Merge 06eb112efd into 877d16659e

Harden overload auth scans and masking safeguards
2026-06-19 09:21:10 +03:00 · 2026-04-09 19:45:54 +03:00 · 2026-04-09 03:45:08 +03:00
79 changed files with 5523 additions and 11790 deletions
@@ -1,16 +0,0 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-polar: # Replace with a single Polar username
-buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
-thanks_dev: # Replace with a single thanks.dev username
-custom:
-  - https://nowpayments.io/donation?api_key=2bf1afd2-abc2-49f9-a012-f1e715b37223
@@ -3,39 +3,50 @@
 ## Purpose

 **Telemt exists to solve technical problems.**
- Telemt is open to contributors who want to learn, improve and build meaningful systems together.
- It is a place for building, testing, reasoning, documenting, and improving systems.
- Discussions that advance this work are in scope, discussions that divert it are not.
- Technology has consequences, responsibility is inherent.

-> **Absicht bestimmt die Form**
+Telemt is open to contributors who want to learn, improve and build meaningful systems together.

-> Design follows intent
+It is a place for building, testing, reasoning, documenting, and improving systems.
+
+Discussions that advance this work are in scope. Discussions that divert it are not.
+
+Technology has consequences. Responsibility is inherent.
+
+> **Zweck bestimmt die Form.**
+
+> Purpose defines form.

 ---

 ## Principles

 * **Technical over emotional**
-  - Arguments are grounded in data, logs, reproducible cases, or clear reasoning.
+
+  Arguments are grounded in data, logs, reproducible cases, or clear reasoning.

 * **Clarity over noise**
-  - Communication is structured, concise, and relevant.
+
+  Communication is structured, concise, and relevant.

 * **Openness with standards**
-  - Participation is open. The work remains disciplined.
+
+  Participation is open. The work remains disciplined.

 * **Independence of judgment**
-  - Claims are evaluated on technical merit, not affiliation or posture.
+
+  Claims are evaluated on technical merit, not affiliation or posture.

 * **Responsibility over capability**
-  - Capability does not justify careless use.
+
+  Capability does not justify careless use.

 * **Cooperation over friction**
-  - Progress depends on coordination, mutual support, and honest review.
+
+  Progress depends on coordination, mutual support, and honest review.

 * **Good intent, rigorous method**
-  - Assume good intent, but require rigor.
+
+  Assume good intent, but require rigor.

 > **Aussagen gelten nach ihrer Begründung.**

@@ -57,9 +68,7 @@ Participants are expected to:

 Precision is learned.

- New contributors are welcome
- They are expected to grow into these standards
- Existing contributors are expected to make that growth possible
+New contributors are welcome. They are expected to grow into these standards. Existing contributors are expected to make that growth possible.

 > **Wer behauptet, belegt.**

@@ -103,7 +112,7 @@ Security is both technical and behavioral.

 ---

-## Openness
+## 6. Openness

 Telemt is open to contributors of different backgrounds, experience levels, and working styles.

@@ -139,9 +148,10 @@ Judgment should be exercised with restraint, consistency, and institutional resp

 All decisions are expected to serve the durability, clarity, and integrity of Telemt.

-> **Klarheit vor Zustimmung - Bestand vor Beifall**
+> **Ordnung ist Voraussetzung der Funktion.**
+
+> Order is the precondition of function.

-> Clarity above approval - substantiality before success
 ---

 ## Enforcement
@@ -161,41 +171,42 @@ Actions are taken to maintain function, continuity, and signal quality.

 ## Final

-**Telemt is built on discipline, structure, and shared intent**
- Signal over noise
- Facts over opinion
- Systems over rhetoric
- Work is collective
- Outcomes are shared
- Responsibility is distributed
- Precision is learned
- Rigor is expected
- Help is part of the work
+Telemt is built on discipline, structure, and shared intent.
+- Signal over noise.
+- Facts over opinion.
+- Systems over rhetoric.

-> **Ordnung ist Voraussetzung der Freiheit**
+- Work is collective.
+- Outcomes are shared.
+- Responsibility is distributed.

- If you contribute — contribute with care
- If you speak — speak with substance
- If you engage — engage constructively
+- Precision is learned.
+- Rigor is expected.
+- Help is part of the work.
+
+> **Ordnung ist Voraussetzung der Freiheit.**
+
+- If you contribute — contribute with care.
+- If you speak — speak with substance.
+- If you engage — engage constructively.

 ---

 ## After All

-Systems outlive intentions
- What is built will be used
- What is released will propagate
- What is maintained will define the future state
+Systems outlive intentions.
+- What is built will be used.
+- What is released will propagate.
+- What is maintained will define the future state.

-There is no neutral infrastructure, only infrastructure shaped well or poorly
+There is no neutral infrastructure, only infrastructure shaped well or poorly.

-> **Ordnung → Umsetzung → Ergebnis**
+> **Jedes System trägt Verantwortung.**

-> Order → Implementation → Result
+> Every system carries responsibility.

- Stability requires discipline
- Freedom requires structure
- Trust requires honesty
-
-In the end: the system reflects its contributors
+- Stability requires discipline.
+- Freedom requires structure.
+- Trust requires honesty.

+In the end: the system reflects its contributors.
@@ -2780,7 +2780,7 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"

 [[package]]
 name = "telemt"
-version = "3.4.0"
+version = "3.3.39"
 dependencies = [
 "aes",
 "anyhow",
@@ -1,6 +1,6 @@
 [package]
 name = "telemt"
-version = "3.4.0"
+version = "3.3.39"
 edition = "2024"

 [features]
@@ -1,33 +1,31 @@
 # Telemt - MTProxy on Rust + Tokio

-![Latest Release](https://img.shields.io/github/v/release/telemt/telemt?color=neon) ![Stars](https://img.shields.io/github/stars/telemt/telemt?style=social) ![Forks](https://img.shields.io/github/forks/telemt/telemt?style=social) [![Telegram](https://img.shields.io/badge/Telegram-Chat-24a1de?logo=telegram&logoColor=24a1de)](https://t.me/telemtrs)
-
-[🇷🇺 README на русском](https://github.com/telemt/telemt/blob/main/README.ru.md)
-
 ***Löst Probleme, bevor andere überhaupt wissen, dass sie existieren*** / ***It solves problems before others even realize they exist***

 > [!NOTE]
 >
-> Fixed TLS ClientHello is now available in official clients for Desktop / Android / iOS
+> Fixed TLS ClientHello is now available:
+> - in **Telegram Desktop** starting from version **6.7.2**
+> - in **Telegram Android Client** starting from version **12.6.4**
+> - **release for iOS is "work in progress"**
 >
 > To work with EE-MTProxy, please update your client!

 <p align="center">
  <a href="https://t.me/telemtrs">
-    <img src="/docs/assets/telegram_button.svg" width="150"/>
+    <img src="/docs/assets/telegram_button.svg" width="200"/>
  </a>
 </p>

-**Telemt** is a fast, secure, and feature-rich server written in Rust: it fully implements the official Telegram proxy algo and adds many production-ready improvements
+**Telemt** is a fast, secure, and feature-rich server written in Rust: it fully implements the official Telegram proxy algo and adds many production-ready improvements such as:
+- [ME Pool + Reader/Writer + Registry + Refill + Adaptive Floor + Trio-State + Generation Lifecycle](https://github.com/telemt/telemt/blob/main/docs/Architecture/Model/MODEL.en.md);
+- [Full-covered API w/ management](https://github.com/telemt/telemt/blob/main/docs/Architecture/API/API.md);
+- Anti-Replay on Sliding Window;
+- Prometheus-format Metrics;
+- TLS-Fronting and TCP-Splicing for masking from "prying" eyes.

-### One-command Install and Update
-```bash
-curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
-```
- [Quick Start Guide](docs/Quick_start/QUICK_START_GUIDE.en.md)
- [Инструкция по быстрому запуску](docs/Quick_start/QUICK_START_GUIDE.ru.md)
+![telemt_scheme](docs/assets/telemt.png)

-## Features
 Our implementation of **TLS-fronting** is one of the most deeply debugged, focused, advanced and *almost* **"behaviorally consistent to real"**:  we are confident we have it right - [see evidence on our validation and traces](docs/FAQ.en.md#recognizability-for-dpi-and-crawler)

 Our ***Middle-End Pool*** is fastest by design in standard scenarios, compared to other implementations of connecting to the Middle-End Proxy: non dramatically, but usual
@@ -42,17 +40,29 @@ Our ***Middle-End Pool*** is fastest by design in standard scenarios, compared t
 - Graceful shutdown on Ctrl+C;
 - Extensive logging via `trace` and `debug` with `RUST_LOG` method.

+## One-command installation (update on re-ru)
+```bash
+curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
+```
+See more in the [Quick Start Guide](docs/Quick_start/QUICK_START_GUIDE.en.md).
+
+# GOTO
+- [FAQ](#faq)
+- [Architecture](docs/Architecture)
+- [Quick Start Guide](#quick-start-guide)
+- [Config parameters](docs/Config_params)
+- [Build](#build)
+- [Why Rust?](#why-rust)
+
+## Quick Start Guide
+- [Quick Start Guide RU](docs/Quick_start/QUICK_START_GUIDE.ru.md)
+- [Quick Start Guide EN](docs/Quick_start/QUICK_START_GUIDE.en.md)
+
 ## FAQ
+
 - [FAQ RU](docs/FAQ.ru.md)
 - [FAQ EN](docs/FAQ.en.md)

-# Learn more about Telemt
- [Our Architecture](docs/Architecture)
- [All Config Options](docs/Config_params)
- [How to build your own Telemt?](#build)
- [Running on BSD](docs/Quick_start/OPENBSD_QUICK_START_GUIDE.en.md)
- [Why Rust?](#why-rust)
-
 ## Build
 ```bash
 # Cloning repo
@@ -62,8 +72,9 @@ cd telemt
 # Starting Release Build
 cargo build --release

-# Current release profile uses lto = "fat" for maximum optimization (see Cargo.toml).
-# On low-RAM systems (~1 GB) you can override it to "thin".
+# Low-RAM devices (1 GB, e.g. NanoPi Neo3 / Raspberry Pi Zero 2):
+# release profile uses lto = "thin" to reduce peak linker memory.
+# If your custom toolchain overrides profiles, avoid enabling fat LTO.

 # Move to /bin
 mv ./target/release/telemt /bin
@@ -73,33 +84,15 @@ chmod +x /bin/telemt
 telemt config.toml
 ```

+### OpenBSD
+- Build and service setup guide: [OpenBSD Guide (EN)](docs/Quick_start/OPENBSD_QUICK_START_GUIDE.en.md)
+- Example rc.d script: [contrib/openbsd/telemt.rcd](contrib/openbsd/telemt.rcd)
+- Status: OpenBSD sandbox hardening with `pledge(2)` and `unveil(2)` is not implemented yet.
+
+
 ## Why Rust?
 - Long-running reliability and idempotent behavior
 - Rust's deterministic resource management - RAII 
 - No garbage collector
 - Memory safety and reduced attack surface
 - Tokio's asynchronous architecture
-
-## Support Telemt
-
-Telemt is free, open-source, and built in personal time.
-If it helps you — consider supporting continued development.
-
-Any cryptocurrency (BTC, ETH, USDT, 350+ coins):
-
-<p align="center">
-  <a href="https://nowpayments.io/donation?api_key=2bf1afd2-abc2-49f9-a012-f1e715b37223" target="_blank" rel="noreferrer noopener">
-    <img src="https://nowpayments.io/images/embeds/donation-button-white.svg" alt="Cryptocurrency & Bitcoin donation button by NOWPayments" height="80">
-  </a>
-</p>
-
-Monero (XMR) directly:
-
-```
-8Bk4tZEYPQWSypeD2hrUXG2rKbAKF16GqEN942ZdAP5cFdSqW6h4DwkP5cJMAdszzuPeHeHZPTyjWWFwzeFdjuci3ktfMoB
-```
-
-All donations go toward infrastructure, development, and research.
-
-
-![telemt_scheme](docs/assets/telemt.png)
@@ -1,31 +1,30 @@
 # Telemt — MTProxy на Rust + Tokio

-![Latest Release](https://img.shields.io/github/v/release/telemt/telemt?color=neon) ![Stars](https://img.shields.io/github/stars/telemt/telemt?style=social) ![Forks](https://img.shields.io/github/forks/telemt/telemt?style=social) [![Telegram](https://img.shields.io/badge/Telegram-Chat-24a1de?logo=telegram&logoColor=24a1de)](https://t.me/telemtrs)
-
 ***Решает проблемы раньше, чем другие узнают об их существовании***

 > [!NOTE]
 >
-> Исправленный TLS ClientHello доступен в Telegram для настольных ПК, Android и iOS.
-> 
-> Пожалуйста, обновите клиентское приложение для работы с EE-MTProxy.
+> Исправленный TLS ClientHello доступен в **Telegram Desktop** начиная с версии **6.7.2**: для работы с EE-MTProxy обновите клиент.
+>
+> Исправленный TLS ClientHello доступен в **Telegram Android** начиная с версии **12.6.4**; **официальный релиз для iOS находится в процессе разработки**.

 <p align="center">
  <a href="https://t.me/telemtrs">
-    <img src="/docs/assets/telegram_button.svg" width="150"/>
+    <img src="/docs/assets/telegram_button.svg" width="200"/>
  </a>
 </p>

 **Telemt** — это быстрый, безопасный и функциональный сервер, написанный на Rust. Он полностью реализует официальный алгоритм прокси Telegram и добавляет множество улучшений для продакшена:

-## Установка и обновление одной командой
+- [ME Pool + Reader/Writer + Registry + Refill + Adaptive Floor + Trio-State + жизненный цикл генераций](https://github.com/telemt/telemt/blob/main/docs/Architecture/Model/MODEL.en.md);
+- [Полноценный API с управлением](https://github.com/telemt/telemt/blob/main/docs/Architecture/API/API.md);
+- Защита от повторных атак (Anti-Replay on Sliding Window);
+- Метрики в формате Prometheus;
+- TLS-fronting и TCP-splicing для маскировки от DPI.

-```bash
-curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
-```
+![telemt_scheme](docs/assets/telemt.png)

- [Инструкция по быстрому запуску](docs/Quick_start/QUICK_START_GUIDE.ru.md)
- [Quick Start Guide](docs/Quick_start/QUICK_START_GUIDE.en.md)
+## Особенности

 Реализация **TLS-fronting** максимально приближена к поведению реального HTTPS-трафика (подробнее - [FAQ](docs/FAQ.ru.md#распознаваемость-для-dpi-и-сканеров)).

@@ -41,19 +40,35 @@ curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
 - Корректное завершение работы (Ctrl+C);
 - Подробное логирование через `trace` и `debug`.

-# Подробнее о Telemt
+
+## Быстрая установка (обновление при повторном запуске)
+```bash
+curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
+```
+
+Подробнее об установке в [Quick Start Guide](docs/Quick_start/QUICK_START_GUIDE.ru.md).
+
+# Навигация
 - [FAQ](#faq)
 - [Архитектура](docs/Architecture)
+- [Быстрый старт](#quick-start-guide)
 - [Параметры конфигурационного файла](docs/Config_params)
 - [Сборка](#build)
- [Установка на BSD](#%D1%83%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0-%D0%BD%D0%B0-bsd)
 - [Почему Rust?](#why-rust)
+- [Известные проблемы](#issues)
+- [Планы](#roadmap)
+
+## Быстрый старт
+- [Quick Start Guide RU](docs/Quick_start/QUICK_START_GUIDE.ru.md)
+- [Quick Start Guide EN](docs/Quick_start/QUICK_START_GUIDE.en.md)

 ## FAQ
+
 - [FAQ RU](docs/FAQ.ru.md)
 - [FAQ EN](docs/FAQ.en.md)

 ## Сборка
+
 ```bash
 # Клонируйте репозиторий
 git clone https://github.com/telemt/telemt 
@@ -62,8 +77,9 @@ cd telemt
 # Начните процесс сборки
 cargo build --release

-# В текущем release-профиле используется lto = "fat" для максимальной оптимизации (см. Cargo.toml).
-# На системах с малым объёмом RAM (~1 ГБ) можно переопределить это значение на "thin".
+# Устройства с небольшим объёмом оперативной памяти (1 ГБ, например NanoPi Neo3 / Raspberry Pi Zero 2):
+# используется параметр lto = «thin» для уменьшения пикового потребления памяти.
+# Если ваш пользовательский набор инструментов переопределяет профили, не используйте Fat LTO.

 # Перейдите в каталог /bin
 mv ./target/release/telemt /bin
@@ -73,37 +89,22 @@ chmod +x /bin/telemt
 telemt config.toml
 ```

-## Установка на BSD
+### Устройства с малым объемом RAM
+Для устройств с ~1 ГБ RAM (например Raspberry Pi):
+- используется облегчённая оптимизация линковщика (thin LTO);
+- не рекомендуется включать fat LTO.
+
+## OpenBSD
+
 - Руководство по сборке и настройке на английском языке [OpenBSD Guide (EN)](docs/Quick_start/OPENBSD_QUICK_START_GUIDE.en.md);
 - Пример rc.d скрипта: [contrib/openbsd/telemt.rcd](contrib/openbsd/telemt.rcd);
 - Поддержка sandbox с `pledge(2)` и `unveil(2)` пока не реализована.

 ## Почему Rust?
+
 - Надёжность для долгоживущих процессов;
 - Детерминированное управление ресурсами (RAII);
 - Отсутствие сборщика мусора;
 - Безопасность памяти;
 - Асинхронная архитектура Tokio.

-## Поддержать Telemt
-
-Telemt — это бесплатное программное обеспечение с открытым исходным кодом, разработанное в свободное время.
-Если оно оказалось вам полезным, вы можете поддержать дальнейшую разработку.
-
-Принимаемые криптовалюты (BTC, ETH, USDT, 350+ и другие):
-
-<p align="center">
-  <a href="https://nowpayments.io/donation?api_key=2bf1afd2-abc2-49f9-a012-f1e715b37223" target="_blank" rel="noreferrer noopener">
-    <img src="https://nowpayments.io/images/embeds/donation-button-white.svg" alt="Cryptocurrency & Bitcoin donation button by NOWPayments" height="80">
-  </a>
-</p>
-
-Monero (XMR) напрямую:
-
-```
-8Bk4tZEYPQWSypeD2hrUXG2rKbAKF16GqEN942ZdAP5cFdSqW6h4DwkP5cJMAdszzuPeHeHZPTyjWWFwzeFdjuci3ktfMoB
-```
-
-Все пожертвования пойдут на инфраструктуру, разработку и исследования.
-
-![telemt_scheme](docs/assets/telemt.png)
@@ -32,13 +32,13 @@ show = "*"
 port = 443
 # proxy_protocol = false           # Enable if behind HAProxy/nginx with PROXY protocol
 # metrics_port = 9090
-# metrics_listen = "127.0.0.1:9090" # Listen address for metrics (overrides metrics_port)
-# metrics_whitelist = ["127.0.0.1/32", "::1/128"]
+# metrics_listen = "0.0.0.0:9090"  # Listen address for metrics (overrides metrics_port)
+# metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]

 [server.api]
 enabled = true
-listen = "127.0.0.1:9091"
-whitelist = ["127.0.0.1/32", "::1/128"]
+listen = "0.0.0.0:9091"
+whitelist = ["127.0.0.0/8"]
 minimal_runtime_enabled = false
 minimal_runtime_cache_ttl_ms = 1000

@@ -48,12 +48,9 @@ ip = "0.0.0.0"

 # === Anti-Censorship & Masking ===
 [censorship]
-# Fake-TLS / SNI masking domain used in generated ee-links.
-# Changing tls_domain invalidates previously generated TLS links.
 tls_domain = "petrovich.ru"
-
 mask = true
-tls_emulation = true         # Fetch real cert lengths and emulate TLS records
+tls_emulation = true        # Fetch real cert lengths and emulate TLS records
 tls_front_dir = "tlsfront"   # Cache directory for TLS emulation

 [access.users]
@@ -9,12 +9,12 @@ API runtime is configured in `[server.api]`.

 | Field | Type | Default | Description |
 | --- | --- | --- | --- |
-| `enabled` | `bool` | `true` | Enables REST API listener. |
-| `listen` | `string` (`IP:PORT`) | `0.0.0.0:9091` | API bind address. |
-| `whitelist` | `CIDR[]` | `127.0.0.0/8` | Source IP allowlist. Empty list means allow all. |
+| `enabled` | `bool` | `false` | Enables REST API listener. |
+| `listen` | `string` (`IP:PORT`) | `127.0.0.1:9091` | API bind address. |
+| `whitelist` | `CIDR[]` | `127.0.0.1/32, ::1/128` | Source IP allowlist. Empty list means allow all. |
 | `auth_header` | `string` | `""` | Exact value for `Authorization` header. Empty disables header auth. |
 | `request_body_limit_bytes` | `usize` | `65536` | Maximum request body size. Must be `> 0`. |
-| `minimal_runtime_enabled` | `bool` | `true` | Enables runtime snapshot endpoints requiring ME pool read-lock aggregation. |
+| `minimal_runtime_enabled` | `bool` | `false` | Enables runtime snapshot endpoints requiring ME pool read-lock aggregation. |
 | `minimal_runtime_cache_ttl_ms` | `u64` | `1000` | Cache TTL for minimal snapshots. `0` disables cache; valid range is `[0, 60000]`. |
 | `runtime_edge_enabled` | `bool` | `false` | Enables runtime edge endpoints with cached aggregation payloads. |
 | `runtime_edge_cache_ttl_ms` | `u64` | `1000` | Cache TTL for runtime edge summary payloads. `0` disables cache. |
@@ -36,11 +36,8 @@ hello2 = "ad_tag2"
 On April 1, 2026, we became aware of a method for detecting MTProxy Fake-TLS, 
 based on the ECH extension and the ordering of cipher suites, 
 as well as an overall unique JA3/JA4 fingerprint 
-that does not occur in modern browsers.
-
-> [!IMPORTANT]
-> TLS fingerprint has been fixed in latest version of clients for Desktop / Android / iOS.  
-> Please update your client for MTProxy Fake-TLS to work correctly.
+that does not occur in modern browsers: 
+we have already submitted initial changes to the Telegram Desktop developers and are working on updates for other clients.

 - We consider this a breakthrough aspect, which has no stable analogues today
 - Based on this: if `telemt` configured correctly, **TLS mode is completely identical to real-life handshake + communication** with a specified host
@@ -157,24 +154,6 @@ Keep-Alive: timeout=60
 ### Why do you need a middle proxy (ME)
 https://github.com/telemt/telemt/discussions/167

-## How clients interact with Telegram DCs
-When you register a Telegram account, it gets permanently bound to one of Telegram's data centers (DCs).  
-It is deciced beforehand by Telegram based on the phone number's region.  
-This DC becomes your **home DC**: all content you upload (photos, videos, files, messages) is stored there.  
-Your client authenticates on it with every connection.  
-
-For example, if your account is registered on **DC2**, your client will always connect to DC2 first.  
-When you open a chat with another user whose home DC is **DC5**, your client opens an additional connection to DC5 to download their media.  
-Those cross-DC requests are normal and happen constantly.  
-
-> [!WARNING]
-> Because every session is anchored to your home DC, an outage there causes other DCs to be unavaliable.  
-> If your home DC is DC2 and DC2 goes down, you **cannot** reach DC5 even though DC5 itself is perfectly healthy.  
-> The client has no valid session to route the request through.  
-
-This is also why an MTProxy only needs to reach Telegram's DC infrastructure as a whole.  
-The proxy itself doesn't care which DC your account lives on. The client negotiates the correct DC through the proxy after connecting.
-
 ### How many people can use one link
 By default, an unlimited number of people can use a single link.  
 However, you can limit the number of unique IP addresses for each user:
@@ -182,8 +161,7 @@ However, you can limit the number of unique IP addresses for each user:
 [access.user_max_unique_ips]
 hello = 1
 ```
-This parameter sets the maximum number of unique IP addresses from which a single link can be used simultaneously. If the first user disconnects, a second one can connect.
-At the same time, multiple users can connect from a single IP address simultaneously (for example, devices on the same Wi-Fi network).
+This parameter sets the maximum number of unique IP addresses from which a single link can be used simultaneously. If the first user disconnects, a second one can connect. At the same time, multiple users can connect from a single IP address simultaneously (for example, devices on the same Wi-Fi network).

 ### How to create multiple different links
 1. Generate the required number of secrets using the command: `openssl rand -hex 16`.
@@ -33,12 +33,9 @@ hello = "ad_tag"
 hello2 = "ad_tag2"
 ```
 ## Распознаваемость для DPI и сканеров
-1 апреля 2026 года нам стало известно о методе обнаружения MTProxy Fake-TLS, основанном на расширении ECH и порядке набора шифров,
-а также об общем уникальном отпечатке JA3/JA4, который не встречается в современных браузерах.

-> [!IMPORTANT]
-> Проблема с TLS отпечатком исправлена в последних версиях клиентов Telegram для Desktop / Android / iOS.  
-> Обновите свой клиент для корректной работы с MTProxy Fake-TLS!
+1 апреля 2026 года нам стало известно о методе обнаружения MTProxy Fake-TLS, основанном на расширении ECH и порядке набора шифров, 
+а также об общем уникальном отпечатке JA3/JA4, который не встречается в современных браузерах: мы уже отправили первоначальные изменения разработчикам Telegram Desktop и работаем над обновлениями для других клиентов.

 - Мы считаем это прорывом, которому на сегодняшний день нет стабильных аналогов;
 - Исходя из этого: если `telemt` настроен правильно, **режим TLS полностью идентичен реальному «рукопожатию» + обмену данными** с указанным хостом;
@@ -155,23 +152,6 @@ Keep-Alive: timeout=60
 ## Зачем нужен middle proxy (ME)
 https://github.com/telemt/telemt/discussions/167

-## Как клиенты взаимодействуют с дата-центрами Telegram
-При регистрации аккаунта Telegram он навсегда привязывается к одному из дата-центров (DC).  
-Telegram заранее определяет к какому DC привязать аккаунт исходя из региона, к которому относиться номер телефона.  
-Этот DC становится вашим **домашним**: именно там хранится весь контент, который вы загружаете (фото, видео, файлы, сообщения).  
-И именно на нем клиент авторизуется при каждом подключении.  
-
-Например, если ваш аккаунт зарегистрирован на **DC2**, клиент всегда будет подключаться в первую очередь к DC2.  
-Когда вы открываете переписку с пользователем, чей домашний DC — **DC5**, клиент устанавливает доп. соединение с DC5, чтобы загрузить его контент.  
-Такие кросс-запросы к DC — это нормальная часть работы Telegram.  
-
-> [!WARNING]
-> Поскольку аккаунт всегда привязан к домашнему DC, при его падении контент с других DC будет недоступен.  
-> Если ваш домашний DC — DC2, и DC2 лежит, вы **не сможете** достучаться  и до DC5, даже если сам DC5 полностью исправен.  
-> У клиента просто нет валидной сессии, через которую можно было бы направить запрос.  
-
-По той же причине MTProxy достаточно иметь доступ к инфраструктуре Telegram в целом.  
-Cамому MTProxy всё равно, на каком DC живёт ваш аккаунт. Клиент cам договаривается о нужном DC через прокси уже после подключения.  

 ## Что такое dd и ee в контексте MTProxy?

@@ -27,8 +27,7 @@ cargo build --release
 ./target/release/telemt --version
 ```

-For low-RAM systems, note that this repository currently uses `lto = "fat"` in release profile.  
-On constrained builders, a local override to `lto = "thin"` may be more practical.
+For low-RAM systems, this repository already uses `lto = "thin"` in release profile.

 ## 3. Install binary and config

@@ -1,36 +1,9 @@
-# Installation Options 
-There are three options for installing Telemt:
- - [Automated installation using a script](#very-quick-start).
- - [Manual installation of Telemt as a service](#telemt-via-systemd).
- - [Installation using Docker Compose](#telemt-via-docker-compose).
-
 # Very quick start

 ### One-command installation / update on re-run
 ```bash
 curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
 ```
-
-After starting, the script will prompt for:
- - Your language (1 - English, 2 - Russian);
- - Your TLS domain (press Enter for petrovich.ru).
-
-The script checks if the port (default **443**) is free. If the port is already in use, installation will fail. You need to free up the port or use the **-p** flag with a different port to retry the installation.
-
-To modify the script’s startup parameters, you can use the following flags:
- - **-d, --domain** - TLS domain;
- - **-p, --port** - server port (1–65535);
- - **-s, --secret** - 32 hex secret;
- - **-a, --ad-tag** - ad_tag;
- - **-l, --lan**g - language (1/en or 2/ru);
-
-Providing all options skips interactive prompts.
-
-After completion, the script will provide a link for client connections:
-```bash
-tg://proxy?server=IP&port=PORT&secret=SECRET
-```
-
 ### Installing a specific version
 ```bash
 curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh -s -- 3.3.39
@@ -137,15 +110,15 @@ show = "*"
 # === Server Binding ===
 [server]
 port = 443
-# proxy_protocol = false            # Enable if behind HAProxy/nginx with PROXY protocol
+# proxy_protocol = false           # Enable if behind HAProxy/nginx with PROXY protocol
 # metrics_port = 9090
-# metrics_listen = "127.0.0.1:9090" # Listen address for metrics (overrides metrics_port)
-# metrics_whitelist = ["127.0.0.1/32", "::1/128"]
+# metrics_listen = "0.0.0.0:9090"  # Listen address for metrics (overrides metrics_port)
+# metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]

 [server.api]
 enabled = true
-listen = "127.0.0.1:9091"
-whitelist = ["127.0.0.1/32", "::1/128"]
+listen = "0.0.0.0:9091"
+whitelist = ["127.0.0.0/8"]
 minimal_runtime_enabled = false
 minimal_runtime_cache_ttl_ms = 1000

@@ -155,9 +128,9 @@ ip = "0.0.0.0"

 # === Anti-Censorship & Masking ===
 [censorship]
-tls_domain = "petrovich.ru"  # Fake-TLS / SNI masking domain used in generated ee-links
+tls_domain = "petrovich.ru"
 mask = true
-tls_emulation = true         # Fetch real cert lengths and emulate TLS records
+tls_emulation = true        # Fetch real cert lengths and emulate TLS records
 tls_front_dir = "tlsfront"   # Cache directory for TLS emulation

 [access.users]
@@ -168,9 +141,9 @@ hello = "00000000000000000000000000000000"
 then Ctrl+S -> Ctrl+X to save

 > [!WARNING]
-> Replace the value of the `hello` parameter with the value you obtained in step 0.  
-> Additionally, change the value of the `tls_domain` parameter to a different website.
-> Changing the `tls_domain` parameter will break all links that use the old domain!
+> Replace the value of the hello parameter with the value you obtained in step 0.  
+> Additionally, change the value of the tls_domain parameter to a different website.
+> Changing the tls_domain parameter will break all links that use the old domain!

 ---

@@ -1,35 +1,9 @@
-# Варианты установки
-Имеется три варианта установки Telemt:
- - [Автоматизированная установка с помощью скрипта](#очень-быстрый-старт).
- - [Ручная установка Telemt в качестве службы](#telemt-через-systemd-вручную).
- - [Установка через Docker Compose](#telemt-через-docker-compose).
-
 # Очень быстрый старт

 ### Установка одной командой / обновление при повторном запуске
 ```bash
 curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh
 ```
-После запуска скрипт запросит:
- - ваш язык (1 - English, 2 - Русский);
- - ваш TLS-домен (нажмите Enter для petrovich.ru).
-
-Во время установки скрипт проверяет, свободен ли порт (по умолчанию **443**). Если порт занят другим процессом - установка завершится с ошибкой. Для повторной установки необходимо освободить порт или указать другой через флаг **-p**.
-
-Для изменения параметров запуска скрипта можно использовать следующие флаги:
- - **-d, --domain** - TLS-домен;
- - **-p, --port** - порт (1–65535);
- - **-s, --secret** - секрет (32 hex символа);
- - **-a, --ad-tag** - ad_tag;
- - **-l, --lang** - язык (1/en или 2/ru).
-
-Если заданы флаги для языка и домена, интерактивных вопросов не будет.
-
-После завершения установки скрипт выдаст ссылку для подключения клиентов:
-```bash
-tg://proxy?server=IP&port=PORT&secret=SECRET
-```
-
 ### Установка нужной версии
 ```bash
 curl -fsSL https://raw.githubusercontent.com/telemt/telemt/main/install.sh | sh -s -- 3.3.39
@@ -129,22 +103,22 @@ tls = true
 [general.links]
 show = "*"
 # show = ["alice", "bob"] # Показывать ссылки только для alice и bob
-# show = "*"              # Показывать ссылки для всех пользователей
-# public_host = "proxy.example.com"  # Хост (IP-адрес или домен) для ссылок tg://
-# public_port = 443                  # Порт для ссылок tg:// (по умолчанию: server.port)
+# show = "*"              # Показывать ссылки для всех пользователей
+# public_host = "proxy.example.com"  # Хост (IP-адрес или домен) для ссылок tg://
+# public_port = 443                  # Порт для ссылок tg:// (по умолчанию: server.port)

 # === Привязка сервера ===
 [server]
 port = 443
-# proxy_protocol = false           # Включите, если сервер находится за HAProxy/nginx с протоколом PROXY
+# proxy_protocol = false           # Включите, если сервер находится за HAProxy/nginx с протоколом PROXY
 # metrics_port = 9090
-# metrics_listen = "127.0.0.1:9090"  # Адрес прослушивания для метрик (переопределяет metrics_port)
-# metrics_whitelist = ["127.0.0.1/32", "::1/128"]
+# metrics_listen = "0.0.0.0:9090"  # Адрес прослушивания для метрик (переопределяет metrics_port)
+# metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]

 [server.api]
 enabled = true
-listen = "127.0.0.1:9091"
-whitelist = ["127.0.0.1/32", "::1/128"]
+listen = "0.0.0.0:9091"
+whitelist = ["127.0.0.0/8"]
 minimal_runtime_enabled = false
 minimal_runtime_cache_ttl_ms = 1000

@@ -154,9 +128,9 @@ ip = "0.0.0.0"

 # === Обход блокировок и маскировка ===
 [censorship]
-tls_domain = "petrovich.ru"  # Домен Fake-TLS / SNI, который будет использоваться в сгенерированных ee-ссылках
+tls_domain = "petrovich.ru"
 mask = true
-tls_emulation = true         # Получить реальную длину сертификата и эмулировать запись TLS
+tls_emulation = true        # Получить реальную длину сертификата и эмулировать запись TLS
 tls_front_dir = "tlsfront"   # Директория кэша для эмуляции TLS

 [access.users]
@@ -167,9 +141,9 @@ hello = "00000000000000000000000000000000"
 Затем нажмите Ctrl+S -> Ctrl+X, чтобы сохранить

 > [!WARNING]
-> Замените значение параметра `hello` на значение, которое вы получили в пункте 0.  
-> Так же замените значение параметра `tls_domain` на другой сайт.
-> Изменение параметра `tls_domain` сделает нерабочими все ссылки, использующие старый домен!
+> Замените значение параметра hello на значение, которое вы получили в пункте 0.  
+> Так же замените значение параметра tls_domain на другой сайт.
+> Изменение параметра tls_domain сделает нерабочими все ссылки, использующие старый домен!

 ---

@@ -163,7 +163,7 @@ PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.
 ---

 ## Step 2. Installing telemt on Server B (conditionally Netherlands)
-Installation and configuration are described [here](https://github.com/telemt/telemt/blob/main/docs/Quick_start/QUICK_START_GUIDE.en.md) or [here](https://gitlab.com/An0nX/telemt-docker#-quick-start-docker-compose).\
+Installation and configuration are described [here](https://github.com/telemt/telemt/blob/main/docs/QUICK_START_GUIDE.ru.md) or [here](https://gitlab.com/An0nX/telemt-docker#-quick-start-docker-compose).\
 It is assumed that telemt expects connections on port `443\tcp`.

 In the telemt config, you must enable the `Proxy` protocol and restrict connections to it only through the tunnel.
@@ -166,7 +166,7 @@ PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.

 ## Шаг 2. Установка telemt на Сервере B (_условно Нидерланды_)

-Установка и настройка описаны [здесь](https://github.com/telemt/telemt/blob/main/docs/Quick_start/QUICK_START_GUIDE.ru.md) или [здесь](https://gitlab.com/An0nX/telemt-docker#-quick-start-docker-compose).\
+Установка и настройка описаны [здесь](https://github.com/telemt/telemt/blob/main/docs/QUICK_START_GUIDE.ru.md) или [здесь](https://gitlab.com/An0nX/telemt-docker#-quick-start-docker-compose).\
 Подразумевается что telemt ожидает подключения на порту `443\tcp`.

 В конфиге telemt необходимо включить протокол `Proxy` и ограничить подключения к нему только через туннель.
@@ -1,273 +0,0 @@
-<img src="https://gist.githubusercontent.com/avbor/1f8a128e628f47249aae6e058a57610b/raw/19013276c035e91058e0a9799ab145f8e70e3ff5/scheme.svg">
-
-## Concept
- **Server A** (_e.g., RU_):\
-  Entry point, accepts Telegram proxy user traffic via **Xray** (port `443\tcp`)\
-  and sends it through the tunnel to Server **B**.\
-  Public port for Telegram clients — `443\tcp`
- **Server B** (_e.g., NL_):\
-  Exit point, runs the **Xray server** (to terminate the tunnel entry point) and **telemt**.\
-  The server must have unrestricted access to Telegram Data Centers.\
-  Public port for VLESS/REALITY (incoming) — `443\tcp`\
-  Internal telemt port (where decrypted Xray traffic ends up) — `8443\tcp`
-
-The tunnel works over the `VLESS-XTLS-Reality` (or `VLESS/xhttp/reality`) protocol. The original client IP address is preserved thanks to the PROXYv2 protocol, which Xray on Server A dynamically injects via a local loopback before wrapping the traffic into Reality, transparently delivering the real IPs to telemt on Server B.
-
---
-
-## Step 1. Setup Xray Tunnel (A <-> B)
-
-You must install **Xray-core** (version 1.8.4 or newer recommended) on both servers.
-Official installation script (run on both servers):
-```bash
-bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
-```
-
-### Key and Parameter Generation (Run Once)
-For configuration, you need a unique UUID and Xray Reality keys. Run on any server with Xray installed:
-1. **Client UUID:**
-```bash
-xray uuid
-# Save the output (e.g.: 12345678-abcd-1234-abcd-1234567890ab) — this is <XRAY_UUID>
-```
-2. **X25519 Keypair (Private & Public) for Reality:**
-```bash
-xray x25519
-# Save the Private key (<SERVER_B_PRIVATE_KEY>) and Public key (<SERVER_B_PUBLIC_KEY>)
-```
-3. **Short ID (Reality identifier):**
-```bash
-openssl rand -hex 16
-# Save the output (e.g.: 0123456789abcdef0123456789abcdef) — this is <SHORT_ID>
-```
-4. **Random Path (for xhttp):**
-```bash
-openssl rand -hex 8
-# Save the output (e.g., abc123def456) to replace <YOUR_RANDOM_PATH> in configs
-```
-
---
-
-### Configuration for Server B (_EU_):
-
-Create or edit the file `/usr/local/etc/xray/config.json`.
-This Xray instance will listen on the public `443` port and proxy valid Reality traffic, while routing "disguised" traffic (e.g., direct web browser scans) to `yahoo.com`.
-
-```bash
-nano /usr/local/etc/xray/config.json
-```
-
-File content:
-```json
-{
-  "log": {
-    "loglevel": "error",
-    "access": "none"
-  },
-  "inbounds": [
-    {
-      "tag": "vless-in",
-      "port": 443,
-      "protocol": "vless",
-      "settings": {
-        "clients": [
-          {
-            "id": "<XRAY_UUID>"
-          }
-        ],
-        "decryption": "none"
-      },
-      "streamSettings": {
-        "network": "xhttp",
-        "security": "reality",
-        "realitySettings": {
-          "dest": "yahoo.com:443",
-          "serverNames": [
-            "yahoo.com"
-          ],
-          "privateKey": "<SERVER_B_PRIVATE_KEY>",
-          "shortIds": [
-            "<SHORT_ID>"
-          ]
-        },
-        "xhttpSettings": {
-          "path": "/<YOUR_RANDOM_PATH>",
-          "mode": "auto"
-        }
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "tag": "tunnel-to-telemt",
-      "protocol": "freedom",
-      "settings": {
-        "destination": "127.0.0.1:8443"
-      }
-    }
-  ],
-  "routing": {
-    "domainStrategy": "AsIs",
-    "rules": [
-      {
-        "type": "field",
-        "inboundTag": [
-          "vless-in"
-        ],
-        "outboundTag": "tunnel-to-telemt"
-      }
-    ]
-  }
-}
-```
-
-Open the firewall port (if enabled):
-```bash
-sudo ufw allow 443/tcp
-```
-Restart and setup Xray to run at boot:
-```bash
-sudo systemctl restart xray
-sudo systemctl enable xray
-```
-
---
-
-### Configuration for Server A (_RU_):
-
-Similarly, edit `/usr/local/etc/xray/config.json`.
-Here Xray acts as the public entry point: it listens on `443\tcp`, uses a local loopback (via internal port `10444`) to prepend the `PROXYv2` header, and encapsulates the payload via Reality to Server B, instructing Server B to deliver it to its *local* `127.0.0.1:8443` port (where telemt will listen).
-
-```bash
-nano /usr/local/etc/xray/config.json
-```
-
-File content:
-```json
-{
-  "log": {
-    "loglevel": "error",
-    "access": "none"
-  },
-  "inbounds": [
-    {
-      "tag": "public-in",
-      "port": 443,
-      "listen": "0.0.0.0",
-      "protocol": "dokodemo-door",
-      "settings": {
-        "address": "127.0.0.1",
-        "port": 10444,
-        "network": "tcp"
-      }
-    },
-    {
-      "tag": "tunnel-in",
-      "port": 10444,
-      "listen": "127.0.0.1",
-      "protocol": "dokodemo-door",
-      "settings": {
-        "address": "127.0.0.1",
-        "port": 8443,
-        "network": "tcp"
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "tag": "local-injector",
-      "protocol": "freedom",
-      "settings": {
-        "proxyProtocol": 2
-      }
-    },
-    {
-      "tag": "vless-out",
-      "protocol": "vless",
-      "settings": {
-        "vnext": [
-          {
-            "address": "<PUBLIC_IP_SERVER_B>",
-            "port": 443,
-            "users": [
-              {
-                "id": "<XRAY_UUID>",
-                "encryption": "none"
-              }
-            ]
-          }
-        ]
-      },
-      "streamSettings": {
-        "network": "xhttp",
-        "security": "reality",
-        "realitySettings": {
-          "serverName": "yahoo.com",
-          "publicKey": "<SERVER_B_PUBLIC_KEY>",
-          "shortId": "<SHORT_ID>",
-          "spiderX": "/",
-          "fingerprint": "chrome"
-        },
-        "xhttpSettings": {
-          "path": "/<YOUR_RANDOM_PATH>"
-        }
-      }
-    }
-  ],
-  "routing": {
-    "domainStrategy": "AsIs",
-    "rules": [
-      {
-        "type": "field",
-        "inboundTag": ["public-in"],
-        "outboundTag": "local-injector"
-      },
-      {
-        "type": "field",
-        "inboundTag": ["tunnel-in"],
-        "outboundTag": "vless-out"
-      }
-    ]
-  }
-}
-```
-*Replace `<PUBLIC_IP_SERVER_B>` with the public IP address of Server B.*
-
-Open the firewall port for clients (if enabled):
-```bash
-sudo ufw allow 443/tcp
-```
-
-Restart and setup Xray to run at boot:
-```bash
-sudo systemctl restart xray
-sudo systemctl enable xray
-```
-
---
-
-## Step 2. Install telemt on Server B (_EU_)
-
-telemt installation is heavily covered in the [Quick Start Guide](../Quick_start/QUICK_START_GUIDE.en.md).
-By contrast to standard setups, telemt must listen strictly _locally_ (since Xray occupies the public `443` interface) and must expect `PROXYv2` packets.
-
-Edit the configuration file (`config.toml`) on Server B accordingly:
-
-```toml
-[server]
-port = 8443
-listen_addr_ipv4 = "127.0.0.1"
-proxy_protocol = true
-
-[general.links]
-show = "*"
-public_host = "<FQDN_OR_IP_SERVER_A>"
-public_port = 443
-```
-
- Address `127.0.0.1` and `port = 8443` instructs the core proxy router to process connections unpacked locally via Xray-server.
- `proxy_protocol = true` commands telemt to parse the injected PROXY header (from Server A's Xray local loopback) and log genuine end-user IPs.
- Under `public_host`, place Server A's public IP address or FQDN to ensure working links are generated for Telegram users.
-
-Restart `telemt`. Your server is now robust against DPI scanners, passing traffic optimally.
-
@@ -1,272 +0,0 @@
-<img src="https://gist.githubusercontent.com/avbor/1f8a128e628f47249aae6e058a57610b/raw/19013276c035e91058e0a9799ab145f8e70e3ff5/scheme.svg">
-
-## Концепция
- **Сервер A** (_РФ_):\
-  Точка входа, принимает трафик пользователей Telegram-прокси напрямую через **Xray** (порт `443\tcp`)\
-  и отправляет его в туннель на Сервер **B**.\
-  Порт для клиентов Telegram — `443\tcp`
- **Сервер B** (_условно Нидерланды_):\
-  Точка выхода, на нем работает **Xray-сервер** (принимает подключения точки входа) и **telemt**.\
-  На сервере должен быть неограниченный доступ до серверов Telegram.\
-  Порт для VLESS/REALITY (вход) — `443\tcp`\
-  Внутренний порт telemt (куда пробрасывается трафик) — `8443\tcp`
-
-Туннель работает по протоколу VLESS-XTLS-Reality (или VLESS/xhttp/reality). Оригинальный IP-адрес клиента сохраняется благодаря протоколу PROXYv2, который Xray на Сервере А добавляет через локальный loopback перед упаковкой в туннель, благодаря чему прозрачно доходит до telemt.
-
---
-
-## Шаг 1. Настройка туннеля Xray (A <-> B)
-
-На обоих серверах необходимо установить **Xray-core** (рекомендуется версия 1.8.4 или новее).
-Официальный скрипт установки (выполнить на обоих серверах):
-```bash
-bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
-```
-
-### Генерация ключей и параметров (выполнить один раз)
-Для конфигурации потребуются уникальные ID и ключи Xray Reality. Выполните на любом сервере с установленным Xray:
-1. **UUID клиента:**
-```bash
-xray uuid
-# Сохраните вывод (например: 12345678-abcd-1234-abcd-1234567890ab) — это <XRAY_UUID>
-```
-2. **Пара ключей X25519 (Private & Public) для Reality:**
-```bash
-xray x25519
-# Сохраните Private key (<SERVER_B_PRIVATE_KEY>) и Public key (<SERVER_B_PUBLIC_KEY>)
-```
-3. **Short ID (идентификатор Reality):**
-```bash
-openssl rand -hex 16
-# Сохраните вывод (например: 0123456789abcdef0123456789abcdef) — это <SHORT_ID>
-```
-4. **Random Path (путь для xhttp):**
-```bash
-openssl rand -hex 8
-# Сохраните вывод (например, abc123def456), чтобы заменить <YOUR_RANDOM_PATH> в конфигах
-```
-
---
-
-### Конфигурация Сервера B (_Нидерланды_):
-
-Создаем или редактируем файл `/usr/local/etc/xray/config.json`.
-Этот Xray-сервер будет слушать порт `443` и прозрачно пропускать валидный Reality трафик дальше, а "замаскированный" трафик (например, если кто-то стучится в лоб веб-браузером) пойдет на `yahoo.com`.
-
-```bash
-nano /usr/local/etc/xray/config.json
-```
-
-Содержимое файла:
-```json
-{
-  "log": {
-    "loglevel": "error",
-    "access": "none"
-  },
-  "inbounds": [
-    {
-      "tag": "vless-in",
-      "port": 443,
-      "protocol": "vless",
-      "settings": {
-        "clients": [
-          {
-            "id": "<XRAY_UUID>"
-          }
-        ],
-        "decryption": "none"
-      },
-      "streamSettings": {
-        "network": "xhttp",
-        "security": "reality",
-        "realitySettings": {
-          "dest": "yahoo.com:443",
-          "serverNames": [
-            "yahoo.com"
-          ],
-          "privateKey": "<SERVER_B_PRIVATE_KEY>",
-          "shortIds": [
-            "<SHORT_ID>"
-          ]
-        },
-        "xhttpSettings": {
-          "path": "/<YOUR_RANDOM_PATH>",
-          "mode": "auto"
-        }
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "tag": "tunnel-to-telemt",
-      "protocol": "freedom",
-      "settings": {
-        "destination": "127.0.0.1:8443"
-      }
-    }
-  ],
-  "routing": {
-    "domainStrategy": "AsIs",
-    "rules": [
-      {
-        "type": "field",
-        "inboundTag": [
-          "vless-in"
-        ],
-        "outboundTag": "tunnel-to-telemt"
-      }
-    ]
-  }
-}
-```
-
-Открываем порт на фаерволе (если включен):
-```bash
-sudo ufw allow 443/tcp
-```
-Перезапускаем Xray:
-```bash
-sudo systemctl restart xray
-sudo systemctl enable xray
-```
-
---
-
-### Конфигурация Сервера A (_РФ_):
-
-Аналогично, редактируем `/usr/local/etc/xray/config.json`.
-Здесь Xray выступает публичной точкой: он принимает трафик на внешний порт `443\tcp`, пропускает через локальный loopback (порт `10444`) для добавления PROXYv2-заголовка, и упаковывает в Reality до Сервера B, прося тот доставить данные на *свой локальный* порт `127.0.0.1:8443` (именно там будет слушать telemt).
-
-```bash
-nano /usr/local/etc/xray/config.json
-```
-
-Содержимое файла:
-```json
-{
-  "log": {
-    "loglevel": "error",
-    "access": "none"
-  },
-  "inbounds": [
-    {
-      "tag": "public-in",
-      "port": 443,
-      "listen": "0.0.0.0",
-      "protocol": "dokodemo-door",
-      "settings": {
-        "address": "127.0.0.1",
-        "port": 10444,
-        "network": "tcp"
-      }
-    },
-    {
-      "tag": "tunnel-in",
-      "port": 10444,
-      "listen": "127.0.0.1",
-      "protocol": "dokodemo-door",
-      "settings": {
-        "address": "127.0.0.1",
-        "port": 8443,
-        "network": "tcp"
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "tag": "local-injector",
-      "protocol": "freedom",
-      "settings": {
-        "proxyProtocol": 2
-      }
-    },
-    {
-      "tag": "vless-out",
-      "protocol": "vless",
-      "settings": {
-        "vnext": [
-          {
-            "address": "<PUBLIC_IP_SERVER_B>",
-            "port": 443,
-            "users": [
-              {
-                "id": "<XRAY_UUID>",
-                "encryption": "none"
-              }
-            ]
-          }
-        ]
-      },
-      "streamSettings": {
-        "network": "xhttp",
-        "security": "reality",
-        "realitySettings": {
-          "serverName": "yahoo.com",
-          "publicKey": "<SERVER_B_PUBLIC_KEY>",
-          "shortId": "<SHORT_ID>",
-          "spiderX": "/",
-          "fingerprint": "chrome"
-        },
-        "xhttpSettings": {
-          "path": "/<YOUR_RANDOM_PATH>"
-        }
-      }
-    }
-  ],
-  "routing": {
-    "domainStrategy": "AsIs",
-    "rules": [
-      {
-        "type": "field",
-        "inboundTag": ["public-in"],
-        "outboundTag": "local-injector"
-      },
-      {
-        "type": "field",
-        "inboundTag": ["tunnel-in"],
-        "outboundTag": "vless-out"
-      }
-    ]
-  }
-}
-```
-*Замените `<PUBLIC_IP_SERVER_B>` на внешний IP-адрес Сервера B.*
-
-Открываем порт на фаерволе для клиентов:
-```bash
-sudo ufw allow 443/tcp
-```
-
-Перезапускаем Xray:
-```bash
-sudo systemctl restart xray
-sudo systemctl enable xray
-```
-
---
-
-## Шаг 2. Установка и настройка telemt на Сервере B (_Нидерланды_)
-
-Установка telemt описана [в основной инструкции](../Quick_start/QUICK_START_GUIDE.ru.md).
-Отличие в том, что telemt должен слушать *внутренний* порт (так как 443 занят Xray-сервером), а также ожидать `PROXY` протокол из Xray туннеля.
-
-В конфиге `config.toml` прокси (на Сервере B) укажите:
-```toml
-[server]
-port = 8443
-listen_addr_ipv4 = "127.0.0.1"
-proxy_protocol = true
-
-[general.links]
-show = "*"
-public_host = "<FQDN_OR_IP_SERVER_A>"
-public_port = 443
-```
-
- `port = 8443` и `listen_addr_ipv4 = "127.0.0.1"` означают, что telemt принимает подключения только изнутри (приходящие от локального Xray-процесса).
- `proxy_protocol = true` заставляет telemt парсить PROXYv2-заголовок (который добавил Xray на Сервере A через loopback), восстанавливая IP-адрес конечного пользователя (РФ).
- В `public_host` укажите публичный IP-адрес или домен Сервера A, чтобы ссылки на подключение генерировались корректно.
-
-Перезапустите `telemt`, и клиенты смогут подключаться по выданным ссылкам.
-
@@ -1 +1,11 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg width="100%" height="100%" viewBox="0 0 150 30" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:2;"><path d="M150,15c0,8.279 -6.721,15 -15,15l-120,0c-8.279,0 -15,-6.721 -15,-15c0,-8.279 6.721,-15 15,-15l120,0c8.279,0 15,6.721 15,15Z" style="fill:#24a1ed;"/><g transform="matrix(20.833333,0,0,20.833333,111.464184,22.329305)"></g><text x="39.666px" y="22.329px" style="font-family:'ArialMT', 'Arial', sans-serif;font-size:20.833px;fill:#fff;">Join us!</text></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="250" height="50" viewBox="0 0 250 50">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #1d98dc;
+      }
+    </style>
+  </defs>
+  <rect id="Прямоугольник_скругл._углы_1" data-name="Прямоугольник, скругл. углы 1" class="cls-1" width="250" height="50" rx="25" ry="25"/>
+  <image id="Join_us_" data-name="Join us!" x="53" y="12" width="144" height="24" xlink:href="data:img/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJAAAAAYCAYAAAAVpXQNAAAFnElEQVRoge2aS2hdRRjHf2Pro1aRW1BBpGpLUQRbNRbxsbCSSKWCD7gVFUFEko1gdykaxQeU1NdGEBpEXLjQdOPCLqSh4koXLUhXUk1a8YFQSVqlYm3tJ1/5bpl8mTn33Nxzb25q/nDbnDMzZ+Z88/+ec4KI0EFcDdwM/A183cmJlrBAUAJ16LdOREZEZJ+IfFTRHLtkNtZ0UmoiMm6zTYpI3/+ZoyprJ3vdC5ZXOEcALgT6gacAFfgNwEXAsQrn6QpEZBio21xK1F3AHYvtPapCCGHKeasZ/acKAl0KXAM8CjwNrAMucX3+6fYLL6HjaItAy4DVwHrgceARYIW16YNPAZfbtdJ2arHtZwhhp7mtuq1/qAeW1XNolUCrzDXdbRZng2vfB3wFPAncaPdOAN8vRuGEELb2wDJ6GmUItMJigAeAe4H7jEgxfgXeM/I8B6yN2v5YrARaQnMUEUgD4NuALcDtwK2Zfp8BO4DfgXfNncX4DfhhaS/OC0yZMTmHC9xbqbXZBIwAHwNjwLMZ8hwCtgFPACeB3QnyKL6zX9chIoMiMipzoWn5cFEZIJG2Dif6zCorRPfrIrLXjR9tp+zgU+iCfoOu72CmX5/JYNr1n7b75coWVl9ZLSLPi8gnIvKziJxOCD3GByKy0cZuFpEjmX6nROQVEbmim3UgE87+Ju/QwBxi0AaBEmuMMT1fErnntEWgjFJ5pMZNxvJo1IE+BO4Crk+k3x4HgLeAzy04fsbcVi3TXyvQh4G/WpTXvGGas7+F8SrMs1lXBXOPAkmNN9SsnjTQ7lzzha0xqTQt4mwary5sI3BTE/IoAd4GHgM+tesXgPcLyKM4CkwC/3ZJOLqWcXdbXetAMFgC4MmiJOqvYAm6MRNacIzm2+769C9UVdvkExNcY5qtIYIVS3PKNONvLLfM6jrgYWCz/X2lVZC1nvMN8CrwpdV0VpqgXkrEUB4/WgZ2pjIpFGPQBXljIYRZ9ZsQggphu4jo/6NR06Btfjs4EEIYcPPtNLcVb1y/WfNuo+YUXuWz2633QMHa5hBICXAcOAi8AdwDPAS8Duyxe1usvqPkucqE/nIJ8ih+MivULdSjeWYS2h8LaqcTVBUWKKe5Y+66yGp3Ep4Ag+2eJ6bS+G/t56Ex0ptuk4pw2txXV2DmOXYNE2ZtijARjampazENnC9yFsxX4heEQCoPERmLrKGSZ9LuTXhrVAZlrAgWH420QB7Fn2bZugW/KWWIUOnG5ghbgsjdxPYE0ZVQ440UvpW1lCWQuq5bWnzJoxlL1g4WyvSfN1AyW5w2lFGgUSuBpFxbrAhnx7ZigVqFEuhIxYKf9VL6iUF06bW8DNm8kBbLoW/bihRC0AB6rWVdPlbss3KDx1b7bCc0rFhZAq10p+uvAe/Y3zkcatLeKnyMM8tFmZuISVRUj2kgDpxnHCF7DfG7FQW+LQXFGvNZQrHKJxUWVxZiPgTaZtnZiBUSU1bmZAfSVO+bUwFfnO3UrGiWhPn6vszYXkRM7r5U3SpRLpjTnotxTAG9TJvXq0oeITwoIr+IyDYRWebaNojIFyJyJipzHxeRO9s4shi244jGtS+9T6e0wwTkz3bGY2HruMzz1iSeFaP0WVhGzqWOIgrG+zVr9lSP2uvuqGHOUUb0TnvjsdbWnzj+qWXWMG3zlSbQehHZJCIXZ9p1U3aIyDGbQD9/vKzCM6+sUBKCrjcZm0JSm12/hSaQX08O4+5+ikBlMOrm93JVEpV2YQetEn0y067m70Uzn3vsfOxEq0IqiSENAHNdrZYxkKqaJjBlxxztVqA7DovPmn0VmUrR54PdIYRsETZCrYoT8vi3UkTuF5Fr23zOcEJDCj+/SMHGeI0Uu1dY7+g1CxQ9R12Nt9DnXFKz03gbn5Jv4zOObEXeudG6iPAfDgYBtHqBCrAAAAAASUVORK5CYII="/>
+</svg>
@@ -1,6 +1,6 @@
 #![allow(clippy::too_many_arguments)]

-use std::io::{Error as IoError, ErrorKind};
+use std::convert::Infallible;
 use std::net::{IpAddr, SocketAddr};
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -16,7 +16,7 @@ use tokio::net::TcpListener;
 use tokio::sync::{Mutex, RwLock, watch};
 use tracing::{debug, info, warn};

-use crate::config::{ApiGrayAction, ProxyConfig};
+use crate::config::ProxyConfig;
 use crate::ip_tracker::UserIpTracker;
 use crate::proxy::route_mode::RouteRuntimeController;
 use crate::startup::StartupTracker;
@@ -184,9 +184,7 @@ pub async fn serve(
                .serve_connection(hyper_util::rt::TokioIo::new(stream), svc)
                .await
            {
-                if !error.is_user() {
-                    debug!(error = %error, "API connection error");
-                }
+                debug!(error = %error, "API connection error");
            }
        });
    }
@@ -197,7 +195,7 @@ async fn handle(
    peer: SocketAddr,
    shared: Arc<ApiShared>,
    config_rx: watch::Receiver<Arc<ProxyConfig>>,
-) -> Result<Response<Full<Bytes>>, IoError> {
+) -> Result<Response<Full<Bytes>>, Infallible> {
    let request_id = shared.next_request_id();
    let cfg = config_rx.borrow().clone();
    let api_cfg = &cfg.server.api;
@@ -215,25 +213,14 @@ async fn handle(

    if !api_cfg.whitelist.is_empty() && !api_cfg.whitelist.iter().any(|net| net.contains(peer.ip()))
    {
-        return match api_cfg.gray_action {
-            ApiGrayAction::Api => Ok(error_response(
-                request_id,
-                ApiFailure::new(
-                    StatusCode::FORBIDDEN,
-                    "forbidden",
-                    "Source IP is not allowed",
-                ),
-            )),
-            ApiGrayAction::Ok200 => Ok(Response::builder()
-                .status(StatusCode::OK)
-                .header("content-type", "text/html; charset=utf-8")
-                .body(Full::new(Bytes::new()))
-                .unwrap()),
-            ApiGrayAction::Drop => Err(IoError::new(
-                ErrorKind::ConnectionAborted,
-                "api request dropped by gray_action=drop",
-            )),
-        };
+        return Ok(error_response(
+            request_id,
+            ApiFailure::new(
+                StatusCode::FORBIDDEN,
+                "forbidden",
+                "Source IP is not allowed",
+            ),
+        ));
    }

    if !api_cfg.auth_header.is_empty() {
@@ -257,16 +244,11 @@ async fn handle(

    let method = req.method().clone();
    let path = req.uri().path().to_string();
-    let normalized_path = if path.len() > 1 {
-        path.trim_end_matches('/')
-    } else {
-        path.as_str()
-    };
    let query = req.uri().query().map(str::to_string);
    let body_limit = api_cfg.request_body_limit_bytes;

    let result: Result<Response<Full<Bytes>>, ApiFailure> = async {
-        match (method.as_str(), normalized_path) {
+        match (method.as_str(), path.as_str()) {
            ("GET", "/v1/health") => {
                let revision = current_revision(&shared.config_path).await?;
                let data = HealthData {
@@ -449,7 +431,7 @@ async fn handle(
                Ok(success_response(status, data, revision))
            }
            _ => {
-                if let Some(user) = normalized_path.strip_prefix("/v1/users/")
+                if let Some(user) = path.strip_prefix("/v1/users/")
                    && !user.is_empty()
                    && !user.contains('/')
                {
@@ -618,12 +600,6 @@ async fn handle(
                        ),
                    ));
                }
-                debug!(
-                    method = method.as_str(),
-                    path = %path,
-                    normalized_path = %normalized_path,
-                    "API route not found"
-                );
                Ok(error_response(
                    request_id,
                    ApiFailure::new(StatusCode::NOT_FOUND, "not_found", "Route not found"),
@@ -452,11 +452,7 @@ fn build_user_links(
    startup_detected_ip_v6: Option<IpAddr>,
 ) -> UserLinks {
    let hosts = resolve_link_hosts(cfg, startup_detected_ip_v4, startup_detected_ip_v6);
-    let port = cfg
-        .general
-        .links
-        .public_port
-        .unwrap_or(resolve_default_link_port(cfg));
+    let port = cfg.general.links.public_port.unwrap_or(cfg.server.port);
    let tls_domains = resolve_tls_domains(cfg);

    let mut classic = Vec::new();
@@ -494,14 +490,6 @@ fn build_user_links(
    }
 }

-fn resolve_default_link_port(cfg: &ProxyConfig) -> u16 {
-    cfg.server
-        .listeners
-        .first()
-        .and_then(|listener| listener.port)
-        .unwrap_or(cfg.server.port)
-}
-
 fn resolve_link_hosts(
    cfg: &ProxyConfig,
    startup_detected_ip_v4: Option<IpAddr>,
@@ -598,17 +598,16 @@ secure = false
 tls = true

 [server]
+port = {port}
 listen_addr_ipv4 = "0.0.0.0"
 listen_addr_ipv6 = "::"

 [[server.listeners]]
 ip = "0.0.0.0"
-port = {port}
 # reuse_allow = false # Set true only when intentionally running multiple telemt instances on same port

 [[server.listeners]]
 ip = "::"
-port = {port}

 [timeouts]
 client_first_byte_idle_secs = 300
@@ -210,7 +210,7 @@ pub(crate) fn default_proxy_protocol_header_timeout_ms() -> u64 {
 }

 pub(crate) fn default_proxy_protocol_trusted_cidrs() -> Vec<IpNetwork> {
-    vec!["0.0.0.0/0".parse().unwrap(), "::/0".parse().unwrap()]
+    Vec::new()
 }

 pub(crate) fn default_server_max_connections() -> u32 {
@@ -615,26 +615,6 @@ pub(crate) fn default_mask_relay_max_bytes() -> usize {
    32 * 1024
 }

-#[cfg(not(test))]
-pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
-    60_000
-}
-
-#[cfg(test)]
-pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
-    200
-}
-
-#[cfg(not(test))]
-pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
-    5_000
-}
-
-#[cfg(test)]
-pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
-    100
-}
-
 pub(crate) fn default_mask_classifier_prefetch_timeout_ms() -> u64 {
    5
 }
@@ -17,9 +17,8 @@
 //! | `network` | `dns_overrides`                | Applied immediately                            |
 //! | `access`  | All user/quota fields          | Effective immediately                          |
 //!
-//! Fields that require re-binding sockets (`server.listeners`, legacy
-//! `server.port`, `censorship.*`, `network.*`, `use_middle_proxy`) are **not**
-//! applied; a warning is emitted.
+//! Fields that require re-binding sockets (`server.port`, `censorship.*`,
+//! `network.*`, `use_middle_proxy`) are **not** applied; a warning is emitted.
 //! Non-hot changes are never mixed into the runtime config snapshot.

 use std::collections::BTreeSet;
@@ -300,7 +299,6 @@ fn listeners_equal(
    }
    lhs.iter().zip(rhs.iter()).all(|(a, b)| {
        a.ip == b.ip
-            && a.port == b.port
            && a.announce == b.announce
            && a.announce_ip == b.announce_ip
            && a.proxy_protocol == b.proxy_protocol
@@ -308,14 +306,6 @@ fn listeners_equal(
    })
 }

-fn resolve_default_link_port(cfg: &ProxyConfig) -> u16 {
-    cfg.server
-        .listeners
-        .first()
-        .and_then(|listener| listener.port)
-        .unwrap_or(cfg.server.port)
-}
-
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 struct WatchManifest {
    files: BTreeSet<PathBuf>,
@@ -570,7 +560,6 @@ fn warn_non_hot_changes(old: &ProxyConfig, new: &ProxyConfig, non_hot_changed: b
    if old.server.api.enabled != new.server.api.enabled
        || old.server.api.listen != new.server.api.listen
        || old.server.api.whitelist != new.server.api.whitelist
-        || old.server.api.gray_action != new.server.api.gray_action
        || old.server.api.auth_header != new.server.api.auth_header
        || old.server.api.request_body_limit_bytes != new.server.api.request_body_limit_bytes
        || old.server.api.minimal_runtime_enabled != new.server.api.minimal_runtime_enabled
@@ -622,8 +611,6 @@ fn warn_non_hot_changes(old: &ProxyConfig, new: &ProxyConfig, non_hot_changed: b
        || old.censorship.mask_shape_above_cap_blur_max_bytes
            != new.censorship.mask_shape_above_cap_blur_max_bytes
        || old.censorship.mask_relay_max_bytes != new.censorship.mask_relay_max_bytes
-        || old.censorship.mask_relay_timeout_ms != new.censorship.mask_relay_timeout_ms
-        || old.censorship.mask_relay_idle_timeout_ms != new.censorship.mask_relay_idle_timeout_ms
        || old.censorship.mask_classifier_prefetch_timeout_ms
            != new.censorship.mask_classifier_prefetch_timeout_ms
        || old.censorship.mask_timing_normalization_enabled
@@ -1130,7 +1117,7 @@ fn log_changes(
                .general
                .links
                .public_port
-                .unwrap_or(resolve_default_link_port(new_cfg));
+                .unwrap_or(new_cfg.server.port);
            for user in &added {
                if let Some(secret) = new_hot.users.get(*user) {
                    print_user_links(user, secret, &host, port, new_cfg);
@@ -47,12 +47,18 @@ pub(crate) struct UserAuthEntry {

 impl UserAuthSnapshot {
    fn from_users(users: &HashMap<String, String>) -> Result<Self> {
+        // Keep runtime user ids stable across reloads so overload scans and
+        // sticky hints do not depend on HashMap iteration order.
+        let mut sorted_users: Vec<_> = users.iter().collect();
+        sorted_users
+            .sort_unstable_by(|(left, _), (right, _)| left.as_bytes().cmp(right.as_bytes()));
+
        let mut entries = Vec::with_capacity(users.len());
        let mut by_name = HashMap::with_capacity(users.len());
        let mut sni_index = HashMap::with_capacity(users.len());
        let mut sni_initial_index = HashMap::with_capacity(users.len());

-        for (user, secret_hex) in users {
+        for (user, secret_hex) in sorted_users {
            let decoded = hex::decode(secret_hex).map_err(|_| ProxyError::InvalidSecret {
                user: user.clone(),
                reason: "Must be 32 hex characters".to_string(),
@@ -253,12 +259,6 @@ fn validate_upstreams(config: &ProxyConfig) -> Result<()> {
    }

    for upstream in &config.upstreams {
-        if matches!(upstream.ipv4, Some(false)) && matches!(upstream.ipv6, Some(false)) {
-            return Err(ProxyError::Config(
-                "upstream.ipv4 and upstream.ipv6 cannot both be false".to_string(),
-            ));
-        }
-
        if let UpstreamType::Shadowsocks { url, .. } = &upstream.upstream_type {
            let parsed = ShadowsocksServerConfig::from_url(url)
                .map_err(|error| ProxyError::Config(format!("invalid shadowsocks url: {error}")))?;
@@ -346,29 +346,12 @@ impl ProxyConfig {
        let update_every_is_explicit = general_table
            .map(|table| table.contains_key("update_every"))
            .unwrap_or(false);
-        let beobachten_is_explicit = general_table
-            .map(|table| table.contains_key("beobachten"))
-            .unwrap_or(false);
-        let beobachten_minutes_is_explicit = general_table
-            .map(|table| table.contains_key("beobachten_minutes"))
-            .unwrap_or(false);
-        let beobachten_flush_secs_is_explicit = general_table
-            .map(|table| table.contains_key("beobachten_flush_secs"))
-            .unwrap_or(false);
-        let beobachten_file_is_explicit = general_table
-            .map(|table| table.contains_key("beobachten_file"))
-            .unwrap_or(false);
        let legacy_secret_is_explicit = general_table
            .map(|table| table.contains_key("proxy_secret_auto_reload_secs"))
            .unwrap_or(false);
        let legacy_config_is_explicit = general_table
            .map(|table| table.contains_key("proxy_config_auto_reload_secs"))
            .unwrap_or(false);
-        let legacy_top_level_beobachten = parsed_toml.get("beobachten").cloned();
-        let legacy_top_level_beobachten_minutes = parsed_toml.get("beobachten_minutes").cloned();
-        let legacy_top_level_beobachten_flush_secs =
-            parsed_toml.get("beobachten_flush_secs").cloned();
-        let legacy_top_level_beobachten_file = parsed_toml.get("beobachten_file").cloned();
        let stun_servers_is_explicit = network_table
            .map(|table| table.contains_key("stun_servers"))
            .unwrap_or(false);
@@ -381,59 +364,6 @@ impl ProxyConfig {
            config.general.update_every = None;
        }

-        // Backward compatibility: legacy top-level beobachten* keys.
-        // Prefer `[general].*` when both are present.
-        let mut legacy_beobachten_applied = false;
-        if !beobachten_is_explicit && let Some(value) = legacy_top_level_beobachten.as_ref() {
-            let parsed = value.as_bool().ok_or_else(|| {
-                ProxyError::Config("beobachten (top-level) must be a boolean".to_string())
-            })?;
-            config.general.beobachten = parsed;
-            legacy_beobachten_applied = true;
-        }
-        if !beobachten_minutes_is_explicit
-            && let Some(value) = legacy_top_level_beobachten_minutes.as_ref()
-        {
-            let raw = value.as_integer().ok_or_else(|| {
-                ProxyError::Config("beobachten_minutes (top-level) must be an integer".to_string())
-            })?;
-            let parsed = u64::try_from(raw).map_err(|_| {
-                ProxyError::Config(
-                    "beobachten_minutes (top-level) must be within u64 range".to_string(),
-                )
-            })?;
-            config.general.beobachten_minutes = parsed;
-            legacy_beobachten_applied = true;
-        }
-        if !beobachten_flush_secs_is_explicit
-            && let Some(value) = legacy_top_level_beobachten_flush_secs.as_ref()
-        {
-            let raw = value.as_integer().ok_or_else(|| {
-                ProxyError::Config(
-                    "beobachten_flush_secs (top-level) must be an integer".to_string(),
-                )
-            })?;
-            let parsed = u64::try_from(raw).map_err(|_| {
-                ProxyError::Config(
-                    "beobachten_flush_secs (top-level) must be within u64 range".to_string(),
-                )
-            })?;
-            config.general.beobachten_flush_secs = parsed;
-            legacy_beobachten_applied = true;
-        }
-        if !beobachten_file_is_explicit
-            && let Some(value) = legacy_top_level_beobachten_file.as_ref()
-        {
-            let parsed = value.as_str().ok_or_else(|| {
-                ProxyError::Config("beobachten_file (top-level) must be a string".to_string())
-            })?;
-            config.general.beobachten_file = parsed.to_string();
-            legacy_beobachten_applied = true;
-        }
-        if legacy_beobachten_applied {
-            warn!("top-level beobachten* keys are deprecated; use general.beobachten* instead");
-        }
-
        let legacy_nat_stun = config.general.middle_proxy_nat_stun.take();
        let legacy_nat_stun_servers =
            std::mem::take(&mut config.general.middle_proxy_nat_stun_servers);
@@ -1326,7 +1256,6 @@ impl ProxyConfig {
            if let Ok(ipv4) = ipv4_str.parse::<IpAddr>() {
                config.server.listeners.push(ListenerConfig {
                    ip: ipv4,
-                    port: Some(config.server.port),
                    announce: None,
                    announce_ip: None,
                    proxy_protocol: None,
@@ -1338,7 +1267,6 @@ impl ProxyConfig {
            {
                config.server.listeners.push(ListenerConfig {
                    ip: ipv6,
-                    port: Some(config.server.port),
                    announce: None,
                    announce_ip: None,
                    proxy_protocol: None,
@@ -1347,13 +1275,6 @@ impl ProxyConfig {
            }
        }

-        // Migration: listeners[].port fallback to legacy server.port.
-        for listener in &mut config.server.listeners {
-            if listener.port.is_none() {
-                listener.port = Some(config.server.port);
-            }
-        }
-
        // Migration: announce_ip → announce for each listener.
        for listener in &mut config.server.listeners {
            if listener.announce.is_none()
@@ -1374,14 +1295,11 @@ impl ProxyConfig {
                upstream_type: UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            });
        }

@@ -1473,21 +1391,6 @@ mod tests {
    const TEST_SHADOWSOCKS_URL: &str =
        "ss://2022-blake3-aes-256-gcm:MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=@127.0.0.1:8388";

-    fn load_config_from_temp_toml(toml: &str) -> ProxyConfig {
-        let nonce = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
-            .as_nanos();
-        let dir = std::env::temp_dir().join(format!("telemt_load_cfg_{nonce}"));
-        std::fs::create_dir_all(&dir).unwrap();
-        let path = dir.join("config.toml");
-        std::fs::write(&path, toml).unwrap();
-        let cfg = ProxyConfig::load(&path).unwrap();
-        let _ = std::fs::remove_file(path);
-        let _ = std::fs::remove_dir(dir);
-        cfg
-    }
-
    #[test]
    fn serde_defaults_remain_unchanged_for_present_sections() {
        let toml = r#"
@@ -1584,7 +1487,6 @@ mod tests {
            cfg.general.rpc_proxy_req_every,
            default_rpc_proxy_req_every()
        );
-        assert_eq!(cfg.general.beobachten_file, default_beobachten_file());
        assert_eq!(cfg.general.update_every, default_update_every());
        assert_eq!(cfg.server.listen_addr_ipv4, default_listen_addr_ipv4());
        assert_eq!(cfg.server.listen_addr_ipv6, default_listen_addr_ipv6_opt());
@@ -1595,7 +1497,6 @@ mod tests {
        assert_eq!(cfg.censorship.unknown_sni_action, UnknownSniAction::Drop);
        assert_eq!(cfg.server.api.listen, default_api_listen());
        assert_eq!(cfg.server.api.whitelist, default_api_whitelist());
-        assert_eq!(cfg.server.api.gray_action, ApiGrayAction::Drop);
        assert_eq!(
            cfg.server.api.request_body_limit_bytes,
            default_api_request_body_limit_bytes()
@@ -1752,7 +1653,6 @@ mod tests {
            default_upstream_connect_failfast_hard_errors()
        );
        assert_eq!(general.rpc_proxy_req_every, default_rpc_proxy_req_every());
-        assert_eq!(general.beobachten_file, default_beobachten_file());
        assert_eq!(general.update_every, default_update_every());

        let server = ServerConfig::default();
@@ -1767,7 +1667,6 @@ mod tests {
        );
        assert_eq!(server.api.listen, default_api_listen());
        assert_eq!(server.api.whitelist, default_api_whitelist());
-        assert_eq!(server.api.gray_action, ApiGrayAction::Drop);
        assert_eq!(
            server.api.request_body_limit_bytes,
            default_api_request_body_limit_bytes()
@@ -1841,10 +1740,7 @@ mod tests {
            "#,
        )
        .unwrap();
-        assert_eq!(
-            cfg_missing.server.proxy_protocol_trusted_cidrs,
-            default_proxy_protocol_trusted_cidrs()
-        );
+        assert!(cfg_missing.server.proxy_protocol_trusted_cidrs.is_empty());

        let cfg_explicit_empty: ProxyConfig = toml::from_str(
            r#"
@@ -1865,6 +1761,46 @@ mod tests {
        );
    }

+    #[test]
+    fn runtime_user_auth_snapshot_order_is_stable_across_hashmap_insertion_orders() {
+        let mut left_users = HashMap::new();
+        left_users.insert(
+            "beta".to_string(),
+            "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb".to_string(),
+        );
+        left_users.insert(
+            "alpha".to_string(),
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(),
+        );
+
+        let mut right_users = HashMap::new();
+        right_users.insert(
+            "alpha".to_string(),
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(),
+        );
+        right_users.insert(
+            "beta".to_string(),
+            "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb".to_string(),
+        );
+
+        let left_snapshot = UserAuthSnapshot::from_users(&left_users).unwrap();
+        let right_snapshot = UserAuthSnapshot::from_users(&right_users).unwrap();
+
+        let left_names: Vec<_> = left_snapshot
+            .entries()
+            .iter()
+            .map(|entry| entry.user.as_str())
+            .collect();
+        let right_names: Vec<_> = right_snapshot
+            .entries()
+            .iter()
+            .map(|entry| entry.user.as_str())
+            .collect();
+
+        assert_eq!(left_names, ["alpha", "beta"]);
+        assert_eq!(left_names, right_names);
+    }
+
    #[test]
    fn unknown_sni_action_parses_and_defaults_to_drop() {
        let cfg_default: ProxyConfig = toml::from_str(
@@ -1915,107 +1851,6 @@ mod tests {
        );
    }

-    #[test]
-    fn api_gray_action_parses_and_defaults_to_drop() {
-        let cfg_default: ProxyConfig = toml::from_str(
-            r#"
-            [server]
-            [general]
-            [network]
-            [access]
-            "#,
-        )
-        .unwrap();
-        assert_eq!(cfg_default.server.api.gray_action, ApiGrayAction::Drop);
-
-        let cfg_api: ProxyConfig = toml::from_str(
-            r#"
-            [server]
-            [general]
-            [network]
-            [access]
-            [server.api]
-            gray_action = "api"
-            "#,
-        )
-        .unwrap();
-        assert_eq!(cfg_api.server.api.gray_action, ApiGrayAction::Api);
-
-        let cfg_200: ProxyConfig = toml::from_str(
-            r#"
-            [server]
-            [general]
-            [network]
-            [access]
-            [server.api]
-            gray_action = "200"
-            "#,
-        )
-        .unwrap();
-        assert_eq!(cfg_200.server.api.gray_action, ApiGrayAction::Ok200);
-
-        let cfg_drop: ProxyConfig = toml::from_str(
-            r#"
-            [server]
-            [general]
-            [network]
-            [access]
-            [server.api]
-            gray_action = "drop"
-            "#,
-        )
-        .unwrap();
-        assert_eq!(cfg_drop.server.api.gray_action, ApiGrayAction::Drop);
-    }
-
-    #[test]
-    fn top_level_beobachten_keys_migrate_to_general_when_general_not_explicit() {
-        let cfg = load_config_from_temp_toml(
-            r#"
-            beobachten = false
-            beobachten_minutes = 7
-            beobachten_flush_secs = 3
-            beobachten_file = "tmp/legacy-beob.txt"
-
-            [server]
-            [general]
-            [network]
-            [access]
-            "#,
-        );
-
-        assert!(!cfg.general.beobachten);
-        assert_eq!(cfg.general.beobachten_minutes, 7);
-        assert_eq!(cfg.general.beobachten_flush_secs, 3);
-        assert_eq!(cfg.general.beobachten_file, "tmp/legacy-beob.txt");
-    }
-
-    #[test]
-    fn general_beobachten_keys_have_priority_over_legacy_top_level() {
-        let cfg = load_config_from_temp_toml(
-            r#"
-            beobachten = true
-            beobachten_minutes = 30
-            beobachten_flush_secs = 30
-            beobachten_file = "tmp/legacy-beob.txt"
-
-            [server]
-            [general]
-            beobachten = false
-            beobachten_minutes = 5
-            beobachten_flush_secs = 2
-            beobachten_file = "tmp/general-beob.txt"
-            [network]
-            [access]
-            "#,
-        );
-
-        assert!(!cfg.general.beobachten);
-        assert_eq!(cfg.general.beobachten_minutes, 5);
-        assert_eq!(cfg.general.beobachten_flush_secs, 2);
-        assert_eq!(cfg.general.beobachten_file, "tmp/general-beob.txt");
-    }
-
    #[test]
    fn dc_overrides_allow_string_and_array() {
        let toml = r#"
@@ -159,21 +159,6 @@ impl MeBindStaleMode {
    }
 }

-/// RST-on-close mode for accepted client sockets.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
-#[serde(rename_all = "lowercase")]
-pub enum RstOnCloseMode {
-    /// Normal FIN on all closes (default, no behaviour change).
-    #[default]
-    Off,
-    /// SO_LINGER(0) on accept; cleared after successful auth.
-    /// Pre-handshake failures (scanners, DPI, timeouts) send RST;
-    /// authenticated relay sessions close gracefully with FIN.
-    Errors,
-    /// SO_LINGER(0) on accept, never cleared — all closes send RST.
-    Always,
-}
-
 /// Middle-End writer floor policy mode.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "lowercase")]
@@ -940,14 +925,6 @@ pub struct GeneralConfig {
    /// Minimum unavailable ME DC groups before degrading.
    #[serde(default = "default_degradation_min_unavailable_dc_groups")]
    pub degradation_min_unavailable_dc_groups: u8,
-
-    /// RST-on-close mode for accepted client sockets.
-    /// `off`    — normal FIN on all closes (default).
-    /// `errors` — SO_LINGER(0) on accept, cleared after successful auth;
-    ///            pre-handshake failures send RST, relayed sessions close gracefully.
-    /// `always` — SO_LINGER(0) on accept, never cleared; all closes send RST.
-    #[serde(default)]
-    pub rst_on_close: RstOnCloseMode,
 }

 impl Default for GeneralConfig {
@@ -1109,7 +1086,6 @@ impl Default for GeneralConfig {
            ntp_servers: default_ntp_servers(),
            auto_degradation_enabled: default_true(),
            degradation_min_unavailable_dc_groups: default_degradation_min_unavailable_dc_groups(),
-            rst_on_close: RstOnCloseMode::default(),
        }
    }
 }
@@ -1153,8 +1129,7 @@ pub struct LinksConfig {
    #[serde(default)]
    pub public_host: Option<String>,

-    /// Public port for tg:// link generation.
-    /// Overrides listener ports and legacy `server.port`.
+    /// Public port for tg:// link generation (overrides server.port).
    #[serde(default)]
    pub public_port: Option<u16>,
 }
@@ -1184,13 +1159,6 @@ pub struct ApiConfig {
    #[serde(default = "default_api_whitelist")]
    pub whitelist: Vec<IpNetwork>,

-    /// Behavior for requests from source IPs outside `whitelist`.
-    /// - `api`: return structured API forbidden response.
-    /// - `200`: return `200 OK` with an empty body.
-    /// - `drop`: close the connection without HTTP response.
-    #[serde(default)]
-    pub gray_action: ApiGrayAction,
-
    /// Optional static value for `Authorization` header validation.
    /// Empty string disables header auth.
    #[serde(default)]
@@ -1235,7 +1203,6 @@ impl Default for ApiConfig {
            enabled: default_true(),
            listen: default_api_listen(),
            whitelist: default_api_whitelist(),
-            gray_action: ApiGrayAction::default(),
            auth_header: String::new(),
            request_body_limit_bytes: default_api_request_body_limit_bytes(),
            minimal_runtime_enabled: default_api_minimal_runtime_enabled(),
@@ -1249,19 +1216,6 @@ impl Default for ApiConfig {
    }
 }

-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
-#[serde(rename_all = "lowercase")]
-pub enum ApiGrayAction {
-    /// Preserve current API behavior for denied source IPs.
-    Api,
-    /// Mimic a plain web endpoint by returning `200 OK` with an empty body.
-    #[serde(rename = "200")]
-    Ok200,
-    /// Drop connection without HTTP response for denied source IPs.
-    #[default]
-    Drop,
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum ConntrackMode {
@@ -1376,8 +1330,6 @@ impl Default for ConntrackControlConfig {

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServerConfig {
-    /// Legacy listener port used for backward compatibility.
-    /// For new configs prefer `[[server.listeners]].port`.
    #[serde(default = "default_port")]
    pub port: u16,

@@ -1411,9 +1363,8 @@ pub struct ServerConfig {

    /// Trusted source CIDRs allowed to send incoming PROXY protocol headers.
    ///
-    /// If this field is omitted in config, it defaults to trust-all CIDRs
-    /// (`0.0.0.0/0` and `::/0`). If it is explicitly set to an empty list,
-    /// all PROXY protocol headers are rejected.
+    /// If this field is omitted in config, it defaults to an empty list and
+    /// all PROXY protocol headers are rejected until trusted CIDRs are set.
    #[serde(default = "default_proxy_protocol_trusted_cidrs")]
    pub proxy_protocol_trusted_cidrs: Vec<IpNetwork>,

@@ -1734,19 +1685,6 @@ pub struct AntiCensorshipConfig {
    #[serde(default = "default_mask_relay_max_bytes")]
    pub mask_relay_max_bytes: usize,

-    /// Wall-clock cap for the full masking relay on non-MTProto fallback paths.
-    /// Raise when the mask target is a long-lived service (e.g. WebSocket).
-    /// Default: 60 000 ms (60 s).
-    #[serde(default = "default_mask_relay_timeout_ms")]
-    pub mask_relay_timeout_ms: u64,
-
-    /// Per-read idle timeout on masking relay and drain paths.
-    /// Limits resource consumption by slow-loris attacks and port scanners.
-    /// A read call stalling beyond this is treated as an abandoned connection.
-    /// Default: 5 000 ms (5 s).
-    #[serde(default = "default_mask_relay_idle_timeout_ms")]
-    pub mask_relay_idle_timeout_ms: u64,
-
    /// Prefetch timeout (ms) for extending fragmented masking classifier window.
    #[serde(default = "default_mask_classifier_prefetch_timeout_ms")]
    pub mask_classifier_prefetch_timeout_ms: u64,
@@ -1792,8 +1730,6 @@ impl Default for AntiCensorshipConfig {
            mask_shape_above_cap_blur: default_mask_shape_above_cap_blur(),
            mask_shape_above_cap_blur_max_bytes: default_mask_shape_above_cap_blur_max_bytes(),
            mask_relay_max_bytes: default_mask_relay_max_bytes(),
-            mask_relay_timeout_ms: default_mask_relay_timeout_ms(),
-            mask_relay_idle_timeout_ms: default_mask_relay_idle_timeout_ms(),
            mask_classifier_prefetch_timeout_ms: default_mask_classifier_prefetch_timeout_ms(),
            mask_timing_normalization_enabled: default_mask_timing_normalization_enabled(),
            mask_timing_normalization_floor_ms: default_mask_timing_normalization_floor_ms(),
@@ -1880,10 +1816,6 @@ pub enum UpstreamType {
        interface: Option<String>,
        #[serde(default)]
        bind_addresses: Option<Vec<String>>,
-        /// Linux-only hard interface pinning via `SO_BINDTODEVICE`.
-        /// Optional alias: `force_bind`.
-        #[serde(default, alias = "force_bind")]
-        bindtodevice: Option<String>,
    },
    Socks4 {
        address: String,
@@ -1920,22 +1852,11 @@ pub struct UpstreamConfig {
    pub scopes: String,
    #[serde(skip)]
    pub selected_scope: String,
-    /// Allow IPv4 DC targets for this upstream.
-    /// `None` means auto-detect from runtime connectivity state.
-    #[serde(default)]
-    pub ipv4: Option<bool>,
-    /// Allow IPv6 DC targets for this upstream.
-    /// `None` means auto-detect from runtime connectivity state.
-    #[serde(default)]
-    pub ipv6: Option<bool>,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ListenerConfig {
    pub ip: IpAddr,
-    /// Per-listener TCP port. If omitted, falls back to legacy `server.port`.
-    #[serde(default)]
-    pub port: Option<u16>,
    /// IP address or hostname to announce in proxy links.
    /// Takes precedence over `announce_ip` if both are set.
    #[serde(default)]
@@ -343,28 +343,15 @@ fn command_exists(binary: &str) -> bool {
    })
 }

-fn listener_port_set(cfg: &ProxyConfig) -> Vec<u16> {
-    let mut ports: BTreeSet<u16> = BTreeSet::new();
-    if cfg.server.listeners.is_empty() {
-        ports.insert(cfg.server.port);
-    } else {
-        for listener in &cfg.server.listeners {
-            ports.insert(listener.port.unwrap_or(cfg.server.port));
-        }
-    }
-    ports.into_iter().collect()
-}
-
-fn notrack_targets(cfg: &ProxyConfig) -> (Vec<(Option<IpAddr>, u16)>, Vec<(Option<IpAddr>, u16)>) {
+fn notrack_targets(cfg: &ProxyConfig) -> (Vec<Option<IpAddr>>, Vec<Option<IpAddr>>) {
    let mode = cfg.server.conntrack_control.mode;
-    let mut v4_targets: BTreeSet<(Option<IpAddr>, u16)> = BTreeSet::new();
-    let mut v6_targets: BTreeSet<(Option<IpAddr>, u16)> = BTreeSet::new();
+    let mut v4_targets: BTreeSet<Option<IpAddr>> = BTreeSet::new();
+    let mut v6_targets: BTreeSet<Option<IpAddr>> = BTreeSet::new();

    match mode {
        ConntrackMode::Tracked => {}
        ConntrackMode::Notrack => {
            if cfg.server.listeners.is_empty() {
-                let port = cfg.server.port;
                if let Some(ipv4) = cfg
                    .server
                    .listen_addr_ipv4
@@ -372,9 +359,9 @@ fn notrack_targets(cfg: &ProxyConfig) -> (Vec<(Option<IpAddr>, u16)>, Vec<(Optio
                    .and_then(|s| s.parse::<IpAddr>().ok())
                {
                    if ipv4.is_unspecified() {
-                        v4_targets.insert((None, port));
+                        v4_targets.insert(None);
                    } else {
-                        v4_targets.insert((Some(ipv4), port));
+                        v4_targets.insert(Some(ipv4));
                    }
                }
                if let Some(ipv6) = cfg
@@ -384,39 +371,33 @@ fn notrack_targets(cfg: &ProxyConfig) -> (Vec<(Option<IpAddr>, u16)>, Vec<(Optio
                    .and_then(|s| s.parse::<IpAddr>().ok())
                {
                    if ipv6.is_unspecified() {
-                        v6_targets.insert((None, port));
+                        v6_targets.insert(None);
                    } else {
-                        v6_targets.insert((Some(ipv6), port));
+                        v6_targets.insert(Some(ipv6));
                    }
                }
            } else {
                for listener in &cfg.server.listeners {
-                    let port = listener.port.unwrap_or(cfg.server.port);
                    if listener.ip.is_ipv4() {
                        if listener.ip.is_unspecified() {
-                            v4_targets.insert((None, port));
+                            v4_targets.insert(None);
                        } else {
-                            v4_targets.insert((Some(listener.ip), port));
+                            v4_targets.insert(Some(listener.ip));
                        }
                    } else if listener.ip.is_unspecified() {
-                        v6_targets.insert((None, port));
+                        v6_targets.insert(None);
                    } else {
-                        v6_targets.insert((Some(listener.ip), port));
+                        v6_targets.insert(Some(listener.ip));
                    }
                }
            }
        }
        ConntrackMode::Hybrid => {
-            let ports = listener_port_set(cfg);
            for ip in &cfg.server.conntrack_control.hybrid_listener_ips {
                if ip.is_ipv4() {
-                    for port in &ports {
-                        v4_targets.insert((Some(*ip), *port));
-                    }
+                    v4_targets.insert(Some(*ip));
                } else {
-                    for port in &ports {
-                        v6_targets.insert((Some(*ip), *port));
-                    }
+                    v6_targets.insert(Some(*ip));
                }
            }
        }
@@ -441,19 +422,19 @@ async fn apply_nft_rules(cfg: &ProxyConfig) -> Result<(), String> {

    let (v4_targets, v6_targets) = notrack_targets(cfg);
    let mut rules = Vec::new();
-    for (ip, port) in v4_targets {
+    for ip in v4_targets {
        let rule = if let Some(ip) = ip {
-            format!("tcp dport {} ip daddr {} notrack", port, ip)
+            format!("tcp dport {} ip daddr {} notrack", cfg.server.port, ip)
        } else {
-            format!("tcp dport {} notrack", port)
+            format!("tcp dport {} notrack", cfg.server.port)
        };
        rules.push(rule);
    }
-    for (ip, port) in v6_targets {
+    for ip in v6_targets {
        let rule = if let Some(ip) = ip {
-            format!("tcp dport {} ip6 daddr {} notrack", port, ip)
+            format!("tcp dport {} ip6 daddr {} notrack", cfg.server.port, ip)
        } else {
-            format!("tcp dport {} notrack", port)
+            format!("tcp dport {} notrack", cfg.server.port)
        };
        rules.push(rule);
    }
@@ -517,7 +498,7 @@ async fn apply_iptables_rules_for_binary(

    let (v4_targets, v6_targets) = notrack_targets(cfg);
    let selected = if ipv4 { v4_targets } else { v6_targets };
-    for (ip, port) in selected {
+    for ip in selected {
        let mut args = vec![
            "-t".to_string(),
            "raw".to_string(),
@@ -526,7 +507,7 @@ async fn apply_iptables_rules_for_binary(
            "-p".to_string(),
            "tcp".to_string(),
            "--dport".to_string(),
-            port.to_string(),
+            cfg.server.port.to_string(),
        ];
        if let Some(ip) = ip {
            args.push("-d".to_string());
@@ -9,7 +9,7 @@ use tokio::net::UnixListener;
 use tokio::sync::{Semaphore, watch};
 use tracing::{debug, error, info, warn};

-use crate::config::{ProxyConfig, RstOnCloseMode};
+use crate::config::ProxyConfig;
 use crate::crypto::SecureRandom;
 use crate::ip_tracker::UserIpTracker;
 use crate::proxy::ClientHandler;
@@ -21,7 +21,6 @@ use crate::stats::{ReplayChecker, Stats};
 use crate::stream::BufferPool;
 use crate::tls_front::TlsFrontCache;
 use crate::transport::middle_proxy::MePool;
-use crate::transport::socket::set_linger_zero;
 use crate::transport::{ListenOptions, UpstreamManager, create_listener, find_listener_processes};

 use super::helpers::{is_expected_handshake_eof, print_proxy_links};
@@ -31,19 +30,6 @@ pub(crate) struct BoundListeners {
    pub(crate) has_unix_listener: bool,
 }

-fn listener_port_or_legacy(listener: &crate::config::ListenerConfig, config: &ProxyConfig) -> u16 {
-    listener.port.unwrap_or(config.server.port)
-}
-
-fn default_link_port(config: &ProxyConfig) -> u16 {
-    config
-        .server
-        .listeners
-        .first()
-        .and_then(|listener| listener.port)
-        .unwrap_or(config.server.port)
-}
-
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn bind_listeners(
    config: &Arc<ProxyConfig>,
@@ -76,8 +62,7 @@ pub(crate) async fn bind_listeners(
    let mut listeners = Vec::new();

    for listener_conf in &config.server.listeners {
-        let listener_port = listener_port_or_legacy(listener_conf, config);
-        let addr = SocketAddr::new(listener_conf.ip, listener_port);
+        let addr = SocketAddr::new(listener_conf.ip, config.server.port);
        if addr.is_ipv4() && !decision_ipv4_dc {
            warn!(%addr, "Skipping IPv4 listener: IPv4 disabled by [network]");
            continue;
@@ -120,7 +105,11 @@ pub(crate) async fn bind_listeners(
                if config.general.links.public_host.is_none()
                    && !config.general.links.show.is_empty()
                {
-                    let link_port = config.general.links.public_port.unwrap_or(listener_port);
+                    let link_port = config
+                        .general
+                        .links
+                        .public_port
+                        .unwrap_or(config.server.port);
                    print_proxy_links(&public_host, link_port, config);
                }

@@ -168,7 +157,7 @@ pub(crate) async fn bind_listeners(
                    .general
                    .links
                    .public_port
-                    .unwrap_or(default_link_port(config)),
+                    .unwrap_or(config.server.port),
            )
        } else {
            let ip = detected_ip_v4.or(detected_ip_v6).map(|ip| ip.to_string());
@@ -183,7 +172,7 @@ pub(crate) async fn bind_listeners(
                    .general
                    .links
                    .public_port
-                    .unwrap_or(default_link_port(config)),
+                    .unwrap_or(config.server.port),
            )
        };

@@ -391,15 +380,6 @@ pub(crate) fn spawn_tcp_accept_loops(
            loop {
                match listener.accept().await {
                    Ok((stream, peer_addr)) => {
-                        let rst_mode = config_rx.borrow().general.rst_on_close;
-                        #[cfg(unix)]
-                        let raw_fd = {
-                            use std::os::unix::io::AsRawFd;
-                            stream.as_raw_fd()
-                        };
-                        if matches!(rst_mode, RstOnCloseMode::Errors | RstOnCloseMode::Always) {
-                            let _ = set_linger_zero(&stream);
-                        }
                        if !*admission_rx_tcp.borrow() {
                            debug!(peer = %peer_addr, "Admission gate closed, dropping connection");
                            drop(stream);
@@ -474,9 +454,6 @@ pub(crate) fn spawn_tcp_accept_loops(
                                shared,
                                proxy_protocol_enabled,
                                real_peer_report_for_handler,
-                                #[cfg(unix)]
-                                raw_fd,
-                                rst_mode,
                            )
                            .run()
                            .await
@@ -81,11 +81,23 @@ pub async fn run() -> std::result::Result<(), Box<dyn std::error::Error>> {
    }
 }

-// Shared maestro startup and main loop. `drop_after_bind` runs on Unix after listeners are bound
-// (for privilege drop); it is a no-op on other platforms.
-async fn run_telemt_core(
-    drop_after_bind: impl FnOnce(),
+#[cfg(unix)]
+async fn run_inner(
+    daemon_opts: DaemonOptions,
 ) -> std::result::Result<(), Box<dyn std::error::Error>> {
+    // Acquire PID file if daemonizing or if explicitly requested
+    // Keep it alive until shutdown (underscore prefix = intentionally kept for RAII cleanup)
+    let _pid_file = if daemon_opts.daemonize || daemon_opts.pid_file.is_some() {
+        let mut pf = PidFile::new(daemon_opts.pid_file_path());
+        if let Err(e) = pf.acquire() {
+            eprintln!("[telemt] {}", e);
+            std::process::exit(1);
+        }
+        Some(pf)
+    } else {
+        None
+    };
+
    let process_started_at = Instant::now();
    let process_started_at_epoch_secs = SystemTime::now()
        .duration_since(UNIX_EPOCH)
@@ -749,8 +761,17 @@ async fn run_telemt_core(
        std::process::exit(1);
    }

-    // On Unix, caller supplies privilege drop after bind (may require root for port < 1024).
-    drop_after_bind();
+    // Drop privileges after binding sockets (which may require root for port < 1024)
+    if daemon_opts.user.is_some() || daemon_opts.group.is_some() {
+        if let Err(e) = drop_privileges(
+            daemon_opts.user.as_deref(),
+            daemon_opts.group.as_deref(),
+            _pid_file.as_ref(),
+        ) {
+            error!(error = %e, "Failed to drop privileges");
+            std::process::exit(1);
+        }
+    }

    runtime_tasks::apply_runtime_log_filter(
        has_rust_log,
@@ -798,39 +819,3 @@ async fn run_telemt_core(

    Ok(())
 }
-
-#[cfg(unix)]
-async fn run_inner(
-    daemon_opts: DaemonOptions,
-) -> std::result::Result<(), Box<dyn std::error::Error>> {
-    // Acquire PID file if daemonizing or if explicitly requested
-    // Keep it alive until shutdown (underscore prefix = intentionally kept for RAII cleanup)
-    let _pid_file = if daemon_opts.daemonize || daemon_opts.pid_file.is_some() {
-        let mut pf = PidFile::new(daemon_opts.pid_file_path());
-        if let Err(e) = pf.acquire() {
-            eprintln!("[telemt] {}", e);
-            std::process::exit(1);
-        }
-        Some(pf)
-    } else {
-        None
-    };
-
-    let user = daemon_opts.user.clone();
-    let group = daemon_opts.group.clone();
-
-    run_telemt_core(|| {
-        if user.is_some() || group.is_some() {
-            if let Err(e) = drop_privileges(user.as_deref(), group.as_deref(), _pid_file.as_ref()) {
-                error!(error = %e, "Failed to drop privileges");
-                std::process::exit(1);
-            }
-        }
-    })
-    .await
-}
-
-#[cfg(not(unix))]
-async fn run_inner() -> std::result::Result<(), Box<dyn std::error::Error>> {
-    run_telemt_core(|| {}).await
-}
@@ -97,7 +97,6 @@ pub async fn run_probe(
        let UpstreamType::Direct {
            interface,
            bind_addresses,
-            ..
        } = &upstream.upstream_type
        else {
            continue;
@@ -804,9 +804,6 @@ pub struct RunningClientHandler {
    beobachten: Arc<BeobachtenStore>,
    shared: Arc<ProxySharedState>,
    proxy_protocol_enabled: bool,
-    #[cfg(unix)]
-    raw_fd: std::os::unix::io::RawFd,
-    rst_on_close: crate::config::RstOnCloseMode,
 }

 impl ClientHandler {
@@ -828,11 +825,6 @@ impl ClientHandler {
        proxy_protocol_enabled: bool,
        real_peer_report: Arc<std::sync::Mutex<Option<SocketAddr>>>,
    ) -> RunningClientHandler {
-        #[cfg(unix)]
-        let raw_fd = {
-            use std::os::unix::io::AsRawFd;
-            stream.as_raw_fd()
-        };
        Self::new_with_shared(
            stream,
            peer,
@@ -850,9 +842,6 @@ impl ClientHandler {
            ProxySharedState::new(),
            proxy_protocol_enabled,
            real_peer_report,
-            #[cfg(unix)]
-            raw_fd,
-            crate::config::RstOnCloseMode::Off,
        )
    }

@@ -874,8 +863,6 @@ impl ClientHandler {
        shared: Arc<ProxySharedState>,
        proxy_protocol_enabled: bool,
        real_peer_report: Arc<std::sync::Mutex<Option<SocketAddr>>>,
-        #[cfg(unix)] raw_fd: std::os::unix::io::RawFd,
-        rst_on_close: crate::config::RstOnCloseMode,
    ) -> RunningClientHandler {
        let normalized_peer = normalize_ip(peer);
        RunningClientHandler {
@@ -896,9 +883,6 @@ impl ClientHandler {
            beobachten,
            shared,
            proxy_protocol_enabled,
-            #[cfg(unix)]
-            raw_fd,
-            rst_on_close,
        }
    }
 }
@@ -917,10 +901,6 @@ impl RunningClientHandler {
            debug!(peer = %peer, error = %e, "Failed to configure client socket");
        }

-        #[cfg(unix)]
-        let raw_fd = self.raw_fd;
-        let rst_on_close = self.rst_on_close;
-
        let outcome = match self.do_handshake().await? {
            Some(outcome) => outcome,
            None => return Ok(()),
@@ -928,14 +908,7 @@ impl RunningClientHandler {

        // Phase 2: relay (WITHOUT handshake timeout — relay has its own activity timeouts)
        match outcome {
-            HandshakeOutcome::NeedsRelay(fut) => {
-                #[cfg(unix)]
-                if matches!(rst_on_close, crate::config::RstOnCloseMode::Errors) {
-                    let _ = crate::transport::socket::clear_linger_fd(raw_fd);
-                }
-                fut.await
-            }
-            HandshakeOutcome::NeedsMasking(fut) => fut.await,
+            HandshakeOutcome::NeedsRelay(fut) | HandshakeOutcome::NeedsMasking(fut) => fut.await,
        }
    }

@@ -55,6 +55,7 @@ const STICKY_HINT_MAX_ENTRIES: usize = 65_536;
 const CANDIDATE_HINT_TRACK_CAP: usize = 64;
 const OVERLOAD_CANDIDATE_BUDGET_HINTED: usize = 16;
 const OVERLOAD_CANDIDATE_BUDGET_UNHINTED: usize = 8;
+const OVERLOAD_FULL_SCAN_USER_THRESHOLD: usize = CANDIDATE_HINT_TRACK_CAP;
 const RECENT_USER_RING_SCAN_LIMIT: usize = 32;

 type HmacSha256 = Hmac<Sha256>;
@@ -242,6 +243,9 @@ fn budget_for_validation(total_users: usize, overload: bool, has_hint: bool) ->
    if !overload {
        return total_users;
    }
+    if total_users <= OVERLOAD_FULL_SCAN_USER_THRESHOLD {
+        return total_users;
+    }
    let cap = if has_hint {
        OVERLOAD_CANDIDATE_BUDGET_HINTED
    } else {
@@ -250,6 +254,28 @@ fn budget_for_validation(total_users: usize, overload: bool, has_hint: bool) ->
    total_users.min(cap.max(1))
 }

+// Rotate partial overload scans across larger snapshots so one truncated
+// validation window does not permanently starve the same cold users.
+fn candidate_scan_start_offset_in(
+    shared: &ProxySharedState,
+    peer_ip: IpAddr,
+    total_users: usize,
+    candidate_budget: usize,
+) -> usize {
+    if total_users == 0 || candidate_budget >= total_users {
+        return 0;
+    }
+
+    let seq = shared
+        .handshake
+        .auth_candidate_scan_seq
+        .fetch_add(1, Ordering::Relaxed);
+    let mut hasher = shared.handshake.auth_probe_eviction_hasher.build_hasher();
+    peer_ip.hash(&mut hasher);
+    seq.hash(&mut hasher);
+    hasher.finish() as usize % total_users
+}
+
 fn parse_tls_auth_material(
    handshake: &[u8],
    ignore_time_skew: bool,
@@ -1312,7 +1338,14 @@ where
        }

        if !matched && !budget_exhausted {
-            for idx in 0..snapshot.entries().len() {
+            let fallback_start = candidate_scan_start_offset_in(
+                shared,
+                peer.ip(),
+                snapshot.entries().len(),
+                candidate_budget,
+            );
+            for offset in 0..snapshot.entries().len() {
+                let idx = (fallback_start + offset) % snapshot.entries().len();
                let Some(user_id) = u32::try_from(idx).ok() else {
                    break;
                };
@@ -1679,7 +1712,14 @@ where
        }

        if !matched && !budget_exhausted {
-            for idx in 0..snapshot.entries().len() {
+            let fallback_start = candidate_scan_start_offset_in(
+                shared,
+                peer.ip(),
+                snapshot.entries().len(),
+                candidate_budget,
+            );
+            for offset in 0..snapshot.entries().len() {
+                let idx = (fallback_start + offset) % snapshot.entries().len();
                let Some(user_id) = u32::try_from(idx).ok() else {
                    break;
                };
@@ -28,10 +28,14 @@ use tracing::debug;
 const MASK_TIMEOUT: Duration = Duration::from_secs(5);
 #[cfg(test)]
 const MASK_TIMEOUT: Duration = Duration::from_millis(50);
-/// Maximum duration for the entire masking relay under test (replaced by config at runtime).
+/// Maximum duration for the entire masking relay.
+/// Limits resource consumption from slow-loris attacks and port scanners.
+#[cfg(not(test))]
+const MASK_RELAY_TIMEOUT: Duration = Duration::from_secs(60);
 #[cfg(test)]
 const MASK_RELAY_TIMEOUT: Duration = Duration::from_millis(200);
-/// Per-read idle timeout for masking relay and drain paths under test (replaced by config at runtime).
+#[cfg(not(test))]
+const MASK_RELAY_IDLE_TIMEOUT: Duration = Duration::from_secs(5);
 #[cfg(test)]
 const MASK_RELAY_IDLE_TIMEOUT: Duration = Duration::from_millis(100);
 const MASK_BUFFER_SIZE: usize = 8192;
@@ -51,7 +55,6 @@ async fn copy_with_idle_timeout<R, W>(
    writer: &mut W,
    byte_cap: usize,
    shutdown_on_eof: bool,
-    idle_timeout: Duration,
 ) -> CopyOutcome
 where
    R: AsyncRead + Unpin,
@@ -75,7 +78,7 @@ where
        }

        let read_len = remaining_budget.min(MASK_BUFFER_SIZE);
-        let read_res = timeout(idle_timeout, reader.read(&mut buf[..read_len])).await;
+        let read_res = timeout(MASK_RELAY_IDLE_TIMEOUT, reader.read(&mut buf[..read_len])).await;
        let n = match read_res {
            Ok(Ok(n)) => n,
            Ok(Err(_)) | Err(_) => break,
@@ -83,13 +86,13 @@ where
        if n == 0 {
            ended_by_eof = true;
            if shutdown_on_eof {
-                let _ = timeout(idle_timeout, writer.shutdown()).await;
+                let _ = timeout(MASK_RELAY_IDLE_TIMEOUT, writer.shutdown()).await;
            }
            break;
        }
        total = total.saturating_add(n);

-        let write_res = timeout(idle_timeout, writer.write_all(&buf[..n])).await;
+        let write_res = timeout(MASK_RELAY_IDLE_TIMEOUT, writer.write_all(&buf[..n])).await;
        match write_res {
            Ok(Ok(())) => {}
            Ok(Err(_)) | Err(_) => break,
@@ -227,20 +230,13 @@ where
    }
 }

-async fn consume_client_data_with_timeout_and_cap<R>(
-    reader: R,
-    byte_cap: usize,
-    relay_timeout: Duration,
-    idle_timeout: Duration,
-) where
+async fn consume_client_data_with_timeout_and_cap<R>(reader: R, byte_cap: usize)
+where
    R: AsyncRead + Unpin,
 {
-    if timeout(
-        relay_timeout,
-        consume_client_data(reader, byte_cap, idle_timeout),
-    )
-    .await
-    .is_err()
+    if timeout(MASK_RELAY_TIMEOUT, consume_client_data(reader, byte_cap))
+        .await
+        .is_err()
    {
        debug!("Timed out while consuming client data on masking fallback path");
    }
@@ -510,6 +506,40 @@ fn is_mask_target_local_listener_with_interfaces(
    local_addr: SocketAddr,
    resolved_override: Option<SocketAddr>,
    interface_ips: &[IpAddr],
+) -> bool {
+    let resolved_candidates = resolved_override
+        .as_ref()
+        .map(std::slice::from_ref)
+        .unwrap_or(&[]);
+    is_mask_target_local_listener_candidates_with_interfaces(
+        mask_host,
+        mask_port,
+        local_addr,
+        resolved_candidates,
+        interface_ips,
+    )
+}
+
+fn mask_ip_targets_local_listener(
+    mask_ip: IpAddr,
+    local_ip: IpAddr,
+    interface_ips: &[IpAddr],
+) -> bool {
+    let mask_ip = canonical_ip(mask_ip);
+    if mask_ip == local_ip {
+        return true;
+    }
+
+    local_ip.is_unspecified()
+        && (mask_ip.is_loopback() || mask_ip.is_unspecified() || interface_ips.contains(&mask_ip))
+}
+
+fn is_mask_target_local_listener_candidates_with_interfaces(
+    mask_host: &str,
+    mask_port: u16,
+    local_addr: SocketAddr,
+    resolved_candidates: &[SocketAddr],
+    interface_ips: &[IpAddr],
 ) -> bool {
    if mask_port != local_addr.port() {
        return false;
@@ -518,31 +548,14 @@ fn is_mask_target_local_listener_with_interfaces(
    let local_ip = canonical_ip(local_addr.ip());
    let literal_mask_ip = parse_mask_host_ip_literal(mask_host).map(canonical_ip);

-    if let Some(addr) = resolved_override {
-        let resolved_ip = canonical_ip(addr.ip());
-        if resolved_ip == local_ip {
-            return true;
-        }
-
-        if local_ip.is_unspecified()
-            && (resolved_ip.is_loopback()
-                || resolved_ip.is_unspecified()
-                || interface_ips.contains(&resolved_ip))
-        {
+    for addr in resolved_candidates {
+        if mask_ip_targets_local_listener(addr.ip(), local_ip, interface_ips) {
            return true;
        }
    }

    if let Some(mask_ip) = literal_mask_ip {
-        if mask_ip == local_ip {
-            return true;
-        }
-
-        if local_ip.is_unspecified()
-            && (mask_ip.is_loopback()
-                || mask_ip.is_unspecified()
-                || interface_ips.contains(&mask_ip))
-        {
+        if mask_ip_targets_local_listener(mask_ip, local_ip, interface_ips) {
            return true;
        }
    }
@@ -576,21 +589,67 @@ async fn is_mask_target_local_listener_async(
    mask_port: u16,
    local_addr: SocketAddr,
    resolved_override: Option<SocketAddr>,
+) -> bool {
+    let resolved_candidates = resolved_override
+        .as_ref()
+        .map(std::slice::from_ref)
+        .unwrap_or(&[]);
+    is_mask_target_local_listener_candidates_async(
+        mask_host,
+        mask_port,
+        local_addr,
+        resolved_candidates,
+    )
+    .await
+}
+
+async fn is_mask_target_local_listener_candidates_async(
+    mask_host: &str,
+    mask_port: u16,
+    local_addr: SocketAddr,
+    resolved_candidates: &[SocketAddr],
 ) -> bool {
    if mask_port != local_addr.port() {
        return false;
    }

    let interfaces = local_interface_ips_async().await;
-    is_mask_target_local_listener_with_interfaces(
+    is_mask_target_local_listener_candidates_with_interfaces(
        mask_host,
        mask_port,
        local_addr,
-        resolved_override,
+        resolved_candidates,
        &interfaces,
    )
 }

+// Resolve hostnames through the same OS DNS path `TcpStream::connect` uses so
+// self-target rejection also catches loopback and local-interface hostnames.
+async fn resolve_mask_target_candidates(
+    mask_host: &str,
+    mask_port: u16,
+    resolved_override: Option<SocketAddr>,
+) -> Vec<SocketAddr> {
+    if let Some(addr) = resolved_override {
+        return vec![addr];
+    }
+
+    if parse_mask_host_ip_literal(mask_host).is_some() {
+        return Vec::new();
+    }
+
+    let mut resolved = Vec::new();
+    if let Ok(addrs) = tokio::net::lookup_host((mask_host, mask_port)).await {
+        for addr in addrs {
+            if !resolved.contains(&addr) {
+                resolved.push(addr);
+            }
+        }
+    }
+
+    resolved
+}
+
 fn masking_beobachten_ttl(config: &ProxyConfig) -> Duration {
    let minutes = config.general.beobachten_minutes;
    let clamped = minutes.clamp(1, 24 * 60);
@@ -643,18 +702,10 @@ pub async fn handle_bad_client<R, W>(
        beobachten.record(client_type, peer.ip(), ttl);
    }

-    let relay_timeout = Duration::from_millis(config.censorship.mask_relay_timeout_ms);
-    let idle_timeout = Duration::from_millis(config.censorship.mask_relay_idle_timeout_ms);
-
    if !config.censorship.mask {
        // Masking disabled, just consume data
-        consume_client_data_with_timeout_and_cap(
-            reader,
-            config.censorship.mask_relay_max_bytes,
-            relay_timeout,
-            idle_timeout,
-        )
-        .await;
+        consume_client_data_with_timeout_and_cap(reader, config.censorship.mask_relay_max_bytes)
+            .await;
        return;
    }

@@ -686,7 +737,7 @@ pub async fn handle_bad_client<R, W>(
                    return;
                }
                if timeout(
-                    relay_timeout,
+                    MASK_RELAY_TIMEOUT,
                    relay_to_mask(
                        reader,
                        writer,
@@ -700,7 +751,6 @@ pub async fn handle_bad_client<R, W>(
                        config.censorship.mask_shape_above_cap_blur_max_bytes,
                        config.censorship.mask_shape_hardening_aggressive_mode,
                        config.censorship.mask_relay_max_bytes,
-                        idle_timeout,
                    ),
                )
                .await
@@ -716,8 +766,6 @@ pub async fn handle_bad_client<R, W>(
                consume_client_data_with_timeout_and_cap(
                    reader,
                    config.censorship.mask_relay_max_bytes,
-                    relay_timeout,
-                    idle_timeout,
                )
                .await;
                wait_mask_outcome_budget(outcome_started, config).await;
@@ -727,8 +775,6 @@ pub async fn handle_bad_client<R, W>(
                consume_client_data_with_timeout_and_cap(
                    reader,
                    config.censorship.mask_relay_max_bytes,
-                    relay_timeout,
-                    idle_timeout,
                )
                .await;
                wait_mask_outcome_budget(outcome_started, config).await;
@@ -748,8 +794,15 @@ pub async fn handle_bad_client<R, W>(
    // Self-referential masking can create recursive proxy loops under
    // misconfiguration and leak distinguishable load spikes to adversaries.
    let resolved_mask_addr = resolve_socket_addr(mask_host, mask_port);
-    if is_mask_target_local_listener_async(mask_host, mask_port, local_addr, resolved_mask_addr)
-        .await
+    let resolved_mask_candidates =
+        resolve_mask_target_candidates(mask_host, mask_port, resolved_mask_addr).await;
+    if is_mask_target_local_listener_candidates_async(
+        mask_host,
+        mask_port,
+        local_addr,
+        &resolved_mask_candidates,
+    )
+    .await
    {
        let outcome_started = Instant::now();
        debug!(
@@ -759,13 +812,8 @@ pub async fn handle_bad_client<R, W>(
            local = %local_addr,
            "Mask target resolves to local listener; refusing self-referential masking fallback"
        );
-        consume_client_data_with_timeout_and_cap(
-            reader,
-            config.censorship.mask_relay_max_bytes,
-            relay_timeout,
-            idle_timeout,
-        )
-        .await;
+        consume_client_data_with_timeout_and_cap(reader, config.censorship.mask_relay_max_bytes)
+            .await;
        wait_mask_outcome_budget(outcome_started, config).await;
        return;
    }
@@ -799,7 +847,7 @@ pub async fn handle_bad_client<R, W>(
                return;
            }
            if timeout(
-                relay_timeout,
+                MASK_RELAY_TIMEOUT,
                relay_to_mask(
                    reader,
                    writer,
@@ -813,7 +861,6 @@ pub async fn handle_bad_client<R, W>(
                    config.censorship.mask_shape_above_cap_blur_max_bytes,
                    config.censorship.mask_shape_hardening_aggressive_mode,
                    config.censorship.mask_relay_max_bytes,
-                    idle_timeout,
                ),
            )
            .await
@@ -829,8 +876,6 @@ pub async fn handle_bad_client<R, W>(
            consume_client_data_with_timeout_and_cap(
                reader,
                config.censorship.mask_relay_max_bytes,
-                relay_timeout,
-                idle_timeout,
            )
            .await;
            wait_mask_outcome_budget(outcome_started, config).await;
@@ -840,8 +885,6 @@ pub async fn handle_bad_client<R, W>(
            consume_client_data_with_timeout_and_cap(
                reader,
                config.censorship.mask_relay_max_bytes,
-                relay_timeout,
-                idle_timeout,
            )
            .await;
            wait_mask_outcome_budget(outcome_started, config).await;
@@ -863,7 +906,6 @@ async fn relay_to_mask<R, W, MR, MW>(
    shape_above_cap_blur_max_bytes: usize,
    shape_hardening_aggressive_mode: bool,
    mask_relay_max_bytes: usize,
-    idle_timeout: Duration,
 ) where
    R: AsyncRead + Unpin + Send + 'static,
    W: AsyncWrite + Unpin + Send + 'static,
@@ -885,19 +927,11 @@ async fn relay_to_mask<R, W, MR, MW>(
                &mut mask_write,
                mask_relay_max_bytes,
                !shape_hardening_enabled,
-                idle_timeout,
            )
            .await
        },
        async {
-            copy_with_idle_timeout(
-                &mut mask_read,
-                &mut writer,
-                mask_relay_max_bytes,
-                true,
-                idle_timeout,
-            )
-            .await
+            copy_with_idle_timeout(&mut mask_read, &mut writer, mask_relay_max_bytes, true).await
        }
    );

@@ -925,11 +959,7 @@ async fn relay_to_mask<R, W, MR, MW>(
 }

 /// Just consume all data from client without responding.
-async fn consume_client_data<R: AsyncRead + Unpin>(
-    mut reader: R,
-    byte_cap: usize,
-    idle_timeout: Duration,
-) {
+async fn consume_client_data<R: AsyncRead + Unpin>(mut reader: R, byte_cap: usize) {
    if byte_cap == 0 {
        return;
    }
@@ -945,7 +975,7 @@ async fn consume_client_data<R: AsyncRead + Unpin>(
        }

        let read_len = remaining_budget.min(MASK_BUFFER_SIZE);
-        let n = match timeout(idle_timeout, reader.read(&mut buf[..read_len])).await {
+        let n = match timeout(MASK_RELAY_IDLE_TIMEOUT, reader.read(&mut buf[..read_len])).await {
            Ok(Ok(n)) => n,
            Ok(Err(_)) | Err(_) => break,
        };
@@ -48,6 +48,7 @@ pub(crate) struct HandshakeSharedState {
    pub(crate) sticky_user_by_sni_hash: DashMap<u64, u32>,
    pub(crate) recent_user_ring: Box<[AtomicU32]>,
    pub(crate) recent_user_ring_seq: AtomicU64,
+    pub(crate) auth_candidate_scan_seq: AtomicU64,
    pub(crate) auth_expensive_checks_total: AtomicU64,
    pub(crate) auth_budget_exhausted_total: AtomicU64,
 }
@@ -86,6 +87,7 @@ impl ProxySharedState {
                    .collect::<Vec<_>>()
                    .into_boxed_slice(),
                recent_user_ring_seq: AtomicU64::new(0),
+                auth_candidate_scan_seq: AtomicU64::new(0),
                auth_expensive_checks_total: AtomicU64::new(0),
                auth_budget_exhausted_total: AtomicU64::new(0),
            },
@@ -31,14 +31,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -27,14 +27,11 @@ fn build_harness(config: ProxyConfig) -> PipelineHarness {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -25,14 +25,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -38,14 +38,11 @@ fn build_harness(secret_hex: &str, mask_port: u16) -> PipelineHarness {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -16,14 +16,11 @@ fn make_test_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -39,14 +39,11 @@ fn build_harness(secret_hex: &str, mask_port: u16) -> RedTeamHarness {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -232,14 +229,11 @@ async fn redteam_03_masking_duration_must_be_less_than_1ms_when_backend_down() {
                upstream_type: UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            1,
@@ -476,14 +470,11 @@ async fn measure_invalid_probe_duration_ms(delay_ms: u64, tls_len: u16, body_sen
                upstream_type: UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            1,
@@ -553,14 +544,11 @@ async fn capture_forwarded_probe_len(tls_len: u16, body_sent: usize) -> usize {
                upstream_type: UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            1,
@@ -13,14 +13,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -11,14 +11,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -25,14 +25,11 @@ fn new_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -332,14 +332,11 @@ async fn relay_task_abort_releases_user_gate_and_ip_reservation() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -449,14 +446,11 @@ async fn relay_cutover_releases_user_gate_and_ip_reservation() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -576,14 +570,11 @@ async fn integration_route_cutover_and_quota_overlap_fails_closed_and_releases_s
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -749,14 +740,11 @@ async fn proxy_protocol_header_is_rejected_when_trust_list_is_empty() {
            upstream_type: crate::config::UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -829,14 +817,11 @@ async fn proxy_protocol_header_from_untrusted_peer_range_is_rejected_under_load(
                upstream_type: crate::config::UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            1,
@@ -992,14 +977,11 @@ async fn short_tls_probe_is_masked_through_client_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1083,14 +1065,11 @@ async fn tls12_record_probe_is_masked_through_client_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1172,14 +1151,11 @@ async fn handle_client_stream_increments_connects_all_exactly_once() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1268,14 +1244,11 @@ async fn running_client_handler_increments_connects_all_exactly_once() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1361,14 +1334,11 @@ async fn idle_pooled_connection_closes_cleanly_in_generic_stream_path() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1435,14 +1405,11 @@ async fn idle_pooled_connection_closes_cleanly_in_client_handler_path() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1524,14 +1491,11 @@ async fn partial_tls_header_stall_triggers_handshake_timeout() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1852,14 +1816,11 @@ async fn valid_tls_path_does_not_fall_back_to_mask_backend() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1964,14 +1925,11 @@ async fn valid_tls_with_invalid_mtproto_falls_back_to_mask_backend() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -2074,14 +2032,11 @@ async fn client_handler_tls_bad_mtproto_is_forwarded_to_mask_backend() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -2199,14 +2154,11 @@ async fn alpn_mismatch_tls_probe_is_masked_through_client_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -2295,14 +2247,11 @@ async fn invalid_hmac_tls_probe_is_masked_through_client_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -2397,14 +2346,11 @@ async fn burst_invalid_tls_probes_are_masked_verbatim() {
                upstream_type: UpstreamType::Direct {
                    interface: None,
                    bind_addresses: None,
-                    bindtodevice: None,
                },
                weight: 1,
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            1,
@@ -3305,14 +3251,11 @@ async fn relay_connect_error_releases_user_and_ip_before_return() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -3869,14 +3812,11 @@ async fn untrusted_proxy_header_source_is_rejected() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -3942,14 +3882,11 @@ async fn empty_proxy_trusted_cidrs_rejects_proxy_header_by_default() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4042,14 +3979,11 @@ async fn oversized_tls_record_is_masked_in_generic_stream_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4148,14 +4082,11 @@ async fn oversized_tls_record_is_masked_in_client_handler_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4268,14 +4199,11 @@ async fn tls_record_len_min_minus_1_is_rejected_in_generic_stream_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4374,14 +4302,11 @@ async fn tls_record_len_min_minus_1_is_rejected_in_client_handler_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4483,14 +4408,11 @@ async fn tls_record_len_16384_is_accepted_in_generic_stream_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -4587,14 +4509,11 @@ async fn tls_record_len_16384_is_accepted_in_client_handler_pipeline() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -24,14 +24,11 @@ fn make_test_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -26,14 +26,11 @@ fn make_test_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -27,14 +27,11 @@ fn make_test_upstream_manager(stats: Arc<Stats>) -> Arc<UpstreamManager> {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -41,14 +41,11 @@ fn build_harness(secret_hex: &str, mask_port: u16) -> PipelineHarness {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1293,14 +1293,11 @@ async fn direct_relay_abort_midflight_releases_route_gauge() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1403,14 +1400,11 @@ async fn direct_relay_cutover_midflight_releases_route_gauge() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1528,14 +1522,11 @@ async fn direct_relay_cutover_storm_multi_session_keeps_generic_errors_and_relea
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -1767,11 +1758,8 @@ async fn negative_direct_relay_dc_connection_refused_fails_fast() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        100,
@@ -1861,11 +1849,8 @@ async fn adversarial_direct_relay_cutover_integrity() {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        100,
@@ -1146,9 +1146,9 @@ async fn tls_overload_budget_limits_candidate_scan_depth() {
    let mut config = ProxyConfig::default();
    config.access.users.clear();
    config.access.ignore_time_skew = true;
-    for idx in 0..32u8 {
+    for idx in 0..96u8 {
        config.access.users.insert(
-            format!("user-{idx}"),
+            format!("user-{idx:02}"),
            format!("{:032x}", u128::from(idx) + 1),
        );
    }
@@ -1203,6 +1203,64 @@ async fn tls_overload_budget_limits_candidate_scan_depth() {
    );
 }

+#[tokio::test]
+async fn tls_overload_full_scans_small_runtime_snapshot_to_preserve_cold_user_auth() {
+    let mut config = ProxyConfig::default();
+    config.access.users.clear();
+    config.access.ignore_time_skew = true;
+    for idx in 0..32u8 {
+        config.access.users.insert(
+            format!("user-{idx:02}"),
+            format!("{:032x}", u128::from(idx) + 1),
+        );
+    }
+    config.rebuild_runtime_user_auth().unwrap();
+
+    let replay_checker = ReplayChecker::new(128, Duration::from_secs(60));
+    let rng = SecureRandom::new();
+    let shared = ProxySharedState::new();
+    let now = Instant::now();
+    {
+        let mut saturation = shared.handshake.auth_probe_saturation.lock().unwrap();
+        *saturation = Some(AuthProbeSaturationState {
+            fail_streak: AUTH_PROBE_BACKOFF_START_FAILS,
+            blocked_until: now + Duration::from_millis(200),
+            last_seen: now,
+        });
+    }
+
+    let peer: SocketAddr = "198.51.100.214:44326".parse().unwrap();
+    let mut secret = [0u8; 16];
+    secret[15] = 32;
+    let handshake = make_valid_tls_handshake(&secret, 0);
+
+    let result = handle_tls_handshake_with_shared(
+        &handshake,
+        tokio::io::empty(),
+        tokio::io::sink(),
+        peer,
+        &config,
+        &replay_checker,
+        &rng,
+        None,
+        shared.as_ref(),
+    )
+    .await;
+
+    assert!(
+        matches!(result, HandshakeResult::Success(_)),
+        "overload mode must still authenticate valid cold users when runtime snapshot stays small"
+    );
+    assert_eq!(
+        shared
+            .handshake
+            .auth_expensive_checks_total
+            .load(Ordering::Relaxed),
+        32,
+        "small saturated snapshots must remain fully scannable"
+    );
+}
+
 #[tokio::test]
 async fn mtproto_runtime_snapshot_prefers_preferred_user_hint() {
    let mut config = ProxyConfig::default();
@@ -1255,6 +1313,66 @@ async fn mtproto_runtime_snapshot_prefers_preferred_user_hint() {
    );
 }

+#[tokio::test]
+async fn mtproto_overload_full_scans_small_runtime_snapshot_to_preserve_cold_user_auth() {
+    let mut config = ProxyConfig::default();
+    config.general.modes.secure = true;
+    config.access.users.clear();
+    config.access.ignore_time_skew = true;
+    for idx in 0..32u8 {
+        config.access.users.insert(
+            format!("user-{idx:02}"),
+            format!("{:032x}", u128::from(idx) + 1),
+        );
+    }
+    config.rebuild_runtime_user_auth().unwrap();
+
+    let shared = ProxySharedState::new();
+    let now = Instant::now();
+    {
+        let mut saturation = shared.handshake.auth_probe_saturation.lock().unwrap();
+        *saturation = Some(AuthProbeSaturationState {
+            fail_streak: AUTH_PROBE_BACKOFF_START_FAILS,
+            blocked_until: now + Duration::from_millis(200),
+            last_seen: now,
+        });
+    }
+
+    let replay_checker = ReplayChecker::new(128, Duration::from_secs(60));
+    let handshake = make_valid_mtproto_handshake(
+        "00000000000000000000000000000020",
+        ProtoTag::Secure,
+        2,
+    );
+    let peer: SocketAddr = "198.51.100.215:44326".parse().unwrap();
+
+    let result = handle_mtproto_handshake_with_shared(
+        &handshake,
+        tokio::io::empty(),
+        tokio::io::sink(),
+        peer,
+        &config,
+        &replay_checker,
+        false,
+        None,
+        shared.as_ref(),
+    )
+    .await;
+
+    assert!(
+        matches!(result, HandshakeResult::Success(_)),
+        "overload mode must still authenticate valid direct MTProto users when runtime snapshot stays small"
+    );
+    assert_eq!(
+        shared
+            .handshake
+            .auth_expensive_checks_total
+            .load(Ordering::Relaxed),
+        32,
+        "small saturated MTProto snapshots must remain fully scannable"
+    );
+}
+
 #[tokio::test]
 async fn alpn_enforce_rejects_unsupported_client_alpn() {
    let secret = [0x33u8; 16];
@@ -47,7 +47,7 @@ async fn consume_client_data_stops_after_byte_cap_without_eof() {
    };
    let cap = 10_000usize;

-    consume_client_data(reader, cap, MASK_RELAY_IDLE_TIMEOUT).await;
+    consume_client_data(reader, cap).await;

    let total = produced.load(Ordering::Relaxed);
    assert!(
@@ -31,7 +31,7 @@ async fn stalling_client_terminates_at_idle_not_relay_timeout() {

    let result = tokio::time::timeout(
        MASK_RELAY_TIMEOUT,
-        consume_client_data(reader, MASK_BUFFER_SIZE * 4, MASK_RELAY_IDLE_TIMEOUT),
+        consume_client_data(reader, MASK_BUFFER_SIZE * 4),
    )
    .await;

@@ -57,12 +57,9 @@ async fn fast_reader_drains_to_eof() {
    let data = vec![0xAAu8; 32 * 1024];
    let reader = std::io::Cursor::new(data);

-    tokio::time::timeout(
-        MASK_RELAY_TIMEOUT,
-        consume_client_data(reader, usize::MAX, MASK_RELAY_IDLE_TIMEOUT),
-    )
-    .await
-    .expect("consume_client_data did not complete for fast EOF reader");
+    tokio::time::timeout(MASK_RELAY_TIMEOUT, consume_client_data(reader, usize::MAX))
+        .await
+        .expect("consume_client_data did not complete for fast EOF reader");
 }

 #[tokio::test]
@@ -84,7 +81,7 @@ async fn io_error_terminates_cleanly() {

    tokio::time::timeout(
        MASK_RELAY_TIMEOUT,
-        consume_client_data(ErrReader, usize::MAX, MASK_RELAY_IDLE_TIMEOUT),
+        consume_client_data(ErrReader, usize::MAX),
    )
    .await
    .expect("consume_client_data did not return on I/O error");
@@ -34,11 +34,7 @@ async fn consume_stall_stress_finishes_within_idle_budget() {
        set.spawn(async {
            tokio::time::timeout(
                MASK_RELAY_TIMEOUT,
-                consume_client_data(
-                    OneByteThenStall { sent: false },
-                    usize::MAX,
-                    MASK_RELAY_IDLE_TIMEOUT,
-                ),
+                consume_client_data(OneByteThenStall { sent: false }, usize::MAX),
            )
            .await
            .expect("consume_client_data exceeded relay timeout under stall load");
@@ -60,7 +56,7 @@ async fn consume_stall_stress_finishes_within_idle_budget() {
 #[tokio::test]
 async fn consume_zero_cap_returns_immediately() {
    let started = Instant::now();
-    consume_client_data(tokio::io::empty(), 0, MASK_RELAY_IDLE_TIMEOUT).await;
+    consume_client_data(tokio::io::empty(), 0).await;
    assert!(
        started.elapsed() < MASK_RELAY_IDLE_TIMEOUT,
        "zero byte cap must return immediately"
@@ -127,14 +127,7 @@ async fn positive_copy_with_production_cap_stops_exactly_at_budget() {
    let mut reader = FinitePatternReader::new(PROD_CAP_BYTES + (256 * 1024), 4096, read_calls);
    let mut writer = CountingWriter::default();

-    let outcome = copy_with_idle_timeout(
-        &mut reader,
-        &mut writer,
-        PROD_CAP_BYTES,
-        true,
-        MASK_RELAY_IDLE_TIMEOUT,
-    )
-    .await;
+    let outcome = copy_with_idle_timeout(&mut reader, &mut writer, PROD_CAP_BYTES, true).await;

    assert_eq!(
        outcome.total, PROD_CAP_BYTES,
@@ -152,13 +145,7 @@ async fn negative_consume_with_zero_cap_performs_no_reads() {
    let read_calls = Arc::new(AtomicUsize::new(0));
    let reader = FinitePatternReader::new(1024, 64, Arc::clone(&read_calls));

-    consume_client_data_with_timeout_and_cap(
-        reader,
-        0,
-        MASK_RELAY_TIMEOUT,
-        MASK_RELAY_IDLE_TIMEOUT,
-    )
-    .await;
+    consume_client_data_with_timeout_and_cap(reader, 0).await;

    assert_eq!(
        read_calls.load(Ordering::Relaxed),
@@ -174,14 +161,7 @@ async fn edge_copy_below_cap_reports_eof_without_overread() {
    let mut reader = FinitePatternReader::new(payload, 3072, read_calls);
    let mut writer = CountingWriter::default();

-    let outcome = copy_with_idle_timeout(
-        &mut reader,
-        &mut writer,
-        PROD_CAP_BYTES,
-        true,
-        MASK_RELAY_IDLE_TIMEOUT,
-    )
-    .await;
+    let outcome = copy_with_idle_timeout(&mut reader, &mut writer, PROD_CAP_BYTES, true).await;

    assert_eq!(outcome.total, payload);
    assert_eq!(writer.written, payload);
@@ -195,13 +175,7 @@ async fn edge_copy_below_cap_reports_eof_without_overread() {
 async fn adversarial_blackhat_never_ready_reader_is_bounded_by_timeout_guards() {
    let started = Instant::now();

-    consume_client_data_with_timeout_and_cap(
-        NeverReadyReader,
-        PROD_CAP_BYTES,
-        MASK_RELAY_TIMEOUT,
-        MASK_RELAY_IDLE_TIMEOUT,
-    )
-    .await;
+    consume_client_data_with_timeout_and_cap(NeverReadyReader, PROD_CAP_BYTES).await;

    assert!(
        started.elapsed() < Duration::from_millis(350),
@@ -216,12 +190,7 @@ async fn integration_consume_path_honors_production_cap_for_large_payload() {

    let bounded = timeout(
        Duration::from_millis(350),
-        consume_client_data_with_timeout_and_cap(
-            reader,
-            PROD_CAP_BYTES,
-            MASK_RELAY_TIMEOUT,
-            MASK_RELAY_IDLE_TIMEOUT,
-        ),
+        consume_client_data_with_timeout_and_cap(reader, PROD_CAP_BYTES),
    )
    .await;

@@ -237,13 +206,7 @@ async fn adversarial_consume_path_never_reads_beyond_declared_byte_cap() {
    let total_read = Arc::new(AtomicUsize::new(0));
    let reader = BudgetProbeReader::new(256 * 1024, Arc::clone(&total_read));

-    consume_client_data_with_timeout_and_cap(
-        reader,
-        byte_cap,
-        MASK_RELAY_TIMEOUT,
-        MASK_RELAY_IDLE_TIMEOUT,
-    )
-    .await;
+    consume_client_data_with_timeout_and_cap(reader, byte_cap).await;

    assert!(
        total_read.load(Ordering::Relaxed) <= byte_cap,
@@ -268,9 +231,7 @@ async fn light_fuzz_cap_and_payload_matrix_preserves_min_budget_invariant() {
        let mut reader = FinitePatternReader::new(payload, chunk, read_calls);
        let mut writer = CountingWriter::default();

-        let outcome =
-            copy_with_idle_timeout(&mut reader, &mut writer, cap, true, MASK_RELAY_IDLE_TIMEOUT)
-                .await;
+        let outcome = copy_with_idle_timeout(&mut reader, &mut writer, cap, true).await;
        let expected = payload.min(cap);

        assert_eq!(
@@ -300,14 +261,7 @@ async fn stress_parallel_copy_tasks_with_production_cap_complete_without_leaks()
                read_calls,
            );
            let mut writer = CountingWriter::default();
-            copy_with_idle_timeout(
-                &mut reader,
-                &mut writer,
-                PROD_CAP_BYTES,
-                true,
-                MASK_RELAY_IDLE_TIMEOUT,
-            )
-            .await
+            copy_with_idle_timeout(&mut reader, &mut writer, PROD_CAP_BYTES, true).await
        }));
    }

@@ -26,7 +26,6 @@ async fn relay_to_mask_enforces_masking_session_byte_cap() {
            0,
            false,
            32 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        )
        .await;
    });
@@ -82,7 +81,6 @@ async fn relay_to_mask_propagates_client_half_close_without_waiting_for_other_di
            0,
            false,
            32 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        )
        .await;
    });
@@ -1377,7 +1377,6 @@ async fn relay_to_mask_keeps_backend_to_client_flow_when_client_to_backend_stall
            0,
            false,
            5 * 1024 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        )
        .await;
    });
@@ -1509,7 +1508,6 @@ async fn relay_to_mask_timeout_cancels_and_drops_all_io_endpoints() {
            0,
            false,
            5 * 1024 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        ),
    )
    .await;
@@ -88,6 +88,45 @@ async fn self_target_fallback_refuses_recursive_loopback_connect() {
    );
 }

+#[tokio::test]
+async fn self_target_fallback_refuses_recursive_hostname_connect() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let local_addr = listener.local_addr().unwrap();
+    let accept_task = tokio::spawn(async move {
+        timeout(Duration::from_millis(120), listener.accept())
+            .await
+            .is_ok()
+    });
+
+    let mut config = ProxyConfig::default();
+    config.general.beobachten = false;
+    config.censorship.mask = true;
+    config.censorship.mask_unix_sock = None;
+    config.censorship.mask_host = Some("localhost".to_string());
+    config.censorship.mask_port = local_addr.port();
+    config.censorship.mask_proxy_protocol = 0;
+
+    let peer: SocketAddr = "203.0.113.99:55099".parse().unwrap();
+    let beobachten = BeobachtenStore::new();
+
+    handle_bad_client(
+        tokio::io::empty(),
+        tokio::io::sink(),
+        b"GET /",
+        peer,
+        local_addr,
+        &config,
+        &beobachten,
+    )
+    .await;
+
+    let accepted = accept_task.await.unwrap();
+    assert!(
+        !accepted,
+        "hostname self-target masking must fail closed without connecting to local listener"
+    );
+}
+
 #[tokio::test]
 async fn same_ip_different_port_still_forwards_to_mask_backend() {
    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -228,7 +267,6 @@ async fn relay_path_idle_timeout_eviction_remains_effective() {
        0,
        false,
        5 * 1024 * 1024,
-        MASK_RELAY_IDLE_TIMEOUT,
    )
    .await;

@@ -44,7 +44,6 @@ async fn run_relay_case(
            above_cap_blur_max_bytes,
            false,
            5 * 1024 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        )
        .await;
    });
@@ -89,7 +89,6 @@ async fn relay_to_mask_applies_cap_clamped_padding_for_non_power_of_two_cap() {
            0,
            false,
            5 * 1024 * 1024,
-            MASK_RELAY_IDLE_TIMEOUT,
        )
        .await;
    });
@@ -53,14 +53,11 @@ fn new_client_harness() -> ClientHarness {
            upstream_type: UpstreamType::Direct {
                interface: None,
                bind_addresses: None,
-                bindtodevice: None,
            },
            weight: 1,
            enabled: true,
            scopes: String::new(),
            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
        }],
        1,
        1,
@@ -67,8 +67,10 @@ struct FamilyReconnectOutcome {
    key: (i32, IpFamily),
    dc: i32,
    family: IpFamily,
+    alive: usize,
    required: usize,
    endpoint_count: usize,
+    restored: usize,
 }

 pub async fn me_health_monitor(pool: Arc<MePool>, rng: Arc<SecureRandom>, _min_connections: usize) {
@@ -80,6 +82,8 @@ pub async fn me_health_monitor(pool: Arc<MePool>, rng: Arc<SecureRandom>, _min_c
    let mut single_endpoint_outage: HashSet<(i32, IpFamily)> = HashSet::new();
    let mut shadow_rotate_deadline: HashMap<(i32, IpFamily), Instant> = HashMap::new();
    let mut idle_refresh_next_attempt: HashMap<(i32, IpFamily), Instant> = HashMap::new();
+    let mut adaptive_idle_since: HashMap<(i32, IpFamily), Instant> = HashMap::new();
+    let mut adaptive_recover_until: HashMap<(i32, IpFamily), Instant> = HashMap::new();
    let mut floor_warn_next_allowed: HashMap<(i32, IpFamily), Instant> = HashMap::new();
    let mut drain_warn_next_allowed: HashMap<u64, Instant> = HashMap::new();
    let mut degraded_interval = true;
@@ -105,6 +109,8 @@ pub async fn me_health_monitor(pool: Arc<MePool>, rng: Arc<SecureRandom>, _min_c
            &mut single_endpoint_outage,
            &mut shadow_rotate_deadline,
            &mut idle_refresh_next_attempt,
+            &mut adaptive_idle_since,
+            &mut adaptive_recover_until,
            &mut floor_warn_next_allowed,
        )
        .await;
@@ -120,6 +126,8 @@ pub async fn me_health_monitor(pool: Arc<MePool>, rng: Arc<SecureRandom>, _min_c
            &mut single_endpoint_outage,
            &mut shadow_rotate_deadline,
            &mut idle_refresh_next_attempt,
+            &mut adaptive_idle_since,
+            &mut adaptive_recover_until,
            &mut floor_warn_next_allowed,
        )
        .await;
@@ -352,6 +360,8 @@ async fn check_family(
    single_endpoint_outage: &mut HashSet<(i32, IpFamily)>,
    shadow_rotate_deadline: &mut HashMap<(i32, IpFamily), Instant>,
    idle_refresh_next_attempt: &mut HashMap<(i32, IpFamily), Instant>,
+    adaptive_idle_since: &mut HashMap<(i32, IpFamily), Instant>,
+    adaptive_recover_until: &mut HashMap<(i32, IpFamily), Instant>,
    floor_warn_next_allowed: &mut HashMap<(i32, IpFamily), Instant>,
 ) -> bool {
    let enabled = match family {
@@ -383,7 +393,10 @@ async fn check_family(
    let reconnect_budget = health_reconnect_budget(pool, dc_endpoints.len());
    let reconnect_sem = Arc::new(Semaphore::new(reconnect_budget));

-    if pool.floor_mode() == MeFloorMode::Static {}
+    if pool.floor_mode() == MeFloorMode::Static {
+        adaptive_idle_since.clear();
+        adaptive_recover_until.clear();
+    }

    let mut live_addr_counts = HashMap::<(i32, SocketAddr), usize>::new();
    let mut live_writer_ids_by_addr = HashMap::<(i32, SocketAddr), Vec<u64>>::new();
@@ -422,6 +435,8 @@ async fn check_family(
        &live_addr_counts,
        &live_writer_ids_by_addr,
        &bound_clients_by_writer,
+        adaptive_idle_since,
+        adaptive_recover_until,
    )
    .await;
    pool.set_adaptive_floor_runtime_caps(
@@ -488,6 +503,8 @@ async fn check_family(
            outage_next_attempt.remove(&key);
            shadow_rotate_deadline.remove(&key);
            idle_refresh_next_attempt.remove(&key);
+            adaptive_idle_since.remove(&key);
+            adaptive_recover_until.remove(&key);
            info!(
                dc = %dc,
                ?family,
@@ -615,28 +632,22 @@ async fn check_family(
                        restored += 1;
                        continue;
                    }
-
-                    let base_req = pool_for_reconnect
-                        .required_writers_for_dc_with_floor_mode(endpoints_for_dc.len(), false);
-                    if alive + restored >= base_req {
-                        pool_for_reconnect
-                            .stats
-                            .increment_me_floor_cap_block_total();
-                        pool_for_reconnect
-                            .stats
-                            .increment_me_floor_swap_idle_failed_total();
-                        debug!(
-                            dc = %dc,
-                            ?family,
-                            alive,
-                            required,
-                            active_cap_effective_total,
-                            "Adaptive floor cap reached, reconnect attempt blocked"
-                        );
-                        break;
-                    }
+                    pool_for_reconnect
+                        .stats
+                        .increment_me_floor_cap_block_total();
+                    pool_for_reconnect
+                        .stats
+                        .increment_me_floor_swap_idle_failed_total();
+                    debug!(
+                        dc = %dc,
+                        ?family,
+                        alive,
+                        required,
+                        active_cap_effective_total,
+                        "Adaptive floor cap reached, reconnect attempt blocked"
+                    );
+                    break;
                }
-                pool_for_reconnect.stats.increment_me_reconnect_attempt();
                let res = tokio::time::timeout(
                    pool_for_reconnect.reconnect_runtime.me_one_timeout,
                    pool_for_reconnect.connect_endpoints_round_robin(
@@ -652,9 +663,11 @@ async fn check_family(
                        pool_for_reconnect.stats.increment_me_reconnect_success();
                    }
                    Ok(false) => {
+                        pool_for_reconnect.stats.increment_me_reconnect_attempt();
                        debug!(dc = %dc, ?family, "ME round-robin reconnect failed")
                    }
                    Err(_) => {
+                        pool_for_reconnect.stats.increment_me_reconnect_attempt();
                        debug!(dc = %dc, ?family, "ME reconnect timed out");
                    }
                }
@@ -665,8 +678,10 @@ async fn check_family(
                key,
                dc,
                family,
+                alive,
                required,
                endpoint_count: endpoints_for_dc.len(),
+                restored,
            }
        });
    }
@@ -680,7 +695,7 @@ async fn check_family(
            }
        };
        let now = Instant::now();
-        let now_alive = live_active_writers_for_dc_family(pool, outcome.dc, outcome.family).await;
+        let now_alive = outcome.alive + outcome.restored;
        if now_alive >= outcome.required {
            info!(
                dc = %outcome.dc,
@@ -836,33 +851,6 @@ fn should_emit_rate_limited_warn(
    false
 }

-async fn live_active_writers_for_dc_family(pool: &Arc<MePool>, dc: i32, family: IpFamily) -> usize {
-    let writers = pool.writers.read().await;
-    writers
-        .iter()
-        .filter(|writer| {
-            if writer.draining.load(std::sync::atomic::Ordering::Relaxed) {
-                return false;
-            }
-            if writer.writer_dc != dc {
-                return false;
-            }
-            if !matches!(
-                super::pool::WriterContour::from_u8(
-                    writer.contour.load(std::sync::atomic::Ordering::Relaxed),
-                ),
-                super::pool::WriterContour::Active
-            ) {
-                return false;
-            }
-            match family {
-                IpFamily::V4 => writer.addr.is_ipv4(),
-                IpFamily::V6 => writer.addr.is_ipv6(),
-            }
-        })
-        .count()
-}
-
 fn adaptive_floor_class_min(
    pool: &Arc<MePool>,
    endpoint_count: usize,
@@ -916,6 +904,8 @@ async fn build_family_floor_plan(
    live_addr_counts: &HashMap<(i32, SocketAddr), usize>,
    live_writer_ids_by_addr: &HashMap<(i32, SocketAddr), Vec<u64>>,
    bound_clients_by_writer: &HashMap<u64, usize>,
+    adaptive_idle_since: &mut HashMap<(i32, IpFamily), Instant>,
+    adaptive_recover_until: &mut HashMap<(i32, IpFamily), Instant>,
 ) -> FamilyFloorPlan {
    let mut entries = Vec::<DcFloorPlanEntry>::new();
    let mut by_dc = HashMap::<i32, DcFloorPlanEntry>::new();
@@ -931,7 +921,18 @@ async fn build_family_floor_plan(
        if endpoints.is_empty() {
            continue;
        }
-        let _key = (*dc, family);
+        let key = (*dc, family);
+        let reduce_for_idle = should_reduce_floor_for_idle(
+            pool,
+            key,
+            *dc,
+            endpoints,
+            live_writer_ids_by_addr,
+            bound_clients_by_writer,
+            adaptive_idle_since,
+            adaptive_recover_until,
+        )
+        .await;
        let base_required = pool.required_writers_for_dc(endpoints.len()).max(1);
        let min_required = if is_adaptive {
            adaptive_floor_class_min(pool, endpoints.len(), base_required)
@@ -946,11 +947,11 @@ async fn build_family_floor_plan(
        if max_required < min_required {
            max_required = min_required;
        }
-        // We initialize target_required at base_required to prevent 0-writer blackouts
-        // caused by proactively dropping an idle DC to a single fragile connection.
-        // The Adaptive Floor constraint loop below will gracefully compress idle DCs
-        // (prioritized via has_bound_clients = false) to min_required only when global capacity is reached.
-        let desired_raw = base_required;
+        let desired_raw = if is_adaptive && reduce_for_idle {
+            min_required
+        } else {
+            base_required
+        };
        let target_required = desired_raw.clamp(min_required, max_required);
        let alive = endpoints
            .iter()
@@ -1277,6 +1278,43 @@ async fn maybe_refresh_idle_writer_for_dc(
    );
 }

+async fn should_reduce_floor_for_idle(
+    pool: &Arc<MePool>,
+    key: (i32, IpFamily),
+    dc: i32,
+    endpoints: &[SocketAddr],
+    live_writer_ids_by_addr: &HashMap<(i32, SocketAddr), Vec<u64>>,
+    bound_clients_by_writer: &HashMap<u64, usize>,
+    adaptive_idle_since: &mut HashMap<(i32, IpFamily), Instant>,
+    adaptive_recover_until: &mut HashMap<(i32, IpFamily), Instant>,
+) -> bool {
+    if pool.floor_mode() != MeFloorMode::Adaptive {
+        adaptive_idle_since.remove(&key);
+        adaptive_recover_until.remove(&key);
+        return false;
+    }
+
+    let now = Instant::now();
+    let writer_ids = list_writer_ids_for_endpoints(dc, endpoints, live_writer_ids_by_addr);
+    let has_bound_clients = has_bound_clients_on_endpoint(&writer_ids, bound_clients_by_writer);
+    if has_bound_clients {
+        adaptive_idle_since.remove(&key);
+        adaptive_recover_until.insert(key, now + pool.adaptive_floor_recover_grace_duration());
+        return false;
+    }
+
+    if let Some(recover_until) = adaptive_recover_until.get(&key)
+        && now < *recover_until
+    {
+        adaptive_idle_since.remove(&key);
+        return false;
+    }
+    adaptive_recover_until.remove(&key);
+
+    let idle_since = adaptive_idle_since.entry(key).or_insert(now);
+    now.saturating_duration_since(*idle_since) >= pool.adaptive_floor_idle_duration()
+}
+
 fn has_bound_clients_on_endpoint(
    writer_ids: &[u64],
    bound_clients_by_writer: &HashMap<u64, usize>,
@@ -1326,7 +1364,6 @@ async fn recover_single_endpoint_outage(
        );
        return;
    };
-    pool.stats.increment_me_reconnect_attempt();
    pool.stats
        .increment_me_single_endpoint_outage_reconnect_attempt_total();

@@ -1402,6 +1439,7 @@ async fn recover_single_endpoint_outage(
        return;
    }

+    pool.stats.increment_me_reconnect_attempt();
    let current_ms = *outage_backoff.get(&key).unwrap_or(&min_backoff_ms);
    let next_ms = current_ms.saturating_mul(2).min(max_backoff_ms);
    outage_backoff.insert(key, next_ms);
@@ -67,7 +67,6 @@ pub fn format_sample_line(sample: &MePingSample) -> String {
 fn format_direct_with_config(
    interface: &Option<String>,
    bind_addresses: &Option<Vec<String>>,
-    bindtodevice: &Option<String>,
 ) -> Option<String> {
    let mut direct_parts: Vec<String> = Vec::new();
    if let Some(dev) = interface.as_deref().filter(|v| !v.is_empty()) {
@@ -76,9 +75,6 @@ fn format_direct_with_config(
    if let Some(src) = bind_addresses.as_ref().filter(|v| !v.is_empty()) {
        direct_parts.push(format!("src={}", src.join(",")));
    }
-    if let Some(device) = bindtodevice.as_deref().filter(|v| !v.is_empty()) {
-        direct_parts.push(format!("bindtodevice={device}"));
-    }
    if direct_parts.is_empty() {
        None
    } else {
@@ -235,11 +231,8 @@ pub async fn format_me_route(
            UpstreamType::Direct {
                interface,
                bind_addresses,
-                bindtodevice,
            } => {
-                if let Some(route) =
-                    format_direct_with_config(interface, bind_addresses, bindtodevice)
-                {
+                if let Some(route) = format_direct_with_config(interface, bind_addresses) {
                    route
                } else {
                    detect_direct_route_details(reports, prefer_ipv6, v4_ok, v6_ok)
@@ -1422,6 +1422,22 @@ impl MePool {
        MeFloorMode::from_u8(self.floor_runtime.me_floor_mode.load(Ordering::Relaxed))
    }

+    pub(super) fn adaptive_floor_idle_duration(&self) -> Duration {
+        Duration::from_secs(
+            self.floor_runtime
+                .me_adaptive_floor_idle_secs
+                .load(Ordering::Relaxed),
+        )
+    }
+
+    pub(super) fn adaptive_floor_recover_grace_duration(&self) -> Duration {
+        Duration::from_secs(
+            self.floor_runtime
+                .me_adaptive_floor_recover_grace_secs
+                .load(Ordering::Relaxed),
+        )
+    }
+
    pub(super) fn adaptive_floor_min_writers_multi_endpoint(&self) -> usize {
        (self
            .floor_runtime
@@ -1643,7 +1659,6 @@ impl MePool {
        &self,
        contour: WriterContour,
        allow_coverage_override: bool,
-        writer_dc: i32,
    ) -> bool {
        let (active_writers, warm_writers, _) = self.non_draining_writer_counts_by_contour().await;
        match contour {
@@ -1655,43 +1670,6 @@ impl MePool {
                if !allow_coverage_override {
                    return false;
                }
-
-                let mut endpoints_len = 0;
-                let now_epoch = Self::now_epoch_secs();
-                if self.family_enabled_for_drain_coverage(IpFamily::V4, now_epoch) {
-                    if let Some(addrs) = self.proxy_map_v4.read().await.get(&writer_dc) {
-                        endpoints_len += addrs.len();
-                    }
-                }
-                if self.family_enabled_for_drain_coverage(IpFamily::V6, now_epoch) {
-                    if let Some(addrs) = self.proxy_map_v6.read().await.get(&writer_dc) {
-                        endpoints_len += addrs.len();
-                    }
-                }
-
-                if endpoints_len > 0 {
-                    let base_req =
-                        self.required_writers_for_dc_with_floor_mode(endpoints_len, false);
-                    let active_for_dc = {
-                        let ws = self.writers.read().await;
-                        ws.iter()
-                            .filter(|w| {
-                                !w.draining.load(std::sync::atomic::Ordering::Relaxed)
-                                    && w.writer_dc == writer_dc
-                                    && matches!(
-                                        WriterContour::from_u8(
-                                            w.contour.load(std::sync::atomic::Ordering::Relaxed),
-                                        ),
-                                        WriterContour::Active
-                                    )
-                            })
-                            .count()
-                    };
-                    if active_for_dc < base_req {
-                        return true;
-                    }
-                }
-
                let coverage_required = self.active_coverage_required_total().await;
                active_writers < coverage_required
            }
@@ -77,12 +77,6 @@ impl MePool {
            return Vec::new();
        }

-        if endpoints.len() == 1 && self.single_endpoint_outage_disable_quarantine() {
-            let mut guard = self.endpoint_quarantine.lock().await;
-            guard.retain(|_, expiry| *expiry > Instant::now());
-            return endpoints.to_vec();
-        }
-
        let mut guard = self.endpoint_quarantine.lock().await;
        let now = Instant::now();
        guard.retain(|_, expiry| *expiry > now);
@@ -242,18 +236,8 @@ impl MePool {
        let fast_retries = self.reconnect_runtime.me_reconnect_fast_retry_count.max(1);
        let mut total_attempts = 0u32;
        let same_endpoint_quarantined = self.is_endpoint_quarantined(addr).await;
-        let dc_endpoints = self.endpoints_for_dc(writer_dc).await;
-        let single_endpoint_dc = dc_endpoints.len() == 1 && dc_endpoints[0] == addr;
-        let bypass_quarantine_for_single_endpoint =
-            single_endpoint_dc && self.single_endpoint_outage_disable_quarantine();

-        if !same_endpoint_quarantined || bypass_quarantine_for_single_endpoint {
-            if same_endpoint_quarantined && bypass_quarantine_for_single_endpoint {
-                debug!(
-                    %addr,
-                    "Bypassing quarantine for immediate reconnect on single-endpoint DC"
-                );
-            }
+        if !same_endpoint_quarantined {
            for attempt in 0..fast_retries {
                if total_attempts >= ME_REFILL_TOTAL_ATTEMPT_CAP {
                    break;
@@ -292,6 +276,7 @@ impl MePool {
            );
        }

+        let dc_endpoints = self.endpoints_for_dc(writer_dc).await;
        if dc_endpoints.is_empty() {
            self.stats.increment_me_refill_failed_total();
            return false;
@@ -342,7 +342,7 @@ impl MePool {
        allow_coverage_override: bool,
    ) -> Result<()> {
        if !self
-            .can_open_writer_for_contour(contour, allow_coverage_override, writer_dc)
+            .can_open_writer_for_contour(contour, allow_coverage_override)
            .await
        {
            return Err(ProxyError::Proxy(format!(
@@ -109,16 +109,18 @@ async fn connectable_endpoints_waits_until_quarantine_expires() {

    {
        let mut guard = pool.endpoint_quarantine.lock().await;
-        guard.insert(addr, Instant::now() + Duration::from_millis(500));
+        guard.insert(addr, Instant::now() + Duration::from_millis(80));
    }

-    let endpoints = tokio::time::timeout(
-        Duration::from_millis(120),
-        pool.connectable_endpoints_for_test(&[addr]),
-    )
-    .await
-    .expect("single-endpoint outage mode should bypass quarantine delay");
+    let started = Instant::now();
+    let endpoints = pool.connectable_endpoints_for_test(&[addr]).await;
+    let elapsed = started.elapsed();
+
    assert_eq!(endpoints, vec![addr]);
+    assert!(
+        elapsed >= Duration::from_millis(50),
+        "single-endpoint DC should honor quarantine before retry"
+    );
 }

 #[tokio::test]
@@ -102,29 +102,14 @@ pub fn configure_client_socket(
    Ok(())
 }

-/// Set socket to send RST on close instead of FIN, eliminating
-/// FIN-WAIT-1 and orphan socket accumulation on high-churn workloads.
+/// Set socket to send RST on close (for masking)
+#[allow(dead_code)]
 pub fn set_linger_zero(stream: &TcpStream) -> Result<()> {
    let socket = socket2::SockRef::from(stream);
    socket.set_linger(Some(Duration::ZERO))?;
    Ok(())
 }

-/// Restore default linger behaviour (graceful FIN) on a socket
-/// identified by its raw file descriptor.  Safe to call after
-/// `TcpStream::into_split()` because the fd remains valid until
-/// both halves are dropped.
-#[cfg(unix)]
-pub fn clear_linger_fd(fd: std::os::unix::io::RawFd) -> Result<()> {
-    use std::os::unix::io::BorrowedFd;
-    // SAFETY: the fd is still open — the caller guarantees the
-    // TcpStream (or its split halves) is alive.
-    let borrowed = unsafe { BorrowedFd::borrow_raw(fd) };
-    let socket = socket2::SockRef::from(&borrowed);
-    socket.set_linger(None)?;
-    Ok(())
-}
-
 /// Create a new TCP socket for outgoing connections
 #[allow(dead_code)]
 pub fn create_outgoing_socket(addr: SocketAddr) -> Result<Socket> {
@@ -158,56 +143,6 @@ pub fn create_outgoing_socket_bound(addr: SocketAddr, bind_addr: Option<IpAddr>)
    Ok(socket)
 }

-/// Pin an outgoing socket to a specific Linux network interface via SO_BINDTODEVICE.
-#[cfg(target_os = "linux")]
-pub fn bind_outgoing_socket_to_device(socket: &Socket, device: &str) -> Result<()> {
-    use std::io::{Error, ErrorKind};
-    use std::os::fd::AsRawFd;
-
-    let name = device.trim();
-    if name.is_empty() {
-        return Err(Error::new(
-            ErrorKind::InvalidInput,
-            "bindtodevice must not be empty",
-        ));
-    }
-
-    // The kernel expects an interface name buffer with a trailing NUL.
-    if name.len() >= libc::IFNAMSIZ {
-        return Err(Error::new(
-            ErrorKind::InvalidInput,
-            "bindtodevice exceeds IFNAMSIZ",
-        ));
-    }
-    let mut ifname = [0u8; libc::IFNAMSIZ];
-    ifname[..name.len()].copy_from_slice(name.as_bytes());
-
-    let rc = unsafe {
-        libc::setsockopt(
-            socket.as_raw_fd(),
-            libc::SOL_SOCKET,
-            libc::SO_BINDTODEVICE,
-            ifname.as_ptr().cast::<libc::c_void>(),
-            (name.len() + 1) as libc::socklen_t,
-        )
-    };
-    if rc != 0 {
-        return Err(Error::last_os_error());
-    }
-    debug!("Pinned outgoing socket to interface {}", name);
-    Ok(())
-}
-
-/// Stub for non-Linux targets where SO_BINDTODEVICE is unavailable.
-#[cfg(not(target_os = "linux"))]
-pub fn bind_outgoing_socket_to_device(_socket: &Socket, _device: &str) -> Result<()> {
-    use std::io::{Error, ErrorKind};
-    Err(Error::new(
-        ErrorKind::Unsupported,
-        "bindtodevice is supported only on Linux",
-    ))
-}
-
 /// Get local address of a socket
 #[allow(dead_code)]
 pub fn get_local_addr(stream: &TcpStream) -> Option<SocketAddr> {
@@ -26,9 +26,7 @@ use crate::stats::Stats;
 use crate::transport::shadowsocks::{
    ShadowsocksStream, connect_shadowsocks, sanitize_shadowsocks_url,
 };
-use crate::transport::socket::{
-    bind_outgoing_socket_to_device, create_outgoing_socket_bound, resolve_interface_ip,
-};
+use crate::transport::socket::{create_outgoing_socket_bound, resolve_interface_ip};
 use crate::transport::socks::{connect_socks4, connect_socks5};

 /// Number of Telegram datacenters
@@ -329,17 +327,6 @@ pub struct UpstreamManager {
 }

 impl UpstreamManager {
-    fn is_unscoped_upstream(upstream: &UpstreamConfig) -> bool {
-        upstream.scopes.is_empty()
-    }
-
-    fn should_check_in_default_dc_connectivity(
-        has_unscoped: bool,
-        upstream: &UpstreamConfig,
-    ) -> bool {
-        !has_unscoped || Self::is_unscoped_upstream(upstream)
-    }
-
    pub fn new(
        configs: Vec<UpstreamConfig>,
        connect_retry_attempts: u32,
@@ -466,87 +453,6 @@ impl UpstreamManager {
        }
    }

-    fn resolve_probe_dc_families(
-        upstream: &UpstreamConfig,
-        ipv4_available: bool,
-        ipv6_available: bool,
-    ) -> (bool, bool) {
-        (
-            upstream.ipv4.unwrap_or(ipv4_available),
-            upstream.ipv6.unwrap_or(ipv6_available),
-        )
-    }
-
-    fn resolve_runtime_dc_families(
-        upstream: &UpstreamConfig,
-        dc_preference: IpPreference,
-    ) -> (bool, bool) {
-        let (auto_ipv4, auto_ipv6) = match dc_preference {
-            IpPreference::PreferV4 => (true, false),
-            IpPreference::PreferV6 => (false, true),
-            IpPreference::BothWork | IpPreference::Unknown | IpPreference::Unavailable => {
-                (true, true)
-            }
-        };
-
-        (
-            upstream.ipv4.unwrap_or(auto_ipv4),
-            upstream.ipv6.unwrap_or(auto_ipv6),
-        )
-    }
-
-    fn dc_table_addr(dc_idx: i16, ipv6: bool, port: u16) -> Option<SocketAddr> {
-        let arr_idx = UpstreamState::dc_array_idx(dc_idx)?;
-        let ip = if ipv6 {
-            TG_DATACENTERS_V6[arr_idx]
-        } else {
-            TG_DATACENTERS_V4[arr_idx]
-        };
-        Some(SocketAddr::new(ip, port))
-    }
-
-    fn resolve_runtime_dc_target(
-        target: SocketAddr,
-        dc_idx: Option<i16>,
-        upstream: &UpstreamConfig,
-        dc_preference: IpPreference,
-    ) -> Result<SocketAddr> {
-        let (allow_ipv4, allow_ipv6) = Self::resolve_runtime_dc_families(upstream, dc_preference);
-        if (target.is_ipv4() && allow_ipv4) || (target.is_ipv6() && allow_ipv6) {
-            return Ok(target);
-        }
-
-        if !allow_ipv4 && !allow_ipv6 {
-            return Err(ProxyError::Config(format!(
-                "Upstream DC family policy blocks all families for target {target}"
-            )));
-        }
-
-        let Some(dc_idx) = dc_idx else {
-            return Err(ProxyError::Config(format!(
-                "Upstream DC family policy cannot remap target {target} without dc_idx"
-            )));
-        };
-
-        let remapped = if target.is_ipv4() {
-            if allow_ipv6 {
-                Self::dc_table_addr(dc_idx, true, target.port())
-            } else {
-                None
-            }
-        } else if allow_ipv4 {
-            Self::dc_table_addr(dc_idx, false, target.port())
-        } else {
-            None
-        };
-
-        remapped.ok_or_else(|| {
-            ProxyError::Config(format!(
-                "Upstream DC family policy rejected target {target} (dc_idx={dc_idx})"
-            ))
-        })
-    }
-
    #[cfg(unix)]
    fn resolve_interface_addrs(name: &str, want_ipv6: bool) -> Vec<IpAddr> {
        use nix::ifaddrs::getifaddrs;
@@ -820,28 +726,18 @@ impl UpstreamManager {
            .await
            .ok_or_else(|| ProxyError::Config("No upstreams available".to_string()))?;

-        let (mut upstream, bind_rr, dc_preference) = {
+        let mut upstream = {
            let guard = self.upstreams.read().await;
-            let state = &guard[idx];
-            let dc_preference = dc_idx
-                .and_then(UpstreamState::dc_array_idx)
-                .map(|dc_array_idx| state.dc_ip_pref[dc_array_idx])
-                .unwrap_or(IpPreference::Unknown);
-            (
-                state.config.clone(),
-                Some(state.bind_rr.clone()),
-                dc_preference,
-            )
+            guard[idx].config.clone()
        };

        if let Some(s) = scope {
            upstream.selected_scope = s.to_string();
        }

-        let target = if dc_idx.is_some() {
-            Self::resolve_runtime_dc_target(target, dc_idx, &upstream, dc_preference)?
-        } else {
-            target
+        let bind_rr = {
+            let guard = self.upstreams.read().await;
+            guard.get(idx).map(|u| u.bind_rr.clone())
        };

        let (stream, _) = self
@@ -862,18 +758,9 @@ impl UpstreamManager {
            .await
            .ok_or_else(|| ProxyError::Config("No upstreams available".to_string()))?;

-        let (mut upstream, bind_rr, dc_preference) = {
+        let mut upstream = {
            let guard = self.upstreams.read().await;
-            let state = &guard[idx];
-            let dc_preference = dc_idx
-                .and_then(UpstreamState::dc_array_idx)
-                .map(|dc_array_idx| state.dc_ip_pref[dc_array_idx])
-                .unwrap_or(IpPreference::Unknown);
-            (
-                state.config.clone(),
-                Some(state.bind_rr.clone()),
-                dc_preference,
-            )
+            guard[idx].config.clone()
        };

        // Set scope for configuration copy
@@ -881,10 +768,9 @@ impl UpstreamManager {
            upstream.selected_scope = s.to_string();
        }

-        let target = if dc_idx.is_some() {
-            Self::resolve_runtime_dc_target(target, dc_idx, &upstream, dc_preference)?
-        } else {
-            target
+        let bind_rr = {
+            let guard = self.upstreams.read().await;
+            guard.get(idx).map(|u| u.bind_rr.clone())
        };

        let (stream, egress) = self
@@ -1042,7 +928,6 @@ impl UpstreamManager {
            UpstreamType::Direct {
                interface,
                bind_addresses,
-                bindtodevice,
            } => {
                let bind_ip = Self::resolve_bind_address(
                    interface,
@@ -1058,10 +943,6 @@ impl UpstreamManager {
                }

                let socket = create_outgoing_socket_bound(target, bind_ip)?;
-                if let Some(device) = bindtodevice.as_deref().filter(|value| !value.is_empty()) {
-                    bind_outgoing_socket_to_device(&socket, device).map_err(ProxyError::Io)?;
-                    debug!(bindtodevice = %device, target = %target, "Pinned socket to interface");
-                }
                if let Some(ip) = bind_ip {
                    debug!(bind = %ip, target = %target, "Bound outgoing socket");
                } else if interface.is_some() || bind_addresses.is_some() {
@@ -1320,26 +1201,14 @@ impl UpstreamManager {
                .map(|(i, u)| (i, u.config.clone(), u.bind_rr.clone()))
                .collect()
        };
-        let has_unscoped = upstreams
-            .iter()
-            .any(|(_, cfg, _)| Self::is_unscoped_upstream(cfg));

        let mut all_results = Vec::new();

        for (upstream_idx, upstream_config, bind_rr) in &upstreams {
-            // DC connectivity checks should follow the default routing path.
-            // Scoped upstreams are included only when no unscoped upstream exists.
-            if !Self::should_check_in_default_dc_connectivity(has_unscoped, upstream_config) {
-                continue;
-            }
-
-            let (upstream_ipv4_enabled, upstream_ipv6_enabled) =
-                Self::resolve_probe_dc_families(upstream_config, ipv4_enabled, ipv6_enabled);
            let upstream_name = match &upstream_config.upstream_type {
                UpstreamType::Direct {
                    interface,
                    bind_addresses,
-                    bindtodevice,
                } => {
                    let mut direct_parts = Vec::new();
                    if let Some(dev) = interface.as_deref().filter(|v| !v.is_empty()) {
@@ -1348,9 +1217,6 @@ impl UpstreamManager {
                    if let Some(src) = bind_addresses.as_ref().filter(|v| !v.is_empty()) {
                        direct_parts.push(format!("src={}", src.join(",")));
                    }
-                    if let Some(device) = bindtodevice.as_deref().filter(|v| !v.is_empty()) {
-                        direct_parts.push(format!("bindtodevice={device}"));
-                    }
                    if direct_parts.is_empty() {
                        "direct".to_string()
                    } else {
@@ -1367,7 +1233,7 @@ impl UpstreamManager {
            };

            let mut v6_results = Vec::with_capacity(NUM_DCS);
-            if upstream_ipv6_enabled {
+            if ipv6_enabled {
                for dc_zero_idx in 0..NUM_DCS {
                    let dc_v6 = TG_DATACENTERS_V6[dc_zero_idx];
                    let addr_v6 = SocketAddr::new(dc_v6, TG_DATACENTER_PORT);
@@ -1418,17 +1284,13 @@ impl UpstreamManager {
                        dc_idx: dc_zero_idx + 1,
                        dc_addr: SocketAddr::new(dc_v6, TG_DATACENTER_PORT),
                        rtt_ms: None,
-                        error: Some(if ipv6_enabled {
-                            "ipv6 disabled by upstream policy".to_string()
-                        } else {
-                            "ipv6 disabled".to_string()
-                        }),
+                        error: Some("ipv6 disabled".to_string()),
                    });
                }
            }

            let mut v4_results = Vec::with_capacity(NUM_DCS);
-            if upstream_ipv4_enabled {
+            if ipv4_enabled {
                for dc_zero_idx in 0..NUM_DCS {
                    let dc_v4 = TG_DATACENTERS_V4[dc_zero_idx];
                    let addr_v4 = SocketAddr::new(dc_v4, TG_DATACENTER_PORT);
@@ -1479,11 +1341,7 @@ impl UpstreamManager {
                        dc_idx: dc_zero_idx + 1,
                        dc_addr: SocketAddr::new(dc_v4, TG_DATACENTER_PORT),
                        rtt_ms: None,
-                        error: Some(if ipv4_enabled {
-                            "ipv4 disabled by upstream policy".to_string()
-                        } else {
-                            "ipv4 disabled".to_string()
-                        }),
+                        error: Some("ipv4 disabled".to_string()),
                    });
                }
            }
@@ -1503,9 +1361,7 @@ impl UpstreamManager {
                    match addr_str.parse::<SocketAddr>() {
                        Ok(addr) => {
                            let is_v6 = addr.is_ipv6();
-                            if (is_v6 && !upstream_ipv6_enabled)
-                                || (!is_v6 && !upstream_ipv4_enabled)
-                            {
+                            if (is_v6 && !ipv6_enabled) || (!is_v6 && !ipv4_enabled) {
                                continue;
                            }
                            let result = tokio::time::timeout(
@@ -1740,32 +1596,13 @@ impl UpstreamManager {
                continue;
            }

-            let target_upstreams: Vec<usize> = {
-                let guard = self.upstreams.read().await;
-                let has_unscoped = guard
-                    .iter()
-                    .any(|upstream| Self::is_unscoped_upstream(&upstream.config));
-                guard
-                    .iter()
-                    .enumerate()
-                    .filter(|(_, upstream)| {
-                        Self::should_check_in_default_dc_connectivity(
-                            has_unscoped,
-                            &upstream.config,
-                        )
-                    })
-                    .map(|(idx, _)| idx)
-                    .collect()
-            };
-
-            for i in target_upstreams {
+            let count = self.upstreams.read().await.len();
+            for i in 0..count {
                let (config, bind_rr) = {
                    let guard = self.upstreams.read().await;
                    let u = &guard[i];
                    (u.config.clone(), u.bind_rr.clone())
                };
-                let (upstream_ipv4_enabled, upstream_ipv6_enabled) =
-                    Self::resolve_probe_dc_families(&config, ipv4_enabled, ipv6_enabled);

                let mut healthy_groups = 0usize;
                let mut latency_updates: Vec<(usize, f64)> = Vec::new();
@@ -1781,30 +1618,14 @@ impl UpstreamManager {
                            continue;
                        }

-                        let filtered_endpoints: Vec<SocketAddr> = endpoints
-                            .iter()
-                            .copied()
-                            .filter(|endpoint| {
-                                if endpoint.is_ipv4() {
-                                    upstream_ipv4_enabled
-                                } else {
-                                    upstream_ipv6_enabled
-                                }
-                            })
-                            .collect();
-
-                        if filtered_endpoints.is_empty() {
-                            continue;
-                        }
-
                        let rotation_key = (i, group.dc_idx, is_primary);
-                        let start_idx = *endpoint_rotation.entry(rotation_key).or_insert(0)
-                            % filtered_endpoints.len();
-                        let mut next_idx = (start_idx + 1) % filtered_endpoints.len();
+                        let start_idx =
+                            *endpoint_rotation.entry(rotation_key).or_insert(0) % endpoints.len();
+                        let mut next_idx = (start_idx + 1) % endpoints.len();

-                        for step in 0..filtered_endpoints.len() {
-                            let endpoint_idx = (start_idx + step) % filtered_endpoints.len();
-                            let endpoint = filtered_endpoints[endpoint_idx];
+                        for step in 0..endpoints.len() {
+                            let endpoint_idx = (start_idx + step) % endpoints.len();
+                            let endpoint = endpoints[endpoint_idx];

                            let start = Instant::now();
                            let result = tokio::time::timeout(
@@ -1823,7 +1644,7 @@ impl UpstreamManager {
                                Ok(Ok(_stream)) => {
                                    group_ok = true;
                                    group_rtt_ms = Some(start.elapsed().as_secs_f64() * 1000.0);
-                                    next_idx = (endpoint_idx + 1) % filtered_endpoints.len();
+                                    next_idx = (endpoint_idx + 1) % endpoints.len();
                                    break;
                                }
                                Ok(Err(e)) => {
@@ -2038,33 +1859,6 @@ mod tests {
        assert!(!UpstreamManager::is_hard_connect_error(&error));
    }

-    #[test]
-    fn unscoped_selection_detects_default_route_upstream() {
-        let mut upstream = UpstreamConfig {
-            upstream_type: UpstreamType::Direct {
-                interface: None,
-                bind_addresses: None,
-                bindtodevice: None,
-            },
-            weight: 1,
-            enabled: true,
-            scopes: String::new(),
-            selected_scope: String::new(),
-            ipv4: None,
-            ipv6: None,
-        };
-
-        assert!(UpstreamManager::is_unscoped_upstream(&upstream));
-        upstream.scopes = "local".to_string();
-        assert!(!UpstreamManager::is_unscoped_upstream(&upstream));
-        assert!(!UpstreamManager::should_check_in_default_dc_connectivity(
-            true, &upstream
-        ));
-        assert!(UpstreamManager::should_check_in_default_dc_connectivity(
-            false, &upstream
-        ));
-    }
-
    #[test]
    fn resolve_bind_address_prefers_explicit_bind_ip() {
        let target = "203.0.113.10:443".parse::<SocketAddr>().unwrap();
@@ -2105,8 +1899,6 @@ mod tests {
                enabled: true,
                scopes: String::new(),
                selected_scope: String::new(),
-                ipv4: None,
-                ipv6: None,
            }],
            1,
            100,
@@ -24,7 +24,7 @@ from urllib.request import Request, urlopen
 # Exceptions
 # ---------------------------------------------------------------------------

-class TelemtAPIError(Exception):
+class TememtAPIError(Exception):
    """Raised when the API returns an error envelope or a transport error."""

    def __init__(self, message: str, code: str | None = None,
@@ -35,7 +35,7 @@ class TelemtAPIError(Exception):
        self.request_id = request_id

    def __repr__(self) -> str:
-        return (f"TelemtAPIError(message={str(self)!r}, code={self.code!r}, "
+        return (f"TememtAPIError(message={str(self)!r}, code={self.code!r}, "
                f"http_status={self.http_status}, request_id={self.request_id})")


@@ -58,7 +58,7 @@ class APIResponse:
 # Main client
 # ---------------------------------------------------------------------------

-class TelemtAPI:
+class TememtAPI:
    """
    HTTP client for the Telemt Control API.

@@ -75,10 +75,10 @@ class TelemtAPI:
    """

    def __init__(
-            self,
-            base_url: str = "http://127.0.0.1:9091",
-            auth_header: str | None = None,
-            timeout: int = 10,
+        self,
+        base_url: str = "http://127.0.0.1:9091",
+        auth_header: str | None = None,
+        timeout: int = 10,
    ) -> None:
        self.base_url = base_url.rstrip("/")
        self.auth_header = auth_header
@@ -98,12 +98,12 @@ class TelemtAPI:
        return h

    def _request(
-            self,
-            method: str,
-            path: str,
-            body: dict | None = None,
-            if_match: str | None = None,
-            query: dict | None = None,
+        self,
+        method: str,
+        path: str,
+        body: dict | None = None,
+        if_match: str | None = None,
+        query: dict | None = None,
    ) -> APIResponse:
        url = self.base_url + path
        if query:
@@ -133,22 +133,22 @@ class TelemtAPI:
            try:
                payload = json.loads(raw)
            except Exception:
-                raise TelemtAPIError(
+                raise TememtAPIError(
                    str(exc), http_status=exc.code
                ) from exc
            err = payload.get("error", {})
-            raise TelemtAPIError(
+            raise TememtAPIError(
                err.get("message", str(exc)),
                code=err.get("code"),
                http_status=exc.code,
                request_id=payload.get("request_id"),
            ) from exc
        except URLError as exc:
-            raise TelemtAPIError(str(exc)) from exc
+            raise TememtAPIError(str(exc)) from exc

        if not payload.get("ok"):
            err = payload.get("error", {})
-            raise TelemtAPIError(
+            raise TememtAPIError(
                err.get("message", "unknown error"),
                code=err.get("code"),
                request_id=payload.get("request_id"),
@@ -298,16 +298,16 @@ class TelemtAPI:
    # ------------------------------------------------------------------

    def create_user(
-            self,
-            username: str,
-            *,
-            secret: str | None = None,
-            user_ad_tag: str | None = None,
-            max_tcp_conns: int | None = None,
-            expiration_rfc3339: str | None = None,
-            data_quota_bytes: int | None = None,
-            max_unique_ips: int | None = None,
-            if_match: str | None = None,
+        self,
+        username: str,
+        *,
+        secret: str | None = None,
+        user_ad_tag: str | None = None,
+        max_tcp_conns: int | None = None,
+        expiration_rfc3339: str | None = None,
+        data_quota_bytes: int | None = None,
+        max_unique_ips: int | None = None,
+        if_match: str | None = None,
    ) -> APIResponse:
        """POST /v1/users — create a new user.

@@ -340,16 +340,16 @@ class TelemtAPI:
        return self._post("/v1/users", body=body, if_match=if_match)

    def patch_user(
-            self,
-            username: str,
-            *,
-            secret: str | None = None,
-            user_ad_tag: str | None = None,
-            max_tcp_conns: int | None = None,
-            expiration_rfc3339: str | None = None,
-            data_quota_bytes: int | None = None,
-            max_unique_ips: int | None = None,
-            if_match: str | None = None,
+        self,
+        username: str,
+        *,
+        secret: str | None = None,
+        user_ad_tag: str | None = None,
+        max_tcp_conns: int | None = None,
+        expiration_rfc3339: str | None = None,
+        data_quota_bytes: int | None = None,
+        max_unique_ips: int | None = None,
+        if_match: str | None = None,
    ) -> APIResponse:
        """PATCH /v1/users/{username} — partial update; only provided fields change.

@@ -385,10 +385,10 @@ class TelemtAPI:
                           if_match=if_match)

    def delete_user(
-            self,
-            username: str,
-            *,
-            if_match: str | None = None,
+        self,
+        username: str,
+        *,
+        if_match: str | None = None,
    ) -> APIResponse:
        """DELETE /v1/users/{username} — remove user; blocks deletion of last user.

@@ -403,11 +403,11 @@ class TelemtAPI:
    # in the route matcher (documented limitation). The method is provided
    # for completeness and future compatibility.
    def rotate_secret(
-            self,
-            username: str,
-            *,
-            secret: str | None = None,
-            if_match: str | None = None,
+        self,
+        username: str,
+        *,
+        secret: str | None = None,
+        if_match: str | None = None,
    ) -> APIResponse:
        """POST /v1/users/{username}/rotate-secret — rotate user secret.

@@ -533,12 +533,12 @@ EXAMPLES
                   help="Username for user commands")

    # user create/patch fields
-    p.add_argument("--secret", default=None)
-    p.add_argument("--ad-tag", dest="ad_tag", default=None)
+    p.add_argument("--secret",    default=None)
+    p.add_argument("--ad-tag",    dest="ad_tag", default=None)
    p.add_argument("--max-conns", dest="max_conns", type=int, default=None)
-    p.add_argument("--expires", default=None)
-    p.add_argument("--quota", type=int, default=None)
-    p.add_argument("--max-ips", dest="max_ips", type=int, default=None)
+    p.add_argument("--expires",   default=None)
+    p.add_argument("--quota",     type=int, default=None)
+    p.add_argument("--max-ips",   dest="max_ips", type=int, default=None)

    # events
    p.add_argument("--limit", type=int, default=None,
@@ -564,10 +564,10 @@ if __name__ == "__main__":
        sys.exit(0)

    if cmd == "gen-secret":
-        print(TelemtAPI.generate_secret())
+        print(TememtAPI.generate_secret())
        sys.exit(0)

-    api = TelemtAPI(args.url, auth_header=args.auth, timeout=args.timeout)
+    api = TememtAPI(args.url, auth_header=args.auth, timeout=args.timeout)

    try:
        # -- read endpoints --------------------------------------------------
@@ -690,8 +690,7 @@ if __name__ == "__main__":
                parser.error("patch command requires <username>")
            if not any([args.secret, args.ad_tag, args.max_conns,
                        args.expires, args.quota, args.max_ips]):
-                parser.error(
-                    "patch requires at least one field (--secret, --max-conns, --expires, --quota, --max-ips, --ad-tag)")
+                parser.error("patch requires at least one field (--secret, --max-conns, --expires, --quota, --max-ips, --ad-tag)")
            _print(api.patch_user(
                args.arg,
                secret=args.secret,
@@ -722,7 +721,7 @@ if __name__ == "__main__":
                  file=sys.stderr)
            sys.exit(1)

-    except TelemtAPIError as exc:
+    except TememtAPIError as exc:
        print(f"API error [{exc.http_status}] {exc.code}: {exc}", file=sys.stderr)
        sys.exit(1)
    except KeyboardInterrupt:
Author	SHA1	Message	Date
Danila Yudin	57729f9e0e	Merge `06eb112efd` into `877d16659e`	2026-04-09 19:45:54 +03:00
sabraman	06eb112efd	Harden overload auth scans and masking safeguards	2026-04-09 03:45:08 +03:00