- decouple restart() from stop_impl() in lifecycle.uc to avoid premature dnsmasq_restore
- keep dhcp.@dnsmasq[0].server locked to 127.0.0.42 throughout service restarts
- add atomic restart_service hooks in init.d/tachyon and initd.uc
- fix dns_turbo_cache path resolution to promote default cache to /etc/sing-box/cache.db
- add Local DNS Cache support in dnsmasq (dns_local_cache, dns_cache_size)
- add comprehensive behavioral regression test tests/service_restart_lifecycle.sh
- Feat(ui): implement adaptive polling in runtimeUiState service (1s -> 2s during active tasks, 10s idle)
- Perf(controller): cache settings snapshot in current_tick_ctx across all probe setting() calls to eliminate repeated uci_core.get_all()
- Perf(controller): reuse ctx.proxy_port in probe_proxy to eliminate duplicate proxy_port() evaluation
- Perf(watchdog): guard adaptive_normal_interval behind 120s check and clear tick context at tick boundary
- Test: add static and behavioral assertions in tests/watchdog_adaptive_intervals.sh
- Perf(watchdog): Adaptive external health checks for proxy (30s) and DNS (60s)
* Honor UCI ai_proxy_health_interval and ai_dns_interval while healthy
* Adapt to fast retry (10-15s) upon consecutive failures, instant post-heal reset
* Single shared observation context (tick_context) per tick eliminating redundant pgrep/proc scans
* Throttle watchdog keepalive file writes from 5s to 30s
- Perf(ui): Read-only fast path for get_ui_state
* Decouple refresh_action_dirs() filesystem GC from 500ms polling requests
* Throttle action directory cleanup to once per 30s via /var/run stamp
* Trigger immediate GC sweep on action job completion
- Perf(telegram): Long-poll 50s and eliminate redundant sleep after success
* Increase getUpdates long-poll timeout to 50s (curl timeout 65s)
* Remove redundant sleep after successful poll for instant command responsiveness
- Perf(torrserver): Cache detected PID and replace shell sleep with native ucode sleep(60000)
- Fix(singbox): Remove harmful hijack-dns rules from mixed proxy inbounds
* Eliminate hijack-dns (port 53 / protocol dns) from section, direct bypass and service mixed proxies
* Resolve 4-5s curl timeouts on component updates (api.github.com) and slow LAN DNS resolution
* Maintain ip_is_private: true direct LAN routing bypass
- Test: Add tests/watchdog_adaptive_intervals.sh and update tests/sing_box_runtime.sh
- Version: Bump fe-app-tachyon to 1.3.27
Replace brittle grep | head pipelines with assert_contains and direct grep flags to prevent pipefail SIGPIPE exit code 141 in OpenWrt container test runs.
- Preserve raw Cloudflare subnets in community-subnets-discord.lst in updates.uc instead of destructive deletion.
- In singbox/generator_routes.uc:
* Exclude Cloudflare Anycast CIDRs from general IP route rules (preventing web hijacking).
* Generate a dedicated Discord Voice route rule for Cloudflare subnets scoped to network: 'udp' and voice port ranges (50000-65535, 3478, 19302, 5000-5020).
* Provide DEFAULT_DISCORD_VOICE_SUBNETS fallback in core/ip.uc.
- In nft/apply.uc:
* Route Cloudflare subnets to ip_ports set with Discord voice ports (5000-5020, 3478, 19302, 50000-65535).
* Automatically enable ip_port rules when section has community_subnets for Discord.
- In section.js (Routing Rule Tracer):
* Filter out Cloudflare subnets when resolving domain web traffic to Discord community subnets.
* Accurately display voice UDP routing notice for Anycast ranges.
- Update tests/community_subnets_sanitization.sh with voice UDP and sing-box validation.
Fixes regression from 1.3.25 where section mixed proxy inbounds lost internet access due to missing DNS hijacking and missing private IP bypass, and suppresses noisy log warnings during service restart/update.
- Unblock devices when admin increases daily_quota_minutes in parental_quota.uc
- Unblock devices removed from active quota schedules and flush sets on disable
- Ignore target != 'all' schedules in parental_quota.uc screen-time dropper
- Do not suppress domain DNS reject or nft redirect rules when quota is set
- Run parental_quota.uc tick on service start and reload for instant sync
- Add target:all dependency to daily_quota_minutes in LuCI parental view
- Add tests in content_blocking.sh and parental_control.sh
- Fix#52: Watchdog proxy restart on single URL failure:
* Validate failure against secondary independent probe URL before declaring proxy down
* Skip restart when direct WAN is also degraded or down (!direct_ok)
* Implement 120s cooldown between automated proxy restarts
* Fix Telegram notification to accurately state 'Перезапуск sing-box' instead of 'Перезапуск роутера'
- Fix#51: Telegram bot spamming WAN up/down notifications:
* Filter hotplug events strictly by badwan_monitored_interfaces (defaults to wan)
* Add atomic directory lock with debounce delay and real ubus state query
* Prevent repeated notifications when interface state has not transitioned
- Feat: 2-VPN deadlock elimination & self-download subscription proxy:
* Isolate unbootstrapped dependent subscription sections on initial boot (deferred_sections)
* Allow self-download proxy target for subscriptions with explicit UI hint '(текущее правило при активности)'
* Enable automatic local proxy fallback for subscription refresh when direct WAN download fails while sing-box is active
* Add regression test in tests/subscription_bootstrap_deadlock.sh
- Fix: Parental control quota enforcement:
* Correct route rule filtering when daily quota minutes are exhausted without a fixed time interval
- i18n & Version bump:
* Bump fe-app-tachyon to 1.3.26 and update Russian PO/POT translations
- Replace invalid POSIX non-capturing group in diagnostics/runtime.uc with standard POSIX ERE pattern.
- Harden 99-tachyon-wan-monitor with stale PID directory lock cleanup and dynamic badwan_reload_delay support.
- Make is_cloudflare_shared_cidr in core/ip.uc case-insensitive.
- Add default wan to badwan_monitored_interfaces in settings.js.
- Fix#50: Discord community subnets hijacking Cloudflare Anycast traffic:
* Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
* Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
* Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
* Add unit tests in tests/community_subnets_sanitization.sh.
- Fix#51: Telegram bot spamming WAN up/down notifications on hotplug:
* Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
* Add background debounce with atomic directory locking and ubus interface status verification.
* Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
* Preserve retry_start_on_wan_up behavior on ifup.
* Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.
- fix(singbox): fix http_clients[0].detour field name (was incorrectly dial_detour, causing fatal decode config unknown field error on sing-box 1.14+)
- fix(ui): rename community list 'Block' to 'Block (RKN)' / 'Реестр РКН' in DOMAIN_LIST_OPTIONS and PO catalogs to prevent confusion with parental control action 'Блокировать'
- fix(ui): fix domain hint for adult content to pornhub.com in section.js
- test(ruleset): update http_clients detour check in ruleset_download_detour.sh
- fix(zapret2): add safe_str fallback and avoid default --filter-tcp=443 injection on UDP rules in prepare_strategy_args()
- fix(providers): make individual rule failures non-fatal in start_runtime() so one bad rule does not rollback all running rules
- fix(binaries): dynamic candidate resolution for nfqws and nfqws2 across standard OpenWrt and custom paths (/opt/zapret2/nfq2, /opt/zapret2/nfq, /opt/zapret2, /usr/bin)
- fix(nft): add raw_output notrack chain and mangle_output/forward counter return rules for desync marks (0x40000000, 0x20000000) and musl/nobody skuid (2147483647, 65534) to prevent EPERM rawsend failure on reload
- fix(reload): ensure nft_rebuild is triggered on zapret and zapret2 runtime updates
- fix(singbox): reject mieru outbounds from rule_set download_detour and http_clients dial_detour to prevent fatal startup crash loop
- fix(singbox): detect sing-box 1.14+ and omit deprecated download_detour on remote rule-sets when http_clients is active
- fix(action): pre-seed /etc/config/zapret2 with enabled=0 via core.uci before package install to prevent conflicting upstream daemon startup
- test(ruleset): add verification tests for mieru download_detour and dial_detour rejection
Dushnilin