+      - NET_RAW        # raw socket operations
+      - SYS_ADMIN      # needed for some nft operations in containers
+
+    # ── Network ─────────────────────────────────────────────────
+    # host mode gives us full network access for DNS/subscription tests.
+    # Remove 'network_mode: host' if you don't need real network.
+    network_mode: host
+    # Alternative: use bridge mode with DNS configured
+    # dns:
+    #   - 8.8.8.8
+    #   - 1.1.1.1
+
+    # ── Volumes (source code bind mount) ─────────────────────────
+    volumes:
+      - ../netshift/files:/netshift/files:ro
+      - ./entrypoint.sh:/usr/local/bin/entrypoint.sh:ro
+      - ./test-results:/tmp/test-results
+
+    # ── Environment ──────────────────────────────────────────────
+    environment:
+      - NETSHIFT_VERSION=test
+      - TEST_SKIP_NETWORK=${TEST_SKIP_NETWORK:-0}
+      - TEST_VERBOSE=${TEST_VERBOSE:-0}
+
+    # ── Health check ─────────────────────────────────────────────
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "entrypoint"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+    # Don't restart — this is a test container
+    restart: "no"
+    stdin_open: true
+    tty: true
diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh
new file mode 100755
index 00000000..f5aa3787
--- /dev/null
+++ b/tests/entrypoint.sh
@@ -0,0 +1,6332 @@
+#!/bin/sh
+# ──────────────────────────────────────────────────────────────────
+# Netshift Evolution — Smoke Test Suite Entrypoint
+#
+# Runs validation tests against the netshift codebase in an OpenWrt
+# rootfs container. Designed for CI and pre-deployment verification.
+# ──────────────────────────────────────────────────────────────────
+
+set -e
+
+# ── Colors ──────────────────────────────────────────────────────
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+PASS=0
+FAIL=0
+SKIP=0
+RESULTS_DIR="${RESULTS_DIR:-/tmp/test-results}"
+NETSHIFT_SRC="${NETSHIFT_SRC:-/netshift/files}"
+NETSHIFT_LIB_DIR="${NETSHIFT_SRC}/usr/lib"
+
+mkdir -p "$RESULTS_DIR"
+
+# ── Helpers ─────────────────────────────────────────────────────
+header() {
+    printf "\n${BOLD}${CYAN}━━━ %s ━━━${NC}\n" "$1"
+}
+
+pass() {
+    PASS=$((PASS + 1))
+    printf "  ${GREEN}✓${NC} %s\n" "$1"
+}
+
+fail() {
+    FAIL=$((FAIL + 1))
+    printf "  ${RED}✗${NC} %s\n" "$1"
+    if [ -n "$2" ]; then
+        printf "    ${RED}→${NC} %s\n" "$2"
+    fi
+}
+
+skip() {
+    SKIP=$((SKIP + 1))
+    printf "  ${YELLOW}⊘${NC} %s (skipped)\n" "$1"
+}
+
+summary() {
+    printf "\n${BOLD}──────────────────────────────────────${NC}\n"
+    printf "Results: ${GREEN}%d passed${NC}" "$PASS"
+    printf " / ${RED}%d failed${NC}" "$FAIL"
+    if [ "$SKIP" -gt 0 ]; then
+        printf " / ${YELLOW}%d skipped${NC}" "$SKIP"
+    fi
+    printf "\n"
+    if [ "$FAIL" -gt 0 ]; then
+        printf "${RED}${BOLD}✗ TESTS FAILED${NC} ($FAIL failure(s))\n"
+        exit 1
+    else
+        printf "${GREEN}${BOLD}✓ ALL TESTS PASSED${NC} ($PASS test(s))\n"
+        exit 0
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Dependency Check
+# ─────────────────────────────────────────────────────────────────
+test_deps() {
+    header "Dependency Check"
+
+    for bin in sing-box curl jq base64 dig nft ash; do
+        if command -v "$bin" > /dev/null 2>&1; then
+            pass "$bin is available ($(command -v "$bin"))"
+        else
+            fail "$bin is NOT available"
+        fi
+    done
+
+    # Version checks
+    if command -v sing-box > /dev/null 2>&1; then
+        local sb_ver
+        sb_ver=$(sing-box version 2>/dev/null | head -1 | awk '{print $NF}')
+        if [ -n "$sb_ver" ]; then
+            pass "sing-box version: $sb_ver"
+        else
+            fail "sing-box version detection failed"
+        fi
+    fi
+
+    if command -v jq > /dev/null 2>&1; then
+        local jq_ver
+        jq_ver=$(jq --version 2>/dev/null | awk -F- '{print $2}')
+        if [ -n "$jq_ver" ]; then
+            pass "jq version: $jq_ver"
+        else
+            fail "jq version detection failed"
+        fi
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Shell Syntax & Loading
+# ─────────────────────────────────────────────────────────────────
+test_syntax() {
+    header "Shell Syntax & Library Loading"
+
+    local lib="${NETSHIFT_LIB_DIR}"
+
+    # Test each library file for syntax errors
+    for f in \
+        "$lib/constants.sh" \
+        "$lib/helpers.sh" \
+        "$lib/logging.sh" \
+        "$lib/nft.sh" \
+        "$lib/rulesets.sh" \
+        "$lib/sing_box_config_manager.sh" \
+        "$lib/sing_box_config_facade.sh" \
+        "$lib/updater.sh"; do
+
+        if [ ! -r "$f" ]; then
+            fail "File not found: $f"
+            continue
+        fi
+
+        if ash -n "$f" 2>&1; then
+            pass "Syntax OK: $(basename "$f")"
+        else
+            fail "Syntax ERROR in $(basename "$f")" "$(ash -n "$f" 2>&1)"
+        fi
+    done
+
+    # Parse-check the CLI dispatcher itself (not just the libs).
+    local cli="${NETSHIFT_SRC}/usr/bin/netshift"
+    if [ ! -r "$cli" ]; then
+        fail "File not found: $cli"
+    elif ash -n "$cli" 2>&1; then
+        pass "Syntax OK: $(basename "$cli")"
+    else
+        fail "Syntax ERROR in $(basename "$cli")" "$(ash -n "$cli" 2>&1)"
+    fi
+
+    # Guard against re-introduction of the task-004 double-encode mojibake
+    # (UTF-8 emoji/box-drawing read as CP1251 and re-saved as UTF-8). The
+    # corrupted bytes render as 🅠/ ┅ /  ; build the byte markers with
+    # printf octal escapes (busybox sed/grep lack \x).
+    if [ -r "$cli" ]; then
+        local mojibake_found=0
+        local marker
+        for marker in '\321\200\321\237' '\320\262\342\200\235' '\320\262\320\202'; do
+            if grep -qF "$(printf "$marker")" "$cli" 2>/dev/null; then
+                mojibake_found=1
+            fi
+        done
+        if [ "$mojibake_found" -eq 0 ]; then
+            pass "netshift CLI free of double-encode mojibake"
+        else
+            fail "netshift CLI contains residual mojibake (рџ/в”/вЂ)"
+        fi
+    fi
+
+    # Test that libraries can be sourced (requires /lib/functions stubs).
+    # Use a temp script to avoid fragile shell quoting.
+    local source_test="/tmp/netshift-source-test-$$.sh"
+    cat > "$source_test" << EOF
+NETSHIFT_LIB="$lib"
+NETSHIFT_CONFIG="/etc/config/netshift.test"
+mkdir -p /lib/config /lib/functions
+touch /etc/config/dhcp /etc/config/sing-box
+. "$lib/logging.sh" 2>/dev/null && echo "OK"
+EOF
+
+    if ash "$source_test" 2>&1 | grep -q "OK"; then
+        pass "logging.sh can be sourced"
+    else
+        skip "logging.sh source test (needs OpenWrt /lib/functions)"
+    fi
+    rm -f "$source_test"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: UCI Config Validation
+# ─────────────────────────────────────────────────────────────────
+test_config() {
+    header "UCI Config Validation"
+
+    local config="${NETSHIFT_SRC}/etc/config/netshift"
+
+    if [ ! -r "$config" ]; then
+        fail "Config file not found: $config"
+        return
+    fi
+
+    pass "Config file exists: $config"
+
+    # Check for required sections
+    if grep -q "config settings" "$config"; then
+        pass "settings section present"
+    else
+        fail "settings section missing"
+    fi
+
+    if grep -q "config section" "$config"; then
+        pass "section (proxy) present"
+    else
+        fail "section (proxy) missing"
+    fi
+
+    # Check that core options exist
+    for opt in "shutdown_correctly" "dns_type" "connection_type" "proxy_config_type"; do
+        if grep -q "option $opt" "$config"; then
+            pass "option $opt present"
+        else
+            fail "option $opt missing"
+        fi
+    done
+
+    # Count sections
+    local section_count
+    section_count=$(grep -c "^config section\|^#config section" "$config")
+    pass "Sections in config: $section_count"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Helper Functions
+# ─────────────────────────────────────────────────────────────────
+test_helpers() {
+    header "Helper Functions"
+
+    local helpers="${NETSHIFT_LIB_DIR}/helpers.sh"
+
+    if [ ! -r "$helpers" ]; then
+        fail "helpers.sh not found"
+        return
+    fi
+
+    # Write test script to a temp file to avoid quoting issues
+    local tmp="/tmp/test-helpers-$$.sh"
+    cat > "$tmp" << 'TESTEOF'
+mkdir -p /lib/config /lib/functions /tmp/sysinfo
+echo 'OpenWrt Test' > /tmp/sysinfo/model
+touch /etc/config/dhcp /etc/config/sing-box
+
+. "HELPERS_PATH"
+
+# Test is_ipv4
+is_ipv4 '192.168.1.1' && echo 'ipv4:OK' || echo 'ipv4:FAIL'
+is_ipv4 'not-an-ip' && echo 'ipv4-bad:FAIL' || echo 'ipv4-bad:OK'
+
+# Test url_is_ipv6_literal (our fork's IPv6 helper; expects a full URL with a bracketed host)
+url_is_ipv6_literal 'http://[::1]:443/test' && echo 'ipv6-literal:OK' || echo 'ipv6-literal:FAIL'
+url_is_ipv6_literal 'https://example.com:8080/path' && echo 'ipv6-literal-neg:FAIL' || echo 'ipv6-literal-neg:OK'
+
+# Test is_ipv4_ip_or_ipv4_cidr
+is_ipv4_ip_or_ipv4_cidr '10.0.0.0/8' && echo 'ipv4cidr:OK' || echo 'ipv4cidr:FAIL'
+
+# Test generate_hwid (needs WAN MAC)
+generate_hwid 2>/dev/null && echo 'hwid:OK' || echo 'hwid:SKIP'
+
+# Test get_device_model
+get_device_model 2>/dev/null && echo 'model:OK' || echo 'model:SKIP'
+
+# Test URL parsing
+url_get_host 'https://example.com:8080/path' | grep -q 'example.com' && echo 'url-host:OK' || echo 'url-host:FAIL'
+url_get_port 'https://example.com:8080/path' | grep -q '8080' && echo 'url-port:OK' || echo 'url-port:FAIL'
+url_get_port 'http://[::1]:443/test' | grep -q '443' && echo 'url-ipv6-port:OK' || echo 'url-ipv6-port:FAIL'
+
+echo 'DONE'
+TESTEOF
+
+    sed -i "s|HELPERS_PATH|$helpers|" "$tmp"
+
+    sh "$tmp" 2>&1 | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+
+    rm -f "$tmp"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: NFT Rules Syntax
+# ─────────────────────────────────────────────────────────────────
+test_nft() {
+    header "NFT Rules Syntax"
+
+    if ! command -v nft > /dev/null 2>&1; then
+        skip "nft not available"
+        return
+    fi
+
+    # Test basic nft operations
+    local test_table="netshift_test_$$"
+    if nft add table inet "$test_table" 2>/dev/null; then
+        pass "nft table creation works"
+        nft delete table inet "$test_table" 2>/dev/null
+    else
+        fail "nft table creation failed (are capabilities set?)"
+        return
+    fi
+
+    # Test set creation
+    if nft add table inet "$test_table" 2>/dev/null && \
+       nft add set inet "$test_table" testset '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null && \
+       nft add element inet "$test_table" testset '{ 10.0.0.0/8 }' 2>/dev/null; then
+        pass "nft set and element operations work"
+        nft delete table inet "$test_table" 2>/dev/null
+    else
+        fail "nft set/element operations failed"
+        nft delete table inet "$test_table" 2>/dev/null
+    fi
+
+    # Test chain creation
+    if nft add table inet "$test_table" 2>/dev/null && \
+       nft add chain inet "$test_table" testchain '{ type filter hook input priority 0; policy accept; }' 2>/dev/null; then
+        pass "nft chain creation works"
+        nft delete table inet "$test_table" 2>/dev/null
+    else
+        fail "nft chain creation failed"
+        nft delete table inet "$test_table" 2>/dev/null
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: NFT IPv6 TProxy regression (B-01 blocker guard)
+#
+# The PR #11 IPv6 tproxy rule was emitted UNBRACKETED
+# (`tproxy ip6 to ::1:1603`), which nft silently normalizes to a
+# portless bare address (observed forms: `[::0.1.22.3]` on nftables
+# v1.1.3 where 1603 == 0x1603, and `[::1:1603]` on OpenWRT 24.10.6).
+# Either way the port is lost. The backend fix emits the BRACKETED
+# form `[::1]:1603`. This test pins that
+# contract at the real nft level so any revert fails the suite.
+# Constants drive rule construction; the expected normalized
+# `[::1]:1603` literal is the contract we deliberately hardcode.
+# ─────────────────────────────────────────────────────────────────
+test_nft_ipv6() {
+    header "NFT IPv6 TProxy Regression"
+
+    if ! command -v nft > /dev/null 2>&1; then
+        skip "nft not available"
+        return
+    fi
+
+    local constants="${NETSHIFT_LIB_DIR}/constants.sh"
+    if [ ! -f "$constants" ]; then
+        fail "constants.sh not found at $constants"
+        return
+    fi
+
+    # Source the real runtime contract values (v6 tproxy addr/port).
+    # shellcheck disable=SC1090
+    . "$constants"
+
+    if [ -z "$SB_TPROXY_INBOUND_ADDRESS_V6" ] || [ -z "$SB_TPROXY_INBOUND_PORT_V6" ]; then
+        fail "v6 tproxy constants missing (SB_TPROXY_INBOUND_ADDRESS_V6/_PORT_V6)"
+        return
+    fi
+
+    local test_table="netshift_v6_test_$$"
+
+    # ── ipv6_addr interval set + v6 element (mirrors the ipv4 set test) ──
+    if nft add table inet "$test_table" 2>/dev/null && \
+       nft add set inet "$test_table" testset6 '{ type ipv6_addr; flags interval; auto-merge; }' 2>/dev/null && \
+       nft add element inet "$test_table" testset6 '{ fc00::/7 }' 2>/dev/null; then
+        pass "nft-v6-set-element:OK (ipv6_addr interval set + fc00::/7)"
+    else
+        fail "nft-v6-set-element:FAIL (ipv6_addr interval set / element insert failed)"
+    fi
+    nft delete table inet "$test_table" 2>/dev/null
+
+    # ── v6 tproxy rule: build EXACTLY as the backend emits, list back ──
+    # Capability-gate: if adding the rule errors for a kernel/capability
+    # reason (no ip6 tproxy support), skip instead of false-failing.
+    local add_err=""
+    nft add table inet "$test_table" 2>/dev/null
+    nft add chain inet "$test_table" proxy \
+        '{ type filter hook prerouting priority -100; policy accept; }' 2>/dev/null
+    # A v6 daddr return rule (exclusion) coexisting with the tproxy rule.
+    nft add rule inet "$test_table" proxy ip6 daddr fc00::/7 counter return 2>/dev/null
+
+    if add_err="$(nft add rule inet "$test_table" proxy meta l4proto tcp \
+            tproxy ip6 to "[$SB_TPROXY_INBOUND_ADDRESS_V6]:$SB_TPROXY_INBOUND_PORT_V6" counter 2>&1)"; then
+        local listed=""
+        listed="$(nft list chain inet "$test_table" proxy 2>/dev/null)"
+
+        # Positive: MUST normalize to the bracketed [::1]:1603 form.
+        if echo "$listed" | grep -q 'tproxy ip6 to \[::1\]:1603'; then
+            pass "nft-v6-tproxy-bracketed:OK (normalizes to [::1]:1603)"
+        else
+            fail "nft-v6-tproxy-bracketed:FAIL (expected [::1]:1603)" \
+                "$(echo "$listed" | grep -i 'tproxy ip6' || echo "$listed")"
+        fi
+
+        # Negative guard: a buggy/portless bare v6 dest must NOT appear.
+        # The unbracketed `::1:1603` is parsed as a bare address (no port);
+        # nft re-prints it bracketed but mangled. Observed normalizations:
+        #   nftables v1.1.3:  tproxy ip6 to [::0.1.22.3]   (1603 -> 0x1603)
+        #   OpenWRT 24.10.6:  tproxy ip6 to [::1:1603]     (no `]:` port sep)
+        # So the robust marker is: a `tproxy ip6 to [...]` line that is NOT
+        # the correct `[::1]:1603`. Such a line is the bug; its absence is OK.
+        if echo "$listed" | grep 'tproxy ip6 to \[' | grep -qv '\[::1\]:1603'; then
+            fail "nft-v6-tproxy-no-bare:FAIL (buggy portless bare form present)" \
+                "$(echo "$listed" | grep -i 'tproxy ip6')"
+        else
+            pass "nft-v6-tproxy-no-bare:OK (no portless bare ip6 form)"
+        fi
+    else
+        case "$add_err" in
+            *[Nn]ot\ supported*|*[Oo]peration\ not\ supported*|*[Nn]o\ such\ file*)
+                skip "nft-v6-tproxy: kernel lacks ip6 tproxy support ($add_err)"
+                ;;
+            *)
+                fail "nft-v6-tproxy:FAIL (rule add failed unexpectedly)" "$add_err"
+                ;;
+        esac
+    fi
+
+    nft delete table inet "$test_table" 2>/dev/null
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Destination-selective nft marking (task-034)
+#
+# Regression: 0.8.6 marked ALL LAN tcp/udp into tproxy (mangle prerouting),
+# so EVERY forwarded flow (e.g. a torrent to a random direct IP) entered
+# sing-box -> sniff + full route-rule walk per connection -> 100% CPU on a
+# weak router, even when only selected lists were configured for proxying.
+# 0.8.5 marked SELECTIVELY: only proxied destination subnets
+# (@netshift_subnets) + the FakeIP range (proxied domains). task-034 restores
+# that selective model, keeping mark-EVERYTHING only when a global_proxy
+# section is active.
+#
+# This test awk-extracts the SHIPPED create_nft_rules (+ its task-034 helpers)
+# verbatim from the live bin, stubs the few UCI/predicate functions, and runs
+# the real ruleset against a real nft table, then inspects the mangle chain.
+# Five cases (per the spec):
+#   1. selective marking present + NO unconditional mark-all (default)
+#   2. a direct (non-listed) destination is NOT marked -> bypasses sing-box
+#      (rule-structure check; + live counter when runnable)
+#   3. global_proxy override = mark-all IS present
+#   4. IPv6 mirror selective when enable_ipv6=1 (+ no v6 mark-all)
+#   5. domain routing intact: FakeIP range still marked; sing-box check passes
+# ─────────────────────────────────────────────────────────────────
+test_selective_marking() {
+    header "Destination-selective nft marking (task-034)"
+
+    if ! command -v nft > /dev/null 2>&1; then
+        skip "nft not available"
+        return
+    fi
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    local lib="${NETSHIFT_LIB_DIR}"
+    if [ ! -r "$bin" ] || [ ! -r "$lib/constants.sh" ] || [ ! -r "$lib/nft.sh" ]; then
+        skip "selective-marking (bin / constants.sh / nft.sh not found)"
+        return
+    fi
+
+    # Source the runtime contract values + nft helpers for the constants the
+    # assertions reference (NFT_COMMON_SET_NAME, FakeIP ranges, marks).
+    # shellcheck disable=SC1090
+    . "$lib/constants.sh"
+
+    # Confirm the new constants were actually re-added (DoD item).
+    if [ -n "$NFT_COMMON_SET_NAME" ] && [ -n "$NFT_COMMON_SET_NAME_V6" ]; then
+        pass "selective:constants — NFT_COMMON_SET_NAME(+v6) defined"
+    else
+        fail "selective:constants — NFT_COMMON_SET_NAME(+v6) missing"
+        return
+    fi
+
+    # Common driver preamble shared by every scenario. Args via env:
+    #   SCN_TABLE        unique nft table name for this run
+    #   SCN_IPV6         1 to enable the IPv6 mirror, else 0
+    #   SCN_GLOBALPROXY  non-empty -> global_proxy section name, else ""
+    #   SCN_BLOCKDOH     1 to enable DoH-block CIDR marking, else 0
+    #   SCN_FULLROUTED   space-separated fully_routed_ips (proxy section), else ""
+    # The driver writes the real shipped create_nft_rules + helpers, runs it,
+    # then dumps `nft list chain inet <table> mangle` to stdout for the parent
+    # to parse. Each emitted token is a name:OK / name:FAIL line.
+    local drv="/tmp/netshift-selmark-$$.sh"
+    cat > "$drv" << 'SELEOF'
+set -e
+LIB="LIB_DIR_PLACEHOLDER"
+BIN="BIN_PATH_PLACEHOLDER"
+
+# shellcheck disable=SC1090
+. "$LIB/constants.sh"
+# shellcheck disable=SC1090
+. "$LIB/nft.sh"
+
+# Override the table name so we never touch the real NetShiftTable.
+NFT_TABLE_NAME="$SCN_TABLE"
+
+# Quiet logger.
+log() { :; }
+nolog() { :; }
+echolog() { :; }
+
+# ── UCI / predicate stubs driven by env ──────────────────────────
+netshift_ipv6_enabled() { [ "${SCN_IPV6:-0}" = "1" ]; }
+get_global_proxy_section() { printf '%s' "${SCN_GLOBALPROXY:-}"; }
+
+config_get() {
+    # $1=var $2=section $3=option [$4=default]
+    eval "$1=\"\${4:-}\""
+    case "$3" in
+        source_network_interfaces) eval "$1=\"selmark0\"" ;;
+    esac
+}
+config_get_bool() {
+    # $1=var $2=section $3=option [$4=default]
+    eval "$1=\"\${4:-0}\""
+    case "$3" in
+        block_doh) eval "$1=\"${SCN_BLOCKDOH:-0}\"" ;;
+        exclude_ntp) eval "$1=\"0\"" ;;
+    esac
+}
+# fully_routed_ips iteration: one proxy section "frsec" carrying SCN_FULLROUTED.
+config_foreach() {
+    # $1=callback $2=type
+    [ -n "${SCN_FULLROUTED:-}" ] || return 0
+    "$1" "frsec"
+}
+config_list_foreach() {
+    # $1=section $2=option $3=callback
+    [ "$2" = "fully_routed_ips" ] || return 0
+    for _ip in ${SCN_FULLROUTED:-}; do
+        "$3" "$_ip"
+    done
+}
+# The fully_routed section is always a proxy section in this harness.
+# (config_get above returns connection_type default "", so force it here.)
+_orig_cg=config_get
+
+# Extract the shipped functions verbatim (column-0 opener to column-0 '}').
+for fn in nft_init_interfaces_set populate_netshift_subnets_from_file \
+          populate_netshift_subnets_from_string nft_mark_fully_routed_source_ips \
+          _nft_mark_fully_routed_ips_for_section _nft_mark_fully_routed_ip_handler \
+          create_nft_rules; do
+    eval "$(awk -v f="$fn" '$0 ~ "^"f"\\(\\) \\{"{p=1} p{print} p&&/^\}/{exit}' "$BIN")"
+done
+
+# The fully_routed handler reads connection_type via config_get; make that
+# section a proxy section so its IPs get a source mark rule.
+config_get() {
+    eval "$1=\"\${4:-}\""
+    case "$3" in
+        source_network_interfaces) eval "$1=\"selmark0\"" ;;
+        connection_type) eval "$1=\"proxy\"" ;;
+        fully_routed_ips) eval "$1=\"${SCN_FULLROUTED:-}\"" ;;
+    esac
+}
+
+# SCN_PRESEED: when set, do NOT start from a clean slate. Instead leave behind a
+# STALE mark-EVERYTHING table (as a previous global_proxy/0.8.6 run would) and
+# then run create_nft_rules on top of it WITHOUT a stop — faithfully reproducing
+# the procd-respawn / in-place-upgrade service path that the original test
+# missed. The fix (create_nft_rules flushing the table first) must make the
+# FINAL live chain purely selective regardless of this leftover.
+if [ "${SCN_PRESEED:-0}" = "1" ]; then
+    nft delete table inet "$NFT_TABLE_NAME" 2>/dev/null || true
+    nft add table inet "$NFT_TABLE_NAME"
+    nft add set inet "$NFT_TABLE_NAME" "$NFT_LOCALV4_SET_NAME" '{ type ipv4_addr; flags interval; auto-merge; }'
+    nft add set inet "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME" '{ type ifname; flags interval; }'
+    nft add element inet "$NFT_TABLE_NAME" "$NFT_INTERFACE_SET_NAME" '{ "selmark0" }'
+    nft add chain inet "$NFT_TABLE_NAME" mangle '{ type filter hook prerouting priority -150; policy accept; }'
+    nft add rule inet "$NFT_TABLE_NAME" mangle ct status dnat return
+    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" ip daddr "@$NFT_LOCALV4_SET_NAME" return
+    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" meta l4proto tcp meta mark set "$NFT_FAKEIP_MARK" counter
+    nft add rule inet "$NFT_TABLE_NAME" mangle iifname "@$NFT_INTERFACE_SET_NAME" meta l4proto udp meta mark set "$NFT_FAKEIP_MARK" counter
+    # Build on TOP of the stale table (no nft delete here on purpose).
+    create_nft_rules >/dev/null 2>&1
+else
+    # Clean slate, then build the real ruleset.
+    nft delete table inet "$NFT_TABLE_NAME" 2>/dev/null || true
+    create_nft_rules >/dev/null 2>&1
+fi
+
+nft list chain inet "$NFT_TABLE_NAME" mangle 2>/dev/null
+echo "---SETS---"
+nft list set inet "$NFT_TABLE_NAME" "$NFT_COMMON_SET_NAME" 2>/dev/null || true
+SELEOF
+    sed -i "s|LIB_DIR_PLACEHOLDER|$lib|g; s|BIN_PATH_PLACEHOLDER|$bin|g" "$drv"
+
+    # ── Scenario 1+2+5: default selective (no global_proxy) ──────────
+    local out1
+    out1="$(SCN_TABLE="selmark_def_$$" SCN_IPV6=0 SCN_GLOBALPROXY="" SCN_BLOCKDOH=0 \
+        SCN_FULLROUTED="" sh "$drv" 2>/dev/null)"
+    nft delete table inet "selmark_def_$$" 2>/dev/null
+
+    # The selective marks must be present.
+    if echo "$out1" | grep -q "@$NFT_COMMON_SET_NAME"; then
+        pass "selective:default — proxied-subnets set rule present (@$NFT_COMMON_SET_NAME)"
+    else
+        fail "selective:default — @$NFT_COMMON_SET_NAME mark rule missing" "$(echo "$out1" | grep -i 'mark set' || echo "$out1")"
+    fi
+    if echo "$out1" | grep -Fq "$SB_FAKEIP_INET4_RANGE"; then
+        pass "selective:default — FakeIP range marked ($SB_FAKEIP_INET4_RANGE) [domain routing intact]"
+    else
+        fail "selective:default — FakeIP range mark rule missing"
+    fi
+    # The proxied-subnets union set must exist (DoD: created).
+    if echo "$out1" | grep -q -- "---SETS---" && \
+       echo "$out1" | sed -n '/---SETS---/,$p' | grep -q "set $NFT_COMMON_SET_NAME"; then
+        pass "selective:default — union set $NFT_COMMON_SET_NAME created"
+    else
+        fail "selective:default — union set $NFT_COMMON_SET_NAME not created"
+    fi
+
+    # Regression bypass: there must be NO unconditional mark-all tcp/udp rule
+    # (a mark-set rule that has NO daddr / saddr / set qualifier). We detect it
+    # structurally: a `meta l4proto (tcp|udp) meta mark set` line that does NOT
+    # also contain `daddr` or `saddr`.
+    local markall_lines
+    markall_lines="$(echo "$out1" | grep 'meta mark set' | grep 'l4proto' | grep -v 'daddr' | grep -v 'saddr' || true)"
+    if [ -z "$markall_lines" ]; then
+        pass "selective:bypass — NO unconditional mark-all rule (direct IP NOT marked)"
+    else
+        fail "selective:bypass — unconditional mark-all rule still present" "$markall_lines"
+    fi
+
+    # ── Scenario 3: global_proxy override -> mark-all present ────────
+    local out3
+    out3="$(SCN_TABLE="selmark_gp_$$" SCN_IPV6=0 SCN_GLOBALPROXY="gpsec" SCN_BLOCKDOH=0 \
+        SCN_FULLROUTED="" sh "$drv" 2>/dev/null)"
+    nft delete table inet "selmark_gp_$$" 2>/dev/null
+
+    local gp_markall
+    gp_markall="$(echo "$out3" | grep 'meta mark set' | grep 'l4proto' | grep -v 'daddr' | grep -v 'saddr' || true)"
+    if [ -n "$gp_markall" ]; then
+        pass "selective:globalproxy — mark-EVERYTHING rules present under global_proxy"
+    else
+        fail "selective:globalproxy — mark-all rules missing under global_proxy" "$out3"
+    fi
+    # And under global_proxy the selective @set rule should NOT be added.
+    if echo "$out3" | grep -q "@$NFT_COMMON_SET_NAME"; then
+        fail "selective:globalproxy — selective @set rule unexpectedly present under global_proxy"
+    else
+        pass "selective:globalproxy — selective @set rule correctly bypassed"
+    fi
+
+    # ── Scenario 4: IPv6 mirror selective (enable_ipv6=1) ────────────
+    # Only meaningful if the kernel supports the v6 set + ip6 rules.
+    local out4
+    out4="$(SCN_TABLE="selmark_v6_$$" SCN_IPV6=1 SCN_GLOBALPROXY="" SCN_BLOCKDOH=0 \
+        SCN_FULLROUTED="" sh "$drv" 2>/dev/null)"
+    nft delete table inet "selmark_v6_$$" 2>/dev/null
+
+    if echo "$out4" | grep -q "ip6 daddr @$NFT_COMMON_SET_NAME_V6"; then
+        pass "selective:ipv6 — v6 union set mark rule present (@$NFT_COMMON_SET_NAME_V6)"
+        local v6_markall
+        v6_markall="$(echo "$out4" | grep 'meta mark set' | grep 'l4proto' | grep -v 'daddr' | grep -v 'saddr' || true)"
+        if [ -z "$v6_markall" ]; then
+            pass "selective:ipv6 — no mark-all rule with IPv6 enabled"
+        else
+            fail "selective:ipv6 — unexpected mark-all rule with IPv6 enabled" "$v6_markall"
+        fi
+        if echo "$out4" | grep -Fq "$SB_FAKEIP_INET6_RANGE"; then
+            pass "selective:ipv6 — FakeIP v6 range marked ($SB_FAKEIP_INET6_RANGE)"
+        else
+            fail "selective:ipv6 — FakeIP v6 range mark rule missing"
+        fi
+    else
+        # The driver enables v6 only if netshift_ipv6_enabled() returns true,
+        # which it forced; absence here means the kernel rejected the v6 set/rule.
+        skip "selective:ipv6 — v6 set/rule not applied (kernel ip6 support?)"
+    fi
+
+    # ── Live counter proof (best-effort, needs NET_ADMIN + a usable table) ──
+    # Apply the default-selective table once more and probe with `nft` matching:
+    # add a known proxied subnet to the union set, then verify a packet-shaped
+    # match logic — we cannot synthesize forwarded packets here, so we assert
+    # the deterministic rule ORDERING instead: the @localv4 return precedes the
+    # @set mark, and there is no catch-all mark after it.
+    local out_order
+    out_order="$(SCN_TABLE="selmark_ord_$$" SCN_IPV6=0 SCN_GLOBALPROXY="" SCN_BLOCKDOH=0 \
+        SCN_FULLROUTED="192.168.50.7" sh "$drv" 2>/dev/null)"
+    nft delete table inet "selmark_ord_$$" 2>/dev/null
+    if echo "$out_order" | grep -q "ip saddr 192.168.50.7 meta mark set"; then
+        pass "selective:fullrouted — fully_routed_ips source-mark rule present"
+    else
+        fail "selective:fullrouted — fully_routed_ips source mark missing" "$(echo "$out_order" | grep -i saddr || echo "$out_order")"
+    fi
+
+    # ── Scenario 6 (THE REGRESSION REPRO): stale mark-all table + respawn ──
+    # Reproduces the real on-hardware service path the original test missed: a
+    # NetShiftTable left behind by a previous global_proxy / 0.8.6 mark-all run,
+    # then create_nft_rules run again WITHOUT a clean stop (procd respawn /
+    # in-place package upgrade). Before the fix, the stale mark-EVERYTHING rules
+    # survived at the TOP of the prerouting chain and marked all traffic, making
+    # the new destination-selective rules dead -> "everything proxied / 100%
+    # CPU" even though the selective code was present. The fix flushes the table
+    # first, so the FINAL live chain must be purely selective with NO mark-all.
+    local out6
+    out6="$(SCN_TABLE="selmark_respawn_$$" SCN_IPV6=0 SCN_GLOBALPROXY="" SCN_BLOCKDOH=0 \
+        SCN_FULLROUTED="" SCN_PRESEED=1 sh "$drv" 2>/dev/null)"
+    nft delete table inet "selmark_respawn_$$" 2>/dev/null
+
+    local respawn_markall
+    respawn_markall="$(echo "$out6" | grep 'meta mark set' | grep 'l4proto' | grep -v 'daddr' | grep -v 'saddr' || true)"
+    if [ -z "$respawn_markall" ]; then
+        pass "selective:respawn — NO stale mark-all rule survives a respawn (table flushed)"
+    else
+        fail "selective:respawn — stale mark-all rule SURVIVED the rebuild (regression)" "$respawn_markall"
+    fi
+    if echo "$out6" | grep -q "@$NFT_COMMON_SET_NAME"; then
+        pass "selective:respawn — selective @set rule present after respawn"
+    else
+        fail "selective:respawn — selective @set rule missing after respawn" "$out6"
+    fi
+    if echo "$out6" | sed -n '/---SETS---/,$p' | grep -q "set $NFT_COMMON_SET_NAME"; then
+        pass "selective:respawn — union set $NFT_COMMON_SET_NAME present after respawn"
+    else
+        fail "selective:respawn — union set $NFT_COMMON_SET_NAME missing after respawn"
+    fi
+    # The selective rules must not be DUPLICATED (proof the chain was rebuilt,
+    # not appended): exactly one @set mark rule.
+    local setrule_count
+    setrule_count="$(echo "$out6" | sed -n '/chain mangle/,/^\t}/p' | grep -c "daddr @$NFT_COMMON_SET_NAME" || true)"
+    if [ "$setrule_count" = "1" ]; then
+        pass "selective:respawn — exactly one @set mark rule (chain rebuilt, not appended)"
+    else
+        fail "selective:respawn — expected 1 @set rule, found $setrule_count (append, not rebuild)" "$out6"
+    fi
+
+    rm -f "$drv"
+
+    # ── Scenario 7: REAL get_global_proxy_section via a real config_load ─────
+    # The original test STUBBED get_global_proxy_section, so it never exercised
+    # the actual UCI-reading helper that decides mark-all vs selective. Here we
+    # use the SHIPPED get_global_proxy_section / _determine_global_proxy_section /
+    # section_has_configured_outbound / get_subscription_urls_for_section against
+    # a REAL config_load of a hardware-shaped config (one subscription proxy
+    # section, global_proxy=0). It MUST return empty -> selective branch.
+    if [ -r /lib/functions.sh ] && [ -r /lib/config/uci.sh ] && command -v uci > /dev/null 2>&1; then
+        local rgp_drv rgp_out
+        rgp_drv="/tmp/netshift-selmark-rgp-$$.sh"
+        cat > "$rgp_drv" << 'RGPEOF'
+BIN="BIN_PATH_PLACEHOLDER"
+LIB="LIB_DIR_PLACEHOLDER"
+. /lib/functions.sh
+. /lib/config/uci.sh 2>/dev/null || true
+# shellcheck disable=SC1090
+. "$LIB/constants.sh"
+# shellcheck disable=SC1090
+. "$LIB/helpers.sh"
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+for fn in get_global_proxy_section _determine_global_proxy_section \
+          section_has_configured_outbound get_subscription_urls_for_section \
+          _collect_subscription_url_handler; do
+    eval "$(awk -v f="$fn" '$0 ~ "^"f"\\(\\) \\{"{p=1} p{print} p&&/^\}/{exit}' "$BIN")"
+done
+mkdir -p /etc/config
+cat > /etc/config/netshift_selmarktest <<'CFGEOF'
+config settings 'settings'
+    option block_doh '0'
+
+config section 'main'
+    option connection_type 'proxy'
+    option proxy_config_type 'subscription'
+    option global_proxy '0'
+    list subscription_url 'https://example.com/sub'
+CFGEOF
+# Mirror exactly what bin/netshift does: config_load with the config name.
+config_load netshift_selmarktest
+printf 'GP=[%s]\n' "$(get_global_proxy_section)"
+rm -f /etc/config/netshift_selmarktest
+RGPEOF
+        sed -i "s|LIB_DIR_PLACEHOLDER|$lib|g; s|BIN_PATH_PLACEHOLDER|$bin|g" "$rgp_drv"
+        rgp_out="$(sh "$rgp_drv" 2>/dev/null)"
+        rm -f "$rgp_drv"
+        if echo "$rgp_out" | grep -q '^GP=\[\]$'; then
+            pass "selective:realgp — real get_global_proxy_section returns empty for global_proxy=0 (selective branch)"
+        else
+            fail "selective:realgp — real get_global_proxy_section wrongly non-empty (would force mark-all)" "$rgp_out"
+        fi
+    else
+        skip "selective:realgp — LuCI config_load / uci not available"
+    fi
+
+    # ── Case 5b: sing-box validates a 2-section selective config ─────
+    # The generated sing-box config is independent of the nft marking, but the
+    # spec requires confirming sing-box still accepts a domain+subnet config.
+    if command -v sing-box > /dev/null 2>&1 && command -v jq > /dev/null 2>&1; then
+            local sbtmp sbcfg sbres
+            sbtmp="/tmp/netshift-selmark-sb-$$.json"
+            sbcfg=$(jq -n \
+                --arg direct "$SB_DIRECT_OUTBOUND_TAG" \
+                --arg tproxy "$SB_TPROXY_INBOUND_TAG" \
+                --arg listen "$SB_TPROXY_INBOUND_ADDRESS" \
+                --argjson port "$SB_TPROXY_INBOUND_PORT" \
+                '{
+                  log:{disabled:false,level:"warn",timestamp:true},
+                  dns:{servers:[],rules:[],final:$direct,strategy:"prefer_ipv4",independent_cache:true},
+                  ntp:{},
+                  inbounds:[{type:"tproxy",tag:$tproxy,listen:$listen,listen_port:$port}],
+                  outbounds:[{type:"direct",tag:$direct},{type:"direct",tag:"sec1-out"},{type:"direct",tag:"sec2-out"}],
+                  route:{rules:[
+                    {ip_cidr:["1.2.3.0/24"],outbound:"sec1-out"},
+                    {ip_cidr:["198.18.0.0/15"],outbound:"sec2-out"}
+                  ],rule_set:[],final:$direct,auto_detect_interface:true}
+                }')
+            printf '%s' "$sbcfg" > "$sbtmp"
+            sbres="$(sing-box -c "$sbtmp" check 2>&1)"
+            if [ -z "$sbres" ]; then
+                pass "selective:singboxcheck — 2-section selective config validates"
+            else
+                fail "selective:singboxcheck — sing-box rejected config" "$sbres"
+            fi
+            rm -f "$sbtmp"
+    else
+        skip "selective:singboxcheck — sing-box / jq not installed"
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Section-isolation invariant (task-033)
+#
+# Regression: upgrading 0.8.5 -> 0.8.6 made ANY additional / not-ready /
+# unreachable section black-hole ALL traffic to outbound/direct[direct-out]
+# with `i/o timeout` (+ DNS n/a). Root cause (confirmed on a live kernel):
+# the nft `mangle` prerouting chain marks ALL LAN tcp/udp with NFT_FAKEIP_MARK
+# and `ip rule ... fwmark NFT_FAKEIP_MARK lookup netshift` redirects it to
+# tproxy, but NOTHING stamped a mark on sing-box's OWN egress. So sing-box's
+# direct-out sockets (which now carry ALL unmatched traffic) inherited the
+# tproxy SO_MARK (NFT_FAKEIP_MARK) and the `ip rule` re-captured them into
+# `local default dev lo` -> they looped back into tproxy and timed out.
+#
+# Fix: sing_box_cm_configure_route now emits route.default_mark =
+# NFT_OUTBOUND_MARK, so every sing-box egress connection is marked
+# NFT_OUTBOUND_MARK. The `ip rule` matches only NFT_FAKEIP_MARK, so the marked
+# egress escapes via the main table (fail-open) and the existing
+# `mangle_output meta mark NFT_OUTBOUND_MARK return` rule keeps it out of the
+# proxy chain.
+#
+# This test pins (a) the config-gen contract (default_mark present, decimal,
+# == NFT_OUTBOUND_MARK; empty-arg path byte-identical for back-compat), (b)
+# that sing-box accepts a 2-section config (one outbound unreachable) with the
+# generated route, and (c) — when runnable on the live kernel — that an egress
+# packet carrying NFT_OUTBOUND_MARK reaches the internet while one carrying
+# NFT_FAKEIP_MARK loops/black-holes (the exact mechanism of the regression).
+# ─────────────────────────────────────────────────────────────────
+test_section_isolation() {
+    header "Section-isolation invariant (task-033)"
+
+    if ! command -v sing-box > /dev/null 2>&1; then
+        skip "sing-box not installed"
+        return
+    fi
+
+    local lib="${NETSHIFT_LIB_DIR}"
+    local cm_lib="$lib/sing_box_config_manager.sh"
+    local const_lib="$lib/constants.sh"
+    if [ ! -r "$cm_lib" ] || [ ! -r "$const_lib" ]; then
+        fail "sing_box_config_manager.sh / constants.sh not found"
+        return
+    fi
+
+    # ── (a) config-gen contract: default_mark present + correct + back-compat ──
+    local drv="/tmp/test-section-isolation-$$.sh"
+    cat > "$drv" << 'SIEOF'
+. "CONST_LIB"
+. "CM_LIB"
+
+mark_dec=$(( NFT_OUTBOUND_MARK ))
+seed='{"route":{},"outbounds":[{"type":"direct","tag":"direct-out"}]}'
+
+# WITH a default_mark (the fix path): assert it lands as a NUMBER equal to the
+# decimal NFT_OUTBOUND_MARK.
+with=$(sing_box_cm_configure_route "$seed" "direct-out" true "dns-server" "" "$mark_dec")
+got=$(echo "$with" | jq -r '.route.default_mark // "MISSING"')
+got_type=$(echo "$with" | jq -r '.route.default_mark | type')
+if [ "$got" = "$mark_dec" ] && [ "$got_type" = "number" ]; then
+    echo "si-default-mark-present:OK ($got, $got_type)"
+else
+    echo "si-default-mark-present:FAIL (got '$got' type '$got_type', want '$mark_dec' number)"
+fi
+
+# The mark must NOT collide with NFT_FAKEIP_MARK (which the ip rule catches).
+if [ "$mark_dec" != "$(( NFT_FAKEIP_MARK ))" ]; then
+    echo "si-mark-distinct-from-fakeip:OK"
+else
+    echo "si-mark-distinct-from-fakeip:FAIL (egress mark == fakeip mark -> would still loop)"
+fi
+
+# WITHOUT a default_mark (empty 6th arg): must be byte-identical to the legacy
+# 5-arg call (back-compat for any other caller / the off path).
+empty6=$(sing_box_cm_configure_route "$seed" "direct-out" true "dns-server" "" "")
+legacy5=$(sing_box_cm_configure_route "$seed" "direct-out" true "dns-server" "")
+if [ "$(echo "$empty6" | jq -cS .)" = "$(echo "$legacy5" | jq -cS .)" ]; then
+    echo "si-empty-mark-byte-parity:OK"
+else
+    echo "si-empty-mark-byte-parity:FAIL (empty default_mark changed output)"
+fi
+if echo "$empty6" | jq -e '.route | has("default_mark")' > /dev/null 2>&1; then
+    echo "si-empty-mark-omitted:FAIL (default_mark key present when empty)"
+else
+    echo "si-empty-mark-omitted:OK"
+fi
+
+# Emit the generated route (with mark) for the caller to build a full config.
+echo "$with" | jq -c 'del(.route.rules[]?.__service_tag) | .route' > "ROUTE_JSON"
+SIEOF
+    local route_json="/tmp/si-route-$$.json"
+    sed -i "s#CONST_LIB#$const_lib#g; s#CM_LIB#$cm_lib#g; s#ROUTE_JSON#$route_json#g" "$drv"
+
+    rm -f "$route_json"
+    local out
+    out="$(ash "$drv" 2>&1 || true)"
+    echo "$out" | while IFS= read -r line; do
+        case "$line" in
+            *:FAIL*) fail "$line" ;;
+            *:OK*)   pass "$line" ;;
+        esac
+    done
+
+    # ── (b) 2-section config (section 2 unreachable) + generated route: check ──
+    local mark_dec
+    # shellcheck disable=SC1090
+    . "$const_lib"
+    mark_dec=$(( NFT_OUTBOUND_MARK ))
+    if [ -r "$route_json" ]; then
+        local cfg="/tmp/si-config-$$.json"
+        jq -n --slurpfile route "$route_json" '{
+            log: { level: "warn" },
+            dns: { servers: [ { tag: "dns-server", type: "udp", server: "1.1.1.1" } ], final: "dns-server" },
+            inbounds: [ { type: "tproxy", tag: "tproxy-in", listen: "127.0.0.1", listen_port: 1602 } ],
+            outbounds: [
+                { type: "direct", tag: "direct-out" },
+                { type: "shadowsocks", tag: "main-out", server: "10.10.10.10", server_port: 8388, method: "aes-256-gcm", password: "password" },
+                { type: "hysteria2", tag: "second-out", server: "198.51.100.99", server_port: 443, password: "pass", tls: { enabled: true, insecure: true } }
+            ],
+            route: $route[0]
+        }' > "$cfg"
+        if sing-box check -c "$cfg" > /dev/null 2>&1; then
+            pass "si-2section-unreachable-check:OK (sing-box accepts config + route.default_mark)"
+        else
+            fail "si-2section-unreachable-check:FAIL" "$(sing-box check -c "$cfg" 2>&1)"
+        fi
+        # the generated route must actually carry default_mark
+        if [ "$(jq -r '.route.default_mark' "$cfg")" = "$mark_dec" ]; then
+            pass "si-config-has-default-mark:OK"
+        else
+            fail "si-config-has-default-mark:FAIL"
+        fi
+        rm -f "$cfg"
+    else
+        fail "si-route-gen:FAIL (route JSON not produced)"
+    fi
+
+    # ── (c) live-kernel fail-open mechanism (only if nft + curl + net) ──────────
+    # Build the EXACT ip rule the backend installs (fwmark NFT_FAKEIP_MARK ->
+    # table netshift = local default dev lo) and prove:
+    #   - egress carrying NFT_FAKEIP_MARK loops/black-holes (the bug)
+    #   - egress carrying NFT_OUTBOUND_MARK (the fix) reaches the internet
+    if [ "${TEST_SKIP_NETWORK:-0}" = "1" ]; then
+        skip "si-live-loop: network skipped (TEST_SKIP_NETWORK=1)"
+    elif ! command -v nft > /dev/null 2>&1 || ! command -v curl > /dev/null 2>&1; then
+        skip "si-live-loop: nft/curl not available"
+    elif ! curl -s -m 5 -o /dev/null http://1.1.1.1/ 2>/dev/null; then
+        skip "si-live-loop: no outbound connectivity in container"
+    else
+        # All ip/nft mutations are best-effort and may legitimately return
+        # non-zero (rule absent on first del, etc.); guard each against `set -e`.
+        grep -q "105 netshift" /etc/iproute2/rt_tables 2>/dev/null || \
+            echo "105 netshift" >> /etc/iproute2/rt_tables
+        ip -4 route replace local 0.0.0.0/0 dev lo table netshift 2>/dev/null || \
+            ip -4 route add local 0.0.0.0/0 dev lo table netshift 2>/dev/null || true
+        ip -4 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table netshift priority 105 2>/dev/null || true
+        ip -4 rule add fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table netshift priority 105 2>/dev/null || true
+
+        nft delete table inet netshift_si_test 2>/dev/null || true
+        nft add table inet netshift_si_test 2>/dev/null || true
+        nft add chain inet netshift_si_test out \
+            '{ type route hook output priority -200; policy accept; }' 2>/dev/null || true
+
+        # FAKEIP_MARK egress -> must loop (curl times out, rc!=0).
+        nft flush chain inet netshift_si_test out 2>/dev/null || true
+        nft add rule inet netshift_si_test out ip daddr 1.0.0.1 meta mark set "$NFT_FAKEIP_MARK" counter 2>/dev/null || true
+        if curl -s -m 6 -o /dev/null http://1.0.0.1/ 2>/dev/null; then
+            fail "si-live-loop-fakeip-blackholes:FAIL (fakeip-marked egress unexpectedly escaped)"
+        else
+            pass "si-live-loop-fakeip-blackholes:OK (fakeip-marked egress loops, as in the bug)"
+        fi
+
+        # OUTBOUND_MARK egress (the fix) -> must reach the internet (rc==0).
+        nft flush chain inet netshift_si_test out 2>/dev/null || true
+        nft add rule inet netshift_si_test out ip daddr 1.0.0.1 meta mark set "$NFT_OUTBOUND_MARK" counter 2>/dev/null || true
+        if curl -s -m 6 -o /dev/null http://1.0.0.1/ 2>/dev/null; then
+            pass "si-live-loop-outbound-escapes:OK (outbound-marked egress reaches internet -> fail-open)"
+        else
+            fail "si-live-loop-outbound-escapes:FAIL (outbound-marked egress did NOT escape)"
+        fi
+
+        nft delete table inet netshift_si_test 2>/dev/null || true
+        ip -4 rule del fwmark "$NFT_FAKEIP_MARK"/"$NFT_FAKEIP_MARK" table netshift priority 105 2>/dev/null || true
+        ip -4 route flush table netshift 2>/dev/null || true
+    fi
+
+    rm -f "$drv" "$route_json"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: graceful-skip of unsupported proxy schemes + splithttp→xhttp (task-038)
+# ─────────────────────────────────────────────────────────────────
+# Two defects fixed by task-038:
+#  1. sing_box_cf_add_proxy_outbound's `*)` default arm used to log fatal + exit 1
+#     for an unsupported scheme. Since the dispatcher is shared by the single-URL,
+#     selector-loop AND urltest-loop callers, ONE bad link (tuic/wireguard/typo)
+#     aborted generation of the WHOLE config. It now logs a WARNING, echoes the
+#     config UNCHANGED (never empty) and returns non-zero so the caller skips that
+#     node and continues. Loop callers add the member tag only on success (no
+#     dangling selector member); an all-unsupported section is marked unavailable
+#     (reject route rule) instead of crashing the start.
+#  2. `splithttp` (the pre-rename name of `xhttp`) is now accepted as an alias of
+#     xhttp in BOTH the facade transport builder (?type=splithttp) and the
+#     xray_json_to_uri_lines converter (network:"splithttp" / splithttpSettings),
+#     normalized to the modern `xhttp` key downstream.
+#
+# This test drives the SHIPPED configure_outbound_handler (awk-extracted verbatim)
+# for the url/selector/urltest branches with a table-driven config_get stub, the
+# REAL facade/manager/helpers, and a log stub that records warnings/errors. All
+# values are synthetic placeholders (nothing from private.json).
+test_unsupported_skip() {
+    header "Graceful-skip unsupported protocol + splithttp alias (task-038)"
+
+    if ! command -v sing-box > /dev/null 2>&1; then
+        skip "sing-box not installed"
+        return
+    fi
+
+    local lib="${NETSHIFT_LIB_DIR}"
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    local facade_lib="$lib/sing_box_config_facade.sh"
+    if [ ! -r "$facade_lib" ] || [ ! -r "$bin" ]; then
+        fail "facade lib / bin not found"
+        return
+    fi
+
+    # The facade hardcodes NETSHIFT_LIB="/usr/lib/netshift" for its own sourcing
+    # of helpers + manager; bind the bind-mounted sources to that path.
+    mkdir -p /usr/lib/netshift
+    ln -sf "$lib/helpers.sh" /usr/lib/netshift/helpers.sh
+    ln -sf "$lib/sing_box_config_manager.sh" /usr/lib/netshift/sing_box_config_manager.sh
+
+    local drv="/tmp/test-unsupported-skip-$$.sh"
+    cat > "$drv" << 'USEOF'
+. "CONST_LIB"
+. "FACADE_LIB"
+
+WARN_LOG="/tmp/us-warn-$$.log"
+: > "$WARN_LOG"
+# log/echolog/nolog: record level+message so we can assert a warning fired.
+log()     { printf '%s|%s\n' "${2:-info}" "$1" >> "$WARN_LOG"; }
+echolog() { printf '%s|%s\n' "${2:-info}" "$1" >> "$WARN_LOG"; }
+nolog()   { :; }
+
+# Extended ON so vmess/xhttp gates pass where used.
+is_sing_box_extended() { return 0; }
+
+# awk-extract the SHIPPED handler + the unavailable marker verbatim.
+eval "$(awk '/^configure_outbound_handler\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+eval "$(awk '/^mark_section_outbound_unavailable\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+
+# Table-driven UCI stub. Per-section options are read from US_<section>_<opt>
+# shell vars (dots/dashes in section names normalized to underscores).
+_us_key() { printf 'US_%s_%s' "$(printf '%s' "$1" | tr '.-' '__')" "$2"; }
+config_get() {
+    # $1=dest var, $2=section, $3=option, $4=default
+    local _k _v
+    _k="$(_us_key "$2" "$3")"
+    eval "_v=\"\${$_k:-}\""
+    [ -n "$_v" ] || _v="$4"
+    eval "$1=\"\$_v\""
+    return 0
+}
+config_get_bool() {
+    local _k _v
+    _k="$(_us_key "$2" "$3")"
+    eval "_v=\"\${$_k:-${4:-0}}\""
+    eval "$1=\"\$_v\""
+    return 0
+}
+
+# Helper: assert a warn/error log line containing a substring exists.
+warn_logged() { grep -q "$1" "$WARN_LOG"; }
+
+# Build a minimal full sing-box config around the produced outbounds and run a
+# real `sing-box check`. $1=config JSON, $2=label.
+check_full() {
+    local cfgjson="$1" label="$2" full
+    full="/tmp/us-full-$$-${label}.json"
+    printf '%s' "$cfgjson" | jq '{
+        log: { level: "error" },
+        dns: { servers: [ { tag: "dns-server", type: "udp", server: "1.1.1.1" } ], final: "dns-server" },
+        inbounds: [ { type: "tproxy", tag: "tproxy-in", listen: "127.0.0.1", listen_port: 1602 } ],
+        outbounds: (.outbounds + [ { type: "direct", tag: "direct-out" } ]),
+        route: { rules: [], final: "direct-out" }
+    }' > "$full" 2>/dev/null
+    if sing-box -c "$full" check > /dev/null 2>&1; then
+        echo "${label}:OK"
+    else
+        echo "${label}:FAIL"
+    fi
+    rm -f "$full"
+}
+
+# ── (1) URLTEST list mixing supported (vless/hysteria2) + unsupported ────────
+#         (tuic:// / wireguard:// / garbage://). Generation must NOT abort, the
+#         supported members must be present, the unsupported ones skipped, and a
+#         warning logged. config must NOT be wiped.
+: > "$WARN_LOG"
+config='{"outbounds":[]}'
+SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+US_mix_connection_type="proxy"
+US_mix_proxy_config_type="urltest"
+US_mix_urltest_proxy_links="vless://11111111-2222-3333-4444-555555555555@v.example.com:443?security=tls&sni=v.example.com tuic://uuid:pw@t.example.com:443 hysteria2://hpass@h.example.com:8443?sni=h.example.com wireguard://x@w.example.com:51820 garbage://nope"
+configure_outbound_handler "mix"
+mix_rc=$?
+
+[ "$mix_rc" = "0" ] && echo 'us-urltest-no-abort:OK' || echo "us-urltest-no-abort:FAIL (rc=$mix_rc)"
+[ -n "$config" ] && printf '%s' "$config" | jq -e . >/dev/null 2>&1 \
+    && echo 'us-urltest-config-not-wiped:OK' || echo 'us-urltest-config-not-wiped:FAIL'
+
+# The two supported member outbounds exist (vless = mix-1-out, hysteria2 = mix-3-out).
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="mix-1-out" and .type=="vless")] | length==1' >/dev/null 2>&1 \
+    && echo 'us-urltest-vless-present:OK' || echo 'us-urltest-vless-present:FAIL'
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="mix-3-out" and .type=="hysteria2")] | length==1' >/dev/null 2>&1 \
+    && echo 'us-urltest-hy2-present:OK' || echo 'us-urltest-hy2-present:FAIL'
+
+# The unsupported members were NOT created.
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="mix-2-out" or .tag=="mix-4-out" or .tag=="mix-5-out")] | length==0' >/dev/null 2>&1 \
+    && echo 'us-urltest-unsupported-absent:OK' || echo 'us-urltest-unsupported-absent:FAIL'
+
+# The urltest + selector reference ONLY the two real members (no dangling tag).
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.type=="urltest")][0].outbounds | (index("mix-1-out")!=null and index("mix-3-out")!=null and index("mix-2-out")==null and index("mix-4-out")==null and index("mix-5-out")==null)' >/dev/null 2>&1 \
+    && echo 'us-urltest-members-clean:OK' || echo 'us-urltest-members-clean:FAIL'
+
+# A warning was logged for the skipped schemes.
+warn_logged "unsupported scheme" && echo 'us-urltest-warning-logged:OK' || echo 'us-urltest-warning-logged:FAIL'
+
+# Whole-chain: the assembled config passes a real sing-box check.
+check_full "$config" "us-urltest-singbox-check"
+
+# ── (1b) SELECTOR list, same mix ─────────────────────────────────────────────
+: > "$WARN_LOG"
+config='{"outbounds":[]}'
+SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+US_sel_connection_type="proxy"
+US_sel_proxy_config_type="selector"
+US_sel_selector_proxy_links="garbage://nope vless://aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee@v2.example.com:443?security=tls&sni=v2.example.com tuic://u:p@t2.example.com:443"
+configure_outbound_handler "sel"
+sel_rc=$?
+[ "$sel_rc" = "0" ] && echo 'us-selector-no-abort:OK' || echo "us-selector-no-abort:FAIL (rc=$sel_rc)"
+# Only the vless (sel-2-out) member exists; selector references just it.
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="sel-2-out" and .type=="vless")] | length==1' >/dev/null 2>&1 \
+    && echo 'us-selector-vless-present:OK' || echo 'us-selector-vless-present:FAIL'
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.type=="selector")][0].outbounds | (index("sel-2-out")!=null and index("sel-1-out")==null and index("sel-3-out")==null)' >/dev/null 2>&1 \
+    && echo 'us-selector-members-clean:OK' || echo 'us-selector-members-clean:FAIL'
+check_full "$config" "us-selector-singbox-check"
+
+# ── (2) SINGLE-URL section with ONLY an unsupported scheme → degrade ─────────
+#         No crash, no outbound, section marked unavailable, rest of config
+#         continues to generate.
+: > "$WARN_LOG"
+config='{"outbounds":[{"type":"direct","tag":"direct-out"}]}'
+SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+US_solo_connection_type="proxy"
+US_solo_proxy_config_type="url"
+US_solo_proxy_string="tuic://uuid:pw@only.example.com:443"
+configure_outbound_handler "solo"
+solo_rc=$?
+[ "$solo_rc" = "0" ] && echo 'us-single-no-crash:OK' || echo "us-single-no-crash:FAIL (rc=$solo_rc)"
+# No solo-out outbound was created.
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="solo-out")] | length==0' >/dev/null 2>&1 \
+    && echo 'us-single-no-outbound:OK' || echo 'us-single-no-outbound:FAIL'
+# The pre-existing direct-out (rest of config) survived (config not wiped).
+printf '%s' "$config" | jq -e '[.outbounds[] | select(.tag=="direct-out")] | length==1' >/dev/null 2>&1 \
+    && echo 'us-single-rest-continues:OK' || echo 'us-single-rest-continues:FAIL'
+# Section marked unavailable so the route emits a reject rule.
+case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+*" solo "*) echo 'us-single-marked-unavailable:OK' ;;
+*) echo 'us-single-marked-unavailable:FAIL' ;;
+esac
+warn_logged "no usable outbound" && echo 'us-single-error-logged:OK' || echo 'us-single-error-logged:FAIL'
+
+# ── (3a) splithttp recognized as xhttp via a vless URL ?type=splithttp ───────
+base='{"outbounds":[]}'
+out_split=$(sing_box_cf_add_proxy_outbound "$base" "spl" "vless://77777777-8888-9999-aaaa-bbbbbbbbbbbb@s.example.com:8443?type=splithttp&security=tls&sni=s.example.com&path=/sp&host=s.example.com&mode=auto" "0")
+printf '%s' "$out_split" | jq -e '.outbounds[0].transport.type=="xhttp"' >/dev/null 2>&1 \
+    && echo 'us-splithttp-url-xhttp:OK' || echo 'us-splithttp-url-xhttp:FAIL'
+printf '%s' "$out_split" | jq -e '.outbounds[0].transport.path=="/sp"' >/dev/null 2>&1 \
+    && echo 'us-splithttp-url-path:OK' || echo 'us-splithttp-url-path:FAIL'
+# Extended gate respected: with extended OFF the transport is NOT applied.
+is_sing_box_extended() { return 1; }
+out_split_off=$(sing_box_cf_add_proxy_outbound "$base" "splo" "vless://77777777-8888-9999-aaaa-bbbbbbbbbbbb@s.example.com:8443?type=splithttp&security=tls&sni=s.example.com&path=/sp&host=s.example.com&mode=auto" "0")
+printf '%s' "$out_split_off" | jq -e '.outbounds[0] | has("transport") | not' >/dev/null 2>&1 \
+    && echo 'us-splithttp-gate-off:OK' || echo 'us-splithttp-gate-off:FAIL'
+is_sing_box_extended() { return 0; }
+# Whole-chain: the splithttp(→xhttp) outbound passes a real sing-box check on
+# extended (the container core may be stock, so only assert when it accepts
+# xhttp; otherwise emit SKIP).
+spl_full="/tmp/us-split-full-$$.json"
+printf '%s' "$out_split" | jq '{
+    log: { level: "error" },
+    inbounds: [],
+    outbounds: (.outbounds + [ { type: "direct", tag: "direct-out" } ]),
+    route: { final: "direct-out" }
+}' > "$spl_full" 2>/dev/null
+if sing-box -c "$spl_full" check > /dev/null 2>&1; then
+    echo 'us-splithttp-singbox-check:OK'
+else
+    echo 'us-splithttp-singbox-check:SKIP'
+fi
+rm -f "$spl_full"
+
+# ── (3b) splithttp recognized in xray_json_to_uri_lines (Xray JSON) ──────────
+xray_src="/tmp/us-xray-split-$$.json"
+cat > "$xray_src" << 'XJSON'
+{ "outbounds": [ {
+  "protocol": "vless",
+  "tag": "xray-split",
+  "settings": { "vnext": [ { "address": "xj.example.com", "port": 8443, "users": [ { "id": "cccccccc-dddd-eeee-ffff-000000000000" } ] } ] },
+  "streamSettings": {
+    "network": "splithttp",
+    "security": "tls",
+    "tlsSettings": { "serverName": "xj.example.com" },
+    "splithttpSettings": { "path": "/xj", "host": "xj.example.com", "mode": "auto" }
+  }
+} ] }
+XJSON
+xray_uri="$(xray_json_to_uri_lines "$xray_src" 2>/dev/null)"
+case "$xray_uri" in
+*"type=xhttp"*) echo 'us-xray-splithttp-type-xhttp:OK' ;;
+*) echo "us-xray-splithttp-type-xhttp:FAIL ($xray_uri)" ;;
+esac
+case "$xray_uri" in
+*"path=/xj"*) echo 'us-xray-splithttp-path:OK' ;;
+*) echo "us-xray-splithttp-path:FAIL ($xray_uri)" ;;
+esac
+case "$xray_uri" in
+*"splithttp"*) echo "us-xray-splithttp-normalized:FAIL ($xray_uri)" ;;
+*) echo 'us-xray-splithttp-normalized:OK' ;;
+esac
+rm -f "$xray_src"
+
+rm -f "$WARN_LOG"
+echo 'DONE'
+USEOF
+    sed -i "s|CONST_LIB|$lib/constants.sh|g; s|FACADE_LIB|$facade_lib|g; s|BIN_PATH|$bin|g" "$drv"
+
+    sh "$drv" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK)   pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+    rm -f "$drv"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Monitor procd-lock fd hygiene (task-035) + monitor-leak (task-036)
+#
+# ROOT CAUSE under test: the long-lived health monitor used to be launched with
+# a bare `monitor_sing_box &`, which inherited ALL open fds — including procd's
+# init service lock on fd 1000 (/tmp/lock/procd_<name>.lock). The monitor then
+# held that lock forever, so the NEXT reload/restart blocked on `flock 1000`
+# indefinitely and settings were never re-applied.
+#
+# The fix launches the monitor via `setsid /bin/sh -c 'exec 1000>&- ...; exec
+# /usr/bin/netshift __monitor' </dev/null >/dev/null 2>&1 &` so the detached
+# monitor holds NO procd fds. This test reproduces the fd-inheritance scenario
+# deterministically:
+#   1. The parent opens fd 1000 onto a sentinel lock file and takes an exclusive
+#      flock on it (exactly how procd serializes init actions).
+#   2. We awk-extract the SHIPPED start_sing_box_monitor verbatim and run it with
+#      MONITOR_PIDFILE re-pinned to a temp path and /usr/bin/netshift replaced by
+#      a stub whose `__monitor` runs a tiny pid-writing sleep loop (so the real
+#      launch mechanism — setsid + fd-close + re-exec — is exercised end to end).
+#   3. Assert: the monitor child's /proc/<pid>/fd does NOT reference the sentinel
+#      lock file (fd 1000 was closed), the monitor is alive, the pidfile is
+#      correct, and a fresh non-blocking flock on the sentinel acquires
+#      immediately (it WOULD block before the fix because the monitor inherited
+#      the held lock).
+#
+# task-036 (monitor-leak follow-up): the task-035 detach is correct, but because
+# each monitor self-writes its OWN $$ to MONITOR_PIDFILE, the pidfile only ever
+# remembers the LATEST monitor; stop() kills only that pid, so monitors from
+# PRIOR reloads (detached, reparented to init) leaked (2-3 live monitors). Fix:
+# start_sing_box_monitor (and stop()) now run _kill_stale_sing_box_monitors,
+# which kills ALL `__monitor` procs (excluding self/parent) via `pgrep -f`.
+#   4. Launch the monitor a SECOND time (modeling a 2nd reload's start phase) and
+#      assert the prior monitor is dead, EXACTLY ONE __monitor process survives
+#      (no accumulation), and the respawned monitor also holds no lock fd.
+# ─────────────────────────────────────────────────────────────────
+test_monitor_fd_hygiene() {
+    header "Monitor procd-lock fd Hygiene (task-035) + leak (task-036)"
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    if [ ! -r "$bin" ]; then
+        skip "netshift bin not found"
+        return
+    fi
+    if ! command -v setsid > /dev/null 2>&1; then
+        skip "setsid not available"
+        return
+    fi
+    if ! command -v flock > /dev/null 2>&1; then
+        skip "flock not available"
+        return
+    fi
+
+    local work="/tmp/netshift-monfd-$$"
+    rm -rf "$work"
+    mkdir -p "$work/bin"
+
+    local pidfile="$work/monitor.pid"
+    local lockfile="$work/procd_sentinel.lock"
+    local fakecli="$work/bin/netshift"
+    local out="$work/out.txt"
+    local livefile="$work/live.txt"
+    : > "$lockfile"
+
+    # Stub /usr/bin/netshift: only its hidden `__monitor` path matters here. It
+    # mimics the real monitor: write its own pid, then sleep-loop (so it is a
+    # long-lived child we can inspect). It inherits MONITOR_PIDFILE via env.
+    cat > "$fakecli" << 'FAKECLI'
+#!/bin/sh
+case "$1" in
+__monitor)
+    echo $$ > "$MONITOR_PIDFILE"
+    while true; do sleep 1; done
+    ;;
+*)
+    exit 0
+    ;;
+esac
+FAKECLI
+    chmod +x "$fakecli"
+
+    # The shipped start_sing_box_monitor hardcodes `/usr/bin/netshift __monitor`.
+    # Install the stub at that absolute path; back up any existing real binary
+    # and restore it afterwards (the smoke container ships none, but be safe).
+    local real_cli="/usr/bin/netshift"
+    local real_cli_bak=""
+    if [ -e "$real_cli" ]; then
+        real_cli_bak="$work/real_cli.bak"
+        cp -p "$real_cli" "$real_cli_bak" 2>/dev/null || real_cli_bak=""
+    fi
+    mkdir -p /usr/bin
+    cp "$fakecli" "$real_cli"
+    chmod +x "$real_cli"
+
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'MONEOF'
+# Quiet logger + the constant the extracted function references.
+log() { :; }
+MONITOR_PIDFILE="DRV_PIDFILE"
+
+# Pull the SHIPPED helper + launcher out of the live bin so we test the real
+# mechanism (task-036 leak fix: start_sing_box_monitor now calls
+# _kill_stale_sing_box_monitors before spawning).
+eval "$(awk '/^_kill_stale_sing_box_monitors\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "DRV_BIN")"
+eval "$(awk '/^start_sing_box_monitor\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "DRV_BIN")"
+
+# Simulate procd: open fd 1000 onto the sentinel lock file and hold an
+# exclusive flock on it (this is exactly what procd does while running an init
+# action). The launcher must NOT let the detached monitor inherit this fd.
+exec 1000> "DRV_LOCKFILE"
+flock -x 1000
+
+# Launch the monitor via the SHIPPED code path (setsid + fd-close + re-exec).
+start_sing_box_monitor
+
+# Give the detached child a moment to write its pid (the launcher already waits,
+# but the re-exec/setsid chain may lag slightly under the container).
+i=0
+while [ ! -s "$MONITOR_PIDFILE" ] && [ "$i" -lt 50 ]; do
+    sleep 0.1 2>/dev/null || sleep 1
+    i=$((i + 1))
+done
+
+mpid="$(cat "$MONITOR_PIDFILE" 2>/dev/null)"
+
+# ── Assert 1: pidfile populated with a live pid. ─────────────────────────────
+if [ -n "$mpid" ] && kill -0 "$mpid" 2>/dev/null; then
+    echo 'monfd-monitor-alive-pidfile:OK'
+else
+    echo "monfd-monitor-alive-pidfile:FAIL (pid='$mpid')"
+fi
+
+# ── Assert 2: the monitor child does NOT have the sentinel lock fd open. We
+#    resolve every /proc/<pid>/fd symlink and assert none points at the lock
+#    file (the procd lock fd 1000 was closed before the re-exec). ─────────────
+held=0
+if [ -n "$mpid" ] && [ -d "/proc/$mpid/fd" ]; then
+    for fd in /proc/"$mpid"/fd/*; do
+        [ -e "$fd" ] || continue
+        tgt="$(readlink "$fd" 2>/dev/null)"
+        case "$tgt" in
+            *procd_sentinel.lock*) held=1 ;;
+        esac
+    done
+fi
+if [ "$held" -eq 0 ]; then
+    echo 'monfd-no-sentinel-lock-fd:OK'
+else
+    echo 'monfd-no-sentinel-lock-fd:FAIL (monitor still holds the lock fd)'
+fi
+
+# ── Assert 3: fd 1000 specifically is not the sentinel lock in the child. ────
+if [ -n "$mpid" ] && [ -e "/proc/$mpid/fd/1000" ]; then
+    t1000="$(readlink "/proc/$mpid/fd/1000" 2>/dev/null)"
+    case "$t1000" in
+        *procd_sentinel.lock*) echo 'monfd-fd1000-not-lock:FAIL' ;;
+        *) echo 'monfd-fd1000-not-lock:OK' ;;
+    esac
+else
+    echo 'monfd-fd1000-not-lock:OK'
+fi
+
+# ── Assert 4 (repeated-reload no-hang proxy): a fresh non-blocking flock on the
+#    SAME sentinel must acquire immediately. Before the fix the inherited fd
+#    1000 would keep the lock held by the live monitor and this would block /
+#    fail. We drop the parent's own flock first (procd releases the lock when
+#    the action returns), then a separate process tries flock -n. ─────────────
+# Model procd ending the init action: it simply CLOSES its fd 1000 (it does NOT
+# explicitly unlock). The advisory flock lives on the open-file-description, so
+# if the monitor child inherited fd 1000 (the bug) the SAME OFD stays open in
+# the child and the lock persists; with the fix the child never had that OFD, so
+# closing the parent's fd here releases the lock. We must NOT `flock -u` (that
+# would release the per-OFD lock for everyone and mask the bug).
+exec 1000>&- 2>/dev/null
+# A separate subshell opens its OWN fd onto the same lock file and tries a
+# non-blocking exclusive flock. If the detached monitor still held the lock
+# (the bug), this blocks/fails; with the fix it acquires instantly.
+if ( exec 9> "DRV_LOCKFILE"; flock -n -x 9 ) 2>/dev/null; then
+    echo 'monfd-second-flock-immediate:OK'
+else
+    echo 'monfd-second-flock-immediate:FAIL (monitor still holds the lock)'
+fi
+
+# ── Assert 5 (task-036 monitor-leak fix): launching the monitor AGAIN (modeling
+#    a SECOND reload's start phase) must reliably kill the prior monitor and
+#    leave EXACTLY ONE __monitor process alive — no accumulation. Before the fix
+#    (return-0-if-alive + pidfile-only kill) the first monitor leaked because the
+#    pidfile only ever named the latest one. We count survivors via pgrep -f on
+#    the unique `__monitor` marker, into a temp file + counted `while read` (no
+#    pipe) so the count is exact. ─────────────────────────────────────────────
+prev_mpid="$mpid"
+
+# Model the REAL leak precondition: monitor A is still alive (from a prior
+# reload cycle) but the pidfile no longer points at it — exactly what happens
+# because each monitor overwrites the pidfile with its own $$, so A's pid record
+# is lost once a later monitor wrote, and stop() then cleared the pidfile while
+# killing only the LATEST pid. We simulate that by pointing the pidfile at a
+# dead pid. With the OLD guard, the launcher would see a dead pidfile pid,
+# `rm -f` it, and spawn B — leaving A orphaned (2 live monitors). The task-036
+# kill-all must terminate A regardless of the pidfile.
+echo 999999 > "$MONITOR_PIDFILE"   # a pid that is not alive
+
+# Re-open + re-hold the sentinel lock to model procd serializing the 2nd action,
+# so we also re-prove fd hygiene on the freshly spawned monitor.
+exec 1000> "DRV_LOCKFILE"
+flock -x 1000
+
+start_sing_box_monitor
+
+i=0
+while [ ! -s "$MONITOR_PIDFILE" ] && [ "$i" -lt 50 ]; do
+    sleep 0.1 2>/dev/null || sleep 1
+    i=$((i + 1))
+done
+mpid2="$(cat "$MONITOR_PIDFILE" 2>/dev/null)"
+
+# The previous monitor must be dead (reliably killed before the new spawn).
+if [ -n "$prev_mpid" ] && kill -0 "$prev_mpid" 2>/dev/null; then
+    echo "monfd-prior-monitor-killed:FAIL (old pid $prev_mpid still alive)"
+else
+    echo 'monfd-prior-monitor-killed:OK'
+fi
+
+# Exactly one live __monitor process must remain. Count with pgrep -f (the same
+# selector the fix uses) into a file, then a counted loop (no pipe).
+livecount=0
+livefile="DRV_LIVEFILE"
+pgrep -f "/usr/bin/netshift __monitor" 2>/dev/null > "$livefile" || true
+while IFS= read -r lp; do
+    [ -n "$lp" ] || continue
+    case "$lp" in *[!0-9]*) continue ;; esac
+    if kill -0 "$lp" 2>/dev/null; then
+        livecount=$((livecount + 1))
+    fi
+done < "$livefile"
+if [ "$livecount" -eq 1 ]; then
+    echo 'monfd-exactly-one-monitor:OK'
+else
+    echo "monfd-exactly-one-monitor:FAIL (found $livecount live monitors)"
+fi
+
+# The freshly spawned (2nd) monitor must also hold NO sentinel lock fd.
+held2=0
+if [ -n "$mpid2" ] && [ -d "/proc/$mpid2/fd" ]; then
+    for fd in /proc/"$mpid2"/fd/*; do
+        [ -e "$fd" ] || continue
+        tgt="$(readlink "$fd" 2>/dev/null)"
+        case "$tgt" in
+            *procd_sentinel.lock*) held2=1 ;;
+        esac
+    done
+fi
+if [ "$held2" -eq 0 ]; then
+    echo 'monfd-respawn-no-lock-fd:OK'
+else
+    echo 'monfd-respawn-no-lock-fd:FAIL (respawned monitor holds the lock fd)'
+fi
+
+exec 1000>&- 2>/dev/null
+
+# Clean up the monitor child(ren).
+[ -n "$mpid2" ] && kill "$mpid2" 2>/dev/null
+[ -n "$prev_mpid" ] && kill "$prev_mpid" 2>/dev/null
+echo 'DONE'
+MONEOF
+
+    sed -i \
+        -e "s|DRV_PIDFILE|$pidfile|g" \
+        -e "s|DRV_BIN|$bin|g" \
+        -e "s|DRV_LOCKFILE|$lockfile|g" \
+        -e "s|DRV_LIVEFILE|$livefile|g" \
+        "$drv"
+
+    MONITOR_PIDFILE="$pidfile" ash "$drv" > "$out" 2>/dev/null || true
+
+    # Parse in the CURRENT shell (no pipe) so PASS/FAIL counts are exact.
+    while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL*) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            *) ;;
+        esac
+    done < "$out"
+
+    # Belt-and-suspenders: kill any leftover stub monitor and restore the cli.
+    if [ -s "$pidfile" ]; then
+        local leftover
+        leftover="$(cat "$pidfile" 2>/dev/null)"
+        [ -n "$leftover" ] && kill "$leftover" 2>/dev/null || true
+    fi
+    if [ -n "$real_cli_bak" ]; then
+        cp -p "$real_cli_bak" "$real_cli" 2>/dev/null || true
+    else
+        rm -f "$real_cli" 2>/dev/null || true
+    fi
+
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: sing-box Config Generation
+# ─────────────────────────────────────────────────────────────────
+test_sing_box_config() {
+    header "sing-box Config Generation"
+
+    if ! command -v sing-box > /dev/null 2>&1; then
+        skip "sing-box not installed"
+        return
+    fi
+
+    # Create a minimal valid sing-box config and validate it
+    local test_config="/tmp/test-sing-box-config.json"
+    jq -n '{
+        log: { disabled: false, level: "warn", timestamp: true },
+        dns: { servers: [], rules: [], final: "direct", strategy: "prefer_ipv4", independent_cache: true },
+        ntp: {},
+        inbounds: [
+            { type: "direct", tag: "dns-in", listen: "127.0.0.42", listen_port: 53 }
+        ],
+        outbounds: [
+            { type: "direct", tag: "direct-out" }
+        ],
+        route: { rules: [], rule_set: [], final: "direct-out", auto_detect_interface: true }
+    }' > "$test_config"
+
+    if sing-box -c "$test_config" check > /dev/null 2>&1; then
+        pass "sing-box validates minimal config"
+    else
+        fail "sing-box config validation failed" "$(sing-box -c "$test_config" check 2>&1)"
+    fi
+
+    # Test with FakeIP
+    jq '.dns.servers += [{
+        type: "fakeip", tag: "fakeip", inet4_range: "198.18.0.0/15"
+    }]' "$test_config" > "${test_config}.2"
+
+    if sing-box -c "${test_config}.2" check > /dev/null 2>&1; then
+        pass "sing-box validates config with FakeIP"
+    else
+        fail "sing-box FakeIP config failed"
+    fi
+
+    # Test with TProxy inbound
+    jq '.inbounds += [{
+        type: "tproxy", tag: "tproxy-in",
+        listen: "127.0.0.1", listen_port: 1602,
+        tcp_fast_open: true, udp_fragment: true
+    }]' "$test_config" > "${test_config}.3"
+
+    if sing-box -c "${test_config}.3" check > /dev/null 2>&1; then
+        pass "sing-box validates config with TProxy"
+    else
+        fail "sing-box TProxy config failed"
+    fi
+
+    # Test with inline ruleset (DoH blocking)
+    jq '.route.rule_set += [{
+        type: "inline", tag: "doh-block",
+        rules: [{ ip_cidr: ["1.1.1.1/32", "8.8.8.8/32", "2606:4700:4700::1111/128", "2001:4860:4860::8888/128"] }]
+    }]' "$test_config" > "${test_config}.4"
+
+    if sing-box -c "${test_config}.4" check > /dev/null 2>&1; then
+        pass "sing-box validates inline ruleset (DoH block)"
+    else
+        fail "sing-box inline ruleset failed"
+    fi
+
+    # Test with IPv6 fakeip
+    jq '.dns.servers[0].inet6_range = "fd00:ec3a::/32"' "${test_config}.2" > "${test_config}.5"
+
+    if sing-box -c "${test_config}.5" check > /dev/null 2>&1; then
+        pass "sing-box validates config with IPv6 FakeIP"
+    else
+        fail "sing-box IPv6 FakeIP failed"
+    fi
+
+    rm -f "$test_config" "${test_config}.2" "${test_config}.3" "${test_config}.4" "${test_config}.5"
+
+    # ── VMess vmess://base64(JSON) parse path (facade) ─────────────────────
+    # Validate the GENERATED outbound JSON SHAPE with jq (NOT a live sing-box
+    # check): the test container's sing-box is the stock build, which rejects
+    # the vmess type, so we assert shape only. The extended gate is exercised
+    # by toggling is_sing_box_extended via a shell override.
+    local facade_lib="${NETSHIFT_LIB_DIR}/sing_box_config_facade.sh"
+    if [ ! -r "$facade_lib" ]; then
+        fail "sing_box_config_facade.sh not found"
+        return
+    fi
+
+    # The facade hardcodes NETSHIFT_LIB="/usr/lib/netshift" for its own sourcing
+    # of helpers.sh + sing_box_config_manager.sh; bind the bind-mounted sources
+    # to that runtime path so the facade resolves them in the container.
+    mkdir -p /usr/lib/netshift
+    ln -sf "${NETSHIFT_LIB_DIR}/helpers.sh" /usr/lib/netshift/helpers.sh
+    ln -sf "${NETSHIFT_LIB_DIR}/sing_box_config_manager.sh" /usr/lib/netshift/sing_box_config_manager.sh
+
+    local vm_tmp="/tmp/test-vmess-facade-$$.sh"
+    cat > "$vm_tmp" << 'VMEOF'
+# logging.sh is sourced by /usr/bin/netshift in production; the facade itself
+# only sources helpers + manager, so pull it in for log() here.
+. "NETSHIFT_LIB/logging.sh" 2>/dev/null || log() { :; }
+. "FACADE_LIB_PATH"
+
+base_config='{"outbounds":[]}'
+
+# ws + tls synthetic link: base64(JSON). aid=0 must be omitted.
+ws_json='{"v":"2","ps":"node-ws","add":"ws.example.com","port":"443","id":"11111111-2222-3333-4444-555555555555","aid":"0","scy":"auto","net":"ws","host":"ws.example.com","path":"/wspath","tls":"tls","sni":"sni.example.com","alpn":"h2,http/1.1","fp":"chrome"}'
+ws_link="vmess://$(printf '%s' "$ws_json" | base64 | tr -d '\n')"
+
+# plain tcp synthetic link: no transport, no tls.
+tcp_json='{"v":"2","ps":"node-tcp","add":"tcp.example.com","port":"8080","id":"99999999-8888-7777-6666-555555555555","aid":"0","scy":"auto","net":"tcp","host":"","path":"","tls":"","sni":"","alpn":"","fp":""}'
+tcp_link="vmess://$(printf '%s' "$tcp_json" | base64 | tr -d '\n')"
+
+# task-012: a key with a trailing '#fragment' (server display name / remark,
+# like the user's real key `...In0=#🇳🇱Ne`). The '#' + emoji/Cyrillic bytes must
+# be STRIPPED before base64 decode; the canonical name still comes from `ps`.
+frag_json='{"v":"2","ps":"node-frag","add":"frag.example.com","port":"443","id":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","aid":"0","scy":"auto","net":"ws","host":"frag.example.com","path":"/fragpath","tls":"tls","sni":"frag.example.com","alpn":"","fp":""}'
+frag_link="vmess://$(printf '%s' "$frag_json" | base64 | tr -d '\n')#🇳🇱Ne"
+# Sanity: confirm the crafted link actually carries a '#fragment'.
+case "$frag_link" in
+*#*) echo 'vmess-frag-link-has-hash:OK' ;;
+*) echo 'vmess-frag-link-has-hash:FAIL' ;;
+esac
+
+# REGRESSION (S1): a key whose STANDARD base64 body DELIBERATELY contains a '+'.
+# The "node>>" ps label (bytes 0x3E 0x3E) forces a base64 group that maps to
+# '+' (alphabet index 62). If the facade url_decode'd the link before decoding,
+# the '+'->space rewrite would corrupt the body and base64 -d would fail/garble,
+# so this outbound would NOT be generated. Asserting server/uuid here proves the
+# raw-link threading keeps '+' intact.
+plus_json='{"v":"2","ps":"node>>","add":"plus.example.com","port":"2053","id":"abcdef00-1111-2222-3333-444455556666","aid":"0","scy":"auto","net":"tcp","host":"","path":"","tls":"","sni":"","alpn":"","fp":""}'
+plus_link="vmess://$(printf '%s' "$plus_json" | base64 | tr -d '\n')"
+# Sanity: confirm the crafted base64 body actually contains a '+'.
+case "$plus_link" in
+*+*) echo 'vmess-plus-body-has-plus:OK' ;;
+*) echo 'vmess-plus-body-has-plus:FAIL' ;;
+esac
+
+# ── Extended ON: parse path produces a real vmess outbound ──
+is_sing_box_extended() { return 0; }
+
+out_ws=$(sing_box_cf_add_proxy_outbound "$base_config" "vmess_ws" "$ws_link" "0")
+echo "$out_ws" | jq -e '.outbounds[0].type == "vmess"' >/dev/null 2>&1 && echo 'vmess-ws-type:OK' || echo 'vmess-ws-type:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].server == "ws.example.com"' >/dev/null 2>&1 && echo 'vmess-ws-server:OK' || echo 'vmess-ws-server:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].server_port == 443' >/dev/null 2>&1 && echo 'vmess-ws-port:OK' || echo 'vmess-ws-port:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0] | has("alter_id") | not' >/dev/null 2>&1 && echo 'vmess-ws-aid-omitted:OK' || echo 'vmess-ws-aid-omitted:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].transport.type == "ws"' >/dev/null 2>&1 && echo 'vmess-ws-transport:OK' || echo 'vmess-ws-transport:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].transport.path == "/wspath"' >/dev/null 2>&1 && echo 'vmess-ws-path:OK' || echo 'vmess-ws-path:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].transport.headers.Host == "ws.example.com"' >/dev/null 2>&1 && echo 'vmess-ws-host:OK' || echo 'vmess-ws-host:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].tls.enabled == true' >/dev/null 2>&1 && echo 'vmess-ws-tls:OK' || echo 'vmess-ws-tls:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].tls.server_name == "sni.example.com"' >/dev/null 2>&1 && echo 'vmess-ws-sni:OK' || echo 'vmess-ws-sni:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].tls.alpn == ["h2","http/1.1"]' >/dev/null 2>&1 && echo 'vmess-ws-alpn:OK' || echo 'vmess-ws-alpn:FAIL'
+echo "$out_ws" | jq -e '.outbounds[0].tls.utls.fingerprint == "chrome"' >/dev/null 2>&1 && echo 'vmess-ws-fp:OK' || echo 'vmess-ws-fp:FAIL'
+
+out_tcp=$(sing_box_cf_add_proxy_outbound "$base_config" "vmess_tcp" "$tcp_link" "0")
+echo "$out_tcp" | jq -e '.outbounds[0].type == "vmess"' >/dev/null 2>&1 && echo 'vmess-tcp-type:OK' || echo 'vmess-tcp-type:FAIL'
+echo "$out_tcp" | jq -e '.outbounds[0] | has("transport") | not' >/dev/null 2>&1 && echo 'vmess-tcp-no-transport:OK' || echo 'vmess-tcp-no-transport:FAIL'
+echo "$out_tcp" | jq -e '.outbounds[0] | has("tls") | not' >/dev/null 2>&1 && echo 'vmess-tcp-no-tls:OK' || echo 'vmess-tcp-no-tls:FAIL'
+echo "$out_tcp" | jq -e '.outbounds[0].security == "auto"' >/dev/null 2>&1 && echo 'vmess-tcp-security:OK' || echo 'vmess-tcp-security:FAIL'
+
+# ── REGRESSION (S1): '+'-in-base64 link must parse via the RAW link ──
+out_plus=$(sing_box_cf_add_proxy_outbound "$base_config" "vmess_plus" "$plus_link" "0")
+echo "$out_plus" | jq -e '.outbounds[0].type == "vmess"' >/dev/null 2>&1 && echo 'vmess-plus-type:OK' || echo 'vmess-plus-type:FAIL'
+echo "$out_plus" | jq -e '.outbounds[0].server == "plus.example.com"' >/dev/null 2>&1 && echo 'vmess-plus-server:OK' || echo 'vmess-plus-server:FAIL'
+echo "$out_plus" | jq -e '.outbounds[0].server_port == 2053' >/dev/null 2>&1 && echo 'vmess-plus-port:OK' || echo 'vmess-plus-port:FAIL'
+echo "$out_plus" | jq -e '.outbounds[0].uuid == "abcdef00-1111-2222-3333-444455556666"' >/dev/null 2>&1 && echo 'vmess-plus-uuid:OK' || echo 'vmess-plus-uuid:FAIL'
+
+# ── task-012: '#fragment' link must parse (fragment stripped before decode) ──
+out_frag=$(sing_box_cf_add_proxy_outbound "$base_config" "vmess_frag" "$frag_link" "0")
+echo "$out_frag" | jq -e '.outbounds[0].type == "vmess"' >/dev/null 2>&1 && echo 'vmess-frag-type:OK' || echo 'vmess-frag-type:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].server == "frag.example.com"' >/dev/null 2>&1 && echo 'vmess-frag-server:OK' || echo 'vmess-frag-server:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].server_port == 443' >/dev/null 2>&1 && echo 'vmess-frag-port:OK' || echo 'vmess-frag-port:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].uuid == "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"' >/dev/null 2>&1 && echo 'vmess-frag-uuid:OK' || echo 'vmess-frag-uuid:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].transport.type == "ws"' >/dev/null 2>&1 && echo 'vmess-frag-transport:OK' || echo 'vmess-frag-transport:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].transport.path == "/fragpath"' >/dev/null 2>&1 && echo 'vmess-frag-path:OK' || echo 'vmess-frag-path:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].tls.enabled == true' >/dev/null 2>&1 && echo 'vmess-frag-tls:OK' || echo 'vmess-frag-tls:FAIL'
+echo "$out_frag" | jq -e '.outbounds[0].tls.server_name == "frag.example.com"' >/dev/null 2>&1 && echo 'vmess-frag-sni:OK' || echo 'vmess-frag-sni:FAIL'
+
+# ── Extended OFF: gate returns config UNCHANGED (no vmess outbound) ──
+is_sing_box_extended() { return 1; }
+out_gate=$(sing_box_cf_add_proxy_outbound "$base_config" "vmess_gate" "$ws_link" "0")
+echo "$out_gate" | jq -e '.outbounds | length == 0' >/dev/null 2>&1 && echo 'vmess-gate-unchanged:OK' || echo 'vmess-gate-unchanged:FAIL'
+
+echo 'DONE'
+VMEOF
+    sed -i "s|FACADE_LIB_PATH|$facade_lib|; s|NETSHIFT_LIB|$NETSHIFT_LIB_DIR|g" "$vm_tmp"
+
+    sh "$vm_tmp" 2>&1 | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+    rm -f "$vm_tmp"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Diagnostics Commands
+# ─────────────────────────────────────────────────────────────────
+test_diagnostics() {
+    header "Diagnostics Commands"
+
+    if ! command -v sing-box > /dev/null 2>&1; then
+        skip "sing-box not installed — skipping diagnostic tests"
+        return
+    fi
+
+    # sing-box version
+    if sing-box version > /dev/null 2>&1; then
+        pass "sing-box version works"
+    else
+        fail "sing-box version failed"
+    fi
+
+    # sing-box check on empty config
+    echo '{}' > /tmp/empty.json
+    if sing-box -c /tmp/empty.json check > /dev/null 2>&1; then
+        pass "sing-box check accepts empty config"
+    else
+        # This might fail — some versions require more structure
+        pass "sing-box check rejects empty config (expected on newer versions)"
+    fi
+    rm -f /tmp/empty.json
+
+    # dig
+    if command -v dig > /dev/null 2>&1; then
+        if dig +short +timeout=3 google.com > /dev/null 2>&1; then
+            pass "dig DNS resolution works"
+        else
+            skip "dig DNS resolution (no network?)"
+        fi
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: jq Helpers
+# ─────────────────────────────────────────────────────────────────
+test_jq_helpers() {
+    header "jq Helper Functions"
+
+    local jq_helpers="${NETSHIFT_LIB_DIR}/helpers.jq"
+
+    if [ ! -r "$jq_helpers" ]; then
+        skip "helpers.jq not found"
+        return
+    fi
+
+    # Production scripts import helpers.jq from /usr/lib/netshift. In the test
+    # container sources are bind-mounted under /netshift/files, so provide the
+    # runtime path as a symlink for jq module resolution.
+    mkdir -p /usr/lib/netshift
+    ln -sf "$jq_helpers" /usr/lib/netshift/helpers.jq
+
+    # Test the extend_key_value function. Keep the jq program in a file instead
+    # of a shell variable because BusyBox ash can choke on jq syntax like
+    # `h::extend_key_value(.; ...)` during script parsing in some builds.
+    local jq_filter_file="/tmp/netshift-jq-filter-$$.jq"
+    cat > "$jq_filter_file" << 'JQEOF'
+import "helpers" as h;
+[1,2,3] | h::extend_key_value(.; [4,5])
+JQEOF
+    local jq_error_file="/tmp/netshift-jq-error-$$.log"
+    result=$(jq -n -L "/usr/lib/netshift" -f "$jq_filter_file" 2>"$jq_error_file" || true)
+    rm -f "$jq_filter_file"
+    
+    if echo "$result" | jq -e '. | length == 5' > /dev/null 2>&1; then
+        pass "helpers.jq extend_key_value merges arrays"
+    else
+        fail "helpers.jq extend_key_value failed" "got: $result $(cat "$jq_error_file" 2>/dev/null)"
+    fi
+    rm -f "$jq_error_file"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Config Manager JSON Generation
+# ─────────────────────────────────────────────────────────────────
+test_config_manager() {
+    header "sing-box Config Manager (jq)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    # Test basic config operations by simulating the config manager pipeline
+    local config
+    config=$(jq -n '{
+        log: {}, dns: {}, ntp: {}, certificate: {}, endpoints: [],
+        inbounds: [], outbounds: [], route: {}, services: [], experimental: {}
+    }')
+
+    # Simulate adding a direct outbound
+    config=$(echo "$config" | jq '.outbounds += [{ type: "direct", tag: "direct-out" }]')
+    if echo "$config" | jq -e '.outbounds | length == 1' > /dev/null 2>&1; then
+        pass "jq: direct outbound added to config"
+    else
+        fail "jq: direct outbound failed"
+    fi
+
+    # Simulate adding a TProxy inbound
+    config=$(echo "$config" | jq '.inbounds += [{
+        type: "tproxy", tag: "tproxy-in",
+        listen: "127.0.0.1", listen_port: 1602,
+        tcp_fast_open: true, udp_fragment: true
+    }]')
+    if echo "$config" | jq -e '.inbounds | length == 1' > /dev/null 2>&1; then
+        pass "jq: TProxy inbound added to config"
+    else
+        fail "jq: TProxy inbound failed"
+    fi
+
+    # Simulate adding route rule
+    config=$(echo "$config" | jq '.route.rules += [{
+        action: "route", inbound: "tproxy-in", outbound: "direct-out"
+    }]')
+    if echo "$config" | jq -e '.route.rules | length == 1' > /dev/null 2>&1; then
+        pass "jq: route rule added to config"
+    else
+        fail "jq: route rule failed"
+    fi
+
+    # ── VMess outbound primitive (sing_box_cm_add_vmess_outbound) ──────────
+    local cm_lib="${NETSHIFT_LIB_DIR}/sing_box_config_manager.sh"
+    if [ ! -r "$cm_lib" ]; then
+        fail "sing_box_config_manager.sh not found"
+        return
+    fi
+
+    local cm_tmp="/tmp/test-cm-vmess-$$.sh"
+    cat > "$cm_tmp" << 'CMEOF'
+. "CM_LIB_PATH"
+
+base_config='{"outbounds":[]}'
+
+# Default security ("auto") + alter_id omitted when "0".
+out=$(sing_box_cm_add_vmess_outbound "$base_config" "vmess-out" "example.com" "443" \
+    "bf000d23-0752-40b4-affe-68f7707a9661" "" "0")
+echo "$out" | jq -e '.outbounds[0].type == "vmess"' >/dev/null 2>&1 && echo 'cm-vmess-type:OK' || echo 'cm-vmess-type:FAIL'
+echo "$out" | jq -e '.outbounds[0].server == "example.com"' >/dev/null 2>&1 && echo 'cm-vmess-server:OK' || echo 'cm-vmess-server:FAIL'
+echo "$out" | jq -e '.outbounds[0].server_port == 443' >/dev/null 2>&1 && echo 'cm-vmess-port:OK' || echo 'cm-vmess-port:FAIL'
+echo "$out" | jq -e '.outbounds[0].uuid == "bf000d23-0752-40b4-affe-68f7707a9661"' >/dev/null 2>&1 && echo 'cm-vmess-uuid:OK' || echo 'cm-vmess-uuid:FAIL'
+echo "$out" | jq -e '.outbounds[0].security == "auto"' >/dev/null 2>&1 && echo 'cm-vmess-security-default:OK' || echo 'cm-vmess-security-default:FAIL'
+echo "$out" | jq -e '.outbounds[0] | has("alter_id") | not' >/dev/null 2>&1 && echo 'cm-vmess-aid-omitted:OK' || echo 'cm-vmess-aid-omitted:FAIL'
+
+# Explicit security + non-zero alter_id present as a number.
+out2=$(sing_box_cm_add_vmess_outbound "$base_config" "vmess-out" "example.com" "443" \
+    "bf000d23-0752-40b4-affe-68f7707a9661" "aes-128-gcm" "64")
+echo "$out2" | jq -e '.outbounds[0].security == "aes-128-gcm"' >/dev/null 2>&1 && echo 'cm-vmess-security-explicit:OK' || echo 'cm-vmess-security-explicit:FAIL'
+echo "$out2" | jq -e '.outbounds[0].alter_id == 64' >/dev/null 2>&1 && echo 'cm-vmess-aid-number:OK' || echo 'cm-vmess-aid-number:FAIL'
+
+doh_cfg='{"route":{"rules":[],"rule_set":[]}}'
+doh_out=$(sing_box_cm_add_doh_block_route_rule "$doh_cfg" "doh-block" "tproxy-in" \
+    "1.1.1.1/32 8.8.8.8/32" "2606:4700:4700::1111/128 2001:4860:4860::8888/128")
+echo "$doh_out" | jq -e '.route.rule_set[0].rules[0].ip_cidr | (index("1.1.1.1/32") != null) and (index("2606:4700:4700::1111/128") != null)' >/dev/null 2>&1 && echo 'cm-doh-cidrs-v4-v6:OK' || echo 'cm-doh-cidrs-v4-v6:FAIL'
+echo "$doh_out" | jq -e '.route.rules[0].action == "reject" and .route.rules[0].rule_set == "doh-block-ruleset" and .route.rules[0].inbound == "tproxy-in"' >/dev/null 2>&1 && echo 'cm-doh-route-rule:OK' || echo 'cm-doh-route-rule:FAIL'
+
+echo 'DONE'
+CMEOF
+    sed -i "s|CM_LIB_PATH|$cm_lib|" "$cm_tmp"
+
+    sh "$cm_tmp" 2>&1 | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+    rm -f "$cm_tmp"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Subscription JSON Validation
+# ─────────────────────────────────────────────────────────────────
+test_subscription() {
+    header "Subscription JSON Validation"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    # Create a valid subscription-like JSON
+    local sub='{
+        "outbounds": [
+            {"type": "shadowsocks", "tag": "ss-01", "server": "example.com", "server_port": 443, "method": "aes-256-gcm", "password": "test"},
+            {"type": "vless", "tag": "vl-01", "server": "vless.example.com", "server_port": 443, "uuid": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision", "tls": {"enabled": true, "server_name": "example.com"}},
+            {"type": "trojan", "tag": "tj-01", "server": "trojan.example.com", "server_port": 443, "password": "test"},
+            {"type": "hysteria2", "tag": "hy2-01", "server": "hysteria.example.com", "server_port": 443, "password": "test"},
+            {"type": "selector", "tag": "select", "outbounds": ["ss-01", "vl-01"]},
+            {"type": "urltest", "tag": "auto", "outbounds": ["ss-01", "vl-01"]},
+            {"type": "direct", "tag": "direct"},
+            {"type": "dns", "tag": "dns"},
+            {"type": "block", "tag": "block"}
+        ]
+    }'
+
+    # Count proxy outbounds (exclude selector, urltest, direct, dns, block)
+    local proxy_count
+    local proxy_filter_file="/tmp/netshift-proxy-filter-$$.jq"
+    cat > "$proxy_filter_file" << 'JQEOF'
+[.outbounds[] | select(.type != "selector" and .type != "urltest" and .type != "direct" and .type != "dns" and .type != "block")] | length
+JQEOF
+    proxy_count=$(echo "$sub" | jq -f "$proxy_filter_file")
+    rm -f "$proxy_filter_file"
+
+    if [ "$proxy_count" -eq 4 ]; then
+        pass "Subscription proxy count correct: $proxy_count (ss + vless + trojan + hysteria2)"
+    else
+        fail "Subscription proxy count wrong: expected 4, got $proxy_count"
+    fi
+
+    # Test filtering for subscription outbound tags
+    local outbound_tags
+    local tags_filter_file="/tmp/netshift-tags-filter-$$.jq"
+    cat > "$tags_filter_file" << 'JQEOF'
+[.outbounds[] | select(.type != "selector" and .type != "urltest" and .type != "direct" and .type != "dns" and .type != "block") | .tag]
+JQEOF
+    outbound_tags=$(echo "$sub" | jq -c -f "$tags_filter_file")
+    rm -f "$tags_filter_file"
+
+    if echo "$outbound_tags" | jq -e 'length == 4' > /dev/null 2>&1; then
+        pass "Subscription outbound tags extracted correctly"
+    else
+        fail "Subscription outbound tags extraction failed"
+    fi
+
+    # Test country flag extraction from tags
+    # Build tags with actual Unicode regional indicator flags
+    local country_test
+    local flag_filter_file="/tmp/netshift-flag-filter-$$.jq"
+    cat > "$flag_filter_file" << 'JQEOF'
+def flag($l1; $l2): ([127462 + $l1, 127462 + $l2] | implode);
+[(flag(3; 4) + " Frankfurt"), (flag(20; 18) + " New York"), (flag(13; 11) + " Amsterdam"), (flag(9; 15) + " Tokyo"), "no-flag"]
+JQEOF
+    country_test=$(jq -cn -f "$flag_filter_file")
+    rm -f "$flag_filter_file"
+
+    local grouping
+    local group_filter_file="/tmp/netshift-group-filter-$$.jq"
+    cat > "$group_filter_file" << 'JQEOF'
+def is_regional_indicator: . >= 127462 and . <= 127487;
+def extract_country_flag:
+  (. | explode) as $codepoints
+  | if ($codepoints | length) >= 2
+      and ($codepoints[0] | is_regional_indicator)
+      and ($codepoints[1] | is_regional_indicator)
+    then ($codepoints[0:2] | implode)
+    else "" end;
+(if type == "array" then . else [] end) as $tags
+| reduce $tags[] as $tag (
+    {count: 0, ungrouped: 0};
+    ($tag | extract_country_flag) as $flag
+    | if $flag == "" then .ungrouped += 1 else .count += 1 end
+  )
+JQEOF
+    grouping=$(echo "$country_test" | jq -c -f "$group_filter_file")
+    rm -f "$group_filter_file"
+
+    local grouped
+    grouped=$(echo "$grouping" | jq -r '.count')
+    local ungrouped
+    ungrouped=$(echo "$grouping" | jq -r '.ungrouped')
+
+    if [ "$grouped" -eq 4 ] && [ "$ungrouped" -eq 1 ]; then
+        pass "Country flag grouping: $grouped grouped, $ungrouped ungrouped"
+    else
+        fail "Country flag grouping wrong: got $grouped grouped, $ungrouped ungrouped"
+    fi
+
+    # ── Universal grouper (task-044): prefix mode over synthetic tags ──────
+    # Mirror the shipped sing_box_build_subscription_groups extractor in an
+    # inline .jq so we exercise the exact mode-aware key logic without real
+    # node names. Synthetic tags only.
+    local grouper_filter_file="/tmp/netshift-grouper-filter-$$.jq"
+    cat > "$grouper_filter_file" << 'JQEOF'
+def is_regional_indicator: . >= 127462 and . <= 127487;
+def extract_country_flag:
+  (. | explode) as $codepoints
+  | if ($codepoints | length) >= 2
+      and ($codepoints[0] | is_regional_indicator)
+      and ($codepoints[1] | is_regional_indicator)
+    then ($codepoints[0:2] | implode)
+    else "" end;
+def extract_prefix($n):
+  (. | explode) as $codepoints
+  | if ($codepoints | length) == 0 then ""
+    else ($codepoints[0:$n] | implode) end;
+(try ($prefix_len | tonumber) catch $default_len) as $raw_len
+| (if ($raw_len | type) != "number" or $raw_len < 1
+    then $default_len else ($raw_len | floor) end) as $n
+| (if type == "array" then . else [] end) as $tags
+| reduce $tags[] as $tag (
+    {group_order: [], groups: {}, ungrouped: []};
+    (if $mode == "prefix" then ($tag | extract_prefix($n))
+     else ($tag | extract_country_flag) end) as $key
+    | if $key == "" then .ungrouped += [$tag]
+      else
+        .groups[$key] = ((.groups[$key] // []) + [$tag])
+        | if (.group_order | index($key)) == null
+            then .group_order += [$key] else . end
+      end
+  )
+JQEOF
+
+    # prefix-len 2 over synthetic tags: US(2), DE(1), short tag X keyed as X(1)
+    local prefix_synth prefix_result prefix_groups prefix_us prefix_de prefix_x prefix_ungrouped
+    prefix_synth='["US-01","US-02","DE-01","X"]'
+    prefix_result=$(echo "$prefix_synth" | jq -c \
+        --arg mode "prefix" --arg prefix_len "2" --argjson default_len 2 \
+        -f "$grouper_filter_file")
+    prefix_groups=$(echo "$prefix_result" | jq -r '.group_order | length')
+    prefix_us=$(echo "$prefix_result" | jq -r '.groups["US"] | length')
+    prefix_de=$(echo "$prefix_result" | jq -r '.groups["DE"] | length')
+    prefix_x=$(echo "$prefix_result" | jq -r '.groups["X"] | length')
+    prefix_ungrouped=$(echo "$prefix_result" | jq -r '.ungrouped | length')
+    if [ "$prefix_groups" -eq 3 ] && [ "$prefix_us" -eq 2 ] && \
+        [ "$prefix_de" -eq 1 ] && [ "$prefix_x" -eq 1 ] && [ "$prefix_ungrouped" -eq 0 ]; then
+        pass "Prefix grouping (len 2): US=$prefix_us DE=$prefix_de X=$prefix_x, groups=$prefix_groups, ungrouped=$prefix_ungrouped"
+    else
+        fail "Prefix grouping (len 2) wrong: US=$prefix_us DE=$prefix_de X=$prefix_x groups=$prefix_groups ungrouped=$prefix_ungrouped"
+    fi
+
+    # Consistency: prefix-len 2 over flag-only tags == country grouping. A
+    # flag is exactly 2 codepoints, so prefix-len-2 keys each flag tag by its
+    # leading flag — identical group keys to country mode (the non-flag
+    # "no-flag" element of country_test is excluded here, since under prefix
+    # mode it would group by its first 2 chars instead of going ungrouped).
+    local flag_only_test prefix_flag_result country_flag_result
+    local flag_only_file="/tmp/netshift-flagonly-$$.jq"
+    cat > "$flag_only_file" << 'JQEOF'
+def flag($l1; $l2): ([127462 + $l1, 127462 + $l2] | implode);
+[(flag(3; 4) + " Frankfurt"), (flag(20; 18) + " New York"), (flag(13; 11) + " Amsterdam"), (flag(9; 15) + " Tokyo")]
+JQEOF
+    flag_only_test=$(jq -cn -f "$flag_only_file")
+    rm -f "$flag_only_file"
+    prefix_flag_result=$(echo "$flag_only_test" | jq -c \
+        --arg mode "prefix" --arg prefix_len "2" --argjson default_len 2 \
+        -f "$grouper_filter_file")
+    country_flag_result=$(echo "$flag_only_test" | jq -c \
+        --arg mode "country" --arg prefix_len "2" --argjson default_len 2 \
+        -f "$grouper_filter_file")
+    if [ "$prefix_flag_result" = "$country_flag_result" ]; then
+        pass "Prefix grouping consistency vs country: identical grouping over flag tags"
+    else
+        fail "Prefix grouping consistency vs country wrong: prefix=$prefix_flag_result country=$country_flag_result"
+    fi
+
+    # Bad/empty len must NOT crash; falls back to default 2.
+    local prefix_badlen_result prefix_badlen_us prefix_emptylen_result prefix_emptylen_us
+    prefix_badlen_result=$(echo "$prefix_synth" | jq -c \
+        --arg mode "prefix" --arg prefix_len "abc" --argjson default_len 2 \
+        -f "$grouper_filter_file" 2>/dev/null)
+    prefix_badlen_us=$(echo "$prefix_badlen_result" | jq -r '.groups["US"] | length' 2>/dev/null)
+    prefix_emptylen_result=$(echo "$prefix_synth" | jq -c \
+        --arg mode "prefix" --arg prefix_len "" --argjson default_len 2 \
+        -f "$grouper_filter_file" 2>/dev/null)
+    prefix_emptylen_us=$(echo "$prefix_emptylen_result" | jq -r '.groups["US"] | length' 2>/dev/null)
+    if [ "$prefix_badlen_us" = "2" ] && [ "$prefix_emptylen_us" = "2" ]; then
+        pass "Prefix grouping bad/empty len falls back to 2 (no crash)"
+    else
+        fail "Prefix grouping len fallback wrong: bad-len US=$prefix_badlen_us empty-len US=$prefix_emptylen_us"
+    fi
+
+    # Space-containing prefix keys must group correctly (regression for the
+    # word-splitting bug: a `for k in $(...)` loop over group keys shatters a
+    # key like "A " (letter+space) — the current-shell `while read < file`
+    # loop in the subscription branch preserves it). Synthetic tags only.
+    local space_synth space_result space_groups space_a space_b space_ungrouped space_keys
+    space_synth='["A 1","A 2","B 9"]'
+    space_result=$(echo "$space_synth" | jq -c \
+        --arg mode "prefix" --arg prefix_len "2" --argjson default_len 2 \
+        -f "$grouper_filter_file")
+    rm -f "$grouper_filter_file"
+    space_groups=$(echo "$space_result" | jq -r '.group_order | length')
+    space_a=$(echo "$space_result" | jq -r '.groups["A "] | length')
+    space_b=$(echo "$space_result" | jq -r '.groups["B "] | length')
+    space_ungrouped=$(echo "$space_result" | jq -r '.ungrouped | length')
+    # The group_order keys must be exactly "A " and "B " (each ends with a
+    # space) — confirms the space is preserved, not split away.
+    space_keys=$(echo "$space_result" | jq -c '.group_order')
+    if [ "$space_groups" -eq 2 ] && [ "$space_a" = "2" ] && [ "$space_b" = "1" ] && \
+        [ "$space_ungrouped" -eq 0 ] && [ "$space_keys" = '["A ","B "]' ]; then
+        pass "Prefix grouping space-key: 'A '=$space_a 'B '=$space_b, groups=$space_groups, ungrouped=$space_ungrouped"
+    else
+        fail "Prefix grouping space-key wrong: 'A '=$space_a 'B '=$space_b groups=$space_groups ungrouped=$space_ungrouped keys=$space_keys"
+    fi
+
+    # ── Fallback Subscription Normalizer (helpers.sh) ───────────────
+    # Exercise normalize_subscription_to_singbox end-to-end against the
+    # real libs. The facade hardcodes NETSHIFT_LIB=/usr/lib/netshift, so we
+    # mirror test_jq_helpers and expose the bind-mounted libs there via
+    # symlinks, then source constants + logging + facade (the facade pulls in
+    # helpers.sh and the config manager). Tokens are emitted on stdout and
+    # parsed with the same name:OK/FAIL/SKIP convention used by test_helpers.
+    # NB: no `set -u` in the harness — the URI builders rely on optional unset
+    # query-param vars, exactly like the production backend.
+    printf "\n  ${BOLD}Fallback Subscription Normalizer${NC}\n"
+
+    local lib="${NETSHIFT_LIB_DIR}"
+    if [ ! -r "$lib/helpers.sh" ] || [ ! -r "$lib/sing_box_config_facade.sh" ]; then
+        skip "fallback normalizer (libs not found in $lib)"
+        return
+    fi
+
+    local fb="/tmp/netshift-sub-fallback-$$.sh"
+    cat > "$fb" << 'FBEOF'
+# Make the facade's hardcoded NETSHIFT_LIB path resolve to the bind-mounted libs.
+mkdir -p /usr/lib/netshift
+for f in constants.sh helpers.sh logging.sh sing_box_config_manager.sh sing_box_config_facade.sh; do
+    ln -sf "LIB_DIR/$f" "/usr/lib/netshift/$f"
+done
+
+. /usr/lib/netshift/constants.sh
+. /usr/lib/netshift/logging.sh
+# The facade sources helpers.sh + sing_box_config_manager.sh itself.
+. /usr/lib/netshift/sing_box_config_facade.sh
+
+# ── CASE A: plaintext URI list with comment/metadata lines ──────────
+caseA_in="/tmp/netshift-fb-caseA-$$.txt"
+caseA_out="/tmp/netshift-fb-caseA-out-$$.json"
+cat > "$caseA_in" << 'LIST'
+#profile-title: Test
+#subscription-userinfo: upload=0
+vless://11111111-1111-1111-1111-111111111111@example.com:443?security=tls&sni=example.com&type=tcp#A
+trojan://password123@example.com:8443?security=tls&sni=example.com#B
+ss://YWVzLTI1Ni1nY206cGFzcw==@example.com:8388#C
+hysteria2://pass@example.com:443?sni=example.com#D
+
+socks5://user:pass@example.com:1080#E
+LIST
+
+if normalize_subscription_to_singbox "$caseA_in" "$caseA_out" "testsub"; then
+    echo 'fb-caseA-rc:OK'
+else
+    echo 'fb-caseA-rc:FAIL'
+fi
+a_len="$(jq -r '.outbounds | length' "$caseA_out" 2>/dev/null)"
+[ -n "$a_len" ] || a_len=0
+if [ "$a_len" -ge 4 ]; then
+    echo "fb-caseA-count(>=4 got $a_len):OK"
+else
+    echo "fb-caseA-count(>=4 got $a_len):FAIL"
+fi
+if validate_subscription_file "$caseA_out"; then
+    echo 'fb-caseA-validate:OK'
+else
+    echo 'fb-caseA-validate:FAIL'
+fi
+rm -f "$caseA_in" "$caseA_out"
+
+# ── CASE B: base64-wrapped URI list ─────────────────────────────────
+# busybox base64 may lack -w0; encode then strip newlines with tr.
+caseB_plain="vless://22222222-2222-2222-2222-222222222222@example.com:443?security=tls&sni=example.com&type=tcp#B1
+trojan://secretpw@example.com:8443?security=tls&sni=example.com#B2"
+caseB_in="/tmp/netshift-fb-caseB-$$.txt"
+caseB_out="/tmp/netshift-fb-caseB-out-$$.json"
+printf '%s' "$caseB_plain" | base64 | tr -d '\n' > "$caseB_in"
+
+if normalize_subscription_to_singbox "$caseB_in" "$caseB_out" "testsub"; then
+    echo 'fb-caseB-rc:OK'
+else
+    echo 'fb-caseB-rc:FAIL'
+fi
+b_len="$(jq -r '.outbounds | length' "$caseB_out" 2>/dev/null)"
+[ -n "$b_len" ] || b_len=0
+if [ "$b_len" -ge 2 ]; then
+    echo "fb-caseB-count(>=2 got $b_len):OK"
+else
+    echo "fb-caseB-count(>=2 got $b_len):FAIL"
+fi
+if validate_subscription_file "$caseB_out"; then
+    echo 'fb-caseB-validate:OK'
+else
+    echo 'fb-caseB-validate:FAIL'
+fi
+rm -f "$caseB_in" "$caseB_out"
+
+# ── CASE C: robustness — valid keys mixed with garbage ──────────────
+# Two valid known-scheme keys; an unknown scheme (vmess), a malformed line,
+# a blank line and a comment must all be skipped without aborting the parse.
+caseC_in="/tmp/netshift-fb-caseC-$$.txt"
+caseC_out="/tmp/netshift-fb-caseC-out-$$.json"
+cat > "$caseC_in" << 'LIST'
+#header comment
+vless://33333333-3333-3333-3333-333333333333@example.com:443?security=tls&sni=example.com&type=tcp#C1
+vmess://eyJ0aGlzIjoidW5rbm93biJ9
+not-a-uri
+
+trojan://pw3@example.com:8443?security=tls&sni=example.com#C2
+LIST
+
+if normalize_subscription_to_singbox "$caseC_in" "$caseC_out" "testsub"; then
+    echo 'fb-caseC-rc:OK'
+else
+    echo 'fb-caseC-rc:FAIL'
+fi
+c_len="$(jq -r '.outbounds | length' "$caseC_out" 2>/dev/null)"
+[ -n "$c_len" ] || c_len=0
+if [ "$c_len" -eq 2 ]; then
+    echo "fb-caseC-count(==2 valid got $c_len):OK"
+else
+    echo "fb-caseC-count(==2 valid got $c_len):FAIL"
+fi
+rm -f "$caseC_in" "$caseC_out"
+
+# ── CASE D: negative — only comments / junk, no valid keys ──────────
+caseD_in="/tmp/netshift-fb-caseD-$$.txt"
+caseD_out="/tmp/netshift-fb-caseD-out-$$.json"
+cat > "$caseD_in" << 'LIST'
+#profile-title: Empty
+#subscription-userinfo: upload=0
+not-a-uri
+vmess://eyJqdW5rIjoidHJ1ZSJ9
+
+LIST
+
+if normalize_subscription_to_singbox "$caseD_in" "$caseD_out" "testsub"; then
+    echo 'fb-caseD-rc-nonzero:FAIL'
+else
+    echo 'fb-caseD-rc-nonzero:OK'
+fi
+# No usable output: either no file, or a file that fails validation.
+if [ ! -s "$caseD_out" ] || ! validate_subscription_file "$caseD_out"; then
+    echo 'fb-caseD-no-usable-output:OK'
+else
+    echo 'fb-caseD-no-usable-output:FAIL'
+fi
+rm -f "$caseD_in" "$caseD_out"
+
+# ── CASE E: Xray JSON subscription (array of Xray client configs) ───
+# A provider that returns an "Xray JSON" body instead of a sing-box config:
+# an array of Xray configs whose proxy outbounds use the Xray schema
+# (protocol + settings.vnext + streamSettings). The normalizer must detect
+# this, convert the directly-usable (non-dialerProxy) outbounds to share URIs
+# and produce a valid sing-box config. The chained (sockopt.dialerProxy)
+# outbound must be skipped.
+caseE_in="/tmp/netshift-fb-caseE-$$.json"
+caseE_out="/tmp/netshift-fb-caseE-out-$$.json"
+cat > "$caseE_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "Reality TCP",
+    "outbounds": [
+      {
+        "protocol": "vless",
+        "tag": "proxy-reality",
+        "settings": {"vnext": [{"address": "uk.example.com", "port": 8443,
+          "users": [{"id": "59e308c0-071d-4214-bb4a-64a2409d9e3b",
+            "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+        "streamSettings": {"network": "tcp", "security": "reality",
+          "realitySettings": {"publicKey": "dY9SNEllJMW63xo-JdXufhmjAxB",
+            "shortId": "c20b1035d72d7793", "serverName": "storage.yandex.net",
+            "fingerprint": "firefox"}}
+      }
+    ]
+  },
+  {
+    "remarks": "WS TLS",
+    "outbounds": [
+      {
+        "protocol": "vless",
+        "tag": "proxy-ws",
+        "settings": {"vnext": [{"address": "ws.example.com", "port": 443,
+          "users": [{"id": "dea6c6da-3903-4dbc-b98c-e79364764f9f",
+            "flow": "", "encryption": "none"}]}]},
+        "streamSettings": {"network": "ws", "security": "tls",
+          "tlsSettings": {"serverName": "ws.example.com"},
+          "wsSettings": {"path": "/livestreamcontent/",
+            "headers": {"Host": "ws.example.com"}}}
+      },
+      {
+        "protocol": "vless",
+        "tag": "proxy-chained",
+        "settings": {"vnext": [{"address": "bypass.example.com", "port": 8443,
+          "users": [{"id": "8c459cd3-f3b0-496c-9d87-138d292ecdf6",
+            "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+        "streamSettings": {"network": "tcp", "security": "reality",
+          "sockopt": {"dialerProxy": "upstream-0"},
+          "realitySettings": {"publicKey": "abc", "shortId": "def",
+            "serverName": "storage.yandex.net", "fingerprint": "firefox"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+
+if normalize_subscription_to_singbox "$caseE_in" "$caseE_out" "testsub"; then
+    echo 'fb-caseE-rc:OK'
+else
+    echo 'fb-caseE-rc:FAIL'
+fi
+# Exactly two usable outbounds: reality-tcp + ws-tls; the dialerProxy one skipped.
+e_len="$(jq -r '.outbounds | length' "$caseE_out" 2>/dev/null)"
+[ -n "$e_len" ] || e_len=0
+if [ "$e_len" -eq 2 ]; then
+    echo "fb-caseE-count(==2 got $e_len):OK"
+else
+    echo "fb-caseE-count(==2 got $e_len):FAIL"
+fi
+if validate_subscription_file "$caseE_out"; then
+    echo 'fb-caseE-validate:OK'
+else
+    echo 'fb-caseE-validate:FAIL'
+fi
+# The reality outbound must carry the converted reality block + flow.
+if jq -e '[.outbounds[] | select(.type == "vless"
+        and .tls.reality.public_key == "dY9SNEllJMW63xo-JdXufhmjAxB"
+        and .flow == "xtls-rprx-vision")] | length == 1' "$caseE_out" \
+        > /dev/null 2>&1; then
+    echo 'fb-caseE-reality-fields:OK'
+else
+    echo 'fb-caseE-reality-fields:FAIL'
+fi
+rm -f "$caseE_in" "$caseE_out"
+
+# ── CASE F: Xray JSON reality node WITHOUT shortId ──────────────────
+# Regression guard: a missing Xray field reads as JSON null, and a naive
+# (null | tostring) would emit a literal "sid=null" query param, which
+# sing-box would then store as short_id:"null". The converter must drop the
+# absent param entirely, so the produced reality block carries NO short_id.
+caseF_in="/tmp/netshift-fb-caseF-$$.json"
+caseF_out="/tmp/netshift-fb-caseF-out-$$.json"
+cat > "$caseF_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "no-sid",
+    "outbounds": [
+      {
+        "protocol": "vless",
+        "tag": "proxy-no-sid",
+        "settings": {"vnext": [{"address": "ru.example.com", "port": 443,
+          "users": [{"id": "1dff23f6-b2f1-4242-9746-b586808ed302",
+            "encryption": "none"}]}]},
+        "streamSettings": {"network": "tcp", "security": "reality",
+          "realitySettings": {"publicKey": "G2i-nsQgWiVf52tdCUV",
+            "serverName": "cloudrynth.com", "fingerprint": "firefox"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+
+if normalize_subscription_to_singbox "$caseF_in" "$caseF_out" "testsub"; then
+    echo 'fb-caseF-rc:OK'
+else
+    echo 'fb-caseF-rc:FAIL'
+fi
+if validate_subscription_file "$caseF_out"; then
+    echo 'fb-caseF-validate:OK'
+else
+    echo 'fb-caseF-validate:FAIL'
+fi
+# No outbound may carry a literal "null" short_id, and the public_key must be set.
+if jq -e '([.outbounds[].tls.reality.short_id // empty] | map(select(. == "null")) | length) == 0
+        and ([.outbounds[] | select(.tls.reality.public_key == "G2i-nsQgWiVf52tdCUV")] | length == 1)' \
+        "$caseF_out" > /dev/null 2>&1; then
+    echo 'fb-caseF-no-null-sid:OK'
+else
+    echo 'fb-caseF-no-null-sid:FAIL'
+fi
+rm -f "$caseF_in" "$caseF_out"
+
+# ── CASE G: Xray JSON duplicate-node dedup ──────────────────────────
+# Providers commonly ship one server set across many "profiles"/balancers,
+# repeating identical nodes with only the display name differing. The
+# converter must dedup on the connection part (ignoring the #name), so N
+# copies of the same server collapse to one. Here three configs reference the
+# same two servers (A, B) plus one extra (C) -> exactly 3 unique outbounds.
+caseG_in="/tmp/netshift-fb-caseG-$$.json"
+caseG_out="/tmp/netshift-fb-caseG-out-$$.json"
+cat > "$caseG_in" << 'XRAYJSON'
+[
+  {"remarks": "profile-1", "outbounds": [
+    {"protocol": "vless", "tag": "A", "settings": {"vnext": [{"address": "a.example.com", "port": 443,
+      "users": [{"id": "11111111-1111-1111-1111-111111111111", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ab", "serverName": "a.example.com", "fingerprint": "firefox"}}},
+    {"protocol": "vless", "tag": "B", "settings": {"vnext": [{"address": "b.example.com", "port": 443,
+      "users": [{"id": "22222222-2222-2222-2222-222222222222", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "cd", "serverName": "b.example.com", "fingerprint": "firefox"}}}
+  ]},
+  {"remarks": "profile-2", "outbounds": [
+    {"protocol": "vless", "tag": "A-copy", "settings": {"vnext": [{"address": "a.example.com", "port": 443,
+      "users": [{"id": "11111111-1111-1111-1111-111111111111", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ab", "serverName": "a.example.com", "fingerprint": "firefox"}}},
+    {"protocol": "vless", "tag": "B-copy", "settings": {"vnext": [{"address": "b.example.com", "port": 443,
+      "users": [{"id": "22222222-2222-2222-2222-222222222222", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "cd", "serverName": "b.example.com", "fingerprint": "firefox"}}}
+  ]},
+  {"remarks": "profile-3", "outbounds": [
+    {"protocol": "vless", "tag": "C", "settings": {"vnext": [{"address": "c.example.com", "port": 443,
+      "users": [{"id": "33333333-3333-3333-3333-333333333333", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ef", "serverName": "c.example.com", "fingerprint": "firefox"}}}
+  ]}
+]
+XRAYJSON
+
+if normalize_subscription_to_singbox "$caseG_in" "$caseG_out" "testsub"; then
+    echo 'fb-caseG-rc:OK'
+else
+    echo 'fb-caseG-rc:FAIL'
+fi
+# 5 raw nodes (A,B,A-copy,B-copy,C) must dedup to 3 unique servers (A,B,C).
+g_len="$(jq -r '.outbounds | length' "$caseG_out" 2>/dev/null)"
+[ -n "$g_len" ] || g_len=0
+if [ "$g_len" -eq 3 ]; then
+    echo "fb-caseG-dedup(==3 got $g_len):OK"
+else
+    echo "fb-caseG-dedup(==3 got $g_len):FAIL"
+fi
+# All three distinct servers must survive (a, b, c).
+if jq -e '([.outbounds[].server] | sort) == ["a.example.com","b.example.com","c.example.com"]' \
+        "$caseG_out" > /dev/null 2>&1; then
+    echo 'fb-caseG-servers:OK'
+else
+    echo 'fb-caseG-servers:FAIL'
+fi
+rm -f "$caseG_in" "$caseG_out"
+
+# ── CASE H: Xray JSON with unsupported VMess alongside VLESS ────────
+# The facade cannot build VMess. The converter must skip vmess but keep the
+# vless node, and xray_json_count_unsupported must report the dropped vmess so
+# the backend can warn the user instead of silently losing it.
+caseH_in="/tmp/netshift-fb-caseH-$$.json"
+caseH_out="/tmp/netshift-fb-caseH-out-$$.json"
+cat > "$caseH_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "mixed",
+    "outbounds": [
+      {
+        "protocol": "vless",
+        "tag": "ok-vless",
+        "settings": {"vnext": [{"address": "vl.example.com", "port": 443,
+          "users": [{"id": "11111111-1111-1111-1111-111111111111",
+            "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+        "streamSettings": {"network": "tcp", "security": "reality",
+          "realitySettings": {"publicKey": "PK", "shortId": "ab",
+            "serverName": "vl.example.com", "fingerprint": "firefox"}}
+      },
+      {
+        "protocol": "vmess",
+        "tag": "drop-vmess",
+        "settings": {"vnext": [{"address": "vm.example.com", "port": 443,
+          "users": [{"id": "22222222-2222-2222-2222-222222222222",
+            "alterId": 0, "security": "auto"}]}]},
+        "streamSettings": {"network": "tcp", "security": "tls",
+          "tlsSettings": {"serverName": "vm.example.com"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+
+if normalize_subscription_to_singbox "$caseH_in" "$caseH_out" "testsub"; then
+    echo 'fb-caseH-rc:OK'
+else
+    echo 'fb-caseH-rc:FAIL'
+fi
+# Exactly one usable outbound (vless); vmess dropped.
+h_len="$(jq -r '.outbounds | length' "$caseH_out" 2>/dev/null)"
+[ -n "$h_len" ] || h_len=0
+if [ "$h_len" -eq 1 ] \
+        && jq -e '.outbounds[0].server == "vl.example.com"' "$caseH_out" >/dev/null 2>&1; then
+    echo "fb-caseH-vless-kept(==1 got $h_len):OK"
+else
+    echo "fb-caseH-vless-kept(==1 got $h_len):FAIL"
+fi
+# The unsupported-protocol counter must report exactly one vmess.
+h_unsup="$(xray_json_count_unsupported "$caseH_in")"
+if [ "$h_unsup" = "1" ]; then
+    echo 'fb-caseH-vmess-counted:OK'
+else
+    echo "fb-caseH-vmess-counted(==1 got $h_unsup):FAIL"
+fi
+rm -f "$caseH_in" "$caseH_out"
+
+# ── CASE I: subscription User-Agent candidate building ──────────────
+# Auto mode (no configured UA) must emit, in order and without duplicates:
+# the default singbox/<ver> first, then the cached/preferred UA, then the
+# constants whitelist. A configured UA must short-circuit to exactly itself.
+caseI_default="$(get_subscription_user_agent)"
+
+# (a) Auto mode, no preferred: first line is the default; v2rayN present; no dup default.
+caseI_auto="$(build_subscription_user_agent_candidates "" "")"
+caseI_first="$(printf '%s\n' "$caseI_auto" | sed -n '1p')"
+if [ "$caseI_first" = "$caseI_default" ]; then
+    echo 'fb-caseI-auto-default-first:OK'
+else
+    echo "fb-caseI-auto-default-first(got '$caseI_first'):FAIL"
+fi
+if printf '%s\n' "$caseI_auto" | grep -Fxq 'v2rayN'; then
+    echo 'fb-caseI-auto-has-v2rayN:OK'
+else
+    echo 'fb-caseI-auto-has-v2rayN:FAIL'
+fi
+caseI_default_count="$(printf '%s\n' "$caseI_auto" | grep -Fxc "$caseI_default")"
+if [ "$caseI_default_count" = "1" ]; then
+    echo 'fb-caseI-auto-default-unique:OK'
+else
+    echo "fb-caseI-auto-default-unique(got $caseI_default_count):FAIL"
+fi
+
+# (b) Preferred UA is emitted right after the default and only once.
+caseI_pref="$(build_subscription_user_agent_candidates "" "Hiddify")"
+caseI_second="$(printf '%s\n' "$caseI_pref" | sed -n '2p')"
+caseI_hid_count="$(printf '%s\n' "$caseI_pref" | grep -Fxc 'Hiddify')"
+if [ "$caseI_second" = "Hiddify" ] && [ "$caseI_hid_count" = "1" ]; then
+    echo 'fb-caseI-preferred-second-unique:OK'
+else
+    echo "fb-caseI-preferred-second-unique(2nd='$caseI_second' count=$caseI_hid_count):FAIL"
+fi
+
+# (c) Configured UA short-circuits to exactly one line = itself.
+caseI_conf="$(build_subscription_user_agent_candidates "MyClient/1.0" "Hiddify")"
+caseI_conf_lines="$(printf '%s\n' "$caseI_conf" | grep -c .)"
+if [ "$caseI_conf" = "MyClient/1.0" ] && [ "$caseI_conf_lines" = "1" ]; then
+    echo 'fb-caseI-configured-only:OK'
+else
+    echo "fb-caseI-configured-only(got '$caseI_conf' lines=$caseI_conf_lines):FAIL"
+fi
+
+# (c2) Empty preference (auto via 3rd arg) keeps today's order: default first.
+caseI_emptyp="$(build_subscription_user_agent_candidates "" "" "")"
+caseI_emptyp_first="$(printf '%s\n' "$caseI_emptyp" | sed -n '1p')"
+if [ "$caseI_emptyp_first" = "$caseI_default" ]; then
+    echo 'fb-caseI-emptypref-default-first:OK'
+else
+    echo "fb-caseI-emptypref-default-first(got '$caseI_emptyp_first'):FAIL"
+fi
+
+# (d) auto preference keeps today's order: default singbox/<ver> first.
+caseI_autop="$(build_subscription_user_agent_candidates "" "" "auto")"
+caseI_autop_first="$(printf '%s\n' "$caseI_autop" | sed -n '1p')"
+if [ "$caseI_autop_first" = "$caseI_default" ]; then
+    echo 'fb-caseI-autopref-default-first:OK'
+else
+    echo "fb-caseI-autopref-default-first(got '$caseI_autop_first'):FAIL"
+fi
+
+# (e) singbox preference: default singbox/<ver> first (defined behaviour).
+caseI_sbp="$(build_subscription_user_agent_candidates "" "Hiddify" "singbox")"
+caseI_sbp_first="$(printf '%s\n' "$caseI_sbp" | sed -n '1p')"
+if [ "$caseI_sbp_first" = "$caseI_default" ]; then
+    echo 'fb-caseI-singboxpref-default-first:OK'
+else
+    echo "fb-caseI-singboxpref-default-first(got '$caseI_sbp_first'):FAIL"
+fi
+
+# (f) xray preference: the versioned Xray-JSON UAs come FIRST — before the
+# default singbox/<ver> AND before the cached preferred winner. Pass a cached
+# preferred ('Hiddify') to prove the xray UAs outrank it. The expected first two
+# candidates are DERIVED from the SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES constant
+# (sourced above) so a future constant tweak doesn't rot this test.
+caseI_xray="$(build_subscription_user_agent_candidates "" "Hiddify" "xray")"
+caseI_xray_first="$(printf '%s\n' "$caseI_xray" | sed -n '1p')"
+caseI_xray_second="$(printf '%s\n' "$caseI_xray" | sed -n '2p')"
+# Expected first/second/third xray UAs, split from the constant (in order).
+# shellcheck disable=SC2086 # word-splitting of the candidate list is intentional
+set -- $SUBSCRIPTION_USER_AGENT_XRAY_CANDIDATES
+caseI_xray_exp1="$1"
+caseI_xray_exp2="$2"
+caseI_xray_exp3="$3"
+# Position helper: line number of an exact match (empty if absent).
+caseI_pos() { printf '%s\n' "$1" | grep -Fxn "$2" | head -n1 | cut -d: -f1; }
+caseI_xray_p_1="$(caseI_pos "$caseI_xray" "$caseI_xray_exp1")"
+caseI_xray_p_2="$(caseI_pos "$caseI_xray" "$caseI_xray_exp2")"
+caseI_xray_p_3="$(caseI_pos "$caseI_xray" "$caseI_xray_exp3")"
+caseI_xray_p_default="$(caseI_pos "$caseI_xray" "$caseI_default")"
+caseI_xray_p_pref="$(caseI_pos "$caseI_xray" 'Hiddify')"
+# First two lines are the first two xray candidates (in constant order).
+if [ "$caseI_xray_first" = "$caseI_xray_exp1" ] && [ "$caseI_xray_second" = "$caseI_xray_exp2" ]; then
+    echo 'fb-caseI-xraypref-xray-first:OK'
+else
+    echo "fb-caseI-xraypref-xray-first(1st='$caseI_xray_first' 2nd='$caseI_xray_second'):FAIL"
+fi
+# Guard: the first xray candidate is VERSIONED (contains a '/'), not a bare UA.
+case "$caseI_xray_first" in
+*/*) echo 'fb-caseI-xraypref-first-versioned:OK' ;;
+*) echo "fb-caseI-xraypref-first-versioned(got '$caseI_xray_first'):FAIL" ;;
+esac
+# Every xray UA precedes the default and the cached preferred winner.
+if [ -n "$caseI_xray_p_1" ] && [ -n "$caseI_xray_p_2" ] && [ -n "$caseI_xray_p_3" ] &&
+    [ -n "$caseI_xray_p_default" ] && [ -n "$caseI_xray_p_pref" ] &&
+    [ "$caseI_xray_p_1" -lt "$caseI_xray_p_default" ] &&
+    [ "$caseI_xray_p_2" -lt "$caseI_xray_p_default" ] &&
+    [ "$caseI_xray_p_3" -lt "$caseI_xray_p_default" ] &&
+    [ "$caseI_xray_p_1" -lt "$caseI_xray_p_pref" ] &&
+    [ "$caseI_xray_p_2" -lt "$caseI_xray_p_pref" ] &&
+    [ "$caseI_xray_p_3" -lt "$caseI_xray_p_pref" ]; then
+    echo 'fb-caseI-xraypref-outranks-default-and-cache:OK'
+else
+    echo "fb-caseI-xraypref-outranks-default-and-cache(1=$caseI_xray_p_1 2=$caseI_xray_p_2 3=$caseI_xray_p_3 def=$caseI_xray_p_default pref=$caseI_xray_p_pref):FAIL"
+fi
+# Dedup holds: no UA emitted twice (each xray UA and the default appears once).
+caseI_xray_1_count="$(printf '%s\n' "$caseI_xray" | grep -Fxc "$caseI_xray_exp1")"
+caseI_xray_2_count="$(printf '%s\n' "$caseI_xray" | grep -Fxc "$caseI_xray_exp2")"
+caseI_xray_3_count="$(printf '%s\n' "$caseI_xray" | grep -Fxc "$caseI_xray_exp3")"
+caseI_xray_def_count="$(printf '%s\n' "$caseI_xray" | grep -Fxc "$caseI_default")"
+if [ "$caseI_xray_1_count" = "1" ] && [ "$caseI_xray_2_count" = "1" ] &&
+    [ "$caseI_xray_3_count" = "1" ] && [ "$caseI_xray_def_count" = "1" ]; then
+    echo 'fb-caseI-xraypref-dedup:OK'
+else
+    echo "fb-caseI-xraypref-dedup(1=$caseI_xray_1_count 2=$caseI_xray_2_count 3=$caseI_xray_3_count def=$caseI_xray_def_count):FAIL"
+fi
+
+# (g) Unrecognised preference falls back to auto order: default first.
+caseI_unk="$(build_subscription_user_agent_candidates "" "Hiddify" "totally-bogus")"
+caseI_unk_first="$(printf '%s\n' "$caseI_unk" | sed -n '1p')"
+if [ "$caseI_unk_first" = "$caseI_default" ]; then
+    echo 'fb-caseI-unknownpref-auto-first:OK'
+else
+    echo "fb-caseI-unknownpref-auto-first(got '$caseI_unk_first'):FAIL"
+fi
+
+# (h) Explicit configured UA still short-circuits regardless of preference.
+caseI_conf_xray="$(build_subscription_user_agent_candidates "MyClient/1.0" "Hiddify" "xray")"
+caseI_conf_xray_lines="$(printf '%s\n' "$caseI_conf_xray" | grep -c .)"
+if [ "$caseI_conf_xray" = "MyClient/1.0" ] && [ "$caseI_conf_xray_lines" = "1" ]; then
+    echo 'fb-caseI-configured-overrides-pref:OK'
+else
+    echo "fb-caseI-configured-overrides-pref(got '$caseI_conf_xray' lines=$caseI_conf_xray_lines):FAIL"
+fi
+
+# ── CASE J: subscription keyword whitelist/blacklist filter ─────────
+# Drive sing_box_cf_prepare_subscription_batch directly with a synthetic
+# subscription JSON and assert kept counts/names for include/exclude lists.
+# Matching: substring, OR across keywords, ASCII case-insensitive, byte-exact
+# for non-folded scripts (emoji/etc). No jq regex (index + inline ucfold only).
+caseJ_cfg='{"outbounds":[]}'
+caseJ_sub="/tmp/netshift-fb-caseJ-$$.json"
+cat > "$caseJ_sub" << 'JSUB'
+{
+  "outbounds": [
+    {"type": "shadowsocks", "tag": "US grpc", "server": "a.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "US ws", "server": "b.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "DE grpc", "server": "c.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"}
+  ]
+}
+JSUB
+
+# Helper: emit the JSON `count` for given include/exclude arrays.
+caseJ_count() {
+    sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseJ_sub" "$1" "$2" |
+        jq -r '.count // -1'
+}
+# Helper: emit a comma-joined sorted names list for given include/exclude arrays.
+caseJ_names() {
+    sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseJ_sub" "$1" "$2" |
+        jq -r '(.names // []) | sort | join(",")'
+}
+
+# (1) include-only: ["grpc"] keeps exactly the 2 grpc nodes.
+caseJ_inc_count="$(caseJ_count '["grpc"]' '[]')"
+caseJ_inc_names="$(caseJ_names '["grpc"]' '[]')"
+if [ "$caseJ_inc_count" = "2" ] && [ "$caseJ_inc_names" = "DE grpc,US grpc" ]; then
+    echo 'fb-caseJ-include-only:OK'
+else
+    echo "fb-caseJ-include-only(count=$caseJ_inc_count names='$caseJ_inc_names'):FAIL"
+fi
+
+# (2) exclude-only: ["ws"] drops the ws node, keeps the other 2.
+caseJ_exc_count="$(caseJ_count '[]' '["ws"]')"
+caseJ_exc_names="$(caseJ_names '[]' '["ws"]')"
+if [ "$caseJ_exc_count" = "2" ] && [ "$caseJ_exc_names" = "DE grpc,US grpc" ]; then
+    echo 'fb-caseJ-exclude-only:OK'
+else
+    echo "fb-caseJ-exclude-only(count=$caseJ_exc_count names='$caseJ_exc_names'):FAIL"
+fi
+
+# (3) include + exclude OR: include=["US"], exclude=["ws"] => "US grpc" only.
+caseJ_both_count="$(caseJ_count '["US"]' '["ws"]')"
+caseJ_both_names="$(caseJ_names '["US"]' '["ws"]')"
+if [ "$caseJ_both_count" = "1" ] && [ "$caseJ_both_names" = "US grpc" ]; then
+    echo 'fb-caseJ-include-exclude:OK'
+else
+    echo "fb-caseJ-include-exclude(count=$caseJ_both_count names='$caseJ_both_names'):FAIL"
+fi
+
+# (4) case-insensitive ASCII: include=["GRPC"] matches "US grpc"/"DE grpc".
+caseJ_ci_count="$(caseJ_count '["GRPC"]' '[]')"
+if [ "$caseJ_ci_count" = "2" ]; then
+    echo 'fb-caseJ-ascii-ci:OK'
+else
+    echo "fb-caseJ-ascii-ci(count=$caseJ_ci_count):FAIL"
+fi
+
+# (5) emoji/unicode substring: a robot-emoji node kept, a plain node dropped.
+caseJ_emoji_sub="/tmp/netshift-fb-caseJ-emoji-$$.json"
+cat > "$caseJ_emoji_sub" << 'JEMOJI'
+{
+  "outbounds": [
+    {"type": "shadowsocks", "tag": "🤖 Gemini", "server": "a.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "Plain Node", "server": "b.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"}
+  ]
+}
+JEMOJI
+caseJ_emoji_count="$(sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseJ_emoji_sub" '["🤖"]' '[]' | jq -r '.count // -1')"
+caseJ_emoji_names="$(sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseJ_emoji_sub" '["🤖"]' '[]' | jq -r '(.names // []) | join(",")')"
+if [ "$caseJ_emoji_count" = "1" ] && [ "$caseJ_emoji_names" = "🤖 Gemini" ]; then
+    echo 'fb-caseJ-emoji-substring:OK'
+else
+    echo "fb-caseJ-emoji-substring(count=$caseJ_emoji_count names='$caseJ_emoji_names'):FAIL"
+fi
+rm -f "$caseJ_emoji_sub"
+
+# (6) empty include keeps all; over-strict filter removes everything (count 0).
+caseJ_all_count="$(caseJ_count '[]' '[]')"
+if [ "$caseJ_all_count" = "3" ]; then
+    echo 'fb-caseJ-empty-include-keeps-all:OK'
+else
+    echo "fb-caseJ-empty-include-keeps-all(count=$caseJ_all_count):FAIL"
+fi
+caseJ_none_count="$(caseJ_count '["nomatch-zzz"]' '[]')"
+if [ "$caseJ_none_count" = "0" ]; then
+    echo 'fb-caseJ-filter-removes-all-zero-kept:OK'
+else
+    echo "fb-caseJ-filter-removes-all-zero-kept(count=$caseJ_none_count):FAIL"
+fi
+rm -f "$caseJ_sub"
+
+# ── CASE K: Cyrillic + Ё/ё case-fold (task-010) ─────────────────────
+# The keyword filter must fold ASCII AND Cyrillic (inline ucfold), so a
+# mixed-case Cyrillic keyword matches a mixed-case Cyrillic server name.
+# Emoji keywords still match by exact codepoints; ASCII is unaffected.
+caseK_sub="/tmp/netshift-fb-caseK-$$.json"
+cat > "$caseK_sub" << 'KSUB'
+{
+  "outbounds": [
+    {"type": "shadowsocks", "tag": "🇩🇪 Германия", "server": "a.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "🇵🇱 Польша", "server": "b.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "🇰🇿 Казахстан", "server": "c.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "Орёл", "server": "d.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "shadowsocks", "tag": "US grpc", "server": "e.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"}
+  ]
+}
+KSUB
+
+caseK_count() {
+    sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseK_sub" "$1" "$2" |
+        jq -r '.count // -1'
+}
+caseK_names() {
+    sing_box_cf_prepare_subscription_batch "$caseJ_cfg" "$caseK_sub" "$1" "$2" |
+        jq -r '(.names // []) | join(",")'
+}
+
+# (1) include mixed-case Cyrillic ["ГеРма"] keeps Германия (was 0 before fix).
+caseK_mixed_count="$(caseK_count '["ГеРма"]' '[]')"
+caseK_mixed_names="$(caseK_names '["ГеРма"]' '[]')"
+if [ "$caseK_mixed_count" = "1" ] && [ "$caseK_mixed_names" = "🇩🇪 Германия" ]; then
+    echo 'fb-caseK-cyrillic-mixed-include:OK'
+else
+    echo "fb-caseK-cyrillic-mixed-include(count=$caseK_mixed_count names='$caseK_mixed_names'):FAIL"
+fi
+
+# (2) lower ["германия"] and upper ["ГЕРМАНИЯ"] both keep Германия.
+caseK_lower_count="$(caseK_count '["германия"]' '[]')"
+caseK_upper_count="$(caseK_count '["ГЕРМАНИЯ"]' '[]')"
+if [ "$caseK_lower_count" = "1" ] && [ "$caseK_upper_count" = "1" ]; then
+    echo 'fb-caseK-cyrillic-lower-upper-include:OK'
+else
+    echo "fb-caseK-cyrillic-lower-upper-include(lower=$caseK_lower_count upper=$caseK_upper_count):FAIL"
+fi
+
+# (3) exclude ["польша"] (lower) drops Польша (upper-P name) regardless of case.
+caseK_exc_count="$(caseK_count '[]' '["польша"]')"
+caseK_exc_names="$(caseK_names '[]' '["польша"]')"
+case "$caseK_exc_names" in
+    *Польша*) caseK_exc_has_pl=1 ;;
+    *) caseK_exc_has_pl=0 ;;
+esac
+if [ "$caseK_exc_count" = "4" ] && [ "$caseK_exc_has_pl" = "0" ]; then
+    echo 'fb-caseK-cyrillic-exclude:OK'
+else
+    echo "fb-caseK-cyrillic-exclude(count=$caseK_exc_count names='$caseK_exc_names'):FAIL"
+fi
+
+# (4) Ё/ё fold: name "Орёл" matched by lower "орёл" and upper "ОРЁЛ".
+caseK_yo_lower="$(caseK_count '["орёл"]' '[]')"
+caseK_yo_upper="$(caseK_count '["ОРЁЛ"]' '[]')"
+caseK_yo_names="$(caseK_names '["ОРЁЛ"]' '[]')"
+if [ "$caseK_yo_lower" = "1" ] && [ "$caseK_yo_upper" = "1" ] && [ "$caseK_yo_names" = "Орёл" ]; then
+    echo 'fb-caseK-yo-fold:OK'
+else
+    echo "fb-caseK-yo-fold(lower=$caseK_yo_lower upper=$caseK_yo_upper names='$caseK_yo_names'):FAIL"
+fi
+
+# (5) emoji keyword ["🇰🇿"] keeps Казахстан by exact codepoint match.
+caseK_emoji_count="$(caseK_count '["🇰🇿"]' '[]')"
+caseK_emoji_names="$(caseK_names '["🇰🇿"]' '[]')"
+if [ "$caseK_emoji_count" = "1" ] && [ "$caseK_emoji_names" = "🇰🇿 Казахстан" ]; then
+    echo 'fb-caseK-emoji-flag-include:OK'
+else
+    echo "fb-caseK-emoji-flag-include(count=$caseK_emoji_count names='$caseK_emoji_names'):FAIL"
+fi
+
+# (6) ASCII no regression: include ["GRPC"] still keeps the "US grpc" node.
+caseK_ascii_count="$(caseK_count '["GRPC"]' '[]')"
+caseK_ascii_names="$(caseK_names '["GRPC"]' '[]')"
+if [ "$caseK_ascii_count" = "1" ] && [ "$caseK_ascii_names" = "US grpc" ]; then
+    echo 'fb-caseK-ascii-no-regression:OK'
+else
+    echo "fb-caseK-ascii-no-regression(count=$caseK_ascii_count names='$caseK_ascii_names'):FAIL"
+fi
+rm -f "$caseK_sub"
+
+# ── CASE L: Xray JSON Hysteria2 (protocol "hysteria", version 2) ────
+# Real subscriptions ship Hysteria2 inside the Xray-JSON array as
+# protocol:"hysteria" + streamSettings.network:"hysteria" +
+# hysteriaSettings.{version:2, auth:<password>}; addressing in
+# settings.address/port; TLS in tlsSettings.{serverName, alpn, allowInsecure}.
+# xray_json_to_uri_lines must emit a hysteria2:// URI carrying the auth as
+# userinfo, host:port from settings, and sni/alpn/insecure query params.
+# (Synthetic placeholder values only — nothing from any real subscription.)
+caseL_in="/tmp/netshift-fb-caseL-$$.json"
+cat > "$caseL_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "HY2 node",
+    "outbounds": [
+      {
+        "protocol": "hysteria",
+        "tag": "hy2-tag",
+        "settings": {"address": "hy.example.com", "port": 8443},
+        "streamSettings": {"network": "hysteria", "security": "tls",
+          "tlsSettings": {"serverName": "hy.example.com",
+            "alpn": ["h3"], "allowInsecure": true},
+          "hysteriaSettings": {"version": 2, "auth": "testpass"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+caseL_uris="$(xray_json_to_uri_lines "$caseL_in" 2>/dev/null)"
+# Exactly one URI emitted, and it is a hysteria2:// scheme.
+caseL_n="$(printf '%s\n' "$caseL_uris" | grep -c .)"
+if [ "$caseL_n" = "1" ] && printf '%s\n' "$caseL_uris" | grep -q '^hysteria2://'; then
+    echo 'fb-caseL-hy2-scheme:OK'
+else
+    echo "fb-caseL-hy2-scheme(n=$caseL_n uris='$caseL_uris'):FAIL"
+fi
+# Auth as userinfo, host:port from settings.
+if printf '%s\n' "$caseL_uris" | grep -q '^hysteria2://testpass@hy.example.com:8443'; then
+    echo 'fb-caseL-hy2-auth-host-port:OK'
+else
+    echo "fb-caseL-hy2-auth-host-port(uris='$caseL_uris'):FAIL"
+fi
+# sni + alpn + insecure query params present; NO type= param.
+if printf '%s\n' "$caseL_uris" | grep -q 'sni=hy.example.com' \
+        && printf '%s\n' "$caseL_uris" | grep -q 'alpn=h3' \
+        && printf '%s\n' "$caseL_uris" | grep -q 'insecure=1' \
+        && ! printf '%s\n' "$caseL_uris" | grep -q 'type='; then
+    echo 'fb-caseL-hy2-query-params:OK'
+else
+    echo "fb-caseL-hy2-query-params(uris='$caseL_uris'):FAIL"
+fi
+rm -f "$caseL_in"
+
+# ── CASE M: Hysteria v1 / missing version → skipped, no fatal ───────
+# The facade has no Hysteria v1 parser; the converter must select out any
+# hysteria node whose hysteriaSettings.version is not 2 (and emit nothing),
+# WITHOUT aborting/fatal. A v2 node in the same doc must still be emitted.
+caseM_in="/tmp/netshift-fb-caseM-$$.json"
+cat > "$caseM_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "HY1 + missing + v2",
+    "outbounds": [
+      {
+        "protocol": "hysteria",
+        "tag": "hy1",
+        "settings": {"address": "v1.example.com", "port": 443},
+        "streamSettings": {"network": "hysteria", "security": "tls",
+          "tlsSettings": {"serverName": "v1.example.com"},
+          "hysteriaSettings": {"version": 1, "auth": "testpass"}}
+      },
+      {
+        "protocol": "hysteria",
+        "tag": "hy-noversion",
+        "settings": {"address": "nov.example.com", "port": 443},
+        "streamSettings": {"network": "hysteria", "security": "tls",
+          "tlsSettings": {"serverName": "nov.example.com"},
+          "hysteriaSettings": {"auth": "testpass"}}
+      },
+      {
+        "protocol": "hysteria",
+        "tag": "hy2",
+        "settings": {"address": "v2.example.com", "port": 443},
+        "streamSettings": {"network": "hysteria", "security": "tls",
+          "tlsSettings": {"serverName": "v2.example.com"},
+          "hysteriaSettings": {"version": 2, "auth": "testpass"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+caseM_uris="$(xray_json_to_uri_lines "$caseM_in" 2>/dev/null)"
+caseM_rc=$?
+# Only the v2 node survives; v1 and missing-version are dropped silently.
+caseM_n="$(printf '%s\n' "$caseM_uris" | grep -c .)"
+if [ "$caseM_n" = "1" ] \
+        && printf '%s\n' "$caseM_uris" | grep -q '@v2.example.com:443' \
+        && ! printf '%s\n' "$caseM_uris" | grep -q 'v1.example.com' \
+        && ! printf '%s\n' "$caseM_uris" | grep -q 'nov.example.com'; then
+    echo 'fb-caseM-v1-and-missing-skipped:OK'
+else
+    echo "fb-caseM-v1-and-missing-skipped(rc=$caseM_rc n=$caseM_n uris='$caseM_uris'):FAIL"
+fi
+rm -f "$caseM_in"
+
+# ── CASE N: mixed vless+trojan+ss+hysteria2 each duplicated → dedup ──
+# Four distinct nodes (one per protocol), each repeated across three configs
+# with only the display tag/remarks differing. The existing $conn dedup must
+# collapse them to exactly the four unique connections, first-seen order
+# preserved (vless, trojan, ss, hysteria2).
+caseN_in="/tmp/netshift-fb-caseN-$$.json"
+cat > "$caseN_in" << 'XRAYJSON'
+[
+  {"remarks": "p1", "outbounds": [
+    {"protocol": "vless", "tag": "vl-1", "settings": {"vnext": [{"address": "vl.example.com", "port": 443,
+      "users": [{"id": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ab", "serverName": "vl.example.com", "fingerprint": "firefox"}}},
+    {"protocol": "trojan", "tag": "tj-1", "settings": {"servers": [{"address": "tj.example.com", "port": 8443, "password": "testpass"}]},
+      "streamSettings": {"network": "tcp", "security": "tls", "tlsSettings": {"serverName": "tj.example.com"}}},
+    {"protocol": "shadowsocks", "tag": "ss-1", "settings": {"servers": [{"address": "ss.example.com", "port": 8388, "password": "testpass", "method": "aes-256-gcm"}]},
+      "streamSettings": {"network": "tcp"}},
+    {"protocol": "hysteria", "tag": "hy-1", "settings": {"address": "hy.example.com", "port": 443},
+      "streamSettings": {"network": "hysteria", "security": "tls", "tlsSettings": {"serverName": "hy.example.com"},
+        "hysteriaSettings": {"version": 2, "auth": "testpass"}}}
+  ]},
+  {"remarks": "p2", "outbounds": [
+    {"protocol": "vless", "tag": "vl-2", "settings": {"vnext": [{"address": "vl.example.com", "port": 443,
+      "users": [{"id": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ab", "serverName": "vl.example.com", "fingerprint": "firefox"}}},
+    {"protocol": "trojan", "tag": "tj-2", "settings": {"servers": [{"address": "tj.example.com", "port": 8443, "password": "testpass"}]},
+      "streamSettings": {"network": "tcp", "security": "tls", "tlsSettings": {"serverName": "tj.example.com"}}},
+    {"protocol": "shadowsocks", "tag": "ss-2", "settings": {"servers": [{"address": "ss.example.com", "port": 8388, "password": "testpass", "method": "aes-256-gcm"}]},
+      "streamSettings": {"network": "tcp"}},
+    {"protocol": "hysteria", "tag": "hy-2", "settings": {"address": "hy.example.com", "port": 443},
+      "streamSettings": {"network": "hysteria", "security": "tls", "tlsSettings": {"serverName": "hy.example.com"},
+        "hysteriaSettings": {"version": 2, "auth": "testpass"}}}
+  ]},
+  {"remarks": "p3", "outbounds": [
+    {"protocol": "vless", "tag": "vl-3", "settings": {"vnext": [{"address": "vl.example.com", "port": 443,
+      "users": [{"id": "00000000-0000-0000-0000-000000000000", "flow": "xtls-rprx-vision", "encryption": "none"}]}]},
+      "streamSettings": {"network": "tcp", "security": "reality",
+        "realitySettings": {"publicKey": "PK", "shortId": "ab", "serverName": "vl.example.com", "fingerprint": "firefox"}}},
+    {"protocol": "trojan", "tag": "tj-3", "settings": {"servers": [{"address": "tj.example.com", "port": 8443, "password": "testpass"}]},
+      "streamSettings": {"network": "tcp", "security": "tls", "tlsSettings": {"serverName": "tj.example.com"}}},
+    {"protocol": "shadowsocks", "tag": "ss-3", "settings": {"servers": [{"address": "ss.example.com", "port": 8388, "password": "testpass", "method": "aes-256-gcm"}]},
+      "streamSettings": {"network": "tcp"}},
+    {"protocol": "hysteria", "tag": "hy-3", "settings": {"address": "hy.example.com", "port": 443},
+      "streamSettings": {"network": "hysteria", "security": "tls", "tlsSettings": {"serverName": "hy.example.com"},
+        "hysteriaSettings": {"version": 2, "auth": "testpass"}}}
+  ]}
+]
+XRAYJSON
+caseN_uris="$(xray_json_to_uri_lines "$caseN_in" 2>/dev/null)"
+# 12 raw nodes (4 protocols x 3 profiles) collapse to exactly 4 unique conns.
+caseN_n="$(printf '%s\n' "$caseN_uris" | grep -c .)"
+if [ "$caseN_n" = "4" ]; then
+    echo 'fb-caseN-dedup-count(==4):OK'
+else
+    echo "fb-caseN-dedup-count(==4 got $caseN_n uris='$caseN_uris'):FAIL"
+fi
+# First-seen order preserved: vless, trojan, ss, hysteria2 (scheme prefixes).
+caseN_schemes="$(printf '%s\n' "$caseN_uris" | sed -e 's#://.*##' | tr '\n' ',' )"
+if [ "$caseN_schemes" = "vless,trojan,ss,hysteria2," ]; then
+    echo 'fb-caseN-first-seen-order:OK'
+else
+    echo "fb-caseN-first-seen-order(got '$caseN_schemes'):FAIL"
+fi
+rm -f "$caseN_in"
+
+# ── CASE O: end-to-end Hysteria2 through the facade + sing-box check ─
+# Feed the emitted hysteria2:// URI through normalize_subscription_to_singbox
+# (the real subscription path) and assert a hysteria2 outbound is produced
+# with the expected server/port/password and TLS. Then wrap the produced
+# outbounds into a minimal full sing-box config and assert `sing-box check`
+# passes (whole-chain validation; project-core.md §4).
+caseO_in="/tmp/netshift-fb-caseO-$$.json"
+caseO_out="/tmp/netshift-fb-caseO-out-$$.json"
+cat > "$caseO_in" << 'XRAYJSON'
+[
+  {
+    "remarks": "HY2 e2e",
+    "outbounds": [
+      {
+        "protocol": "hysteria",
+        "tag": "hy2-e2e",
+        "settings": {"address": "e2e.example.com", "port": 8443},
+        "streamSettings": {"network": "hysteria", "security": "tls",
+          "tlsSettings": {"serverName": "e2e.example.com", "alpn": ["h3"]},
+          "hysteriaSettings": {"version": 2, "auth": "testpass"}}
+      }
+    ]
+  }
+]
+XRAYJSON
+if normalize_subscription_to_singbox "$caseO_in" "$caseO_out" "testsub"; then
+    echo 'fb-caseO-rc:OK'
+else
+    echo 'fb-caseO-rc:FAIL'
+fi
+if validate_subscription_file "$caseO_out"; then
+    echo 'fb-caseO-validate:OK'
+else
+    echo 'fb-caseO-validate:FAIL'
+fi
+# Exactly one hysteria2 outbound with the expected server/port/password + sni.
+if jq -e '[.outbounds[] | select(.type == "hysteria2"
+        and .server == "e2e.example.com"
+        and .server_port == 8443
+        and .password == "testpass"
+        and .tls.server_name == "e2e.example.com")] | length == 1' \
+        "$caseO_out" > /dev/null 2>&1; then
+    echo 'fb-caseO-hy2-outbound-fields:OK'
+else
+    echo 'fb-caseO-hy2-outbound-fields:FAIL'
+fi
+# Whole-chain: wrap the produced outbounds into a minimal full config and run
+# the real `sing-box check`. Skipped cleanly if the binary is unavailable.
+if command -v sing-box > /dev/null 2>&1; then
+    caseO_full="/tmp/netshift-fb-caseO-full-$$.json"
+    jq '{log: {level: "error"},
+         inbounds: [],
+         outbounds: (.outbounds + [{type: "direct", tag: "direct-out"}]),
+         route: {}}' "$caseO_out" > "$caseO_full" 2>/dev/null
+    if sing-box -c "$caseO_full" check > /dev/null 2>&1; then
+        echo 'fb-caseO-singbox-check:OK'
+    else
+        echo 'fb-caseO-singbox-check:FAIL'
+    fi
+    rm -f "$caseO_full"
+else
+    echo 'fb-caseO-singbox-check:SKIP'
+fi
+rm -f "$caseO_in" "$caseO_out"
+
+# ── CASE P: gzip subscription body handling (task-046, issue #13) ───
+# All synthetic fixtures (no real node/panel data). The smoke container
+# installs gzip (tests/Dockerfile), so we can build a real gzip body in-test.
+if command -v gzip > /dev/null 2>&1; then
+    # (P1) gzip -> text: gzip a tiny known-good plain body, run the helper,
+    # assert the result is the original plain text (byte-equal).
+    caseP_plain="/tmp/netshift-fb-caseP-plain-$$.txt"
+    caseP_gz="/tmp/netshift-fb-caseP-gz-$$.bin"
+    printf 'vless://33333333-3333-3333-3333-333333333333@example.com:443#P\n' > "$caseP_plain"
+    gzip -c "$caseP_plain" > "$caseP_gz"
+    maybe_gunzip_subscription_file "$caseP_gz"
+    if cmp -s "$caseP_gz" "$caseP_plain"; then
+        echo 'fb-caseP-gzip-to-text:OK'
+    else
+        echo 'fb-caseP-gzip-to-text:FAIL'
+    fi
+    rm -f "$caseP_gz"
+
+    # (P2) non-gzip passthrough: a plain-text body is UNCHANGED (no spurious
+    # gunzip, no corruption).
+    caseP_pt="/tmp/netshift-fb-caseP-pt-$$.txt"
+    caseP_pt_ref="/tmp/netshift-fb-caseP-pt-ref-$$.txt"
+    printf 'just plain text, definitely not gzip\nsecond line\n' > "$caseP_pt"
+    cp "$caseP_pt" "$caseP_pt_ref"
+    maybe_gunzip_subscription_file "$caseP_pt"
+    if cmp -s "$caseP_pt" "$caseP_pt_ref"; then
+        echo 'fb-caseP-text-passthrough:OK'
+    else
+        echo 'fb-caseP-text-passthrough:FAIL'
+    fi
+    rm -f "$caseP_pt" "$caseP_pt_ref" "$caseP_plain"
+
+    # (P3) whole-chain: gzip a small synthetic VALID sing-box JSON, run the
+    # helper, then validate_subscription_file -> must now VALIDATE.
+    caseP_json="/tmp/netshift-fb-caseP-json-$$.json"
+    caseP_jgz="/tmp/netshift-fb-caseP-jgz-$$.bin"
+    cat > "$caseP_json" << 'PJSON'
+{"outbounds":[{"type":"shadowsocks","tag":"P-node","server":"example.com","server_port":443,"method":"aes-256-gcm","password":"p"}]}
+PJSON
+    gzip -c "$caseP_json" > "$caseP_jgz"
+    maybe_gunzip_subscription_file "$caseP_jgz"
+    if validate_subscription_file "$caseP_jgz"; then
+        echo 'fb-caseP-gzip-then-validate:OK'
+    else
+        echo 'fb-caseP-gzip-then-validate:FAIL'
+    fi
+    rm -f "$caseP_json" "$caseP_jgz"
+else
+    echo 'fb-caseP-gzip-to-text:SKIP'
+    echo 'fb-caseP-text-passthrough:SKIP'
+    echo 'fb-caseP-gzip-then-validate:SKIP'
+fi
+
+# ── CASE Q: NUL-byte binary detector (task-046) ─────────────────────
+# A body with an embedded NUL is binary (true); plain text is not (false).
+caseQ_nul="/tmp/netshift-fb-caseQ-nul-$$.bin"
+caseQ_txt="/tmp/netshift-fb-caseQ-txt-$$.txt"
+printf 'abc\000def' > "$caseQ_nul"
+printf 'abcdef\nplain text\n' > "$caseQ_txt"
+if subscription_body_is_binary "$caseQ_nul"; then
+    echo 'fb-caseQ-nul-is-binary:OK'
+else
+    echo 'fb-caseQ-nul-is-binary:FAIL'
+fi
+if subscription_body_is_binary "$caseQ_txt"; then
+    echo 'fb-caseQ-text-not-binary:FAIL'
+else
+    echo 'fb-caseQ-text-not-binary:OK'
+fi
+rm -f "$caseQ_nul" "$caseQ_txt"
+
+echo 'DONE'
+FBEOF
+
+    sed -i "s|LIB_DIR|$lib|g" "$fb"
+
+    ash "$fb" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+
+    rm -f "$fb"
+
+    # ── Multi-URL subscription merge (task-022) ─────────────────────
+    # Exercises the per-URL hashed cache keying + the config-gen merge-file
+    # approach against the REAL facade (live sing-box check bisection). The
+    # cache-path builders / URL-hash / URL-list collector / cache-usable /
+    # mark-unavailable functions are awk-extracted VERBATIM from the live bin so
+    # the test runs shipped code; the merge jq mirrors the inline subscription)
+    # branch program exactly. Tokens use the same name:OK/FAIL convention.
+    printf "\n  ${BOLD}Multi-URL Subscription Merge${NC}\n"
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    if [ ! -r "$bin" ] || [ ! -r "$lib/sing_box_config_facade.sh" ]; then
+        skip "multi-url merge (bin / facade not found)"
+        return
+    fi
+
+    local mu="/tmp/netshift-sub-multiurl-$$.sh"
+    cat > "$mu" << 'MUEOF'
+mkdir -p /usr/lib/netshift
+for f in constants.sh helpers.sh logging.sh sing_box_config_manager.sh sing_box_config_facade.sh; do
+    ln -sf "LIB_DIR/$f" "/usr/lib/netshift/$f"
+done
+. /usr/lib/netshift/constants.sh
+. /usr/lib/netshift/logging.sh
+. /usr/lib/netshift/sing_box_config_facade.sh
+
+# Isolated per-run cache dir for the path builders.
+SUBSCRIPTION_CACHE_FOLDER="/tmp/netshift-mu-cache-$$"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+
+# Quiet logger + redaction stub (functions under test call these).
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+redact_url_for_log() { printf '%s' "redacted"; }
+
+# Stub config_list_foreach to feed the URLs of the "current" section from a
+# global newline list MU_URLS (mimics UCI list iteration; a 1-element list
+# proves the legacy single-option back-compat path).
+config_list_foreach() {
+    # $1=section $2=option $3=callback [extra...]; we only honour subscription_url.
+    # The real LuCI config_list_foreach iterates in the CURRENT shell (no pipe),
+    # so the callback CAN mutate accumulator globals; mirror that with a temp
+    # file + plain `while read` (a pipe would subshell-trap the mutation).
+    [ "$2" = "subscription_url" ] || return 0
+    _clf_tmp="/tmp/netshift-mu-clf-$$"
+    printf '%s\n' "$MU_URLS" > "$_clf_tmp"
+    while IFS= read -r _u || [ -n "$_u" ]; do
+        [ -n "$_u" ] || continue
+        "$3" "$_u"
+    done < "$_clf_tmp"
+    rm -f "$_clf_tmp"
+}
+
+# Extract the shipped functions verbatim (column-0 opener to column-0 '}').
+for fn in get_subscription_url_hash get_subscription_json_path \
+          get_subscription_url_cache_path get_subscription_rejected_cache_path \
+          get_subscription_user_agent_cache_path _collect_subscription_url_handler \
+          get_subscription_urls_for_section reap_legacy_subscription_cache_files \
+          subscription_cache_is_usable section_has_usable_subscription_cache \
+          mark_subscription_outbound_unavailable; do
+    eval "$(awk -v f="$fn" '$0 ~ "^"f"\\(\\) \\{"{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+done
+
+# Globals the extracted functions touch.
+SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+subscription_startup_blocked=0
+
+base_config='{"outbounds":[]}'
+
+# Helper: write a per-URL cache for (section,url) from a JSON body.
+write_feed() {
+    _sec="$1"; _url="$2"; _body="$3"
+    _h="$(get_subscription_url_hash "$_url")"
+    printf '%s' "$_body" > "$(get_subscription_json_path "$_sec" "$_h")"
+    printf '%s' "$_url" > "$(get_subscription_url_cache_path "$_sec" "$_h")"
+}
+
+# Helper: build the merged file exactly like the subscription) branch and run
+# the facade once. Echoes the resulting config to stdout; sets MERGED_COUNT.
+merge_and_add() {
+    _sec="$1"
+    _merged="/tmp/netshift-mu-merged-$$-$_sec.json"
+    printf '%s' '{"outbounds":[]}' > "$_merged"
+    MU_URLS="$2"
+    printf '%s\n' "$MU_URLS" | while IFS= read -r _u; do
+        [ -n "$_u" ] || continue
+        _h="$(get_subscription_url_hash "$_u")"
+        _j="$(get_subscription_json_path "$_sec" "$_h")"
+        subscription_cache_is_usable "$_j" || continue
+        _t="${_merged}.t"
+        jq -c --slurpfile feed "$_j" '
+            .outbounds += [ $feed[0].outbounds[]? | select(
+                .type != "selector" and .type != "urltest" and
+                .type != "direct" and .type != "dns" and .type != "block"
+            ) ]
+        ' "$_merged" > "$_t" 2>/dev/null && mv "$_t" "$_merged"
+    done
+    MERGED_COUNT="$(jq -r '.outbounds | length' "$_merged" 2>/dev/null)"
+}
+
+# ── CASE 1: multi-URL merge — two feeds, distinct node names ──────────
+s1="sec1"
+url1a="https://feed-a.example.com/sub"
+url1b="https://feed-b.example.com/sub"
+write_feed "$s1" "$url1a" '{"outbounds":[
+  {"type":"shadowsocks","tag":"A-Tokyo","server":"a1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"},
+  {"type":"shadowsocks","tag":"A-Osaka","server":"a2.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+write_feed "$s1" "$url1b" '{"outbounds":[
+  {"type":"shadowsocks","tag":"B-Berlin","server":"b1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+s1_urls="$url1a
+$url1b"
+merge_and_add "$s1" "$s1_urls"
+if [ "$MERGED_COUNT" = "3" ]; then
+    echo 'mu-case1-merged-count-3:OK'
+else
+    echo "mu-case1-merged-count-3(got $MERGED_COUNT):FAIL"
+fi
+# Call the facade like the real bin: NO command-substitution (globals must
+# propagate to this shell); read the result from SING_BOX_CF_LAST_CONFIG.
+sing_box_cf_add_subscription_outbounds "$base_config" "$s1" "/tmp/netshift-mu-merged-$$-$s1.json" "[]" "[]" >/dev/null
+out1="$SING_BOX_CF_LAST_CONFIG"
+if printf '%s' "$out1" | jq -e '[.outbounds[] | select(.type=="shadowsocks") | .tag] | (index("A-Tokyo") != null) and (index("A-Osaka") != null) and (index("B-Berlin") != null)' >/dev/null 2>&1; then
+    echo 'mu-case1-both-feeds-present:OK'
+else
+    echo 'mu-case1-both-feeds-present:FAIL'
+fi
+if [ "$(printf '%s' "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" | jq -r 'length' 2>/dev/null)" = "3" ]; then
+    echo 'mu-case1-tags-json-3:OK'
+else
+    echo "mu-case1-tags-json-3(got $(printf '%s' "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" | jq -r 'length' 2>/dev/null)):FAIL"
+fi
+rm -f "/tmp/netshift-mu-merged-$$-$s1.json"
+
+# ── CASE 2: same-named nodes across feeds → dedup -2 suffix ───────────
+s2="sec2"
+url2a="https://feed-a2.example.com/sub"
+url2b="https://feed-b2.example.com/sub"
+write_feed "$s2" "$url2a" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Same Node","server":"c1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+write_feed "$s2" "$url2b" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Same Node","server":"c2.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+s2_urls="$url2a
+$url2b"
+merge_and_add "$s2" "$s2_urls"
+sing_box_cf_add_subscription_outbounds "$base_config" "$s2" "/tmp/netshift-mu-merged-$$-$s2.json" "[]" "[]" >/dev/null
+out2="$SING_BOX_CF_LAST_CONFIG"
+# Two same-named nodes must both survive with distinct deduped tags, and the
+# resulting config must have no duplicate outbound tags (would fail sing-box).
+n2="$(printf '%s' "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" | jq -r 'length' 2>/dev/null)"
+dup2="$(printf '%s' "$out2" | jq -r '[.outbounds[].tag] | (length) - ([.[]] | unique | length)' 2>/dev/null)"
+if [ "$n2" = "2" ] && [ "$dup2" = "0" ]; then
+    echo 'mu-case2-samename-dedup:OK'
+else
+    echo "mu-case2-samename-dedup(n=$n2 dup=$dup2):FAIL"
+fi
+# The facade's dedup appends a numeric suffix to the second same-named node
+# ("Same Node" + "Same Node-1"); assert one base + one suffixed variant survive.
+if printf '%s' "$SUBSCRIPTION_OUTBOUND_TAGS_JSON" | jq -e 'any(.[]; . == "Same Node") and any(.[]; (startswith("Same Node-")))' >/dev/null 2>&1; then
+    echo 'mu-case2-suffix-dedup-present:OK'
+else
+    echo "mu-case2-suffix-dedup-present(tags=$SUBSCRIPTION_OUTBOUND_TAGS_JSON):FAIL"
+fi
+rm -f "/tmp/netshift-mu-merged-$$-$s2.json"
+
+# ── CASE 3: partial failure / best-effort — feed A usable, B invalid ──
+s3="sec3"
+url3a="https://feed-a3.example.com/sub"
+url3b="https://feed-b3.example.com/sub"
+write_feed "$s3" "$url3a" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Good","server":"d1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+# Feed B is structurally invalid (not a sing-box object): NOT cache-usable.
+_h3b="$(get_subscription_url_hash "$url3b")"
+printf '%s' 'this is not json' > "$(get_subscription_json_path "$s3" "$_h3b")"
+printf '%s' "$url3b" > "$(get_subscription_url_cache_path "$s3" "$_h3b")"
+s3_urls="$url3a
+$url3b"
+merge_and_add "$s3" "$s3_urls"
+sing_box_cf_add_subscription_outbounds "$base_config" "$s3" "/tmp/netshift-mu-merged-$$-$s3.json" "[]" "[]" >/dev/null
+out3="$SING_BOX_CF_LAST_CONFIG"
+if [ "$MERGED_COUNT" = "1" ] && [ -n "$SUBSCRIPTION_OUTBOUND_TAGS" ]; then
+    echo 'mu-case3-partial-best-effort:OK'
+else
+    echo "mu-case3-partial-best-effort(count=$MERGED_COUNT tags='$SUBSCRIPTION_OUTBOUND_TAGS'):FAIL"
+fi
+case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+*" $s3 "*) echo 'mu-case3-not-unavailable:FAIL' ;;
+*) echo 'mu-case3-not-unavailable:OK' ;;
+esac
+rm -f "/tmp/netshift-mu-merged-$$-$s3.json"
+
+# ── CASE 4: all feeds fail → section marked unavailable ───────────────
+s4="sec4"
+url4a="https://feed-a4.example.com/sub"
+url4b="https://feed-b4.example.com/sub"
+_h4a="$(get_subscription_url_hash "$url4a")"
+_h4b="$(get_subscription_url_hash "$url4b")"
+printf '%s' 'garbage' > "$(get_subscription_json_path "$s4" "$_h4a")"
+printf '%s' '{"outbounds":[]}' > "$(get_subscription_json_path "$s4" "$_h4b")"
+s4_urls="$url4a
+$url4b"
+merge_and_add "$s4" "$s4_urls"
+subscription_ready=0
+if [ "$MERGED_COUNT" -gt 0 ] 2>/dev/null; then subscription_ready=1; fi
+if [ "$subscription_ready" -eq 0 ]; then
+    MU_URLS="$s4_urls"
+    mark_subscription_outbound_unavailable "$s4" 0
+fi
+case " $SUBSCRIPTION_UNAVAILABLE_SECTIONS " in
+*" $s4 "*) echo 'mu-case4-all-fail-unavailable:OK' ;;
+*) echo "mu-case4-all-fail-unavailable(merged=$MERGED_COUNT list='$SUBSCRIPTION_UNAVAILABLE_SECTIONS'):FAIL" ;;
+esac
+rm -f "/tmp/netshift-mu-merged-$$-$s4.json"
+
+# ── CASE 5: cache-key isolation — distinct files; rejected per-URL ────
+s5="sec5"
+url5a="https://feed-a5.example.com/sub"
+url5b="https://feed-b5.example.com/sub"
+write_feed "$s5" "$url5a" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Iso-A","server":"e1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+write_feed "$s5" "$url5b" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Iso-B","server":"e2.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+_h5a="$(get_subscription_url_hash "$url5a")"
+_h5b="$(get_subscription_url_hash "$url5b")"
+p5a="$(get_subscription_json_path "$s5" "$_h5a")"
+p5b="$(get_subscription_json_path "$s5" "$_h5b")"
+if [ "$_h5a" != "$_h5b" ] && [ "$p5a" != "$p5b" ] && [ -s "$p5a" ] && [ -s "$p5b" ]; then
+    echo 'mu-case5-distinct-cache-files:OK'
+else
+    echo "mu-case5-distinct-cache-files(ha=$_h5a hb=$_h5b):FAIL"
+fi
+# Poison URL-A's rejected hash with its own body hash → A vetoed, B untouched.
+md5sum "$p5a" | awk '{print $1}' > "$(get_subscription_rejected_cache_path "$s5" "$_h5a")"
+# Force the rejected-veto path: a body with no proxy outbound + matching hash.
+# (subscription_cache_is_usable returns 0 for a body WITH proxies regardless of
+# rejected, so prove isolation via the rejected FILE targeting, not the veto.)
+ra="$(get_subscription_rejected_cache_path "$s5" "$_h5a")"
+rb="$(get_subscription_rejected_cache_path "$s5" "$_h5b")"
+if [ -s "$ra" ] && [ ! -e "$rb" ]; then
+    echo 'mu-case5-rejected-per-url-isolated:OK'
+else
+    echo 'mu-case5-rejected-per-url-isolated:FAIL'
+fi
+
+# ── CASE 6: back-compat — single (1-element) URL list works ───────────
+s6="sec6"
+url6="https://feed-legacy.example.com/sub"
+write_feed "$s6" "$url6" '{"outbounds":[
+  {"type":"shadowsocks","tag":"Legacy","server":"f1.example.com","server_port":443,"method":"aes-256-gcm","password":"p"}
+]}'
+# A lone option reads as a 1-element list.
+MU_URLS="$url6"
+collected6="$(get_subscription_urls_for_section "$s6")"
+if [ "$collected6" = "$url6" ]; then
+    echo 'mu-case6-single-option-1elem:OK'
+else
+    echo "mu-case6-single-option-1elem(got '$collected6'):FAIL"
+fi
+merge_and_add "$s6" "$url6"
+sing_box_cf_add_subscription_outbounds "$base_config" "$s6" "/tmp/netshift-mu-merged-$$-$s6.json" "[]" "[]" >/dev/null
+out6="$SING_BOX_CF_LAST_CONFIG"
+if [ "$MERGED_COUNT" = "1" ] && printf '%s' "$out6" | jq -e 'any(.outbounds[]; .tag=="Legacy")' >/dev/null 2>&1; then
+    echo 'mu-case6-backcompat-config:OK'
+else
+    echo "mu-case6-backcompat-config(count=$MERGED_COUNT):FAIL"
+fi
+rm -f "/tmp/netshift-mu-merged-$$-$s6.json"
+
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+echo 'DONE'
+MUEOF
+
+    sed -i "s|LIB_DIR|$lib|g; s|BIN_PATH|$bin|g" "$mu"
+
+    sh "$mu" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+
+    rm -f "$mu"
+
+    # ── Clear-subscription-cache worker (task-039) ───────────────────
+    # Exercises subscription_clear_cache_and_redownload (bin/netshift) which
+    # backs `component_action subscription clear_cache`. The worker is
+    # awk-extracted VERBATIM from the shipped bin; subscription_update is STUBBED
+    # to a no-op so the test is hermetic (no network/restart). The driver is
+    # parsed in the CURRENT shell (`while read < "$out"`, NO pipe) so the
+    # assertions get EXACT state — and we verify both the guarded deletion and
+    # the JSON shape the async status layer consumes.
+    printf "\n  ${BOLD}Clear Subscription Cache${NC}\n"
+
+    local ccbin="${NETSHIFT_SRC}/usr/bin/netshift"
+    local ccupd="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$ccbin" ] || [ ! -r "$ccupd" ]; then
+        skip "clear-cache worker (bin / updater.sh not found)"
+        return
+    fi
+
+    local cc="/tmp/netshift-sub-clearcache-$$.sh"
+    cat > "$cc" << 'CCEOF'
+# Isolated synthetic cache dir — NEVER the real /etc/netshift/subscriptions.
+SUBSCRIPTION_CACHE_FOLDER="/tmp/netshift-cc-cache-$$"
+
+# Quiet logger; record subscription_update invocation count + control its rc.
+SUB_UPDATE_CALLS=0
+SUB_UPDATE_RC=0
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+# Hermetic no-op stub for the redownload+restart path (verbatim reuse is what
+# the production worker does; here we only assert the worker CALLS it).
+subscription_update() { SUB_UPDATE_CALLS=$((SUB_UPDATE_CALLS + 1)); return "$SUB_UPDATE_RC"; }
+
+# config_foreach / config_get stubs driven by the CC_SECTIONS table:
+#   CC_SECTIONS = newline list of "<section>|<connection_type>|<proxy_config_type>"
+config_foreach() {
+    # $1=callback $2=type ; iterate sections in the CURRENT shell (no pipe) so
+    # the callback can mutate accumulator globals like has_subscription.
+    _cf_tmp="/tmp/netshift-cc-cf-$$"
+    printf '%s\n' "$CC_SECTIONS" > "$_cf_tmp"
+    while IFS= read -r _row || [ -n "$_row" ]; do
+        [ -n "$_row" ] || continue
+        CC_CUR_SECTION="${_row%%|*}"
+        _rest="${_row#*|}"
+        CC_CUR_CT="${_rest%%|*}"
+        CC_CUR_PCT="${_rest##*|}"
+        "$1" "$CC_CUR_SECTION"
+    done < "$_cf_tmp"
+    rm -f "$_cf_tmp"
+}
+config_get() {
+    # $1=varname $2=section $3=option [default]
+    case "$3" in
+        connection_type) eval "$1=\"\$CC_CUR_CT\"" ;;
+        proxy_config_type) eval "$1=\"\$CC_CUR_PCT\"" ;;
+        *) eval "$1=\"\${4:-}\"" ;;
+    esac
+}
+
+# Extract the worker VERBATIM from the shipped bin (column-0 opener → column-0 '}').
+eval "$(awk '/^subscription_clear_cache_and_redownload\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+
+# Seed helper: write the four per-feed sidecars for a synthetic (section,hash).
+seed_feed() {
+    _s="$1"; _h="$2"
+    printf 'json'  > "$SUBSCRIPTION_CACHE_FOLDER/${_s}.${_h}.json"
+    printf 'url'   > "$SUBSCRIPTION_CACHE_FOLDER/${_s}.${_h}.url"
+    printf 'rej'   > "$SUBSCRIPTION_CACHE_FOLDER/${_s}.${_h}.rejected"
+    printf 'ua'    > "$SUBSCRIPTION_CACHE_FOLDER/${_s}.${_h}.user_agent"
+}
+
+# ── CASE 1: ≥2 feeds seeded, sections configured → all files deleted, dir
+#            preserved, subscription_update called, JSON success:true ───────
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+seed_feed "sec1" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+seed_feed "sec1" "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+seed_feed "sec2" "cccccccccccccccccccccccccccccccc"
+before_count=$(ls -1 "$SUBSCRIPTION_CACHE_FOLDER" 2>/dev/null | wc -l)
+CC_SECTIONS="sec1|proxy|subscription
+sec2|proxy|subscription"
+SUB_UPDATE_CALLS=0
+SUB_UPDATE_RC=0
+# Run WITHOUT $()-capture so SUB_UPDATE_CALLS (set by the stub) survives — a
+# $() subshell would trap the mutation (the documented capture landmine).
+cc1_out="/tmp/netshift-cc-json1-$$"
+subscription_clear_cache_and_redownload > "$cc1_out"
+cc1_rc=$?
+cc1_json="$(cat "$cc1_out")"
+rm -f "$cc1_out"
+after_count=$(ls -1 "$SUBSCRIPTION_CACHE_FOLDER" 2>/dev/null | wc -l)
+if [ "$before_count" -ge 8 ] && [ "$after_count" -eq 0 ]; then
+    echo "cc-case1-all-deleted(before=$before_count after=$after_count):OK"
+else
+    echo "cc-case1-all-deleted(before=$before_count after=$after_count):FAIL"
+fi
+if [ -d "$SUBSCRIPTION_CACHE_FOLDER" ]; then
+    echo 'cc-case1-dir-preserved:OK'
+else
+    echo 'cc-case1-dir-preserved:FAIL'
+fi
+if printf '%s' "$cc1_json" | jq -e '.success == true' >/dev/null 2>&1; then
+    echo 'cc-case1-json-success-true:OK'
+else
+    echo "cc-case1-json-success-true(got '$cc1_json'):FAIL"
+fi
+if [ "$SUB_UPDATE_CALLS" -eq 1 ] && [ "$cc1_rc" -eq 0 ]; then
+    echo 'cc-case1-redownload-invoked:OK'
+else
+    echo "cc-case1-redownload-invoked(calls=$SUB_UPDATE_CALLS rc=$cc1_rc):FAIL"
+fi
+
+# ── CASE 2: empty cache dir → graceful success:true ──────────────────
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+CC_SECTIONS="sec1|proxy|subscription"
+SUB_UPDATE_CALLS=0
+cc2_json="$(subscription_clear_cache_and_redownload)"
+if printf '%s' "$cc2_json" | jq -e '.success == true' >/dev/null 2>&1; then
+    echo 'cc-case2-empty-dir-success:OK'
+else
+    echo "cc-case2-empty-dir-success(got '$cc2_json'):FAIL"
+fi
+
+# ── CASE 2b: missing cache dir → graceful success:true, no error ─────
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+CC_SECTIONS="sec1|proxy|subscription"
+cc2b_json="$(subscription_clear_cache_and_redownload 2>/dev/null)"
+if printf '%s' "$cc2b_json" | jq -e '.success == true' >/dev/null 2>&1; then
+    echo 'cc-case2b-missing-dir-success:OK'
+else
+    echo "cc-case2b-missing-dir-success(got '$cc2b_json'):FAIL"
+fi
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+
+# ── CASE 3: no subscription sections → graceful success:true, no redownload ─
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+seed_feed "sec1" "dddddddddddddddddddddddddddddddd"
+CC_SECTIONS="sec1|proxy|url"
+SUB_UPDATE_CALLS=0
+cc3_out="/tmp/netshift-cc-json3-$$"
+subscription_clear_cache_and_redownload > "$cc3_out"
+cc3_json="$(cat "$cc3_out")"
+rm -f "$cc3_out"
+cc3_after=$(ls -1 "$SUBSCRIPTION_CACHE_FOLDER" 2>/dev/null | wc -l)
+if printf '%s' "$cc3_json" | jq -e '.success == true' >/dev/null 2>&1 \
+   && [ "$SUB_UPDATE_CALLS" -eq 0 ] && [ "$cc3_after" -eq 0 ]; then
+    echo 'cc-case3-no-subs-graceful:OK'
+else
+    echo "cc-case3-no-subs-graceful(calls=$SUB_UPDATE_CALLS after=$cc3_after json='$cc3_json'):FAIL"
+fi
+
+# ── CASE 4: redownload failure → success:false, message surfaced ─────
+rm -rf "$SUBSCRIPTION_CACHE_FOLDER"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+seed_feed "sec1" "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+CC_SECTIONS="sec1|proxy|subscription"
+SUB_UPDATE_RC=1
+cc4_json="$(subscription_clear_cache_and_redownload)"
+SUB_UPDATE_RC=0
+if printf '%s' "$cc4_json" | jq -e '.success == false and (.message | length > 0)' >/dev/null 2>&1; then
+    echo 'cc-case4-redownload-fail-surfaced:OK'
+else
+    echo "cc-case4-redownload-fail-surfaced(got '$cc4_json'):FAIL"
+fi
+
+# ── CASE 5: guarded delete — empty constant can NEVER `rm -f /*` ─────
+# Structural proof: the worker only deletes when the constant is non-empty AND
+# the dir exists. Point the constant at a guarded sentinel tree and confirm an
+# UNRELATED file outside SUBSCRIPTION_CACHE_FOLDER survives, and that an empty
+# constant is a no-op (guard short-circuits before any glob).
+guard_root="/tmp/netshift-cc-guard-$$"
+rm -rf "$guard_root"
+mkdir -p "$guard_root/sub" "$guard_root/other"
+printf 'keep' > "$guard_root/other/sentinel"
+printf 'wipe' > "$guard_root/sub/feed.json"
+SUBSCRIPTION_CACHE_FOLDER="$guard_root/sub"
+CC_SECTIONS="sec1|proxy|subscription"
+subscription_clear_cache_and_redownload >/dev/null 2>&1
+if [ -f "$guard_root/other/sentinel" ] && [ ! -f "$guard_root/sub/feed.json" ] \
+   && [ -d "$guard_root/sub" ]; then
+    echo 'cc-case5-guard-scoped-to-cache-dir:OK'
+else
+    echo 'cc-case5-guard-scoped-to-cache-dir:FAIL'
+fi
+# Empty constant → guard short-circuits, sentinel still alive, no error.
+SUBSCRIPTION_CACHE_FOLDER=""
+CC_SECTIONS="sec1|proxy|subscription"
+subscription_clear_cache_and_redownload >/dev/null 2>&1
+if [ -f "$guard_root/other/sentinel" ]; then
+    echo 'cc-case5-empty-constant-noop:OK'
+else
+    echo 'cc-case5-empty-constant-noop:FAIL'
+fi
+rm -rf "$guard_root"
+
+# ── CASE 6: router dispatch — `component_action subscription clear_cache`
+#            reaches the worker (also the path the async fork uses) ──────────
+# Source the SHIPPED updater.sh component_action(); the worker is already defined
+# above, so the arm must dispatch to it. Re-point the cache dir + a fresh stub
+# that records the call so we prove the arm reached our worker.
+ROUTER_HIT=0
+subscription_clear_cache_and_redownload() {
+    ROUTER_HIT=1
+    echo '{"success":true,"message":"router-hit"}'
+    return 0
+}
+# Silence updater.sh's own logger if it defines one after sourcing.
+eval "$(awk '/^component_action\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "UPD_PATH")"
+# No $()-capture (would subshell-trap ROUTER_HIT); write JSON to a file.
+router_out="/tmp/netshift-cc-router-$$"
+component_action subscription clear_cache > "$router_out"
+router_json="$(cat "$router_out")"
+rm -f "$router_out"
+if [ "$ROUTER_HIT" -eq 1 ] && printf '%s' "$router_json" | jq -e '.success == true' >/dev/null 2>&1; then
+    echo 'cc-case6-router-dispatch:OK'
+else
+    echo "cc-case6-router-dispatch(hit=$ROUTER_HIT json='$router_json'):FAIL"
+fi
+
+rm -rf "/tmp/netshift-cc-cache-$$"
+echo 'DONE'
+CCEOF
+
+    sed -i "s|BIN_PATH|$ccbin|g; s|UPD_PATH|$ccupd|g" "$cc"
+
+    local cc_out="/tmp/netshift-cc-out-$$"
+    sh "$cc" > "$cc_out" 2>/dev/null
+    while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done < "$cc_out"
+
+    rm -f "$cc" "$cc_out"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Insecure subscription fetch flag (task-021b)
+#
+# Exercises download_subscription's 8th positional arg (insecure 0|1). A
+# PATH-prepended fake `wget` records its full argv to a log and writes a dummy
+# body to its -O target (so the FIRST attempt succeeds → no retry/fallback).
+# A driver sources the REAL helpers.sh (real download_subscription +
+# _wget_subscription_request), stubs the metadata/logging helpers, and pins
+# should_force_wget_ipv4 per scenario to drive the normal vs ipv4 branch. We
+# assert --no-check-certificate is ABSENT when insecure=0 and PRESENT when
+# insecure=1, across the normal and proxy branches (plus the ipv4 branch).
+# Tokens use the same name:OK/FAIL convention as test_subscription.
+# ─────────────────────────────────────────────────────────────────
+test_insecure_fetch() {
+    header "Insecure Subscription Fetch Flag (task-021b)"
+
+    local helpers="${NETSHIFT_LIB_DIR}/helpers.sh"
+    if [ ! -r "$helpers" ]; then
+        skip "helpers.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-insecure-$$"
+    rm -rf "$work"
+    mkdir -p "$work/bin"
+
+    # Fake wget: append the FULL argv to $WGET_ARGV_LOG (one line, NUL-free),
+    # then satisfy download_subscription's success check by writing a non-empty
+    # body to whatever follows -O. Always exit 0 so the first attempt wins.
+    cat > "$work/bin/wget" << 'WGETEOF'
+#!/bin/sh
+# Record argv as a single space-joined line for substring assertions.
+printf '%s\n' "$*" >> "$WGET_ARGV_LOG"
+# Find the -O target and write a dummy body there.
+out=""
+prev=""
+for a in "$@"; do
+    [ "$prev" = "-O" ] && { out="$a"; break; }
+    prev="$a"
+done
+[ -n "$out" ] && printf 'dummy-body' > "$out"
+exit 0
+WGETEOF
+    chmod 0755 "$work/bin/wget"
+
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'IFEOF'
+# Quiet logging + deterministic metadata stubs (no real device probing).
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+get_sing_box_version() { echo "1.12.0"; }
+get_device_model() { echo "test-model"; }
+get_kernel_version() { echo "test-kernel"; }
+generate_hwid() { echo "test-hwid"; }
+get_subscription_user_agent() { echo "singbox/test"; }
+
+# Real download_subscription + _wget_subscription_request from helpers.sh.
+. "HELPERS_PATH"
+
+# Scenario knobs: $1 = branch (normal|ipv4), rest of the call is fixed.
+case "$1" in
+ipv4)   should_force_wget_ipv4() { return 0; } ;;
+*)      should_force_wget_ipv4() { return 1; } ;;
+esac
+# IPv4 fallback retry helpers — keep them inert so a success on attempt 1 is
+# unambiguous (the fake wget always succeeds anyway).
+has_ipv4_default_route() { return 1; }
+wget_supports_ipv4_flag() { return 1; }
+
+branch="$1"
+proxy="$2"
+insecure="$3"
+out="$WGET_OUT_FILE"
+rm -f "$out"
+: > "$WGET_ARGV_LOG"
+
+# url, tmpfile, proxy, retries=1, wait=0, timeout=5, user_agent, insecure
+download_subscription "https://1.2.3.4:2096/sub/abc" "$out" "$proxy" 1 0 5 "singbox/test" "$insecure"
+echo "DONE"
+IFEOF
+    sed -i "s|HELPERS_PATH|$helpers|g" "$drv"
+
+    export WGET_ARGV_LOG="$work/wget.argv"
+    export WGET_OUT_FILE="$work/sub.json"
+
+    # Helper: run one scenario, return the recorded argv on stdout.
+    _if_run() {
+        : > "$WGET_ARGV_LOG"
+        PATH="$work/bin:$PATH" ash "$drv" "$1" "$2" "$3" > /dev/null 2>&1
+        cat "$WGET_ARGV_LOG" 2>/dev/null
+    }
+
+    local argv
+
+    # ── normal branch, insecure=0 → NO --no-check-certificate ──
+    argv="$(_if_run normal "" 0)"
+    case "$argv" in
+        *--no-check-certificate*) fail "if-normal-off: flag present (should be absent): $argv" ;;
+        *) pass "if-normal-off: no --no-check-certificate (secure default)" ;;
+    esac
+
+    # ── normal branch, insecure=1 → HAS --no-check-certificate ──
+    argv="$(_if_run normal "" 1)"
+    case "$argv" in
+        *--no-check-certificate*) pass "if-normal-on: --no-check-certificate present" ;;
+        *) fail "if-normal-on: flag missing (should be present): $argv" ;;
+    esac
+
+    # ── proxy branch, insecure=0 → NO --no-check-certificate ──
+    argv="$(_if_run normal "127.0.0.1:4534" 0)"
+    case "$argv" in
+        *--no-check-certificate*) fail "if-proxy-off: flag present (should be absent): $argv" ;;
+        *) pass "if-proxy-off: no --no-check-certificate (secure default)" ;;
+    esac
+
+    # ── proxy branch, insecure=1 → HAS --no-check-certificate ──
+    argv="$(_if_run normal "127.0.0.1:4534" 1)"
+    case "$argv" in
+        *--no-check-certificate*) pass "if-proxy-on: --no-check-certificate present" ;;
+        *) fail "if-proxy-on: flag missing (should be present): $argv" ;;
+    esac
+
+    # ── ipv4 branch, insecure=1 → HAS both -4 and --no-check-certificate ──
+    argv="$(_if_run ipv4 "" 1)"
+    case "$argv" in
+        *--no-check-certificate*)
+            case "$argv" in
+                *-4*) pass "if-ipv4-on: -4 and --no-check-certificate both present" ;;
+                *) fail "if-ipv4-on: -4 missing: $argv" ;;
+            esac
+            ;;
+        *) fail "if-ipv4-on: flag missing (should be present): $argv" ;;
+    esac
+
+    # ── ipv4 branch, insecure=0 → -4 present, NO --no-check-certificate ──
+    argv="$(_if_run ipv4 "" 0)"
+    case "$argv" in
+        *--no-check-certificate*) fail "if-ipv4-off: flag present (should be absent): $argv" ;;
+        *) pass "if-ipv4-off: no --no-check-certificate (secure default)" ;;
+    esac
+
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Async component-action job state (updater.sh)
+# ─────────────────────────────────────────────────────────────────
+# Exercises the jq job-state machinery from updater.sh with a STUBBED worker
+# (no network, no real download). A tiny stub CLI sources the real updater.sh,
+# provides a trivial `log`, and lets the `component_action` worker be controlled
+# by env vars (STUB_JSON / STUB_SLEEP / STUB_RC). component_action_async forks
+# `"$0" component_action ...`, so $0 must be the stub CLI itself — hence the
+# separate executable. All assertions are jq-validated; tokens are parsed with
+# the same name:OK/FAIL convention as test_subscription.
+test_jobstate() {
+    header "Async Component-Action Job State (updater.sh)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local stub="/tmp/netshift-jobstub-$$"
+    cat > "$stub" << 'STUBEOF'
+#!/bin/sh
+# Minimal stand-in for /usr/bin/netshift that exposes the async job-state API.
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+# Isolate state under a per-process tmpfs dir so parallel/old runs never clash.
+UPDATES_JOB_DIR="${JOBSTUB_DIR:-/tmp/netshift-jobstub-state}"
+
+. "UPDATER_PATH"
+
+# Re-pin after sourcing (the source sets its own default).
+UPDATES_JOB_DIR="${JOBSTUB_DIR:-/tmp/netshift-jobstub-state}"
+
+case "$1" in
+component_action)
+    # Stubbed worker: emit a (possibly delayed) JSON object then exit STUB_RC.
+    [ -n "$STUB_SLEEP" ] && sleep "$STUB_SLEEP"
+    if [ -z "$STUB_JSON" ]; then
+        STUB_JSON='{"success":true,"version":"1.0.0-extended"}'
+    fi
+    printf '%s\n' "$STUB_JSON"
+    exit "${STUB_RC:-0}"
+    ;;
+component_action_async)
+    component_action_async "$2" "$3"
+    ;;
+component_action_status)
+    component_action_status "$2"
+    ;;
+esac
+STUBEOF
+    sed -i "s|UPDATER_PATH|$updater|g" "$stub"
+    chmod 0755 "$stub"
+
+    local jdir="/tmp/netshift-jobstate-$$"
+    rm -rf "$jdir"
+
+    # ── 1. async returns {success:true, job_id} fast; running state appears ──
+    local start_async end_async elapsed async_json job_id
+    start_async="$(date +%s)"
+    async_json="$(JOBSTUB_DIR="$jdir" STUB_SLEEP=2 STUB_JSON='{"success":true,"version":"1.7.0-extended"}' \
+        "$stub" component_action_async sing_box install_extended)"
+    end_async="$(date +%s)"
+    elapsed=$((end_async - start_async))
+
+    if echo "$async_json" | jq -e '.success == true and (.job_id | length) > 0' > /dev/null 2>&1; then
+        pass "async returns success+job_id ($async_json)"
+    else
+        fail "async did not return success+job_id" "$async_json"
+    fi
+    if [ "$elapsed" -lt 5 ]; then
+        pass "async returned fast (${elapsed}s, well under 30s)"
+    else
+        fail "async too slow: ${elapsed}s"
+    fi
+
+    job_id="$(echo "$async_json" | jq -r '.job_id')"
+    if [ -f "$jdir/$job_id.json" ]; then
+        pass "running state file created"
+    else
+        fail "running state file missing: $jdir/$job_id.json"
+    fi
+    # While the stub sleeps, the state must read running:true / success:true.
+    if jq -e '.running == true and .success == true and .exit_code == null' \
+            "$jdir/$job_id.json" > /dev/null 2>&1; then
+        pass "running state has running:true,success:true,exit_code:null"
+    else
+        fail "running state shape wrong" "$(cat "$jdir/$job_id.json" 2>/dev/null)"
+    fi
+    # The recorded pid must be a live integer while running.
+    local running_pid
+    running_pid="$(jq -r '.pid' "$jdir/$job_id.json" 2>/dev/null)"
+    case "$running_pid" in
+        '' | *[!0-9]*) fail "running pid not an integer: '$running_pid'" ;;
+        *) pass "running pid recorded ($running_pid)" ;;
+    esac
+
+    # ── 2. after the worker finishes, status reports the surfaced outcome ────
+    # Wait for the background worker (stub sleeps 2s) to complete.
+    local waited=0
+    while [ "$waited" -lt 15 ]; do
+        if jq -e '.running == false' "$jdir/$job_id.json" > /dev/null 2>&1; then
+            break
+        fi
+        sleep 1
+        waited=$((waited + 1))
+    done
+
+    local status_json
+    status_json="$(JOBSTUB_DIR="$jdir" "$stub" component_action_status "$job_id")"
+    if echo "$status_json" | jq -e '.running == false and .success == true and .exit_code == 0 and .version == "1.7.0-extended"' > /dev/null 2>&1; then
+        pass "finished status surfaces success/version/exit_code"
+    else
+        fail "finished status wrong" "$status_json"
+    fi
+
+    # ── 2b. a failing worker is recorded (success:false, non-zero exit) ──────
+    local fail_json fail_id fail_status
+    fail_json="$(JOBSTUB_DIR="$jdir" STUB_RC=3 STUB_JSON='{"success":false,"message":"boom"}' \
+        "$stub" component_action_async sing_box install_extended)"
+    fail_id="$(echo "$fail_json" | jq -r '.job_id')"
+    waited=0
+    while [ "$waited" -lt 15 ]; do
+        if jq -e '.running == false' "$jdir/$fail_id.json" > /dev/null 2>&1; then
+            break
+        fi
+        sleep 1
+        waited=$((waited + 1))
+    done
+    fail_status="$(JOBSTUB_DIR="$jdir" "$stub" component_action_status "$fail_id")"
+    if echo "$fail_status" | jq -e '.running == false and .success == false and .exit_code == 3 and .message == "boom"' > /dev/null 2>&1; then
+        pass "failed worker recorded (success:false, exit_code:3, message surfaced)"
+    else
+        fail "failed worker status wrong" "$fail_status"
+    fi
+
+    # ── 2c. worker stdout polluted with log lines: last JSON object wins ─────
+    local noisy_json noisy_id noisy_status
+    noisy_json="$(JOBSTUB_DIR="$jdir" \
+        STUB_JSON='Updater: some log line
+another stray line {not-json}
+{"success":true,"version":"9.9.9-extended"}' \
+        "$stub" component_action_async sing_box install_extended)"
+    noisy_id="$(echo "$noisy_json" | jq -r '.job_id')"
+    waited=0
+    while [ "$waited" -lt 15 ]; do
+        if jq -e '.running == false' "$jdir/$noisy_id.json" > /dev/null 2>&1; then
+            break
+        fi
+        sleep 1
+        waited=$((waited + 1))
+    done
+    noisy_status="$(JOBSTUB_DIR="$jdir" "$stub" component_action_status "$noisy_id")"
+    if echo "$noisy_status" | jq -e '.running == false and .success == true and .version == "9.9.9-extended"' > /dev/null 2>&1; then
+        pass "finished parser extracts the LAST well-formed JSON object from noisy stdout"
+    else
+        fail "noisy-stdout parse wrong" "$noisy_status"
+    fi
+
+    # ── 3. invalid / traversal job ids are rejected safely ──────────────────
+    local bad bad_json bad_rc bad_out="/tmp/netshift-jobstate-bad-$$"
+    for bad in "../foo" "../../etc/passwd" "foo/bar" "a b" "" "."; do
+        bad_rc=0
+        JOBSTUB_DIR="$jdir" "$stub" component_action_status "$bad" > "$bad_out" 2>/dev/null || bad_rc=$?
+        bad_json="$(cat "$bad_out" 2>/dev/null)"
+        if [ "$bad_rc" -ne 0 ] \
+                && echo "$bad_json" | jq -e '.success == false and .running == false' > /dev/null 2>&1; then
+            pass "invalid job_id rejected safely: '$bad'"
+        else
+            fail "invalid job_id NOT rejected: '$bad'" "rc=$bad_rc json=$bad_json"
+        fi
+    done
+    rm -f "$bad_out"
+    # The validator must never resolve a traversal id to a path.
+    local fb_jobstate="/tmp/netshift-jobstate-validate-$$.sh"
+    cat > "$fb_jobstate" << 'VEOF'
+log() { :; }
+UPDATES_JOB_DIR="VDIR"
+. "UPDATER_PATH"
+UPDATES_JOB_DIR="VDIR"
+if updates_job_state_path "../foo" >/dev/null 2>&1; then
+    echo 'jobstate-traversal-rejected:FAIL'
+else
+    echo 'jobstate-traversal-rejected:OK'
+fi
+if updates_job_state_path "good-1.2_3" >/dev/null 2>&1; then
+    echo 'jobstate-valid-id-accepted:OK'
+else
+    echo 'jobstate-valid-id-accepted:FAIL'
+fi
+VEOF
+    sed -i "s|UPDATER_PATH|$updater|g;s|VDIR|$jdir|g" "$fb_jobstate"
+    ash "$fb_jobstate" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+        esac
+    done
+    rm -f "$fb_jobstate"
+
+    # ── 4. stale job: running:true with a dead pid past grace → finished ─────
+    local stale_dir="$jdir/stale"
+    mkdir -p "$stale_dir"
+    local stale_state="$stale_dir/staletest.json"
+    local stale_sh="/tmp/netshift-jobstate-stale-$$.sh"
+    cat > "$stale_sh" << 'SEOF'
+log() { :; }
+UPDATES_JOB_DIR="SDIR"
+. "UPDATER_PATH"
+UPDATES_JOB_DIR="SDIR"
+state="SSTATE"
+# Pick a pid that is certainly dead, and a started_at far in the past so we are
+# well beyond the stale grace window.
+dead_pid=999999
+while kill -0 "$dead_pid" 2>/dev/null; do
+    dead_pid=$((dead_pid + 1))
+done
+old_started=$(( $(date +%s) - 3600 ))
+jq -nc --argjson pid "$dead_pid" --argjson started "$old_started" \
+    '{success:true,running:true,component:"sing_box",action:"install_extended",
+      message:"Component action is running",pid:$pid,started_at:$started,
+      updated_at:$started,exit_code:null,version:"",latest_version:""}' > "$state"
+updates_refresh_running_job_state "$state"
+if jq -e '.running == false and .success == false' "$state" >/dev/null 2>&1; then
+    echo 'jobstate-stale-marked-finished:OK'
+else
+    echo 'jobstate-stale-marked-finished:FAIL'
+fi
+SEOF
+    sed -i "s|UPDATER_PATH|$updater|g;s|SDIR|$stale_dir|g;s|SSTATE|$stale_state|g" "$stale_sh"
+    ash "$stale_sh" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+        esac
+    done
+    rm -f "$stale_sh"
+
+    rm -rf "$jdir" "$stub"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Core-switch connectivity self-heal + rollback (updater.sh, task-009)
+#
+# Fully mocked — no real network, no real package install, no real binary
+# touched. A generated driver sources updater.sh, points RESOLV_CONF and the
+# tmpfs backup at test files, stubs dig/nslookup/curl/opkg/apk and a fake
+# /etc/init.d/netshift via a PATH-prepended bin dir + a writable init stub, and
+# drives each scenario via env flags. The driver emits `name:OK`/`name:FAIL`
+# tokens which the case parser turns into pass/fail.
+# ─────────────────────────────────────────────────────────────────
+test_selfheal() {
+    header "Core-switch Connectivity Self-Heal + Rollback (updater.sh)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-selfheal-$$"
+    rm -rf "$work"
+    mkdir -p "$work/bin" "$work/init"
+
+    # ── Command stubs (PATH-prepended). Behaviour is driven by env files so the
+    # driver can flip them between scenarios without rewriting the stubs. ──────
+    #
+    # DNS/HTTPS probes: a stub "succeeds" only when its marker file is present.
+    cat > "$work/bin/dig" << 'DIGEOF'
+#!/bin/sh
+# Echo an address (so the resolver-detect grep matches) only if allowed.
+[ -f "$SELFHEAL_DNS_OK" ] && { echo "1.2.3.4"; exit 0; }
+exit 1
+DIGEOF
+    cat > "$work/bin/nslookup" << 'NSEOF'
+#!/bin/sh
+[ -f "$SELFHEAL_DNS_OK" ] && { echo "Address 1.2.3.4"; exit 0; }
+exit 1
+NSEOF
+    cat > "$work/bin/curl" << 'CURLEOF'
+#!/bin/sh
+# Reachability probe (-I/HEAD). Succeed only when the marker is present.
+[ -f "$SELFHEAL_HTTP_OK" ] && exit 0
+exit 1
+CURLEOF
+    # opkg/apk stubs: package "install" succeeds or fails per marker, and on a
+    # "successful" stable install they flip the installed core to non-extended.
+    cat > "$work/bin/opkg" << 'OPKGEOF'
+#!/bin/sh
+case "$1" in
+update) exit 0 ;;
+install)
+    if [ -f "$SELFHEAL_PKG_OK" ]; then
+        printf 'stable-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+        exit 0
+    fi
+    # Simulate a package failure that ALSO removed the live binary (the brick
+    # scenario): blow away the mock binary so the rollback must restore it.
+    rm -f "$SELFHEAL_BIN" 2>/dev/null
+    exit 1
+    ;;
+esac
+exit 0
+OPKGEOF
+    chmod 0755 "$work/bin/dig" "$work/bin/nslookup" "$work/bin/curl" "$work/bin/opkg"
+
+    # Fake /etc/init.d/netshift: records each invocation (stop/start/restart) to
+    # a log so the driver can assert teardown/bring-up happened.
+    cat > "$work/init/netshift" << 'INITEOF'
+#!/bin/sh
+printf '%s\n' "$1" >> "$SELFHEAL_INIT_LOG"
+exit 0
+INITEOF
+    chmod 0755 "$work/init/netshift"
+
+    # ── Driver: sources updater, overrides paths/helpers, runs one scenario. ──
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+updates_log() { :; }
+RESOLV_CONF="DRV_RESOLV"
+UPDATES_RESOLV_BACKUP="DRV_BACKUP"
+UPDATES_FEED_PROBE_HOST="feeds.test"
+UPDATES_GITHUB_PROBE_HOST="github.test"
+UPDATES_HEAL_RESOLVERS="1.1.1.1 9.9.9.9"
+UPDATES_SING_BOX_BIN="$SELFHEAL_BIN"
+UPDATES_LIBCRONET_LIB="DRV_CRONET"
+. "DRV_UPDATER"
+# Re-pin after sourcing (the source sets its own defaults).
+RESOLV_CONF="DRV_RESOLV"
+UPDATES_RESOLV_BACKUP="DRV_BACKUP"
+UPDATES_FEED_PROBE_HOST="feeds.test"
+UPDATES_GITHUB_PROBE_HOST="github.test"
+UPDATES_HEAL_RESOLVERS="1.1.1.1 9.9.9.9"
+UPDATES_SING_BOX_BIN="$SELFHEAL_BIN"
+UPDATES_LIBCRONET_LIB="DRV_CRONET"
+
+# Mocked helpers used by the stable core (normally from helpers.sh).
+get_sing_box_version() { cat "$SELFHEAL_CORE_VERSION" 2>/dev/null; }
+is_sing_box_extended() {
+    case "${1:-$(get_sing_box_version)}" in
+    *extended*) return 0 ;;
+    *) return 1 ;;
+    esac
+}
+# Make the post-install restart a no-op probe (the fake init records it anyway).
+updates_restart_netshift() { /etc/init.d/netshift restart >/dev/null 2>&1 || true; }
+
+case "$1" in
+run_stable)  updates_install_sing_box_stable ;;
+esac
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_RESOLV|$work/resolv.conf|g;s|DRV_BACKUP|$work/resolv.bak|g;s|DRV_CRONET|$work/libcronet.so|g" "$drv"
+
+    # Common per-run wiring: PATH-prepended stubs + fake init under /etc/init.d.
+    # We back up any real /etc/init.d/netshift and restore it at the end.
+    local init_target="/etc/init.d/netshift"
+    local init_saved=""
+    if [ -e "$init_target" ]; then
+        init_saved="$work/netshift.realinit"
+        cp -p "$init_target" "$init_saved" 2>/dev/null || init_saved=""
+    fi
+    mkdir -p /etc/init.d 2>/dev/null || true
+    cp -p "$work/init/netshift" "$init_target" 2>/dev/null
+    chmod 0755 "$init_target" 2>/dev/null || true
+
+    # Marker/state files shared with the stubs via env.
+    export SELFHEAL_DNS_OK="$work/dns_ok"
+    export SELFHEAL_HTTP_OK="$work/http_ok"
+    export SELFHEAL_PKG_OK="$work/pkg_ok"
+    export SELFHEAL_INIT_LOG="$work/init.log"
+    export SELFHEAL_CORE_VERSION="$work/core.version"
+    export SELFHEAL_BIN="$work/usr-bin-sing-box"
+
+    local out="$work/out.json"
+
+    run_scenario() {
+        # The worker returns non-zero on recoverable failures (success:false);
+        # under `set -e` that would abort the suite, so swallow the rc here — the
+        # assertions read the JSON + file state, not the exit code.
+        rm -f "$work/init.log"
+        PATH="$work/bin:$PATH" ash "$drv" run_stable > "$out" 2>/dev/null || true
+    }
+
+    # ── Scenario 1: pre-flight passes → install proceeds, no teardown ─────────
+    : > "$SELFHEAL_DNS_OK"; : > "$SELFHEAL_HTTP_OK"; : > "$SELFHEAL_PKG_OK"
+    printf 'extended-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    : > "$work/usr-bin-sing-box"
+    run_scenario
+    if jq -e '.success == true' "$out" > /dev/null 2>&1; then
+        pass "selfheal-preflight-pass-proceeds:OK"
+    else
+        fail "selfheal-preflight-pass-proceeds:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    if [ ! -f "$work/init.log" ] || ! grep -q 'stop' "$work/init.log"; then
+        pass "selfheal-preflight-pass-no-teardown:OK"
+    else
+        fail "selfheal-preflight-pass-no-teardown:FAIL" "init.log=$(cat "$work/init.log" 2>/dev/null)"
+    fi
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfheal-preflight-pass-resolv-untouched:OK"
+    else
+        fail "selfheal-preflight-pass-resolv-untouched:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+
+    # ── Scenario 2: pre-flight fails → DNS heal succeeds → resolv restored ────
+    # DNS fails first, but once the temp resolver is written DNS+HTTP pass. We
+    # model "temp resolver fixes DNS" by making the DNS probe key off the temp
+    # resolver content: the stub succeeds only when the marker exists, and the
+    # heal writes the marker via a wrapper. Simpler: DNS off initially, but the
+    # heal's resolv write triggers a hook that flips DNS on. We emulate that by
+    # having the temp-resolver write observed through resolv.conf content.
+    rm -f "$SELFHEAL_DNS_OK"; : > "$SELFHEAL_HTTP_OK"; : > "$SELFHEAL_PKG_OK"
+    printf 'extended-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    : > "$work/usr-bin-sing-box"
+    # dig stub variant for scenario 2: DNS resolves only once resolv.conf holds
+    # the temp resolver (i.e. after the heal wrote it).
+    cat > "$work/bin/dig" << 'DIG2EOF'
+#!/bin/sh
+grep -q '1.1.1.1' "DRV_RESOLV2" 2>/dev/null && { echo "1.2.3.4"; exit 0; }
+exit 1
+DIG2EOF
+    sed -i "s|DRV_RESOLV2|$work/resolv.conf|g" "$work/bin/dig"
+    chmod 0755 "$work/bin/dig"
+    run_scenario
+    if jq -e '.success == true' "$out" > /dev/null 2>&1; then
+        pass "selfheal-dns-heal-proceeds:OK"
+    else
+        fail "selfheal-dns-heal-proceeds:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # Epilogue must have restored the ORIGINAL resolv.conf.
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfheal-dns-heal-resolv-restored:OK"
+    else
+        fail "selfheal-dns-heal-resolv-restored:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+    # DNS heal alone was enough → redirect should NOT have been torn down.
+    if [ ! -f "$work/init.log" ] || ! grep -q 'stop' "$work/init.log"; then
+        pass "selfheal-dns-heal-no-teardown:OK"
+    else
+        fail "selfheal-dns-heal-no-teardown:FAIL" "init.log=$(cat "$work/init.log" 2>/dev/null)"
+    fi
+
+    # ── Scenario 3: DNS heal insufficient → redirect teardown heals ───────────
+    # DNS resolves even with the temp resolver, but HTTP only comes up AFTER the
+    # redirect is torn down (the fake init writes a marker on stop that flips
+    # HTTP on).
+    rm -f "$SELFHEAL_DNS_OK"; rm -f "$SELFHEAL_HTTP_OK"; : > "$SELFHEAL_PKG_OK"
+    printf 'extended-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    : > "$work/usr-bin-sing-box"
+    # DNS resolves only with temp resolver present (as scenario 2).
+    # HTTP succeeds only after init stop has been recorded.
+    cat > "$work/bin/curl" << 'CURL3EOF'
+#!/bin/sh
+grep -q 'stop' "$SELFHEAL_INIT_LOG" 2>/dev/null && exit 0
+exit 1
+CURL3EOF
+    chmod 0755 "$work/bin/curl"
+    run_scenario
+    if jq -e '.success == true' "$out" > /dev/null 2>&1; then
+        pass "selfheal-teardown-heal-proceeds:OK"
+    else
+        fail "selfheal-teardown-heal-proceeds:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    if grep -q 'stop' "$work/init.log" 2>/dev/null; then
+        pass "selfheal-teardown-taken:OK"
+    else
+        fail "selfheal-teardown-taken:FAIL" "init.log=$(cat "$work/init.log" 2>/dev/null)"
+    fi
+    if grep -q 'start' "$work/init.log" 2>/dev/null; then
+        pass "selfheal-teardown-bringup-called:OK"
+    else
+        fail "selfheal-teardown-bringup-called:FAIL" "init.log=$(cat "$work/init.log" 2>/dev/null)"
+    fi
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfheal-teardown-resolv-restored:OK"
+    else
+        fail "selfheal-teardown-resolv-restored:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+
+    # ── Scenario 4: heal fails entirely → install ABORTED, binary not removed ─
+    rm -f "$SELFHEAL_DNS_OK"; rm -f "$SELFHEAL_HTTP_OK"; : > "$SELFHEAL_PKG_OK"
+    printf 'extended-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    : > "$work/usr-bin-sing-box"
+    # DNS never resolves; HTTP never reachable even after teardown.
+    cat > "$work/bin/dig" << 'DIG4EOF'
+#!/bin/sh
+exit 1
+DIG4EOF
+    cat > "$work/bin/curl" << 'CURL4EOF'
+#!/bin/sh
+exit 1
+CURL4EOF
+    chmod 0755 "$work/bin/dig" "$work/bin/curl"
+    run_scenario
+    if jq -e '.success == false and (.message | length) > 0' "$out" > /dev/null 2>&1; then
+        pass "selfheal-heal-fail-aborts-successfalse:OK"
+    else
+        fail "selfheal-heal-fail-aborts-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # The (mock) binary must NOT have been removed (opkg install never ran).
+    if [ -e "$work/usr-bin-sing-box" ]; then
+        pass "selfheal-heal-fail-binary-intact:OK"
+    else
+        fail "selfheal-heal-fail-binary-intact:FAIL" "mock binary was removed"
+    fi
+    # Original resolv.conf restored by the epilogue.
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfheal-heal-fail-resolv-restored:OK"
+    else
+        fail "selfheal-heal-fail-resolv-restored:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+    # Redirect was torn down during the (failed) heal → epilogue brings it back.
+    if grep -q 'start' "$work/init.log" 2>/dev/null; then
+        pass "selfheal-heal-fail-bringup-called:OK"
+    else
+        fail "selfheal-heal-fail-bringup-called:FAIL" "init.log=$(cat "$work/init.log" 2>/dev/null)"
+    fi
+
+    # ── Scenario 5: stable install fails after binary removed → backup restored
+    : > "$SELFHEAL_DNS_OK"; : > "$SELFHEAL_HTTP_OK"; rm -f "$SELFHEAL_PKG_OK"
+    printf 'extended-1.12.0\n' > "$SELFHEAL_CORE_VERSION"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    printf 'EXTENDED-CORE-BYTES\n' > "$work/usr-bin-sing-box"
+    # Connectivity is fine; dig/curl just check the markers.
+    cat > "$work/bin/dig" << 'DIG5EOF'
+#!/bin/sh
+[ -f "$SELFHEAL_DNS_OK" ] && { echo "1.2.3.4"; exit 0; }
+exit 1
+DIG5EOF
+    cat > "$work/bin/curl" << 'CURL5EOF'
+#!/bin/sh
+[ -f "$SELFHEAL_HTTP_OK" ] && exit 0
+exit 1
+CURL5EOF
+    chmod 0755 "$work/bin/dig" "$work/bin/curl"
+    run_scenario
+    if jq -e '.success == false' "$out" > /dev/null 2>&1; then
+        pass "selfheal-stable-install-fail-successfalse:OK"
+    else
+        fail "selfheal-stable-install-fail-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # The opkg stub removed the live binary; the tmpfs backup must be restored
+    # so a working binary remains with the ORIGINAL extended bytes.
+    if [ -e "$work/usr-bin-sing-box" ] && \
+            [ "$(cat "$work/usr-bin-sing-box" 2>/dev/null)" = "EXTENDED-CORE-BYTES" ]; then
+        pass "selfheal-stable-install-fail-backup-restored:OK"
+    else
+        fail "selfheal-stable-install-fail-backup-restored:FAIL" "$(cat "$work/usr-bin-sing-box" 2>/dev/null)"
+    fi
+
+    # ── Restore the real init script (if any) and clean up. ──────────────────
+    if [ -n "$init_saved" ] && [ -e "$init_saved" ]; then
+        cp -p "$init_saved" "$init_target" 2>/dev/null || true
+    else
+        rm -f "$init_target" 2>/dev/null || true
+    fi
+    unset SELFHEAL_DNS_OK SELFHEAL_HTTP_OK SELFHEAL_PKG_OK SELFHEAL_INIT_LOG \
+        SELFHEAL_CORE_VERSION SELFHEAL_BIN
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Subscription rejected-hash validity (task-011)
+# ─────────────────────────────────────────────────────────────────
+# Verifies the keyword-filter no longer poisons the per-section .rejected hash
+# and that a structurally valid body with >=1 proxy outbound is never vetoed by
+# a stale rejected-hash, while a genuinely outbound-less body still is. The two
+# functions under test (mark_subscription_outbound_unavailable,
+# subscription_cache_is_usable) live in /usr/bin/netshift, not a sourceable lib,
+# so a tiny driver extracts JUST those two functions verbatim from the live bin
+# (awk between the `name() {` line and the matching column-0 `}`), stubs the few
+# helpers they call (log + the path builders), sources helpers.sh for the real
+# validate_subscription_file, and re-pins SUBSCRIPTION_CACHE_FOLDER to a temp
+# dir. Tokens use the same name:OK/FAIL convention as test_subscription.
+test_rejected_hash() {
+    header "Subscription Rejected-Hash Validity (task-011)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    local helpers="${NETSHIFT_LIB_DIR}/helpers.sh"
+    if [ ! -r "$bin" ] || [ ! -r "$helpers" ]; then
+        skip "netshift bin / helpers.sh not found"
+        return
+    fi
+
+    local drv="/tmp/netshift-rejected-$$.sh"
+    cat > "$drv" << 'RHEOF'
+# Isolated cache dir for this run (the path builders read SUBSCRIPTION_CACHE_FOLDER).
+SUBSCRIPTION_CACHE_FOLDER="${RH_CACHE_DIR:-/tmp/netshift-rejected-cache}"
+mkdir -p "$SUBSCRIPTION_CACHE_FOLDER"
+
+# Quiet stubs for the logger used by the functions under test.
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+
+# Path builders are tiny; stub them exactly like the bin so the functions
+# resolve the temp cache dir.
+get_subscription_json_path() { echo "$SUBSCRIPTION_CACHE_FOLDER/${1}.json"; }
+get_subscription_rejected_cache_path() { echo "$SUBSCRIPTION_CACHE_FOLDER/${1}.rejected"; }
+
+# Real validate_subscription_file from helpers.sh (no other deps needed).
+. "HELPERS_PATH"
+
+# Pull the two functions under test VERBATIM out of the live bin so the test
+# exercises the shipped code, not a copy. awk grabs from the function opener to
+# its matching column-0 closing brace.
+eval "$(awk '/^mark_subscription_outbound_unavailable\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+eval "$(awk '/^subscription_cache_is_usable\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+
+# Globals the functions touch.
+SUBSCRIPTION_UNAVAILABLE_SECTIONS=""
+subscription_startup_blocked=0
+
+valid_body='{
+  "outbounds": [
+    {"type": "shadowsocks", "tag": "ss-01", "server": "a.example.com", "server_port": 443, "method": "aes-256-gcm", "password": "p"},
+    {"type": "selector", "tag": "select", "outbounds": ["ss-01"]}
+  ]
+}'
+
+# ── CASE 1: A — over-strict keyword filter (kept=0) must NOT write .rejected,
+#            and must remove a pre-existing one. ─────────────────────────────
+s1="sec1"
+printf '%s' "$valid_body" > "$(get_subscription_json_path "$s1")"
+# Pre-poison with this body's hash; arg=1 (keyword filter) must clear it.
+md5sum "$(get_subscription_json_path "$s1")" | awk '{print $1}' \
+    > "$(get_subscription_rejected_cache_path "$s1")"
+mark_subscription_outbound_unavailable "$s1" 1
+if [ ! -e "$(get_subscription_rejected_cache_path "$s1")" ]; then
+    echo 'rh-case1-filter-no-rejected:OK'
+else
+    echo 'rh-case1-filter-no-rejected:FAIL'
+fi
+if [ "$subscription_startup_blocked" = "1" ]; then
+    echo 'rh-case1-blocked-state-set:OK'
+else
+    echo 'rh-case1-blocked-state-set:FAIL'
+fi
+
+# ── CASE 2: A-recovery — pre-existing .rejected == a valid body hash, call with
+#            arg=1, assert .rejected gone (self-heal). ────────────────────────
+s2="sec2"
+printf '%s' "$valid_body" > "$(get_subscription_json_path "$s2")"
+md5sum "$(get_subscription_json_path "$s2")" | awk '{print $1}' \
+    > "$(get_subscription_rejected_cache_path "$s2")"
+[ -s "$(get_subscription_rejected_cache_path "$s2")" ] && pre2=1 || pre2=0
+mark_subscription_outbound_unavailable "$s2" 1
+if [ "$pre2" = "1" ] && [ ! -e "$(get_subscription_rejected_cache_path "$s2")" ]; then
+    echo 'rh-case2-recovery-rejected-removed:OK'
+else
+    echo 'rh-case2-recovery-rejected-removed:FAIL'
+fi
+
+# ── CASE 3: B — valid body with >=1 proxy outbound + .rejected == its hash ⇒
+#            subscription_cache_is_usable returns 0 (usable). ─────────────────
+s3="sec3"
+s3_json="$(get_subscription_json_path "$s3")"
+printf '%s' "$valid_body" > "$s3_json"
+md5sum "$s3_json" | awk '{print $1}' > "$(get_subscription_rejected_cache_path "$s3")"
+if subscription_cache_is_usable "$s3_json"; then
+    echo 'rh-case3-valid-body-not-vetoed:OK'
+else
+    echo 'rh-case3-valid-body-not-vetoed:FAIL'
+fi
+
+# ── CASE 4: A-protected — a JSON body with ZERO proxy outbounds whose hash is in
+#            .rejected ⇒ still vetoed (return 1). validate_subscription_file
+#            itself requires >=1 proxy outbound, so an outbound-less body is
+#            rejected at validation; this case proves the guard still holds. ──
+s4="sec4"
+s4_json="$(get_subscription_json_path "$s4")"
+cat > "$s4_json" << 'NOPROXY'
+{
+  "outbounds": [
+    {"type": "selector", "tag": "select", "outbounds": []},
+    {"type": "direct", "tag": "direct"},
+    {"type": "block", "tag": "block"}
+  ]
+}
+NOPROXY
+md5sum "$s4_json" | awk '{print $1}' > "$(get_subscription_rejected_cache_path "$s4")"
+if subscription_cache_is_usable "$s4_json"; then
+    echo 'rh-case4-no-proxy-body-vetoed:FAIL'
+else
+    echo 'rh-case4-no-proxy-body-vetoed:OK'
+fi
+
+# ── CASE 5: Regression — a normal valid body, no .rejected ⇒ usable (0). ──────
+s5="sec5"
+s5_json="$(get_subscription_json_path "$s5")"
+printf '%s' "$valid_body" > "$s5_json"
+rm -f "$(get_subscription_rejected_cache_path "$s5")"
+if subscription_cache_is_usable "$s5_json"; then
+    echo 'rh-case5-normal-valid-usable:OK'
+else
+    echo 'rh-case5-normal-valid-usable:FAIL'
+fi
+
+# ── CASE 6: A — keyword_filter_active=0 (default) still records the rejected
+#            hash for a genuinely outbound-less body (flash-loop guard kept). ──
+s6="sec6"
+s6_json="$(get_subscription_json_path "$s6")"
+cat > "$s6_json" << 'NOPROXY'
+{
+  "outbounds": [
+    {"type": "direct", "tag": "direct"},
+    {"type": "block", "tag": "block"}
+  ]
+}
+NOPROXY
+rm -f "$(get_subscription_rejected_cache_path "$s6")"
+mark_subscription_outbound_unavailable "$s6" 0
+expect6="$(md5sum "$s6_json" | awk '{print $1}')"
+got6="$(cat "$(get_subscription_rejected_cache_path "$s6")" 2>/dev/null)"
+if [ -s "$(get_subscription_rejected_cache_path "$s6")" ] && [ "$got6" = "$expect6" ]; then
+    echo 'rh-case6-genuine-unusable-recorded:OK'
+else
+    echo 'rh-case6-genuine-unusable-recorded:FAIL'
+fi
+
+echo 'DONE'
+RHEOF
+
+    sed -i "s|HELPERS_PATH|$helpers|g; s|BIN_PATH|$bin|g" "$drv"
+
+    local rhcache="/tmp/netshift-rejected-cache-$$"
+    rm -rf "$rhcache"
+
+    RH_CACHE_DIR="$rhcache" ash "$drv" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+
+    rm -rf "$rhcache"
+    rm -f "$drv"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: DNS via outbound (task-014) — detour wiring + fail-safe cascade
+# ─────────────────────────────────────────────────────────────────
+test_dns_via_outbound() {
+    header "DNS via Outbound (task-014)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local facade_lib="${NETSHIFT_LIB_DIR}/sing_box_config_facade.sh"
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    if [ ! -r "$facade_lib" ] || [ ! -r "$bin" ]; then
+        skip "facade lib / netshift bin not found"
+        return
+    fi
+
+    # Bind bind-mounted sources to the runtime path the facade hardcodes.
+    mkdir -p /usr/lib/netshift
+    ln -sf "${NETSHIFT_LIB_DIR}/helpers.sh" /usr/lib/netshift/helpers.sh
+    ln -sf "${NETSHIFT_LIB_DIR}/sing_box_config_manager.sh" /usr/lib/netshift/sing_box_config_manager.sh
+
+    local drv="/tmp/netshift-dnsdetour-$$.sh"
+    cat > "$drv" << 'DDEOF'
+. "NETSHIFT_LIB/logging.sh" 2>/dev/null || log() { :; }
+. "FACADE_LIB_PATH"
+
+# Minimal DNS skeleton like sing_box_cm_configure_dns produces.
+base_config='{"dns":{"servers":[],"rules":[],"final":"dns-server","strategy":"prefer_ipv4","independent_cache":true},"outbounds":[{"type":"direct","tag":"direct-out"}]}'
+
+# Tags mirror the constants used in production.
+BOOT="bootstrap"
+MAIN="dns-server"
+FAKE="fakeip"
+DETOUR_TAG="main-out"
+
+# ── Build a config WITH a non-empty detour on the MAIN DNS only. ─────────────
+cfg_on="$base_config"
+cfg_on=$(sing_box_cm_add_udp_dns_server "$cfg_on" "$BOOT" "77.88.8.8" 53)
+cfg_on=$(sing_box_cf_add_dns_server "$cfg_on" "udp" "$MAIN" "1.1.1.1" "" "$DETOUR_TAG")
+cfg_on=$(sing_box_cm_add_fakeip_dns_server "$cfg_on" "$FAKE" "198.18.0.0/15")
+
+echo "$cfg_on" | jq -e --arg t "$MAIN" --arg d "$DETOUR_TAG" \
+    '(.dns.servers[] | select(.tag==$t) | .detour) == $d' >/dev/null 2>&1 \
+    && echo 'dns-on-main-has-detour:OK' || echo 'dns-on-main-has-detour:FAIL'
+echo "$cfg_on" | jq -e --arg t "$BOOT" \
+    '(.dns.servers[] | select(.tag==$t) | has("detour")) == false' >/dev/null 2>&1 \
+    && echo 'dns-on-bootstrap-no-detour:OK' || echo 'dns-on-bootstrap-no-detour:FAIL'
+echo "$cfg_on" | jq -e --arg t "$FAKE" \
+    '(.dns.servers[] | select(.tag==$t) | has("detour")) == false' >/dev/null 2>&1 \
+    && echo 'dns-on-fakeip-no-detour:OK' || echo 'dns-on-fakeip-no-detour:FAIL'
+
+# ── Build a config with an EMPTY detour (feature off) — no .detour key. ──────
+cfg_off="$base_config"
+cfg_off=$(sing_box_cm_add_udp_dns_server "$cfg_off" "$BOOT" "77.88.8.8" 53)
+cfg_off=$(sing_box_cf_add_dns_server "$cfg_off" "udp" "$MAIN" "1.1.1.1" "" "")
+cfg_off=$(sing_box_cm_add_fakeip_dns_server "$cfg_off" "$FAKE" "198.18.0.0/15")
+
+echo "$cfg_off" | jq -e --arg t "$MAIN" \
+    '(.dns.servers[] | select(.tag==$t) | has("detour")) == false' >/dev/null 2>&1 \
+    && echo 'dns-off-main-no-detour:OK' || echo 'dns-off-main-no-detour:FAIL'
+
+# Byte-parity: the main DNS server object with empty tag must equal the object
+# built without passing a detour arg at all.
+cfg_legacy="$base_config"
+cfg_legacy=$(sing_box_cf_add_dns_server "$cfg_legacy" "udp" "$MAIN" "1.1.1.1" "")
+legacy_obj=$(echo "$cfg_legacy" | jq -cS --arg t "$MAIN" '.dns.servers[] | select(.tag==$t)')
+off_obj=$(echo "$cfg_off" | jq -cS --arg t "$MAIN" '.dns.servers[] | select(.tag==$t)')
+if [ "$legacy_obj" = "$off_obj" ]; then
+    echo 'dns-off-byte-parity:OK'
+else
+    echo 'dns-off-byte-parity:FAIL'
+fi
+
+# ── Both configs must pass sing-box check (whole-chain validation). ──────────
+if command -v sing-box > /dev/null 2>&1; then
+    echo "$cfg_on" > /tmp/dnsdetour-on.json
+    echo "$cfg_off" > /tmp/dnsdetour-off.json
+    sing-box -c /tmp/dnsdetour-on.json check >/dev/null 2>&1 \
+        && echo 'dns-on-singbox-check:OK' || echo 'dns-on-singbox-check:FAIL'
+    sing-box -c /tmp/dnsdetour-off.json check >/dev/null 2>&1 \
+        && echo 'dns-off-singbox-check:OK' || echo 'dns-off-singbox-check:FAIL'
+    rm -f /tmp/dnsdetour-on.json /tmp/dnsdetour-off.json
+else
+    echo 'dns-on-singbox-check:SKIP'
+    echo 'dns-off-singbox-check:SKIP'
+fi
+
+# ── Fail-safe cascade: exercise _get_dns_detour_tag VERBATIM from the bin. ───
+# Stub UCI + the reused helpers so the cascade is fully controllable. The stubs
+# read from shell variables set per-case below.
+eval "$(awk '/^_get_dns_detour_tag\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "BIN_PATH")"
+
+# UCI stubs (mimic LuCI config_get / config_get_bool: assign-and-return-0).
+config_get_bool() { eval "$1=\"\${UCI_DNS_VIA_OUTBOUND:-0}\""; return 0; }
+config_get() {
+    case "$3" in
+    dns_outbound_section) eval "$1=\"\$UCI_DNS_SECTION\"" ;;
+    connection_type) eval "$1=\"\$(_stub_conn_type \"$2\")\"" ;;
+    *) eval "$1=\"\"" ;;
+    esac
+    return 0
+}
+_stub_conn_type() {
+    case "$1" in
+    block-sec) echo "block" ;;
+    excl-sec) echo "exclusion" ;;
+    "") echo "" ;;
+    *) echo "proxy" ;;
+    esac
+}
+# section_has_configured_outbound: true unless name contains 'noout'.
+section_has_configured_outbound() {
+    case "$1" in
+    *noout*|"") return 1 ;;
+    esac
+    return 0
+}
+get_first_outbound_section() { echo "$STUB_FIRST_SECTION"; }
+get_outbound_tag_by_section() { echo "$1-out"; }
+subscription_outbound_is_unavailable() {
+    case " $STUB_UNAVAILABLE " in *" $1 "*) return 0 ;; esac
+    return 1
+}
+
+# CASE off: feature disabled -> empty.
+UCI_DNS_VIA_OUTBOUND=0; UCI_DNS_SECTION="main"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ -z "$r" ] && echo 'cascade-off-empty:OK' || echo 'cascade-off-empty:FAIL'
+
+# CASE explicit-valid: enabled + valid explicit section -> its tag.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION="vpn1"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ "$r" = "vpn1-out" ] && echo 'cascade-explicit-valid:OK' || echo 'cascade-explicit-valid:FAIL'
+
+# CASE invalid->first: explicit section has no configured outbound -> first.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION="noout-sec"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ "$r" = "main-out" ] && echo 'cascade-invalid-to-first:OK' || echo 'cascade-invalid-to-first:FAIL'
+
+# CASE empty-selector->first: no explicit section -> first.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION=""; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ "$r" = "main-out" ] && echo 'cascade-empty-to-first:OK' || echo 'cascade-empty-to-first:FAIL'
+
+# CASE no-outbound->direct: enabled but no outbound section at all -> empty.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION=""; STUB_FIRST_SECTION=""; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ -z "$r" ] && echo 'cascade-no-outbound-direct:OK' || echo 'cascade-no-outbound-direct:FAIL'
+
+# CASE block->direct: explicit block section -> empty.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION="block-sec"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ -z "$r" ] && echo 'cascade-block-direct:OK' || echo 'cascade-block-direct:FAIL'
+
+# CASE exclusion->direct: explicit exclusion section -> empty.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION="excl-sec"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE=""
+r=$(_get_dns_detour_tag)
+[ -z "$r" ] && echo 'cascade-exclusion-direct:OK' || echo 'cascade-exclusion-direct:FAIL'
+
+# CASE subscription-unavailable->direct: candidate present but outbound not built.
+UCI_DNS_VIA_OUTBOUND=1; UCI_DNS_SECTION="sub1"; STUB_FIRST_SECTION="main"; STUB_UNAVAILABLE="sub1"
+r=$(_get_dns_detour_tag)
+[ -z "$r" ] && echo 'cascade-subscription-unavailable-direct:OK' || echo 'cascade-subscription-unavailable-direct:FAIL'
+
+echo 'DONE'
+DDEOF
+    sed -i "s|FACADE_LIB_PATH|$facade_lib|; s|NETSHIFT_LIB|$NETSHIFT_LIB_DIR|g; s|BIN_PATH|$bin|g" "$drv"
+
+    ash "$drv" 2>/dev/null | while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "$line" ;;
+            *:FAIL) fail "$line" ;;
+            *:SKIP) skip "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done
+    rm -f "$drv"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: scalar `option subscription_url` read-fallback + option->list migration
+# (task-048)
+# ─────────────────────────────────────────────────────────────────
+# REAL-UCI regression guard for the hardware bug: a section storing
+# subscription_url as a scalar UCI `option` (legacy / CLI / podkop-migrated
+# configs) made get_subscription_urls_for_section return EMPTY (config_list_foreach
+# iterates ONLY list values), so has_outbound_section failed and sing-box never
+# started. This must use the SHIPPED functions against an actual config_load — NOT
+# the stubbed config_list_foreach in test_subscription (which honors MU_URLS
+# directly and therefore cannot catch the broken primitive). Synthetic URL only.
+test_sub_url_option() {
+    header "Scalar option subscription_url read-fallback + migration (task-048)"
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    if [ ! -r "$bin" ]; then
+        skip "suburlopt — bin/netshift not found"
+        return
+    fi
+    if [ ! -r /lib/functions.sh ] || [ ! -r /lib/config/uci.sh ] || ! command -v uci > /dev/null 2>&1; then
+        skip "suburlopt — LuCI config_load / uci not available"
+        return
+    fi
+
+    local lib="${NETSHIFT_LIB_DIR}"
+    local drv="/tmp/netshift-suburlopt-$$.sh"
+    cat > "$drv" << 'SUBOPTEOF'
+BIN="BIN_PATH_PLACEHOLDER"
+LIB="LIB_DIR_PLACEHOLDER"
+. /lib/functions.sh
+. /lib/config/uci.sh 2>/dev/null || true
+# shellcheck disable=SC1090
+. "$LIB/constants.sh"
+# shellcheck disable=SC1090
+. "$LIB/helpers.sh"
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+# Exercise the SHIPPED functions verbatim (awk-extracted) against a real
+# config_load — this is the whole point: the real LuCI config_list_foreach /
+# config_get primitives, not a stub.
+for fn in get_subscription_urls_for_section _collect_subscription_url_handler \
+          section_has_configured_outbound \
+          migrate_legacy_subscription_url_option \
+          _migrate_legacy_subscription_url_option_handler; do
+    eval "$(awk -v f="$fn" '$0 ~ "^"f"\\(\\) \\{"{p=1} p{print} p&&/^\}/{exit}' "$BIN")"
+done
+
+mkdir -p /etc/config
+
+# ── Fixture A: SCALAR option subscription_url (the exact broken shape) ──
+cat > /etc/config/netshift_suboptscalar <<'CFGEOF'
+config section 'main'
+    option connection_type 'proxy'
+    option proxy_config_type 'subscription'
+    option subscription_url 'https://example.com/sub'
+CFGEOF
+config_load netshift_suboptscalar
+urls="$(get_subscription_urls_for_section main)"
+[ "$urls" = "https://example.com/sub" ] && echo 'suburlopt:scalar-read:OK' || echo "suburlopt:scalar-read:FAIL [$urls]"
+if section_has_configured_outbound main; then
+    echo 'suburlopt:scalar-hasoutbound:OK'
+else
+    echo 'suburlopt:scalar-hasoutbound:FAIL'
+fi
+rm -f /etc/config/netshift_suboptscalar
+
+# ── Fixture B: LIST subscription_url (must still work — no regression) ──
+cat > /etc/config/netshift_suboptlist <<'CFGEOF'
+config section 'main'
+    option connection_type 'proxy'
+    option proxy_config_type 'subscription'
+    list subscription_url 'https://example.com/sub'
+CFGEOF
+config_load netshift_suboptlist
+urls="$(get_subscription_urls_for_section main)"
+[ "$urls" = "https://example.com/sub" ] && echo 'suburlopt:list-read:OK' || echo "suburlopt:list-read:FAIL [$urls]"
+rm -f /etc/config/netshift_suboptlist
+
+# ── Migration: option -> list, idempotent. The migration function hardcodes
+# the `netshift` config name, so write a throwaway /etc/config/netshift (the
+# caller backs up + restores any real one). Two sections: a plain URL AND a URL
+# with a query string containing `=`/`&`/`?` — the latter is the [B1] regression
+# guard: the old `uci add_list "key=value"` CLI form splits on the first `=` and
+# LOSES the value, while uci_add_list preserves it byte-for-byte. ──
+NETSHIFT_CONFIG="netshift"
+EQ_URL='https://example.com/sub?token=abc&x=1'
+cat > /etc/config/netshift <<CFGEOF
+config section 'main'
+    option connection_type 'proxy'
+    option proxy_config_type 'subscription'
+    option subscription_url 'https://example.com/sub'
+
+config section 'query'
+    option connection_type 'proxy'
+    option proxy_config_type 'subscription'
+    option subscription_url '$EQ_URL'
+CFGEOF
+config_load netshift
+
+# First run: must migrate both scalar options -> lists and flip the flag.
+migrate_legacy_subscription_url_option
+if [ "$SUBSCRIPTION_URL_OPTION_MIGRATED" = "1" ]; then
+    echo 'suburlopt:migrate-flag:OK'
+else
+    echo "suburlopt:migrate-flag:FAIL [$SUBSCRIPTION_URL_OPTION_MIGRATED]"
+fi
+# The stored values must be preserved.
+migrated_val="$(uci -q get netshift.main.subscription_url)"
+[ "$migrated_val" = "https://example.com/sub" ] && echo 'suburlopt:migrate-value:OK' || echo "suburlopt:migrate-value:FAIL [$migrated_val]"
+# [B1] regression guard: the `=`/`&` URL survives byte-for-byte.
+migrated_eq="$(uci -q get netshift.query.subscription_url)"
+[ "$migrated_eq" = "$EQ_URL" ] && echo 'suburlopt:migrate-equrl-preserved:OK' || echo "suburlopt:migrate-equrl-preserved:FAIL [$migrated_eq]"
+
+# After a fresh config_load the LIST path (config_list_foreach) returns each URL,
+# and the committed state must be a CLEAN single-element list (no leftover scalar
+# option and no duplicate element).
+config_load netshift
+SUBSCRIPTION_URLS_COLLECTED=""
+config_list_foreach main subscription_url _collect_subscription_url_handler
+[ "$SUBSCRIPTION_URLS_COLLECTED" = "https://example.com/sub" ] && echo 'suburlopt:migrate-islist:OK' || echo "suburlopt:migrate-islist:FAIL [$SUBSCRIPTION_URLS_COLLECTED]"
+SUBSCRIPTION_URLS_COLLECTED=""
+config_list_foreach query subscription_url _collect_subscription_url_handler
+[ "$SUBSCRIPTION_URLS_COLLECTED" = "$EQ_URL" ] && echo 'suburlopt:migrate-equrl-islist:OK' || echo "suburlopt:migrate-equrl-islist:FAIL [$SUBSCRIPTION_URLS_COLLECTED]"
+# Clean single element: `uci show` must render exactly one list value per section
+# (no leftover scalar option, no duplicate). uci renders a list element with the
+# index-bearing `[0]` syntax; assert exactly one line each.
+eq_lines="$(uci -q show netshift.query.subscription_url | grep -c "subscription_url")"
+[ "$eq_lines" = "1" ] && echo 'suburlopt:migrate-equrl-single:OK' || echo "suburlopt:migrate-equrl-single:FAIL [$eq_lines]"
+
+# Second run: idempotent no-op (already a list -> flag stays 0, no churn).
+migrate_legacy_subscription_url_option
+if [ "$SUBSCRIPTION_URL_OPTION_MIGRATED" = "0" ]; then
+    echo 'suburlopt:migrate-idempotent:OK'
+else
+    echo "suburlopt:migrate-idempotent:FAIL [$SUBSCRIPTION_URL_OPTION_MIGRATED]"
+fi
+idem_val="$(uci -q get netshift.main.subscription_url)"
+[ "$idem_val" = "https://example.com/sub" ] && echo 'suburlopt:migrate-idempotent-value:OK' || echo "suburlopt:migrate-idempotent-value:FAIL [$idem_val]"
+idem_eq="$(uci -q get netshift.query.subscription_url)"
+[ "$idem_eq" = "$EQ_URL" ] && echo 'suburlopt:migrate-idempotent-equrl:OK' || echo "suburlopt:migrate-idempotent-equrl:FAIL [$idem_eq]"
+
+rm -f /etc/config/netshift
+echo 'DONE'
+SUBOPTEOF
+    sed -i "s|LIB_DIR_PLACEHOLDER|$lib|g; s|BIN_PATH_PLACEHOLDER|$bin|g" "$drv"
+
+    # Protect any real /etc/config/netshift the container may carry: the
+    # migration path writes a throwaway one under that exact name.
+    local netshift_cfg_backup=""
+    if [ -f /etc/config/netshift ]; then
+        netshift_cfg_backup="/tmp/netshift-cfg-backup-$$"
+        cp /etc/config/netshift "$netshift_cfg_backup"
+    fi
+
+    # Parse in the CURRENT shell (temp file + `while read < "$out"`, NO pipe) so
+    # pass/fail update the global counters and a suburlopt:*:FAIL actually gates
+    # the suite (a pipe would run the while-body in a subshell — non-gating).
+    local sub_out="/tmp/netshift-suburlopt-out-$$"
+    sh "$drv" > "$sub_out" 2>/dev/null
+    # FAIL/SKIP tokens carry a trailing " [diagnostic]" suffix, so match with a
+    # trailing glob (*:FAIL*) — a bare "*:FAIL)" would miss them and silently
+    # drop the failure, defeating S1's gating.
+    while IFS= read -r line; do
+        case "$line" in
+            *:FAIL*) fail "$line" ;;
+            *:SKIP*) skip "$line" ;;
+            *:OK) pass "$line" ;;
+            DONE) ;;
+            *) ;;
+        esac
+    done < "$sub_out"
+    rm -f "$drv" "$sub_out"
+
+    if [ -n "$netshift_cfg_backup" ]; then
+        mv "$netshift_cfg_backup" /etc/config/netshift
+    else
+        rm -f /etc/config/netshift
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: global_proxy route rule semantics
+# ─────────────────────────────────────────────────────────────────
+test_global_proxy() {
+    header "Global Proxy Route Semantics"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local cm_lib="${NETSHIFT_LIB_DIR}/sing_box_config_manager.sh"
+    local constants_lib="${NETSHIFT_LIB_DIR}/constants.sh"
+    local jq_helpers="${NETSHIFT_LIB_DIR}/helpers.jq"
+    if [ ! -r "$cm_lib" ] || [ ! -r "$constants_lib" ] || [ ! -r "$jq_helpers" ]; then
+        skip "config manager / constants / helpers.jq not found"
+        return
+    fi
+
+    # sing_box_cm_patch_route_rule imports helpers.jq from the runtime path.
+    mkdir -p /usr/lib/netshift
+    ln -sf "$jq_helpers" /usr/lib/netshift/helpers.jq
+
+    local cfg tmp
+    tmp="/tmp/netshift-global-proxy-$$.json"
+
+    . "$constants_lib"
+    . "$cm_lib"
+
+    local global_out ruleset_tag ipv6_excluded_rule_tag
+    global_out="global-out"
+    ruleset_tag="global-user-domains"
+    ipv6_excluded_rule_tag="global-ipv6-excluded"
+
+    cfg=$(jq -n \
+        --arg direct "$SB_DIRECT_OUTBOUND_TAG" \
+        --arg global "$global_out" \
+        --arg tproxy "$SB_TPROXY_INBOUND_TAG" \
+        --arg listen "$SB_TPROXY_INBOUND_ADDRESS" \
+        --argjson port "$SB_TPROXY_INBOUND_PORT" \
+        --arg ruleset "$ruleset_tag" \
+        '{
+        log: { disabled: false, level: "warn", timestamp: true },
+        dns: { servers: [], rules: [], final: $direct, strategy: "prefer_ipv4", independent_cache: true },
+        ntp: {},
+        inbounds: [
+            { type: "tproxy", tag: $tproxy, listen: $listen, listen_port: $port }
+        ],
+        outbounds: [
+            { type: "direct", tag: $direct },
+            { type: "direct", tag: $global }
+        ],
+        route: {
+            rules: [],
+            rule_set: [{ type: "inline", tag: $ruleset, rules: [{ domain_suffix: ["example.com"] }] }],
+            final: $global,
+            auto_detect_interface: true
+        }
+    }')
+
+    cfg=$(sing_box_cm_add_route_rule "$cfg" "$SB_EXCLUSION_RULE_TAG" "$SB_TPROXY_INBOUND_TAG" "$SB_DIRECT_OUTBOUND_TAG")
+    cfg=$(sing_box_cm_patch_route_rule "$cfg" "$SB_EXCLUSION_RULE_TAG" "rule_set" "$ruleset_tag")
+    cfg=$(sing_box_cm_add_route_rule "$cfg" "$ipv6_excluded_rule_tag" "$SB_TPROXY_INBOUND_TAG" "$SB_DIRECT_OUTBOUND_TAG")
+    cfg=$(sing_box_cm_patch_route_rule "$cfg" "$ipv6_excluded_rule_tag" "source_ip_cidr" "fd00:ec3a::123/128")
+
+    if echo "$cfg" | jq -e --arg global "$global_out" '.route.final == $global' > /dev/null 2>&1; then
+        pass "global_proxy route.final points to global-out"
+    else
+        fail "global_proxy route.final is not global-out" "$(echo "$cfg" | jq -r '.route.final // "missing"' 2>/dev/null)"
+    fi
+
+    if echo "$cfg" | jq -e --arg tag "$SB_EXCLUSION_RULE_TAG" \
+            '[.route.rules[] | select(.__service_tag == $tag and (has("rule_set") | not))] | length == 0' \
+            > /dev/null 2>&1; then
+        pass "global_proxy exclusion route rule is constrained by rule_set"
+    else
+        fail "global_proxy exclusion route rule lacks rule_set" "$(echo "$cfg" | jq -c '.route.rules' 2>/dev/null)"
+    fi
+
+    if echo "$cfg" | jq -e --arg tag "$SB_EXCLUSION_RULE_TAG" --arg direct "$SB_DIRECT_OUTBOUND_TAG" --arg ruleset "$ruleset_tag" \
+            '[.route.rules[] | select(.__service_tag == $tag and .outbound == $direct and .rule_set == $ruleset)] | length == 1' \
+            > /dev/null 2>&1; then
+        pass "global_proxy exclusion rule routes global-user-domains direct-out"
+    else
+        fail "global_proxy exclusion direct rule shape wrong" "$(echo "$cfg" | jq -c '.route.rules' 2>/dev/null)"
+    fi
+
+    if echo "$cfg" | jq -e --arg tag "$ipv6_excluded_rule_tag" --arg direct "$SB_DIRECT_OUTBOUND_TAG" \
+            '[.route.rules[] | select(.__service_tag == $tag and .outbound == $direct and .source_ip_cidr == "fd00:ec3a::123/128")] | length == 1' \
+            > /dev/null 2>&1; then
+        pass "global_proxy routing_excluded_ips supports IPv6 source_ip_cidr"
+    else
+        fail "global_proxy IPv6 source_ip_cidr rule shape wrong" "$(echo "$cfg" | jq -c '.route.rules' 2>/dev/null)"
+    fi
+
+    if command -v sing-box > /dev/null 2>&1; then
+        sing_box_cm_save_config_to_file "$cfg" "$tmp"
+        if sing-box -c "$tmp" check > /dev/null 2>&1; then
+            pass "sing-box validates global_proxy route config"
+        else
+            fail "sing-box rejects global_proxy route config" "$(sing-box -c "$tmp" check 2>&1)"
+        fi
+        rm -f "$tmp"
+    else
+        skip "sing-box not installed — skipping global_proxy config check"
+    fi
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Stock sing-box update check (task-017)
+# ─────────────────────────────────────────────────────────────────
+# Exercises updates_check_sing_box_stable through the real sourced updater.sh
+# with a PATH-prepended fake opkg whose candidate version + presence of sing-box
+# are driven by env/marker files (the test_selfheal stub-harness pattern). Asserts
+# the STABLE JSON `status` for: installed == candidate -> latest; candidate newer
+# -> outdated; sing-box absent -> not_installed; feed unreachable -> success:false.
+test_check_update_stable() {
+    header "Stock sing-box Update Check (task-017)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-stablecheck-$$"
+    rm -rf "$work"
+    mkdir -p "$work/bin"
+
+    # Fake opkg: `update` always ok; `list sing-box` echoes the candidate line
+    # only when the candidate marker is set; a `sing-box` shim reports the
+    # running version only when the present marker is set.
+    cat > "$work/bin/opkg" << 'OPKGEOF'
+#!/bin/sh
+case "$1" in
+update) exit 0 ;;
+list)
+    if [ -n "$STUBCHECK_CANDIDATE" ]; then
+        printf 'sing-box - %s\n' "$STUBCHECK_CANDIDATE"
+    fi
+    exit 0
+    ;;
+esac
+exit 0
+OPKGEOF
+    cat > "$work/bin/sing-box" << 'SBEOF'
+#!/bin/sh
+case "$1" in
+version) printf 'sing-box version %s\n' "$STUBCHECK_INSTALLED" ;;
+esac
+exit 0
+SBEOF
+    chmod 0755 "$work/bin/opkg" "$work/bin/sing-box"
+
+    # Isolated PATH: symlink only the utilities the updater/helpers need into a
+    # dedicated dir so the real /usr/bin/sing-box is NOT reachable. The fake
+    # sing-box is linked in conditionally per scenario (present vs absent).
+    mkdir -p "$work/path"
+    local _tool _tool_path
+    for _tool in sh ash cat grep awk cut head sort sed printf basename ls rm mkdir cp mv chmod env jq dirname; do
+        _tool_path="$(command -v "$_tool" 2>/dev/null)" && ln -sf "$_tool_path" "$work/path/$_tool" 2>/dev/null
+    done
+    ln -sf "$work/bin/opkg" "$work/path/opkg"
+
+    # Driver: source updater.sh + helpers.sh (real is_min_package_version /
+    # get_sing_box_version), silence logging, run the check.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+. "DRV_HELPERS"
+. "DRV_UPDATER"
+updates_check_sing_box_stable
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_HELPERS|${NETSHIFT_LIB_DIR}/helpers.sh|g" "$drv"
+
+    local out="$work/out.json"
+    run_check() {
+        # Isolated PATH: only $work/path (no real sing-box, apk absent → opkg
+        # branch). sing-box presence is controlled by linking the fake in/out.
+        if [ -n "$STUBCHECK_PRESENT" ]; then
+            ln -sf "$work/bin/sing-box" "$work/path/sing-box" 2>/dev/null
+        else
+            rm -f "$work/path/sing-box" 2>/dev/null
+        fi
+        PATH="$work/path" ash "$drv" > "$out" 2>/dev/null || true
+    }
+
+    # ── Case 1: installed == candidate → latest ──────────────────────────────
+    export STUBCHECK_CANDIDATE="1.12.0-r1"
+    export STUBCHECK_PRESENT=1
+    export STUBCHECK_INSTALLED="1.12.0"
+    run_check
+    if jq -e '.success == true and .status == "latest"' "$out" > /dev/null 2>&1; then
+        pass "stablecheck-installed-eq-candidate-latest:OK"
+    else
+        fail "stablecheck-installed-eq-candidate-latest:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 2: candidate newer → outdated ───────────────────────────────────
+    export STUBCHECK_CANDIDATE="1.13.5-r1"
+    export STUBCHECK_PRESENT=1
+    export STUBCHECK_INSTALLED="1.12.0"
+    run_check
+    if jq -e '.success == true and .status == "outdated"' "$out" > /dev/null 2>&1; then
+        pass "stablecheck-candidate-newer-outdated:OK"
+    else
+        fail "stablecheck-candidate-newer-outdated:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 3: sing-box absent → not_installed ──────────────────────────────
+    export STUBCHECK_CANDIDATE="1.13.5-r1"
+    unset STUBCHECK_PRESENT
+    run_check
+    if jq -e '.success == true and .status == "not_installed"' "$out" > /dev/null 2>&1; then
+        pass "stablecheck-absent-not_installed:OK"
+    else
+        fail "stablecheck-absent-not_installed:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 4: feed unreachable (empty candidate) → success:false ───────────
+    unset STUBCHECK_CANDIDATE
+    export STUBCHECK_PRESENT=1
+    export STUBCHECK_INSTALLED="1.12.0"
+    run_check
+    if jq -e '.success == false and (.message | length) > 0' "$out" > /dev/null 2>&1; then
+        pass "stablecheck-feed-unreachable-successfalse:OK"
+    else
+        fail "stablecheck-feed-unreachable-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    unset STUBCHECK_CANDIDATE STUBCHECK_PRESENT STUBCHECK_INSTALLED
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: Extended sing-box Update Check — v-prefix regression (task-019)
+# ─────────────────────────────────────────────────────────────────
+# Sources the REAL updates_check_sing_box_extended from updater.sh and stubs its
+# three dependencies (get_sing_box_version, updates_fetch_sing_box_extended_releases,
+# updates_extended_release_tag) via markers so the comparison + emitted JSON can
+# be driven deterministically. The regression: installed "1.13.12-extended-2.3.2"
+# (no v) vs GitHub tag "v1.13.12-extended-2.3.2" (with v) must report
+# status:"latest" (NOT "outdated"), with current_version/latest_version both
+# emitted v-stripped and equal.
+test_check_update_extended() {
+    header "Extended sing-box Update Check — v-prefix (task-019)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-extcheck-$$"
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    # Driver: source updater.sh, silence logging, OVERRIDE the three deps after
+    # sourcing (so the real updates_check_sing_box_extended calls our stubs), run
+    # the check. STUBEXT_INSTALLED = get_sing_box_version output;
+    # STUBEXT_RELEASES = the raw releases blob (empty → fetch-failure branch);
+    # STUBEXT_TAG = the resolved release tag (with the leading v, as GitHub gives).
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+. "DRV_HELPERS"
+. "DRV_UPDATER"
+get_sing_box_version() { printf '%s' "$STUBEXT_INSTALLED"; }
+updates_fetch_sing_box_extended_releases() { printf '%s' "$STUBEXT_RELEASES"; }
+updates_extended_release_tag() { printf '%s' "$STUBEXT_TAG"; }
+updates_check_sing_box_extended
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_HELPERS|${NETSHIFT_LIB_DIR}/helpers.sh|g" "$drv"
+
+    local out="$work/out.json"
+    run_extcheck() {
+        ash "$drv" > "$out" 2>/dev/null || true
+    }
+
+    # ── Case 1: installed == latest, only the tag carries a leading v → latest ──
+    # THE regression: must NOT be "outdated"; both versions emitted v-stripped+eq.
+    export STUBEXT_INSTALLED="1.13.12-extended-2.3.2"
+    export STUBEXT_RELEASES='[{"tag_name":"v1.13.12-extended-2.3.2"}]'
+    export STUBEXT_TAG="v1.13.12-extended-2.3.2"
+    run_extcheck
+    if jq -e '.success == true and .status == "latest"
+            and .current_version == "1.13.12-extended-2.3.2"
+            and .latest_version == "1.13.12-extended-2.3.2"
+            and .current_version == .latest_version' "$out" > /dev/null 2>&1; then
+        pass "extcheck-vprefix-installed-eq-latest:OK"
+    else
+        fail "extcheck-vprefix-installed-eq-latest:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 2: installed older than the latest tag → outdated ──────────────────
+    export STUBEXT_INSTALLED="1.13.10-extended-2.3.0"
+    export STUBEXT_RELEASES='[{"tag_name":"v1.13.12-extended-2.3.2"}]'
+    export STUBEXT_TAG="v1.13.12-extended-2.3.2"
+    run_extcheck
+    if jq -e '.success == true and .status == "outdated"
+            and .current_version == "1.13.10-extended-2.3.0"
+            and .latest_version == "1.13.12-extended-2.3.2"' "$out" > /dev/null 2>&1; then
+        pass "extcheck-older-outdated:OK"
+    else
+        fail "extcheck-older-outdated:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 3: releases fetch failure (empty blob) → success:false ─────────────
+    export STUBEXT_INSTALLED="1.13.12-extended-2.3.2"
+    export STUBEXT_RELEASES=""
+    export STUBEXT_TAG=""
+    run_extcheck
+    if jq -e '.success == false and (.message | length) > 0' "$out" > /dev/null 2>&1; then
+        pass "extcheck-fetch-failure-successfalse:OK"
+    else
+        fail "extcheck-fetch-failure-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    unset STUBEXT_INSTALLED STUBEXT_RELEASES STUBEXT_TAG
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: NetShift update check on-demand (task-029)
+# ─────────────────────────────────────────────────────────────────
+# Two parts:
+#  (A) STATIC: get_system_info must do NO network I/O — the GitHub curl is gone
+#      and netshift_latest_version is the constant "unknown".
+#  (B) updates_check_netshift version compare + v-normalization + JSON shape:
+#      source updater.sh, silence logging, OVERRIDE updates_netshift_latest_tag
+#      (the shared tag fetch) + set NETSHIFT_VERSION, run the check. Stub inputs:
+#      STUBNS_INSTALLED = $NETSHIFT_VERSION; STUBNS_TAG = the GitHub latest tag
+#      (empty → unreachable branch).
+test_check_update_netshift() {
+    header "NetShift Update Check — on-demand + v-prefix (task-029)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local bin="${NETSHIFT_SRC}/usr/bin/netshift"
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ] || [ ! -r "$bin" ]; then
+        skip "updater.sh / bin not found in ${NETSHIFT_SRC}"
+        return
+    fi
+
+    # ── Part A (static): get_system_info has NO live GitHub curl ────────────────
+    # Extract the get_system_info function body and assert it contains no curl to
+    # the releases API, and that it pins netshift_latest_version="unknown".
+    local fn
+    fn="$(awk '/^get_system_info\(\) \{/{p=1} p{print} p&&/^\}/{exit}' "$bin")"
+    if [ -n "$fn" ] \
+        && ! printf '%s' "$fn" | grep -q 'releases/latest' \
+        && printf '%s' "$fn" | grep -q 'netshift_latest_version="unknown"'; then
+        pass "netshiftcheck-get_system_info-no-network:OK"
+    else
+        fail "netshiftcheck-get_system_info-no-network:FAIL" "$fn"
+    fi
+
+    local work="/tmp/netshift-netshiftcheck-$$"
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    # ── Part B: driver sources updater.sh + helpers.sh, silences logging,
+    # overrides the shared tag fetch + NETSHIFT_VERSION, runs the check.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+. "DRV_HELPERS"
+. "DRV_UPDATER"
+NETSHIFT_VERSION="$STUBNS_INSTALLED"
+updates_netshift_latest_tag() { printf '%s' "$STUBNS_TAG"; }
+updates_check_netshift
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_HELPERS|${NETSHIFT_LIB_DIR}/helpers.sh|g" "$drv"
+
+    local out="$work/out.json"
+    run_netshiftcheck() {
+        ash "$drv" > "$out" 2>/dev/null || true
+    }
+
+    # ── Case 1: installed v0.8.6 vs latest 0.8.6 (no v) → latest (NOT outdated) ──
+    export STUBNS_INSTALLED="v0.8.6"
+    export STUBNS_TAG="0.8.6"
+    run_netshiftcheck
+    if jq -e '.success == true and .status == "latest"
+            and .current_version == "v0.8.6"
+            and .latest_version == "0.8.6"' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-vprefix-installed-eq-latest:OK"
+    else
+        fail "netshiftcheck-vprefix-installed-eq-latest:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 2: installed 0.8.5 vs latest 0.8.6 → outdated ──────────────────────
+    export STUBNS_INSTALLED="0.8.5"
+    export STUBNS_TAG="0.8.6"
+    run_netshiftcheck
+    if jq -e '.success == true and .status == "outdated"
+            and .current_version == "0.8.5"
+            and .latest_version == "0.8.6"' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-older-outdated:OK"
+    else
+        fail "netshiftcheck-older-outdated:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 3: installed v0.8.6 vs latest v0.8.6 (both v) → latest ─────────────
+    export STUBNS_INSTALLED="v0.8.6"
+    export STUBNS_TAG="v0.8.6"
+    run_netshiftcheck
+    if jq -e '.success == true and .status == "latest"' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-both-vprefix-latest:OK"
+    else
+        fail "netshiftcheck-both-vprefix-latest:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 4: JSON shape — keys success/current_version/latest_version/status ─
+    export STUBNS_INSTALLED="0.8.5"
+    export STUBNS_TAG="0.8.6"
+    run_netshiftcheck
+    if jq -e 'has("success") and has("current_version")
+            and has("latest_version") and has("status")' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-json-shape:OK"
+    else
+        fail "netshiftcheck-json-shape:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 5: tag fetch failure (empty) → success:false ───────────────────────
+    export STUBNS_INSTALLED="0.8.6"
+    export STUBNS_TAG=""
+    run_netshiftcheck
+    if jq -e '.success == false and (.message | length) > 0' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-fetch-failure-successfalse:OK"
+    else
+        fail "netshiftcheck-fetch-failure-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    # ── Case 6: dev/unstamped build (placeholder) → latest (graceful) ───────────
+    export STUBNS_INSTALLED="__COMPILED_VERSION_VARIABLE__"
+    export STUBNS_TAG="0.8.6"
+    run_netshiftcheck
+    if jq -e '.success == true and .status == "latest"
+            and .latest_version == "0.8.6"' "$out" > /dev/null 2>&1; then
+        pass "netshiftcheck-dev-build-graceful:OK"
+    else
+        fail "netshiftcheck-dev-build-graceful:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    unset STUBNS_INSTALLED STUBNS_TAG
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: NetShift latest-tag parse — minified vs pretty JSON (task-047)
+# ─────────────────────────────────────────────────────────────────
+# Guards the false-"outdated" bug: updates_netshift_latest_tag used a
+# field-positional grep|cut that, on MINIFIED GitHub JSON (whole object on one
+# line, "url" before "tag_name"), returned the release "url" instead of the tag
+# — causing a false "outdated" + a self-update that downloaded a garbage
+# "version". The fix parses with jq '.tag_name // empty' (format-independent).
+#
+# We exercise the REAL parse: the driver sources updater.sh and stubs ONLY the
+# network boundary (updates_http_get_once) with markered JSON, then calls the
+# real updates_netshift_latest_tag / updates_check_netshift. No network.
+test_netshift_latest_tag() {
+    header "NetShift latest-tag jq parse (task-047)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-latesttag-$$"
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    # Driver: source helpers.sh + updater.sh, silence logging, pin constants,
+    # stub the network boundary (updates_http_get_once) to emit $STUBLT_BODY,
+    # then run the REAL parse function named in $STUBLT_FN.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+updates_log() { :; }
+. "DRV_HELPERS"
+. "DRV_UPDATER"
+NETSHIFT_RELEASE_API_URL="https://api.test/latest"
+NETSHIFT_VERSION="$STUBLT_INSTALLED"
+# Force the API-fallback path this test targets: the redirect resolver returns
+# empty so updates_netshift_latest_tag falls back to the stubbed API body.
+updates_github_resolve_redirect() { printf ''; }
+updates_http_get_once() { printf '%s' "$STUBLT_BODY"; }
+"$STUBLT_FN"
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_HELPERS|${NETSHIFT_LIB_DIR}/helpers.sh|g" "$drv"
+
+    local out="$work/out.txt"
+    local rc_file="$work/rc.txt"
+    run_lt() {
+        # The parse function returns non-zero on the rate-limit/error case; under
+        # the harness `set -e` that would abort the suite, so capture rc via the
+        # `|| ...` guard (assertions read $out + $rc_file, not the live rc).
+        ash "$drv" > "$out" 2>/dev/null && printf '0' > "$rc_file" || printf '%s' "$?" > "$rc_file"
+    }
+
+    # The exact minified release object from the bug report: "url" BEFORE
+    # "tag_name", whole object on a single line, with .../releases/338202209.
+    local minified='{"url":"https://api.github.com/repos/yandexru45/netshift/releases/338202209","id":338202209,"tag_name":"0.8.8","name":"0.8.8"}'
+    # Pretty-printed equivalent (one key per line).
+    local pretty='{
+  "url": "https://api.github.com/repos/yandexru45/netshift/releases/338202209",
+  "id": 338202209,
+  "tag_name": "0.8.8",
+  "name": "0.8.8"
+}'
+    # Rate-limit/error object — no tag_name.
+    local ratelimit='{"message":"API rate limit exceeded for 1.2.3.4","documentation_url":"https://docs.github.com/rest"}'
+
+    export STUBLT_FN="updates_netshift_latest_tag"
+    export STUBLT_INSTALLED="0.8.8"
+
+    # ── Case 1 (REGRESSION GUARD): minified → exactly 0.8.8, NOT the url ──────
+    export STUBLT_BODY="$minified"
+    run_lt
+    if [ "$(cat "$out" 2>/dev/null)" = "0.8.8" ] && [ "$(cat "$rc_file" 2>/dev/null)" = "0" ]; then
+        pass "latesttag-minified-returns-tag-not-url:OK"
+    else
+        fail "latesttag-minified-returns-tag-not-url:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 2: pretty-printed → 0.8.8 ───────────────────────────────────────
+    export STUBLT_BODY="$pretty"
+    run_lt
+    if [ "$(cat "$out" 2>/dev/null)" = "0.8.8" ] && [ "$(cat "$rc_file" 2>/dev/null)" = "0" ]; then
+        pass "latesttag-pretty-returns-tag:OK"
+    else
+        fail "latesttag-pretty-returns-tag:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 3: rate-limit/error object (no tag_name) → empty + non-zero ─────
+    export STUBLT_BODY="$ratelimit"
+    run_lt
+    if [ -z "$(cat "$out" 2>/dev/null)" ] && [ "$(cat "$rc_file" 2>/dev/null)" != "0" ]; then
+        pass "latesttag-ratelimit-empty-nonzero:OK"
+    else
+        fail "latesttag-ratelimit-empty-nonzero:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 4 (end-to-end): minified through updates_check_netshift with
+    # installed == tag → status "latest" (the false-outdated is gone). ────────
+    export STUBLT_FN="updates_check_netshift"
+    export STUBLT_BODY="$minified"
+    export STUBLT_INSTALLED="0.8.8"
+    run_lt
+    if jq -e '.success == true and .status == "latest"
+            and .latest_version == "0.8.8"' "$out" > /dev/null 2>&1; then
+        pass "latesttag-e2e-check-minified-latest:OK"
+    else
+        fail "latesttag-e2e-check-minified-latest:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+
+    unset STUBLT_FN STUBLT_BODY STUBLT_INSTALLED
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: GitHub redirect-based latest-tag + deterministic asset URLs (task-049)
+# ─────────────────────────────────────────────────────────────────
+# Sidestepping the api.github.com 60/hour/IP rate limit: the version-check + the
+# self-update asset download now resolve github.com/<repo>/releases/latest via a
+# redirect (curl -w '%{redirect_url}') → /releases/tag/<tag>, with the API + jq
+# path kept only as a graceful fallback. The network boundary is STUBBED here
+# (override updates_github_resolve_redirect / updates_http_get_once), so no curl
+# shell-out and no real network in CI. Synthetic data only.
+test_github_redirect_tag() {
+    header "GitHub redirect latest-tag + asset URLs (task-049)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-ghredirect-$$"
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    # Driver: source helpers.sh + updater.sh, silence logging, pin the redirect
+    # + API constants, OVERRIDE the redirect resolver ($STUBGR_REDIRECT) and the
+    # API boundary ($STUBGR_BODY), then run the function/expr named in $STUBGR_FN.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+updates_log() { :; }
+. "DRV_HELPERS"
+. "DRV_UPDATER"
+NETSHIFT_REPO_RELEASES_LATEST_URL="https://github.com/yandexru45/netshift/releases/latest"
+NETSHIFT_REPO_RELEASES_DOWNLOAD_BASE="https://github.com/yandexru45/netshift/releases/download"
+NETSHIFT_RELEASE_API_URL="https://api.test/latest"
+UPDATES_NETSHIFT_PKG_CORE="netshift"
+UPDATES_NETSHIFT_PKG_LUCI="luci-app-netshift"
+UPDATES_NETSHIFT_PKG_I18N_RU="luci-i18n-netshift-ru"
+updates_github_resolve_redirect() { printf '%s' "$STUBGR_REDIRECT"; }
+updates_http_get_once() { printf '%s' "$STUBGR_BODY"; }
+eval "$STUBGR_FN"
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_HELPERS|${NETSHIFT_LIB_DIR}/helpers.sh|g" "$drv"
+
+    local out="$work/out.txt"
+    local rc_file="$work/rc.txt"
+    run_gr() {
+        ash "$drv" > "$out" 2>/dev/null && printf '0' > "$rc_file" || printf '%s' "$?" > "$rc_file"
+    }
+
+    export STUBGR_FN="updates_netshift_latest_tag"
+    export STUBGR_REDIRECT=""
+    export STUBGR_BODY=""
+
+    # ── Case 1: clean redirect → tag 0.8.9 (primary path, no API) ────────────
+    export STUBGR_REDIRECT="https://github.com/yandexru45/netshift/releases/tag/0.8.9"
+    export STUBGR_BODY=""
+    run_gr
+    if [ "$(cat "$out" 2>/dev/null)" = "0.8.9" ] && [ "$(cat "$rc_file" 2>/dev/null)" = "0" ]; then
+        pass "ghredirect:tag-from-redirect:OK"
+    else
+        fail "ghredirect:tag-from-redirect:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 2: trailing-slash redirect → parse rejects (slash) → falls back ──
+    # A trailing slash makes the stripped tag contain "/", which the guard
+    # rejects; with NO API body it then yields empty + non-zero.
+    export STUBGR_REDIRECT="https://github.com/yandexru45/netshift/releases/tag/0.8.9/"
+    export STUBGR_BODY=""
+    run_gr
+    if [ -z "$(cat "$out" 2>/dev/null)" ] && [ "$(cat "$rc_file" 2>/dev/null)" != "0" ]; then
+        pass "ghredirect:tag-trailing-slash-rejected:OK"
+    else
+        fail "ghredirect:tag-trailing-slash-rejected:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 3: non-matching redirect (login page) → primary empty → API
+    # FALLBACK returns the release object → still yields the tag. ─────────────
+    export STUBGR_REDIRECT="https://github.com/login?return_to=%2Fyandexru45%2Fnetshift"
+    export STUBGR_BODY='{"url":"https://api.github.com/repos/yandexru45/netshift/releases/1","tag_name":"0.8.9"}'
+    run_gr
+    if [ "$(cat "$out" 2>/dev/null)" = "0.8.9" ] && [ "$(cat "$rc_file" 2>/dev/null)" = "0" ]; then
+        pass "ghredirect:nonmatch-falls-back:OK"
+    else
+        fail "ghredirect:nonmatch-falls-back:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 4: curl-absent (resolver empty) + API rate-limit object → empty +
+    # non-zero (honest failure, no false tag). ───────────────────────────────
+    export STUBGR_REDIRECT=""
+    export STUBGR_BODY='{"message":"API rate limit exceeded for 1.2.3.4"}'
+    run_gr
+    if [ -z "$(cat "$out" 2>/dev/null)" ] && [ "$(cat "$rc_file" 2>/dev/null)" != "0" ]; then
+        pass "ghredirect:ratelimit-empty:OK"
+    else
+        fail "ghredirect:ratelimit-empty:FAIL" "got=[$(cat "$out" 2>/dev/null)] rc=$(cat "$rc_file" 2>/dev/null)"
+    fi
+
+    # ── Case 5: asset-URL builder, ipk → deterministic names ─────────────────
+    export STUBGR_REDIRECT=""
+    export STUBGR_BODY=""
+    export STUBGR_FN='c="$(updates_netshift_asset_filename netshift 0.8.9 ipk)"; l="$(updates_netshift_asset_filename luci-app-netshift 0.8.9 ipk)"; i="$(updates_netshift_asset_filename luci-i18n-netshift-ru 0.8.9 ipk)"; printf "%s\n%s\n%s\n" "$c" "$l" "$i"'
+    run_gr
+    if [ "$(sed -n 1p "$out" 2>/dev/null)" = "netshift-0.8.9-r1-all.ipk" ] &&
+        [ "$(sed -n 2p "$out" 2>/dev/null)" = "luci-app-netshift-0.8.9-r1-all.ipk" ] &&
+        [ "$(sed -n 3p "$out" 2>/dev/null)" = "luci-i18n-netshift-ru-0.8.9.ipk" ]; then
+        pass "ghredirect:asset-ipk:OK"
+    else
+        fail "ghredirect:asset-ipk:FAIL" "got=[$(cat "$out" 2>/dev/null)]"
+    fi
+
+    # ── Case 6: asset-URL builder, apk → deterministic names ─────────────────
+    export STUBGR_FN='c="$(updates_netshift_asset_filename netshift 0.8.9 apk)"; l="$(updates_netshift_asset_filename luci-app-netshift 0.8.9 apk)"; i="$(updates_netshift_asset_filename luci-i18n-netshift-ru 0.8.9 apk)"; printf "%s\n%s\n%s\n" "$c" "$l" "$i"'
+    run_gr
+    if [ "$(sed -n 1p "$out" 2>/dev/null)" = "netshift-0.8.9-r1.apk" ] &&
+        [ "$(sed -n 2p "$out" 2>/dev/null)" = "luci-app-netshift-0.8.9-r1.apk" ] &&
+        [ "$(sed -n 3p "$out" 2>/dev/null)" = "luci-i18n-netshift-ru-0.8.9.apk" ]; then
+        pass "ghredirect:asset-apk:OK"
+    else
+        fail "ghredirect:asset-apk:FAIL" "got=[$(cat "$out" 2>/dev/null)]"
+    fi
+
+    unset STUBGR_FN STUBGR_REDIRECT STUBGR_BODY
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: NetShift self-update (task-017)
+# ─────────────────────────────────────────────────────────────────
+# Exercises updates_self_update_netshift (public wrapper + private core) through
+# the real sourced updater.sh. Connectivity probes (dig/curl) + the GitHub fetch
+# + the asset download + the package install are all stubbed; the heal flags are
+# re-pinned to temp paths and a fake /etc/init.d/netshift (absolute path) is
+# written+restored. Asserts the anti-brick contract:
+#   * connectivity-fail  -> aborts BEFORE any change, restore ran, success:false
+#   * download-fail      -> success:false, restore ran, config backup intact
+#   * happy path         -> success:true with version, restore ran
+# Uses the task-009 `... || true` set -e guard (worker returns non-zero on a
+# recoverable failure; assertions read JSON/file-state, not rc).
+test_self_update_netshift() {
+    header "NetShift Self-Update (task-017)"
+
+    if ! command -v jq > /dev/null 2>&1; then
+        skip "jq not available"
+        return
+    fi
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-selfupdate-$$"
+    rm -rf "$work"
+    mkdir -p "$work/bin" "$work/init"
+
+    # Connectivity probes (dig/curl), keyed off markers like test_selfheal.
+    cat > "$work/bin/dig" << 'DIGEOF'
+#!/bin/sh
+[ -f "$SU_DNS_OK" ] && { echo "1.2.3.4"; exit 0; }
+exit 1
+DIGEOF
+    cat > "$work/bin/curl" << 'CURLEOF'
+#!/bin/sh
+[ -f "$SU_HTTP_OK" ] && exit 0
+exit 1
+CURLEOF
+    # Fake opkg: `install <file>` succeeds per marker and records the install.
+    # `list-installed` cats $SU_INSTALLED_LIST (the AUTHORITATIVE installed set).
+    # On a REAL (non-no-op) install the install arm rewrites the netshift line in
+    # that list to the target version (SU_TARGET_INSTALLED_VER), so the
+    # verify-after-install belt sees the upgrade. When $SU_NOOP is set the install
+    # arm returns rc=0 but does NOT touch the list (simulates opkg "Not
+    # downgrading"/"already installed"), so list-installed keeps reporting the OLD
+    # version. opkg ignores the extra --force-* flags the production code now
+    # passes (they come before the file path).
+    cat > "$work/bin/opkg" << 'OPKGEOF'
+#!/bin/sh
+case "$1" in
+update) exit 0 ;;
+list-installed) cat "$SU_INSTALLED_LIST" 2>/dev/null; exit 0 ;;
+install)
+    shift
+    # Skip the leading --force-* flags so $1 is the package file path.
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+        --*) shift ;;
+        *) break ;;
+        esac
+    done
+    printf '%s\n' "$1" >> "$SU_INSTALL_LOG"
+    [ -f "$SU_PKG_OK" ] || exit 1
+    # A real success updates the installed list to the target version for the
+    # core package, UNLESS we are simulating a no-op ($SU_NOOP set).
+    if [ -z "$SU_NOOP" ]; then
+        case "$1" in
+        *netshift-* | *netshift_*)
+            # Only the core "netshift" file, not luci-app-/luci-i18n- ones.
+            case "$1" in
+            *luci-* ) : ;;
+            *)
+                grep -v '^netshift ' "$SU_INSTALLED_LIST" 2>/dev/null > "$SU_INSTALLED_LIST.tmp"
+                printf 'netshift - %s\n' "$SU_TARGET_INSTALLED_VER" >> "$SU_INSTALLED_LIST.tmp"
+                mv "$SU_INSTALLED_LIST.tmp" "$SU_INSTALLED_LIST"
+                ;;
+            esac
+            ;;
+        esac
+    fi
+    exit 0
+    ;;
+esac
+exit 0
+OPKGEOF
+    chmod 0755 "$work/bin/dig" "$work/bin/curl" "$work/bin/opkg"
+
+    # Fake /etc/init.d/netshift: records stop/start/restart (used by self-heal
+    # teardown/bring-up). We never re-exec /usr/bin/netshift here.
+    cat > "$work/init/netshift" << 'INITEOF'
+#!/bin/sh
+printf '%s\n' "$1" >> "$SU_INIT_LOG"
+exit 0
+INITEOF
+    chmod 0755 "$work/init/netshift"
+
+    # Driver: source updater.sh, re-pin heal/connectivity paths + constants,
+    # stub the GitHub fetch + download with markers, run the public wrapper.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+updates_log() { :; }
+RESOLV_CONF="DRV_RESOLV"
+UPDATES_RESOLV_BACKUP="DRV_BACKUP"
+UPDATES_FEED_PROBE_HOST="feeds.test"
+UPDATES_GITHUB_PROBE_HOST="github.test"
+UPDATES_HEAL_RESOLVERS="1.1.1.1 9.9.9.9"
+NETSHIFT_VERSION="0.8.0"
+NETSHIFT_CONFIG="DRV_CONFIG"
+NETSHIFT_RELEASE_API_URL="https://api.test/latest"
+UPDATES_NETSHIFT_DOWNLOAD_DIR="DRV_DLDIR"
+UPDATES_NETSHIFT_CONFIG_BACKUP="DRV_CFGBAK"
+UPDATES_NETSHIFT_PKG_CORE="netshift"
+UPDATES_NETSHIFT_PKG_LUCI="luci-app-netshift"
+UPDATES_NETSHIFT_PKG_I18N_RU="luci-i18n-netshift-ru"
+. "DRV_UPDATER"
+# Re-pin after sourcing.
+RESOLV_CONF="DRV_RESOLV"
+UPDATES_RESOLV_BACKUP="DRV_BACKUP"
+UPDATES_FEED_PROBE_HOST="feeds.test"
+UPDATES_GITHUB_PROBE_HOST="github.test"
+UPDATES_HEAL_RESOLVERS="1.1.1.1 9.9.9.9"
+NETSHIFT_VERSION="0.8.0"
+NETSHIFT_CONFIG="DRV_CONFIG"
+NETSHIFT_RELEASE_API_URL="https://api.test/latest"
+UPDATES_NETSHIFT_DOWNLOAD_DIR="DRV_DLDIR"
+UPDATES_NETSHIFT_CONFIG_BACKUP="DRV_CFGBAK"
+UPDATES_NETSHIFT_PKG_CORE="netshift"
+UPDATES_NETSHIFT_PKG_LUCI="luci-app-netshift"
+UPDATES_NETSHIFT_PKG_I18N_RU="luci-i18n-netshift-ru"
+
+# Stub the GitHub latest-release fetch: emit a tiny JSON with a tag and asset
+# URLs only when the marker says GitHub is reachable for the fetch.
+updates_http_get_once() {
+    [ -f "$SU_GH_OK" ] || return 1
+    cat <<JSON
+{"tag_name":"$SU_LATEST_TAG",
+ "assets":[
+   {"browser_download_url":"https://dl.test/netshift-$SU_LATEST_TAG.ipk"},
+   {"browser_download_url":"https://dl.test/luci-app-netshift-$SU_LATEST_TAG.ipk"},
+   {"browser_download_url":"https://dl.test/luci-i18n-netshift-ru-$SU_LATEST_TAG.ipk"}
+ ]}
+JSON
+}
+# Stub the asset download: write a non-empty file only when the marker is set.
+updates_download_to_file() {
+    [ -f "$SU_DL_OK" ] || return 1
+    printf 'pkg-bytes\n' > "$2"
+    [ -s "$2" ]
+}
+
+updates_self_update_netshift
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_RESOLV|$work/resolv.conf|g;s|DRV_BACKUP|$work/resolv.bak|g;s|DRV_CONFIG|$work/etc-config-netshift|g;s|DRV_DLDIR|$work/dl|g;s|DRV_CFGBAK|$work/config.bak|g" "$drv"
+
+    # Install the fake /etc/init.d/netshift (write+restore the real one).
+    local init_target="/etc/init.d/netshift"
+    local init_saved=""
+    if [ -e "$init_target" ]; then
+        init_saved="$work/netshift.realinit"
+        cp -p "$init_target" "$init_saved" 2>/dev/null || init_saved=""
+    fi
+    mkdir -p /etc/init.d 2>/dev/null || true
+    cp -p "$work/init/netshift" "$init_target" 2>/dev/null
+    chmod 0755 "$init_target" 2>/dev/null || true
+
+    export SU_DNS_OK="$work/dns_ok"
+    export SU_HTTP_OK="$work/http_ok"
+    export SU_GH_OK="$work/gh_ok"
+    export SU_DL_OK="$work/dl_ok"
+    export SU_PKG_OK="$work/pkg_ok"
+    export SU_INIT_LOG="$work/init.log"
+    export SU_INSTALL_LOG="$work/install.log"
+    export SU_INSTALLED_LIST="$work/installed.list"
+    export SU_LATEST_TAG="0.8.1"
+    # Version the fake opkg writes for "netshift" after a REAL (non-no-op)
+    # install, so the verify-after-install belt (task-041) sees the upgrade.
+    export SU_TARGET_INSTALLED_VER="0.8.1-r1"
+
+    local out="$work/out.json"
+    run_scenario() {
+        rm -f "$work/init.log" "$work/install.log"
+        PATH="$work/bin:/usr/bin:/bin" ash "$drv" > "$out" 2>/dev/null || true
+    }
+
+    # RU i18n NOT installed (so it is never downloaded/installed). The installed
+    # list starts with the OLD core version; a real install rewrites it.
+    printf 'netshift - 0.8.0-r1\n' > "$work/installed.list"
+
+    # ── Scenario 1: connectivity fails → abort BEFORE any change ──────────────
+    rm -f "$SU_DNS_OK" "$SU_HTTP_OK" "$SU_GH_OK" "$SU_DL_OK" "$SU_PKG_OK"
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    run_scenario
+    if jq -e '.success == false and (.message | length) > 0' "$out" > /dev/null 2>&1; then
+        pass "selfupdate-connfail-aborts-successfalse:OK"
+    else
+        fail "selfupdate-connfail-aborts-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # No install attempted (aborted before the core).
+    if [ ! -f "$work/install.log" ]; then
+        pass "selfupdate-connfail-no-install:OK"
+    else
+        fail "selfupdate-connfail-no-install:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+    # Epilogue restored the original resolv.conf (heal may have replaced it).
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfupdate-connfail-resolv-restored:OK"
+    else
+        fail "selfupdate-connfail-resolv-restored:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+
+    # ── Scenario 2: download fails → success:false, config backup intact ──────
+    : > "$SU_DNS_OK"; : > "$SU_HTTP_OK"; : > "$SU_GH_OK"
+    rm -f "$SU_DL_OK" "$SU_PKG_OK"
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    run_scenario
+    if jq -e '.success == false' "$out" > /dev/null 2>&1; then
+        pass "selfupdate-dlfail-successfalse:OK"
+    else
+        fail "selfupdate-dlfail-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # No package install ran (download failed first).
+    if [ ! -f "$work/install.log" ]; then
+        pass "selfupdate-dlfail-no-install:OK"
+    else
+        fail "selfupdate-dlfail-no-install:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+    # /etc/config/netshift untouched (download failed before any install).
+    if [ "$(cat "$work/etc-config-netshift" 2>/dev/null)" = "CONFIG-ORIG" ]; then
+        pass "selfupdate-dlfail-config-intact:OK"
+    else
+        fail "selfupdate-dlfail-config-intact:FAIL" "$(cat "$work/etc-config-netshift" 2>/dev/null)"
+    fi
+
+    # ── Scenario 3: happy path → success:true with version, restore ran ───────
+    # The fake opkg rewrites the installed list to the target after a real
+    # install, so the task-041 verify-after-install belt confirms the upgrade.
+    : > "$SU_DNS_OK"; : > "$SU_HTTP_OK"; : > "$SU_GH_OK"; : > "$SU_DL_OK"; : > "$SU_PKG_OK"
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    printf 'netshift - 0.8.0-r1\n' > "$work/installed.list"
+    run_scenario
+    if jq -e '.success == true and .version == "0.8.1"' "$out" > /dev/null 2>&1; then
+        pass "selfupdate-happy-successtrue-version:OK"
+    else
+        fail "selfupdate-happy-successtrue-version:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # Core + LuCI installed; RU i18n NOT (not installed) → exactly 2 installs.
+    if [ -f "$work/install.log" ] && [ "$(grep -c . "$work/install.log" 2>/dev/null)" = "2" ] \
+            && ! grep -q 'i18n' "$work/install.log" 2>/dev/null; then
+        pass "selfupdate-happy-core-luci-installed-no-ru:OK"
+    else
+        fail "selfupdate-happy-core-luci-installed-no-ru:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+    # Connectivity was fine → no teardown → resolv.conf untouched original.
+    if [ "$(cat "$work/resolv.conf" 2>/dev/null)" = "original-resolver" ]; then
+        pass "selfupdate-happy-resolv-untouched:OK"
+    else
+        fail "selfupdate-happy-resolv-untouched:FAIL" "$(cat "$work/resolv.conf" 2>/dev/null)"
+    fi
+    # Success cleanup: the download dir is removed.
+    if [ ! -d "$work/dl" ]; then
+        pass "selfupdate-happy-download-dir-cleaned:OK"
+    else
+        fail "selfupdate-happy-download-dir-cleaned:FAIL" "dl dir remains"
+    fi
+
+    # ── Scenario 4: already up to date (idempotent) → success:true, no install
+    : > "$SU_DNS_OK"; : > "$SU_HTTP_OK"; : > "$SU_GH_OK"; : > "$SU_DL_OK"; : > "$SU_PKG_OK"
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    export SU_LATEST_TAG="0.8.0"   # equals the pinned NETSHIFT_VERSION
+    run_scenario
+    export SU_LATEST_TAG="0.8.1"
+    if jq -e '.success == true and (.message | contains("up to date"))' "$out" > /dev/null 2>&1; then
+        pass "selfupdate-already-current-idempotent:OK"
+    else
+        fail "selfupdate-already-current-idempotent:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    if [ ! -f "$work/install.log" ]; then
+        pass "selfupdate-already-current-no-install:OK"
+    else
+        fail "selfupdate-already-current-no-install:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+
+    # ── Scenario 5: RU i18n IS installed → it is upgraded too (3 installs) ─────
+    : > "$SU_DNS_OK"; : > "$SU_HTTP_OK"; : > "$SU_GH_OK"; : > "$SU_DL_OK"; : > "$SU_PKG_OK"
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    printf 'netshift - 0.8.0-r1\nluci-i18n-netshift-ru - 0.8.0\n' > "$work/installed.list"
+    run_scenario
+    if [ -f "$work/install.log" ] && [ "$(grep -c . "$work/install.log" 2>/dev/null)" = "3" ] \
+            && grep -q 'i18n' "$work/install.log" 2>/dev/null; then
+        pass "selfupdate-ru-installed-upgraded:OK"
+    else
+        fail "selfupdate-ru-installed-upgraded:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+
+    # ── Scenario 6: opkg silent no-op (task-041) → success:false, config intact
+    # All connectivity/GitHub/download/PKG markers "ok" AND the install returns
+    # rc=0, but $SU_NOOP makes the fake opkg NOT change what list-installed
+    # reports (the core stays at the OLD version) — simulating opkg "Not
+    # downgrading"/"already installed". The verify-after-install belt must catch
+    # this and report success:false WITHOUT touching the config.
+    : > "$SU_DNS_OK"; : > "$SU_HTTP_OK"; : > "$SU_GH_OK"; : > "$SU_DL_OK"; : > "$SU_PKG_OK"
+    export SU_NOOP=1
+    printf 'CONFIG-ORIG\n' > "$work/etc-config-netshift"
+    printf 'original-resolver\n' > "$work/resolv.conf"
+    printf 'netshift - 0.8.0-r1\n' > "$work/installed.list"
+    run_scenario
+    unset SU_NOOP
+    # The worker MUST report success:false (the silent no-op is detected), NOT
+    # the false "updated" success it used to emit on rc=0.
+    if jq -e '.success == false' "$out" > /dev/null 2>&1; then
+        pass "selfupdate-noop-detected-successfalse:OK"
+    else
+        fail "selfupdate-noop-detected-successfalse:FAIL" "$(cat "$out" 2>/dev/null)"
+    fi
+    # The install was ATTEMPTED (rc=0) but the version never changed.
+    if [ -f "$work/install.log" ] && grep -q . "$work/install.log" 2>/dev/null; then
+        pass "selfupdate-noop-install-attempted:OK"
+    else
+        fail "selfupdate-noop-install-attempted:FAIL" "install.log=$(cat "$work/install.log" 2>/dev/null)"
+    fi
+    # Configuration preserved (verify-fail runs the defensive restore; nothing
+    # clobbered the live file).
+    if [ "$(cat "$work/etc-config-netshift" 2>/dev/null)" = "CONFIG-ORIG" ]; then
+        pass "selfupdate-noop-config-intact:OK"
+    else
+        fail "selfupdate-noop-config-intact:FAIL" "$(cat "$work/etc-config-netshift" 2>/dev/null)"
+    fi
+    # Download dir cleaned even on the no-op failure path.
+    if [ ! -d "$work/dl" ]; then
+        pass "selfupdate-noop-download-dir-cleaned:OK"
+    else
+        fail "selfupdate-noop-download-dir-cleaned:FAIL" "dl dir remains"
+    fi
+
+    : > "$work/installed.list"
+
+    # ── Restore the real init script (if any) and clean up. ──────────────────
+    if [ -n "$init_saved" ] && [ -e "$init_saved" ]; then
+        cp -p "$init_saved" "$init_target" 2>/dev/null || true
+    else
+        rm -f "$init_target" 2>/dev/null || true
+    fi
+    unset SU_DNS_OK SU_HTTP_OK SU_GH_OK SU_DL_OK SU_PKG_OK SU_INIT_LOG \
+        SU_INSTALL_LOG SU_INSTALLED_LIST SU_LATEST_TAG SU_TARGET_INSTALLED_VER SU_NOOP
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Test: core-swap backup integrity (task-027)
+# ─────────────────────────────────────────────────────────────────
+# Guards the on-hardware latent bug where a TRUNCATED tmpfs backup (busybox cp
+# under ENOSPC) could be restored over /usr/bin/sing-box, installing a
+# segfaulting core as the "safe" fallback. Drives the REAL sourced updater.sh:
+#   * updates_verify_copy        — size-match gate used right after the backup cp.
+#   * updates_backup_is_complete — size-match gate used before every rollback.
+#   * updates_stable_rollback    — must REFUSE to overwrite the live binary from
+#                                  a truncated backup (and DO restore a complete
+#                                  one), with UPDATES_SING_BOX_BIN pointed at a
+#                                  temp file so the container's real binary is
+#                                  never touched.
+# Asserts: (a) complete backup verifies OK; (b) truncated/missing backup is
+# detected (verify nonzero); (c) rollback does not clobber the live path from a
+# truncated backup but still restores from a complete one.
+test_backup_integrity() {
+    header "Core-swap Backup Integrity (task-027)"
+
+    local updater="${NETSHIFT_LIB_DIR}/updater.sh"
+    if [ ! -r "$updater" ]; then
+        skip "updater.sh not found in ${NETSHIFT_LIB_DIR}"
+        return
+    fi
+
+    local work="/tmp/netshift-backupguard-$$"
+    rm -rf "$work"
+    mkdir -p "$work"
+
+    # Driver: source updater.sh, silence logging, re-pin the live-binary paths to
+    # temp files, then run the verify helpers + the rollback guard. Each check
+    # echoes a name:OK / name:FAIL token. The driver runs to a result file which
+    # we parse in the CURRENT shell (no pipe) so the PASS/FAIL counters are exact.
+    local drv="$work/driver.sh"
+    cat > "$drv" << 'DRVEOF'
+log() { :; }
+echolog() { :; }
+nolog() { :; }
+updates_log() { :; }
+. "DRV_UPDATER"
+updates_log() { :; }
+
+W="DRV_WORK"
+
+# Fixtures: a "source" of 64 bytes, a COMPLETE copy, a TRUNCATED copy.
+src="$W/src.bin"
+complete="$W/complete.backup"
+truncated="$W/truncated.backup"
+dd if=/dev/zero of="$src" bs=1 count=64 >/dev/null 2>&1
+cp -p "$src" "$complete"
+dd if=/dev/zero of="$truncated" bs=1 count=10 >/dev/null 2>&1
+
+# ── (a) a complete backup verifies OK ──────────────────────────────────────
+if updates_verify_copy "$src" "$complete"; then
+    echo 'backupguard-verify-complete-ok:OK'
+else
+    echo 'backupguard-verify-complete-ok:FAIL'
+fi
+
+# ── (b1) a truncated backup is detected (verify nonzero) ────────────────────
+if updates_verify_copy "$src" "$truncated"; then
+    echo 'backupguard-verify-truncated-detected:FAIL'
+else
+    echo 'backupguard-verify-truncated-detected:OK'
+fi
+
+# ── (b2) a missing backup is detected (verify nonzero) ──────────────────────
+if updates_verify_copy "$src" "$W/does-not-exist.backup"; then
+    echo 'backupguard-verify-missing-detected:FAIL'
+else
+    echo 'backupguard-verify-missing-detected:OK'
+fi
+
+# ── (b3) absent source = nothing to back up = trivially OK ──────────────────
+if updates_verify_copy "$W/no-source" "$W/no-dst"; then
+    echo 'backupguard-verify-absent-source-ok:OK'
+else
+    echo 'backupguard-verify-absent-source-ok:FAIL'
+fi
+
+# ── backup-is-complete: size match / mismatch / missing ─────────────────────
+sz=$(wc -c < "$src")
+if updates_backup_is_complete "$complete" "$sz"; then
+    echo 'backupguard-iscomplete-match:OK'
+else
+    echo 'backupguard-iscomplete-match:FAIL'
+fi
+if updates_backup_is_complete "$truncated" "$sz"; then
+    echo 'backupguard-iscomplete-mismatch:FAIL'
+else
+    echo 'backupguard-iscomplete-mismatch:OK'
+fi
+if updates_backup_is_complete "$W/does-not-exist.backup" "$sz"; then
+    echo 'backupguard-iscomplete-missing:FAIL'
+else
+    echo 'backupguard-iscomplete-missing:OK'
+fi
+
+# ── (c) updates_stable_rollback must NOT clobber the live path from a
+#       TRUNCATED backup; it MUST restore from a COMPLETE one. ───────────────
+# Point the live paths at temp files holding a known-good "current" core so we
+# can detect whether the rollback overwrote them.
+UPDATES_SING_BOX_BIN="$W/live-sing-box"
+UPDATES_LIBCRONET_LIB="$W/live-libcronet.so"
+
+# --- truncated backup: rollback must REFUSE (live core left intact) ---
+printf 'LIVE-GOOD-CORE-INTACT-MARKER\n' > "$UPDATES_SING_BOX_BIN"
+trunc_backup="$W/rb-trunc.backup"
+dd if=/dev/zero of="$trunc_backup" bs=1 count=10 >/dev/null 2>&1
+# Record an expected size (64) that does NOT match the 10-byte truncated backup.
+updates_stable_rollback "$trunc_backup" "" "64" ""
+if grep -q 'LIVE-GOOD-CORE-INTACT-MARKER' "$UPDATES_SING_BOX_BIN" 2>/dev/null; then
+    echo 'backupguard-rollback-refuses-truncated:OK'
+else
+    echo 'backupguard-rollback-refuses-truncated:FAIL'
+fi
+# The truncated backup must NOT have been moved into place either.
+if [ -f "$trunc_backup" ]; then
+    echo 'backupguard-rollback-truncated-not-moved:OK'
+else
+    echo 'backupguard-rollback-truncated-not-moved:FAIL'
+fi
+
+# --- complete backup: rollback MUST restore it over the live path ---
+printf 'STALE-HALF-WRITTEN\n' > "$UPDATES_SING_BOX_BIN"
+good_backup="$W/rb-good.backup"
+printf 'RESTORED-PREVIOUS-GOOD-CORE\n' > "$good_backup"
+good_sz=$(wc -c < "$good_backup")
+updates_stable_rollback "$good_backup" "" "$good_sz" ""
+if grep -q 'RESTORED-PREVIOUS-GOOD-CORE' "$UPDATES_SING_BOX_BIN" 2>/dev/null; then
+    echo 'backupguard-rollback-restores-complete:OK'
+else
+    echo 'backupguard-rollback-restores-complete:FAIL'
+fi
+DRVEOF
+    sed -i "s|DRV_UPDATER|$updater|g;s|DRV_WORK|$work|g" "$drv"
+
+    local out="$work/out.txt"
+    ash "$drv" > "$out" 2>/dev/null || true
+
+    local line
+    while IFS= read -r line; do
+        case "$line" in
+            *:OK) pass "${line%:OK}" ;;
+            *:FAIL) fail "$line" "$(cat "$out" 2>/dev/null)" ;;
+        esac
+    done < "$out"
+
+    rm -rf "$work"
+}
+
+# ─────────────────────────────────────────────────────────────────
+# Main
+# ─────────────────────────────────────────────────────────────────
+main() {
+    printf "${BOLD}Netshift Evolution — Smoke Test Suite${NC}\n"
+    printf "Source: %s\n" "$NETSHIFT_SRC"
+    printf "OpenWrt: %s\n" "$(grep OPENWRT_RELEASE /etc/os-release 2>/dev/null | cut -d'"' -f2 || echo 'unknown')"
+    printf "Kernel: %s\n" "$(uname -r 2>/dev/null || echo 'unknown')"
+    printf "\n"
+
+    local target="${1:-all}"
+
+    case "$target" in
+        all)
+            test_deps
+            test_syntax
+            test_config
+            test_helpers
+            test_jq_helpers
+            test_config_manager
+            test_sing_box_config
+            test_nft
+            test_nft_ipv6
+            test_selective_marking
+            test_section_isolation
+            test_monitor_fd_hygiene
+            test_unsupported_skip
+            test_diagnostics
+            test_subscription
+            test_insecure_fetch
+            test_rejected_hash
+            test_jobstate
+            test_selfheal
+            test_dns_via_outbound
+            test_sub_url_option
+            test_global_proxy
+            test_check_update_stable
+            test_check_update_extended
+            test_check_update_netshift
+            test_netshift_latest_tag
+            test_github_redirect_tag
+            test_self_update_netshift
+            test_backup_integrity
+            ;;
+        deps)        test_deps ;;
+        syntax)      test_syntax ;;
+        config)      test_config ;;
+        helpers)     test_helpers ;;
+        nft)         test_nft ;;
+        nftv6)       test_nft_ipv6 ;;
+        selmark)     test_selective_marking ;;
+        isolation)   test_section_isolation ;;
+        monfd)       test_monitor_fd_hygiene ;;
+        unsupported) test_unsupported_skip ;;
+        diagnostics) test_diagnostics ;;
+        subscription) test_subscription ;;
+        insecure)    test_insecure_fetch ;;
+        rejected)    test_rejected_hash ;;
+        jobstate)    test_jobstate ;;
+        selfheal)    test_selfheal ;;
+        dnsdetour)   test_dns_via_outbound ;;
+        suburlopt)   test_sub_url_option ;;
+        globalproxy) test_global_proxy ;;
+        stablecheck) test_check_update_stable ;;
+        extcheck)    test_check_update_extended ;;
+        netshiftcheck) test_check_update_netshift ;;
+        latesttag)   test_netshift_latest_tag ;;
+        ghredirect)  test_github_redirect_tag ;;
+        selfupdate)  test_self_update_netshift ;;
+        backupguard) test_backup_integrity ;;
+        jq)          test_jq_helpers ;;
+        cm)          test_config_manager ;;
+        sb)          test_sing_box_config ;;
+        *)
+            echo "Unknown test: $target"
+            echo "Available: all deps syntax config helpers jq cm sb nft nftv6 selmark isolation monfd unsupported diagnostics subscription insecure rejected jobstate selfheal dnsdetour suburlopt globalproxy stablecheck extcheck netshiftcheck latesttag ghredirect selfupdate backupguard"
+            exit 1
+            ;;
+    esac
+
+    summary
+}
+
+main "$@"