- Preserve raw Cloudflare subnets in community-subnets-discord.lst in updates.uc instead of destructive deletion.
- In singbox/generator_routes.uc:
* Exclude Cloudflare Anycast CIDRs from general IP route rules (preventing web hijacking).
* Generate a dedicated Discord Voice route rule for Cloudflare subnets scoped to network: 'udp' and voice port ranges (50000-65535, 3478, 19302, 5000-5020).
* Provide DEFAULT_DISCORD_VOICE_SUBNETS fallback in core/ip.uc.
- In nft/apply.uc:
* Route Cloudflare subnets to ip_ports set with Discord voice ports (5000-5020, 3478, 19302, 50000-65535).
* Automatically enable ip_port rules when section has community_subnets for Discord.
- In section.js (Routing Rule Tracer):
* Filter out Cloudflare subnets when resolving domain web traffic to Discord community subnets.
* Accurately display voice UDP routing notice for Anycast ranges.
- Update tests/community_subnets_sanitization.sh with voice UDP and sing-box validation.
Fixes regression from 1.3.25 where section mixed proxy inbounds lost internet access due to missing DNS hijacking and missing private IP bypass, and suppresses noisy log warnings during service restart/update.
- Unblock devices when admin increases daily_quota_minutes in parental_quota.uc
- Unblock devices removed from active quota schedules and flush sets on disable
- Ignore target != 'all' schedules in parental_quota.uc screen-time dropper
- Do not suppress domain DNS reject or nft redirect rules when quota is set
- Run parental_quota.uc tick on service start and reload for instant sync
- Add target:all dependency to daily_quota_minutes in LuCI parental view
- Add tests in content_blocking.sh and parental_control.sh
- Fix#52: Watchdog proxy restart on single URL failure:
* Validate failure against secondary independent probe URL before declaring proxy down
* Skip restart when direct WAN is also degraded or down (!direct_ok)
* Implement 120s cooldown between automated proxy restarts
* Fix Telegram notification to accurately state 'Перезапуск sing-box' instead of 'Перезапуск роутера'
- Fix#51: Telegram bot spamming WAN up/down notifications:
* Filter hotplug events strictly by badwan_monitored_interfaces (defaults to wan)
* Add atomic directory lock with debounce delay and real ubus state query
* Prevent repeated notifications when interface state has not transitioned
- Feat: 2-VPN deadlock elimination & self-download subscription proxy:
* Isolate unbootstrapped dependent subscription sections on initial boot (deferred_sections)
* Allow self-download proxy target for subscriptions with explicit UI hint '(текущее правило при активности)'
* Enable automatic local proxy fallback for subscription refresh when direct WAN download fails while sing-box is active
* Add regression test in tests/subscription_bootstrap_deadlock.sh
- Fix: Parental control quota enforcement:
* Correct route rule filtering when daily quota minutes are exhausted without a fixed time interval
- i18n & Version bump:
* Bump fe-app-tachyon to 1.3.26 and update Russian PO/POT translations
- Fix -1ms badge and green coloring in dashboard sections when node latency check fails or returns -1
- Handle Clash API group delay responses properly in dashboard single and batch latency tests
- Target active outbound node in diagnostics outbounds check instead of group tag to prevent router timeout
- Add nslookup fallback in country.uc resolve_service_host and retain system DNS resolution
- Ensure flag emoji country deduction acts as fallback in URLTest groups when exclude_countries is specified
- Ignore processes in container network namespaces when diagnosing system port 53 / DNS conflicts for AdGuardHome
- Bump fe-app-tachyon version to 1.3.25 and rebuild LuCI bundle
- Fix#50: Discord community subnets hijacking Cloudflare Anycast traffic:
* Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
* Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
* Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
* Add unit tests in tests/community_subnets_sanitization.sh.
- Fix#51: Telegram bot spamming WAN up/down notifications on hotplug:
* Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
* Add background debounce with atomic directory locking and ubus interface status verification.
* Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
* Preserve retry_start_on_wan_up behavior on ifup.
* Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.
- fix(singbox): fix http_clients[0].detour field name (was incorrectly dial_detour, causing fatal decode config unknown field error on sing-box 1.14+)
- fix(ui): rename community list 'Block' to 'Block (RKN)' / 'Реестр РКН' in DOMAIN_LIST_OPTIONS and PO catalogs to prevent confusion with parental control action 'Блокировать'
- fix(ui): fix domain hint for adult content to pornhub.com in section.js
- test(ruleset): update http_clients detour check in ruleset_download_detour.sh
- fix(zapret2): add safe_str fallback and avoid default --filter-tcp=443 injection on UDP rules in prepare_strategy_args()
- fix(providers): make individual rule failures non-fatal in start_runtime() so one bad rule does not rollback all running rules
- fix(binaries): dynamic candidate resolution for nfqws and nfqws2 across standard OpenWrt and custom paths (/opt/zapret2/nfq2, /opt/zapret2/nfq, /opt/zapret2, /usr/bin)
- fix(nft): add raw_output notrack chain and mangle_output/forward counter return rules for desync marks (0x40000000, 0x20000000) and musl/nobody skuid (2147483647, 65534) to prevent EPERM rawsend failure on reload
- fix(reload): ensure nft_rebuild is triggered on zapret and zapret2 runtime updates
- fix(singbox): reject mieru outbounds from rule_set download_detour and http_clients dial_detour to prevent fatal startup crash loop
- fix(singbox): detect sing-box 1.14+ and omit deprecated download_detour on remote rule-sets when http_clients is active
- fix(action): pre-seed /etc/config/zapret2 with enabled=0 via core.uci before package install to prevent conflicting upstream daemon startup
- test(ruleset): add verification tests for mieru download_detour and dial_detour rejection
- providers/zapret2/common.uc: import core.common and declare as_string helper to resolve type error during zapret2 strategy argument preparation.
- service/snapshot.uc: redirect command output to /dev/null in command_success_from_args to prevent stdout leakage breaking LuCI JSON parsing on snapshot restore.
- settings.js: robustly parse JSON from snapshot command output using regex delimiter.
- components/action.uc: add --force-depends to opkg install arguments, detect opkg lock contention and retry with backoff, and log non-zero exit stdout as warning.
- providers/nfqueue/runtime.uc: ensure standalone services are cleanly stopped and disabled before starting Tachyon-managed runtime.
- section.js, generator_routes.uc, apply.uc: add community_subnets option to conditionally include community CIDRs in routing and nftables.
- Bundle universal 17-byte empty SRS stub and add is_valid_srs_file/ensure_empty_srs_stub in rulesets.uc
- Add prepare_community_rulesets in lifecycle.uc to pre-fetch via gh-proxy mirrors or initialize safe local stub before sing-box start
- Support local community rulesets and stubs in generator_routes.uc
- Add fallback to component proxy for list downloads in updates.uc and preserve cached stubs
- Skip non-functional jsdelivr for release downloads and prioritize gh-proxy mirrors in core/url.uc
- Add tests/cold_boot_community_stub.sh testing cold boot fallback behavior
- Ensure selector and urltest groups require all member outbounds to support UDP
- Add explicit reject rule for UDP on non-UDP outbounds to avoid sing-box router log spam
- Add http/s:// to connection URL description in LuCI settings and update localization
- Display transport protocol badges on dashboard outbound cards and modal rows
- Deduplicate and collapse UDP routing error lines in telegram logs and bug report
- subscription: детерминированная сортировка аутбаундов при расчете сигнатуры кэша (защита от перезапусков при shuffle)
- dns: порог последовательных ошибок dns_failover_failure_threshold (защита от флаппинга)
- singbox: выделенный direct_bypass inbound (mixed port 2080) для прямого выхода устройств в обход TPROXY
- torrserver: автоматический bypass cgroups v2 services/torrserver прямо в WAN
- zapret: нормализация устаревших параметров conntrack --ctrack-timeouts
- ui: интеграция управления службами TorrServer Direct и Direct Proxy в LuCI
- tests: новые тесты subscription_order_independence и direct_bypass_torrserver
- backend: добавлены команды list_update_async и list_update_status с отслеживанием шагов в /var/run/tachyon/list-update.status
- ui: кнопка ручного обновления списков теперь запускает операцию в фоне, показывает модалку с индикатором и опрашивает статус (устранен таймаут LuCI XHR в 30 сек)
- json: sing-box config.json теперь форматируется с отступами в 2 пробела (sprintf '%.2J') для удобства чтения
- tests: обновлены тесты и добавлены проверки для list-update-status (122/122 passed)
- singbox/generator_routes.uc: восстановлена маршрутизация IP-подсетей сервисов в ip_cidr, добавлены сиды для холодного старта
- nft/apply.uc: наполнение sets.subnets сидами подсетей Discord и Telegram до первой загрузки .lst
- components/updates.uc: автоматический reload ядра Sing-box после фонового list_update при обновлении ruleset
- diagnostics/fuzzer.uc: учет объема скачанных данных, детектирование троттлинга DPI 16KB и вердикты проходимости
- fe-app-tachyon: отображение статусов верификации данных и DPI вердиктов в UI фаззера
- Исправлена совместимость с Official (1.13.x), Tiny, LX и Extended ядрами sing-box
- Устранена фатальная ошибка unknown field store_dns на sing-box 1.13.x (автоопределение store_rdrc vs store_dns)
- Добавлена плавная деградация в runtime при неподдерживаемых параметрах cache_file и неизвестных транспортах
- Разделены правила маршрутизации доменов/наборов правил и IP CIDR, устраняя конфликт логики AND в sing-box 1.14+
- Исключены подсети общих CDN (Cloudflare, CloudFront, Hetzner, OVH, DigitalOcean) из nftables L4 для предотвращения перехвата сторонних ресурсов (включая Discord) вышестоящими секциями
- Обеспечено строгое соблюдение порядка следования секций сверху вниз во всех конфигурациях
All Go runtime tuning (GOMEMLIMIT, GOGC, GOMAXPROCS) caused more harm
than good — GC thrashing increased both CPU usage and memory consumption.
Go's default GC with GODEBUG=madvdontneed=1 is already optimal for
sing-box on OpenWrt. sing-box uses ~380MB RSS with 130+ outbounds on
a 2GB device, which is normal and expected.
Removed:
- GOMEMLIMIT (caused GC thrashing, 91% CPU)
- GOGC (aggressive values caused CPU spikes)
- GOMAXPROCS (unnecessary, Go handles this)
- mem_scale file (no longer needed)
- Adaptive memory scaling logic
Kept: GODEBUG=madvdontneed=1 only.
rtk git push origin main
- GOMEMLIMIT: remove 256MB RAM threshold cap. Now applies to ALL
devices. Formula: min(35% RAM, 512MB). mem_scale respected.
Fixes sing-box eating 500MB+ on 2GB routers with no limit.
- Cascade delete: when a routing section is deleted, child UCI entries
(subscription_url, urltest, priority_group, priority_level,
section_interface) are now removed. Prevents orphaned entries that
corrupt config generation.
- Migration cleanup: orphan_section_interfaces now cleans ALL child
types, not just section_interface.
- Watchdog logread: kill orphans in stop_runtime(), add SIGTERM/SIGINT
handlers in uloop mode (previously only in fallback mode).
- priority.uc: replace 1s tight sleep loop with dynamic interval based on group config (5s default)
- dns_failover.uc: replace 1s sleep with min(active_interval, recovery_interval)
- watchdog.uc: cap pending_smart_domains at 500 entries, add 300s TTL expiry
- event_controller.uc: batch is_dns_working nslookup calls into single shell process
- byedpi/runtime.uc: add crash-loop backoff (up to 6x base delay after 5 rapid crashes)
- nfqueue/runtime.uc: same crash-loop backoff for nfqws supervisors
Dushnilin