v2.6.2.14: trusted tunnel — Connect honesty, CN/IR profiles, no false-green.

Align Android speedtest with live sing-box, require TUN path probes, add Iran/China presets and subscription mirrors; remove unused Sponsors badge.

Author: drmikecrypto

.github/FUNDING.yml

@@ -37,9 +37,21 @@ jobs:
       - name: Install Android workload
         run: dotnet workload install android
 
-      - name: Download Android Xray assets
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+
+      - uses: nttld/setup-ndk@v1
+        id: ndk
+        with:
+          ndk-version: r26d
+
+      - name: Download Android assets (patched sing-box required)
         shell: pwsh
-        run: ./scripts/package-android.ps1 -AllowUnpatchedSingBox
+        env:
+          ANDROID_NDK_HOME: ${{ steps.ndk.outputs.ndk-path }}
+        # D18 / PLAN: never allow stock libsingbox.so — TUN fd inheritance requires the patch.
+        run: ./scripts/package-android.ps1
 
       - name: Build Android
         run: dotnet build src/v2rayF.Android/v2rayF.Android.csproj -c Release -f net10.0-android

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: Release
 
+# Tag push (v*) publishes platform zips via softprops/action-gh-release.
+# body_path: docs/releases/<tag>.md
+
 on:
   push:
     tags:
@@ -61,10 +64,12 @@ jobs:
           echo "ANDROID_KEYSTORE_PATH=$RUNNER_TEMP/signing/v2rayf-release.jks" >> "$GITHUB_ENV"
 
       - uses: actions/setup-go@v5
+        if: matrix.android == true
         with:
           go-version: "1.23"
 
       - uses: nttld/setup-ndk@v1
+        if: matrix.android == true
         id: ndk
         with:
           ndk-version: r26d

.github/workflows/release.yml

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.6.2.14] - 2026-09-09
+
+### Added
+
+- Canonical product plan: `docs/PLAN.md` (trusted tunnel, Android-first)
+- Golden app matrix + UDP/QUIC messenger QA + exception-list shrink policy tips
+- Iran / China one-tap network profiles (Settings)
+- Android Private DNS conflict warning before Connect
+- sing-box Bypass China via geosite-cn / geoip-cn remote rule-sets (jsDelivr)
+- `AndroidTunLifecycle` state machine documentation for TUN fd lifecycle
+- GitHub/raw subscription mirror auto-retry + `docs/tips/subscription-mirrors.md`
+- Path truth line while Connected; scorecard template copy (Settings)
+- fa/zh Private DNS + battery tips
+
+### Changed
+
+- Android speedtest uses the same sing-box path as live Connect (D13)
+- Connect gate requires TUN app-path probe when TUN is active (no false-green)
+- Import hard-refuse messaging for SIP003 plugins and unsupported schemes
+- CI builds patched Android sing-box (no `-AllowUnpatchedSingBox`); release Go/NDK gated to Android (D18/D19)
+- Shrink messaging exact-host glue; keep FCM + Meta MQTT intentional lists
+- Battery exemption re-prompts after revoke (D14)
+- Desktop TUN requirement message honest on macOS/Linux
+- App Network hint explains GMS/GSF Direct as proven breaker, not generic glue
+- Remove GitHub Sponsors badge and FUNDING.yml until Sponsors is configured
+
 ## [2.6.2.13] - 2026-09-09
 
 ### Fixed

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Thank you for your interest in improving v2rayF!
 
+## Maintainer release gate
+
+**Do not push to GitHub or cut a public release** unless the project maintainer explicitly asks for a push/release. Local builds and private APK sideloads are fine. Product direction lives in [`docs/PLAN.md`](docs/PLAN.md).
+
 ## How to contribute
 
 1. **Fork** the repository on GitHub

CONTRIBUTING.md

@@ -27,7 +27,6 @@ HTTP/2 302  →  grab a zip. no brew. no store tax. MIT.
   <a href="https://github.com/drmikecrypto/v2rayF/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/drmikecrypto/v2rayF/ci.yml?branch=main&style=for-the-badge&label=ci&color=222222&labelColor=111111" alt="ci"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-222222?style=for-the-badge&labelColor=111111" alt="license"></a>
   <a href="https://github.com/drmikecrypto/v2rayF/stargazers"><img src="https://img.shields.io/github/stars/drmikecrypto/v2rayF?style=for-the-badge&color=222222&labelColor=111111" alt="stars"></a>
-  <a href="https://github.com/sponsors/drmikecrypto"><img src="https://img.shields.io/badge/sponsor-♥_keep_it_free-ea4aaa?style=for-the-badge&labelColor=111111" alt="sponsor"></a>
 </p>
 
 ---
@@ -202,7 +201,6 @@ One Avalonia tree across desktop+Android, explicit Sentinel leak profile, Secure
 ## contribute / legal
 
 - [CONTRIBUTING](CONTRIBUTING.md) · [bug](https://github.com/drmikecrypto/v2rayF/issues/new?template=bug_report.md) · [feature](https://github.com/drmikecrypto/v2rayF/issues/new?template=feature_request.md) · [SECURITY](SECURITY.md)
-- [Sponsor](https://github.com/sponsors/drmikecrypto) — keep v2rayF open source and free
 - MIT · ships [Xray-core](https://github.com/XTLS/Xray-core) + [sing-box](https://github.com/SagerNet/sing-box) in release artifacts (not in git)
 - UI: [Avalonia](https://avaloniaui.net/)
 

README.md

@@ -0,0 +1,92 @@
+# v2rayF PLAN — From glued client to trusted tunnel
+
+Single source of truth for product direction. Older notes in [`roadmap-engine-first.md`](roadmap-engine-first.md) point here.
+
+## Operating rules
+
+- GitHub push / public release only when the maintainer explicitly asks (authorized for **v2.6.2.14**).
+- Local builds, APK sideloads, and private testing are fine between releases.
+- North star: drop any valid config → **every app on the device** reaches the internet through that exit — not “browser works, Instagram Direct dies.”
+
+## Focus
+
+**Android-first** (Iran/China phones) for 3–6 months. Windows follows once Android full-tunnel QA passes. macOS/Linux TUN/kill-switch after that.
+
+## Success criteria (Connect green)
+
+Connect may show Connected only when:
+
+1. Core process is alive, and
+2. Local SOCKS probe passes, and
+3. On Android TUN sessions: TUN path probe passes (no false-green on HTTP-proxy-only paths).
+
+## Golden app matrix
+
+Same subscription, clean install, Private DNS **Off**. Mark pass/fail (not Mbps alone).
+
+| App | Check |
+|-----|--------|
+| Chrome | HTTPS page load |
+| Instagram | Feed + **Direct** (MQTT) |
+| WhatsApp | Chat send/receive |
+| Telegram | Chat + media |
+| YouTube | Video playback |
+| Maps | Load + search |
+| Play Services | FCM push arrives |
+| One UDP game / voice | Real-time UDP path |
+
+**Scorecard:** run v2rayF vs v2rayNG vs V2Box on the same phone and link; file results under private notes (do not commit credentials).
+
+## Phases
+
+### Phase 0 — Freeze the leak of trust
+
+- [x] Codify success criteria + golden matrix (this file)
+- [x] Scorecard process documented
+- [x] Release gate: maintainer approves every push
+
+### Phase 1 — One live engine on Android
+
+- [x] Android live Connect + latency/speedtest both prefer sing-box when `PreferSingBoxOnAndroid` (D13)
+- [x] TUN fd lifecycle documented as one state machine (`AndroidTunLifecycle` + rebind policy)
+- [x] CI / package-android: fail if unpatched sing-box in release path (D18)
+
+**Exit gate:** Instagram Direct + WhatsApp + Chrome on clean install without manual App Network tweaks.
+
+### Phase 2 — Full-tunnel correctness
+
+- [x] DNS: keep real UDP via proxy + IPv6 fail-closed; Private DNS conflict UX on Android
+- [x] Bypass China on sing-box via rule-sets (no longer silent Bypass LAN stub)
+- [x] IR / CN network presets (one-tap profiles)
+- [x] Prefer tunnel+DNS over growing exception lists; document shrink policy
+- [x] UDP/QUIC golden checks documented (manual scorecard)
+
+**Exit gate:** golden matrix green on IR-like and CN-like path (or lab equivalent).
+
+### Phase 3 — Config completeness
+
+- [x] Unsupported SIP003 / exotic plugins: hard refuse with reason (never silent “connected”)
+- [x] Unsupported schemes (Hysteria1, Naive, SSR, …) return refuse hints
+- [x] Subscription mirror hints + auto-retry for GitHub/raw (CN/IR)
+
+### Phase 4 — Desktop parity + innovation (after Android wins)
+
+- [x] Path truth UI (TUN / HTTP assist / Direct counts) while Connected
+- [x] Scorecard template export (Settings)
+- [x] Desktop TUN / kill-switch honesty on macOS/Linux (`TunRequirementMessage`)
+- Windows TUN reliability bar (ongoing)
+- Then UX / multipath / diagnostics (former “Phase C”)
+
+### Phase 5 — Distribution for CN/IR
+
+- [x] Sideload + in-app update primary (documented); subscription mirrors tip
+- [x] fa / zh tips (Private DNS, battery) — `docs/tips/fa-zh-connect.md`
+- [x] Battery exemption re-prompt after revoke (D14)
+- No Play Store dependency for core updates
+
+## What we will not do
+
+- One-off domain/package patches without a golden-matrix failure and a removal plan
+- UX redesign as a substitute for tunnel correctness
+- iOS before Android full-tunnel bar
+- Silent Survive / traffic rewrite without consent

docs/PLAN.md

@@ -1,18 +1,18 @@
 # Backlog — v2.6.2.14 hygiene (deferred from defect audit)
 
-Tracked from the 2.6.2.12 audit; **not** in 2.6.2.13.
+Tracked from the 2.6.2.12 audit. Items marked **done** landed with the trusted-tunnel PLAN work.
 
-| ID | Finding | Fix |
-|----|---------|-----|
-| D12 | Connected ignores TUN and SetHttpProxy OEM failure | StatusText weak proxy/TUN; re-show HTTP proxy warning |
-| D13 | Android speedtest = Xray; live = sing-box | Speedtest use PreferSingBox path on Android |
-| D14 | Battery exemption never re-prompts after revoke | Clear prompt flag when OS still optimizing |
-| D15 | StatusSanitizer misses hy2/tuic/anytls/wg and logcat dumps | Extend schemes + scrub |
-| D16 | tip/desktop docs TunOnlyFailThreshold 2 vs code 6 | Living tips → 6 |
-| D17 | `Defaults_SurviveAndDoH_Off` misnamed | Rename |
-| D18 | CI `-AllowUnpatchedSingBox` | Build patched lib or fail if stock |
-| D19 | Release workflow installs Go/NDK on all RIDs | Gate `if: matrix.android` |
-| D20 | `SECURITY.md` still 1.4.x | Support 2.6.x; Sponsors/advisories contact |
-| D21 | `llms.txt` 1.4 / ProcessBuilder stale | Align DualCore 2.6.x |
-| D22 | Version scattered in 4 csproj | Optional Directory.Build.props + CI assert |
-| D23 | Local `dist/` / `.tools/` junk | `scripts/clean-artifacts.ps1` only |
+| ID | Finding | Fix | Status |
+|----|---------|-----|--------|
+| D12 | Connected ignores TUN and SetHttpProxy OEM failure | StatusText weak proxy/TUN; re-show HTTP proxy warning | open |
+| D13 | Android speedtest = Xray; live = sing-box | Speedtest use PreferSingBox path on Android | **done** |
+| D14 | Battery exemption never re-prompts after revoke | Clear prompt flag when OS still optimizing | **done** |
+| D15 | StatusSanitizer misses hy2/tuic/anytls/wg and logcat dumps | Extend schemes + scrub | open |
+| D16 | tip/desktop docs TunOnlyFailThreshold 2 vs code 6 | Living tips → 6 | open |
+| D17 | `Defaults_SurviveAndDoH_Off` misnamed | Rename | open |
+| D18 | CI `-AllowUnpatchedSingBox` | Build patched lib or fail if stock | **done** |
+| D19 | Release workflow installs Go/NDK on all RIDs | Gate `if: matrix.android` | **done** |
+| D20 | `SECURITY.md` still 1.4.x | Support 2.6.x; Sponsors/advisories contact | open |
+| D21 | `llms.txt` 1.4 / ProcessBuilder stale | Align DualCore 2.6.x | open |
+| D22 | Version scattered in 4 csproj | Optional Directory.Build.props + CI assert | open |
+| D23 | Local `dist/` / `.tools/` junk | `scripts/clean-artifacts.ps1` only | open |

docs/backlog-2.6.2.14.md

@@ -0,0 +1,26 @@
+# v2.6.2.14
+
+Trusted-tunnel reliability release — Android full-tunnel honesty, CN/IR presets, no false-green Connect.
+
+### Added
+
+- `docs/PLAN.md` — product north star (Android-first trusted tunnel)
+- Iran / China / Sentinel one-tap network profiles
+- Path truth line while Connected; scorecard template copy
+- Private DNS conflict warning (Android); fa/zh Private DNS + battery tips
+- Subscription GitHub/raw mirror auto-retry for CN/IR
+- sing-box Bypass China via geosite-cn / geoip-cn (jsDelivr)
+
+### Changed
+
+- Android speedtest uses the same sing-box path as live Connect (D13)
+- Connect requires SOCKS + TUN app-path (no false-green)
+- CI requires patched Android sing-box (D18); release Go/NDK only on Android (D19)
+- Battery exemption re-prompts after revoke (D14)
+- Desktop TUN/kill-switch honesty on macOS/Linux
+- Hard refuse for SIP003 plugins / unsupported schemes
+- Remove unused GitHub Sponsors badge (no Sponsors account yet)
+
+### Install
+
+Sideload the platform zip from this release. Android: prefer in-app Update, or uninstall→install if signature changed.

docs/releases/v2.6.2.14.md

@@ -1,16 +1,10 @@
-# Engine-first roadmap (Beat V2Box)
+# Engine-first roadmap
 
-Shipped through **v2.2.2**:
+**Canonical plan:** [`PLAN.md`](PLAN.md) — trusted tunnel, Android-first for CN/IR, no GitHub push until maintainer approval.
 
-- Phase A: default DoH for Connect + DoH retry — **kept**. Speedtest DNS stays UDP (v2.2.1; DoH-in-speedtest caused universal timeouts).
-- Phase B: Android classic on sing-box TUN (`stack: system`) — **re-enabled in v2.2.2** for Instagram Direct / raw-socket apps; keeps v2.2.1 speedtest safeguards. Desktop classic stays Xray. Hy2/TUIC/WG remain on sing-box.
+Shipped through v2.2.2 (kept):
 
-## Phase C (not in this release)
+- Phase A: default DoH for Connect + DoH retry. Speedtest DNS stays UDP.
+- Phase B: Android classic on sing-box TUN; desktop classic on Xray; Hy2/TUIC/WG on sing-box.
 
-Track separately once head-to-head Mbps vs V2Box on the same subscription links is competitive:
-
-1. Visual / UX system (brand, motion, hierarchy — not default Avalonia panels)
-2. Multi-path / bonding aggregation (SpeedyFi-like) only after single-link engine wins
-3. Onboarding + diagnostics that show path RTT vs Mbps honestly
-
-Do not start Phase C as a substitute for engine parity.
+Former “Phase C” (UX / multipath / diagnostics) stays deferred until single-link engine + golden app matrix meet [`PLAN.md`](PLAN.md) exit gates.