Merge pull request #930 from telemt/thundering

WEB Bridge Sideband + Atomic Lifecycle for Writer Refresh + ME Authority
Bump -> 3.5.8
2026-09-27 21:15:58 +03:00 · 2026-09-27 17:32:02 +03:00 · 2026-09-27 17:23:49 +03:00 · 2026-09-26 14:25:24 +03:00 · 2026-09-26 13:49:28 +03:00 · 2026-09-25 19:49:36 +03:00
472 changed files with 76233 additions and 33362 deletions
@@ -19,13 +19,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1

      - name: Install latest stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry & build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/registry
@@ -39,7 +39,7 @@ jobs:
        run: cargo build --release --verbose

      - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
        with:
          name: telemt
-          path: target/release/telemt
+          path: target/release/telemt
@@ -14,9 +14,7 @@ concurrency:
  cancel-in-progress: true

 jobs:
-# ==========================
-# Formatting
-# ==========================
+# Rust formatting validation
  fmt:
    name: Fmt
    runs-on: ubuntu-latest
@@ -25,7 +23,7 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -33,9 +31,23 @@ jobs:

      - run: cargo fmt -- --check

-# ==========================
-# Tests
-# ==========================
+# Minimum supported Rust version validation
+  msrv:
+    name: MSRV
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: dtolnay/rust-toolchain@1.88.0
+
+      - name: Check all targets on MSRV
+        run: cargo check --all-targets --locked
+
+# Rust test suite
  test:
    name: Test
    runs-on: ubuntu-latest
@@ -46,32 +58,34 @@ jobs:
      checks: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

      - uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry
            ~/.cargo/git
            target
-          key: ${{ runner.os }}-cargo-nextest-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-nextest-0.9.143-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
+            ${{ runner.os }}-cargo-nextest-0.9.143-
            ${{ runner.os }}-cargo-nextest-
            ${{ runner.os }}-cargo-

      - name: Install cargo-nextest
-        run: cargo install --locked cargo-nextest || true
+        run: |
+          if ! cargo-nextest --version 2>/dev/null | grep -Fq "cargo-nextest 0.9.143"; then
+            cargo install --locked --version 0.9.143 --force cargo-nextest
+          fi

      - name: Run tests with nextest
        run: cargo nextest run -j "$(nproc)"

-# ==========================
-# Clippy
-# ==========================
+# Rust lint validation
  clippy:
    name: Clippy
    runs-on: ubuntu-latest
@@ -81,14 +95,14 @@ jobs:
      checks: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/registry
@@ -102,9 +116,7 @@ jobs:
      - name: Run clippy
        run: cargo clippy -j "$(nproc)" -- --cap-lints warn

-# ==========================
-# Udeps
-# ==========================
+# Unused dependency validation
  udeps:
    name: Udeps
    runs-on: ubuntu-latest
@@ -113,27 +125,31 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src

      - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry
            ~/.cargo/git
            target
-          key: ${{ runner.os }}-cargo-udeps-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-udeps-0.1.61-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
+            ${{ runner.os }}-cargo-udeps-0.1.61-
            ${{ runner.os }}-cargo-udeps-
            ${{ runner.os }}-cargo-

      - name: Install cargo-udeps
-        run: cargo install --locked cargo-udeps || true
+        run: |
+          if ! cargo-udeps --version 2>/dev/null | grep -Fq "cargo-udeps 0.1.61"; then
+            cargo install --locked --version 0.1.61 --force cargo-udeps
+          fi

      - name: Run udeps
        run: cargo udeps -j "$(nproc)" || true
@@ -30,16 +30,16 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: .github/codeql/codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.9
        with:
          category: "/language:${{ matrix.language }}"
@@ -17,33 +17,37 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/bin
            ~/.cargo/registry
            ~/.cargo/git
            target
-          key: ${{ runner.os }}-cargo-llvm-cov-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-llvm-cov-0.9.0-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
+            ${{ runner.os }}-cargo-llvm-cov-0.9.0-
            ${{ runner.os }}-cargo-llvm-cov-
            ${{ runner.os }}-cargo-

      - name: Install cargo-llvm-cov
-        run: cargo install --locked cargo-llvm-cov || true
+        run: |
+          if ! cargo-llvm-cov --version 2>/dev/null | grep -Fq "cargo-llvm-cov 0.9.0"; then
+            cargo install --locked --version 0.9.0 --force cargo-llvm-cov
+          fi

      - name: Generate LCOV report
        run: cargo llvm-cov --locked --lcov --output-path lcov.info

      - name: Upload LCOV report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
        with:
          name: telemt-lcov
          path: lcov.info
@@ -88,9 +88,9 @@ jobs:
            cpu: generic

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

-      - uses: dtolnay/rust-toolchain@v1
+      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: |
@@ -108,7 +108,7 @@ jobs:
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu

-      - uses: actions/cache@v4
+      - uses: actions/cache@v6.1.0
        with:
          path: |
            /usr/local/cargo/registry
@@ -166,7 +166,7 @@ jobs:

          sha256sum "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
        with:
          name: ${{ matrix.asset }}
          path: dist/*
@@ -199,7 +199,7 @@ jobs:
            cpu: generic

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

      - name: Install deps
        run: |
@@ -209,7 +209,7 @@ jobs:
            pkg-config \
            curl

-      - uses: actions/cache@v4
+      - uses: actions/cache@v6.1.0
        if: matrix.target == 'aarch64-unknown-linux-musl'
        with:
          path: ~/.musl-aarch64
@@ -244,7 +244,7 @@ jobs:
      - name: Add rust target
        run: rustup target add ${{ matrix.target }}

-      - uses: actions/cache@v4
+      - uses: actions/cache@v6.1.0
        with:
          path: |
            /usr/local/cargo/registry
@@ -302,7 +302,7 @@ jobs:

          sha256sum "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
        with:
          name: ${{ matrix.asset }}
          path: dist/*
@@ -319,7 +319,7 @@ jobs:
      contents: write

    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8.0.1
        with:
          path: artifacts

@@ -331,7 +331,7 @@ jobs:
          find artifacts -type f -exec cp {} dist/ \;

      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3.0.3
        with:
          tag_name: ${{ needs.prepare.outputs.version }}
          target_commitish: ${{ github.sha }}
@@ -353,13 +353,13 @@ jobs:
      packages: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1

-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@v4.3.0

-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4.3.0

-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -407,7 +407,7 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Build & Push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          push: true
@@ -1,28 +1,29 @@
 [package]
 name = "telemt"
-version = "3.5.3"
+version = "3.5.8"
 edition = "2024"
+rust-version = "1.88"

 [features]
 redteam_offline_expected_fail = []

 [dependencies]
 # C
-libc = "0.2.186"
+libc = "0.2.189"

 # Async runtime
-tokio = { version = "1.52.3", features = ["full", "tracing"] }
-tokio-util = { version = "0.7.18", features = ["full"] }
+tokio = { version = "1.53.1", features = ["full", "tracing"] }
+tokio-util = { version = "0.7.19", features = ["full"] }

 # Crypto
 aes = { version = "0.8.4", features = ["zeroize"] }
 ctr = { version = "0.9.2", features = ["zeroize"] }
 cbc = "0.1.2"
 sha2 = "0.10.9"
-sha1 = "0.10.6"
+sha1 = "0.10.7"
 md-5 = "0.10.6"
 hmac = "0.12.1"
-crc32fast = "1.5.0"
+crc32fast = "1.5.1"
 crc32c = "0.6.8"
 zeroize = { version = "1.9.0", features = ["derive"] }
 subtle = "2.6.1"
@@ -30,75 +31,83 @@ static_assertions = "1.1.0"
 ml-kem = { version = "0.3.2", default-features = false, features = ["alloc", "zeroize"] }

 # Network
-socket2 = { version = "0.6.4", features = ["all"] }
+socket2 = { version = "0.6.5", features = ["all"] }
 nix = { version = "0.31.3", default-features = false, features = [
  "net",
  "user",
  "process",
+  "dir",
  "fs",
  "signal",
 ] }
-shadowsocks = { version = "1.24.0", features = ["aead-cipher-2022"] }
+shadowsocks = { version = "1.24.0", default-features = false, features = [
+  "aead-cipher",
+  "aead-cipher-2022",
+] }

 # Serialization
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
-toml = "1.1"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
+toml = "1.1.5"
 x509-parser = "0.18.1"

 # Utils
-bytes = "1.12.0"
-thiserror = "2.0.18"
+bytes = "1.12.1"
+thiserror = "2.0.20"
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 tracing-appender = "0.2.5"
 parking_lot = "0.12.5"
 dashmap = "6.2.1"
-arc-swap = "1.9.1"
-lru = "0.16.4"
-rand = "0.10.1"
+arc-swap = "1.9.2"
+lru = "0.18.4"
+rand = "0.10.2"
 chrono = { version = "0.4.45", features = ["serde"] }
 hex = "0.4.3"
 base64 = "0.22.1"
 url = "2.5.8"
-regex = "1.12.4"
-crossbeam-queue = "0.3.12"
-num-bigint = "0.4.6"
+regex = "1.13.1"
+crossbeam-queue = "0.3.14"
+num-bigint = "0.4.8"
 num-traits = "0.2.19"
 x25519-dalek = "2.0.1"
-anyhow = "1.0.102"
+anyhow = "1.0.104"

 # HTTP
 reqwest = { version = "0.13.4", features = ["rustls"], default-features = false }
 notify = "8.2.0"
 ipnetwork = { version = "0.21.1", features = ["serde"] }
-hyper = { version = "1.10.1", features = ["client", "server", "http1"] }
+hyper = { version = "1.11.1", features = ["client", "server", "http1"] }
 hyper-util = { version = "0.1.20", features = ["tokio", "server-auto"] }
-http-body-util = "0.1.3"
+http-body-util = "0.1.5"
 httpdate = "1.0.3"
 tokio-tungstenite = { version = "0.30.0", default-features = false }
-futures-util = { version = "0.3.32", default-features = false, features = ["sink", "std"] }
-tokio-rustls = { version = "0.26.4", default-features = false, features = [
+futures-util = { version = "0.3.34", default-features = false, features = ["sink", "std"] }
+tokio-rustls = { version = "0.26.5", default-features = false, features = [
  "tls12",
 ] }
-rustls = { version = "0.23.41", default-features = false, features = [
+rustls = { version = "0.23.43", default-features = false, features = [
  "std",
  "tls12",
  "ring",
 ] }
-webpki-roots = "1.0.8"
+webpki-roots = "1.0.9"

 [dev-dependencies]
 tokio-test = "0.4.5"
 criterion = "0.8.2"
 proptest = "1.11.0"
-futures = "0.3.32"
+futures = "0.3.34"
 tempfile = "3.27.0"

 [[bench]]
 name = "crypto_bench"
 harness = false

+[[bench]]
+name = "web_decoy_fasttrack"
+harness = false
+
 [profile.release]
 lto = "fat"
 codegen-units = 1
@@ -1,12 +1,32 @@
-# LICENSING
-## Licenses for Versions
-| Version ≥ | Version ≤ | License       |
-|-----------|-----------|---------------|
-| 1.0       | 3.3.17    | NO LICNESE    |
-| 3.3.18    | 3.4.0     | TELEMT PL 3   |
+# Licensing

-### License Types
- **NO LICENSE** = ***ALL RIGHT RESERVED***
- **TELEMT PL** - special Telemt Public License based on Apache License 2 principles
+Telemt is currently distributed under the **TELEMT Public License**

-## [Telemt Public License 3](https://github.com/telemt/telemt/blob/main/LICENSE)
+For the complete and legally binding license terms, see [`LICENSE`](./LICENSE).
+
+The license file accompanying a particular release is authoritative for that release. A future release may use a different version of the TELEMT Public License or another license without changing the licensing terms of previously released versions.
+
+## Summary
+
+Under the TELEMT Public License, you may generally:
+
+* use and reproduce the Software;
+* modify it and create derivative works;
+* publish and redistribute source or binary copies;
+* sublicense the Software;
+* sell copies or products containing the Software.
+
+The license includes several conditions and limitations, including:
+
+* copyright notices, attribution notices, and the license text must be preserved when redistributing Telemt-derived code;
+* modified versions must be clearly identified as modified and include a brief description of the changes;
+* modified or redistributed versions must not be presented as official Telemt releases;
+* the license does not grant rights to Telemt trademarks, logos, or branding;
+* contributors provide a patent license for patent claims necessarily infringed by their contributions, subject to defensive termination provisions;
+* contributions submitted for inclusion in Telemt are licensed under the same license unless explicitly stated otherwise;
+* operators of publicly accessible services using Telemt are encouraged to provide attribution;
+* providing corresponding source code and build instructions with binary distributions is encouraged, but not required.
+
+The Software is provided **WITHOUT ANY KIND OF WARRANTY**, as described in [`LICENSE`](./LICENSE).
+
+This document is only a summary intended to make Telemt's licensing easier to understand. If anything in this document conflicts with the applicable [`LICENSE`](./LICENSE), the license text controls.
@@ -6,11 +6,9 @@

 > [!NOTE]
 >
-> From June 5th, 2026: we are already analyzing the causes of a new wave of "malfunctions"
+> From August 22nd, 2026: we're drafting MTProxy WEB Implementation in Telemt!
 > 
-> Telegram Clients TLS ClientHello has been banned by JA4/JA4+ Fingerprint: we are already looking for ways to solve this problem
->
-> You can try build your client with our Telegram Devlibrary - [tdlib-obf](https://github.com/telemt/tdlib-obf)
+> It uses WebView on your device to create a datachannel!

 <p align="center">
  <a href="https://t.me/telemtrs">
@@ -0,0 +1,73 @@
+use std::hint::black_box;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use base64::Engine as _;
+use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
+
+#[allow(dead_code)]
+#[path = "../src/web/http/capability.rs"]
+mod capability;
+
+fn capability_at(index: usize) -> [u8; 32] {
+    let mut capability = [0xa5u8; 32];
+    capability[..8].copy_from_slice(&(index as u64).to_le_bytes());
+    capability
+}
+
+fn consume_scan(scan: capability::CapabilityScan) {
+    black_box(scan.matched.unwrap_u8());
+    black_box(scan.matched_index);
+}
+
+fn bench_decoy_fasttrack(c: &mut Criterion) {
+    for profile_count in [1usize, 32, 256, 1024] {
+        let capabilities = (0..profile_count).map(capability_at).collect::<Vec<_>>();
+        let miss = [0x5au8; 32];
+        let first = capabilities[0];
+        let middle = capabilities[profile_count / 2];
+        let last = capabilities[profile_count - 1];
+        let telemetry = AtomicU64::new(0);
+        let mut group = c.benchmark_group(format!("web_decoy_fasttrack/{profile_count}"));
+
+        group.bench_function(BenchmarkId::new("ordinary_enforce", profile_count), |b| {
+            b.iter(|| {
+                let candidate = capability::bridge_candidate(black_box(None));
+                telemetry.fetch_add(1, Ordering::Relaxed);
+                black_box(candidate.is_canonical());
+            });
+        });
+        group.bench_function(BenchmarkId::new("ordinary_shadow", profile_count), |b| {
+            b.iter(|| {
+                let candidate = capability::bridge_candidate(black_box(None));
+                telemetry.fetch_add(1, Ordering::Relaxed);
+                consume_scan(capability::scan_capabilities(
+                    black_box(&capabilities),
+                    candidate.scan_bytes(),
+                ));
+            });
+        });
+        for (name, candidate) in [
+            ("canonical_miss", miss),
+            ("canonical_hit_first", first),
+            ("canonical_hit_middle", middle),
+            ("canonical_hit_last", last),
+        ] {
+            let token = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(candidate);
+            let query = format!("bridge={token}");
+            group.bench_function(BenchmarkId::new(name, profile_count), |b| {
+                b.iter(|| {
+                    let candidate = capability::bridge_candidate(black_box(Some(&query)));
+                    telemetry.fetch_add(1, Ordering::Relaxed);
+                    consume_scan(capability::scan_capabilities(
+                        black_box(&capabilities),
+                        candidate.scan_bytes(),
+                    ));
+                });
+            });
+        }
+        group.finish();
+    }
+}
+
+criterion_group!(benches, bench_decoy_fasttrack);
+criterion_main!(benches);
@@ -104,6 +104,16 @@ Notes:
 | `GET` | `/v1/runtime/connections/summary` | none | `200` | `RuntimeEdgeConnectionsSummaryData` |
 | `GET` | `/v1/runtime/events/recent` | none | `200` | `RuntimeEdgeEventsData` |
 | `GET` | `/v1/runtime/tls-fingerprints` | optional `limit=1..1000` | `200` | `RuntimeEdgeTlsFingerprintsData` |
+| `GET` | `/v1/runtime/web/status` | none | `200` | `WebStatusData` |
+| `GET` | `/v1/runtime/web/sessions` | bounded query | `200` | `SessionPage` |
+| `GET` | `/v1/runtime/web/sessions/{session_ref}` | none | `200` or `410` | `SessionRow` or closed tombstone |
+| `POST` | `/v1/runtime/web/sessions/close` | `CloseRequest` | `202` | `ControlOperationStatus` |
+| `GET` | `/v1/runtime/web/operations/{operation_id}` | none | `200` | `ControlOperationStatus` |
+| `POST` | `/v1/runtime/web/debug/clear` | `RuntimeInstanceRequest` | `200` | `DebugClearData` |
+| `POST` | `/v1/runtime/web/carrier-learning/reset` | `RuntimeInstanceRequest` | `200` | `LearningResetData` |
+| `POST` | `/v1/runtime/web/lifecycle/pause` | `RuntimeInstanceRequest` | `200` | `OperatorLifecycleStatus` |
+| `POST` | `/v1/runtime/web/lifecycle/drain` | `DrainRequest` | `202` | `OperatorLifecycleStatus` |
+| `POST` | `/v1/runtime/web/lifecycle/resume` | `RuntimeInstanceRequest` | `200` | `OperatorLifecycleStatus` |
 | `GET` | `/v1/stats/users/active-ips` | none | `200` | `UserActiveIps[]` |
 | `GET` | `/v1/stats/users` | none | `200` | `UserInfo[]` |
 | `GET` | `/v1/config` | none | `200` | `ConfigData` |
@@ -145,6 +155,16 @@ Notes:
 | `GET /v1/runtime/me-selftest` | Returns ME self-test state for KDF, time skew, IP family, PID, and SOCKS BND observations. |
 | `GET /v1/runtime/connections/summary` | Returns runtime-edge connection totals and top-N users by connections/throughput. |
 | `GET /v1/runtime/events/recent` | Returns recent API/runtime event records with optional `limit` query. |
+| `GET /v1/runtime/web/status` | Returns WEB listener lifecycle and a non-blocking, plane-local snapshot of the process-owned WEB runtime when available. |
+| `GET /v1/runtime/web/sessions` | Returns a bounded ordered page of live WEB sessions with strict filters and opaque process-fenced references. |
+| `GET /v1/runtime/web/sessions/{session_ref}` | Returns one exact live-session snapshot or a retained closed-session tombstone. |
+| `POST /v1/runtime/web/sessions/close` | Accepts one bounded asynchronous point-in-time close operation. |
+| `GET /v1/runtime/web/operations/{operation_id}` | Returns one of the 32 most recently retained WEB close-operation states. |
+| `POST /v1/runtime/web/debug/clear` | Clears the bounded WEB debug ring under an epoch fence. |
+| `POST /v1/runtime/web/carrier-learning/reset` | Clears process-local carrier-learning evidence without changing live attempt chains. |
+| `POST /v1/runtime/web/lifecycle/pause` | Ephemerally closes new WEB work admission without closing existing sessions or streams. |
+| `POST /v1/runtime/web/lifecycle/drain` | Starts one asynchronous graceful WEB drain under a bounded monotonic deadline. |
+| `POST /v1/runtime/web/lifecycle/resume` | Cancels an active drain, if any, and reopens only the operator-owned admission fence. |
 | `GET /v1/stats/users/active-ips` | Returns users that currently have non-empty active source-IP lists. |
 | `GET /v1/stats/users` | Alias of `GET /v1/users`; returns disk-first user views with runtime lag flag. |
 | `GET /v1/config` | Returns the current editable config sections as JSON (no `access.*`) plus the revision. |
@@ -176,12 +196,20 @@ Notes:
 | `405` | `method_not_allowed` | Unsupported method for `/v1/users/{username}` route shape. |
 | `409` | `revision_conflict` | `If-Match` revision mismatch. |
 | `409` | `reload_in_progress` | Another reload operation is non-terminal. |
+| `409` | `web_runtime_mismatch` | A runtime instance, session reference, or operation reference belongs to another WEB process instance. |
+| `409` | `web_issuance_enabled` | A WEB close-all operation was requested while effective issuance remained enabled. |
+| `409` | `web_operation_in_progress` | Another bounded WEB close operation is active. |
+| `409` | `web_lifecycle_in_progress` | Another WEB drain operation is active. |
 | `409` | `user_exists` | User already exists on create. |
 | `409` | `last_user_forbidden` | Attempt to delete last configured user. |
 | `413` | `payload_too_large` | Body exceeds `request_body_limit_bytes`. |
+| `415` | `unsupported_media_type` | A WEB runtime POST does not carry exactly one `Content-Type: application/json` header. |
+| `410` | success envelope | A valid WEB session reference resolves to a retained closed-session tombstone. |
 | `500` | `internal_error` | Internal error (I/O, serialization, config load/save). |
 | `503` | `api_disabled` | API disabled in config. |
 | `503` | `maestro_unavailable` | Maestro's reload command channel is unavailable. |
+| `503` | `web_runtime_unavailable` | The WEB runtime is not running or has left the readable lifecycle. |
+| `503` | `web_snapshot_busy` | An exact non-blocking WEB session snapshot encountered lock contention. |

 ## Routing and Method Edge Cases

@@ -204,8 +232,8 @@ Notes:
 - Body size limit is enforced during streaming read (`413 payload_too_large`).
 - Invalid transport body frame returns `400 bad_request` (`Invalid request body`).
 - Invalid JSON returns `400 bad_request` (`Invalid JSON body`).
- `Content-Type` is not required for JSON parsing.
- Unknown JSON fields are ignored by deserialization.
+- `Content-Type` is not required for existing config/user/reload JSON parsing. Every WEB runtime POST requires exactly one header with the exact value `application/json`.
+- Existing request DTOs retain their documented unknown-field behavior. WEB runtime POST DTOs reject unknown JSON fields.
 - `PATCH` uses JSON Merge Patch semantics for optional per-user fields: omitted means unchanged, explicit `null` removes the config entry, and a non-null value sets it.
 - `If-Match` supports both quoted and unquoted values; surrounding whitespace is trimmed.

@@ -214,6 +242,7 @@ Notes:
 | Endpoint | Query | Behavior |
 | --- | --- | --- |
 | `GET /v1/runtime/events/recent` | `limit=<usize>` | Optional. Invalid/missing value falls back to default `50`. Effective value is clamped to `[1, 1000]` and additionally bounded by ring-buffer capacity. |
+| `GET /v1/runtime/web/sessions` | `limit`, `cursor`, `session_ref`, `ip`, `host`, `user`, `user_agent_id`, `key_id`, `carrier`, `state` | `limit` defaults to 50 and is bounded to `1..=200`; the ordered candidate scan stops at 1000. Duplicate and unknown fields are rejected. `session_ref` selects an exact logical session and cannot be combined with `cursor` or `limit`. |

 ## Request Contracts

@@ -261,11 +290,11 @@ bob = ["198.51.100.42/32"]

 ### `PatchConfigRequest`

-A sparse JSON object containing only the top-level config sections to modify. Each key must be one of the editable sections (`general`, `timeouts`, `censorship`, `upstreams`, `dc_overrides`) or the partially editable `server` object (only `listeners` is allowed under `server`; see below). Tables within a section are deep-merged field-by-field into the existing config; arrays and scalar values replace the existing value wholesale. Untouched sections and file comments are preserved.
+A sparse JSON object containing only the top-level config sections to modify. Each key must be one of the editable sections (`general`, `timeouts`, `censorship`, `upstreams`, `dc_overrides`, `web`) or the partially editable `server` object (only `listeners` is allowed under `server`; see below). Tables within a section are deep-merged field-by-field into the existing config; arrays and scalar values replace the existing value wholesale. Untouched sections and file comments are preserved.

 **Rejected keys:**
 - `access` → `400 access_not_editable` (users/secrets are managed via `POST/PATCH /v1/users`).
- `network`, `web`, or any unknown top-level key → `400 section_not_editable`.
+- `network` or any unknown top-level key → `400 section_not_editable`.
 - `server` with any key other than `listeners` (e.g. `port`, `api`, `admin_api`) → `400 field_not_editable`.
 - An object with no editable keys → `400 bad_request` (empty patch).

@@ -299,9 +328,134 @@ Returned by `GET /v1/config` as the envelope `data`. The fields are exactly the
 | `censorship` | `object?` | `[censorship]` section, if present. |
 | `upstreams` | `object?` | `[upstreams]` section, if present. |
 | `dc_overrides` | `object?` | `[dc_overrides]` section, if present. |
+| `web` | `object?` | Complete authored `[web]` section, if present. The derived runtime-only `web.runtime` field is excluded. |
 | `server` | `object?` | Partial `[server]` view when editable nested fields are present. Currently only `listeners` may appear; `api`/`admin_api`, `port`, unix sockets, and other bind-identity fields are never returned. |

-Sections absent from the config file are absent from the response (not `null`). Only the editable sections above are returned; `access` (users/secrets) and `network` (per-node addresses) are always excluded. Under `server`, only the nested field-level allowlist (`listeners`) is exposed.
+Sections absent from the config file are absent from the response (not `null`). Only the editable sections above are returned; `access` (users/secrets) and `network` (per-node addresses) are always excluded. Under `server`, only the nested field-level allowlist (`listeners`) is exposed. Changes under `[web.limits]` are valid desired configuration but remain process-deferred; the patch response reports `web.limits` in `deferred_process_fields` until restart.
+
+### WEB runtime identity and lifecycle
+
+The WEB control plane is process-fenced. `runtime_instance` is a random 128-bit lowercase hexadecimal value created with the process-owned WEB runtime. Session references use `ws1.<runtime_instance>.<16-lowercase-hex-id>`, close-operation references use `wo1.<runtime_instance>.<16-lowercase-hex-id>`, and drain references use `wd1.<runtime_instance>.<16-lowercase-hex-id>`. Treat all references as opaque. A reference from another process instance returns `409 web_runtime_mismatch`, preventing an old controller from targeting reused counters after restart.
+
+`GET /v1/config` is the desired on-disk configuration view. `GET /v1/runtime/web/status` is the effective process view. Its envelope `revision` still identifies the current source graph and can therefore be newer than the active runtime generation while a reload is pending.
+
+`WebStatusData` contains:
+
+| Field | Type | Description |
+| --- | --- | --- |
+| `lifecycle` | `string` | `starting`, `no_web_listener`, `running`, `draining`, `drained`, or `deadline_exceeded`. |
+| `lifecycle_epoch` | `u64` | Monotonic publication epoch. |
+| `lifecycle_age_ms` | `u64` | Monotonic age of the current lifecycle publication. |
+| `available` | `bool` | Backward-compatible readable-runtime flag; it is not public TLS or private acceptor readiness. |
+| `reason` | `string?` | Stable unavailability reason when `available=false`. |
+| `listeners` | `string[]` | Effective bound WEB listener addresses. |
+| `effective_config_enabled` | `bool` | `web.enabled` in the API request's active runtime generation. |
+| `ingress` | `WebIngressStatus` | Process-owned listener/acceptor liveness and TCP accept counters. |
+| `capacity` | `WebCapacityStatus` | Effective accepted-socket policy, fixed global resources, and typed rejection counters. |
+| `decoy_upstream` | `WebDecoyUpstreamStatus` | Passive outcomes for Telemt's internal plain-HTTP decoy origin hop. |
+| `decoy_fasttrack` | `WebDecoyFastTrackStatus` | Effective restart-frozen capability policy and fixed process-lifetime routing counters. |
+| `carrier_negotiation` | `WebCarrierNegotiationStatus` | Fixed process-lifetime selection, reported-failure, and health/learning outcome counters. |
+| `lifecycle_counters` | `WebLifecycleCountersStatus` | Fixed close-reason, post-gap observation, and bridge-recovery counters plus the effective recovery deadline. |
+| `operator_lifecycle` | `OperatorLifecycleStatus?` | Process-local reversible admission and active/latest drain status while a runtime is published. |
+| `runtime` | `WebRuntimeStatus?` | Present while the weak process-runtime publication can be upgraded. |
+
+`WebIngressStatus` contains `configured_listeners`, `live_acceptors`, `accepting_connections`, optional `reason`, `tcp_accept_total`, and `tcp_accept_error_total`. Accepting requires lifecycle `running`, a readable runtime, at least one effective WEB listener, and one live accept loop per listener. Stable non-accepting reasons are `starting`, `no_web_listener`, `ingress_draining`, `ingress_drained`, `deadline_exceeded`, `runtime_released`, and `acceptor_unavailable`. Accept errors are `accept(2)` failures observed by Telemt; they are not kernel backlog drops or failed connection attempts that never reached the process.
+
+`WebCapacityStatus` contains `http_connection_capacity_action`, `max_http_overload_connections`, `http_overload_timeout_ms`, fixed `resources`, `saturated_resources`, `partial`, `rejections`, and `http_connection_overload_outcomes`. Each resource has a closed-set `resource`, `unit`, `used`, `available`, `limit`, and terminal `closed` flag. Saturation is an instantaneous plane-local observation and never changes `available` or ingress readiness. Rejections are monotonic admission decisions indexed only by a closed reason enum; an internally retried queue or byte-budget decision may later make progress. Accepted-socket outcomes are `dropped`, `wait_admitted`, `wait_timeout_503`, `responded_503`, `overflow_capacity_drop`, `response_error_drop`, and `shutdown_drop`; `wait_admitted` is not a rejection.
+
+`WebDecoyUpstreamStatus` contains the complete fixed outcome set plus optional `last_outcome` and `last_outcome_age_ms`. Outcomes distinguish `success`, `deadline_exhausted`, `connect_refused`, `connect_timeout`, `connect_error`, `http_handshake_timeout`, `http_handshake_error`, `response_head_timeout`, and `request_error`. This describes only Telemt to the configured decoy origin. A public client to NGINX refusal, or an NGINX to Telemt refusal before `accept(2)`, is outside this counter plane.
+
+`WebDecoyFastTrackStatus` contains effective `mode` and the complete fixed `requests` disposition array. Dispositions are `shadow_would_fasttrack`, `shadow_candidate_full_scan`, `enforce_fasttrack`, and `enforce_candidate_full_scan`. `off` performs no fast-track counter writes. The complete set remains visible and retains its process-lifetime totals after runtime release because telemetry is process-owned.
+
+`WebCarrierNegotiationStatus` remains present when the process runtime is unavailable because its counters belong to the WEB publication. `selections` is the complete carrier x disposition matrix (`profile_disabled`, `policy_disabled`, `policy_pending`, `epoch_exhausted`, `cold`, `applied`). `reported_failures` is the complete carrier x phase x canonical reason matrix, where phase is `provisional` or `committed` and reason is `timeout`, `network`, `upgrade`, `http`, or `protocol`. `learning_outcomes` distinguishes `recorded`, `not_eligible`, `policy_disabled`, `stale_epoch`, `capacity_rejected`, `sequence_exhausted`, `missing_chain`, `phase_mismatch`, `session_mismatch`, `owner_not_live`, and `closed_before_health`. Reported failures and rejection outcomes are diagnostic only and never create negative ranking evidence.
+
+`WebLifecycleCountersStatus` always contains `bridge_recovery_secs`, the complete carrier x close-reason matrix, the complete carrier x lifecycle-observation matrix, and all recovery milestones. Close reasons are `client_delete`, `bridge_recovery`, `peer_idle`, `negotiation_timeout`, `carrier_superseded`, `protocol`, `backpressure`, `websocket_ended`, `api_close`, `operator_force`, and `runtime_shutdown`. Observations are `http_activity_after_gap`, `websocket_activity_after_gap`, and `request_after_close`. Recovery events are `bootstrap_issued`, `session_created`, `committed`, `expired_unused`, and `closed_before_commit`. All counters are process-owned, monotonic, fixed-cardinality, and remain present at zero while the runtime is unavailable.
+
+`WebRuntimeStatus` includes `runtime_instance`, `generation_id`, immutable effective `limits`, manager/stream/budget/WebSocket/learning/debug planes, permit usage, task/counter totals, and `partial`. Plane locks are read with `try_lock`; a contended plane is omitted and named in `partial`. Status collection performs no cleanup, waits, or data-plane mutation, so fields are plane-local observations rather than one globally atomic snapshot. `runtime.manager.issuance_enabled` is the authority to check before close-all.
+
+`OperatorLifecycleStatus` is a lock-free process snapshot with `state`, monotonic `epoch`, `age_ms`, `admission_open`, `effective_new_work_admission`, and the active or latest `drain`. States are `running`, `paused`, `draining`, `force_closing`, and `drained`. Drain status contains its opaque id, phase/outcome, frozen timeout, wall-clock correlation timestamps, latest session/stream/WebSocket remainder, and `force_close_signalled`. The response envelope `revision` remains a config source-graph revision and is not a lifecycle version.
+
+The Prometheus endpoint exports the same process-owned observations through fixed-cardinality `telemt_web_*` families: ingress/operator lifecycle states, independent ingress flags, listener and TCP accept counts, resource usage/closure/saturation, typed rejection totals, accepted-socket overload outcomes, internal decoy-origin outcomes, and session/stream/carrier aggregate totals. Decoy routing adds `telemt_web_decoy_fasttrack_mode{mode}` and `telemt_web_decoy_fasttrack_requests_total{disposition}`. Carrier negotiation adds `telemt_web_carrier_selections_total{carrier,disposition}`, `telemt_web_carrier_reported_failures_total{carrier,phase,reason}`, `telemt_web_carrier_learning_outcomes_total{carrier,outcome}`, one-hot `telemt_web_carrier_learning_state{state}`, `telemt_web_carrier_learning_entries{kind}`, and one-hot `telemt_web_carrier_learning_policy{aggressiveness}`. Lifecycle recovery adds `telemt_web_session_closures_total{carrier,reason}`, `telemt_web_session_lifecycle_observations_total{carrier,observation}`, `telemt_web_bridge_recovery_events_total{event}`, and `telemt_web_bridge_recovery_seconds`. The learning states are `unavailable`, `partial`, `pending`, `exhausted`, `disabled`, and `enabled`; `pending` explicitly exposes a generation/policy publication mismatch instead of silently treating it as cold evidence. WEB labels never contain a host, user, client IP, listener address, token, session reference, profile key, runtime instance, or generation ID. Telemt does not claim health for the externally owned NGINX or HAProxy TLS endpoint; that boundary requires terminator telemetry and an external TCP/TLS probe.
+
+### WEB session enumeration
+
+`GET /v1/runtime/web/sessions` defaults to `limit=50`, permits `1..=200`, and scans at most 1000 ordered candidates. `next_cursor` continues after the last scanned opaque session reference. `scan_truncated` reports the scan bound, `partial_sessions` counts contended per-session snapshots, and `partial` names an unavailable manager plane. The complete serialized page remains below the API response envelope because every string and row count is bounded.
+
+Filters are exact unless stated otherwise:
+
+| Query field | Contract |
+| --- | --- |
+| `cursor`, `session_ref` | Canonical opaque reference for the current `runtime_instance`; `session_ref` forces one-row lookup semantics and is mutually exclusive with `cursor` and `limit`. |
+| `ip` | Canonically formatted IPv4 or IPv6 address. |
+| `host` | Non-empty, at most 253 bytes. |
+| `user` | Non-empty, at most 64 bytes. |
+| `user_agent_id` | Exactly 32 lowercase hexadecimal characters. |
+| `key_id` | Exactly 16 lowercase hexadecimal characters; this is a non-secret domain-separated fingerprint. |
+| `carrier` | `https`, `https-lanes`, `websocket`, or `websocket-lanes`. |
+| `state` | `provisional`, `replacing`, `committed`, `healthy`, `closing`, `superseded`, or transient live-index `closed`. |
+
+Each `SessionRow` contains `session_ref`, optional bounded `user_agent` and `user_agent_id`, plus client IP, host, user, key fingerprint, carrier/attempt/class/state, health publication, stream/task/lane/WebSocket counts, pending/control usage, progress idle time, authenticated peer idle time, frozen reconnect grace, remaining peer deadline, and optional negotiation time remaining. Server-only progress and empty long polls do not extend the authenticated peer deadline. No bootstrap token, session bearer, raw capability, configured secret/hash, or synthetic source/KDF port is returned. `GET /v1/runtime/web/sessions/{session_ref}` returns `200` for a live row, `410` with `state`, `attempt`, `carrier`, `reason`, and `closed_age_ms` for a bounded retained tombstone, `404` if unknown, or `503 web_snapshot_busy` on lock contention.
+
+### WEB runtime mutations
+
+Every WEB runtime POST requires the currently published `runtime_instance`, exactly one `Content-Type: application/json` header, no query parameters, and a JSON object with no unknown fields. All mutations inherit API authentication, direct-peer whitelist, body limit, audit recording, and `read_only` enforcement.
+
+Operator lifecycle requests are:
+
+```json
+{"runtime_instance":"0123456789abcdef0123456789abcdef"}
+```
+
+for `POST /v1/runtime/web/lifecycle/pause` and `/resume`, and:
+
+```json
+{"runtime_instance":"0123456789abcdef0123456789abcdef","timeout_secs":30}
+```
+
+for `POST /v1/runtime/web/lifecycle/drain`, where `timeout_secs` is bounded to `1..=3600`. Pause and resume return `200`; drain freezes one monotonic absolute deadline and returns `202` without waiting for completion. A second drain while one is `draining` or `force_closing` returns `409 web_lifecycle_in_progress` and cannot alter the first deadline. Repeated pause/resume requests already satisfied by the current state are idempotent and do not advance the lifecycle epoch. Pause during an active drain leaves that drain running. Resume cancels an active drain and opens admission; if the deadline already committed its forced-close snapshot, those old session close signals remain effective.
+
+Pause and drain block bootstrap issuance, initial/replacement session creation, and logical-stream admission. Exact session-creation replay, existing DATA/WINDOW/CLOSE, carrier polling/WebSocket exchanges, and explicit session DELETE remain available. Rejection does not consume bootstrap/session/stream rate or quota state: authenticated session creation returns retryable `503` with `Retry-After: 1`, while bridge issuance preserves the decoy route and a rejected logical `OPEN` receives a stream-local close.
+
+Drain remains graceful until either all live sessions, logical-stream ownership, and session-owned WebSockets reach zero or its deadline fires. The deadline is the latest time to commit close signals, not a claim that cooperative task teardown is already complete. At the deadline every remaining live session receives an idempotent close signal outside manager locks, status becomes `force_closing`, and only confirmed zero publishes `drained` with outcome `forced`. Natural zero publishes outcome `graceful`. Both outcomes keep operator admission closed until explicit resume.
+
+This lifecycle is ephemeral: it survives in-process generation reload because its authority is process-owned, is not written to configuration, and starts as `running` after process restart. Resume never overrides `web.enabled=false`, disabled-user policy, generation health admission, or terminal process shutdown. The global health/readiness and native TCP/Unix admission contracts are unchanged.
+
+`POST /v1/runtime/web/sessions/close` accepts:
+
+```json
+{
+  "runtime_instance": "0123456789abcdef0123456789abcdef",
+  "selector": {
+    "kind": "refs",
+    "session_refs": ["ws1.0123456789abcdef0123456789abcdef.0000000000000001"]
+  }
+}
+```
+
+The selector is exactly one of:
+
+- `refs`: `1..=200` unique current-instance session references.
+- `filter`: at least one session filter using the same fields and bounds as enumeration.
+- `all`: every session at or below the operation's submission high-water mark; rejected with `409 web_issuance_enabled` until effective issuance is disabled.
+
+Only one close operation runs at a time. Work is chunked into at most 128 registry candidates between cancellation points, never awaits while holding a manager/session lock, and never targets sessions created above its high-water mark. `202` returns `ControlOperationStatus`; poll its `operation_id` through `GET /v1/runtime/web/operations/{operation_id}`. The process retains 32 statuses. Fields include `state` (`queued`, `running`, `completed`, `cancelled`, or `failed`), the high-water reference, requested/scanned/matched/signalled/conflicted counters, timestamps, and an optional sanitized failure token.
+
+`POST /v1/runtime/web/debug/clear` and `POST /v1/runtime/web/carrier-learning/reset` both accept:
+
+```json
+{"runtime_instance":"0123456789abcdef0123456789abcdef"}
+```
+
+Debug clear swaps the retained ring under a new epoch and reports `records_cleared`, still-leased snapshot bytes, and `epoch`; old in-flight commits cannot restore removed data. Learning reset swaps bounded evidence under a new epoch and reports `entries_cleared` and `epoch`; live sessions and already frozen negotiation chains are unaffected.
+
+Deterministic close-all sequence:
+
+1. `PATCH /v1/config?reload=drain` with `{"web":{"enabled":false}}`.
+2. Poll the accepted reload, then `GET /v1/runtime/web/status` until `runtime.manager.issuance_enabled=false`.
+3. Submit the `all` close selector with the same status `runtime_instance`.
+4. Poll the returned operation to a terminal state.
+
+`web.enabled=false` only stops new bridge/bootstrap/session issuance. It never implicitly closes active WEB sessions.

 ### `PatchConfigResponse`

@@ -312,8 +466,8 @@ Returned by `PATCH /v1/config` on success (`200`, or `202` when a reload was acc
 | `revision` | `string` | SHA-256 hex of the config file after the patch was written. |
 | `restart_required` | `bool` | Legacy classifier result: `true` when the old file watcher alone cannot apply every changed field. Use `runtime_reload_required` and `process_restart_required` for new integrations. |
 | `runtime_reload_required` | `bool` | `true` when full effect requires a Maestro runtime-generation reload rather than the legacy hot-field overlay. |
-| `process_restart_required` | `bool` | `true` when process-owned sockets or paths changed and remain deferred after an in-process reload. |
-| `deferred_process_fields` | `string[]` | Process-owned fields that the active process cannot rebind during generation activation. |
+| `process_restart_required` | `bool` | `true` when a process-owned field changed and remains deferred after an in-process reload. |
+| `deferred_process_fields` | `string[]` | Process-owned sockets, paths, capacities, or policies retained by the active process. |
 | `changed` | `string[]` | Top-level section names that differed between the old and new config (e.g. `["censorship"]`). |
 | `reload` | `ReloadAccepted?` | Present only when the patch included a valid reload query and Maestro accepted the operation. |

@@ -564,8 +718,11 @@ This means the same EOF-while-reading-64-bytes failure happened once in the dire
 | --- | --- | --- |
 | `active_generation` | `u64` | Active pool generation id. |
 | `warm_generation` | `u64` | Warm pool generation id. |
+| `warm_generations` | `u64[]` | All concurrently warming generation ids in ascending order. |
 | `pending_hardswap_generation` | `u64` | Pending hardswap generation id (`0` when none). |
 | `pending_hardswap_age_secs` | `u64?` | Age of pending hardswap generation in seconds. |
+| `reinit_inflight` | `usize` | Generation warmups currently in flight. |
+| `reinit_max_concurrency_effective` | `usize` | Effective bounded warmup concurrency. |
 | `draining_generations` | `u64[]` | Distinct generation ids currently draining. |

 #### `RuntimeMePoolStateHardswapData`
@@ -603,6 +760,8 @@ This means the same EOF-while-reading-64-bytes failure happened once in the dire
 | --- | --- | --- |
 | `inflight_endpoints_total` | `usize` | Total in-flight endpoint refill operations. |
 | `inflight_dc_total` | `usize` | Number of distinct DC+family keys with refill in flight. |
+| `running_dc_total` | `usize` | DC+family refill workers currently running. |
+| `pending_dc_total` | `usize` | Running DC+family workers with one coalesced pending endpoint. |
 | `by_dc` | `RuntimeMePoolStateRefillDcData[]` | Per-DC refill rows. |

 #### `RuntimeMePoolStateRefillDcData`
@@ -1160,8 +1319,11 @@ JA3 follows the Salesforce ClientHello field order. JA4 follows the FoxIO TLS-cl
 | --- | --- | --- |
 | `active_generation` | `u64` | Active pool generation. |
 | `warm_generation` | `u64` | Warm pool generation. |
+| `warm_generations` | `u64[]` | All concurrently warming generation ids in ascending order. |
 | `pending_hardswap_generation` | `u64` | Pending hardswap generation. |
 | `pending_hardswap_age_secs` | `u64?` | Pending hardswap age in seconds. |
+| `reinit_inflight` | `usize` | Generation warmups currently in flight. |
+| `reinit_max_concurrency_effective` | `usize` | Effective bounded warmup concurrency. |
 | `hardswap_enabled` | `bool` | Hardswap mode toggle. |
 | `floor_mode` | `string` | Writer floor mode. |
 | `adaptive_floor_idle_secs` | `u64` | Idle threshold for adaptive floor. |
@@ -1462,7 +1624,7 @@ Without a `reload` query parameter, the endpoint writes the patch and the file w
 - `revision` — SHA-256 hex of the canonical source manifest after the write, including every recursive include path and its raw bytes.
 - `restart_required` — legacy file-watcher classification retained for compatibility.
 - `runtime_reload_required` — reports whether a full Maestro generation reload is needed for runtime effect.
- `process_restart_required` and `deferred_process_fields` — report socket policies or process-owned paths that remain unchanged by an in-process reload. A pure listener endpoint move is reloadable only when every retained endpoint keeps identical bind policy and neither the active nor desired listener set uses SYN limiting; same-address MSS, PROXY protocol, backlog, reuse, or SYN-limit changes remain deferred.
+- `process_restart_required` and `deferred_process_fields` — report process-owned sockets, paths, capacities, or policies that remain unchanged by an in-process reload, including `web.decoy_fasttrack_mode`. A pure listener endpoint move is reloadable only when every retained endpoint keeps identical bind policy and neither the active nor desired listener set uses SYN limiting; same-address MSS, PROXY protocol, backlog, reuse, or SYN-limit changes remain deferred.
 - `changed` — list of top-level section names that differed.
 - `reload` — accepted operation metadata; omitted without a reload query and for process-only patches that cannot change the active generation.

@@ -1524,20 +1686,23 @@ The revision is verified again after preparation. With `failure_policy=rollback`

 ## WEB Proxy Management

-The API provides partial operational control for WEB mode. It does not expose a mutable `/v1/web` resource, but it serves bounded read-only HTML diagnostics at `GET /web-status`.
+The API exposes WEB desired configuration through the common config resource, process state through `/v1/runtime/web`, and bounded read-only HTML diagnostics at `GET /web-status`. There is no separate `/v1/web` configuration resource.

 | Operation | Current contract |
 | --- | --- |
-| Read or patch `[web]`, vhosts, profiles, decoys, timeouts, or limits | Not exposed. `GET /v1/config` omits `[web]`; a `web` key in `PATCH /v1/config` returns `400 section_not_editable`. |
+| Read or patch `[web]`, vhosts, profiles, decoys, timeouts, or limits | Supported through `GET` and `PATCH /v1/config`; `web.runtime` is derived and excluded. Tables deep-merge, arrays replace wholesale; `web.limits` and `web.decoy_fasttrack_mode` remain process-deferred. |
 | Persist `server.listeners` | Supported through `PATCH /v1/config`. Arrays replace wholesale. A changed WEB listener is process-owned and remains deferred until process restart. |
 | Apply an externally edited WEB config | Update the owning TOML source, call `POST /v1/system/reload`, then poll `GET /v1/system/reload/{id}`. |
-| Inspect restart requirements | Read `deferred_process_fields` from reload status. `server.listeners` and `web.limits` require process restart. |
-| Manage access users | Use `/v1/users`. Creating a user does not add it to `web.vhosts.profiles`; profile membership remains file-managed. |
+| Inspect restart requirements | Read `deferred_process_fields` from reload status. `server.listeners`, `web.limits`, and `web.decoy_fasttrack_mode` require process restart. |
+| Inspect WEB lifecycle, capacity, sessions, operations, learning, and debug state | Use the authenticated `GET /v1/runtime/web/*` routes documented above. |
+| Close selected or all point-in-time sessions | Use `POST /v1/runtime/web/sessions/close`; close-all first requires effective issuance to be disabled. |
+| Clear debug records or reset carrier learning | Use `POST /v1/runtime/web/debug/clear` or `/carrier-learning/reset` with the current `runtime_instance`. |
+| Manage access users | Use `/v1/users`. Creating a user does not add it to `web.vhosts.profiles`; add profile membership through the `web` config patch. |
 | Disable one user | `POST /v1/users/{username}/disable` updates admission immediately and cancels the user's active sessions. |
 | Rotate a profiled user's secret | Use `/v1/users/{username}/rotate-secret`; the config watcher rebuilds WEB capabilities from the new access snapshot. The API returns the secret, not a `tg://webproxy` link. |
 | Read WEB-specific runtime diagnostics | Use authenticated `GET /web-status`; filters cover client IP, process session ID, User-Agent, and non-secret key fingerprint, with optional grouping, expandable HTTP request-to-response details, and WebSocket handshake/message/frame rows. |

-`web.enabled`, `web.carrier`, `web.debug`, `web.timeouts`, vhosts, profiles, and decoy snapshots are runtime-generation fields. A changed carrier applies only to newly issued bridge sessions; existing sessions retain their creation-time carrier. WEB listener inventory and trust policy, plus all `[web.limits]`, are process-owned. A successful reload can therefore activate the runtime-owned subset while reporting the process-owned subset as deferred.
+`web.enabled`, `web.carrier`, `web.debug`, `web.timeouts`, vhosts, profiles, and decoy snapshots are runtime-generation fields. A changed carrier applies only to newly issued bridge sessions; existing sessions and issued bootstrap chains retain their issuance-time policy. `web.enabled=false` stops new issuance but never closes live sessions implicitly. WEB listener inventory and trust policy, plus all `[web.limits]`, are process-owned. A successful reload can therefore activate the runtime-owned subset while reporting the process-owned subset as deferred.

 Before deleting a user referenced by a WEB profile, remove and apply the profile first. User mutations validate the complete resulting configuration, so a dangling WEB profile is rejected rather than persisted.

@@ -2558,12 +2558,19 @@ Der WEB-Modus transportiert MTProxy-Datenverkehr von Telegram Desktop über HTTP
 | --- | --- | --- | --- |
 | `enabled` | `bool` | `false` | `✔` |
 | `carrier` | `"https"`, `"https-lanes"`, `"websocket"` oder `"websocket-lanes"` | `"https"` | `✔` |
+| `carriers` | `false` oder ein nicht leeres Array eindeutiger Carrier | `false` | `✔` |
+| `carrier_learning` | `bool` | `true` | `✔` |
+| `carrier_negotiation_aggressiveness` | `"conservative"`, `"balanced"` oder `"aggressive"` | `"conservative"` | `✔` |
 | `debug` | Tabelle | deaktiviert, begrenzte Defaults | `✔` |
 | `limits` | Tabelle | begrenzte Defaults | `✘` |
 | `timeouts` | Tabelle | begrenzte Defaults | `✔` |
 | `vhosts` | Tabellen-Array | `[]` | `✔` |

-`enabled = true` erfordert mindestens einen durch die Netzwerkrichtlinie zugelassenen WEB-Listener, einen vhost und mindestens ein Profil in jedem vhost. `https` behält den serialisierten HTTPS-Transport bei. Mit `https-lanes` erhalten Stream null und jeder logische Stream eigene Uplink-Sequenzen, Downlink-Cursor, Wiederholungen und Long Polls; dieser Carrier erfordert `max_http_handlers >= 2` und öffentliches HTTP/2 am TLS-Terminator. `websocket` transportiert alle logischen Streams über eine geordnete RFC-6455-Verbindung, während `websocket-lanes` jedem Stream ungleich null eine eigene Verbindung zuweist und Lane-Fehler isoliert. Beide WebSocket-Carrier verwenden nach der HTTPS-Sitzungserstellung `GET /api/v1/ws` und erfordern, dass der TLS-Terminator die HTTP/1.1-Upgrade-Header unverändert weiterleitet. Ein Reload wendet `carrier` nur auf neu ausgegebene Bridge-Sitzungen an. Das Deaktivieren von WEB beendet nach dem Reload die Ausgabe neuer Bridge- und Session-Zugangsdaten; zum Widerrufen aktiver Sitzungen eines einzelnen Benutzers verwenden Sie die Users-API.
+`enabled = true` erfordert mindestens einen durch die Netzwerkrichtlinie zugelassenen WEB-Listener, einen vhost und mindestens ein Profil in jedem vhost. `https` behält den serialisierten HTTPS-Transport bei und erfordert `max_http_handlers >= 2`. Mit `https-lanes` erhalten Stream null und jeder logische Stream eigene Uplink-Sequenzen, Downlink-Cursor, Wiederholungen und Long Polls; dieser Carrier erfordert `max_http_handlers >= 4` und öffentliches HTTP/2 am TLS-Terminator. `websocket` transportiert alle logischen Streams über eine geordnete RFC-6455-Verbindung, während `websocket-lanes` jedem Stream ungleich null eine eigene Verbindung zuweist und Lane-Fehler isoliert. Beide WebSocket-Carrier verwenden nach der HTTPS-Sitzungserstellung `GET /api/v1/ws` und erfordern, dass der TLS-Terminator die HTTP/1.1-Upgrade-Header unverändert weiterleitet.
+
+Fehlt `carriers` oder ist es `false`, sind Auto-Negotiation und Lernen deaktiviert und `carrier` ist der einzige Modus. Ein nicht leeres `carriers`-Array aktiviert die Start-Negotiation in der konfigurierten Reihenfolge; `carrier` wird genau einmal als letzter Fallback angehängt. Leere Arrays, Duplikate und `true` werden abgelehnt. Der Client darf nur vor dem Carrier-Commit zum nächsten Kandidaten wechseln; nach dem Commit erfordert ein Carrier-Wechsel eine neue Sitzung. Ein nativer Client ohne Metadaten, einschließlich Telegram iOS, verwendet immer den konfigurierten festen `carrier`, auch bei aktivierter Negotiation. Das aktuelle iOS unterstützt nur `https`; solche Bereitstellungen müssen daher `carrier = "https"` setzen. Die CFNetwork- und Darwin-User-Agent-Klassifizierung leitet keine Carrier-Unterstützung ab. Explizite native iOS-Capabilities werden mit `{https}` geschnitten; andere explizite Client-Capabilities gelten wie gemeldet.
+
+`carrier_learning` wirkt nur bei aktivierter Negotiation. Das Lernen ist prozesslokal, speicherresident, begrenzt und ausschließlich positiv: Nur ein Carrier, der den serverdefinierten Zustand healthy erreicht, liefert Evidenz. `conservative` erfordert die breiteste Evidenz und deaktiviert IP-Ranking, `balanced` verwendet mittlere User-Agent-/Profil-Schwellen sowie geeignete öffentliche IPs nur als Tie-Breaker, und `aggressive` reagiert auf die ersten begrenzten Samples. Vom Client gemeldete Fehler bleiben rein diagnostisch und erzeugen keine negative Evidenz. Ein Reload wendet die Richtlinie auf neue Negotiation-Ketten an und verwirft inkompatible gespeicherte Evidenz. Das Deaktivieren von WEB beendet die Ausgabe neuer Bridge- und Session-Zugangsdaten; zum Widerrufen aktiver Sitzungen eines einzelnen Benutzers verwenden Sie die Users-API.

 # [web.debug]

@@ -2584,6 +2591,8 @@ Diese hot-reload-fähige Tabelle steuert den prozesseigenen serverseitigen WEB-D

 Eine Änderung von `enabled` oder einem Erfassungsfeld löscht gespeicherte Datensätze und verwirft Commits, die unter der vorherigen Policy-Epoche begonnen wurden. Ändert sich nur das standardmäßige oder maximale Beobachtungsfenster, bleiben kompatible Datensätze erhalten. `full` speichert den vollständigen Body eines erkannten Carriers nur bis `web.limits.max_body_bytes`; Decoy-Bodys bleiben immer auf einen Präfix begrenzt. Ein Präfix, der nur mit einer gleichzeitig erhöhten, neustartpflichtigen Kapazität zulässig wäre, wird zusammen mit `web.debug` bis zum Neustart zurückgestellt. URI-Queries werden nie gespeichert, Werte von Credential-Headern werden ausgelassen, Body-Kopien werden von bekannten WEB-Capabilities und Bearer-Tokens bereinigt und Profilschlüssel ausschließlich als domänengetrennter Fingerprint mit 16 Hex-Zeichen dargestellt.

+Die authentifizierte JSON-Steuerung kann den Ring mit `POST /v1/runtime/web/debug/clear` explizit löschen. Die erforderliche prozessbezogene `runtime_instance` sperrt veraltete Controller, die zurückgegebene Epoche sperrt laufende Writer und `leased_bytes` meldet Speicher, der noch von bereits gerenderten Snapshots gehalten wird.
+
 # [web.limits]

 Diese prozessweiten Obergrenzen begrenzen alle WEB-Register, Warteschlangen, Request-Bodys, statischen Snapshots und Admission-Pfade. Alle Werte werden gemeinsam validiert: Eigentümerbezogene Grenzen dürfen die globalen Grenzen nicht überschreiten, Queue-Reserven müssen den Fortschritt von Control Frames gewährleisten, Body-Reservierungen müssen in ihr globales Budget passen und alle deklarierten Byte-Grenzen müssen in `memory_envelope_bytes` passen. Jede Änderung in dieser Tabelle erfordert einen Prozessneustart.
@@ -2597,10 +2606,15 @@ Diese prozessweiten Obergrenzen begrenzen alle WEB-Register, Warteschlangen, Req
 | `max_frames_per_body` | `usize` | `4096` | Maximale Zahl geparster oder ausgegebener Frames pro Carrier-Body. |
 | `max_http_connections` | `usize` | `1024` | Prozessweit akzeptierte WEB-HTTP-Verbindungen. |
 | `max_http_handlers` | `usize` | `512` | Prozessweit gleichzeitig ausgeführte HTTP-Handler; HTTPS-Lanes dürfen höchstens die Hälfte mit Long Polls belegen, der Rest bleibt für Session-, Uplink- und Steuerarbeit verfügbar. |
+| `max_lane_open_waits_per_session` | `usize` | `16` | Kanonische Cursor-null-Downlink-Polls, die pro Sitzung auf ein konkurrierendes Lane-`OPEN` warten dürfen. |
+| `pending_bytes_per_lane` | `usize` | `8388608` | Eingereihte und residente `DATA`-Bytes pro unabhängiger HTTPS- oder WebSocket-Lane. |
+| `pending_items_per_lane` | `usize` | `1024` | Eingereihte und residente `DATA`-Elemente pro unabhängiger HTTPS- oder WebSocket-Lane. |
 | `websocket_bytes_global` | `usize` | `268435456` | Transientes Teilbudget für WebSocket-Codecs, Messages und Write-Staging innerhalb von `pending_bytes_global`. |
-| `websocket_admission_watermark_pct` | `u8` | `75` | WebSocket-Byte-Anteil, ab dem neue Admission eine Owner-First-Verbindung ersetzen darf. |
-| `websocket_eviction_watermark_pct` | `u8` | `90` | WebSocket-Byte-Anteil, ab dem Queue-Druck die zulässige Verbindung mit dem ältesten Fortschritt verdrängen darf. |
+| `websocket_admission_watermark_pct` | `u8` | `75` | WebSocket-Byte-Watermark für neue Basis-Admission und die Fair-Share-Berechnung des deterministischen Ersatzes. |
+| `websocket_eviction_watermark_pct` | `u8` | `90` | Watermark für WebSocket-Datenallokationen, ab dem gemeinsamer Queue-Druck ein deterministisches Cleanup anfordern darf. |
 | `websocket_http_connection_reserve` | `usize` | `64` | Für WebSocket-Upgrades gesperrte HTTP-Verbindungen, die Kapazität für gewöhnliches HTTP und Decoys erhalten. |
+| `max_websocket_evictions_in_flight` | `usize` | `8` | Prozessweite Obergrenze gleichzeitiger exakter WebSocket-Verdrängungs-Claims bei Admission und Druck-Cleanup. |
+| `max_carrier_learning_entries` | `usize` | `4096` | Prozessweite Obergrenze begrenzter Carrier-Learning-Evidenzeinträge. |
 | `max_body_readers` | `usize` | `32` | Prozessweit gleichzeitig gesammelte Request-Bodys. |
 | `max_body_bytes_global` | `usize` | `67108864` | Globales Byte-Budget für gesammelte Bodys. |
 | `max_sessions_global` | `usize` | `128` | Prozessweit aktive WEB-Sitzungen. |
@@ -2624,7 +2638,7 @@ Diese prozessweiten Obergrenzen begrenzen alle WEB-Register, Warteschlangen, Req
 | `max_static_bytes` | `usize` | `67108864` | Bytes statischer Snapshots über alle vhosts. |
 | `debug_records_capacity` | `usize` | `65536` | Maximale Zahl gespeicherter WEB-Debugdatensätze. |
 | `debug_bytes_global` | `usize` | `67108864` | Globale Byte-Obergrenze für gespeicherte und in Verarbeitung befindliche WEB-Debugdaten; mindestens 4096. |
-| `memory_envelope_bytes` | `usize` | `805306368` | Deklarierter Rahmen für HTTP-Heads, Bodys, gemeinsame Queues/WebSocket-I/O, statische Snapshots und begrenzte Debug-/Statuspuffer; maximal 4 GiB. |
+| `memory_envelope_bytes` | `usize` | `1342177280` | Deklarierter Rahmen für HTTP-Heads, Bodys, gemeinsame Queues/WebSocket-I/O, Lane-Zustand, Carrier-Learning, statische Snapshots und begrenzte Debug-/Statuspuffer; maximal 4 GiB. |
 | `new_bootstraps_per_minute` | `u32` | `1200` | Nachhaltige prozessweite Ausgaberate für Bootstraps. |
 | `new_bootstraps_burst` | `u32` | `256` | Prozessweiter Burst für die Bootstrap-Ausgabe. |
 | `new_sessions_per_minute` | `u32` | `600` | Nachhaltige prozessweite Erstellungsrate für Sitzungen. |
@@ -2634,21 +2648,31 @@ Diese prozessweiten Obergrenzen begrenzen alle WEB-Register, Warteschlangen, Req

 # [web.timeouts]

-Alle Timeouts werden in Sekunden angegeben und müssen im Bereich `1..=3600` liegen. Die längste Request-Deadline muss kleiner als `http_idle_secs` sein.
+Sofern eine Zeile nichts anderes angibt, werden Timeouts in Sekunden angegeben und müssen im Bereich `1..=3600` liegen. Konfigurierte serverseitige Deadlines einzelner HTTP-Phasen müssen kleiner als `http_idle_secs` sein; geschützte Phasen behalten ihre eigenen Deadlines, sodass der Idle-Timer keine Gesamtdeadline für einen Request ist. Das clientseitige Bridge-Retry-Fenster hat eigene Grenzen.

 | Schlüssel | Typ | Default | Hot-Reload | Beschreibung |
 | --- | --- | --- | --- | --- |
 | `header_secs` | `u64` | `10` | `✔` | Empfang eines vollständigen HTTP-Request-Heads. |
 | `body_secs` | `u64` | `30` | `✔` | Sammeln eines authentifizierten Carrier-Bodys. |
 | `stream_handshake_secs` | `u64` | `10` | `✔` | Abschluss eines inneren MTProxy-Handshakes. |
+| `stream_first_byte_secs` | `u64` | `30` | `✔` | Empfang des ersten inneren MTProxy-Bytes nach `OPEN`; validiert im Bereich `1..=300`. |
 | `long_poll_secs` | `u64` | `25` | `✔` | Maximale Dauer eines leeren Downlink-Long-Polls. |
+| `bridge_request_secs` | `u64` | `10` | `✔` | Bridge-seitige Deadline eines HTTP-Versuchs bis zum vollständigen Lesen des Response-Bodys; `/down` erhält zusätzlich `long_poll_secs`. Bereich `1..=60`. |
+| `bridge_retry_secs` | `u64` | `90` | `✔` | Absolutes Bridge-Retry-Fenster einschließlich Versuchen und Backoff; Bereich `1..=300` und nicht kleiner als `bridge_request_secs`. |
+| `carrier_probe_coalesce_ms` | `u64` | `0` | `✔` | Optionales Bridge-Warten nach `OPEN` auf passendes `DATA`; Millisekunden im Bereich `0..=10`, wobei `0` sofortiges Probing beibehält. |
+| `lane_open_wait_secs` | `u64` | `2` | `✔` | Wartezeit für einen kanonischen Cursor-null-Downlink, der sein Lane-`OPEN` überholt; höchstens `long_poll_secs`. |
+| `carrier_health_secs` | `u64` | `30` | `✔` | Beobachtungsintervall nach dem Commit, bevor ein Carrier Learning-Evidenz liefern kann. |
+| `websocket_upgrade_secs` | `u64` | `5` | `✔` | Maximale Wartezeit, bis ein akzeptiertes HTTP-Upgrade zum WebSocket wird; Bereich `1..=60`. |
+| `websocket_open_secs` | `u64` | `15` | `✔` | Absolute Deadline für die erste Carrier-Binärnachricht nach dem Upgrade; Bereich `1..=300`. |
 | `websocket_write_secs` | `u64` | `30` | `✔` | Maximale Wartezeit für einen WebSocket-Write oder Flush. |
 | `websocket_backpressure_secs` | `u64` | `30` | `✔` | Maximale Wartezeit auf Fortschritt des gemeinsamen Byte-Budgets oder einer Queue, bevor die betroffene Verbindung geschlossen wird. |
 | `websocket_eviction_secs` | `u64` | `1` | `✔` | Karenzzeit, in der ein verdrängter WebSocket Slot und Budget freigeben muss, bevor Admission fehlschlägt. |
+| `carrier_negotiation_deadlines_secs` | `[u64; 4]` | `[3, 5, 8, 12]` | `✔` | Streng steigende kumulative Offsets: Die Bridge verwendet sie vor ihrem ersten `/session`-Request, der Server bei Annahme des ersten automatischen Versuchs. Die Checkpoints für ein bis vier Kandidaten sind `[d3]`, `[d0, d3]`, `[d0, d1, d3]` und `[d0, d1, d2, d3]`; der letzte Kandidat verwendet immer `d3`. |
+| `carrier_learning_secs` | `u64` | `600` | `✔` | Feste Lebensdauer zweier prozesslokaler Evidenzfenster; Bereich `2..=86400`. |
 | `bootstrap_lifetime_secs` | `u64` | `120` | `✔` | Lebensdauer ungenutzter Bootstraps und geschlossener Token-Replay-Marker. |
 | `reconnect_grace_secs` | `u64` | `120` | `✔` | Maximale Carrier-Inaktivität bis zum Schließen der Sitzung. |
-| `http_idle_secs` | `u64` | `75` | `✔` | Idle-Lebensdauer einer WEB-HTTP-Keep-Alive-Verbindung. |
-| `shutdown_secs` | `u64` | `15` | `✔` | Deadline für das kontrollierte Beenden von WEB. |
+| `http_idle_secs` | `u64` | `75` | `✔` | Idle-Grenze zwischen HTTP-Austauschvorgängen und bei ausbleibendem Fortschritt eines bereits ausgegebenen Response-Bodys. Explizit begrenzte Request-Body-, Long-Poll-, Decoy- und ausstehende Upgrade-Phasen behalten ihre eigenen Deadlines und werden nicht durch diesen Timer verkürzt. Der Wert wird beim Annehmen der Verbindung fixiert. |
+| `shutdown_secs` | `u64` | `15` | `✔` | Ein absolutes Budget für das Beenden des Prozesses, das von allen Listener-Acceptoren und Verbindungen sowie WEB-Sitzungs- und Hilfstask-Drains gemeinsam verwendet wird. Der aktive Wert wird beim Start des Shutdowns einmalig erfasst. |
 | `decoy_header_secs` | `u64` | `30` | `✔` | Deadline für Verbindung und Response-Head eines HTTP-Decoys. |

 # [[web.vhosts]]
@@ -2675,7 +2699,7 @@ Genau ein Decoy-Modus ist erforderlich:

 | Schlüssel | Typ | Erforderlich | Default | Beschreibung |
 | --- | --- | --- | --- | --- |
-| `user` | `String` | ja | — | Vorhandener Schlüssel aus `[access.users]`. |
+| `user` | `String` | ja | — | Vorhandener Schlüssel mit 1–64 Byte aus `[access.users]`; die Grenze hält Runtime-Status und Filter beschränkt. |
 | `secret_mode` | `"plain"` oder `"dd"` | ja | — | Exakte Secret-Darstellung für Telegram Desktop. `ee` wird nicht unterstützt. |
 | `max_sessions` | `usize` | nein | `web.limits.max_sessions_global` | Aktive Sitzungen für dieses Profil. |
 | `max_streams` | `usize` | nein | `web.limits.max_streams_global` | Aktive logische Streams für dieses Profil. |
@@ -2685,10 +2709,11 @@ Profilgrenzen müssen ungleich null sein und dürfen die zugehörigen globalen G

 ## WEB-Lebenszyklus und API-Verwaltung

- Config-Watcher und Generations-Reload wenden `web.enabled`, `web.carrier`, `web.debug`, `web.timeouts`, vhosts, Profile und Decoy-Snapshots ohne Prozessneustart an. Bestehende Sitzungen behalten Carrier, Grenzen und Deadlines ihres Erstellungszeitpunkts; neu ausgegebene Bridge-Sitzungen verwenden die aktive Generation.
+- Config-Watcher und Generations-Reload wenden `web.enabled`, Carrier- und Negotiation-Richtlinie, `web.debug`, `web.timeouts`, vhosts, Profile und Decoy-Snapshots ohne Prozessneustart an. Ein einzelner unveränderlicher expandierter Source-Snapshot wird validiert und aktiviert; der Watcher einer Kandidatengeneration startet erst nach deren Aktivierung. Bestehende Sitzungen und laufende Negotiation-Ketten behalten Carrier-Kandidaten, Grenzen, Timeouts und absolute Deadlines ihres Ausgabezeitpunkts; neue Bridge-Sitzungen verwenden genau eine fixierte aktive Generation.
 - Bestand und Vertrauensrichtlinie der WEB-Listener unter `server.listeners` sowie alle Werte in `web.limits` sind prozesseigen und erfordern einen Neustart.
- Es gibt keine veränderbare Ressource `/v1/web`. `GET /web-status` stellt authentifizierte, schreibgeschützte HTML-Diagnosen bereit; `GET /v1/config` lässt `[web]` aus und `PATCH /v1/config` lehnt einen Schlüssel `web` mit `400 section_not_editable` ab.
- Zum entfernten Anwenden einer WEB-Richtlinie ändern Sie die zuständige TOML-Datei und rufen `POST /v1/system/reload` auf. Prüfen Sie anschließend `GET /v1/system/reload/{id}` und dessen `deferred_process_fields`. Starten Sie Telemt neu, wenn das Feld `server.listeners` oder `web.limits` enthält.
+- `GET /v1/config` liefert den vollständigen verfassten `[web]`-Baum außer dem abgeleiteten Snapshot `web.runtime`. `PATCH /v1/config` akzeptiert ein dünn besetztes `web`-Objekt, führt Tabellen tief zusammen, ersetzt Arrays vollständig, validiert den gesamten Kandidaten und meldet `web.limits` bis zum Neustart in `deferred_process_fields`.
+- `GET /v1/runtime/web/status`, `/sessions`, `/sessions/{session_ref}` und `/operations/{operation_id}` stellen begrenzten, nicht geheimen Runtime-Zustand bereit. POST-Steuerungen schließen ausgewählte Sitzungen, löschen Debugdaten oder setzen Carrier-Learning zurück und verlangen die aktuelle zufällige `runtime_instance`.
+- `web.enabled = false` stoppt nach der Aktivierung neue Bootstrap-/Session-Ausgaben, schließt aber keine aktiven Sitzungen. Warten Sie für Close-all auf `manager.issuance_enabled = false`, senden Sie den asynchronen Selektor `all` und fragen Sie dessen Operation ab.
 - Vorhandene Access-Benutzer können über `/v1/users` erstellt, geändert, rotiert, aktiviert, deaktiviert und gelöscht werden. Das Erstellen eines Benutzers fügt kein WEB-Profil hinzu. Das Deaktivieren aktualisiert die Admission sofort und beendet die aktiven Sitzungen dieses Benutzers.
 - `PATCH /v1/config` kann `server.listeners` einschließlich der WEB-Listener-Felder speichern; ein geänderter WEB-Listener wird jedoch erst nach einem Prozessneustart aktiv.

@@ -308,6 +308,7 @@ This document lists all configuration keys accepted by `config.toml`.
 | [`proxy_secret_auto_reload_secs`](#proxy_secret_auto_reload_secs) | `u64` | `3600` | `✔` |
 | [`proxy_config_auto_reload_secs`](#proxy_config_auto_reload_secs) | `u64` | `3600` | `✔` |
 | [`me_reinit_singleflight`](#me_reinit_singleflight) | `bool` | `true` | `✔` |
+| [`me_reinit_max_concurrency`](#me_reinit_max_concurrency) | `usize` | `2` | `✔` |
 | [`me_reinit_trigger_channel`](#me_reinit_trigger_channel) | `usize` | `64` | `✘` |
 | [`me_reinit_coalesce_window_ms`](#me_reinit_coalesce_window_ms) | `u64` | `200` | `✔` |
 | [`me_deterministic_writer_sort`](#me_deterministic_writer_sort) | `bool` | `true` | `✔` |
@@ -1547,8 +1548,17 @@ This document lists all configuration keys accepted by `config.toml`.
    [general]
    me_reinit_singleflight = true
    ```
+## me_reinit_max_concurrency
+  - **Constraints / validation**: Must be within `[1, 8]`. The effective value is `1` while `me_reinit_singleflight = true`.
+  - **Description**: Bounds concurrent ME generation warmups. Excess triggers are coalesced into one pending rerun.
+  - **Example**:
+
+    ```toml
+    [general]
+    me_reinit_max_concurrency = 2
+    ```
 ## me_reinit_trigger_channel
-  - **Constraints / validation**: Must be `> 0`.
+  - **Constraints / validation**: Must be within `[1, 4096]`.
  - **Description**: Trigger queue capacity for reinit scheduler.
  - **Example**:

@@ -2558,12 +2568,25 @@ WEB mode carries Telegram Desktop MTProxy traffic through HTTPS terminated by an
 | --- | --- | --- | --- |
 | `enabled` | `bool` | `false` | `✔` |
 | `carrier` | `"https"`, `"https-lanes"`, `"websocket"`, or `"websocket-lanes"` | `"https"` | `✔` |
+| `carriers` | `false` or a non-empty array of unique carriers | `false` | `✔` |
+| `carrier_learning` | `bool` | `true` | `✔` |
+| `carrier_negotiation_aggressiveness` | `"conservative"`, `"balanced"`, or `"aggressive"` | `"conservative"` | `✔` |
+| `decoy_fasttrack_mode` | `"off"`, `"shadow"`, or `"enforce"` | `"off"` | `✘` |
+| `http_connection_capacity_action` | `"drop"`, `"wait"`, or `"respond"` | `"drop"` | `✔` |
 | `debug` | table | disabled, bounded defaults | `✔` |
 | `limits` | table | bounded defaults | `✘` |
 | `timeouts` | table | bounded defaults | `✔` |
 | `vhosts` | array of tables | `[]` | `✔` |

-`enabled = true` requires at least one network-eligible WEB listener, at least one vhost, and at least one profile in every vhost. `https` preserves the serialized HTTPS transport. `https-lanes` gives stream zero and every logical stream independent uplink sequencing, downlink cursors, retries, and long polls; it requires `max_http_handlers >= 2` and public HTTP/2 on the TLS terminator. `websocket` carries all logical streams over one ordered RFC 6455 connection, while `websocket-lanes` owns one connection per non-zero logical stream and isolates lane failures. Both WebSocket carriers use `GET /api/v1/ws` after HTTPS session creation and require the TLS terminator to preserve HTTP/1.1 Upgrade headers. A reload applies `carrier` only to newly issued bridge sessions. Disabling WEB stops issuance of new bridge and session credentials after reload; use the users API to revoke one user's active sessions.
+`enabled = true` requires at least one network-eligible WEB listener, at least one vhost, and at least one profile in every vhost. `https` preserves the serialized HTTPS transport and requires `max_http_handlers >= 2`. `https-lanes` gives stream zero and every logical stream independent uplink sequencing, downlink cursors, retries, and long polls; it requires `max_http_handlers >= 4` and public HTTP/2 on the TLS terminator. `websocket` carries all logical streams over one ordered RFC 6455 connection, while `websocket-lanes` owns one connection per non-zero logical stream and isolates lane failures. Both WebSocket carriers use `GET /api/v1/ws` after HTTPS session creation and require the TLS terminator to preserve HTTP/1.1 Upgrade headers.
+
+When `carriers` is missing or `false`, auto-negotiation and learning are disabled and `carrier` is the only mode. A non-empty `carriers` array enables startup-only negotiation in its configured order; `carrier` is appended exactly once as the final fallback. Empty arrays, duplicates, and `true` are rejected. The client advances candidates only before carrier commit and must create a new session to change carrier after commit. A metadata-free native client, including Telegram iOS, always uses the configured fixed `carrier`, even when negotiation is enabled. Current iOS supports only `https`, so such deployments must configure `carrier = "https"`. CFNetwork and Darwin User-Agent classification does not infer carrier support. Explicit native iOS capabilities are intersected with `{https}`; other explicit client capabilities participate as reported.
+
+`http_connection_capacity_action` applies only after Telemt has accepted a private WEB TCP connection and `max_http_connections` is exhausted. `drop` preserves the legacy immediate close. `respond` emits an empty `503 Service Unavailable` with `Retry-After: 1`, `Cache-Control: no-store`, and `Connection: close`. `wait` waits for ordinary connection capacity for at most `http_overload_timeout_ms`, then enters normal HTTP handling; timeout emits the same bounded `503`. At most `max_http_overload_connections` accepted sockets may wait or respond outside ordinary connection capacity. This policy cannot observe or cause a TCP connect refusal before Telemt accepts the socket.
+
+`decoy_fasttrack_mode` is restart-only. `off` preserves legacy root-request scanning and collects no fast-track decisions. `shadow` records eligible requests while preserving the full scan. `enforce` skips scans only for `HEAD` or absent/noncanonical bridge queries. A canonical bridge-shaped `GET`, including an unknown capability, always scans every profile in the selected vhost. The optimization does not bound hostile canonical probes and enforce mode must be validated for request-shape timing distinguishability behind the production TLS terminator.
+
+`carrier_learning` applies only while negotiation is enabled. Learning is process-local, in-memory, bounded, and positive-only: only a carrier that reaches the server-defined healthy state contributes evidence. `conservative` requires the broadest evidence and disables IP ranking, `balanced` admits moderate User-Agent/profile evidence plus eligible public-IP tie breaking, and `aggressive` reacts to the first bounded samples. Reported client failures remain diagnostic and never create negative evidence. Reload preserves evidence across a generation change only when enabled state, aggressiveness, evidence lifetime, and health window are identical; any semantic change advances the evidence epoch and fences stale outcomes. Because `[web.limits]` is process-owned, a reload that enables learning or negotiation using only a desired larger `max_carrier_learning_entries` atomically defers the dependent learning/carrier field rather than publishing an invalid effective combination. Disabling WEB stops issuance of new bridge and session credentials after reload; use the users API to revoke one user's active sessions.

 # [web.debug]

@@ -2584,9 +2607,11 @@ This hot-reloadable table controls the process-owned server-side WEB debug recor

 Changing `enabled` or any capture field clears retained records and rejects commits started under the previous policy epoch. Changing only the default or maximum observation window preserves compatible retained records. `full` retains a complete recognized carrier body only up to `web.limits.max_body_bytes`; decoy bodies always remain prefix-bounded. A prefix that depends on a simultaneously increased restart-only capacity is deferred with `web.debug` until restart. URI queries are never retained, credential header values are omitted, body copies are scrubbed for known WEB capabilities and bearer tokens, and profile keys are represented only by a domain-separated 16-hex fingerprint.

+Authenticated JSON control may clear the ring explicitly with `POST /v1/runtime/web/debug/clear`; the required process `runtime_instance` fences stale controllers, the returned epoch fences in-flight writers, and `leased_bytes` reports memory still owned by already rendered snapshots.
+
 # [web.limits]

-These process-wide ceilings make every WEB registry, queue, request body, static snapshot, and admission path bounded. All values are validated together. Per-owner limits cannot exceed global limits, queue reserves must preserve control-frame progress, body reservations must fit their global budget, and all declared byte ceilings must fit `memory_envelope_bytes`. Changing any value in this table requires a process restart.
+These process-wide ceilings make every WEB registry, queue, request body, capability index, static snapshot, and admission path bounded. All values are validated together. Per-owner limits cannot exceed global limits, queue reserves must preserve control-frame progress, body reservations must fit their global budget, and all declared byte ceilings must fit `memory_envelope_bytes`. Changing any value in this table requires a process restart.

 | Key | Type | Default | Description |
 | --- | --- | --- | --- |
@@ -2596,11 +2621,17 @@ These process-wide ceilings make every WEB registry, queue, request body, static
 | `carrier_batch_bytes` | `usize` | `2097152` | Maximum encoded downlink batch. |
 | `max_frames_per_body` | `usize` | `4096` | Maximum frames parsed or emitted per carrier body. |
 | `max_http_connections` | `usize` | `1024` | Accepted WEB HTTP connections process-wide. |
+| `max_http_overload_connections` | `usize` | `64` | Accepted saturated sockets allowed to wait or emit the bounded retryable response outside ordinary HTTP capacity. |
 | `max_http_handlers` | `usize` | `512` | Concurrent HTTP handlers process-wide; HTTPS lanes may park at most half, preserving the remainder for session, uplink, and control work. |
+| `max_lane_open_waits_per_session` | `usize` | `16` | Canonical cursor-zero downlink polls allowed to wait for a racing lane `OPEN` in one session. |
+| `pending_bytes_per_lane` | `usize` | `8388608` | Queued and resident `DATA` bytes allowed for one independent HTTPS or WebSocket lane. |
+| `pending_items_per_lane` | `usize` | `1024` | Queued and resident `DATA` items allowed for one independent HTTPS or WebSocket lane. |
 | `websocket_bytes_global` | `usize` | `268435456` | Transient WebSocket codec, message, and write-staging sub-budget inside `pending_bytes_global`. |
-| `websocket_admission_watermark_pct` | `u8` | `75` | WebSocket byte percentage at which new admission may replace an owner-first victim. |
-| `websocket_eviction_watermark_pct` | `u8` | `90` | WebSocket byte percentage at which queue pressure may evict the least-recently-progressed eligible connection. |
+| `websocket_admission_watermark_pct` | `u8` | `75` | WebSocket byte watermark for new base admission and the fair-share calculation used by deterministic replacement. |
+| `websocket_eviction_watermark_pct` | `u8` | `90` | WebSocket data-allocation watermark at which shared queue pressure may request deterministic cleanup. |
 | `websocket_http_connection_reserve` | `usize` | `64` | Accepted HTTP connections unavailable to WebSocket upgrades, preserving ordinary HTTP and decoy capacity. |
+| `max_websocket_evictions_in_flight` | `usize` | `8` | Process-wide ceiling for concurrent exact WebSocket eviction claims during admission and pressure cleanup. |
+| `max_carrier_learning_entries` | `usize` | `4096` | Process-wide ceiling for bounded carrier-learning evidence entries. |
 | `max_body_readers` | `usize` | `32` | Concurrent collected request bodies process-wide. |
 | `max_body_bytes_global` | `usize` | `67108864` | Global byte reservation for collected bodies. |
 | `max_sessions_global` | `usize` | `128` | Live WEB sessions process-wide. |
@@ -2624,7 +2655,7 @@ These process-wide ceilings make every WEB registry, queue, request body, static
 | `max_static_bytes` | `usize` | `67108864` | Static snapshot bytes across all vhosts. |
 | `debug_records_capacity` | `usize` | `65536` | Maximum retained WEB debug record count. |
 | `debug_bytes_global` | `usize` | `67108864` | Retained plus in-flight WEB debug byte ceiling; minimum 4096. |
-| `memory_envelope_bytes` | `usize` | `805306368` | Declared envelope for HTTP heads, bodies, shared queues/WebSocket I/O, static snapshots, and bounded debug/status buffers; maximum 4 GiB. |
+| `memory_envelope_bytes` | `usize` | `1342177280` | Declared envelope for HTTP heads, bodies, shared queues/WebSocket I/O, capability indexes, lane state, carrier learning, static snapshots, and bounded debug/status buffers; maximum 4 GiB. |
 | `new_bootstraps_per_minute` | `u32` | `1200` | Sustained process-wide bootstrap issuance rate. |
 | `new_bootstraps_burst` | `u32` | `256` | Process-wide bootstrap issuance burst. |
 | `new_sessions_per_minute` | `u32` | `600` | Sustained process-wide session creation rate. |
@@ -2634,21 +2665,33 @@ These process-wide ceilings make every WEB registry, queue, request body, static

 # [web.timeouts]

-Every timeout is measured in seconds and must be within `1..=3600`. The longest request deadline must be lower than `http_idle_secs`.
+Unless a row states otherwise, timeouts are measured in seconds and must be within `1..=3600`. Configured server-side HTTP phase deadlines must be lower than `http_idle_secs`; protected phases retain their own deadlines, so the idle timer is not an aggregate request deadline. The bridge retry window is client-side and follows its own bound.

 | Key | Type | Default | Hot-Reload | Description |
 | --- | --- | --- | --- | --- |
 | `header_secs` | `u64` | `10` | `✔` | Receive one complete HTTP request head. |
 | `body_secs` | `u64` | `30` | `✔` | Collect one authenticated carrier body. |
 | `stream_handshake_secs` | `u64` | `10` | `✔` | Complete one inner MTProxy handshake. |
+| `stream_first_byte_secs` | `u64` | `30` | `✔` | Receive the first inner MTProxy byte after `OPEN`; validated within `1..=300`. |
 | `long_poll_secs` | `u64` | `25` | `✔` | Maximum empty downlink long poll. |
+| `bridge_request_secs` | `u64` | `10` | `✔` | Bridge-side deadline for one HTTP attempt through complete response-body consumption; `/down` additionally allows `long_poll_secs`. Validated within `1..=60`. |
+| `bridge_retry_secs` | `u64` | `90` | `✔` | Absolute bridge retry window including attempts and backoff; validated within `1..=300` and no lower than `bridge_request_secs`. |
+| `bridge_recovery_secs` | `u64` | `15` | `✔` | Absolute post-commit recovery window for a surviving bridge document; validated within `1..=60` and frozen when recovery starts. |
+| `carrier_probe_coalesce_ms` | `u64` | `0` | `✔` | Optional bridge wait after `OPEN` for matching `DATA`; milliseconds within `0..=10`, where `0` preserves immediate probing. |
+| `lane_open_wait_secs` | `u64` | `2` | `✔` | Wait for a canonical cursor-zero downlink that races its lane `OPEN`; no greater than `long_poll_secs`. |
+| `carrier_health_secs` | `u64` | `30` | `✔` | Post-commit observation interval required before a carrier can contribute learning evidence. |
+| `websocket_upgrade_secs` | `u64` | `5` | `✔` | Maximum wait for an accepted HTTP Upgrade to become a WebSocket; validated within `1..=60`. |
+| `websocket_open_secs` | `u64` | `15` | `✔` | Absolute deadline for the first carrier binary message after Upgrade; validated within `1..=300`. |
 | `websocket_write_secs` | `u64` | `30` | `✔` | Maximum wait for one WebSocket write or flush. |
 | `websocket_backpressure_secs` | `u64` | `30` | `✔` | Maximum wait for shared byte-budget or queue progress before closing the affected connection. |
 | `websocket_eviction_secs` | `u64` | `1` | `✔` | Grace allowed for a pressure-evicted WebSocket to release its slot and budget before admission fails. |
+| `carrier_negotiation_deadlines_secs` | `[u64; 4]` | `[3, 5, 8, 12]` | `✔` | Strictly increasing cumulative offsets used by the bridge before its first `/session` request and by the server when accepting the first automatic attempt. Checkpoints for one through four candidates are `[d3]`, `[d0, d3]`, `[d0, d1, d3]`, and `[d0, d1, d2, d3]`; the final candidate always uses `d3`. |
+| `carrier_learning_secs` | `u64` | `600` | `✔` | Fixed two-window process-local evidence lifetime; validated within `2..=86400`. |
 | `bootstrap_lifetime_secs` | `u64` | `120` | `✔` | Unused bootstrap and closed-token replay lifetime. |
-| `reconnect_grace_secs` | `u64` | `120` | `✔` | Maximum carrier inactivity before session closure. |
-| `http_idle_secs` | `u64` | `75` | `✔` | WEB HTTP keep-alive idle lifetime. |
-| `shutdown_secs` | `u64` | `15` | `✔` | Graceful WEB shutdown deadline. |
+| `reconnect_grace_secs` | `u64` | `120` | `✔` | Maximum validated peer inactivity before session closure; empty polls and backend-only progress do not renew this lease. |
+| `http_idle_secs` | `u64` | `75` | `✔` | Idle limit between HTTP exchanges and while an emitted response body makes no progress. Explicitly bounded request-body, long-poll, decoy, and pending-Upgrade phases keep their own deadlines instead of being truncated by this timer. The value is frozen when the connection is accepted. |
+| `http_overload_timeout_ms` | `u64` | `250` | `✔` | Per-phase deadline in milliseconds for an accepted saturated socket to wait for capacity or write its retryable response; validated within `1..=60000`. A timed-out wait and its response write each receive at most one phase budget. |
+| `shutdown_secs` | `u64` | `15` | `✔` | One absolute process-shutdown budget shared by all listener acceptors and connections plus WEB session and auxiliary-task drains. The active value is captured once when shutdown starts. |
 | `decoy_header_secs` | `u64` | `30` | `✔` | Connect and response-head deadline for an HTTP decoy. |

 # [[web.vhosts]]
@@ -2675,7 +2718,7 @@ Exactly one decoy mode is required:

 | Key | Type | Required | Default | Description |
 | --- | --- | --- | --- | --- |
-| `user` | `String` | yes | — | Existing key from `[access.users]`. |
+| `user` | `String` | yes | — | Existing 1–64-byte key from `[access.users]`; the bound keeps runtime status and filters bounded. |
 | `secret_mode` | `"plain"` or `"dd"` | yes | — | Exact Telegram Desktop secret representation. `ee` is not supported. |
 | `max_sessions` | `usize` | no | `web.limits.max_sessions_global` | Live sessions for this profile. |
 | `max_streams` | `usize` | no | `web.limits.max_streams_global` | Live logical streams for this profile. |
@@ -2685,10 +2728,11 @@ Profile limits must be non-zero and no greater than their corresponding global l

 ## WEB lifecycle and API management

- The config watcher and generation reload apply `web.enabled`, `web.carrier`, `web.debug`, `web.timeouts`, vhosts, profiles, and decoy snapshots without a process restart. Existing sessions keep their acquisition-time carrier, limits, and deadlines; newly issued bridge sessions use the active generation.
+- The config watcher and generation reload apply `web.enabled`, carrier and negotiation policy, `web.debug`, `web.timeouts`, vhosts, profiles, and decoy snapshots without a process restart. One immutable expanded source snapshot is validated and activated; a candidate generation's watcher starts only after that generation becomes active. Existing sessions and in-flight negotiation chains keep their issuance-time carrier candidates, limits, timeouts, and absolute deadlines; newly issued bridge sessions use one pinned active generation.
 - WEB listener inventory and trust policy under `server.listeners`, and every `web.limits` value, are process-owned and restart-required.
- There is no mutable `/v1/web` resource. `GET /web-status` provides authenticated read-only HTML diagnostics; `GET /v1/config` omits `[web]`, and `PATCH /v1/config` rejects a `web` key with `400 section_not_editable`.
- To manage WEB policy remotely, update the owned TOML file and call `POST /v1/system/reload`; inspect `GET /v1/system/reload/{id}` and its `deferred_process_fields`. Restart Telemt when it contains `server.listeners` or `web.limits`.
+- `GET /v1/config` returns the complete authored `[web]` tree except the derived `web.runtime` snapshot. `PATCH /v1/config` accepts a sparse `web` object, deep-merges tables, replaces arrays wholesale, validates the complete candidate, and reports `web.limits` in `deferred_process_fields` until restart.
+- `GET /v1/runtime/web/status`, `/sessions`, `/sessions/{session_ref}`, and `/operations/{operation_id}` expose bounded non-secret runtime state. POST controls close selected sessions, clear debug data, or reset carrier learning and require the current random `runtime_instance`.
+- `web.enabled = false` stops new bootstrap/session issuance after activation but does not close live sessions. For close-all, wait until status reports `manager.issuance_enabled = false`, submit the asynchronous `all` selector, and poll its operation.
 - Existing access users can be created, changed, rotated, enabled, disabled, and deleted through `/v1/users`. Creating a user does not add a WEB profile. Disabling a user immediately updates admission and cancels that user's active sessions.
 - `PATCH /v1/config` can persist `server.listeners`, including WEB listener fields, but a changed WEB listener does not become active until process restart.

@@ -2484,12 +2484,19 @@ WEB-режим переносит MTProxy-трафик Telegram Desktop внут
 | --- | --- | --- | --- |
 | `enabled` | `bool` | `false` | `✔` |
 | `carrier` | `"https"`, `"https-lanes"`, `"websocket"` или `"websocket-lanes"` | `"https"` | `✔` |
+| `carriers` | `false` или непустой массив уникальных carrier | `false` | `✔` |
+| `carrier_learning` | `bool` | `true` | `✔` |
+| `carrier_negotiation_aggressiveness` | `"conservative"`, `"balanced"` или `"aggressive"` | `"conservative"` | `✔` |
 | `debug` | таблица | выключено, ограниченные defaults | `✔` |
 | `limits` | таблица | ограниченные defaults | `✘` |
 | `timeouts` | таблица | ограниченные defaults | `✔` |
 | `vhosts` | массив таблиц | `[]` | `✔` |

-Для `enabled = true` нужен как минимум один доступный по сетевой политике WEB-listener, один vhost и один профиль в каждом vhost. `https` сохраняет сериализованный HTTPS transport. В `https-lanes` stream zero и каждый logical stream получают независимые uplink sequence, downlink cursor, retry и long poll; carrier требует `max_http_handlers >= 2` и публичного HTTP/2 на TLS-терминаторе. `websocket` переносит все logical streams через одно упорядоченное RFC 6455 connection, а `websocket-lanes` выделяет отдельное connection каждому ненулевому stream и изолирует сбои lane. Оба WebSocket carrier используют `GET /api/v1/ws` после создания HTTPS-сессии и требуют от TLS-терминатора сохранять HTTP/1.1 Upgrade headers. Reload применяет `carrier` только к новым bridge sessions. Отключение WEB после reload прекращает выдачу новых bridge- и session-credentials; для отзыва активных сессий отдельного пользователя используйте users API.
+Для `enabled = true` нужен как минимум один доступный по сетевой политике WEB-listener, один vhost и один профиль в каждом vhost. `https` сохраняет сериализованный HTTPS transport и требует `max_http_handlers >= 2`. В `https-lanes` stream zero и каждый logical stream получают независимые uplink sequence, downlink cursor, retry и long poll; carrier требует `max_http_handlers >= 4` и публичного HTTP/2 на TLS-терминаторе. `websocket` переносит все logical streams через одно упорядоченное RFC 6455 connection, а `websocket-lanes` выделяет отдельное connection каждому ненулевому stream и изолирует сбои lane. Оба WebSocket carrier используют `GET /api/v1/ws` после создания HTTPS-сессии и требуют от TLS-терминатора сохранять HTTP/1.1 Upgrade headers.
+
+Если `carriers` отсутствует или равен `false`, auto-negotiation и обучение выключены, а `carrier` задаёт единственный режим. Непустой массив `carriers` включает стартовый перебор в заданном порядке; `carrier` ровно один раз добавляется последним fallback-вариантом. Пустой массив, дубликаты и `true` запрещены. Клиент может перейти к следующему кандидату только до commit carrier; для смены carrier после commit нужна новая сессия. Native-клиент без метаданных, включая Telegram iOS, всегда использует настроенный фиксированный `carrier`, даже при включённом auto-negotiation. Текущий iOS поддерживает только `https`, поэтому такой deployment должен задавать `carrier = "https"`. Классификация User-Agent CFNetwork и Darwin не определяет поддержку carrier. Явные capabilities нативного iOS пересекаются с `{https}`; capabilities остальных явных клиентов применяются как переданы.
+
+`carrier_learning` действует только при включённом auto-negotiation. Обучение локально для процесса, хранится в памяти, ограничено и учитывает только положительный результат: evidence добавляет лишь carrier, достигший определённого сервером состояния healthy. `conservative` требует наиболее широкой выборки и отключает ранжирование по IP, `balanced` использует умеренные пороги для User-Agent/профиля и допустимый публичный IP только для разрешения равенства, а `aggressive` реагирует на первые ограниченные samples. Сообщённые клиентом ошибки остаются только диагностикой и не создают отрицательный evidence. Reload применяет новую policy к новым цепочкам negotiation и инвалидирует несовместимый сохранённый evidence. Отключение WEB прекращает выдачу новых bridge- и session-credentials; для отзыва активных сессий отдельного пользователя используйте users API.

 # [web.debug]

@@ -2510,6 +2517,8 @@ WEB-режим переносит MTProxy-трафик Telegram Desktop внут

 Изменение `enabled` или любого поля capture очищает сохранённые записи и отклоняет commits, начатые в предыдущую policy epoch. Изменение только стандартного или максимального окна наблюдения сохраняет совместимые записи. `full` сохраняет полное тело распознанного carrier только до `web.limits.max_body_bytes`; decoy bodies всегда остаются ограничены настроенным prefix. Prefix, который помещается только в одновременно увеличенную restart-only ёмкость, откладывается вместе с `web.debug` до перезапуска. URI queries никогда не сохраняются, значения credential headers исключаются, копии body очищаются от известных WEB capabilities и bearer tokens, а ключи профилей представлены только domain-separated fingerprint из 16 hex-символов.

+Аутентифицированное JSON-управление может явно очистить ring через `POST /v1/runtime/web/debug/clear`: обязательный process `runtime_instance` защищает от устаревшего controller, возвращаемый epoch отсекает in-flight writers, а `leased_bytes` показывает память, всё ещё удерживаемую уже отрисовываемыми snapshots.
+
 # [web.limits]

 Эти process-wide границы ограничивают все WEB-реестры, очереди, тела запросов, статические snapshots и admission-пути. Значения проверяются совместно: per-owner лимиты не могут превышать глобальные, резервы очередей должны сохранять прогресс control frames, body-резервы должны помещаться в общий бюджет, а все заявленные байтовые границы — в `memory_envelope_bytes`. Изменение любого значения этой таблицы требует перезапуска процесса.
@@ -2523,10 +2532,15 @@ WEB-режим переносит MTProxy-трафик Telegram Desktop внут
 | `max_frames_per_body` | `usize` | `4096` | Максимальное число frames в одном carrier body. |
 | `max_http_connections` | `usize` | `1024` | Принятые WEB HTTP connections на весь процесс. |
 | `max_http_handlers` | `usize` | `512` | Одновременно выполняемые HTTP handlers на весь процесс; HTTPS lanes могут занять long polls не более половины лимита, оставляя остаток для session, uplink и control work. |
+| `max_lane_open_waits_per_session` | `usize` | `16` | Канонические downlink polls с cursor zero, которые могут ожидать конкурирующий lane `OPEN` в одной сессии. |
+| `pending_bytes_per_lane` | `usize` | `8388608` | Байты queued и resident `DATA`, разрешённые одной независимой HTTPS- или WebSocket-lane. |
+| `pending_items_per_lane` | `usize` | `1024` | Элементы queued и resident `DATA`, разрешённые одной независимой HTTPS- или WebSocket-lane. |
 | `websocket_bytes_global` | `usize` | `268435456` | Подбюджет transient WebSocket codec, messages и write staging внутри `pending_bytes_global`. |
-| `websocket_admission_watermark_pct` | `u8` | `75` | Доля WebSocket byte-budget, после которой новый admission может вытеснить owner-first victim. |
-| `websocket_eviction_watermark_pct` | `u8` | `90` | Доля WebSocket byte-budget, после которой queue pressure может вытеснить подходящее connection с наиболее старым прогрессом. |
+| `websocket_admission_watermark_pct` | `u8` | `75` | Watermark WebSocket byte-budget для нового base admission и расчёта fair share при детерминированном replacement. |
+| `websocket_eviction_watermark_pct` | `u8` | `90` | Watermark выделения WebSocket data, после которого давление общей queue может запросить детерминированный cleanup. |
 | `websocket_http_connection_reserve` | `usize` | `64` | Число принятых HTTP connections, недоступных WebSocket upgrades и сохраняющих capacity для обычного HTTP и decoy. |
+| `max_websocket_evictions_in_flight` | `usize` | `8` | Process-wide предел одновременных точных WebSocket eviction claims при admission и pressure cleanup. |
+| `max_carrier_learning_entries` | `usize` | `4096` | Process-wide предел записей bounded carrier-learning evidence. |
 | `max_body_readers` | `usize` | `32` | Одновременно собираемые request bodies на весь процесс. |
 | `max_body_bytes_global` | `usize` | `67108864` | Глобальный байтовый резерв для собранных bodies. |
 | `max_sessions_global` | `usize` | `128` | Активные WEB-сессии на весь процесс. |
@@ -2550,7 +2564,7 @@ WEB-режим переносит MTProxy-трафик Telegram Desktop внут
 | `max_static_bytes` | `usize` | `67108864` | Размер static snapshots всех vhosts. |
 | `debug_records_capacity` | `usize` | `65536` | Максимальное число сохранённых WEB debug records. |
 | `debug_bytes_global` | `usize` | `67108864` | Глобальная байтовая граница сохранённых и находящихся в обработке WEB debug данных; минимум 4096. |
-| `memory_envelope_bytes` | `usize` | `805306368` | Заявленный envelope для HTTP heads, bodies, общих queues/WebSocket I/O, static snapshots и bounded debug/status buffers; максимум 4 GiB. |
+| `memory_envelope_bytes` | `usize` | `1342177280` | Заявленный envelope для HTTP heads, bodies, общих queues/WebSocket I/O, состояния lanes, carrier learning, static snapshots и bounded debug/status buffers; максимум 4 GiB. |
 | `new_bootstraps_per_minute` | `u32` | `1200` | Устойчивая process-wide скорость выдачи bootstrap. |
 | `new_bootstraps_burst` | `u32` | `256` | Process-wide burst выдачи bootstrap. |
 | `new_sessions_per_minute` | `u32` | `600` | Устойчивая process-wide скорость создания сессий. |
@@ -2560,21 +2574,31 @@ WEB-режим переносит MTProxy-трафик Telegram Desktop внут

 # [web.timeouts]

-Все таймауты задаются в секундах и должны входить в диапазон `1..=3600`. Самый длинный request deadline должен быть меньше `http_idle_secs`.
+Если в строке не указано иное, таймауты задаются в секундах и должны входить в диапазон `1..=3600`. Настроенные серверные deadlines отдельных HTTP-фаз должны быть меньше `http_idle_secs`; защищённые фазы сохраняют собственные deadlines, поэтому idle-таймер не является общим deadline запроса. Client-side окно повторов bridge имеет отдельные границы.

 | Ключ | Тип | По умолчанию | Hot-Reload | Описание |
 | --- | --- | --- | --- | --- |
 | `header_secs` | `u64` | `10` | `✔` | Получение полного заголовка HTTP-запроса. |
 | `body_secs` | `u64` | `30` | `✔` | Сбор одного аутентифицированного carrier body. |
 | `stream_handshake_secs` | `u64` | `10` | `✔` | Выполнение внутреннего MTProxy handshake. |
+| `stream_first_byte_secs` | `u64` | `30` | `✔` | Получение первого внутреннего MTProxy-байта после `OPEN`; диапазон `1..=300`. |
 | `long_poll_secs` | `u64` | `25` | `✔` | Максимальная длительность пустого downlink long poll. |
+| `bridge_request_secs` | `u64` | `10` | `✔` | Deadline одной HTTP attempt в bridge до полного чтения response body; для `/down` дополнительно разрешён `long_poll_secs`. Диапазон `1..=60`. |
+| `bridge_retry_secs` | `u64` | `90` | `✔` | Абсолютное окно повторов bridge, включая attempts и backoff; диапазон `1..=300`, не меньше `bridge_request_secs`. |
+| `carrier_probe_coalesce_ms` | `u64` | `0` | `✔` | Опциональное ожидание bridge после `OPEN` для соответствующего `DATA`; миллисекунды в диапазоне `0..=10`, где `0` сохраняет немедленный probe. |
+| `lane_open_wait_secs` | `u64` | `2` | `✔` | Ожидание канонического downlink с cursor zero, опередившего свой lane `OPEN`; не больше `long_poll_secs`. |
+| `carrier_health_secs` | `u64` | `30` | `✔` | Интервал наблюдения после commit, необходимый для добавления carrier-learning evidence. |
+| `websocket_upgrade_secs` | `u64` | `5` | `✔` | Максимальное ожидание превращения принятого HTTP Upgrade в WebSocket; диапазон `1..=60`. |
+| `websocket_open_secs` | `u64` | `15` | `✔` | Абсолютный deadline первого carrier binary message после Upgrade; диапазон `1..=300`. |
 | `websocket_write_secs` | `u64` | `30` | `✔` | Максимальное ожидание одной WebSocket write или flush операции. |
 | `websocket_backpressure_secs` | `u64` | `30` | `✔` | Максимальное ожидание прогресса общего byte-budget или queue перед закрытием затронутого connection. |
 | `websocket_eviction_secs` | `u64` | `1` | `✔` | Grace period для освобождения slot и budget вытесненным WebSocket до отказа admission. |
+| `carrier_negotiation_deadlines_secs` | `[u64; 4]` | `[3, 5, 8, 12]` | `✔` | Строго возрастающие cumulative offsets: bridge применяет их перед первым запросом `/session`, сервер — при приёме первой automatic attempt. Checkpoints для одного—четырёх кандидатов: `[d3]`, `[d0, d3]`, `[d0, d1, d3]` и `[d0, d1, d2, d3]`; последний кандидат всегда использует `d3`. |
+| `carrier_learning_secs` | `u64` | `600` | `✔` | Фиксированный срок двух process-local окон evidence; диапазон `2..=86400`. |
 | `bootstrap_lifetime_secs` | `u64` | `120` | `✔` | Срок неиспользованного bootstrap и replay-marker закрытого token. |
 | `reconnect_grace_secs` | `u64` | `120` | `✔` | Максимальная неактивность carrier до закрытия сессии. |
-| `http_idle_secs` | `u64` | `75` | `✔` | Idle lifetime WEB HTTP keep-alive connection. |
-| `shutdown_secs` | `u64` | `15` | `✔` | Deadline корректного завершения WEB. |
+| `http_idle_secs` | `u64` | `75` | `✔` | Лимит простоя между HTTP-обменами и при отсутствии прогресса уже выданного response body. Явно ограниченные фазы request body, long poll, decoy и ожидания Upgrade сохраняют собственные deadlines и не обрываются этим таймером. Значение фиксируется при приёме connection. |
+| `shutdown_secs` | `u64` | `15` | `✔` | Один абсолютный бюджет завершения процесса, общий для всех listener acceptors и connections, а также для WEB sessions и auxiliary tasks. Активное значение фиксируется один раз при начале shutdown. |
 | `decoy_header_secs` | `u64` | `30` | `✔` | Deadline подключения и получения response head от HTTP decoy. |

 # [[web.vhosts]]
@@ -2601,7 +2625,7 @@ Hostname нормализуется при валидации и должен п

 | Ключ | Тип | Обязательный | По умолчанию | Описание |
 | --- | --- | --- | --- | --- |
-| `user` | `String` | да | — | Существующий ключ из `[access.users]`. |
+| `user` | `String` | да | — | Существующий ключ длиной 1–64 байта из `[access.users]`; ограничение сохраняет bounded runtime-status и фильтры. |
 | `secret_mode` | `"plain"` или `"dd"` | да | — | Точное представление секрета для Telegram Desktop. `ee` не поддерживается. |
 | `max_sessions` | `usize` | нет | `web.limits.max_sessions_global` | Активные сессии этого профиля. |
 | `max_streams` | `usize` | нет | `web.limits.max_streams_global` | Активные logical streams этого профиля. |
@@ -2611,10 +2635,11 @@ Hostname нормализуется при валидации и должен п

 ## Lifecycle WEB и управление через API

- Config watcher и generation reload применяют `web.enabled`, `web.carrier`, `web.debug`, `web.timeouts`, vhosts, profiles и decoy snapshots без перезапуска процесса. Существующие сессии сохраняют carrier, лимиты и deadlines своего момента создания; новые bridge sessions используют активное поколение.
+- Config watcher и generation reload применяют `web.enabled`, policy carrier/negotiation, `web.debug`, `web.timeouts`, vhosts, profiles и decoy snapshots без перезапуска процесса. Валидируется и активируется один immutable expanded source snapshot; watcher candidate generation запускается только после активации этого поколения. Существующие сессии и начатые negotiation chains сохраняют issuance-time carrier candidates, limits, timeouts и абсолютные deadlines; новые bridge sessions используют одно зафиксированное активное поколение.
 - Состав WEB-listeners и их trust policy в `server.listeners`, а также все значения `web.limits` принадлежат процессу и требуют перезапуска.
- Изменяемого ресурса `/v1/web` нет. `GET /web-status` предоставляет аутентифицированную read-only HTML-диагностику; `GET /v1/config` не возвращает `[web]`, а `PATCH /v1/config` отклоняет ключ `web` с `400 section_not_editable`.
- Для удалённого применения WEB policy измените соответствующий TOML-файл и вызовите `POST /v1/system/reload`; проверьте `GET /v1/system/reload/{id}` и поле `deferred_process_fields`. Если оно содержит `server.listeners` или `web.limits`, перезапустите Telemt.
+- `GET /v1/config` возвращает полное авторское дерево `[web]`, кроме производного snapshot `web.runtime`. `PATCH /v1/config` принимает sparse object `web`, глубоко сливает tables, целиком заменяет arrays, валидирует полный candidate и указывает `web.limits` в `deferred_process_fields` до перезапуска.
+- `GET /v1/runtime/web/status`, `/sessions`, `/sessions/{session_ref}` и `/operations/{operation_id}` предоставляют bounded несекретное runtime-состояние. POST controls закрывают выбранные сессии, очищают debug или сбрасывают carrier learning и требуют текущий случайный `runtime_instance`.
+- `web.enabled = false` после активации прекращает новую выдачу bootstrap/session credentials, но не закрывает активные сессии. Для close-all дождитесь `manager.issuance_enabled = false`, отправьте асинхронный selector `all` и опрашивайте его operation.
 - Существующих access users можно создавать, изменять, ротировать, включать, выключать и удалять через `/v1/users`. Создание пользователя не добавляет WEB-профиль. Отключение пользователя немедленно обновляет admission и завершает его активные сессии.
 - `PATCH /v1/config` может сохранить `server.listeners`, включая поля WEB-listener’а, но изменённый WEB-listener активируется только после перезапуска процесса.

@@ -28,7 +28,9 @@ Leiten Sie den vollständigen öffentlichen vhost an Telemt weiter. Wenn der TLS

 - Der öffentliche Endpunkt ist immer `https://HOST:443`.
 - Unterstützt werden 16-Byte-MTProxy-Secrets in den Modi `plain` und `dd`. FakeTLS-Secrets mit `ee` werden im WEB-Modus nicht unterstützt.
- `web.carrier = "https"` wählt serialisierte HTTPS-Uplinks und Long Polling. `https-lanes` wählt unabhängige HTTPS-Sequenzen und Polls pro logischem Stream. `websocket` wählt einen geordneten WebSocket für alle Streams. `websocket-lanes` wählt einen unabhängig verwalteten WebSocket für jeden logischen Stream ungleich null.
+- `web.carrier` wählt den einzigen Carrier bei deaktivierter Auto-Negotiation und den letzten Fallback bei aktivierter Negotiation. `https` verwendet serialisierte HTTPS-Uplinks und Long Polling. `https-lanes` verwendet unabhängige HTTPS-Sequenzen und Polls pro logischem Stream. `websocket` verwendet einen geordneten WebSocket für alle Streams. `websocket-lanes` verwendet einen unabhängig verwalteten WebSocket für jeden logischen Stream ungleich null.
+- Ein fehlendes `web.carriers` oder `web.carriers = false` deaktiviert Auto-Negotiation und Lernen. Ein nicht leeres Array aktiviert ausschließlich die sequenzielle Start-Negotiation; eine bereits festgeschriebene Sitzung wird nie migriert.
+- Native Clients ohne kanonische Carrier-Negotiation-Header verwenden den konfigurierten festen `carrier`, auch wenn `carriers` die Negotiation für fähige Clients aktiviert. Das aktuelle Telegram iOS unterstützt nur `https`; für metadatafreies iOS muss der Betreiber daher `web.carrier = "https"` setzen, `https-lanes` wird nicht unterstützt. User-Agent-Werte einschließlich CFNetwork oder Darwin leiten niemals Capabilities ab. Sendet ein nativer iOS-Client explizite Negotiation-Metadaten, schneidet Telemt sie mit der serverautoritativen Obergrenze `{https}` und lehnt ein leeres Ergebnis ab; andere explizite Clients verwenden ihren angegebenen Capability-Satz.
 - Capability-, Bootstrap- und Session-Zugangsdaten sind getrennte Werte mit begrenzter Lebensdauer. Carrier-Zugangsdaten sind geheim und dürfen nicht in Access-Logs erscheinen.
 - Ein Bootstrap ist ein Bearer-Token und nicht an eine Quelladresse gebunden. Client-Adresse und IP-Familie dürfen sich zwischen dem Laden der Bridge und der Sitzungserstellung ändern. Die Ausstellungsadresse bleibt dem Limit ungenutzter Bootstraps zugeordnet; die Adresse des ersten gültigen Erstellungs-Requests wird der Sitzung zugeordnet.
 - Die innere MTProxy-Authentifizierung ist auf den Benutzer und Secret-Modus des vhost-Profils beschränkt. Ein ungültiger innerer Handshake schließt nur seinen logischen Stream und gelangt niemals in den TCP-Masking-Pfad.
@@ -91,17 +93,52 @@ max_streams = 512
 max_streams_per_session = 64
 ```

+## Serverseitige Carrier-Negotiation
+
+Auto-Negotiation ist optional und bleibt deaktiviert, solange `carriers` nicht als explizites, nicht leeres Array gesetzt ist. Der konfigurierte `carrier` bleibt der letzte Fallback und wird genau einmal angehängt, auch wenn er bereits im Array steht:
+
+```toml
+[web]
+enabled = true
+carrier = "https"
+carriers = ["websocket-lanes", "websocket", "https-lanes"]
+carrier_learning = true
+carrier_negotiation_aggressiveness = "conservative"
+
+[web.timeouts]
+carrier_negotiation_deadlines_secs = [3, 5, 8, 12]
+carrier_health_secs = 30
+carrier_learning_secs = 600
+bridge_request_secs = 10
+bridge_retry_secs = 90
+carrier_probe_coalesce_ms = 0
+```
+
+Die erzeugte Bridge sendet bei `/session` die kanonischen Header `X-Carrier-Capabilities`, `X-Carrier-Attempt` und ab dem zweiten Versuch `X-Carrier-Failure`. Jede erfolgreiche automatische Response liefert `X-Carrier-Mode`, `X-Carrier-Attempt`, `X-Carrier-Candidate-Count`, `X-Carrier-Deadline` und `X-Carrier-State`. Die Bridge startet ihre lokale kumulative Uhr unmittelbar vor dem ersten `/session`-Request; der Server friert seine separate absolute Chain-Deadline bei Annahme des ersten automatischen Versuchs ein. Beide verwenden die konfigurierten Offsets und werden bei Ersatzversuchen nicht zurückgesetzt. Für einen bis vier effektive Kandidaten lauten die Attempt-Checkpoints entsprechend `[d3]`, `[d0, d3]`, `[d0, d1, d3]` und `[d0, d1, d2, d3]`; der letzte Kandidat verwendet immer `d3`. Ein Nachfolger bleibt bis zu seinem eigenen Checkpoint zulässig. Die Zustände sind `provisional`, `committed` und `healthy`.
+
+Versuche laufen streng sequenziell. Akzeptierter `OPEN`- oder `DATA`-Fortschritt schreibt den gewählten Carrier sofort fest und schließt die Ersatzgrenze endgültig. Ein authentifiziertes `409` für eine festgeschriebene Kette wiederholt deren Metadaten und ist terminal; es erlaubt keinen weiteren Versuch. Das exakte Replay von `/session` wird nur verwendet, solange dessen Ergebnis mehrdeutig ist. Nach der authentifizierten Auswahl eines provisional Carriers fordert ein Transportfehler direkt den nächsten Versuch an; wurde der vorherige Probe doch committed, antwortet der Server terminal mit `409`, statt einen unsicheren Ersatz zuzulassen. Die endgültige absolute Server-Deadline begrenzt auch einen Nachfolger, dessen Response den Client nie erreicht hat. Dynamisches Umschalten nach dem Commit wird absichtlich nicht unterstützt; dafür ist eine neue Sitzung erforderlich.
+
+Jede HTTP-Operation der Bridge besitzt ein absolutes Budget `bridge_retry_secs` und höchstens neun Versuche. `bridge_request_secs` umfasst sowohl den Fetch-Response-Head als auch das vollständige Lesen des Response-Bodys; ein Downlink-Versuch erhält zusätzlich das konfigurierte Long-Poll-Intervall. Netzwerkfehler und Antworten mit `408`, `429`, `502`, `503` oder `504` verwenden begrenzten exponentiellen Backoff, während `Retry-After` das absolute Budget nicht verlängern kann. `carrier_probe_coalesce_ms = 0` sendet den ersten geordneten `OPEN`-Probe sofort. Ein Wert bis 10 ms kann passendes `DATA` aus diesem Fenster aufnehmen; multiplexierte Carrier bewahren die vollständige vorhergehende Frame-Reihenfolge, Lane-Carrier beanspruchen nur die ausgewählte Lane. Vor der Probe-Bestätigung startet kein HTTP-Downlink. Ein multiplexierter WebSocket-Upgrade kann unmittelbar nach seiner Auswahl durch `/session` beginnen und danach eingereihte Probe-Daten aufnehmen; ein Lane-WebSocket wartet auf die bekannte Stream-ID.
+
+Automatische WebSockets verwenden `tproxy-auto-v1.<session-token>` beziehungsweise `tproxy-auto-lane-v1.<session-token>.<stream-id>`. Die erste akzeptierte Binärnachricht mit echtem `OPEN`- oder `DATA`-Fortschritt schreibt den Carrier fest; danach schreibt der Server eine leere binäre Commit-Bestätigung auf genau diese Verbindung. Ping/Pong schreibt keinen Carrier fest und zählt nicht als Learning-Evidenz.
+
+Ein festgeschriebener Versuch wird erst healthy, wenn transportspezifische bidirektionale Evidenz für `carrier_health_secs` gültig bleibt. HTTPS erfordert akzeptiertes `DATA`, einen bestätigten nicht leeren Post-Commit-Downlink-Batch sowie authentifizierte Aktivität an oder nach der Health-Deadline. WebSocket erfordert die geschriebene exakte Commit-Bestätigung, danach akzeptiertes `OPEN` oder `DATA` desselben Owners und einen bis zum Ende des Intervalls lebenden Owner. Ein früheres Schließen ist neutral und erzeugt kein Lernergebnis.
+
+Das Lernen ist prozesslokal, speicherresident, ausschließlich positiv und durch `max_carrier_learning_entries` begrenzt. Es sortiert nur vom Client unterstützte konfigurierte Kandidaten, hält den konfigurierten Fallback stets zuletzt und bewahrt bei gleichen Scores die Konfigurationsreihenfolge. User-Agent- und Profilevidenz haben Primärgewicht; eine zulässige IP dient nur als Tie-Breaker. IP-Evidenz erfordert genau eine explizite, global routbare `X-Forwarded-For`-Adresse; private, Loopback-, Link-Local-, Carrier-Grade-NAT-, Dokumentations-, Multicast- und entsprechende IPv4-Mapped-Adressen sind ausgeschlossen. Vom Client gemeldete Fehlerkategorien und Request-Latenz sind ausschließlich diagnostisch und erzeugen weder negative noch Ranking-Evidenz. `conservative` erfordert 3 User-Agent-Ergebnisse oder 8 Profilergebnisse aus 4 Kohorten und deaktiviert IP-Evidenz; `balanced` verwendet 2, 6 aus 3 Kohorten und 3 zulässige IP-Ergebnisse; `aggressive` verwendet 1, 4 aus 2 Kohorten und 1 IP-Ergebnis. Deaktiviertes Lernen oder eine geänderte Richtlinie verwirft beim Reload inkompatible Evidenz, ohne laufende Sitzungen zu verändern.
+
 `https` bleibt der Default und behält das ursprüngliche serialisierte Verhalten bei. Bei `https-lanes` ist Lane null für Session-Steuerung reserviert, und jeder logische Stream ungleich null erhält eine eigene Lane. Jede Lane besitzt eigene Uplink-Sequenzen, Retry-Digests, Downlink-Cursor, nicht bestätigte Replay-Batches, Queues und einen Newest-Poll-Wins-Lebenszyklus. Ein langsamer Stream blockiert daher keinen anderen Stream auf der WEB-Protokollebene.

 Damit entfällt die Serialisierung zwischen WEB-Streams auf Anwendungsebene. Öffentliches HTTP/2 läuft weiterhin über eine oder mehrere TCP-Verbindungen, sodass Paketverlust Head-of-Line-Blocking auf Transportebene verursachen kann; `https-lanes` ist kein HTTP/3- oder QUIC-Carrier.

-Alle Lane-Queues bleiben innerhalb der vorhandenen Byte-/Item-Budgets pro Sitzung und Prozess. Die Bridge begrenzt jede Lane zusätzlich auf 8 MiB und 1024 eingereihte Elemente. Lane-Long-Polls dürfen höchstens die Hälfte von `web.limits.max_http_handlers` belegen, sodass Handler-Kapazität für Sitzungserstellung, Uplink, DELETE und andere Steuerarbeit verbleibt. `https-lanes` erfordert `max_http_handlers >= 2`.
+Alle Lane-Queues und residenten Response-Bodys bleiben innerhalb der vorhandenen Byte-/Item-Budgets pro Sitzung und Prozess. Telemt begrenzt jede Lane zusätzlich durch `pending_bytes_per_lane` und `pending_items_per_lane`; die erzeugte Bridge begrenzt ihre entsprechenden Queues auf 8 MiB und 1024 Elemente. Lane-Long-Polls dürfen höchstens die Hälfte von `web.limits.max_http_handlers` belegen, sodass Handler-Kapazität für Sitzungserstellung, Uplink, DELETE und andere Steuerarbeit verbleibt. `https` erfordert `max_http_handlers >= 2`, `https-lanes` erfordert `max_http_handlers >= 4`.

-Die Pfade `/api/v1/up` und `/api/v1/down` ändern sich nicht. Bei `https-lanes` enthält jeder Request an diese Pfade genau einen kanonischen dezimalen `X-Lane-ID`-Header. Die Uplink-Sequenz beginnt pro Lane unabhängig bei `1`, der Downlink-Cursor bei `0`. Lane null akzeptiert nur Session-`PONG`; jeder Frame einer Lane ungleich null muss dieselbe Stream-ID tragen, und eine neue Lane muss mit `OPEN` beginnen. Nachdem eingereihte und nicht bestätigte Downlink-Daten einer geschlossenen Lane vollständig abgearbeitet sind, antwortet Telemt leer mit `X-Lane-Closed: 1`, und die Bridge beendet deren Polling. Wiederholungen bleiben byte-identisch und spielen die ursprüngliche Bestätigung oder den Downlink-Batch erneut aus.
+Die Pfade `/api/v1/up` und `/api/v1/down` ändern sich nicht. Bei `https-lanes` enthält jeder Request an diese Pfade genau einen kanonischen dezimalen `X-Lane-ID`-Header. Die Uplink-Sequenz beginnt pro Lane unabhängig bei `1`, der Downlink-Cursor bei `0`. Lane null akzeptiert nur Session-`PONG`; jeder Frame einer Lane ungleich null muss dieselbe Stream-ID tragen, und eine neue Lane muss mit `OPEN` beginnen. Ein kanonischer Cursor-null-Downlink, der kurz vor dem `OPEN` seiner Lane eintrifft, wartet bis zu `lane_open_wait_secs`, ohne Lane-Zustand anzulegen; Grenzen pro Sitzung und prozessweite Hilfs-Permits begrenzen diese Wartefälle. Nach Ablauf folgt eine leere `204`-Response, während eine fehlende Lane mit fortgeschrittenem Cursor weiterhin als Protokollfehler über den Decoy-Pfad behandelt wird. Nachdem eingereihte und nicht bestätigte Downlink-Daten einer geschlossenen Lane vollständig abgearbeitet sind, antwortet Telemt leer mit `X-Lane-Closed: 1`, und die Bridge beendet deren Polling. Wiederholungen bleiben byte-identisch und spielen die ursprüngliche Bestätigung oder den Downlink-Batch erneut aus.

 Beide WebSocket-Carrier erstellen und löschen die übergeordnete Sitzung weiterhin über HTTPS und verwenden danach einen strikten Upgrade-Request ohne Body an `GET /api/v1/ws`. `websocket` übermittelt in `Sec-WebSocket-Protocol` exakt `tproxy-v1.<session-token>`; binäre Messages sind geordnete Carrier-Batches, und ein Protokoll-, Deadline- oder Verbindungsfehler schließt die gesamte übergeordnete Sitzung. `websocket-lanes` übermittelt exakt `tproxy-lane-v1.<session-token>.<stream-id>`, wobei die Stream-ID kanonisch dezimal im Bereich `1..=16777215` steht. Die erste binäre Message muss mit `OPEN` beginnen, alle Frames müssen diese Stream-ID verwenden und ein Fehler nach dem Upgrade schließt nur diese Lane. Es gibt keinen Lane-null-WebSocket: HTTPS transportiert `HELLO` und `WELCOME`, während RFC-6455-Ping/Pong die Verbindungsliveness gewährleistet.

-WebSocket-Codec-Puffer und laufende Read-/Write-Messages teilen das prozesseigene Budget `pending_bytes_global` mit den Carrier-Queues und sind zusätzlich durch `websocket_bytes_global` begrenzt. Admission reserviert `websocket_http_connection_reserve` angenommene Verbindungen für gewöhnliches HTTP und Decoys. Unter Druck erfolgt die Verdrängung zuerst beim selben Owner und danach nach dem ältesten Fortschritt; Pre-Upgrade- und tote Verbindungen stehen vor aktiven Lanes und multiplexierten Sitzungen. Nach `long_poll_secs` ohne Peer-Aktivität wird auch bei kontinuierlichem Downlink-Verkehr ein Transport-Ping gesendet; fehlende Peer-Aktivität während des doppelten, beim Verbindungsaufbau festgelegten Intervalls macht die Verbindung zum Cleanup-Kandidaten.
+Vor HTTP `101` wird eine WebSocket-Lane-Reservierung an die exakte Prozessverbindung und Lane-Inkarnation gebunden; ein akzeptiertes `OPEN` überträgt die Ownership auf die exakte Stream-Inkarnation, bevor deren Backend-Task laufen kann. Ein verspäteter Poll, Close oder Reservierungs-Drop eines älteren Sockets kann einen Ersatz mit derselben numerischen Lane-ID weder bestätigen noch schließen oder freigeben.
+
+WebSocket-Codec-Puffer und laufende Read-/Write-Messages teilen das prozesseigene Budget `pending_bytes_global` mit den Carrier-Queues und sind zusätzlich durch `websocket_bytes_global` begrenzt. Admission reserviert `websocket_http_connection_reserve` angenommene Verbindungen für gewöhnliches HTTP und Decoys. Bei einem Admission-Ersatz werden zuerst global tote aktive Verbindungen ausgewählt; danach gelten die Lokalitätsstufen gleiche Sitzung, gleicher Profil-Owner und gleiche Client-IP. Ein davon unabhängiges gesundes Opfer ist nur zulässig, wenn der Anforderer unter seinem fairen Byte-Anteil und der Owner des Opfers darüber liegt. Innerhalb einer Lokalitätsstufe stehen beanspruchte oder auf WebSocket hochgestufte Verbindungen vor aktiven Lanes und diese vor aktiven multiplexierten Sitzungen; letzter Fortschritt, Erstellungsreihenfolge und Verbindungs-ID lösen Gleichstände deterministisch auf. Das Cleanup bei Speicherdruck verwendet dieselbe Dead-first- und Lebenszyklusreihenfolge und bevorzugt Owner über ihrem fairen Anteil, setzt die Verdrängung aber auch fort, wenn alle Owner ihren Anteil einhalten. `max_websocket_evictions_in_flight` begrenzt gleichzeitige exakte Verdrängungs-Claims. Upgrade-, Erstnachrichten-, Write-, Backpressure- und Eviction-Deadlines stammen unveränderlich aus der Parent-Sitzung. Nach `long_poll_secs` ohne Peer-Aktivität wird auch bei kontinuierlichem Downlink-Verkehr ein Transport-Ping gesendet; fehlende Peer-Aktivität während des doppelten, beim Verbindungsaufbau festgelegten Intervalls macht eine aktive Verbindung zum Cleanup-Kandidaten.

 Jeder Authentifizierungs-, Shape-, Lane-Reservierungs- oder Kapazitätsfehler vor dem Upgrade folgt dem bereinigten Decoy-Pfad und legt keinen WebSocket-spezifischen Status offen. Das exakte Subprotokoll enthält den Session-Bearer und darf nicht protokolliert werden.

@@ -198,22 +235,29 @@ Im Frontend oder im Abschnitt `defaults` muss für das standardmäßige WebSocke
 | --- | --- |
 | Bestand der WEB-Listener, Bind-Adresse und Vertrauensrichtlinie | Prozesseigen; Telemt neu starten. |
 | Jeder Wert in `[web.limits]` | Prozesseigener Speicher- und Ressourcenvertrag; Telemt neu starten. |
-| `web.enabled`, `web.carrier`, `web.debug`, Timeouts, vhosts, Profile und Decoys | Werden vom Config-Watcher oder durch einen Runtime-Generations-Reload angewendet. |
-| Bestehende HTTP-Verbindungen und WEB-Sitzungen | Behalten Carrier, Grenzen und Session-Deadlines ihres Erstellungszeitpunkts; neu ausgegebene Bridge-Sitzungen verwenden den aktiven Carrier. WebSocket-Write-, Backpressure- und Eviction-Vorgänge lesen die aktiven hot-reload-fähigen Deadlines. Neue logische Streams verwenden die aktive Relay-Generation. |
-| Beenden des Prozesses | Verwendet den zuletzt geladenen Wert von `web.timeouts.shutdown_secs`. |
+| `web.enabled`, Carrier-/Negotiation-Richtlinie, `web.debug`, Timeouts, vhosts, Profile und Decoys | Werden vom Config-Watcher oder durch einen Runtime-Generations-Reload angewendet. |
+| Bestehende HTTP-Verbindungen und WEB-Sitzungen | Behalten HTTP-Idle-Grenze, Carrier-Kandidaten, Grenzen, Body-Timeout, Lebensdauer des Replay-Markers geschlossener Token sowie absolute Session-/Negotiation-Deadlines ihres Erstellungszeitpunkts; jede ausgegebene Bridge enthält ihre Request-, Retry- und Probe-Coalescing-Werte. WebSocket-Upgrade-, Open-, Write-, Backpressure- und Eviction-Vorgänge verwenden die unveränderlichen Deadlines der Parent-Sitzung. Neue Bridges verwenden die aktive Richtlinie, neue logische Streams die aktive Relay-Generation. |
+| Beenden des Prozesses | Erfasst den zuletzt geladenen Wert von `web.timeouts.shutdown_secs` einmalig und verwendet dieselbe absolute Deadline für Listener-Acceptoren und Verbindungen sowie WEB-Sitzungen und Hilfstasks. Aufeinanderfolgende Komponenten erhalten keine separaten vollständigen Budgets. |

 Jeder logische Stream behält die Client-IP seiner Sitzung und besitzt während der gesamten Relay-Lebensdauer einen prozessweit eindeutigen, von null verschiedenen synthetischen Quellport. Damit bleibt für Direct- und Middle-End-KDF-Routing ein stabiles, kollisionsfreies Quell-/Ziel-Tupel erhalten.

+Die HTTP-Idle-Erfassung schützt nur explizit begrenzte Request-Body-, Long-Poll-, Decoy-Verbindungs-/Response-Head- und ausstehende Upgrade-Phasen. Die eigene Deadline der Operation bleibt exakt; besteht ihre Lease in diesem Moment noch, gewährt der Verbindungs-Watchdog dem eingeplanten Task höchstens ein Connection-Idle-Intervall zur Veröffentlichung seines Timeouts/Ergebnisses, bevor er die Verbindung erzwingend schließt. Zwischen Austauschvorgängen und nach Bereitstellung eines Response-Heads setzt Fortschritt den Idle-Timer zurück, während ein blockierter Response-Body weiterhin durch den Idle-Timeout begrenzt bleibt. Der Abschluss einer älteren Phase kann den Deadline-Schutz einer neueren Phase nicht freigeben.
+
+Ein `OPEN` reserviert die begrenzte Eigentümerschaft für logischen Stream und Tupel, verbraucht jedoch noch kein `max_connections`-Permit der Relay-Generation. Telemt erwirbt dieses Permit erst nach dem ersten inneren Byte; die unveränderliche First-Byte-Deadline und Stream-Grenzen begrenzen stille Opens, und erschöpfte Kapazität schließt anschließend nur den betroffenen Stream.
+
 ## Verwaltung über die API

-API-Verwaltung ist verfügbar, aber absichtlich eingeschränkt. Es gibt keine veränderbare Ressource `/v1/web`; der API-Listener stellt die schreibgeschützte HTML-Debug-Ansicht unter `/web-status` bereit.
+WEB-Konfiguration, Runtime-Status und begrenzte Runtime-Steuerung verwenden denselben authentifizierten API-Listener. `/web-status` bleibt eine schreibgeschützte HTML-Diagnose; zustandsverändernde Operationen existieren ausschließlich unter `/v1/runtime/web`.

 | Operation | API-Unterstützung |
 | --- | --- |
-| `[web]`, vhosts, Profile, Decoys, Timeouts oder Limits lesen oder ändern | Nein. `GET /v1/config` lässt `[web]` aus; `PATCH /v1/config` antwortet für `web` mit `400 section_not_editable`. |
+| `[web]`, vhosts, Profile, Decoys, Timeouts oder Limits lesen oder ändern | Ja, über `GET` oder `PATCH /v1/config`. Der abgeleitete Snapshot `web.runtime` wird weder ausgegeben noch kann er geschrieben werden. Verschachtelte Tabellen werden feldweise zusammengeführt; Arrays ersetzen das bisherige Array vollständig. Jede Änderung an `[web.limits]` wird als gewünschte Konfiguration angenommen, aber bis zum Prozessneustart als zurückgestellt gemeldet. |
 | `server.listeners` speichern | Ja, über `PATCH /v1/config`; ein geänderter WEB-Listener bleibt jedoch bis zum Prozessneustart zurückgestellt. |
 | Außerhalb der API geänderte WEB-Konfiguration anwenden | Ja, über `POST /v1/system/reload` und anschließende Abfrage des Vorgangsstatus. |
 | Begrenzte serverseitige WEB-Request- und Lifecycle-Details untersuchen | Ja, über ein authentifiziertes `GET /web-status`. |
+| Lifecycle, Kapazitätsebenen, Learning-/Debug-Zustand und aktive Sitzungen untersuchen | Ja, über `GET /v1/runtime/web/status` und `/v1/runtime/web/sessions`. |
+| Ausgewählte aktive WEB-Sitzungen schließen | Ja, über die asynchrone Operation `POST /v1/runtime/web/sessions/close`. |
+| Debug-Datensätze löschen oder Carrier-Learning zurücksetzen | Ja, über die entsprechenden Runtime-POST-Endpunkte. |
 | `[access.users]` verwalten | Ja, über `/v1/users`. Das Erstellen eines Benutzers erzeugt kein WEB-Profil. |
 | Einen Benutzer widerrufen | Ja. `/v1/users/{username}/disable` aktualisiert die Admission sofort und beendet die aktiven Sitzungen dieses Benutzers. |

@@ -230,6 +274,20 @@ read_only = false

 Die API-Whitelist prüft den direkten TCP-Peer und vertraut `X-Forwarded-For` nicht. Änderungen an `[server.api]` selbst erfordern einen Prozessneustart.

+### Runtime-Status und Steuerung
+
+`GET /v1/runtime/web/status` liefert immer den veröffentlichten Lifecycle (`starting`, `no_web_listener`, `running`, `draining`, `drained` oder `deadline_exceeded`), dessen Epoche und Alter, die effektiven Listener-Adressen und die Verfügbarkeit. Solange die prozesseigene WEB-Runtime lebt, ergänzt `runtime` die zufällige 128-Bit-`runtime_instance`, die aktive Generation, unveränderliche Limits, ebenenlokale Kapazitätszähler, Carrier-Learning-/Debug-Epochen und Summen. Die Statuserfassung liest jede Ebene nicht blockierend: Eine umkämpfte Ebene wird ausgelassen und in `partial` benannt; der Endpunkt wartet nie auf die Datenebene, bereinigt sie nicht und verändert sie nicht.
+
+`GET /v1/runtime/web/sessions` liefert standardmäßig höchstens 50 und bei gesetztem `limit` höchstens 200 Sitzungen. Der geordnete Scan ist auf 1000 Kandidaten begrenzt. `cursor` und `session_ref` verwenden die undurchsichtige kanonische Form `ws1.<runtime-instance>.<lowercase-hex-id>`; ein exakter `session_ref` darf nicht mit `cursor` oder `limit` kombiniert werden. Filter sind `ip`, `host`, `user`, `user_agent_id`, `key_id`, `carrier` und `state`; doppelte oder unbekannte Query-Felder werden abgelehnt. Der Detailpfad lautet `GET /v1/runtime/web/sessions/{session_ref}`. Ein gespeicherter Tombstone einer geschlossenen Sitzung ergibt `410`; ein umkämpfter exakter Snapshot ergibt `503 web_snapshot_busy`. Antworten enthalten nur begrenzte, nicht geheime Metadaten und niemals Bootstrap-/Session-Bearer, Capabilities, Secret-Hashes oder synthetische KDF-Ports.
+
+Jeder Runtime-POST verlangt exakt `Content-Type: application/json`, lehnt unbekannte JSON-Felder ab, beachtet API-Authentifizierung, Whitelist und `read_only` und enthält die aktuelle `runtime_instance` als ABA-Sperre. Verfügbare Steuerungen:
+
+- `POST /v1/runtime/web/sessions/close` mit genau einem Selektor: `{"kind":"refs","session_refs":[...]}`, `{"kind":"filter",...}` oder `{"kind":"all"}`. Exakte Referenzen sind auf 200 begrenzt, ein Filter darf nicht leer sein, nur eine Close-Operation darf laufen, und `all` wird abgelehnt, solange die effektive Ausgabe aktiviert ist. Die `202`-Antwort liefert `operation_id`; fragen Sie `GET /v1/runtime/web/operations/{operation_id}` ab. Die Operation scannt in Blöcken von 128 nur Sitzungen bis einschließlich ihres beim Start fixierten High-Water-Marks.
+- `POST /v1/runtime/web/debug/clear` mit `{"runtime_instance":"..."}`. Die Antwort meldet gelöschte Datensätze, weiterhin von bereits gerenderten Snapshots gehaltene Bytes und die neue Epoche. Laufende Writer der alten Epoche können den Ring nicht erneut füllen.
+- `POST /v1/runtime/web/carrier-learning/reset` mit derselben Body-Form. Der Endpunkt löscht gespeicherte prozesslokale Evidenz und erhöht die Learning-Epoche; bereits fixierte Versuchsketten und aktive Sitzungen bleiben unverändert.
+
+Für ein deterministisches Close-all patchen Sie `{"web":{"enabled":false}}` mit aktiviertem Runtime-Reload, warten auf `runtime.manager.issuance_enabled = false`, senden den Selektor `all` mit derselben `runtime_instance` und fragen die Operation bis zu einem Endzustand ab. Das Deaktivieren von WEB stoppt neue Bootstrap-/Session-Ausgabe, schließt bestehende Sitzungen aber niemals implizit.
+
 ### Serverseitige WEB-Debug-Ansicht

 Aktivieren Sie die begrenzte Erfassung in der zuständigen Konfigurationsdatei:
@@ -248,7 +306,7 @@ default_window_secs = 180
 max_window_secs = 3600
 ```

-Öffnen Sie `http://127.0.0.1:9091/web-status` mit derselben Whitelist direkter Peers und demselben exakten `Authorization`-Header wie für die API. Ein abschließender Slash wird akzeptiert. Nur `GET` ist zulässig. Die Seite unterstützt die Filter `window_secs`, kanonische `ip`, numerische `session`, `user_agent` ohne Beachtung der Groß-/Kleinschreibung und `key`. Wiederholen Sie `group_by=ip`, `group_by=session`, `group_by=user_agent` oder `group_by=key`, um gruppierte Zusammenfassungen zu erstellen; `limit` ist auf `1..=1000` beschränkt. HTTP-Zeilen lassen sich vom Request bis zur Response zu Methode, Pfad, bereinigten Headern, Body-Metadaten oder -Bytes, Zeitpunkten, Frames und typisierten Lifecycle-Ereignissen aufklappen. Für WebSocket kommen der bereinigte Handshake `GET` → `101` sowie begrenzte Angaben pro Message zu Richtung, Message-Typ, Payload-/Body-Erfassung, Verarbeitungszeit, Verbindungs-/Lane-ID und geparsten inneren Frames hinzu. Rohe Subprotokolle und Session-Tokens werden nie gespeichert.
+Öffnen Sie `http://127.0.0.1:9091/web-status` mit derselben Whitelist direkter Peers und demselben exakten `Authorization`-Header wie für die API. Ein abschließender Slash wird akzeptiert. Nur `GET` ist zulässig. Die Seite unterstützt die Filter `window_secs`, kanonische `ip`, numerische `session`, `user_agent` ohne Beachtung der Groß-/Kleinschreibung und `key`. Wiederholen Sie `group_by=ip`, `group_by=session`, `group_by=user_agent` oder `group_by=key`, um gruppierte Zusammenfassungen zu erstellen; `limit` ist auf `1..=1000` beschränkt. HTTP-Zeilen lassen sich vom Request bis zur Response zu Methode, Pfad, bereinigten Headern, Body-Metadaten oder -Bytes, Zeitpunkten, Frames und typisierten Lifecycle-Ereignissen einschließlich Carrier-Versuch, Commit, Healthy und gemeldetem Fehler aufklappen. Für WebSocket kommen der bereinigte Handshake `GET` → `101` sowie begrenzte Angaben pro Message zu Richtung, Message-Typ, Payload-/Body-Erfassung, Verarbeitungszeit, Verbindungs-/Lane-ID und geparsten inneren Frames hinzu. Rohe Subprotokolle und Session-Tokens werden nie gespeichert.

 Der prozesseigene Ring übersteht den Austausch einer Runtime-Generation. Änderungen der Erfassungs-Policy löschen inkompatible gespeicherte Datensätze; reine Änderungen des Beobachtungsfensters tun dies nicht. Der Ring ist standardmäßig auf 65536 Datensätze und 64 MiB gespeicherte plus in Verarbeitung befindliche Daten begrenzt, die HTML-Response auf 8 MiB und die Gruppierung auf 1024 Gruppen; gleichzeitig dürfen höchstens zwei Response-Bodys Seiten-Permits halten. Ändern Sie `web.limits.debug_records_capacity` oder `web.limits.debug_bytes_global` nur zusammen mit einem Prozessneustart. Ein hot-reload-fähiger Präfix, der nur in eine gleichzeitig erhöhte neustartpflichtige Kapazität passt, wird bis zu diesem Neustart zurückgestellt.

@@ -267,7 +325,7 @@ curl -sS http://127.0.0.1:9091/v1/system/reload/RELOAD_ID \
  -H "Authorization: ${TELEMT_API_AUTH}"
 ```

-Der terminale Status `succeeded` bestätigt die Runtime-Aktivierung. Ein geänderter `web.carrier` wird von neu ausgegebenen Bridge-Sitzungen verwendet; bestehende Sitzungen werden nicht migriert. Enthält `deferred_process_fields` den Wert `server.listeners` oder `web.limits`, ist die Datei gültig und gespeichert, diese Einstellungen erfordern aber weiterhin einen Telemt-Neustart.
+Der terminale Status `succeeded` bestätigt die Runtime-Aktivierung. Geänderte Carrier-, Kandidaten-, Deadline- oder Learning-Richtlinien werden von neu ausgegebenen Bridge-Sitzungen verwendet; bestehende Sitzungen und laufende Versuchsketten werden nicht migriert. Enthält `deferred_process_fields` den Wert `server.listeners` oder `web.limits`, ist die Datei gültig und gespeichert, diese Einstellungen erfordern aber weiterhin einen Telemt-Neustart.

 Operationen für Access-Benutzer verwenden die vorhandenen Endpunkte, zum Beispiel:

@@ -291,7 +349,7 @@ Der vollständige Vertrag für Requests, Revisionen, Fehler und alle Benutzer-En
 - Deaktivieren Sie am TLS-Terminator die Protokollierung von Request-Target und Authorization oder verwenden Sie ein geprüftes, redigiertes Format. Raw Queries enthalten Bridge-Capabilities und `Authorization` enthält Bootstrap- oder Session-Bearer-Zugangsdaten.
 - Verwenden Sie pro vhost eine stabile öffentliche Adresse. Wenn DNS mehrere Ingress-Adressen liefert, muss jede Bereitstellung die Adresse ihres externen Pfads verwenden.
 - Bootstrap- und Session-Register sind prozesslokal. Ein Multi-Prozess- oder Multi-Host-Upstream-Pool benötigt Affinität für den vollständigen vhost: Bridge-GET, Sitzungserstellung, Uplink, Downlink und DELETE. Ein einzelner Telemt-Prozess benötigt keine zusätzliche Affinität.
- Ein ungenutzter Bootstrap übersteht einen Konfigurations-Reload nur, wenn die exakte Profilidentität aktiv bleibt: Host, `public_addr`, Benutzer, Secret-Modus, Carrier und Capability. Bereits erstellte Sitzungen behalten ihren unveränderlichen Carrier und ihre Profilidentität und bleiben lifecycle-bounded.
+- Ein ungenutzter Bootstrap übersteht einen Konfigurations-Reload nur, wenn die exakte Profilidentität aktiv bleibt: Host, `public_addr`, Benutzer, Secret-Modus, Carrier-Kandidaten, Negotiation-Deadlines und Capability. Bereits erstellte Sitzungen behalten ihren unveränderlichen Carrier und ihre Profilidentität und bleiben lifecycle-bounded.
 - Der Decoy gehört zum Anti-Probing-Vertrag. Prüfen Sie sein gewöhnliches 404-Verhalten und die Antwortzeiten über den öffentlichen TLS-Endpunkt, bevor Sie Links verteilen.

 ## Erstprüfung
@@ -304,6 +362,7 @@ Der vollständige Vertrag für Requests, Revisionen, Fehler und alle Benutzer-En
 6. Bestätigen Sie für `websocket` eine `101`-Response, binären Relay-Datenverkehr und RFC-6455-Ping/Pong nach 25 Sekunden. Testen Sie für `websocket-lanes` mindestens zwei gleichzeitige Stream-Sockets und prüfen Sie, dass das Schließen oder Beschädigen einer Lane weder Geschwister noch die übergeordnete Sitzung schließt.
 7. Testen Sie einen Reconnect und mindestens einen Long Poll über 25 Sekunden, um sicherzustellen, dass Frontend-Timeouts den Carrier nicht abbrechen.
 8. Prüfen Sie Benutzer- und logische MTProxy-Verbindungslimits anhand der Logical-Stream-Zähler und nicht anhand der Zahl der HTTP-Verbindungen.
+9. Prüfen Sie bei aktivierter Auto-Negotiation die konfigurierte Reihenfolge, das Replay exakt desselben Versuchs nach einer absichtlich verlorenen Response, das terminale Verhalten nach dem Commit sowie die Lifecycle-Zeilen `carrier_committed` und `carrier_healthy` in `/web-status`. Prüfen Sie, dass ein nativer Client ohne Metadaten den festen `carrier` ohne automatische Response-Header verwendet und explizite Capabilities unverändert bleiben.

 ## Fehlerbehebung

@@ -311,6 +370,8 @@ Der vollständige Vertrag für Requests, Revisionen, Fehler und alle Benutzer-En
 | --- | --- |
 | WEB-Konfiguration ist auf dem Datenträger gültig, aber das Listener-Verhalten hat sich nicht geändert | Prüfen Sie `deferred_process_fields`; Listener- und `[web.limits]`-Änderungen erfordern einen Neustart. |
 | Carrier-Requests erreichen den Decoy | Prüfen Sie den exakten vhost, den Secret-Modus des Links, das CIDR des direkten Proxys und genau einen syntaktisch gültigen `X-Forwarded-For`-Wert. |
+| Ein konkurrierender `https-lanes`-Downlink erreicht den Decoy mit `404` | Prüfen Sie, dass er mit `X-Down-Cursor: 0` beginnt, bewahren Sie `X-Lane-ID` und setzen Sie `lane_open_wait_secs` über den beobachteten Abstand zwischen Downlink und `OPEN`. Fortgeschrittene Cursor fehlender Lanes schlagen absichtlich fail-closed fehl. |
+| Auto-Negotiation wechselt weiter, nachdem Daten bereits akzeptiert wurden | Das ist ungültig. Prüfen Sie das authentifizierte `X-Carrier-State`-Replay und das Carrier-Commit-Lifecycle-Ereignis; `committed` oder `healthy` ist terminal und erfordert eine neue Sitzung. |
 | Long Polls werden nach einem festen Intervall getrennt | Setzen Sie Client-, Server-, Sende- und Lese-Timeouts von NGINX/HAProxy über `web.timeouts.long_poll_secs`. |
 | WebSocket-Upgrade erreicht statt `101` den Decoy | Bewahren Sie HTTP/1.1 `Connection: Upgrade`, `Upgrade: websocket`, das einzelne exakte `Sec-WebSocket-Protocol` und den kanonischen bodylosen Request `/api/v1/ws`. Prüfen Sie außerdem Carrier-/Session-Kompatibilität und die Prozess-Verbindungsreserve. |
 | Ein `websocket-lanes`-Stream wurde geschlossen, Geschwister bleiben aber verbunden | Dies ist die beabsichtigte Fehlergrenze. Prüfen Sie die Message-/Frame-Zeilen dieser Lane in `/web-status`; fehlerhafte oder lane-fremde Frames, Write-Timeouts und Backend-Close schließen nur die betroffene Lane. |
@@ -28,7 +28,9 @@ Route the complete public vhost to Telemt. Splitting only recognized carrier pat

 - The public endpoint is always `https://HOST:443`.
 - `plain` and `dd` 16-byte MTProxy secrets are supported. `ee` FakeTLS secrets are not supported by WEB mode.
- `web.carrier = "https"` selects serialized HTTPS uplink and long polling. `https-lanes` selects independent HTTPS sequencing and polling per logical stream. `websocket` selects one ordered WebSocket for all streams. `websocket-lanes` selects one independently owned WebSocket per non-zero logical stream.
+- `web.carrier` selects the sole carrier when auto-negotiation is disabled and the final fallback when it is enabled. `https` uses serialized HTTPS uplink and long polling. `https-lanes` uses independent HTTPS sequencing and polling per logical stream. `websocket` uses one ordered WebSocket for all streams. `websocket-lanes` uses one independently owned WebSocket per non-zero logical stream.
+- Missing `web.carriers` or `web.carriers = false` disables auto-negotiation and learning. A non-empty array enables startup-only sequential negotiation; it never migrates an already committed session.
+- Native clients without canonical carrier-negotiation headers use the configured fixed `carrier`, even when `carriers` enables negotiation for capable clients. Current Telegram iOS supports only `https`, so an operator serving metadata-free iOS clients must set `web.carrier = "https"`; it does not support `https-lanes`. User-Agent values, including CFNetwork or Darwin, never infer capabilities. When a native iOS request does send explicit negotiation metadata, Telemt intersects it with the server-authoritative `{https}` ceiling and rejects an empty result; other explicit clients use their advertised capability set.
 - Capability, bootstrap, and session credentials are separate bounded-lifetime values. Carrier credentials must be treated as secrets and must not appear in access logs.
 - A bootstrap is a bearer credential, not a source-address-bound token. The client address and IP family may change between bridge loading and session creation. The issuing address retains unused-bootstrap accounting, while the address on the first valid creation request owns the session.
 - Inner MTProxy authentication is restricted to the user and secret mode selected by the vhost profile. Invalid inner handshakes close only their logical stream and never enter the TCP masking path.
@@ -74,6 +76,8 @@ web_trusted_proxy_cidrs = ["127.0.0.1/32"]
 [web]
 enabled = true
 carrier = "https-lanes"
+decoy_fasttrack_mode = "off"
+http_connection_capacity_action = "drop"

 [[web.vhosts]]
 host = "proxy.example.com"
@@ -91,23 +95,71 @@ max_streams = 512
 max_streams_per_session = 64
 ```

+Accepted-socket overload handling is independently configurable. `drop` preserves the legacy close after `accept(2)`. `respond` writes an empty retryable `503` without parsing a request. `wait` waits outside the accept loop for ordinary connection capacity and then enters normal HTTP handling; timeout writes the same `503`. Both waiting and response writing use `web.timeouts.http_overload_timeout_ms` per phase. `web.limits.max_http_overload_connections` bounds sockets outside ordinary capacity and requires a process restart when changed; the action and timeout are hot-reloadable.
+
+`decoy_fasttrack_mode` controls only capability work for `GET/HEAD /`. `off` is the default and preserves the legacy full scan without fast-track counters. `shadow` records which structurally impossible requests could bypass the scan but still performs the complete legacy scan. `enforce` bypasses capability work only for `HEAD` or an absent/noncanonical `bridge` query. Every exact canonical `GET /?bridge=<43-character-base64url>` performs a complete scan across all profiles of the selected vhost, for both matches and misses. The setting requires a process restart; reload persists the desired value but reports `web.decoy_fasttrack_mode` as deferred. Fast-track does not protect against adversarial CPU load because a scanner can always submit canonical candidates, and enforce mode may expose a public request-shape timing class, especially with a static decoy. Do not enable enforce without external timing measurements through the production TLS terminator.
+
+## Server-side carrier negotiation
+
+Auto-negotiation is optional and disabled unless `carriers` is an explicit non-empty array. The configured `carrier` remains the final fallback and is appended exactly once, even when it also appears in the array:
+
+```toml
+[web]
+enabled = true
+carrier = "https"
+carriers = ["websocket-lanes", "websocket", "https-lanes"]
+carrier_learning = true
+carrier_negotiation_aggressiveness = "conservative"
+
+[web.timeouts]
+carrier_negotiation_deadlines_secs = [3, 5, 8, 12]
+carrier_health_secs = 30
+carrier_learning_secs = 600
+bridge_request_secs = 10
+bridge_retry_secs = 90
+bridge_recovery_secs = 15
+carrier_probe_coalesce_ms = 0
+```
+
+The generated bridge sends canonical `X-Carrier-Capabilities`, `X-Carrier-Attempt`, and, after the first attempt, `X-Carrier-Failure` headers on `/session`. Every successful automatic response returns `X-Carrier-Mode`, `X-Carrier-Attempt`, `X-Carrier-Candidate-Count`, `X-Carrier-Deadline`, and `X-Carrier-State`. The bridge starts its local cumulative clock immediately before the first `/session` request; the server freezes its separate absolute chain deadline when it accepts the first automatic attempt. Both use the configured offsets, and neither resets across replacement attempts. For one through four effective candidates, the attempt checkpoints are respectively `[d3]`, `[d0, d3]`, `[d0, d1, d3]`, and `[d0, d1, d2, d3]`; the final candidate always owns `d3`. A successor remains admissible until its own checkpoint. The states are `provisional`, `committed`, and `healthy`.
+
+The bridge emits additive v1 status objects with `state`, `phase`, `reason`, and `deadline_ms`. `phase=provisional` follows the authenticated `WELCOME`; `state=connected,phase=committed` is emitted only after the selected transport acknowledges real `OPEN` or `DATA` progress. The initialization port has its own `bridge_request_secs` pre-`HELLO` deadline, and page navigation is terminal for that document instance. A later initialization message cannot resurrect a closed or BFCache-retained bridge.
+
+Attempts are strictly sequential. Accepted `OPEN` or `DATA` progress commits the chosen carrier immediately and permanently closes the pre-commit replacement boundary. A `409` for an authenticated committed chain echoes the committed metadata and is terminal; it is not permission to advance. Exact `/session` replay is used only while that response is ambiguous. Once an authenticated response has selected a provisional carrier, a transport failure requests the next attempt directly; if the previous probe actually committed, the server answers with the terminal `409` instead of permitting an unsafe replacement. The server's final absolute deadline also bounds a successor response that the client never received. Post-commit in-place carrier switching remains unsupported; a surviving bridge recovers by creating a fresh server session.
+
+After commit, an HTTP failure first replays the exact frozen request against the current bearer. A successful replay keeps the current session. WebSocket loss, or a foreground/online/native event after at least `reconnect_grace_secs` of scheduler gap, starts one recovery epoch. The bridge performs exactly one `GET /?bridge=<capability>` with `Accept: application/vnd.telemt.web-recovery+json` and optional current bearer authorization. A positive response is an uncacheable JSON document of at most 1024 bytes containing a fresh bootstrap plus current limits, timeouts, and negotiation policy. Telemt issues that bootstrap before synchronously retiring a matching current session, so recreation remains possible with a one-session capacity. Unknown or already retired bearer authorization receives the same positive representation; malformed recovery headers, disabled admission, pause, drain, and capacity rejection follow the sanitized decoy path.
+
+The recovery epoch has one dual wall/monotonic absolute `bridge_recovery_secs` deadline, a single recovery-document request, and bounded carrier retries with 250 ms through 2 s backoff. Recovery status is repeated at most every 2.5 seconds while active. A fresh incarnation aborts and releases old requests, sockets, lanes, and queues, sends one synthetic `CLOSE` for each still-active native stream, suppresses a second `WELCOME`, and commits only after real carrier progress. Retired stream IDs are retained in a bounded set so valid late frames cannot enter a new stream; the native side must allocate a new stream ID. Frequent native reconnect attempts are valid, but they neither extend the recovery epoch nor retain old incarnation state. Destroying the WebView destroys this recovery owner; a native supervisor must then create a new bridge document.
+
+Each ordinary bridge carrier HTTP operation has an absolute `bridge_retry_secs` budget and at most nine attempts. `bridge_request_secs` covers both the Fetch response head and complete response body; a downlink attempt additionally receives the configured long-poll interval. Network failures and `408`, `429`, `502`, `503`, or `504` responses use bounded exponential backoff, while `Retry-After` cannot extend the absolute budget. `carrier_probe_coalesce_ms = 0` sends the first ordered `OPEN` probe immediately. A value up to 10 ms may include matching `DATA` that arrives in that window; multiplexed carriers preserve the complete preceding frame order, while lane carriers claim only the selected lane. No HTTP downlink starts before the probe acknowledgement. Multiplexed WebSocket Upgrade may begin as soon as `/session` selects it and then absorbs queued probe data; a lane WebSocket waits until its stream ID is known.
+
+Response bodies are streamed into explicit endpoint bounds: `/session` is exactly eight bytes, a successful `/down` is at most `carrier_batch_bytes`, and bodyless responses accept zero bytes. Declared overflow is rejected before reading, streamed overflow or excessive chunk count cancels the reader, and retryable response bodies are canceled before backoff. Terminal bridge cleanup sends at most one authenticated `DELETE`; canonical transport failures are copied to `X-Carrier-Failure` for diagnostics, while navigation and explicit close remain non-learning reasons.
+
+Automatic WebSockets use `tproxy-auto-v1.<session-token>` or `tproxy-auto-lane-v1.<session-token>.<stream-id>`. The first accepted binary message containing real `OPEN` or `DATA` progress commits the carrier; the server then writes an empty binary commit acknowledgement to that exact connection. Ping/Pong does not commit a carrier and does not count as learning evidence.
+
+A committed attempt becomes healthy only after transport-specific bidirectional evidence remains valid for `carrier_health_secs`. HTTPS requires accepted `DATA`, an acknowledged non-empty post-commit downlink batch, and authenticated activity at or after the health deadline. WebSocket requires the exact commit acknowledgement to be written, subsequent accepted `OPEN` or `DATA` from the same owner, and that owner to remain live through the interval. Health publication, owner eviction, and close have one terminal winner. Closing earlier remains neutral for ranking evidence but is visible as the diagnostic `closed_before_health` outcome.
+
+Learning is process-local, in-memory, positive-only, and bounded by `max_carrier_learning_entries`. It ranks only client-supported configured candidates, keeps the configured fallback last, and uses configured order for equal scores. User-Agent and profile evidence have primary weight; an eligible IP is only a tie-breaker. IP evidence requires exactly one explicit, globally routable `X-Forwarded-For` address; private, loopback, link-local, carrier-grade NAT, documentation, multicast, and IPv4-mapped equivalents are excluded. Client-reported failure categories and request latency are diagnostics, not negative or ranking evidence. `conservative` requires 3 User-Agent outcomes or 8 profile outcomes across 4 cohorts and disables IP evidence; `balanced` uses 2, 6 across 3, and 3 eligible-IP outcomes; `aggressive` uses 1, 4 across 2, and 1 eligible-IP outcome. A generation change with identical learning semantics preserves evidence and atomically republishes its generation fence. Disabling learning or changing aggressiveness, evidence lifetime, or health window advances the evidence epoch and detaches incompatible state; stale outcomes cannot repopulate it.
+
 `https` remains the default and preserves the original serialized behavior. `https-lanes` assigns lane zero to session control and one lane to every non-zero logical stream. Each lane has its own uplink sequence, retry digest, downlink cursor, unacknowledged replay batch, queue, and newest-poll-wins lifecycle. A slow stream therefore does not block another stream at the WEB protocol layer.

 This removes application-level serialization between WEB streams. Public HTTP/2 still runs over one or more TCP connections, so packet loss can cause transport-level head-of-line blocking; `https-lanes` is not an HTTP/3 or QUIC carrier.

-All lane queues remain inside the existing per-session and process-wide byte/item budgets. The bridge also limits each lane to 8 MiB and 1024 queued items. Telemt permits lane long polls to occupy at most half of `web.limits.max_http_handlers`, preserving handler capacity for session creation, uplink, DELETE, and other control work. `https-lanes` requires `max_http_handlers >= 2`.
+All lane queues and resident response bodies remain inside the existing per-session and process-wide byte/item budgets. Telemt additionally limits each lane to `pending_bytes_per_lane` and `pending_items_per_lane`; the generated bridge caps its corresponding queues at 8 MiB and 1024 items. Telemt permits lane long polls to occupy at most half of `web.limits.max_http_handlers`, preserving handler capacity for session creation, uplink, DELETE, and other control work. `https` requires `max_http_handlers >= 2`, and `https-lanes` requires `max_http_handlers >= 4`.

-The `/api/v1/up` and `/api/v1/down` paths do not change. In `https-lanes`, every request on those paths carries one canonical decimal `X-Lane-ID`. Uplink sequence starts at `1` and downlink cursor at `0` independently for each lane. Lane zero accepts only session `PONG`; every frame in a non-zero lane must have the same stream ID, and a new lane must begin with `OPEN`. After a closed lane's queued and unacknowledged downlink data is drained, Telemt returns an empty response with `X-Lane-Closed: 1`, and the bridge stops polling it. Retries remain byte-identical and replay the original acknowledgement or downlink batch.
+The `/api/v1/up` and `/api/v1/down` paths do not change. In `https-lanes`, every request on those paths carries one canonical decimal `X-Lane-ID`. Uplink sequence starts at `1` and downlink cursor at `0` independently for each lane. Lane zero accepts only session `PONG`; every frame in a non-zero lane must have the same stream ID, and a new lane must begin with `OPEN`. A canonical cursor-zero downlink that reaches Telemt just before its lane `OPEN` waits up to `lane_open_wait_secs` without creating lane state; per-session and process auxiliary permits bound these waits. Expiry returns an empty `204`, while a missing lane with an advanced cursor remains a protocol failure routed through the decoy. After a closed lane's queued and unacknowledged downlink data is drained, Telemt returns an empty response with `X-Lane-Closed: 1`, and the bridge stops polling it. Retries remain byte-identical and replay the original acknowledgement or downlink batch.

 Both WebSocket carriers still create and delete the parent session over HTTPS. They then use a strict bodyless `GET /api/v1/ws` Upgrade request. `websocket` offers exactly `tproxy-v1.<session-token>` in `Sec-WebSocket-Protocol`; binary messages are ordered carrier batches, and a protocol, deadline, or connection failure closes the complete parent session. `websocket-lanes` offers exactly `tproxy-lane-v1.<session-token>.<stream-id>`, where the stream ID is canonical decimal in `1..=16777215`. Its first binary message must begin with `OPEN`, every frame must use that stream ID, and failure after upgrade closes only that lane. There is no lane-zero WebSocket: HTTPS carries `HELLO` and `WELCOME`, while RFC 6455 Ping/Pong supplies connection liveness.

-WebSocket codec buffers and in-flight read/write messages share the process-owned `pending_bytes_global` budget with carrier queues and are additionally bounded by `websocket_bytes_global`. Admission leaves `websocket_http_connection_reserve` accepted connections for ordinary HTTP and decoys. Under pressure, replacement is owner-first, then least-recently-progressed with pre-Upgrade and dead connections ahead of live lanes and multiplexed sessions. A transport Ping is sent after `long_poll_secs` without peer activity, including during continuous downlink traffic; missing peer activity for twice that creation-time interval makes a connection eligible for cleanup.
+Before HTTP `101`, a WebSocket-lane reservation binds to the exact process connection and lane incarnation; an accepted `OPEN` transfers ownership to the exact stream incarnation before its backend task can run. A late poll, close, or reservation drop from an older socket cannot acknowledge, close, or release a replacement that reused the same numeric lane ID.
+
+WebSocket codec buffers and in-flight read/write messages share the process-owned `pending_bytes_global` budget with carrier queues and are additionally bounded by `websocket_bytes_global`. Admission leaves `websocket_http_connection_reserve` accepted connections for ordinary HTTP and decoys. Admission replacement selects dead active connections globally first, then uses same-session, same-profile-owner, and same-client-IP locality. An unrelated healthy victim is eligible only when the requester is below its fair byte share and the victim owner is above it. Within one locality, claimed or upgraded connections precede active lanes, active lanes precede active multiplexed sessions, and least-recent progress, creation order, and connection ID provide deterministic tie breaking. Memory-pressure cleanup uses the same dead-first and lifecycle ordering, preferring over-share owners without stalling when every owner is at or below its share. `max_websocket_evictions_in_flight` bounds concurrent exact eviction claims. Upgrade, first-message, write, backpressure, and eviction deadlines are frozen from the parent session. A transport Ping is sent after `long_poll_secs` without peer activity, including during continuous downlink traffic; missing peer activity for twice that creation-time interval makes an active connection eligible for cleanup.

 Every pre-Upgrade authentication, shape, lane-reservation, or capacity failure follows the sanitized decoy path instead of exposing a WebSocket-specific status. The exact subprotocol contains the session bearer and must not be logged.

 The WEB listener must use `proxy_protocol = false` and `reuse_allow = false`. It cannot use `client_mss`, `synlimit`, `announce`, or `announce_ip`. `web_trusted_proxy_cidrs` must be non-empty and must contain only the immediate NGINX or HAProxy peers; `/0` networks are rejected.

-The HTTP decoy origin must be a loopback, link-local, or private IP literal. Telemt preserves ordinary request method, path, query, headers, streamed body, response status, headers, and body while removing hop-by-hop headers. Malformed carrier requests have carrier credentials and bodies removed before falling back to the decoy.
+The HTTP decoy origin must be a loopback, link-local, or private IP literal. Telemt preserves ordinary request method, path, query, headers, streamed body, response status, headers, and body while removing hop-by-hop headers. Malformed carrier requests have carrier credentials and bodies removed before falling back to the decoy. A literal decoy endpoint that exactly matches an effective WEB listener, or is covered by its same-family wildcard address on the same port, is rejected. Indirect loops through DNS, NGINX, HAProxy, or another forwarding layer cannot be proven from Telemt configuration and must be excluded operationally.

 An immutable static-site snapshot can be used instead:

@@ -168,6 +220,14 @@ Place the `map` in NGINX's `http` context. `client_max_body_size` must be at lea

 Public HTTP/2 is mandatory for `https-lanes`; use the equivalent HTTP/2 directive supported by the installed NGINX release. WebSocket Upgrade requires HTTP/1.1, so the public endpoint must also permit HTTP/1.1 and the private NGINX-to-Telemt hop remains HTTP/1.1. Preserve `Connection`, `Upgrade`, and `Sec-WebSocket-*` exactly as shown. Ensure the upstream connection capacity can sustain the expected simultaneous lane polls or WebSocket lanes; `keepalive` controls the idle pool and is not a concurrency limit.

+### Distinguishing refusal from WEB capacity
+
+`connect() failed (111: Connection refused) while connecting to upstream` is a TCP-connect failure before Telemt accepts a socket. Check that the Telemt process is running, the effective WEB listener address and port match the NGINX upstream, both processes share the expected network namespace and address family, and no local firewall actively rejects the connection. Startup bind failure, terminal listener removal, or switching NGINX to a desired port before a restart-only listener change becomes effective can produce this symptom. Kernel listen-backlog pressure is separate and normally requires host `ListenOverflows`/`ListenDrops` telemetry.
+
+WEB capacity is enforced after successful `accept(2)`. Exhausting `max_http_connections` therefore produces the configured `drop`, `wait`, or `respond` outcome; it does not produce an upstream connect refusal. Handler, body, lane, stream, queue, and WebSocket limits have their own HTTP, decoy, or stream-local failure boundaries. Operator pause and drain also leave the WEB listener bound, so they cannot by themselves cause a refusal.
+
+Use `GET /v1/runtime/web/status` to correlate only Telemt-owned state. `ingress.accepting_connections` requires a running publication, a readable runtime, and one live acceptor for every effective WEB listener. `capacity.saturated_resources`, typed rejection totals, and overload outcomes identify failures after acceptance. `decoy_upstream` describes only Telemt's outgoing plain-HTTP decoy hop. None of these fields claims that the public NGINX TLS endpoint is reachable; use an external TCP/TLS probe and NGINX or HAProxy telemetry for that boundary.
+
 ## HAProxy TLS termination

 ```haproxy
@@ -198,22 +258,31 @@ The frontend or `defaults` section must also set `timeout client 65s` or longer
 | --- | --- |
 | WEB listener inventory, bind address, and trust policy | Process-owned; restart Telemt. |
 | Any `[web.limits]` value | Process-owned memory/resource contract; restart Telemt. |
-| `web.enabled`, `web.carrier`, `web.debug`, timeouts, vhosts, profiles, and decoys | Applied by the config watcher or a runtime generation reload. |
-| Existing HTTP connections and WEB sessions | Keep their acquisition-time carrier, limits, and session deadlines; newly issued bridge sessions use the active carrier. WebSocket write, backpressure, and eviction operations read the active hot-reloaded deadlines. New logical streams use the active relay generation. |
-| Process shutdown | Uses the latest reloaded `web.timeouts.shutdown_secs`. |
+| `web.enabled`, carrier/negotiation policy, `web.debug`, timeouts, vhosts, profiles, and decoys | Applied by the config watcher or a runtime generation reload. |
+| Operator pause/drain state | Process-owned and ephemeral; survives generation reload, never writes config, and resets to `running` after process restart. |
+| Existing HTTP connections and WEB sessions | Keep their acquisition-time HTTP idle limit, carrier candidates, limits, body timeout, closed-token replay lifetime, and absolute session/negotiation deadlines; each issued bridge embeds its request, retry, recovery, and probe-coalescing values. A recovery epoch freezes its current bridge budget, while a successful recovery representation refreshes the policy used by later epochs and the fresh session. WebSocket upgrade, open, write, backpressure, and eviction operations use the parent session's frozen deadlines. Newly issued bridges use the active policy, while new logical streams use the active relay generation. |
+| Process shutdown | Captures the latest reloaded `web.timeouts.shutdown_secs` once and shares that single absolute deadline across listener acceptors and connections plus WEB sessions and auxiliary tasks. The waits do not receive sequential per-component budgets. |

 Each logical stream keeps its session's creation-time client IP and owns a process-unique, non-zero synthetic source port for the complete relay lifetime. This preserves one stable, non-colliding source/destination tuple for Direct and Middle-End KDF routing.

+HTTP idle accounting protects only explicitly bounded request-body, long-poll, decoy connect/response-head, and pending-Upgrade phases. The operation's own deadline remains exact; if its lease is still present at that instant, the connection watchdog allows at most one connection-idle interval for the scheduled task to publish its timeout/result before forcing closure. Between exchanges, and after a response head is ready, progress resets the idle clock while a stalled response body remains idle-bounded. Completion of an older phase cannot release the deadline protection owned by a newer phase.
+
+An `OPEN` reserves the bounded logical-stream and tuple ownership but does not consume the relay generation's `max_connections` permit. Telemt acquires that permit only after the first inner byte arrives; the frozen first-byte deadline and stream limits bound silent opens, and capacity exhaustion then closes only the affected stream.
+
 ## API management

-API management is available, but it is intentionally partial. There is no mutable `/v1/web` resource; the API listener exposes the read-only HTML debug view at `/web-status`.
+WEB configuration, runtime status, and bounded runtime controls share the authenticated API listener. `/web-status` remains a read-only HTML diagnostic view; state-changing operations exist only under `/v1/runtime/web`.

 | Operation | API support |
 | --- | --- |
-| Read or patch `[web]`, vhosts, profiles, decoys, timeouts, or limits | No. `GET /v1/config` omits `[web]`; `PATCH /v1/config` returns `400 section_not_editable` for `web`. |
+| Read or patch `[web]`, vhosts, profiles, decoys, timeouts, or limits | Yes, through `GET` or `PATCH /v1/config`. The derived `web.runtime` snapshot is never returned or writable. Nested tables merge field-by-field; arrays replace the previous array wholesale. Every `[web.limits]` change is accepted as desired configuration but reported as deferred until process restart. |
 | Persist `server.listeners` | Yes, through `PATCH /v1/config`, but a changed WEB listener remains deferred until process restart. |
 | Apply an externally edited WEB configuration | Yes, through `POST /v1/system/reload`, then inspect the operation status. |
 | Inspect bounded server-side WEB request and lifecycle details | Yes, through authenticated `GET /web-status`. |
+| Inspect lifecycle, capacity planes, learning/debug state, and live sessions | Yes, through `GET /v1/runtime/web/status` and `/v1/runtime/web/sessions`. |
+| Close selected live WEB sessions | Yes, through the asynchronous `POST /v1/runtime/web/sessions/close` operation. |
+| Pause, deadline-drain, or resume new WEB work | Yes, through `/v1/runtime/web/lifecycle/{pause,drain,resume}`. |
+| Clear debug records or reset carrier learning | Yes, through the corresponding runtime POST endpoints. |
 | Manage `[access.users]` | Yes, through `/v1/users`. User creation does not create a WEB profile. |
 | Revoke one user | Yes. `/v1/users/{username}/disable` updates admission immediately and cancels that user's active sessions. |

@@ -230,6 +299,27 @@ read_only = false

 The API whitelist checks the direct TCP peer and does not trust `X-Forwarded-For`. Changes to `[server.api]` itself require a process restart.

+### Runtime status and control
+
+`GET /v1/runtime/web/status` always returns the published ingress lifecycle (`starting`, `no_web_listener`, `running`, `draining`, `drained`, or `deadline_exceeded`), its epoch and age, effective listener addresses, and backward-compatible runtime availability. `ingress` independently reports configured listeners, live acceptors, accepting state, accept totals, and a stable reason. `capacity` reports effective accepted-socket overload policy, fixed resource usage, instantaneous saturation, partial planes, typed rejection decisions, and overload outcomes. `decoy_upstream` reports fixed outcomes and the age of the latest internal origin result. `decoy_fasttrack` reports the effective restart-frozen mode and the complete fixed disposition set even while the runtime manager is unavailable. `carrier_negotiation` always reports fixed selection, client-failure, and terminal health/learning outcome matrices from publication ownership. When the process-owned WEB runtime is alive, `operator_lifecycle` independently exposes `running`, `paused`, `draining`, `force_closing`, or `drained`, its own epoch/admission flags, and the active or latest drain. `runtime` adds the random 128-bit `runtime_instance`, active generation, immutable limits, plane-local capacity counters, carrier-learning/debug epochs, and totals. Runtime plane collection uses non-blocking reads: a contended plane is omitted and named in `partial`; the endpoint never waits for, cleans up, or mutates the data plane.
+
+Prometheus exports the same process-owned planes as fixed-cardinality `telemt_web_*` families: ingress and operator one-hot states, listener/accept counters, capacity usage and saturation, typed terminal rejections, accepted-socket overload outcomes, internal decoy-origin outcomes, and session/stream/carrier totals. Decoy routing adds one-hot `telemt_web_decoy_fasttrack_mode` and fixed `telemt_web_decoy_fasttrack_requests_total{disposition}`. Carrier negotiation uses `telemt_web_carrier_selections_total`, `telemt_web_carrier_reported_failures_total`, `telemt_web_carrier_learning_outcomes_total`, one-hot learning state/policy gauges, and used/limit entry gauges. Labels are closed enums or fixed resource names; user, host, client IP, token, profile key, runtime instance, listener address, and generation ID are never labels. A successful `wait` outcome does not increment a rejection counter.
+
+`GET /v1/runtime/web/sessions` returns at most 50 sessions by default and at most 200 when `limit` is supplied. Its ordered scan is capped at 1000 candidates. `cursor` and `session_ref` use the opaque canonical form `ws1.<runtime-instance>.<lowercase-hex-id>`; exact `session_ref` is mutually exclusive with `cursor` and `limit`. Filters are `ip`, `host`, `user`, `user_agent_id`, `key_id`, `carrier`, and `state`; duplicate or unknown query fields are rejected. The detail route is `GET /v1/runtime/web/sessions/{session_ref}`. A retained closed-session tombstone returns `410`; a contended exact snapshot returns `503 web_snapshot_busy`. Responses expose bounded non-secret metadata and never expose bootstrap/session bearers, capabilities, secret hashes, or synthetic/KDF ports.
+
+Every runtime POST requires `Content-Type: application/json` exactly, rejects unknown JSON fields, obeys API authentication, whitelist, and `read_only`, and carries the current `runtime_instance` as an ABA fence. Available controls are:
+
+- `POST /v1/runtime/web/lifecycle/pause` with `{"runtime_instance":"..."}`. It blocks new bootstrap, session incarnation, replacement, and logical-stream admission after a linearizable fence. Existing carrier exchanges and streams continue, exact session replay remains available, and bridge rejection stays on the decoy route.
+- `POST /v1/runtime/web/lifecycle/drain` with `{"runtime_instance":"...","timeout_secs":30}`. It returns `202`, keeps the same admission fence closed, and waits asynchronously for sessions, streams, and session-owned WebSockets. At the monotonic deadline it signals close to every remaining live session and reports `force_closing` until zero is confirmed. Natural and forced completion both remain closed until resume. A concurrent second drain returns `409 web_lifecycle_in_progress`.
+- `POST /v1/runtime/web/lifecycle/resume` with `{"runtime_instance":"..."}`. It cancels an active drain and reopens only operator admission. If forced close already committed, old session cancellation cannot be undone. Config, user, generation, and terminal shutdown gates still dominate.
+- `POST /v1/runtime/web/sessions/close` with one selector: `{"kind":"refs","session_refs":[...]}`, `{"kind":"filter",...}`, or `{"kind":"all"}`. Exact refs are limited to 200, a filter must be non-empty, only one close operation may run, and `all` is rejected while effective issuance remains enabled. The `202` response returns `operation_id`; poll `GET /v1/runtime/web/operations/{operation_id}`. The operation scans only sessions at or below its submission high-water mark in chunks of 128.
+- `POST /v1/runtime/web/debug/clear` with `{"runtime_instance":"..."}`. The response reports cleared records, bytes still leased by already rendered snapshots, and the new epoch. In-flight writers from the old epoch cannot repopulate the ring.
+- `POST /v1/runtime/web/carrier-learning/reset` with the same body shape. It clears retained process-local evidence and advances the learning epoch; already frozen attempt chains and live sessions are unchanged.
+
+For a deterministic close-all, patch `{"web":{"enabled":false}}` with runtime reload enabled, wait until `runtime.manager.issuance_enabled` is `false`, submit the `all` selector using that same `runtime_instance`, and poll the operation to a terminal state. Disabling WEB stops new bootstrap/session issuance but never implicitly closes existing sessions.
+
+Operator lifecycle is WEB-only and does not change global readiness, liveness, native TCP/Unix listeners, TLS-fronting, or fallback behavior. A pre-pause WebSocket lane reservation is already admitted logical work: it may finish opening and remains included in drain accounting. Lifecycle rejection consumes no rate/quota tokens and adds no hot-path relay lock.
+
 ### Server-side WEB debug view

 Enable bounded collection in the owned configuration file:
@@ -248,7 +338,7 @@ default_window_secs = 180
 max_window_secs = 3600
 ```

-Open `http://127.0.0.1:9091/web-status` with the same direct-peer whitelist and exact `Authorization` header used by the API. A trailing slash is accepted. Only `GET` is allowed. The page supports `window_secs`, canonical `ip`, numeric `session`, case-insensitive `user_agent`, and `key` filters. Repeat `group_by=ip`, `group_by=session`, `group_by=user_agent`, or `group_by=key` to build grouped summaries; `limit` is restricted to `1..=1000`. HTTP rows expand from request through response with method, path, sanitized headers, body metadata or bytes, timing points, parsed frames, and typed lifecycle events. WebSocket operation adds the sanitized `GET` to `101` handshake plus bounded per-message direction, message type, payload/body capture, processing time, connection/lane identifiers, and parsed inner frames. Raw subprotocols and session tokens are never retained.
+Open `http://127.0.0.1:9091/web-status` with the same direct-peer whitelist and exact `Authorization` header used by the API. A trailing slash is accepted. Only `GET` is allowed. The page supports `window_secs`, canonical `ip`, numeric `session`, case-insensitive `user_agent`, and `key` filters. Repeat `group_by=ip`, `group_by=session`, `group_by=user_agent`, or `group_by=key` to build grouped summaries; `limit` is restricted to `1..=1000`. HTTP rows expand from request through response with method, path, sanitized headers, body metadata or bytes, timing points, parsed frames, and typed lifecycle events, including carrier attempt, commit, healthy, reported-failure, exact close reason, peer gap, and recovered-session predecessor transitions. WebSocket operation adds the sanitized `GET` to `101` handshake plus bounded per-message direction, message type, payload/body capture, processing time, connection/lane identifiers, and parsed inner frames. Raw subprotocols and session tokens are never retained.

 The process-owned ring survives runtime generation replacement. Capture-policy changes clear incompatible retained records; window-only changes do not. The ring defaults to 65536 records and 64 MiB retained plus in-flight bytes, the HTML response is capped at 8 MiB, grouping is capped at 1024 groups, and no more than two response bodies retain page permits concurrently. Change `web.limits.debug_records_capacity` or `web.limits.debug_bytes_global` only with a process restart. A hot prefix that fits only a simultaneously increased restart-only capacity is deferred until that restart.

@@ -267,7 +357,7 @@ curl -sS http://127.0.0.1:9091/v1/system/reload/RELOAD_ID \
  -H "Authorization: ${TELEMT_API_AUTH}"
 ```

-A terminal `succeeded` status confirms runtime activation. A changed `web.carrier` is used by newly issued bridge sessions; existing sessions are not migrated. If `deferred_process_fields` contains `server.listeners` or `web.limits`, the file is valid and persisted but those settings still require a Telemt restart.
+A terminal `succeeded` status confirms runtime activation. Changed carrier, candidate, deadline, or learning policy is used by newly issued bridge sessions; existing sessions and in-flight attempt chains are not migrated. If `deferred_process_fields` contains `server.listeners` or `web.limits`, the file is valid and persisted but those settings still require a Telemt restart.

 Access-user operations use the existing endpoints, for example:

@@ -290,8 +380,8 @@ See the complete [Control API contract](../Architecture/API/API.md) for request
 - Never expose the plain HTTP WEB listener to an untrusted network. Enforce the restriction with host firewall rules even when it binds to loopback.
 - Disable request-target and authorization logging at the TLS terminator, or use a verified redacted format. Raw queries contain bridge capabilities and `Authorization` contains bootstrap or session bearer credentials.
 - Keep one stable public address per vhost. If DNS returns several ingress addresses, each deployment must use the address matching its external path.
- Bootstrap and session registries are process-local. A multi-process or multi-host upstream pool requires affinity for the complete vhost: bridge GET, session creation, uplink, downlink, and DELETE. A single Telemt process needs no extra affinity.
- An unused bootstrap survives a configuration reload only when the exact profile identity remains active: host, `public_addr`, user, secret mode, carrier, and capability. Existing created sessions retain their immutable carrier and profile identity and remain lifecycle-bounded.
+- Bootstrap and session registries are process-local. A multi-process or multi-host upstream pool requires affinity for the complete vhost: initial and recovery root GET, session creation, uplink, downlink, WebSocket Upgrade, and DELETE. A single Telemt process needs no extra affinity.
+- An unused bootstrap survives a configuration reload only when the exact profile identity remains active: host, `public_addr`, user, secret mode, carrier candidates, negotiation deadlines, and capability. Existing created sessions retain their immutable carrier and profile identity and remain lifecycle-bounded.
 - The decoy is part of the anti-probing contract. Verify its ordinary 404 behavior and response timing through the public TLS endpoint before distributing links.

 ## Initial verification
@@ -302,8 +392,9 @@ See the complete [Control API contract](../Architecture/API/API.md) for request
 4. Import the printed `tg://webproxy` link in the intended Telegram Desktop build and establish a proxy connection.
 5. For `https-lanes`, confirm that the public connection negotiated HTTP/2 and exercise at least two simultaneous logical streams; the private Telemt hop remains HTTP/1.1.
 6. For `websocket`, confirm one `101` response, binary relay traffic, and RFC 6455 Ping/Pong beyond 25 seconds. For `websocket-lanes`, exercise at least two simultaneous stream sockets and verify that closing or corrupting one lane does not close its sibling or parent session.
-7. Exercise reconnect and at least one long poll beyond 25 seconds to prove the frontend timeouts do not truncate the carrier.
+7. Exercise one HTTP replay and one fresh-session recovery after a scheduler gap, then keep a long poll open beyond 25 seconds to prove the frontend timeouts do not truncate the carrier.
 8. Verify user and logical MTProxy connection limits using logical-stream counters, not the number of HTTP connections.
+9. When auto-negotiation is enabled, verify the configured sequence, exact-attempt replay after an intentionally lost response, terminal behavior after commit, and `carrier_committed`/`carrier_healthy` lifecycle rows in `/web-status`. Verify that a metadata-free native client uses the fixed `carrier` without automatic response headers and that explicit capabilities remain unchanged.

 ## Troubleshooting

@@ -311,6 +402,8 @@ See the complete [Control API contract](../Architecture/API/API.md) for request
 | --- | --- |
 | WEB configuration is valid on disk but listener behavior did not change | Inspect reload `deferred_process_fields`; listener and `[web.limits]` changes require restart. |
 | Carrier requests reach the decoy | Verify exact vhost, link secret mode, direct proxy CIDR, and one parseable `X-Forwarded-For` value. |
+| A racing `https-lanes` downlink reaches the decoy with `404` | Confirm it starts at `X-Down-Cursor: 0`, preserve `X-Lane-ID`, and set `lane_open_wait_secs` above the observed down-before-`OPEN` skew. Advanced cursors for missing lanes intentionally fail closed. |
+| Auto-negotiation advances after traffic was already accepted | This is not valid behavior. Inspect the authenticated `X-Carrier-State` replay and the carrier commit lifecycle row; a committed or healthy response is terminal and requires a new session. |
 | Long polls disconnect near a fixed interval | Raise NGINX/HAProxy client, server, send, and read timeouts above `web.timeouts.long_poll_secs`. |
 | WebSocket Upgrade reaches the decoy instead of returning `101` | Preserve HTTP/1.1 `Connection: Upgrade`, `Upgrade: websocket`, the single exact `Sec-WebSocket-Protocol`, and the canonical bodyless `/api/v1/ws` request. Also check carrier/session compatibility and the process connection reserve. |
 | One `websocket-lanes` stream closes while siblings stay connected | This is the intended failure boundary. Inspect that lane's message/frame rows in `/web-status`; malformed, cross-lane, write-timeout, and backend-close paths terminate only the affected lane. |
@@ -28,7 +28,9 @@ WEB-listener Telemt

 - Публичный endpoint всегда имеет вид `https://HOST:443`.
 - Поддерживаются 16-байтовые MTProxy-секреты `plain` и `dd`. FakeTLS-секреты `ee` в WEB-режиме не поддерживаются.
- `web.carrier = "https"` выбирает сериализованные HTTPS uplink и long polling. `https-lanes` выбирает независимые HTTPS sequencing и polling для каждого logical stream. `websocket` выбирает один упорядоченный WebSocket для всех streams. `websocket-lanes` выбирает отдельный WebSocket с независимым ownership для каждого ненулевого logical stream.
+- `web.carrier` выбирает единственный carrier при выключенном auto-negotiation и последний fallback при включённом. `https` использует сериализованные HTTPS uplink и long polling. `https-lanes` использует независимые HTTPS sequencing и polling для каждого logical stream. `websocket` использует один упорядоченный WebSocket для всех streams. `websocket-lanes` использует отдельный WebSocket с независимым ownership для каждого ненулевого logical stream.
+- Отсутствующий `web.carriers` или `web.carriers = false` отключает auto-negotiation и обучение. Непустой массив включает только стартовый последовательный перебор; уже committed session никогда не мигрирует.
+- Нативные клиенты без канонических headers carrier negotiation используют настроенный фиксированный `carrier`, даже когда `carriers` включает negotiation для поддерживающих его клиентов. Текущий Telegram iOS поддерживает только `https`, поэтому для metadata-free iOS оператор должен задать `web.carrier = "https"`; `https-lanes` этим клиентом не поддерживается. User-Agent, включая CFNetwork или Darwin, никогда не выводит capabilities неявно. Если нативный iOS всё же отправляет явные negotiation metadata, Telemt пересекает их с server-authoritative ceiling `{https}` и отклоняет пустой результат; остальные явные клиенты используют заявленный capability set.
 - Capability, bootstrap и session credentials — отдельные значения с ограниченным сроком жизни. Carrier credentials считаются секретами и не должны попадать в access logs.
 - Bootstrap является bearer credential, а не token с привязкой к source address. Адрес клиента и его IP-семейство могут измениться между загрузкой bridge и созданием session. Адрес выдачи продолжает учитываться в лимите неиспользованных bootstrap, а владельцем session становится адрес первого корректного запроса создания.
 - Внутренняя MTProxy-аутентификация ограничена пользователем и режимом секрета, выбранными профилем vhost. Некорректный внутренний handshake закрывает только свой logical stream и никогда не попадает в TCP masking path.
@@ -91,17 +93,52 @@ max_streams = 512
 max_streams_per_session = 64
 ```

+## Server-side negotiation carrier
+
+Auto-negotiation необязателен и выключен, пока `carriers` не задан явным непустым массивом. Настроенный `carrier` остаётся последним fallback и добавляется ровно один раз, даже если уже присутствует в массиве:
+
+```toml
+[web]
+enabled = true
+carrier = "https"
+carriers = ["websocket-lanes", "websocket", "https-lanes"]
+carrier_learning = true
+carrier_negotiation_aggressiveness = "conservative"
+
+[web.timeouts]
+carrier_negotiation_deadlines_secs = [3, 5, 8, 12]
+carrier_health_secs = 30
+carrier_learning_secs = 600
+bridge_request_secs = 10
+bridge_retry_secs = 90
+carrier_probe_coalesce_ms = 0
+```
+
+Сгенерированный bridge отправляет канонические headers `X-Carrier-Capabilities`, `X-Carrier-Attempt` и, после первой попытки, `X-Carrier-Failure` в запросе `/session`. Каждый успешный automatic response возвращает `X-Carrier-Mode`, `X-Carrier-Attempt`, `X-Carrier-Candidate-Count`, `X-Carrier-Deadline` и `X-Carrier-State`. Bridge запускает локальный cumulative clock непосредственно перед первым запросом `/session`, а сервер фиксирует отдельный absolute chain deadline при приёме первой automatic attempt. Оба используют настроенные offsets и не сбрасываются при replacement. Для одного, двух, трёх и четырёх effective candidates checkpoints attempts равны соответственно `[d3]`, `[d0, d3]`, `[d0, d1, d3]` и `[d0, d1, d2, d3]`; финальному candidate всегда принадлежит `d3`. Successor остаётся допустимым до собственного checkpoint. Состояния: `provisional`, `committed` и `healthy`.
+
+Попытки строго последовательны. Принятый прогресс `OPEN` или `DATA` немедленно фиксирует выбранный carrier и окончательно закрывает границу replacement. Аутентифицированный `409` для committed chain повторяет metadata зафиксированного carrier и является terminal response, а не разрешением перейти дальше. Точный replay `/session` применяется только пока результат этого запроса неоднозначен. После аутентифицированного выбора provisional carrier transport failure сразу запрашивает следующую attempt; если предыдущий probe всё же успел committed, сервер возвращает terminal `409` и не разрешает небезопасный replacement. Финальный абсолютный deadline на сервере также ограничивает lifetime successor, ответ которого клиент не получил. Динамическое post-commit переключение намеренно не поддерживается: для смены carrier требуется новая сессия.
+
+Каждая HTTP-операция bridge имеет абсолютный budget `bridge_retry_secs` и не более девяти attempts. `bridge_request_secs` охватывает Fetch response head и полное чтение response body; для downlink attempt дополнительно разрешён настроенный long-poll interval. Network failures и ответы `408`, `429`, `502`, `503` или `504` используют bounded exponential backoff, а `Retry-After` не может расширить абсолютный budget. При `carrier_probe_coalesce_ms = 0` первый упорядоченный probe с `OPEN` отправляется немедленно. Значение до 10 мс позволяет включить соответствующий `DATA`, пришедший в этом окне; multiplexed carriers сохраняют весь предшествующий порядок frames, а lane carriers забирают только выбранную lane. HTTP downlink не запускается до acknowledgement probe. Multiplexed WebSocket Upgrade может начаться сразу после его выбора ответом `/session` и затем включить queued probe data; lane WebSocket ждёт известного stream ID.
+
+Automatic WebSocket использует `tproxy-auto-v1.<session-token>` или `tproxy-auto-lane-v1.<session-token>.<stream-id>`. Первое принятое binary message с реальным прогрессом `OPEN` или `DATA` фиксирует carrier; затем сервер пишет пустой binary commit ACK именно в это connection. Ping/Pong не фиксирует carrier и не считается learning evidence.
+
+Committed attempt становится healthy, только когда transport-specific двунаправленный evidence остаётся корректным в течение `carrier_health_secs`. HTTPS требует принятый `DATA`, подтверждённый непустой post-commit downlink batch и аутентифицированную активность не раньше health deadline. WebSocket требует записи точного commit ACK, последующего принятого `OPEN` или `DATA` от того же owner и сохранения этого owner живым до конца интервала. Более раннее закрытие нейтрально и не записывает результат обучения.
+
+Обучение process-local, in-memory, positive-only и ограничено `max_carrier_learning_entries`. Оно ранжирует только поддерживаемые клиентом настроенные candidates, всегда оставляет fallback последним и сохраняет настроенный порядок при равных scores. Evidence User-Agent и профиля имеет основной вес; допустимый IP служит только tie-breaker. Для IP evidence требуется ровно один явный глобально маршрутизируемый `X-Forwarded-For`; private, loopback, link-local, carrier-grade NAT, documentation, multicast и их IPv4-mapped эквиваленты исключаются. Категории ошибок от клиента и request latency используются только для диагностики и не создают отрицательный или ranking evidence. `conservative` требует 3 outcomes User-Agent или 8 outcomes профиля в 4 cohorts и отключает IP evidence; `balanced` использует соответственно 2, 6 в 3 cohorts и 3 outcomes допустимого IP; `aggressive` — 1, 4 в 2 cohorts и 1 outcome IP. Выключение обучения или смена policy при reload очищает несовместимый evidence, не меняя уже начатые сессии.
+
 `https` остаётся default и сохраняет исходное сериализованное поведение. В `https-lanes` lane zero отведена под session control, а каждому ненулевому logical stream соответствует своя lane. У каждой lane собственные uplink sequence, retry digest, downlink cursor, unacknowledged replay batch, очередь и lifecycle newest-poll-wins. Поэтому медленный stream не блокирует другой stream на уровне WEB-протокола.

 Это устраняет сериализацию между WEB-streams на уровне приложения. Публичный HTTP/2 всё ещё работает поверх одного или нескольких TCP-connections, поэтому потеря пакетов может вызвать transport-level head-of-line blocking; `https-lanes` не является HTTP/3- или QUIC-carrier.

-Все lane queues входят в существующие per-session и process-wide byte/item budgets. Bridge дополнительно ограничивает одну lane 8 MiB и 1024 элементами. Lane long polls могут занимать не более половины `web.limits.max_http_handlers`, оставляя handler capacity для session creation, uplink, DELETE и другой control work. Для `https-lanes` требуется `max_http_handlers >= 2`.
+Все lane queues и resident response bodies входят в существующие per-session и process-wide byte/item budgets. Telemt дополнительно ограничивает одну lane значениями `pending_bytes_per_lane` и `pending_items_per_lane`; сгенерированный bridge ограничивает свои очереди 8 MiB и 1024 элементами. Lane long polls могут занимать не более половины `web.limits.max_http_handlers`, оставляя handler capacity для session creation, uplink, DELETE и другой control work. Для `https` требуется `max_http_handlers >= 2`, для `https-lanes` — `max_http_handlers >= 4`.

-Paths `/api/v1/up` и `/api/v1/down` не меняются. В `https-lanes` каждый запрос к ним содержит один канонический десятичный `X-Lane-ID`. Uplink sequence начинается с `1`, а downlink cursor — с `0` независимо для каждой lane. Lane zero принимает только session `PONG`; все frames ненулевой lane должны иметь тот же stream ID, а новая lane должна начинаться с `OPEN`. После отправки всей queued и unacknowledged downlink data закрытой lane Telemt возвращает пустой ответ с `X-Lane-Closed: 1`, и bridge прекращает её polling. Retry остаются byte-identical и повторяют исходный acknowledgement или downlink batch.
+Paths `/api/v1/up` и `/api/v1/down` не меняются. В `https-lanes` каждый запрос к ним содержит один канонический десятичный `X-Lane-ID`. Uplink sequence начинается с `1`, а downlink cursor — с `0` независимо для каждой lane. Lane zero принимает только session `PONG`; все frames ненулевой lane должны иметь тот же stream ID, а новая lane должна начинаться с `OPEN`. Канонический downlink с cursor zero, пришедший немного раньше `OPEN` своей lane, ждёт до `lane_open_wait_secs` без создания lane state; число таких ожиданий ограничено per-session и process auxiliary permits. Истечение таймаута возвращает пустой `204`, а отсутствующая lane с продвинутым cursor остаётся protocol failure и уходит в decoy. После отправки всей queued и unacknowledged downlink data закрытой lane Telemt возвращает пустой ответ с `X-Lane-Closed: 1`, и bridge прекращает её polling. Retry остаются byte-identical и повторяют исходный acknowledgement или downlink batch.

 Оба WebSocket carrier по-прежнему создают и удаляют parent session через HTTPS, после чего используют строгий bodyless Upgrade-запрос `GET /api/v1/ws`. `websocket` передаёт в `Sec-WebSocket-Protocol` ровно `tproxy-v1.<session-token>`; binary messages являются упорядоченными carrier batches, а ошибка протокола, deadline или connection закрывает всю parent session. `websocket-lanes` передаёт ровно `tproxy-lane-v1.<session-token>.<stream-id>`, где stream ID записан каноническим десятичным числом из диапазона `1..=16777215`. Первое binary message должно начинаться с `OPEN`, все frames должны содержать этот stream ID, а сбой после Upgrade закрывает только данную lane. Lane-zero WebSocket отсутствует: HTTPS переносит `HELLO` и `WELCOME`, а liveness connection обеспечивает RFC 6455 Ping/Pong.

-WebSocket codec buffers и находящиеся в обработке read/write messages делят process-owned `pending_bytes_global` с carrier queues и дополнительно ограничены `websocket_bytes_global`. Admission оставляет `websocket_http_connection_reserve` принятых connections для обычного HTTP и decoy. При pressure вытеснение сначала выбирает того же owner, затем connection с наиболее старым прогрессом; pre-Upgrade и dead connections идут раньше активных lanes и multiplexed sessions. После `long_poll_secs` без peer activity отправляется transport Ping, в том числе при непрерывном downlink traffic, а отсутствие peer activity в течение удвоенного creation-time интервала делает connection кандидатом на cleanup.
+До HTTP `101` reservation WebSocket lane привязывается к точным process connection и incarnation lane; принятый `OPEN` передаёт ownership точному incarnation stream до запуска его backend task. Поздний poll, close или drop reservation от старого socket не может подтвердить, закрыть или освободить replacement, повторно использующий тот же числовой lane ID.
+
+WebSocket codec buffers и находящиеся в обработке read/write messages делят process-owned `pending_bytes_global` с carrier queues и дополнительно ограничены `websocket_bytes_global`. Admission оставляет `websocket_http_connection_reserve` принятых connections для обычного HTTP и decoy. При admission replacement сначала глобально выбираются dead active connections, затем применяются уровни locality: та же session, тот же profile owner и тот же client IP. Не связанный с ними healthy victim допустим только когда requester использует меньше своей fair byte share, а owner victim — больше. Внутри одного уровня locality claimed или upgraded connections идут перед active lanes, lanes — перед active multiplexed sessions; дальнейший порядок детерминируют время последнего прогресса, создания и connection ID. Cleanup при memory pressure использует тот же dead-first и lifecycle-порядок, предпочитая owners выше fair share, но продолжает eviction, если все owners находятся на своей share или ниже. `max_websocket_evictions_in_flight` ограничивает одновременные точные eviction claims. Deadlines Upgrade, первого message, write, backpressure и eviction заморожены из parent session. После `long_poll_secs` без peer activity отправляется transport Ping, в том числе при непрерывном downlink traffic, а отсутствие peer activity в течение удвоенного creation-time интервала делает active connection кандидатом на cleanup.

 Любая ошибка authentication, shape, lane reservation или capacity до Upgrade следует по очищенному decoy path и не раскрывает WebSocket-специфичный status. Точный subprotocol содержит session bearer и не должен попадать в logs.

@@ -198,22 +235,29 @@ backend telemt_web
 | --- | --- |
 | Состав WEB-listeners, bind address и trust policy | Принадлежат процессу; перезапустите Telemt. |
 | Любое значение `[web.limits]` | Process-owned контракт памяти и ресурсов; перезапустите Telemt. |
-| `web.enabled`, `web.carrier`, `web.debug`, timeouts, vhosts, profiles и decoys | Применяются config watcher или runtime generation reload. |
-| Существующие HTTP connections и WEB sessions | Сохраняют carrier, лимиты и session deadlines своего момента создания; новые bridge sessions получают активный carrier. WebSocket write, backpressure и eviction operations читают активные hot-reloaded deadlines. Новые logical streams используют активное relay generation. |
-| Завершение процесса | Использует последнее применённое значение `web.timeouts.shutdown_secs`. |
+| `web.enabled`, policy carrier/negotiation, `web.debug`, timeouts, vhosts, profiles и decoys | Применяются config watcher или runtime generation reload. |
+| Существующие HTTP connections и WEB sessions | Сохраняют HTTP idle limit, carrier candidates, лимиты, body timeout, lifetime replay-marker закрытого token и абсолютные session/negotiation deadlines своего момента создания; каждый выданный bridge содержит собственные request, retry и probe-coalescing значения. WebSocket Upgrade, open, write, backpressure и eviction operations используют замороженные deadlines parent session. Новые bridges получают активную policy, а новые logical streams используют активное relay generation. |
+| Завершение процесса | Один раз фиксирует последнее применённое значение `web.timeouts.shutdown_secs` и использует единый абсолютный deadline для listener acceptors и connections, WEB sessions и auxiliary tasks. Последовательные компоненты не получают отдельные полные бюджеты. |

 Каждый logical stream сохраняет client IP своей сессии и владеет уникальным в пределах процесса ненулевым synthetic source port до завершения relay. Это сохраняет один стабильный непересекающийся source/destination tuple для Direct и Middle-End KDF routing.

+HTTP idle accounting защищает только явно ограниченные фазы request body, long poll, подключения/response head decoy и ожидания Upgrade. Собственный deadline операции остаётся точным; если в этот момент её lease ещё существует, connection watchdog даёт запланированной задаче не более одного connection-idle interval для публикации timeout/result, после чего принудительно закрывает connection. Между обменами и после готовности response head прогресс сбрасывает idle-таймер, а зависший response body остаётся ограничен idle timeout. Завершение старой фазы не может снять deadline-защиту, которой уже владеет новая фаза.
+
+`OPEN` резервирует bounded ownership logical stream и tuple, но не занимает permit `max_connections` relay generation. Telemt получает этот permit только после первого внутреннего байта; замороженный first-byte deadline и stream limits ограничивают silent opens, а исчерпание capacity закрывает только затронутый stream.
+
 ## Управление через API

-Управление через API доступно, но намеренно ограничено. Изменяемого ресурса `/v1/web` нет; API-listener предоставляет read-only HTML debug view по адресу `/web-status`.
+Конфигурация WEB, статус runtime и bounded runtime-управление доступны на одном аутентифицированном API-listener. `/web-status` остаётся read-only HTML-диагностикой; операции, изменяющие состояние, существуют только под `/v1/runtime/web`.

 | Операция | Поддержка API |
 | --- | --- |
-| Чтение или изменение `[web]`, vhosts, profiles, decoys, timeouts или limits | Нет. `GET /v1/config` не возвращает `[web]`; `PATCH /v1/config` отвечает `400 section_not_editable` на ключ `web`. |
+| Чтение или изменение `[web]`, vhosts, profiles, decoys, timeouts или limits | Да, через `GET` или `PATCH /v1/config`. Производный snapshot `web.runtime` не возвращается и недоступен для записи. Вложенные tables сливаются по полям; arrays целиком заменяют прежний array. Любое изменение `[web.limits]` принимается как desired configuration, но помечается deferred до перезапуска процесса. |
 | Сохранение `server.listeners` | Да, через `PATCH /v1/config`, но изменённый WEB-listener остаётся deferred до перезапуска процесса. |
 | Применение WEB-конфигурации, изменённой вне API | Да, через `POST /v1/system/reload` с последующей проверкой статуса операции. |
 | Просмотр bounded серверных WEB request- и lifecycle-деталей | Да, через аутентифицированный `GET /web-status`. |
+| Просмотр lifecycle, capacity planes, состояния learning/debug и активных сессий | Да, через `GET /v1/runtime/web/status` и `/v1/runtime/web/sessions`. |
+| Закрытие выбранных активных WEB-сессий | Да, через асинхронную операцию `POST /v1/runtime/web/sessions/close`. |
+| Очистка debug-записей или сброс carrier learning | Да, через соответствующие runtime POST endpoints. |
 | Управление `[access.users]` | Да, через `/v1/users`. Создание пользователя не создаёт WEB-профиль. |
 | Отзыв отдельного пользователя | Да. `/v1/users/{username}/disable` немедленно обновляет admission и завершает активные сессии пользователя. |

@@ -230,6 +274,20 @@ read_only = false

 API whitelist проверяет непосредственный TCP peer и не доверяет `X-Forwarded-For`. Изменения самой секции `[server.api]` требуют перезапуска процесса.

+### Статус и управление runtime
+
+`GET /v1/runtime/web/status` всегда возвращает опубликованный lifecycle (`starting`, `no_web_listener`, `running`, `draining`, `drained` или `deadline_exceeded`), его epoch и возраст, эффективные адреса listeners и доступность. Пока process-owned WEB runtime существует, поле `runtime` добавляет случайный 128-битный `runtime_instance`, активное поколение, неизменяемые limits, capacity counters отдельных planes, epochs carrier-learning/debug и суммарные counters. Status собирается неблокирующим чтением каждого plane: занятый plane пропускается и указывается в `partial`; endpoint никогда не ожидает data plane, не выполняет cleanup и не изменяет его.
+
+`GET /v1/runtime/web/sessions` возвращает не более 50 сессий по умолчанию и не более 200 при заданном `limit`. Упорядоченный scan ограничен 1000 кандидатами. `cursor` и `session_ref` имеют opaque canonical вид `ws1.<runtime-instance>.<lowercase-hex-id>`; точный `session_ref` нельзя сочетать с `cursor` или `limit`. Доступны фильтры `ip`, `host`, `user`, `user_agent_id`, `key_id`, `carrier` и `state`; повторяющиеся или неизвестные query fields отклоняются. Детальная операция — `GET /v1/runtime/web/sessions/{session_ref}`. Сохранённый tombstone закрытой сессии возвращает `410`; занятый точный snapshot — `503 web_snapshot_busy`. Ответы содержат только bounded несекретные metadata и никогда не раскрывают bootstrap/session bearers, capabilities, hashes секретов или synthetic/KDF ports.
+
+Каждый runtime POST требует ровно `Content-Type: application/json`, отклоняет неизвестные JSON fields, наследует API authentication, whitelist и `read_only`, а также содержит текущий `runtime_instance` как ABA-fence. Доступные операции:
+
+- `POST /v1/runtime/web/sessions/close` с одним selector: `{"kind":"refs","session_refs":[...]}`, `{"kind":"filter",...}` или `{"kind":"all"}`. Точные refs ограничены 200, filter должен быть непустым, одновременно выполняется не более одной close operation, а `all` отклоняется, пока effective issuance включён. Ответ `202` содержит `operation_id`; опрашивайте `GET /v1/runtime/web/operations/{operation_id}`. Операция chunks по 128 сканирует только сессии не выше submission high-water mark.
+- `POST /v1/runtime/web/debug/clear` с `{"runtime_instance":"..."}`. Ответ содержит число удалённых записей, bytes, всё ещё удерживаемые уже отрисовываемыми snapshots, и новый epoch. In-flight writers старого epoch не могут снова заполнить ring.
+- `POST /v1/runtime/web/carrier-learning/reset` с тем же body. Операция очищает сохранённый process-local evidence и увеличивает learning epoch; уже замороженные attempt chains и активные сессии не изменяются.
+
+Для детерминированного close-all отправьте patch `{"web":{"enabled":false}}` с включённым runtime reload, дождитесь `runtime.manager.issuance_enabled = false`, отправьте selector `all` с тем же `runtime_instance` и опрашивайте operation до terminal state. Отключение WEB прекращает новую выдачу bootstrap/session credentials, но никогда не закрывает существующие сессии неявно.
+
 ### Серверная WEB-отладка

 Включите bounded сбор в конфигурационном файле, которому принадлежит эта секция:
@@ -248,7 +306,7 @@ default_window_secs = 180
 max_window_secs = 3600
 ```

-Откройте `http://127.0.0.1:9091/web-status`, используя те же whitelist непосредственных peers и точный header `Authorization`, что и для API. Завершающий slash разрешён. Допускается только `GET`. Страница поддерживает фильтры `window_secs`, канонический `ip`, числовой `session`, регистронезависимый `user_agent` и `key`. Повторяйте `group_by=ip`, `group_by=session`, `group_by=user_agent` или `group_by=key` для построения сгруппированных сводок; `limit` ограничен диапазоном `1..=1000`. HTTP rows раскрываются от request до response с method, path, очищенными headers, метаданными или байтами body, timing points, frames и типизированными lifecycle events. Для WebSocket добавляются очищенный handshake `GET` → `101` и bounded per-message direction, message type, payload/body capture, processing time, connection/lane identifiers и разобранные inner frames. Raw subprotocol и session tokens никогда не сохраняются.
+Откройте `http://127.0.0.1:9091/web-status`, используя те же whitelist непосредственных peers и точный header `Authorization`, что и для API. Завершающий slash разрешён. Допускается только `GET`. Страница поддерживает фильтры `window_secs`, канонический `ip`, числовой `session`, регистронезависимый `user_agent` и `key`. Повторяйте `group_by=ip`, `group_by=session`, `group_by=user_agent` или `group_by=key` для построения сгруппированных сводок; `limit` ограничен диапазоном `1..=1000`. HTTP rows раскрываются от request до response с method, path, очищенными headers, метаданными или байтами body, timing points, frames и типизированными lifecycle events, включая carrier attempt, commit, healthy и reported-failure transitions. Для WebSocket добавляются очищенный handshake `GET` → `101` и bounded per-message direction, message type, payload/body capture, processing time, connection/lane identifiers и разобранные inner frames. Raw subprotocol и session tokens никогда не сохраняются.

 Process-owned кольцевой буфер переживает замену runtime generation. Изменения capture policy очищают несовместимые сохранённые записи; изменения только окна наблюдения этого не делают. По умолчанию кольцо ограничено 65536 записями и 64 MiB сохранённых плюс находящихся в обработке данных, HTML-response — 8 MiB, grouping — 1024 группами; одновременно page permits могут удерживать не более двух response bodies. Изменяйте `web.limits.debug_records_capacity` или `web.limits.debug_bytes_global` только с перезапуском процесса. Hot prefix, который помещается только в одновременно увеличенную restart-only ёмкость, откладывается до этого перезапуска.

@@ -267,7 +325,7 @@ curl -sS http://127.0.0.1:9091/v1/system/reload/RELOAD_ID \
  -H "Authorization: ${TELEMT_API_AUTH}"
 ```

-Терминальный статус `succeeded` подтверждает активацию runtime. Изменённый `web.carrier` используют новые bridge sessions; существующие сессии не мигрируют. Если `deferred_process_fields` содержит `server.listeners` или `web.limits`, файл валиден и сохранён, но эти настройки всё ещё требуют перезапуска Telemt.
+Терминальный статус `succeeded` подтверждает активацию runtime. Изменённые carrier, candidates, deadlines или learning policy используют новые bridge sessions; существующие сессии и начатые attempt chains не мигрируют. Если `deferred_process_fields` содержит `server.listeners` или `web.limits`, файл валиден и сохранён, но эти настройки всё ещё требуют перезапуска Telemt.

 Операции с access users используют существующие endpoints, например:

@@ -291,7 +349,7 @@ curl -sS -X POST http://127.0.0.1:9091/v1/users/web-user/rotate-secret \
 - Отключите логирование request target и authorization на TLS-терминаторе либо используйте проверенный формат с редактированием. Raw queries содержат bridge capabilities, а `Authorization` — bootstrap или session bearer credentials.
 - Сохраняйте один стабильный публичный адрес на vhost. Если DNS возвращает несколько ingress addresses, каждый deployment должен использовать адрес своего внешнего пути.
 - Bootstrap- и session-registries локальны для процесса. Для multi-process или multi-host upstream pool нужна affinity всего vhost: bridge GET, создание сессии, uplink, downlink и DELETE. Одному процессу Telemt дополнительная affinity не нужна.
- Неиспользованный bootstrap переживает reload конфигурации, только если остаётся активной точная identity профиля: host, `public_addr`, user, secret mode, carrier и capability. Уже созданные sessions сохраняют неизменные carrier и identity профиля и остаются lifecycle-bounded.
+- Неиспользованный bootstrap переживает reload конфигурации, только если остаётся активной точная identity профиля: host, `public_addr`, user, secret mode, carrier candidates, negotiation deadlines и capability. Уже созданные sessions сохраняют неизменные carrier и identity профиля и остаются lifecycle-bounded.
 - Decoy входит в anti-probing contract. До распространения ссылок проверьте через публичный TLS endpoint его обычный ответ 404 и response timing.

 ## Первичная проверка
@@ -304,6 +362,7 @@ curl -sS -X POST http://127.0.0.1:9091/v1/users/web-user/rotate-secret \
 6. Для `websocket` подтвердите один response `101`, binary relay traffic и RFC 6455 Ping/Pong после 25 секунд. Для `websocket-lanes` проверьте как минимум два одновременных stream sockets и убедитесь, что закрытие или повреждение одной lane не закрывает sibling или parent session.
 7. Проверьте reconnect и как минимум один long poll длительнее 25 секунд, чтобы frontend timeouts не обрывали carrier.
 8. Проверяйте лимиты пользователя и logical MTProxy connections по logical-stream counters, а не по числу HTTP connections.
+9. При включённом auto-negotiation проверьте настроенную последовательность, replay точно той же попытки после намеренно потерянного response, terminal-поведение после commit и lifecycle rows `carrier_committed`/`carrier_healthy` в `/web-status`. Убедитесь, что нативный клиент без metadata использует фиксированный `carrier` без automatic response headers, а явные capabilities остаются неизменными.

 ## Диагностика

@@ -311,6 +370,8 @@ curl -sS -X POST http://127.0.0.1:9091/v1/users/web-user/rotate-secret \
 | --- | --- |
 | WEB-конфигурация валидна на диске, но поведение listener’а не изменилось | Проверьте `deferred_process_fields`; listener и `[web.limits]` требуют перезапуска. |
 | Carrier-запросы попадают в decoy | Проверьте точный vhost, secret mode ссылки, CIDR непосредственного proxy и единственное корректно разбираемое значение `X-Forwarded-For`. |
+| Downlink `https-lanes`, участвующий в гонке, попадает в decoy с `404` | Убедитесь, что он начинается с `X-Down-Cursor: 0`, сохраняйте `X-Lane-ID` и задайте `lane_open_wait_secs` выше наблюдаемого разрыва down-before-`OPEN`. Продвинутый cursor отсутствующей lane намеренно закрывается fail-closed. |
+| Auto-negotiation переходит дальше после уже принятого трафика | Такое поведение некорректно. Проверьте аутентифицированный replay `X-Carrier-State` и lifecycle row commit carrier; ответ `committed` или `healthy` terminal и требует новой сессии. |
 | Long polls разрываются через фиксированный интервал | Поднимите client, server, send и read timeouts NGINX/HAProxy выше `web.timeouts.long_poll_secs`. |
 | WebSocket Upgrade попадает в decoy вместо `101` | Сохраните HTTP/1.1 `Connection: Upgrade`, `Upgrade: websocket`, единственный точный `Sec-WebSocket-Protocol` и канонический bodyless request `/api/v1/ws`. Также проверьте соответствие carrier/session и process connection reserve. |
 | Один stream `websocket-lanes` закрылся, а siblings остались подключены | Это штатная failure boundary. Проверьте message/frame rows этой lane в `/web-status`; malformed, cross-lane, write-timeout и backend-close закрывают только затронутую lane. |
@@ -447,9 +447,9 @@ check_port_availability() {
    port_info=""

    if command -v ss >/dev/null 2>&1; then
-        port_info=$($SUDO ss -tulnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
+        port_info=$($SUDO ss -tlnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
    elif command -v netstat >/dev/null 2>&1; then
-        port_info=$($SUDO netstat -tulnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
+        port_info=$($SUDO netstat -tlnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
    elif command -v lsof >/dev/null 2>&1; then
        port_info=$($SUDO lsof -i :${SERVER_PORT} 2>/dev/null | grep LISTEN || true)
    else
@@ -6,34 +6,50 @@ use serde_json::Value as Json;
 use toml::Value as Toml;

 use super::ApiShared;
+#[cfg(test)]
+use super::config_store::write_atomic;
 use super::config_store::{
    EDITABLE_SECTIONS, EDITABLE_SERVER_FIELDS, compute_snapshot_revision, is_editable_section,
    load_candidate_snapshot, load_config_snapshot, render_server_listeners,
-    render_top_level_section, resolve_single_source_owner, upsert_toml_table, write_atomic,
+    render_top_level_section, resolve_single_source_owner, upsert_toml_table,
+    write_atomic_if_unchanged,
 };
 use super::model::ApiFailure;
 use crate::config::ProxyConfig;
 use crate::config::hot_reload::classify_config_changes;
 use crate::maestro::reload::{ReloadAccepted, ReloadRequest, ReloadSubmitError};
-use crate::maestro::runtime_build::{deferred_process_fields, resolve_reload_config};
+use crate::maestro::runtime_build::{
+    ResolvedReloadConfig, deferred_process_fields, resolve_reload_config,
+};
 use serde::Serialize;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;

+/// Result of one validated managed-config mutation.
 #[derive(Debug, Serialize)]
 pub(super) struct PatchConfigResponse {
+    /// Revision of the persisted desired configuration.
    pub revision: String,
+    /// Whether any changed field is not hot-reloadable.
    pub restart_required: bool,
+    /// Whether the effective runtime snapshot must be reloaded.
    pub runtime_reload_required: bool,
+    /// Whether any desired field remains deferred until process restart.
    pub process_restart_required: bool,
+    /// Stable paths of desired fields retained from the active process.
    pub deferred_process_fields: Vec<String>,
+    /// Top-level managed sections changed by the mutation.
    pub changed: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
+    /// Accepted runtime reload when one was requested and required.
    pub reload: Option<ReloadAccepted>,
 }

 struct PreparedConfigPatch {
+    config_path: PathBuf,
+    expected_revision: String,
    owner_path: PathBuf,
+    expected_owner_contents: String,
    owner_contents: String,
    desired_config: Arc<ProxyConfig>,
    response: PatchConfigResponse,
@@ -46,15 +62,31 @@ pub(super) async fn patch_config(
    expected_revision: Option<String>,
    reload_request: Option<ReloadRequest>,
    shared: &ApiShared,
+) -> Result<PatchConfigResponse, ApiFailure> {
+    let shared = shared.clone();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            patch_config_to_completion(patch_json, expected_revision, reload_request, &shared).await
+        })
+        .await
+}
+
+async fn patch_config_to_completion(
+    patch_json: Json,
+    expected_revision: Option<String>,
+    reload_request: Option<ReloadRequest>,
+    shared: &ApiShared,
 ) -> Result<PatchConfigResponse, ApiFailure> {
    let _guard = shared.mutation_lock.lock().await;
    let active_config = shared.active_runtime.load_full().config();
    let mut prepared =
        prepare_patch_to_path(&shared.config_path, &patch_json, expected_revision).await?;
-    let resolved = resolve_reload_config(&active_config, &prepared.desired_config);
-    prepared.response.runtime_reload_required = resolved.runtime_changed;
-    prepared.response.process_restart_required = !resolved.deferred_process_fields.is_empty();
-    prepared.response.deferred_process_fields = resolved.deferred_process_fields;
+    let resolved = reconcile_runtime_effect(
+        &mut prepared.response,
+        &active_config,
+        &prepared.desired_config,
+    )?;
    let reservation = if let Some(request) = reload_request.filter(|_| resolved.runtime_changed) {
        Some(
            shared
@@ -66,7 +98,14 @@ pub(super) async fn patch_config(
    } else {
        None
    };
-    write_atomic(prepared.owner_path, prepared.owner_contents).await?;
+    prepared.response.revision = write_atomic_if_unchanged(
+        prepared.config_path,
+        prepared.expected_revision,
+        prepared.owner_path,
+        prepared.expected_owner_contents,
+        prepared.owner_contents,
+    )
+    .await?;
    if let Some(reservation) = reservation {
        prepared.response.reload = Some(reservation.enqueue(prepared.desired_config));
    }
@@ -78,6 +117,19 @@ pub(super) async fn patch_config(
    Ok(resp)
 }

+fn reconcile_runtime_effect(
+    response: &mut PatchConfigResponse,
+    active_config: &ProxyConfig,
+    desired_config: &ProxyConfig,
+) -> Result<ResolvedReloadConfig, ApiFailure> {
+    let resolved =
+        resolve_reload_config(active_config, desired_config).map_err(ApiFailure::bad_request)?;
+    response.runtime_reload_required = resolved.runtime_changed;
+    response.process_restart_required = !resolved.deferred_process_fields.is_empty();
+    response.deferred_process_fields = resolved.deferred_process_fields.clone();
+    Ok(resolved)
+}
+
 /// Core patch logic, decoupled from hyper/shared-state so it is unit-testable
 /// against a temp file. The route handler holds `mutation_lock` while calling this.
 #[cfg(test)]
@@ -86,8 +138,16 @@ pub(super) async fn apply_patch_to_path(
    patch_json: &Json,
    expected_revision: Option<String>,
 ) -> Result<PatchConfigResponse, ApiFailure> {
-    let prepared = prepare_patch_to_path(config_path, patch_json, expected_revision).await?;
-    write_atomic(prepared.owner_path, prepared.owner_contents).await?;
+    let mut prepared = prepare_patch_to_path(config_path, patch_json, expected_revision).await?;
+    let revision = write_atomic_if_unchanged(
+        prepared.config_path,
+        prepared.expected_revision,
+        prepared.owner_path,
+        prepared.expected_owner_contents,
+        prepared.owner_contents,
+    )
+    .await?;
+    prepared.response.revision = revision;
    Ok(prepared.response)
 }

@@ -173,6 +233,7 @@ async fn prepare_patch_to_path(
        .get(&owner_path)
        .cloned()
        .ok_or_else(|| ApiFailure::internal("config source owner is missing from snapshot"))?;
+    let expected_owner_contents = owner_contents.clone();
    for section in &touched {
        if *section == "server" {
            let rendered = render_server_listeners(&requested_cfg)?;
@@ -205,10 +266,14 @@ async fn prepare_patch_to_path(
    let revision = compute_snapshot_revision(&candidate);
    let new_cfg = candidate.config;
    let class = classify_config_changes(&old_cfg, &new_cfg);
-    let deferred_process_fields = deferred_process_fields(&old_cfg, &new_cfg);
+    let deferred_process_fields =
+        deferred_process_fields(&old_cfg, &new_cfg).map_err(ApiFailure::bad_request)?;

    Ok(PreparedConfigPatch {
+        config_path: config_path.to_path_buf(),
+        expected_revision: current,
        owner_path,
+        expected_owner_contents,
        owner_contents,
        desired_config: Arc::new(new_cfg),
        response: PatchConfigResponse {
@@ -238,7 +303,7 @@ fn reload_submit_failure(error: ReloadSubmitError) -> ApiFailure {
    }
 }

-/// Return only the editable config sections + current revision.
+/// Returns only the editable config sections and current revision.
 pub(super) async fn read_managed_config(config_path: &Path) -> Result<(Toml, String), ApiFailure> {
    let loaded = load_config_snapshot(config_path, false).await?;
    let revision = compute_snapshot_revision(&loaded);
@@ -382,6 +447,9 @@ fn deep_merge(base: &mut Toml, patch: &Toml) {
    }
 }

+#[cfg(test)]
+#[path = "config_edit/base_path_tests.rs"]
+mod base_path_tests;
 #[cfg(test)]
 #[path = "config_edit/tests.rs"]
 mod tests;
@@ -0,0 +1,88 @@
+use super::*;
+
+fn web_config() -> &'static str {
+    r#"
+[access.users]
+alice = "000102030405060708090a0b0c0d0e0f"
+
+[[server.listeners]]
+ip = "127.0.0.1"
+port = 18080
+transport = "web"
+proxy_protocol = false
+web_client_ip_source = "x_forwarded_for"
+web_trusted_proxy_cidrs = ["127.0.0.1/32"]
+
+[web]
+enabled = true
+
+[[web.vhosts]]
+host = "proxy.example.com"
+public_addr = "203.0.113.10:443"
+
+[web.vhosts.decoy]
+mode = "http_upstream"
+upstream = "http://127.0.0.1:18081"
+
+[[web.vhosts.profiles]]
+user = "alice"
+secret_mode = "plain"
+"#
+}
+
+fn vhosts_patch(base_path: &str) -> Json {
+    serde_json::json!({
+        "web": {
+            "vhosts": [{
+                "host": "proxy.example.com",
+                "base_path": base_path,
+                "public_addr": "203.0.113.10:443",
+                "decoy": {
+                    "mode": "http_upstream",
+                    "upstream": "http://127.0.0.1:18081"
+                },
+                "profiles": [{
+                    "user": "alice",
+                    "secret_mode": "plain"
+                }]
+            }]
+        }
+    })
+}
+
+#[tokio::test]
+async fn config_api_applies_valid_base_path_and_preserves_source_on_invalid_patch() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("config.toml");
+    std::fs::write(&path, web_config()).unwrap();
+    let active = ProxyConfig::load(&path).unwrap();
+
+    let mut response = apply_patch_to_path(&path, &vhosts_patch("MixedCase/path"), None)
+        .await
+        .unwrap();
+    let desired = ProxyConfig::load(&path).unwrap();
+    let resolved = reconcile_runtime_effect(&mut response, &active, &desired).unwrap();
+    assert!(!response.restart_required);
+    assert!(response.runtime_reload_required);
+    assert!(!response.process_restart_required);
+    assert!(response.deferred_process_fields.is_empty());
+    assert!(resolved.runtime_changed);
+    assert_eq!(desired.web.vhosts[0].base_path, "MixedCase/path");
+    assert_eq!(
+        resolved.effective.web.runtime.as_ref().unwrap().vhosts["proxy.example.com"].base,
+        "/MixedCase/path/"
+    );
+
+    let (managed, _revision) = read_managed_config(&path).await.unwrap();
+    let vhosts = managed["web"]["vhosts"].as_array().unwrap();
+    assert_eq!(vhosts[0]["base_path"].as_str(), Some("MixedCase/path"));
+    assert!(managed["web"].get("runtime").is_none());
+    assert!(!managed.as_table().unwrap().contains_key("access"));
+
+    let before_invalid = std::fs::read(&path).unwrap();
+    let error = apply_patch_to_path(&path, &vhosts_patch("/invalid"), None)
+        .await
+        .unwrap_err();
+    assert_eq!(error.status, hyper::StatusCode::BAD_REQUEST);
+    assert_eq!(std::fs::read(&path).unwrap(), before_invalid);
+}
@@ -87,6 +87,95 @@ async fn read_managed_config_strips_access() {
    );
 }

+#[tokio::test]
+async fn read_managed_config_exposes_web_without_runtime_or_access_secrets() {
+    let (path, _directory) = temp_config(concat!(
+        "[web]\nenabled = false\ncarrier = \"https\"\n",
+        "[web.debug]\nenabled = true\ndefault_window_secs = 180\n",
+        "[access.users]\nbob = \"00000000000000000000000000000000\"\n",
+    ));
+
+    let (value, _revision) = read_managed_config(&path).await.unwrap();
+    let table = value.as_table().unwrap();
+
+    assert!(table.contains_key("web"));
+    assert!(table["web"].get("debug").is_some());
+    assert!(table["web"].get("runtime").is_none());
+    assert!(!table.contains_key("access"));
+}
+
+#[tokio::test]
+async fn patch_web_debug_is_hot_and_limits_are_process_deferred() {
+    let (path, _directory) = temp_config("[web]\nenabled = false\n");
+    let active = ProxyConfig::load(&path).unwrap();
+    let debug_patch: Json = serde_json::json!({
+        "web": {"debug": {
+            "enabled": true,
+            "sideband": true,
+            "capture_headers": false
+        }}
+    });
+    let mut debug = apply_patch_to_path(&path, &debug_patch, None)
+        .await
+        .unwrap();
+    let desired = ProxyConfig::load(&path).unwrap();
+    reconcile_runtime_effect(&mut debug, &active, &desired).unwrap();
+    assert!(!debug.restart_required);
+    assert!(debug.runtime_reload_required);
+    assert!(!debug.process_restart_required);
+    assert!(debug.changed.iter().any(|section| section == "web"));
+    assert!(desired.web.debug.sideband);
+
+    let limits_patch: Json = serde_json::json!({
+        "web": {"limits": {"max_http_connections": 2049}}
+    });
+    let limits = apply_patch_to_path(&path, &limits_patch, None)
+        .await
+        .unwrap();
+    assert!(limits.process_restart_required);
+    assert!(
+        limits
+            .deferred_process_fields
+            .iter()
+            .any(|field| field == "web.limits")
+    );
+}
+
+#[tokio::test]
+async fn patch_web_decoy_fasttrack_requires_only_process_restart() {
+    let (path, _directory) = temp_config("[web]\nenabled = false\n");
+    let active = ProxyConfig::load(&path).unwrap();
+    let patch: Json = serde_json::json!({
+        "web": {"decoy_fasttrack_mode": "shadow"}
+    });
+
+    let mut prepared = prepare_patch_to_path(&path, &patch, None).await.unwrap();
+    reconcile_runtime_effect(&mut prepared.response, &active, &prepared.desired_config).unwrap();
+    let response = prepared.response;
+
+    assert!(response.restart_required);
+    assert!(!response.runtime_reload_required);
+    assert!(response.process_restart_required);
+    assert_eq!(
+        response.deferred_process_fields,
+        vec!["web.decoy_fasttrack_mode".to_string()]
+    );
+}
+
+#[tokio::test]
+async fn invalid_web_patch_does_not_modify_the_source() {
+    let (path, _directory) = temp_config("[web]\nenabled = false\n");
+    let original = tokio::fs::read_to_string(&path).await.unwrap();
+    let patch: Json = serde_json::json!({
+        "web": {"debug": {"default_window_secs": 181, "max_window_secs": 180}}
+    });
+
+    let error = apply_patch_to_path(&path, &patch, None).await.unwrap_err();
+
+    assert_eq!(error.status, hyper::StatusCode::BAD_REQUEST);
+    assert_eq!(tokio::fs::read_to_string(&path).await.unwrap(), original);
+}
+
 #[tokio::test]
 async fn read_managed_config_returns_only_editable_sections() {
    // Full server (api/port) and network must not leak. Listeners-only server
@@ -234,6 +323,30 @@ async fn patch_writes_the_included_section_owner_only() {
    );
 }

+#[tokio::test]
+async fn prepared_patch_rejects_external_edit_before_commit() {
+    let (path, _directory) = temp_config("[censorship]\ntls_domain = \"old.example\"\n");
+    let patch: Json = serde_json::json!({
+        "censorship": {"tls_domain": "api.example"}
+    });
+    let prepared = prepare_patch_to_path(&path, &patch, None).await.unwrap();
+    let external = "[censorship]\ntls_domain = \"external.example\"\n";
+    tokio::fs::write(&path, external).await.unwrap();
+
+    let error = write_atomic_if_unchanged(
+        prepared.config_path,
+        prepared.expected_revision,
+        prepared.owner_path,
+        prepared.expected_owner_contents,
+        prepared.owner_contents,
+    )
+    .await
+    .unwrap_err();
+
+    assert_eq!(error.code, "revision_conflict");
+    assert_eq!(tokio::fs::read_to_string(&path).await.unwrap(), external);
+}
+
 #[tokio::test]
 async fn patch_rejects_multiple_source_owners_without_writing() {
    let dir = tempfile::tempdir().unwrap();
@@ -10,12 +10,15 @@ use super::model::ApiFailure;

 // Source-preserving TOML rendering and atomic persistence helpers.
 mod persistence;
+// Compare-and-replace file persistence and metadata preservation.
+mod atomic;

+pub(in crate::api) use atomic::{write_atomic, write_atomic_if_unchanged};
 #[cfg(test)]
 use persistence::{find_toml_table_bounds, render_access_section, save_sections_to_disk};
 pub(in crate::api) use persistence::{
    render_server_listeners, render_top_level_section, save_access_sections_to_disk,
-    upsert_toml_table, write_atomic,
+    save_access_sections_to_disk_if_revision, upsert_toml_table,
 };

 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -54,22 +57,21 @@ pub(super) fn parse_if_match(headers: &hyper::HeaderMap) -> Option<String> {
        .map(|value| value.trim_matches('"').to_string())
 }

-pub(super) async fn ensure_expected_revision(
+/// Loads one mutation base and validates its revision from the same source snapshot.
+pub(super) async fn load_config_for_mutation(
    config_path: &Path,
    expected_revision: Option<&str>,
-) -> Result<(), ApiFailure> {
-    let Some(expected) = expected_revision else {
-        return Ok(());
-    };
-    let current = current_revision(config_path).await?;
-    if current != expected {
+) -> Result<(ProxyConfig, String), ApiFailure> {
+    let loaded = load_config_snapshot(config_path, false).await?;
+    let revision = compute_snapshot_revision(&loaded);
+    if expected_revision.is_some_and(|expected| expected != revision) {
        return Err(ApiFailure::new(
            hyper::StatusCode::CONFLICT,
            "revision_conflict",
            "Config revision mismatch",
        ));
    }
-    Ok(())
+    Ok((loaded.config, revision))
 }

 pub(super) async fn current_revision(config_path: &Path) -> Result<String, ApiFailure> {
@@ -243,15 +245,24 @@ pub(super) async fn load_candidate_snapshot(
 }

 fn normalize_source_path(path: &Path) -> PathBuf {
-    path.canonicalize().unwrap_or_else(|_| {
-        if path.is_absolute() {
-            path.to_path_buf()
-        } else {
-            std::env::current_dir()
-                .map(|cwd| cwd.join(path))
-                .unwrap_or_else(|_| path.to_path_buf())
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()
+            .map(|cwd| cwd.join(path))
+            .unwrap_or_else(|_| path.to_path_buf())
+    };
+    let mut normalized = PathBuf::new();
+    for component in absolute.components() {
+        match component {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                normalized.pop();
+            }
+            component => normalized.push(component.as_os_str()),
        }
-    })
+    }
+    normalized
 }

 pub(super) async fn load_config_from_disk(config_path: &Path) -> Result<ProxyConfig, ApiFailure> {
@@ -262,12 +273,12 @@ pub(super) async fn load_config_from_disk(config_path: &Path) -> Result<ProxyCon
        .map_err(|e| ApiFailure::internal(format!("failed to load config: {}", e)))
 }

-pub(super) async fn load_config_for_reload(config_path: &Path) -> Result<ProxyConfig, ApiFailure> {
-    let config_path = config_path.to_path_buf();
-    tokio::task::spawn_blocking(move || ProxyConfig::load(config_path))
-        .await
-        .map_err(|error| ApiFailure::internal(format!("failed to join config loader: {}", error)))?
-        .map_err(|error| ApiFailure::bad_request(format!("invalid runtime config: {}", error)))
+pub(super) async fn load_config_for_reload(
+    config_path: &Path,
+) -> Result<(ProxyConfig, String), ApiFailure> {
+    let loaded = load_config_snapshot(config_path, true).await?;
+    let revision = compute_snapshot_revision(&loaded);
+    Ok((loaded.config, revision))
 }

 #[allow(dead_code)]
@@ -307,6 +318,7 @@ pub(super) const EDITABLE_SECTIONS: &[&str] = &[
    "censorship",
    "upstreams",
    "dc_overrides",
+    "web",
 ];

 /// Nested fields under `[server]` that may be read/patched via the config API.
@@ -0,0 +1,432 @@
+use std::fs::File;
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+
+#[cfg(unix)]
+use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+#[cfg(unix)]
+use nix::fcntl::{Flock, FlockArg, OFlag, openat, renameat};
+#[cfg(unix)]
+use nix::sys::stat::Mode;
+#[cfg(unix)]
+use nix::unistd::{UnlinkatFlags, fsync, unlinkat};
+#[cfg(unix)]
+use tracing::warn;
+
+use super::compute_source_revision;
+use crate::api::model::ApiFailure;
+use crate::config::ProxyConfig;
+#[cfg(unix)]
+use crate::util::secure_fs::AnchoredPath;
+
+const MAX_CONFIG_SOURCE_BYTES: u64 = 8 * 1024 * 1024;
+
+enum AtomicWriteError {
+    Conflict,
+    ReadGraph(String),
+    Io(std::io::Error),
+}
+
+struct ExistingTarget {
+    contents: String,
+    metadata: std::fs::Metadata,
+}
+
+struct GraphFence<'a> {
+    config_path: &'a Path,
+    expected_revision: &'a str,
+}
+
+struct ConfigWriteLock {
+    #[cfg(unix)]
+    _file: Flock<File>,
+}
+
+impl ConfigWriteLock {
+    fn acquire(path: &Path) -> std::io::Result<Self> {
+        let path = normalize_path(path);
+        #[cfg(unix)]
+        {
+            let lock_path = sibling_lock_path(&path);
+            let anchored = AnchoredPath::open_creating_parents(&lock_path, 0o750)?;
+            let descriptor = openat(
+                anchored.parent(),
+                anchored.name(),
+                OFlag::O_RDWR | OFlag::O_CREAT | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC,
+                Mode::from_bits_truncate(0o600),
+            )
+            .map_err(errno_to_io)?;
+            let file = File::from(descriptor);
+            let metadata = file.metadata()?;
+            if !metadata.is_file() || metadata.nlink() != 1 {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::InvalidInput,
+                    "config lock must be a regular file with one directory entry",
+                ));
+            }
+            let file = Flock::lock(file, FlockArg::LockExclusive)
+                .map_err(|(_, error)| errno_to_io(error))?;
+            Ok(Self { _file: file })
+        }
+        #[cfg(not(unix))]
+        {
+            let _ = path;
+            Ok(Self {})
+        }
+    }
+}
+
+/// Replaces one config source through a same-directory rename after syncing file data.
+pub(in crate::api) async fn write_atomic(
+    path: PathBuf,
+    contents: String,
+) -> Result<(), ApiFailure> {
+    tokio::task::spawn_blocking(move || {
+        let _lock = ConfigWriteLock::acquire(&path)?;
+        write_atomic_sync(&path, None, &contents, None).map(|_| ())
+    })
+    .await
+    .map_err(|error| ApiFailure::internal(format!("failed to join writer: {error}")))?
+    .map_err(|error| ApiFailure::internal(format!("failed to write config: {error}")))
+}
+
+/// Replaces one source only if both its graph revision and owner contents are unchanged.
+pub(in crate::api) async fn write_atomic_if_unchanged(
+    config_path: PathBuf,
+    expected_revision: String,
+    path: PathBuf,
+    expected_contents: String,
+    contents: String,
+) -> Result<String, ApiFailure> {
+    tokio::task::spawn_blocking(move || {
+        let config_path = normalize_path(&config_path);
+        let path = normalize_path(&path);
+        // Every API mutation locks the root source so writes to different includes serialize.
+        let _lock = ConfigWriteLock::acquire(&config_path).map_err(AtomicWriteError::Io)?;
+        let graph = ProxyConfig::read_source_graph(&config_path)
+            .map_err(|error| AtomicWriteError::ReadGraph(error.to_string()))?;
+        if compute_source_revision(&graph) != expected_revision {
+            return Err(AtomicWriteError::Conflict);
+        }
+        write_atomic_sync(
+            &path,
+            Some(&expected_contents),
+            &contents,
+            Some(GraphFence {
+                config_path: &config_path,
+                expected_revision: &expected_revision,
+            }),
+        )
+        .map_err(|error| {
+            if error.kind() == std::io::ErrorKind::AlreadyExists {
+                AtomicWriteError::Conflict
+            } else {
+                AtomicWriteError::Io(error)
+            }
+        })?
+        .ok_or_else(|| {
+            AtomicWriteError::Io(std::io::Error::other(
+                "config graph fence did not produce a committed revision",
+            ))
+        })
+    })
+    .await
+    .map_err(|error| ApiFailure::internal(format!("failed to join writer: {error}")))?
+    .map_err(|error| match error {
+        AtomicWriteError::Conflict => revision_conflict(),
+        AtomicWriteError::ReadGraph(error) => {
+            ApiFailure::internal(format!("failed to verify config graph: {error}"))
+        }
+        AtomicWriteError::Io(error) => {
+            ApiFailure::internal(format!("failed to write config: {error}"))
+        }
+    })
+}
+
+fn revision_conflict() -> ApiFailure {
+    ApiFailure::new(
+        hyper::StatusCode::CONFLICT,
+        "revision_conflict",
+        "Config revision changed before persistence",
+    )
+}
+
+fn sibling_lock_path(path: &Path) -> PathBuf {
+    let mut name = path
+        .file_name()
+        .unwrap_or_else(|| std::ffi::OsStr::new("config.toml"))
+        .to_os_string();
+    name.push(".lock");
+    path.parent().unwrap_or_else(|| Path::new(".")).join(name)
+}
+
+fn normalize_path(path: &Path) -> PathBuf {
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()
+            .map(|current| current.join(path))
+            .unwrap_or_else(|_| path.to_path_buf())
+    };
+    let mut normalized = PathBuf::new();
+    for component in absolute.components() {
+        match component {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                normalized.pop();
+            }
+            component => normalized.push(component.as_os_str()),
+        }
+    }
+    normalized
+}
+
+fn fenced_post_commit_revision(
+    fence: GraphFence<'_>,
+    path: &Path,
+    contents: &str,
+) -> std::io::Result<String> {
+    let mut graph = ProxyConfig::read_source_graph(fence.config_path)
+        .map_err(|error| std::io::Error::other(error.to_string()))?;
+    if compute_source_revision(&graph) != fence.expected_revision {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::AlreadyExists,
+            "config graph changed during persistence",
+        ));
+    }
+    let path = normalize_path(path);
+    let Some(owner) = graph.source_contents.get_mut(&path) else {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "config source owner left the source graph during persistence",
+        ));
+    };
+    *owner = contents.to_string();
+    Ok(compute_source_revision(&graph))
+}
+
+#[cfg(unix)]
+fn open_existing_target(anchored: &AnchoredPath) -> std::io::Result<Option<ExistingTarget>> {
+    let descriptor = match openat(
+        anchored.parent(),
+        anchored.name(),
+        OFlag::O_RDONLY | OFlag::O_NONBLOCK | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC,
+        Mode::empty(),
+    ) {
+        Ok(descriptor) => descriptor,
+        Err(nix::errno::Errno::ENOENT) => return Ok(None),
+        Err(error) => return Err(errno_to_io(error)),
+    };
+    let mut file = File::from(descriptor);
+    let metadata = file.metadata()?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.len() > MAX_CONFIG_SOURCE_BYTES {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "config target must be a bounded regular file with one directory entry",
+        ));
+    }
+    let mut contents = String::with_capacity(metadata.len() as usize);
+    Read::take(&mut file, MAX_CONFIG_SOURCE_BYTES + 1).read_to_string(&mut contents)?;
+    if contents.len() as u64 > MAX_CONFIG_SOURCE_BYTES {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            "config target exceeds the source size limit",
+        ));
+    }
+    let completed = file.metadata()?;
+    if !same_target(&metadata, &completed) || metadata.len() != completed.len() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            "config target changed while it was read",
+        ));
+    }
+    Ok(Some(ExistingTarget { contents, metadata }))
+}
+
+#[cfg(not(unix))]
+fn open_existing_target(path: &Path) -> std::io::Result<Option<ExistingTarget>> {
+    let mut file = match File::open(path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(error),
+    };
+    let metadata = file.metadata()?;
+    if !metadata.is_file() || metadata.len() > MAX_CONFIG_SOURCE_BYTES {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "config target must be a bounded regular file",
+        ));
+    }
+    let mut contents = String::new();
+    file.read_to_string(&mut contents)?;
+    Ok(Some(ExistingTarget { contents, metadata }))
+}
+
+fn same_target(left: &std::fs::Metadata, right: &std::fs::Metadata) -> bool {
+    #[cfg(unix)]
+    {
+        left.dev() == right.dev() && left.ino() == right.ino()
+    }
+    #[cfg(not(unix))]
+    {
+        left.len() == right.len() && left.modified().ok() == right.modified().ok()
+    }
+}
+
+#[cfg(unix)]
+fn write_atomic_sync(
+    path: &Path,
+    expected_contents: Option<&str>,
+    contents: &str,
+    graph_fence: Option<GraphFence<'_>>,
+) -> std::io::Result<Option<String>> {
+    let anchored = AnchoredPath::open_creating_parents(path, 0o750)?;
+    let existing = open_existing_target(&anchored)?;
+    validate_expected_contents(existing.as_ref(), expected_contents)?;
+    let temp_name = format!(
+        ".{}.tmp-{}",
+        path.file_name()
+            .and_then(|name| name.to_str())
+            .unwrap_or("config.toml"),
+        rand::random::<u64>()
+    );
+    let descriptor = openat(
+        anchored.parent(),
+        temp_name.as_str(),
+        OFlag::O_WRONLY | OFlag::O_CREAT | OFlag::O_EXCL | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC,
+        Mode::from_bits_truncate(0o600),
+    )
+    .map_err(errno_to_io)?;
+    let write_result = write_and_publish(
+        descriptor,
+        path,
+        &anchored,
+        &temp_name,
+        existing.as_ref(),
+        contents,
+        graph_fence,
+    );
+    if write_result.is_err() {
+        let _ = unlinkat(
+            anchored.parent(),
+            temp_name.as_str(),
+            UnlinkatFlags::NoRemoveDir,
+        );
+    }
+    write_result
+}
+
+#[cfg(unix)]
+fn write_and_publish(
+    descriptor: std::os::fd::OwnedFd,
+    path: &Path,
+    anchored: &AnchoredPath,
+    temp_name: &str,
+    existing: Option<&ExistingTarget>,
+    contents: &str,
+    graph_fence: Option<GraphFence<'_>>,
+) -> std::io::Result<Option<String>> {
+    let mut file = File::from(descriptor);
+    if let Some(existing) = existing {
+        use nix::unistd::{Gid, Uid, fchown};
+
+        fchown(
+            &file,
+            Some(Uid::from_raw(existing.metadata.uid())),
+            Some(Gid::from_raw(existing.metadata.gid())),
+        )
+        .map_err(errno_to_io)?;
+        file.set_permissions(std::fs::Permissions::from_mode(
+            existing.metadata.mode() & 0o7777,
+        ))?;
+    }
+    file.write_all(contents.as_bytes())?;
+    file.sync_all()?;
+    let current = open_existing_target(anchored)?;
+    if !target_unchanged(existing, current.as_ref()) {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::AlreadyExists,
+            "config target changed during persistence",
+        ));
+    }
+    let committed_revision = graph_fence
+        .map(|fence| fenced_post_commit_revision(fence, path, contents))
+        .transpose()?;
+    renameat(
+        anchored.parent(),
+        temp_name,
+        anchored.parent(),
+        anchored.name(),
+    )
+    .map_err(errno_to_io)?;
+    // Rename is the commit boundary. A later directory-sync error cannot be reported as an
+    // uncommitted mutation because mandatory in-process publication must still run.
+    if let Err(error) = fsync(anchored.parent()).map_err(errno_to_io) {
+        warn!(
+            path = %path.display(),
+            %error,
+            "Config rename committed but directory durability sync failed"
+        );
+    }
+    Ok(committed_revision)
+}
+
+#[cfg(not(unix))]
+fn write_atomic_sync(
+    path: &Path,
+    expected_contents: Option<&str>,
+    contents: &str,
+    graph_fence: Option<GraphFence<'_>>,
+) -> std::io::Result<Option<String>> {
+    let parent = path.parent().unwrap_or_else(|| Path::new("."));
+    std::fs::create_dir_all(parent)?;
+    let existing = open_existing_target(path)?;
+    validate_expected_contents(existing.as_ref(), expected_contents)?;
+    let temp = parent.join(format!(".telemt.tmp-{}", rand::random::<u64>()));
+    std::fs::write(&temp, contents)?;
+    let current = open_existing_target(path)?;
+    if !target_unchanged(existing.as_ref(), current.as_ref()) {
+        let _ = std::fs::remove_file(&temp);
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::AlreadyExists,
+            "config target changed during persistence",
+        ));
+    }
+    let committed_revision = graph_fence
+        .map(|fence| fenced_post_commit_revision(fence, path, contents))
+        .transpose()?;
+    std::fs::rename(temp, path)?;
+    Ok(committed_revision)
+}
+
+fn validate_expected_contents(
+    existing: Option<&ExistingTarget>,
+    expected_contents: Option<&str>,
+) -> std::io::Result<()> {
+    if expected_contents
+        .is_some_and(|expected| existing.is_none_or(|target| target.contents != expected))
+    {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::AlreadyExists,
+            "config source changed before persistence",
+        ));
+    }
+    Ok(())
+}
+
+fn target_unchanged(existing: Option<&ExistingTarget>, current: Option<&ExistingTarget>) -> bool {
+    match (existing, current) {
+        (Some(expected), Some(current)) => {
+            same_target(&expected.metadata, &current.metadata)
+                && expected.contents == current.contents
+        }
+        (None, None) => true,
+        _ => false,
+    }
+}
+
+#[cfg(unix)]
+fn errno_to_io(error: nix::errno::Errno) -> std::io::Error {
+    std::io::Error::from_raw_os_error(error as i32)
+}
@@ -1,12 +1,14 @@
 use std::collections::BTreeMap;
-use std::io::Write;
-use std::path::{Path, PathBuf};
+use std::path::Path;

 use chrono::{DateTime, Utc};
 use serde::Serialize;

 use crate::config::{ProxyConfig, RateLimitBps};

+#[cfg(test)]
+use super::atomic::write_atomic;
+use super::atomic::write_atomic_if_unchanged;
 #[cfg(test)]
 use super::compute_revision;
 use super::{
@@ -99,8 +101,22 @@ pub(in crate::api) async fn save_access_sections_to_disk(
    config_path: &Path,
    cfg: &ProxyConfig,
    sections: &[AccessSection],
+) -> Result<String, ApiFailure> {
+    save_access_sections_to_disk_if_revision(config_path, cfg, sections, None).await
+}
+
+/// Persists access tables only while the complete source graph remains unchanged.
+pub(in crate::api) async fn save_access_sections_to_disk_if_revision(
+    config_path: &Path,
+    cfg: &ProxyConfig,
+    sections: &[AccessSection],
+    expected_revision: Option<&str>,
 ) -> Result<String, ApiFailure> {
    let loaded = load_config_snapshot(config_path, false).await?;
+    let loaded_revision = compute_snapshot_revision(&loaded);
+    if expected_revision.is_some_and(|expected| expected != loaded_revision) {
+        return Err(revision_conflict());
+    }
    let mut applied = Vec::new();
    for section in sections {
        if applied.contains(section) {
@@ -117,7 +133,7 @@ pub(in crate::api) async fn save_access_sections_to_disk(
            })
    });
    if applied.is_empty() {
-        return Ok(compute_snapshot_revision(&loaded));
+        return Ok(loaded_revision);
    }

    let targets = applied
@@ -130,6 +146,7 @@ pub(in crate::api) async fn save_access_sections_to_disk(
        .get(&owner_path)
        .cloned()
        .ok_or_else(|| ApiFailure::internal("config source owner is missing from snapshot"))?;
+    let expected_owner_contents = owner_contents.clone();
    for section in applied {
        let rendered = render_access_section(cfg, section)?;
        owner_contents = upsert_toml_table(&owner_contents, section.table_name(), &rendered);
@@ -142,8 +159,15 @@ pub(in crate::api) async fn save_access_sections_to_disk(
        owner_contents.clone(),
    )
    .await?;
-    let revision = compute_snapshot_revision(&candidate);
-    write_atomic(owner_path, owner_contents).await?;
+    let _candidate_revision = compute_snapshot_revision(&candidate);
+    let revision = write_atomic_if_unchanged(
+        config_path.to_path_buf(),
+        loaded_revision,
+        owner_path,
+        expected_owner_contents,
+        owner_contents,
+    )
+    .await?;
    Ok(revision)
 }

@@ -373,46 +397,10 @@ fn find_all_table_blocks(source: &str, table_name: &str) -> Vec<(usize, usize)>
    blocks
 }

-/// Replaces one config source through a durable same-directory rename.
-pub(in crate::api) async fn write_atomic(
-    path: PathBuf,
-    contents: String,
-) -> Result<(), ApiFailure> {
-    tokio::task::spawn_blocking(move || write_atomic_sync(&path, &contents))
-        .await
-        .map_err(|e| ApiFailure::internal(format!("failed to join writer: {}", e)))?
-        .map_err(|e| ApiFailure::internal(format!("failed to write config: {}", e)))
-}
-
-fn write_atomic_sync(path: &Path, contents: &str) -> std::io::Result<()> {
-    let parent = path.parent().unwrap_or_else(|| Path::new("."));
-    std::fs::create_dir_all(parent)?;
-
-    let tmp_name = format!(
-        ".{}.tmp-{}",
-        path.file_name()
-            .and_then(|s| s.to_str())
-            .unwrap_or("config.toml"),
-        rand::random::<u64>()
-    );
-    let tmp_path = parent.join(tmp_name);
-
-    let write_result = (|| {
-        let mut file = std::fs::OpenOptions::new()
-            .create_new(true)
-            .write(true)
-            .open(&tmp_path)?;
-        file.write_all(contents.as_bytes())?;
-        file.sync_all()?;
-        std::fs::rename(&tmp_path, path)?;
-        if let Ok(dir) = std::fs::File::open(parent) {
-            let _ = dir.sync_all();
-        }
-        Ok(())
-    })();
-
-    if write_result.is_err() {
-        let _ = std::fs::remove_file(&tmp_path);
-    }
-    write_result
+fn revision_conflict() -> ApiFailure {
+    ApiFailure::new(
+        hyper::StatusCode::CONFLICT,
+        "revision_conflict",
+        "Config revision changed before persistence",
+    )
 }
@@ -260,6 +260,104 @@ async fn access_mutation_writes_only_the_single_included_owner() {
    assert_eq!(revision, current_revision(&root).await.unwrap());
 }

+#[tokio::test]
+async fn access_mutation_rejects_source_graph_change_after_snapshot() {
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().join("config.toml");
+    let included = dir.path().join("users.toml");
+    let root_body = "include = \"users.toml\"\n[censorship]\ntls_domain = \"one.example\"\n";
+    let external_root = "include = \"users.toml\"\n[censorship]\ntls_domain = \"two.example\"\n";
+    let included_body = "[access.users]\nalice = \"00000000000000000000000000000000\"\n";
+    tokio::fs::write(&root, root_body).await.unwrap();
+    tokio::fs::write(&included, included_body).await.unwrap();
+    let (mut cfg, revision) = load_config_for_mutation(&root, None).await.unwrap();
+    cfg.access.users.insert(
+        "bob".to_string(),
+        "11111111111111111111111111111111".to_string(),
+    );
+    tokio::fs::write(&root, external_root).await.unwrap();
+
+    let error = save_access_sections_to_disk_if_revision(
+        &root,
+        &cfg,
+        &[AccessSection::Users],
+        Some(&revision),
+    )
+    .await
+    .unwrap_err();
+
+    assert_eq!(error.code, "revision_conflict");
+    assert_eq!(
+        tokio::fs::read_to_string(&root).await.unwrap(),
+        external_root
+    );
+    assert_eq!(
+        tokio::fs::read_to_string(&included).await.unwrap(),
+        included_body
+    );
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn atomic_write_preserves_existing_file_mode() {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt};
+
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("config.toml");
+    tokio::fs::write(&path, "old").await.unwrap();
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o640)).unwrap();
+    let before = std::fs::metadata(&path).unwrap();
+
+    write_atomic(path.clone(), "new".to_string()).await.unwrap();
+
+    let after = std::fs::metadata(&path).unwrap();
+    assert_eq!(after.mode() & 0o7777, 0o640);
+    assert_eq!(after.uid(), before.uid());
+    assert_eq!(after.gid(), before.gid());
+}
+
+#[tokio::test]
+async fn config_sidecar_lock_serializes_competing_revision_writers() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("config.toml");
+    let original = concat!(
+        "[censorship]\n",
+        "tls_domain = \"original.example\"\n",
+        "[access.users]\n",
+        "alice = \"00000000000000000000000000000000\"\n"
+    );
+    tokio::fs::write(&path, original).await.unwrap();
+    let graph = ProxyConfig::read_source_graph(&path).unwrap();
+    let revision = compute_source_revision(&graph);
+
+    let first = tokio::spawn(write_atomic_if_unchanged(
+        path.clone(),
+        revision.clone(),
+        path.clone(),
+        original.to_string(),
+        original.replace("original.example", "first.example"),
+    ));
+    let second = tokio::spawn(write_atomic_if_unchanged(
+        path.clone(),
+        revision,
+        path.clone(),
+        original.to_string(),
+        original.replace("original.example", "second.example"),
+    ));
+    let first = first.await.unwrap();
+    let second = second.await.unwrap();
+
+    assert_ne!(first.is_ok(), second.is_ok());
+    let (winner_revision, conflict) = match (first, second) {
+        (Ok(revision), Err(error)) | (Err(error), Ok(revision)) => (revision, error),
+        _ => unreachable!("exactly one cooperative writer must commit"),
+    };
+    assert_eq!(conflict.code, "revision_conflict");
+    assert_eq!(winner_revision, current_revision(&path).await.unwrap());
+    let persisted = tokio::fs::read_to_string(&path).await.unwrap();
+    assert!(persisted.contains("first.example") || persisted.contains("second.example"));
+}
+
 #[tokio::test]
 async fn access_mutation_rejects_sections_with_different_source_owners() {
    let dir = tempfile::tempdir().unwrap();
@@ -307,3 +405,17 @@ fn render_user_rate_limits_section() {
    assert!(rendered.starts_with("[access.user_rate_limits]\n"));
    assert!(rendered.contains("alice = { up_bps = 1024, down_bps = 2048 }"));
 }
+
+#[cfg(unix)]
+#[test]
+fn source_owner_normalization_preserves_symlinks() {
+    use std::os::unix::fs::symlink;
+
+    let dir = tempfile::tempdir().unwrap();
+    let real = dir.path().join("real.toml");
+    let linked = dir.path().join("linked.toml");
+    std::fs::write(&real, "").unwrap();
+    symlink(&real, &linked).unwrap();
+
+    assert_eq!(normalize_source_path(&linked), linked);
+}
@@ -0,0 +1,187 @@
+use super::*;
+
+// Read-only fixed API endpoints.
+mod read_routes;
+// Fixed configuration and lifecycle mutations.
+mod fixed_routes;
+// Dynamic reload and user-resource routes.
+mod user_routes;
+
+pub(super) async fn handle(
+    req: Request<Incoming>,
+    peer: SocketAddr,
+    shared: Arc<ApiShared>,
+) -> Result<Response<Full<Bytes>>, IoError> {
+    let runtime = shared.active_runtime.load_full();
+    let previous_cache_generation = shared.cache_generation.swap(runtime.id, Ordering::AcqRel);
+    if previous_cache_generation != runtime.id {
+        *shared.minimal_cache.lock().await = None;
+        *shared.runtime_edge_connections_cache.lock().await = None;
+    }
+    let shared = Arc::new(shared.for_runtime(runtime.as_ref()));
+    let config_rx = runtime.config_rx.clone();
+    shared
+        .runtime_state
+        .admission_open
+        .store(*runtime.admission_rx.borrow(), Ordering::Relaxed);
+    let request_id = shared.next_request_id();
+    let cfg = config_rx.borrow().clone();
+    let api_cfg = &cfg.server.api;
+
+    if !api_cfg.enabled {
+        return Ok(error_response(
+            request_id,
+            ApiFailure::new(
+                StatusCode::SERVICE_UNAVAILABLE,
+                "api_disabled",
+                "API is disabled",
+            ),
+        ));
+    }
+
+    if !api_cfg.whitelist.is_empty() && !api_cfg.whitelist.iter().any(|net| net.contains(peer.ip()))
+    {
+        return match api_cfg.gray_action {
+            ApiGrayAction::Api => Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::FORBIDDEN,
+                    "forbidden",
+                    "Source IP is not allowed",
+                ),
+            )),
+            ApiGrayAction::Ok200 => Ok(Response::builder()
+                .status(StatusCode::OK)
+                .header("content-type", "text/html; charset=utf-8")
+                .body(Full::new(Bytes::new()))
+                .unwrap()),
+            ApiGrayAction::Drop => Err(IoError::new(
+                ErrorKind::ConnectionAborted,
+                "api request dropped by gray_action=drop",
+            )),
+        };
+    }
+
+    if !api_cfg.auth_header.is_empty() {
+        let auth_ok = req
+            .headers()
+            .get(AUTHORIZATION)
+            .and_then(|v| v.to_str().ok())
+            .map(|v| auth_header_matches(v, &api_cfg.auth_header))
+            .unwrap_or(false);
+        if !auth_ok {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::UNAUTHORIZED,
+                    "unauthorized",
+                    "Missing or invalid Authorization header",
+                ),
+            ));
+        }
+    }
+
+    let method = req.method().clone();
+    let path = req.uri().path().to_string();
+    let normalized_path = if path.len() > 1 {
+        path.trim_end_matches('/')
+    } else {
+        path.as_str()
+    };
+    let query = req.uri().query().map(str::to_string);
+    let body_limit = api_cfg.request_body_limit_bytes;
+
+    let result = dispatch(
+        req,
+        method,
+        &path,
+        normalized_path,
+        query.as_deref(),
+        body_limit,
+        &shared,
+        cfg.as_ref(),
+        &config_rx,
+        request_id,
+    )
+    .await;
+    match result {
+        Ok(resp) => Ok(resp),
+        Err(error) => Ok(error_response(request_id, error)),
+    }
+}
+
+async fn dispatch(
+    req: Request<Incoming>,
+    method: Method,
+    path: &str,
+    normalized_path: &str,
+    query: Option<&str>,
+    body_limit: usize,
+    shared: &Arc<ApiShared>,
+    cfg: &ProxyConfig,
+    config_rx: &watch::Receiver<Arc<ProxyConfig>>,
+    request_id: u64,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    if web_runtime::is_route(normalized_path) {
+        let web_mutation = method == Method::POST;
+        let result = web_runtime::handle(
+            method,
+            normalized_path,
+            query,
+            req,
+            shared.as_ref(),
+            cfg,
+            request_id,
+            body_limit,
+        )
+        .await;
+        if web_mutation && let Err(error) = &result {
+            shared.runtime_events.record(
+                "api.web.control.failed",
+                format!("path={} code={}", normalized_path, error.code),
+            );
+        }
+        return result;
+    }
+
+    if let Some(response) = read_routes::handle(
+        &method,
+        normalized_path,
+        query,
+        shared.as_ref(),
+        cfg,
+        config_rx,
+    )
+    .await?
+    {
+        return Ok(response);
+    }
+
+    match (method.as_str(), normalized_path) {
+        ("POST", "/v1/users") => {
+            fixed_routes::create_user_route(req, shared, cfg, config_rx, request_id, body_limit)
+                .await
+        }
+        ("GET", "/v1/config") => fixed_routes::get_config_route(shared).await,
+        ("POST", "/v1/system/reload") => {
+            fixed_routes::reload_route(req, shared, cfg, request_id, body_limit).await
+        }
+        ("PATCH", "/v1/config") => {
+            fixed_routes::patch_config_route(req, shared, cfg, query, request_id, body_limit).await
+        }
+        _ => {
+            user_routes::handle(
+                req,
+                &method,
+                path,
+                normalized_path,
+                shared,
+                cfg,
+                config_rx,
+                request_id,
+                body_limit,
+            )
+            .await
+        }
+    }
+}
@@ -0,0 +1,129 @@
+use super::*;
+
+pub(super) async fn create_user_route(
+    req: Request<Incoming>,
+    shared: &Arc<ApiShared>,
+    cfg: &ProxyConfig,
+    config_rx: &watch::Receiver<Arc<ProxyConfig>>,
+    request_id: u64,
+    body_limit: usize,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let api_cfg = &cfg.server.api;
+    if api_cfg.read_only {
+        return Ok(error_response(
+            request_id,
+            ApiFailure::new(
+                StatusCode::FORBIDDEN,
+                "read_only",
+                "API runs in read-only mode",
+            ),
+        ));
+    }
+    let expected_revision = parse_if_match(req.headers());
+    let body = read_json::<CreateUserRequest>(req.into_body(), body_limit).await?;
+    let result = create_user(body, expected_revision, shared).await;
+    let (mut data, revision) = match result {
+        Ok(ok) => ok,
+        Err(error) => {
+            shared
+                .runtime_events
+                .record("api.user.create.failed", error.code);
+            return Err(error);
+        }
+    };
+    let runtime_cfg = config_rx.borrow().clone();
+    data.user.in_runtime = runtime_cfg.access.users.contains_key(&data.user.username);
+    shared.runtime_events.record(
+        "api.user.create.ok",
+        format!("username={}", data.user.username),
+    );
+    let status = if data.user.in_runtime {
+        StatusCode::CREATED
+    } else {
+        StatusCode::ACCEPTED
+    };
+    Ok(success_response(status, data, revision))
+}
+
+pub(super) async fn get_config_route(
+    shared: &Arc<ApiShared>,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let (value, revision) = config_edit::read_managed_config(&shared.config_path).await?;
+    Ok(success_response(StatusCode::OK, value, revision))
+}
+
+pub(super) async fn reload_route(
+    req: Request<Incoming>,
+    shared: &Arc<ApiShared>,
+    cfg: &ProxyConfig,
+    request_id: u64,
+    body_limit: usize,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let api_cfg = &cfg.server.api;
+    if api_cfg.read_only {
+        return Ok(error_response(
+            request_id,
+            ApiFailure::new(
+                StatusCode::FORBIDDEN,
+                "read_only",
+                "API runs in read-only mode",
+            ),
+        ));
+    }
+    let expected_revision = parse_if_match(req.headers());
+    let request = read_optional_json::<ReloadRequest>(req.into_body(), body_limit)
+        .await?
+        .unwrap_or_default();
+    request.validate().map_err(ApiFailure::bad_request)?;
+
+    let (accepted, revision) = submit_reload_from_disk(
+        &shared.config_path,
+        shared.mutation_lock.as_ref(),
+        &shared.reload_control,
+        expected_revision.as_deref(),
+        request,
+    )
+    .await?;
+    Ok(success_response(StatusCode::ACCEPTED, accepted, revision))
+}
+
+pub(super) async fn patch_config_route(
+    req: Request<Incoming>,
+    shared: &Arc<ApiShared>,
+    cfg: &ProxyConfig,
+    query: Option<&str>,
+    request_id: u64,
+    body_limit: usize,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let api_cfg = &cfg.server.api;
+    if api_cfg.read_only {
+        return Ok(error_response(
+            request_id,
+            ApiFailure::new(
+                StatusCode::FORBIDDEN,
+                "read_only",
+                "API runs in read-only mode",
+            ),
+        ));
+    }
+    let expected_revision = parse_if_match(req.headers());
+    let reload_request = ReloadRequest::from_query(query).map_err(ApiFailure::bad_request)?;
+    let body = read_json::<serde_json::Value>(req.into_body(), body_limit).await?;
+    match config_edit::patch_config(body, expected_revision, reload_request, shared).await {
+        Ok(resp) => {
+            let revision = resp.revision.clone();
+            let status = if resp.reload.is_some() {
+                StatusCode::ACCEPTED
+            } else {
+                StatusCode::OK
+            };
+            Ok(success_response(status, resp, revision))
+        }
+        Err(error) => {
+            shared
+                .runtime_events
+                .record("api.config.patch.failed", error.code);
+            Err(error)
+        }
+    }
+}
@@ -0,0 +1,210 @@
+use super::*;
+
+pub(super) async fn handle(
+    method: &Method,
+    normalized_path: &str,
+    query: Option<&str>,
+    shared: &ApiShared,
+    cfg: &ProxyConfig,
+    config_rx: &watch::Receiver<Arc<ProxyConfig>>,
+) -> Result<Option<Response<Full<Bytes>>>, ApiFailure> {
+    let api_cfg = &cfg.server.api;
+    match (method.as_str(), normalized_path) {
+        ("GET", "/web-status") => Ok(web_status::render(query, &shared.web_trace).await),
+        ("GET", "/v1/health") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = HealthData {
+                status: "ok",
+                read_only: api_cfg.read_only,
+            };
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/health/ready") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let admission_open = shared.runtime_state.admission_open.load(Ordering::Relaxed);
+            let upstream_health = shared.upstream_manager.api_health_summary().await;
+            let ready = admission_open && upstream_health.healthy_total > 0;
+            let reason = if ready {
+                None
+            } else if !admission_open {
+                Some("admission_closed")
+            } else {
+                Some("no_healthy_upstreams")
+            };
+            let data = HealthReadyData {
+                ready,
+                status: if ready { "ready" } else { "not_ready" },
+                reason,
+                admission_open,
+                healthy_upstreams: upstream_health.healthy_total,
+                total_upstreams: upstream_health.configured_total,
+            };
+            let status_code = if ready {
+                StatusCode::OK
+            } else {
+                StatusCode::SERVICE_UNAVAILABLE
+            };
+            Ok(success_response(status_code, data, revision))
+        }
+        ("GET", "/v1/system/info") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_system_info_data(shared, cfg, &revision);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/gates") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_gates_data(shared, cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/initialization") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_initialization_data(shared).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/limits/effective") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_limits_effective_data(cfg);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/security/posture") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_security_posture_data(cfg);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/security/whitelist") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_security_whitelist_data(cfg);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/summary") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let connections_bad_by_class = shared
+                .stats
+                .get_connects_bad_class_counts()
+                .into_iter()
+                .map(|(class, total)| ClassCount { class, total })
+                .collect();
+            let handshake_failures_by_class = shared
+                .stats
+                .get_handshake_failure_class_counts()
+                .into_iter()
+                .map(|(class, total)| ClassCount { class, total })
+                .collect();
+            let data = SummaryData {
+                uptime_seconds: shared.stats.uptime_secs(),
+                connections_total: shared.stats.get_connects_all(),
+                connections_bad_total: shared.stats.get_connects_bad(),
+                connections_bad_by_class,
+                handshake_failures_by_class,
+                handshake_timeouts_total: shared.stats.get_handshake_timeouts(),
+                configured_users: cfg.access.users.len(),
+            };
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/zero/all") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_zero_all_data(&shared.stats, cfg.access.users.len());
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/upstreams") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_upstreams_data(shared, api_cfg);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/minimal/all") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_minimal_all_data(shared, api_cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/me-writers") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_me_writers_data(shared, api_cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/dcs") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_dcs_data(shared, api_cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/me-pool-state") | ("GET", "/v1/runtime/me_pool_state") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_me_pool_state_data(shared).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/me-quality") | ("GET", "/v1/runtime/me_quality") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_me_quality_data(shared).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/upstream-quality") | ("GET", "/v1/runtime/upstream_quality") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_upstream_quality_data(shared).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/nat-stun") | ("GET", "/v1/runtime/nat_stun") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_nat_stun_data(shared).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/me-selftest") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_me_selftest_data(shared, cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/connections/summary") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_connections_summary_data(shared, cfg).await;
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/events/recent") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_events_recent_data(shared, cfg, query);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/runtime/tls-fingerprints") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let data = build_runtime_tls_fingerprints_data(shared, cfg, query);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/users/active-ips") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let usernames: Vec<_> = cfg.access.users.keys().cloned().collect();
+            let active_ips_map = shared.ip_tracker.get_active_ips_for_users(&usernames).await;
+            let mut data: Vec<UserActiveIps> = active_ips_map
+                .into_iter()
+                .filter(|(_, ips)| !ips.is_empty())
+                .map(|(username, active_ips)| UserActiveIps {
+                    username,
+                    active_ips,
+                })
+                .collect();
+            data.sort_by(|a, b| a.username.cmp(&b.username));
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", "/v1/stats/users") | ("GET", "/v1/users") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let disk_cfg = load_config_from_disk(&shared.config_path).await?;
+            let runtime_cfg = config_rx.borrow().clone();
+            let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();
+            let users = users_from_config(
+                &disk_cfg,
+                &shared.stats,
+                &shared.ip_tracker,
+                detected_ip_v4,
+                detected_ip_v6,
+                Some(runtime_cfg.as_ref()),
+            )
+            .await;
+            Ok(success_response(StatusCode::OK, users, revision))
+        }
+        ("GET", "/v1/stats/users/quota") => {
+            let revision = current_revision(&shared.config_path).await?;
+            let disk_cfg = load_config_from_disk(&shared.config_path).await?;
+            let data = build_user_quota_list(&disk_cfg, shared.stats.as_ref());
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+
+        _ => return Ok(None),
+    }
+    .map(Some)
+}
@@ -0,0 +1,373 @@
+use super::*;
+
+pub(super) async fn handle(
+    req: Request<Incoming>,
+    method: &Method,
+    path: &str,
+    normalized_path: &str,
+    shared: &Arc<ApiShared>,
+    cfg: &ProxyConfig,
+    config_rx: &watch::Receiver<Arc<ProxyConfig>>,
+    request_id: u64,
+    body_limit: usize,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let api_cfg = &cfg.server.api;
+    if method == Method::GET
+        && let Some(reload_id) = reload_status_route_id(normalized_path)
+    {
+        let revision = current_revision(&shared.config_path).await?;
+        let status = shared
+            .reload_control
+            .status(reload_id)
+            .await
+            .ok_or_else(|| {
+                ApiFailure::new(
+                    StatusCode::NOT_FOUND,
+                    "reload_not_found",
+                    format!("Reload {} was not found", reload_id),
+                )
+            })?;
+        return Ok(success_response(StatusCode::OK, status, revision));
+    }
+    if method == Method::POST
+        && let Some(base_user) = normalized_path
+            .strip_prefix("/v1/users/")
+            .and_then(|path| path.strip_suffix("/enable"))
+        && !base_user.is_empty()
+        && !base_user.contains('/')
+    {
+        let base_user = parse_route_username(base_user)?;
+        if api_cfg.read_only {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::FORBIDDEN,
+                    "read_only",
+                    "API runs in read-only mode",
+                ),
+            ));
+        }
+        let expected_revision = parse_if_match(req.headers());
+        let result = set_user_enabled(base_user, true, expected_revision, shared).await;
+        let (mut data, revision) = match result {
+            Ok(ok) => ok,
+            Err(error) => {
+                shared.runtime_events.record(
+                    "api.user.enable.failed",
+                    format!("username={} code={}", base_user, error.code),
+                );
+                return Err(error);
+            }
+        };
+        let runtime_cfg = config_rx.borrow().clone();
+        data.in_runtime = runtime_cfg.access.users.contains_key(&data.username);
+        shared
+            .runtime_events
+            .record("api.user.enable.ok", format!("username={}", base_user));
+        let status = if data.in_runtime {
+            StatusCode::OK
+        } else {
+            StatusCode::ACCEPTED
+        };
+        return Ok(success_response(status, data, revision));
+    }
+    if method == Method::POST
+        && let Some(base_user) = normalized_path
+            .strip_prefix("/v1/users/")
+            .and_then(|path| path.strip_suffix("/disable"))
+        && !base_user.is_empty()
+        && !base_user.contains('/')
+    {
+        let base_user = parse_route_username(base_user)?;
+        if api_cfg.read_only {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::FORBIDDEN,
+                    "read_only",
+                    "API runs in read-only mode",
+                ),
+            ));
+        }
+        let expected_revision = parse_if_match(req.headers());
+        let result = set_user_enabled(base_user, false, expected_revision, shared).await;
+        let (mut data, revision) = match result {
+            Ok(ok) => ok,
+            Err(error) => {
+                shared.runtime_events.record(
+                    "api.user.disable.failed",
+                    format!("username={} code={}", base_user, error.code),
+                );
+                return Err(error);
+            }
+        };
+        let runtime_cfg = config_rx.borrow().clone();
+        data.in_runtime = runtime_cfg.access.users.contains_key(&data.username);
+        shared
+            .runtime_events
+            .record("api.user.disable.ok", format!("username={}", base_user));
+        let status = if data.in_runtime {
+            StatusCode::OK
+        } else {
+            StatusCode::ACCEPTED
+        };
+        return Ok(success_response(status, data, revision));
+    }
+    if method == Method::POST
+        && let Some(user) = normalized_path
+            .strip_prefix("/v1/users/")
+            .and_then(|path| path.strip_suffix("/reset-quota"))
+        && !user.is_empty()
+        && !user.contains('/')
+    {
+        let user = parse_route_username(user)?;
+        if api_cfg.read_only {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::FORBIDDEN,
+                    "read_only",
+                    "API runs in read-only mode",
+                ),
+            ));
+        }
+        let expected_revision = parse_if_match(req.headers());
+        let completion_shared = shared.as_ref().clone();
+        let user_owned = user.to_string();
+        let completion = shared
+            .run_mutation_completion(async move {
+                let _mutation_guard = completion_shared.mutation_lock.lock().await;
+                let (disk_cfg, _) = load_config_for_mutation(
+                    &completion_shared.config_path,
+                    expected_revision.as_deref(),
+                )
+                .await?;
+                if !disk_cfg.access.users.contains_key(&user_owned) {
+                    return Err(ApiFailure::new(
+                        StatusCode::NOT_FOUND,
+                        "not_found",
+                        "User not found",
+                    ));
+                }
+                let configured_users = disk_cfg
+                    .access
+                    .users
+                    .keys()
+                    .cloned()
+                    .collect::<BTreeSet<_>>();
+                let snapshot = completion_shared
+                    .quota_state
+                    .reset_user(&configured_users, &user_owned)
+                    .await
+                    .map_err(|error| {
+                        completion_shared.runtime_events.record(
+                            "api.user.reset_quota.failed",
+                            format!("username={} error={}", user_owned, error),
+                        );
+                        ApiFailure::internal(format!("Failed to reset user quota: {}", error))
+                    })?;
+                completion_shared.runtime_events.record(
+                    "api.user.reset_quota.ok",
+                    format!("username={}", user_owned),
+                );
+                let revision = current_revision(&completion_shared.config_path).await?;
+                Ok((snapshot, revision))
+            })
+            .await;
+        let (snapshot, revision) = match completion {
+            Ok(result) => result,
+            Err(error) if error.code == "not_found" => {
+                return Ok(error_response(request_id, error));
+            }
+            Err(error) => return Err(error),
+        };
+        return Ok(success_response(
+            StatusCode::OK,
+            ResetUserQuotaResponse {
+                username: user.to_string(),
+                used_bytes: snapshot.used_bytes,
+                last_reset_epoch_secs: snapshot.last_reset_epoch_secs,
+            },
+            revision,
+        ));
+    }
+    if method == Method::POST
+        && let Some(base_user) = normalized_path
+            .strip_prefix("/v1/users/")
+            .and_then(|path| path.strip_suffix("/rotate-secret"))
+        && !base_user.is_empty()
+        && !base_user.contains('/')
+    {
+        let base_user = parse_route_username(base_user)?;
+        if api_cfg.read_only {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(
+                    StatusCode::FORBIDDEN,
+                    "read_only",
+                    "API runs in read-only mode",
+                ),
+            ));
+        }
+        let expected_revision = parse_if_match(req.headers());
+        let body = read_optional_json::<RotateSecretRequest>(req.into_body(), body_limit).await?;
+        let result = rotate_secret(
+            base_user,
+            body.unwrap_or_default(),
+            expected_revision,
+            shared,
+        )
+        .await;
+        let (mut data, revision) = match result {
+            Ok(ok) => ok,
+            Err(error) => {
+                shared.runtime_events.record(
+                    "api.user.rotate_secret.failed",
+                    format!("username={} code={}", base_user, error.code),
+                );
+                return Err(error);
+            }
+        };
+        let runtime_cfg = config_rx.borrow().clone();
+        data.user.in_runtime = runtime_cfg.access.users.contains_key(&data.user.username);
+        shared.runtime_events.record(
+            "api.user.rotate_secret.ok",
+            format!("username={}", base_user),
+        );
+        let status = if data.user.in_runtime {
+            StatusCode::OK
+        } else {
+            StatusCode::ACCEPTED
+        };
+        return Ok(success_response(status, data, revision));
+    }
+    if let Some(user) = normalized_path.strip_prefix("/v1/users/")
+        && !user.is_empty()
+        && !user.contains('/')
+    {
+        let user = parse_route_username(user)?;
+        if method == Method::GET {
+            let revision = current_revision(&shared.config_path).await?;
+            let disk_cfg = load_config_from_disk(&shared.config_path).await?;
+            let runtime_cfg = config_rx.borrow().clone();
+            let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();
+            let users = users_from_config(
+                &disk_cfg,
+                &shared.stats,
+                &shared.ip_tracker,
+                detected_ip_v4,
+                detected_ip_v6,
+                Some(runtime_cfg.as_ref()),
+            )
+            .await;
+            if let Some(user_info) = users.into_iter().find(|entry| entry.username == user) {
+                return Ok(success_response(StatusCode::OK, user_info, revision));
+            }
+            return Ok(error_response(
+                request_id,
+                ApiFailure::new(StatusCode::NOT_FOUND, "not_found", "User not found"),
+            ));
+        }
+        if method == Method::PATCH {
+            if api_cfg.read_only {
+                return Ok(error_response(
+                    request_id,
+                    ApiFailure::new(
+                        StatusCode::FORBIDDEN,
+                        "read_only",
+                        "API runs in read-only mode",
+                    ),
+                ));
+            }
+            let expected_revision = parse_if_match(req.headers());
+            let body = read_json::<PatchUserRequest>(req.into_body(), body_limit).await?;
+            let result = patch_user(user, body, expected_revision, shared).await;
+            let (mut data, revision) = match result {
+                Ok(ok) => ok,
+                Err(error) => {
+                    shared.runtime_events.record(
+                        "api.user.patch.failed",
+                        format!("username={} code={}", user, error.code),
+                    );
+                    return Err(error);
+                }
+            };
+            let runtime_cfg = config_rx.borrow().clone();
+            data.in_runtime = runtime_cfg.access.users.contains_key(&data.username);
+            shared
+                .runtime_events
+                .record("api.user.patch.ok", format!("username={}", data.username));
+            let status = if data.in_runtime {
+                StatusCode::OK
+            } else {
+                StatusCode::ACCEPTED
+            };
+            return Ok(success_response(status, data, revision));
+        }
+        if method == Method::DELETE {
+            if api_cfg.read_only {
+                return Ok(error_response(
+                    request_id,
+                    ApiFailure::new(
+                        StatusCode::FORBIDDEN,
+                        "read_only",
+                        "API runs in read-only mode",
+                    ),
+                ));
+            }
+            let expected_revision = parse_if_match(req.headers());
+            let result = delete_user(user, expected_revision, shared).await;
+            let (deleted_user, revision) = match result {
+                Ok(ok) => ok,
+                Err(error) => {
+                    shared.runtime_events.record(
+                        "api.user.delete.failed",
+                        format!("username={} code={}", user, error.code),
+                    );
+                    return Err(error);
+                }
+            };
+            shared
+                .runtime_events
+                .record("api.user.delete.ok", format!("username={}", deleted_user));
+            let runtime_cfg = config_rx.borrow().clone();
+            let in_runtime = runtime_cfg.access.users.contains_key(&deleted_user);
+            let response = DeleteUserResponse {
+                username: deleted_user,
+                in_runtime,
+            };
+            let status = if response.in_runtime {
+                StatusCode::ACCEPTED
+            } else {
+                StatusCode::OK
+            };
+            return Ok(success_response(status, response, revision));
+        }
+        if method == Method::POST {
+            return Ok(error_response(
+                request_id,
+                ApiFailure::method_not_allowed(ALLOW_GET_PATCH_DELETE),
+            ));
+        }
+        return Ok(error_response(
+            request_id,
+            ApiFailure::method_not_allowed(ALLOW_GET_PATCH_DELETE),
+        ));
+    }
+    if let Some(allow) = allowed_methods_for_path(normalized_path) {
+        return Ok(error_response(
+            request_id,
+            ApiFailure::method_not_allowed(allow),
+        ));
+    }
+    debug!(
+        method = method.as_str(),
+        path = %path,
+        normalized_path = %normalized_path,
+        "API route not found"
+    );
+    Ok(error_response(
+        request_id,
+        ApiFailure::new(StatusCode::NOT_FOUND, "not_found", "Route not found"),
+    ))
+}
@@ -124,6 +124,10 @@ pub(super) struct ZeroCoreData {
    pub(super) conntrack_pressure_active: bool,
    pub(super) conntrack_event_queue_depth: u64,
    pub(super) conntrack_rule_apply_ok: bool,
+    pub(super) conntrack_rule_reconcile_success_total: u64,
+    pub(super) conntrack_rule_reconcile_error_total: u64,
+    pub(super) conntrack_rule_rollback_success_total: u64,
+    pub(super) conntrack_rule_rollback_error_total: u64,
    pub(super) conntrack_delete_attempt_total: u64,
    pub(super) conntrack_delete_success_total: u64,
    pub(super) conntrack_delete_not_found_total: u64,
@@ -211,6 +215,7 @@ pub(super) struct ZeroMiddleProxyData {
    pub(super) reconnect_success_total: u64,
    pub(super) handshake_reject_total: u64,
    pub(super) handshake_error_codes: Vec<ZeroCodeCount>,
+    pub(super) handshake_error_code_overflow_total: u64,
    pub(super) reader_eof_total: u64,
    pub(super) idle_close_by_peer_total: u64,
    pub(super) route_drop_no_conn_total: u64,
@@ -388,8 +393,11 @@ pub(super) struct MinimalDcPathData {
 pub(super) struct MinimalMeRuntimeData {
    pub(super) active_generation: u64,
    pub(super) warm_generation: u64,
+    pub(super) warm_generations: Vec<u64>,
    pub(super) pending_hardswap_generation: u64,
    pub(super) pending_hardswap_age_secs: Option<u64>,
+    pub(super) reinit_inflight: usize,
+    pub(super) reinit_max_concurrency_effective: usize,
    pub(super) hardswap_enabled: bool,
    pub(super) floor_mode: &'static str,
    pub(super) adaptive_floor_idle_secs: u64,
@@ -462,164 +470,6 @@ pub(super) struct MinimalAllData {
    pub(super) data: Option<MinimalAllPayload>,
 }

-#[derive(Serialize)]
-pub(super) struct UserLinks {
-    pub(super) classic: Vec<String>,
-    pub(super) secure: Vec<String>,
-    pub(super) tls: Vec<String>,
-    pub(super) tls_domains: Vec<TlsDomainLink>,
-}
-
-#[derive(Serialize)]
-pub(super) struct TlsDomainLink {
-    pub(super) domain: String,
-    pub(super) link: String,
-}
-
-#[derive(Serialize)]
-pub(super) struct UserInfo {
-    pub(super) username: String,
-    pub(super) enabled: bool,
-    pub(super) in_runtime: bool,
-    pub(super) user_ad_tag: Option<String>,
-    pub(super) max_tcp_conns: Option<usize>,
-    pub(super) expiration_rfc3339: Option<String>,
-    pub(super) data_quota_bytes: Option<u64>,
-    pub(super) rate_limit_up_bps: Option<u64>,
-    pub(super) rate_limit_down_bps: Option<u64>,
-    pub(super) max_unique_ips: Option<usize>,
-    pub(super) current_connections: u64,
-    pub(super) active_unique_ips: usize,
-    pub(super) active_unique_ips_list: Vec<IpAddr>,
-    pub(super) recent_unique_ips: usize,
-    pub(super) recent_unique_ips_list: Vec<IpAddr>,
-    pub(super) total_octets: u64,
-    pub(super) links: UserLinks,
-}
-
-#[derive(Serialize)]
-pub(super) struct UserActiveIps {
-    pub(super) username: String,
-    pub(super) active_ips: Vec<IpAddr>,
-}
-
-#[derive(Serialize)]
-pub(super) struct CreateUserResponse {
-    pub(super) user: UserInfo,
-    pub(super) secret: String,
-}
-
-#[derive(Serialize)]
-pub(super) struct DeleteUserResponse {
-    pub(super) username: String,
-    pub(super) in_runtime: bool,
-}
-
-#[derive(Serialize)]
-pub(super) struct ResetUserQuotaResponse {
-    pub(super) username: String,
-    pub(super) used_bytes: u64,
-    pub(super) last_reset_epoch_secs: u64,
-}
-
-#[derive(Serialize)]
-pub(super) struct UserQuotaListData {
-    pub(super) users: Vec<UserQuotaEntry>,
-}
-
-#[derive(Serialize)]
-pub(super) struct UserQuotaEntry {
-    pub(super) username: String,
-    pub(super) data_quota_bytes: u64,
-    pub(super) used_bytes: u64,
-    pub(super) last_reset_epoch_secs: u64,
-}
-
-#[derive(Deserialize)]
-pub(super) struct CreateUserRequest {
-    pub(super) username: String,
-    pub(super) secret: Option<String>,
-    pub(super) user_ad_tag: Option<String>,
-    pub(super) max_tcp_conns: Option<usize>,
-    pub(super) expiration_rfc3339: Option<String>,
-    pub(super) data_quota_bytes: Option<u64>,
-    pub(super) rate_limit_up_bps: Option<u64>,
-    pub(super) rate_limit_down_bps: Option<u64>,
-    pub(super) max_unique_ips: Option<usize>,
-    pub(super) enabled: Option<bool>,
-}
-
-#[derive(Deserialize)]
-pub(super) struct PatchUserRequest {
-    pub(super) secret: Option<String>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) user_ad_tag: Patch<String>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) max_tcp_conns: Patch<usize>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) expiration_rfc3339: Patch<String>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) data_quota_bytes: Patch<u64>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) rate_limit_up_bps: Patch<u64>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) rate_limit_down_bps: Patch<u64>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) max_unique_ips: Patch<usize>,
-    #[serde(default, deserialize_with = "patch_field")]
-    pub(super) enabled: Patch<bool>,
-}
-
-#[derive(Default, Deserialize)]
-pub(super) struct RotateSecretRequest {
-    pub(super) secret: Option<String>,
-}
-
-pub(super) fn parse_optional_expiration(
-    value: Option<&str>,
-) -> Result<Option<DateTime<Utc>>, ApiFailure> {
-    let Some(raw) = value else {
-        return Ok(None);
-    };
-    let parsed = DateTime::parse_from_rfc3339(raw)
-        .map_err(|_| ApiFailure::bad_request("expiration_rfc3339 must be valid RFC3339"))?;
-    Ok(Some(parsed.with_timezone(&Utc)))
-}
-
-pub(super) fn parse_patch_expiration(
-    value: &Patch<String>,
-) -> Result<Patch<DateTime<Utc>>, ApiFailure> {
-    match value {
-        Patch::Unchanged => Ok(Patch::Unchanged),
-        Patch::Remove => Ok(Patch::Remove),
-        Patch::Set(raw) => {
-            let parsed = DateTime::parse_from_rfc3339(raw)
-                .map_err(|_| ApiFailure::bad_request("expiration_rfc3339 must be valid RFC3339"))?;
-            Ok(Patch::Set(parsed.with_timezone(&Utc)))
-        }
-    }
-}
-
-pub(super) fn is_valid_user_secret(secret: &str) -> bool {
-    secret.len() == 32 && secret.chars().all(|c| c.is_ascii_hexdigit())
-}
-
-pub(super) fn is_valid_ad_tag(tag: &str) -> bool {
-    tag.len() == 32 && tag.chars().all(|c| c.is_ascii_hexdigit())
-}
-
-pub(super) fn is_valid_username(user: &str) -> bool {
-    !user.is_empty()
-        && user.len() <= MAX_USERNAME_LEN
-        && user
-            .chars()
-            .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '-' | '.'))
-}
-
-pub(super) fn random_user_secret() -> String {
-    static API_SECRET_RNG: OnceLock<SecureRandom> = OnceLock::new();
-    let rng = API_SECRET_RNG.get_or_init(SecureRandom::new);
-    let mut bytes = [0u8; 16];
-    rng.fill(&mut bytes);
-    hex::encode(bytes)
-}
+// User-management request, response, and validation models.
+mod users;
+pub(super) use users::*;
@@ -0,0 +1,163 @@
+use super::*;
+
+#[derive(Serialize)]
+pub(in crate::api) struct UserLinks {
+    pub(in crate::api) classic: Vec<String>,
+    pub(in crate::api) secure: Vec<String>,
+    pub(in crate::api) tls: Vec<String>,
+    pub(in crate::api) tls_domains: Vec<TlsDomainLink>,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct TlsDomainLink {
+    pub(in crate::api) domain: String,
+    pub(in crate::api) link: String,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct UserInfo {
+    pub(in crate::api) username: String,
+    pub(in crate::api) enabled: bool,
+    pub(in crate::api) in_runtime: bool,
+    pub(in crate::api) user_ad_tag: Option<String>,
+    pub(in crate::api) max_tcp_conns: Option<usize>,
+    pub(in crate::api) expiration_rfc3339: Option<String>,
+    pub(in crate::api) data_quota_bytes: Option<u64>,
+    pub(in crate::api) rate_limit_up_bps: Option<u64>,
+    pub(in crate::api) rate_limit_down_bps: Option<u64>,
+    pub(in crate::api) max_unique_ips: Option<usize>,
+    pub(in crate::api) current_connections: u64,
+    pub(in crate::api) active_unique_ips: usize,
+    pub(in crate::api) active_unique_ips_list: Vec<IpAddr>,
+    pub(in crate::api) recent_unique_ips: usize,
+    pub(in crate::api) recent_unique_ips_list: Vec<IpAddr>,
+    pub(in crate::api) total_octets: u64,
+    pub(in crate::api) links: UserLinks,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct UserActiveIps {
+    pub(in crate::api) username: String,
+    pub(in crate::api) active_ips: Vec<IpAddr>,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct CreateUserResponse {
+    pub(in crate::api) user: UserInfo,
+    pub(in crate::api) secret: String,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct DeleteUserResponse {
+    pub(in crate::api) username: String,
+    pub(in crate::api) in_runtime: bool,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct ResetUserQuotaResponse {
+    pub(in crate::api) username: String,
+    pub(in crate::api) used_bytes: u64,
+    pub(in crate::api) last_reset_epoch_secs: u64,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct UserQuotaListData {
+    pub(in crate::api) users: Vec<UserQuotaEntry>,
+}
+
+#[derive(Serialize)]
+pub(in crate::api) struct UserQuotaEntry {
+    pub(in crate::api) username: String,
+    pub(in crate::api) data_quota_bytes: u64,
+    pub(in crate::api) used_bytes: u64,
+    pub(in crate::api) last_reset_epoch_secs: u64,
+}
+
+#[derive(Deserialize)]
+pub(in crate::api) struct CreateUserRequest {
+    pub(in crate::api) username: String,
+    pub(in crate::api) secret: Option<String>,
+    pub(in crate::api) user_ad_tag: Option<String>,
+    pub(in crate::api) max_tcp_conns: Option<usize>,
+    pub(in crate::api) expiration_rfc3339: Option<String>,
+    pub(in crate::api) data_quota_bytes: Option<u64>,
+    pub(in crate::api) rate_limit_up_bps: Option<u64>,
+    pub(in crate::api) rate_limit_down_bps: Option<u64>,
+    pub(in crate::api) max_unique_ips: Option<usize>,
+    pub(in crate::api) enabled: Option<bool>,
+}
+
+#[derive(Deserialize)]
+pub(in crate::api) struct PatchUserRequest {
+    pub(in crate::api) secret: Option<String>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) user_ad_tag: Patch<String>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) max_tcp_conns: Patch<usize>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) expiration_rfc3339: Patch<String>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) data_quota_bytes: Patch<u64>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) rate_limit_up_bps: Patch<u64>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) rate_limit_down_bps: Patch<u64>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) max_unique_ips: Patch<usize>,
+    #[serde(default, deserialize_with = "patch_field")]
+    pub(in crate::api) enabled: Patch<bool>,
+}
+
+#[derive(Default, Deserialize)]
+pub(in crate::api) struct RotateSecretRequest {
+    pub(in crate::api) secret: Option<String>,
+}
+
+pub(in crate::api) fn parse_optional_expiration(
+    value: Option<&str>,
+) -> Result<Option<DateTime<Utc>>, ApiFailure> {
+    let Some(raw) = value else {
+        return Ok(None);
+    };
+    let parsed = DateTime::parse_from_rfc3339(raw)
+        .map_err(|_| ApiFailure::bad_request("expiration_rfc3339 must be valid RFC3339"))?;
+    Ok(Some(parsed.with_timezone(&Utc)))
+}
+
+pub(in crate::api) fn parse_patch_expiration(
+    value: &Patch<String>,
+) -> Result<Patch<DateTime<Utc>>, ApiFailure> {
+    match value {
+        Patch::Unchanged => Ok(Patch::Unchanged),
+        Patch::Remove => Ok(Patch::Remove),
+        Patch::Set(raw) => {
+            let parsed = DateTime::parse_from_rfc3339(raw)
+                .map_err(|_| ApiFailure::bad_request("expiration_rfc3339 must be valid RFC3339"))?;
+            Ok(Patch::Set(parsed.with_timezone(&Utc)))
+        }
+    }
+}
+
+pub(in crate::api) fn is_valid_user_secret(secret: &str) -> bool {
+    secret.len() == 32 && secret.chars().all(|c| c.is_ascii_hexdigit())
+}
+
+pub(in crate::api) fn is_valid_ad_tag(tag: &str) -> bool {
+    tag.len() == 32 && tag.chars().all(|c| c.is_ascii_hexdigit())
+}
+
+pub(in crate::api) fn is_valid_username(user: &str) -> bool {
+    !user.is_empty()
+        && user.len() <= MAX_USERNAME_LEN
+        && user
+            .chars()
+            .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '-' | '.'))
+}
+
+pub(in crate::api) fn random_user_secret() -> String {
+    static API_SECRET_RNG: OnceLock<SecureRandom> = OnceLock::new();
+    let rng = API_SECRET_RNG.get_or_init(SecureRandom::new);
+    let mut bytes = [0u8; 16];
+    rng.fill(&mut bytes);
+    hex::encode(bytes)
+}
@@ -314,9 +314,7 @@ async fn recompute_connections_payload(
    let mut active_users = 0usize;
    for entry in shared.stats.iter_user_stats() {
        let user_stats = entry.value();
-        let current_connections = user_stats
-            .curr_connects
-            .load(std::sync::atomic::Ordering::Relaxed);
+        let current_connections = shared.stats.get_process_user_curr_connects(entry.key());
        let total_octets = user_stats
            .octets_from_client
            .load(std::sync::atomic::Ordering::Relaxed)
@@ -1,4 +1,3 @@
-use std::collections::BTreeSet;
 use std::time::{SystemTime, UNIX_EPOCH};

 use serde::Serialize;
@@ -17,77 +16,6 @@ pub(super) struct SecurityWhitelistData {
    pub(super) entries: Vec<String>,
 }

-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateGenerationData {
-    pub(super) active_generation: u64,
-    pub(super) warm_generation: u64,
-    pub(super) pending_hardswap_generation: u64,
-    pub(super) pending_hardswap_age_secs: Option<u64>,
-    pub(super) draining_generations: Vec<u64>,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateHardswapData {
-    pub(super) enabled: bool,
-    pub(super) pending: bool,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateWriterContourData {
-    pub(super) warm: usize,
-    pub(super) active: usize,
-    pub(super) draining: usize,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateWriterHealthData {
-    pub(super) healthy: usize,
-    pub(super) degraded: usize,
-    pub(super) draining: usize,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateWriterData {
-    pub(super) total: usize,
-    pub(super) alive_non_draining: usize,
-    pub(super) draining: usize,
-    pub(super) degraded: usize,
-    pub(super) contour: RuntimeMePoolStateWriterContourData,
-    pub(super) health: RuntimeMePoolStateWriterHealthData,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateRefillDcData {
-    pub(super) dc: i16,
-    pub(super) family: &'static str,
-    pub(super) inflight: usize,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateRefillData {
-    pub(super) inflight_endpoints_total: usize,
-    pub(super) inflight_dc_total: usize,
-    pub(super) by_dc: Vec<RuntimeMePoolStateRefillDcData>,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStatePayload {
-    pub(super) generations: RuntimeMePoolStateGenerationData,
-    pub(super) hardswap: RuntimeMePoolStateHardswapData,
-    pub(super) writers: RuntimeMePoolStateWriterData,
-    pub(super) refill: RuntimeMePoolStateRefillData,
-}
-
-#[derive(Serialize)]
-pub(super) struct RuntimeMePoolStateData {
-    pub(super) enabled: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(super) reason: Option<&'static str>,
-    pub(super) generated_at_epoch_secs: u64,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(super) data: Option<RuntimeMePoolStatePayload>,
-}
-
 #[derive(Serialize)]
 pub(super) struct RuntimeMeQualityCountersData {
    pub(super) idle_close_by_peer_total: u64,
@@ -280,96 +208,6 @@ pub(super) fn build_security_whitelist_data(cfg: &ProxyConfig) -> SecurityWhitel
    }
 }

-pub(super) async fn build_runtime_me_pool_state_data(shared: &ApiShared) -> RuntimeMePoolStateData {
-    let now_epoch_secs = now_epoch_secs();
-    let Some(pool) = shared.me_pool.read().await.clone() else {
-        return RuntimeMePoolStateData {
-            enabled: false,
-            reason: Some(SOURCE_UNAVAILABLE_REASON),
-            generated_at_epoch_secs: now_epoch_secs,
-            data: None,
-        };
-    };
-
-    let status = pool.api_status_snapshot().await;
-    let runtime = pool.api_runtime_snapshot().await;
-    let refill = pool.api_refill_snapshot().await;
-
-    let mut draining_generations = BTreeSet::<u64>::new();
-    let mut contour_warm = 0usize;
-    let mut contour_active = 0usize;
-    let mut contour_draining = 0usize;
-    let mut draining = 0usize;
-    let mut degraded = 0usize;
-    let mut healthy = 0usize;
-
-    for writer in &status.writers {
-        if writer.draining {
-            draining_generations.insert(writer.generation);
-            draining += 1;
-        }
-        if writer.degraded && !writer.draining {
-            degraded += 1;
-        }
-        if !writer.degraded && !writer.draining {
-            healthy += 1;
-        }
-        match writer.state {
-            "warm" => contour_warm += 1,
-            "active" => contour_active += 1,
-            _ => contour_draining += 1,
-        }
-    }
-
-    RuntimeMePoolStateData {
-        enabled: true,
-        reason: None,
-        generated_at_epoch_secs: status.generated_at_epoch_secs,
-        data: Some(RuntimeMePoolStatePayload {
-            generations: RuntimeMePoolStateGenerationData {
-                active_generation: runtime.active_generation,
-                warm_generation: runtime.warm_generation,
-                pending_hardswap_generation: runtime.pending_hardswap_generation,
-                pending_hardswap_age_secs: runtime.pending_hardswap_age_secs,
-                draining_generations: draining_generations.into_iter().collect(),
-            },
-            hardswap: RuntimeMePoolStateHardswapData {
-                enabled: runtime.hardswap_enabled,
-                pending: runtime.pending_hardswap_generation != 0,
-            },
-            writers: RuntimeMePoolStateWriterData {
-                total: status.writers.len(),
-                alive_non_draining: status.writers.len().saturating_sub(draining),
-                draining,
-                degraded,
-                contour: RuntimeMePoolStateWriterContourData {
-                    warm: contour_warm,
-                    active: contour_active,
-                    draining: contour_draining,
-                },
-                health: RuntimeMePoolStateWriterHealthData {
-                    healthy,
-                    degraded,
-                    draining,
-                },
-            },
-            refill: RuntimeMePoolStateRefillData {
-                inflight_endpoints_total: refill.inflight_endpoints_total,
-                inflight_dc_total: refill.inflight_dc_total,
-                by_dc: refill
-                    .by_dc
-                    .into_iter()
-                    .map(|entry| RuntimeMePoolStateRefillDcData {
-                        dc: entry.dc,
-                        family: entry.family,
-                        inflight: entry.inflight,
-                    })
-                    .collect(),
-            },
-        }),
-    }
-}
-
 pub(super) async fn build_runtime_me_quality_data(shared: &ApiShared) -> RuntimeMeQualityData {
    let now_epoch_secs = now_epoch_secs();
    let Some(pool) = shared.me_pool.read().await.clone() else {
@@ -532,55 +370,10 @@ pub(super) async fn build_runtime_upstream_quality_data(
    }
 }

-pub(super) async fn build_runtime_nat_stun_data(shared: &ApiShared) -> RuntimeNatStunData {
-    let now_epoch_secs = now_epoch_secs();
-    let Some(pool) = shared.me_pool.read().await.clone() else {
-        return RuntimeNatStunData {
-            enabled: false,
-            reason: Some(SOURCE_UNAVAILABLE_REASON),
-            generated_at_epoch_secs: now_epoch_secs,
-            data: None,
-        };
-    };
-
-    let snapshot = pool.api_nat_stun_snapshot().await;
-    RuntimeNatStunData {
-        enabled: true,
-        reason: None,
-        generated_at_epoch_secs: now_epoch_secs,
-        data: Some(RuntimeNatStunPayload {
-            flags: RuntimeNatStunFlagsData {
-                nat_probe_enabled: snapshot.nat_probe_enabled,
-                nat_probe_disabled_runtime: snapshot.nat_probe_disabled_runtime,
-                nat_probe_attempts: snapshot.nat_probe_attempts,
-            },
-            servers: RuntimeNatStunServersData {
-                configured: snapshot.configured_servers,
-                live: snapshot.live_servers.clone(),
-                live_total: snapshot.live_servers.len(),
-            },
-            reflection: RuntimeNatStunReflectionBlockData {
-                v4: snapshot
-                    .reflection_v4
-                    .map(|entry| RuntimeNatStunReflectionData {
-                        addr: entry.addr.to_string(),
-                        age_secs: entry.age_secs,
-                    }),
-                v6: snapshot
-                    .reflection_v6
-                    .map(|entry| RuntimeNatStunReflectionData {
-                        addr: entry.addr.to_string(),
-                        age_secs: entry.age_secs,
-                    }),
-            },
-            stun_backoff_remaining_ms: snapshot.stun_backoff_remaining_ms,
-        }),
-    }
-}
-
-fn now_epoch_secs() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs()
-}
+// ME pool runtime-state projection.
+mod me_pool;
+// NAT/STUN runtime projection and timestamping.
+mod nat;
+pub(super) use me_pool::build_runtime_me_pool_state_data;
+pub(super) use nat::build_runtime_nat_stun_data;
+use nat::now_epoch_secs;
@@ -0,0 +1,192 @@
+//! ME pool runtime-state projection.
+
+use std::collections::BTreeSet;
+
+use serde::Serialize;
+
+use super::{ApiShared, SOURCE_UNAVAILABLE_REASON, now_epoch_secs};
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateGenerationData {
+    active_generation: u64,
+    warm_generation: u64,
+    warm_generations: Vec<u64>,
+    pending_hardswap_generation: u64,
+    pending_hardswap_age_secs: Option<u64>,
+    reinit_inflight: usize,
+    reinit_max_concurrency_effective: usize,
+    draining_generations: Vec<u64>,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateHardswapData {
+    enabled: bool,
+    pending: bool,
+    pending_writers_current: usize,
+    pending_writer_deficit: usize,
+    pending_missing_dc_groups: usize,
+    pending_map_current: Option<bool>,
+    orphan_warm_writers_current: usize,
+    replacement_preparing_current: usize,
+    replacement_retiring_current: usize,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateWriterContourData {
+    warm: usize,
+    active: usize,
+    draining: usize,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateWriterHealthData {
+    healthy: usize,
+    degraded: usize,
+    draining: usize,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateWriterData {
+    total: usize,
+    alive_non_draining: usize,
+    draining: usize,
+    degraded: usize,
+    contour: RuntimeMePoolStateWriterContourData,
+    health: RuntimeMePoolStateWriterHealthData,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateRefillDcData {
+    dc: i16,
+    family: &'static str,
+    inflight: usize,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateRefillData {
+    inflight_endpoints_total: usize,
+    inflight_dc_total: usize,
+    running_dc_total: usize,
+    pending_dc_total: usize,
+    by_dc: Vec<RuntimeMePoolStateRefillDcData>,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStatePayload {
+    generations: RuntimeMePoolStateGenerationData,
+    hardswap: RuntimeMePoolStateHardswapData,
+    writers: RuntimeMePoolStateWriterData,
+    refill: RuntimeMePoolStateRefillData,
+}
+
+#[derive(Serialize)]
+struct RuntimeMePoolStateData {
+    enabled: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reason: Option<&'static str>,
+    generated_at_epoch_secs: u64,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    data: Option<RuntimeMePoolStatePayload>,
+}
+
+/// Builds the bounded runtime ME pool response projection.
+pub(in crate::api) async fn build_runtime_me_pool_state_data(shared: &ApiShared) -> impl Serialize {
+    let now_epoch_secs = now_epoch_secs();
+    let Some(pool) = shared.me_pool.read().await.clone() else {
+        return RuntimeMePoolStateData {
+            enabled: false,
+            reason: Some(SOURCE_UNAVAILABLE_REASON),
+            generated_at_epoch_secs: now_epoch_secs,
+            data: None,
+        };
+    };
+
+    let (status, runtime) = pool.api_coherent_snapshots().await;
+    let refill = pool.api_refill_snapshot().await;
+
+    let mut draining_generations = BTreeSet::<u64>::new();
+    let mut contour_warm = 0usize;
+    let mut contour_active = 0usize;
+    let mut contour_draining = 0usize;
+    let mut draining = 0usize;
+    let mut degraded = 0usize;
+    let mut healthy = 0usize;
+
+    for writer in &status.writers {
+        if writer.draining {
+            draining_generations.insert(writer.generation);
+            draining += 1;
+        }
+        if writer.degraded && !writer.draining {
+            degraded += 1;
+        }
+        if !writer.degraded && !writer.draining {
+            healthy += 1;
+        }
+        match writer.state {
+            "warm" => contour_warm += 1,
+            "active" => contour_active += 1,
+            _ => contour_draining += 1,
+        }
+    }
+
+    RuntimeMePoolStateData {
+        enabled: true,
+        reason: None,
+        generated_at_epoch_secs: status.generated_at_epoch_secs,
+        data: Some(RuntimeMePoolStatePayload {
+            generations: RuntimeMePoolStateGenerationData {
+                active_generation: runtime.active_generation,
+                warm_generation: runtime.warm_generation,
+                warm_generations: runtime.warm_generations,
+                pending_hardswap_generation: runtime.pending_hardswap_generation,
+                pending_hardswap_age_secs: runtime.pending_hardswap_age_secs,
+                reinit_inflight: runtime.reinit_inflight,
+                reinit_max_concurrency_effective: runtime.reinit_max_concurrency_effective,
+                draining_generations: draining_generations.into_iter().collect(),
+            },
+            hardswap: RuntimeMePoolStateHardswapData {
+                enabled: runtime.hardswap_enabled,
+                pending: runtime.pending_hardswap_generation != 0,
+                pending_writers_current: runtime.pending_writers_current,
+                pending_writer_deficit: runtime.pending_writer_deficit,
+                pending_missing_dc_groups: runtime.pending_missing_dc_groups,
+                pending_map_current: runtime.pending_map_current,
+                orphan_warm_writers_current: runtime.orphan_warm_writers_current,
+                replacement_preparing_current: runtime.replacement_preparing_current,
+                replacement_retiring_current: runtime.replacement_retiring_current,
+            },
+            writers: RuntimeMePoolStateWriterData {
+                total: status.writers.len(),
+                alive_non_draining: status.writers.len().saturating_sub(draining),
+                draining,
+                degraded,
+                contour: RuntimeMePoolStateWriterContourData {
+                    warm: contour_warm,
+                    active: contour_active,
+                    draining: contour_draining,
+                },
+                health: RuntimeMePoolStateWriterHealthData {
+                    healthy,
+                    degraded,
+                    draining,
+                },
+            },
+            refill: RuntimeMePoolStateRefillData {
+                inflight_endpoints_total: refill.inflight_endpoints_total,
+                inflight_dc_total: refill.inflight_dc_total,
+                running_dc_total: refill.running_dc_total,
+                pending_dc_total: refill.pending_dc_total,
+                by_dc: refill
+                    .by_dc
+                    .into_iter()
+                    .map(|entry| RuntimeMePoolStateRefillDcData {
+                        dc: entry.dc,
+                        family: entry.family,
+                        inflight: entry.inflight,
+                    })
+                    .collect(),
+            },
+        }),
+    }
+}
@@ -0,0 +1,54 @@
+use super::*;
+
+pub(in crate::api) async fn build_runtime_nat_stun_data(shared: &ApiShared) -> RuntimeNatStunData {
+    let now_epoch_secs = now_epoch_secs();
+    let Some(pool) = shared.me_pool.read().await.clone() else {
+        return RuntimeNatStunData {
+            enabled: false,
+            reason: Some(SOURCE_UNAVAILABLE_REASON),
+            generated_at_epoch_secs: now_epoch_secs,
+            data: None,
+        };
+    };
+
+    let snapshot = pool.api_nat_stun_snapshot().await;
+    RuntimeNatStunData {
+        enabled: true,
+        reason: None,
+        generated_at_epoch_secs: now_epoch_secs,
+        data: Some(RuntimeNatStunPayload {
+            flags: RuntimeNatStunFlagsData {
+                nat_probe_enabled: snapshot.nat_probe_enabled,
+                nat_probe_disabled_runtime: snapshot.nat_probe_disabled_runtime,
+                nat_probe_attempts: snapshot.nat_probe_attempts,
+            },
+            servers: RuntimeNatStunServersData {
+                configured: snapshot.configured_servers,
+                live: snapshot.live_servers.clone(),
+                live_total: snapshot.live_servers.len(),
+            },
+            reflection: RuntimeNatStunReflectionBlockData {
+                v4: snapshot
+                    .reflection_v4
+                    .map(|entry| RuntimeNatStunReflectionData {
+                        addr: entry.addr.to_string(),
+                        age_secs: entry.age_secs,
+                    }),
+                v6: snapshot
+                    .reflection_v6
+                    .map(|entry| RuntimeNatStunReflectionData {
+                        addr: entry.addr.to_string(),
+                        age_secs: entry.age_secs,
+                    }),
+            },
+            stun_backoff_remaining_ms: snapshot.stun_backoff_remaining_ms,
+        }),
+    }
+}
+
+pub(super) fn now_epoch_secs() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
@@ -61,6 +61,12 @@ pub(super) fn build_zero_all_data(stats: &Stats, configured_users: usize) -> Zer
            conntrack_pressure_active: stats.get_conntrack_pressure_active(),
            conntrack_event_queue_depth: stats.get_conntrack_event_queue_depth(),
            conntrack_rule_apply_ok: stats.get_conntrack_rule_apply_ok(),
+            conntrack_rule_reconcile_success_total: stats
+                .get_conntrack_rule_reconcile_success_total(),
+            conntrack_rule_reconcile_error_total: stats.get_conntrack_rule_reconcile_error_total(),
+            conntrack_rule_rollback_success_total: stats
+                .get_conntrack_rule_rollback_success_total(),
+            conntrack_rule_rollback_error_total: stats.get_conntrack_rule_rollback_error_total(),
            conntrack_delete_attempt_total: stats.get_conntrack_delete_attempt_total(),
            conntrack_delete_success_total: stats.get_conntrack_delete_success_total(),
            conntrack_delete_not_found_total: stats.get_conntrack_delete_not_found_total(),
@@ -84,6 +90,7 @@ pub(super) fn build_zero_all_data(stats: &Stats, configured_users: usize) -> Zer
            reconnect_success_total: stats.get_me_reconnect_success(),
            handshake_reject_total: stats.get_me_handshake_reject_total(),
            handshake_error_codes,
+            handshake_error_code_overflow_total: stats.get_me_handshake_error_code_overflow_total(),
            reader_eof_total: stats.get_me_reader_eof_total(),
            idle_close_by_peer_total: stats.get_me_idle_close_by_peer_total(),
            route_drop_no_conn_total: stats.get_me_route_drop_no_conn(),
@@ -342,8 +349,7 @@ async fn get_minimal_payload_cached(
    }

    let pool = shared.me_pool.read().await.clone()?;
-    let status = pool.api_status_snapshot().await;
-    let runtime = pool.api_runtime_snapshot().await;
+    let (status, runtime) = pool.api_coherent_snapshots().await;
    let generated_at_epoch_secs = status.generated_at_epoch_secs;

    let me_writers = MeWritersData {
@@ -425,8 +431,11 @@ async fn get_minimal_payload_cached(
    let me_runtime = MinimalMeRuntimeData {
        active_generation: runtime.active_generation,
        warm_generation: runtime.warm_generation,
+        warm_generations: runtime.warm_generations,
        pending_hardswap_generation: runtime.pending_hardswap_generation,
        pending_hardswap_age_secs: runtime.pending_hardswap_age_secs,
+        reinit_inflight: runtime.reinit_inflight,
+        reinit_max_concurrency_effective: runtime.reinit_max_concurrency_effective,
        hardswap_enabled: runtime.hardswap_enabled,
        floor_mode: runtime.floor_mode,
        adaptive_floor_idle_secs: runtime.adaptive_floor_idle_secs,
@@ -523,57 +532,6 @@ async fn get_minimal_payload_cached(
    Some((generated_at_epoch_secs, payload))
 }

-fn disabled_me_writers(now_epoch_secs: u64, reason: &'static str) -> MeWritersData {
-    MeWritersData {
-        middle_proxy_enabled: false,
-        reason: Some(reason),
-        generated_at_epoch_secs: now_epoch_secs,
-        summary: MeWritersSummary {
-            configured_dc_groups: 0,
-            configured_endpoints: 0,
-            available_endpoints: 0,
-            available_pct: 0.0,
-            required_writers: 0,
-            alive_writers: 0,
-            coverage_pct: 0.0,
-            fresh_alive_writers: 0,
-            fresh_coverage_pct: 0.0,
-        },
-        writers: Vec::new(),
-    }
-}
-
-fn disabled_dcs(now_epoch_secs: u64, reason: &'static str) -> DcStatusData {
-    DcStatusData {
-        middle_proxy_enabled: false,
-        reason: Some(reason),
-        generated_at_epoch_secs: now_epoch_secs,
-        dcs: Vec::new(),
-    }
-}
-
-fn map_route_kind(value: UpstreamRouteKind) -> &'static str {
-    match value {
-        UpstreamRouteKind::Direct => "direct",
-        UpstreamRouteKind::Socks4 => "socks4",
-        UpstreamRouteKind::Socks5 => "socks5",
-        UpstreamRouteKind::Shadowsocks => "shadowsocks",
-    }
-}
-
-fn map_ip_preference(value: IpPreference) -> &'static str {
-    match value {
-        IpPreference::Unknown => "unknown",
-        IpPreference::PreferV6 => "prefer_v6",
-        IpPreference::PreferV4 => "prefer_v4",
-        IpPreference::BothWork => "both_work",
-        IpPreference::Unavailable => "unavailable",
-    }
-}
-
-fn now_epoch_secs() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs()
-}
+// Disabled-state builders and stable upstream enum mappings.
+mod helpers;
+use helpers::*;
@@ -0,0 +1,56 @@
+use super::*;
+
+pub(super) fn disabled_me_writers(now_epoch_secs: u64, reason: &'static str) -> MeWritersData {
+    MeWritersData {
+        middle_proxy_enabled: false,
+        reason: Some(reason),
+        generated_at_epoch_secs: now_epoch_secs,
+        summary: MeWritersSummary {
+            configured_dc_groups: 0,
+            configured_endpoints: 0,
+            available_endpoints: 0,
+            available_pct: 0.0,
+            required_writers: 0,
+            alive_writers: 0,
+            coverage_pct: 0.0,
+            fresh_alive_writers: 0,
+            fresh_coverage_pct: 0.0,
+        },
+        writers: Vec::new(),
+    }
+}
+
+pub(super) fn disabled_dcs(now_epoch_secs: u64, reason: &'static str) -> DcStatusData {
+    DcStatusData {
+        middle_proxy_enabled: false,
+        reason: Some(reason),
+        generated_at_epoch_secs: now_epoch_secs,
+        dcs: Vec::new(),
+    }
+}
+
+pub(super) fn map_route_kind(value: UpstreamRouteKind) -> &'static str {
+    match value {
+        UpstreamRouteKind::Direct => "direct",
+        UpstreamRouteKind::Socks4 => "socks4",
+        UpstreamRouteKind::Socks5 => "socks5",
+        UpstreamRouteKind::Shadowsocks => "shadowsocks",
+    }
+}
+
+pub(super) fn map_ip_preference(value: IpPreference) -> &'static str {
+    match value {
+        IpPreference::Unknown => "unknown",
+        IpPreference::PreferV6 => "prefer_v6",
+        IpPreference::PreferV4 => "prefer_v4",
+        IpPreference::BothWork => "both_work",
+        IpPreference::Unavailable => "unavailable",
+    }
+}
+
+pub(super) fn now_epoch_secs() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
@@ -4,6 +4,7 @@ use std::time::{SystemTime, UNIX_EPOCH};

 use tokio::sync::watch;

+use crate::maestro::control_plane::ProcessControlPlane;
 use crate::maestro::generation::RuntimeWatchState;

 use super::ApiRuntimeState;
@@ -13,22 +14,29 @@ pub(super) fn spawn_runtime_watchers(
    runtime_watch_rx: watch::Receiver<Option<RuntimeWatchState>>,
    runtime_state: Arc<ApiRuntimeState>,
    runtime_events: Arc<ApiEventStore>,
+    control_plane: &ProcessControlPlane,
 ) {
-    let _config_watcher = spawn_config_watcher(
+    spawn_config_watcher(
        runtime_watch_rx.clone(),
        runtime_state.clone(),
        runtime_events.clone(),
+        control_plane,
+    );
+    spawn_admission_watcher(
+        runtime_watch_rx,
+        runtime_state,
+        runtime_events,
+        control_plane,
    );
-    let _admission_watcher =
-        spawn_admission_watcher(runtime_watch_rx, runtime_state, runtime_events);
 }

 fn spawn_config_watcher(
    mut runtime_watch_rx: watch::Receiver<Option<RuntimeWatchState>>,
    runtime_state: Arc<ApiRuntimeState>,
    runtime_events: Arc<ApiEventStore>,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
+    control_plane: &ProcessControlPlane,
+) {
+    let _ = control_plane.spawn(async move {
        let Some(mut current) = runtime_watch_rx.borrow().clone() else {
            return;
        };
@@ -78,15 +86,16 @@ fn spawn_config_watcher(
                }
            }
        }
-    })
+    });
 }

 fn spawn_admission_watcher(
    mut runtime_watch_rx: watch::Receiver<Option<RuntimeWatchState>>,
    runtime_state: Arc<ApiRuntimeState>,
    runtime_events: Arc<ApiEventStore>,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
+    control_plane: &ProcessControlPlane,
+) {
+    let _ = control_plane.spawn(async move {
        let Some(mut current) = runtime_watch_rx.borrow().clone() else {
            return;
        };
@@ -124,7 +133,7 @@ fn spawn_admission_watcher(
                }
            }
        }
-    })
+    });
 }

 fn active_generation_id(
@@ -246,7 +255,13 @@ mod tests {
        let (runtime_watch_tx, runtime_watch_rx) = watch::channel(Some(initial));
        let runtime_state = runtime_state();
        let events = Arc::new(ApiEventStore::new(16));
-        spawn_runtime_watchers(runtime_watch_rx, runtime_state.clone(), events.clone());
+        let control_plane = ProcessControlPlane::new();
+        spawn_runtime_watchers(
+            runtime_watch_rx,
+            runtime_state.clone(),
+            events.clone(),
+            &control_plane,
+        );
        tokio::task::yield_now().await;

        assert_eq!(runtime_state.config_reload_count.load(Ordering::Relaxed), 0);
@@ -283,6 +298,7 @@ mod tests {
                .count(),
            3
        );
+        assert!(control_plane.shutdown(Duration::from_secs(1)).await);
    }

    #[tokio::test]
@@ -291,7 +307,13 @@ mod tests {
        let (runtime_watch_tx, runtime_watch_rx) = watch::channel(Some(initial));
        let runtime_state = runtime_state();
        let events = Arc::new(ApiEventStore::new(16));
-        let watcher = spawn_config_watcher(runtime_watch_rx, runtime_state.clone(), events.clone());
+        let control_plane = ProcessControlPlane::new();
+        spawn_config_watcher(
+            runtime_watch_rx,
+            runtime_state.clone(),
+            events.clone(),
+            &control_plane,
+        );
        drop(initial_config_tx);
        tokio::task::yield_now().await;

@@ -302,10 +324,7 @@ mod tests {
        wait_for_count(&runtime_state, 2).await;

        drop(runtime_watch_tx);
-        tokio::time::timeout(Duration::from_secs(1), watcher)
-            .await
-            .unwrap()
-            .unwrap();
+        assert!(control_plane.shutdown(Duration::from_secs(1)).await);
        assert_eq!(
            events
                .snapshot(16)
@@ -200,7 +200,7 @@ pub(super) async fn build_runtime_gates_data(
        && cfg.general.me2dc_fallback
        && matches!(route_state.mode, RelayRouteMode::Direct);
    let reroute_to_direct_at_epoch_secs = if reroute_active {
-        shared.route_runtime.direct_since_epoch_secs()
+        route_state.direct_since_epoch_secs
    } else {
        None
    };
@@ -5,12 +5,13 @@ use hyper::StatusCode;
 use crate::config::ProxyConfig;
 use crate::config::RateLimitBps;
 use crate::ip_tracker::UserIpTracker;
+use crate::proxy::user_admission::credential_id_from_hex;
 use crate::stats::Stats;

 use super::ApiShared;
 use super::config_store::{
-    AccessSection, current_revision, ensure_expected_revision, load_config_from_disk,
-    save_access_sections_to_disk,
+    AccessSection, current_revision, load_config_for_mutation,
+    save_access_sections_to_disk_if_revision,
 };
 use super::model::{
    ApiFailure, CreateUserRequest, CreateUserResponse, PatchUserRequest, RotateSecretRequest,
@@ -4,6 +4,20 @@ pub(in crate::api) async fn create_user(
    body: CreateUserRequest,
    expected_revision: Option<String>,
    shared: &ApiShared,
+) -> Result<(CreateUserResponse, String), ApiFailure> {
+    let shared = shared.clone();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            create_user_to_completion(body, expected_revision, &shared).await
+        })
+        .await
+}
+
+async fn create_user_to_completion(
+    body: CreateUserRequest,
+    expected_revision: Option<String>,
+    shared: &ApiShared,
 ) -> Result<(CreateUserResponse, String), ApiFailure> {
    let touches_user_ad_tags = body.user_ad_tag.is_some();
    let touches_user_max_tcp_conns = body.max_tcp_conns.is_some();
@@ -41,9 +55,11 @@ pub(in crate::api) async fn create_user(
    }

    let expiration = parse_optional_expiration(body.expiration_rfc3339.as_deref())?;
+    let credential_id = credential_id_from_hex(&secret)
+        .ok_or_else(|| ApiFailure::internal("validated user secret could not be decoded"))?;
    let _guard = shared.mutation_lock.lock().await;
-    let mut cfg = load_config_from_disk(&shared.config_path).await?;
-    ensure_expected_revision(&shared.config_path, expected_revision.as_deref()).await?;
+    let (mut cfg, base_revision) =
+        load_config_for_mutation(&shared.config_path, expected_revision.as_deref()).await?;

    if cfg.access.users.contains_key(&body.username) {
        return Err(ApiFailure::new(
@@ -122,9 +138,18 @@ pub(in crate::api) async fn create_user(
        touched_sections.push(AccessSection::UserEnabled);
    }

-    let revision =
-        save_access_sections_to_disk(&shared.config_path, &cfg, &touched_sections).await?;
-    drop(_guard);
+    let revision = save_access_sections_to_disk_if_revision(
+        &shared.config_path,
+        &cfg,
+        &touched_sections,
+        Some(&base_revision),
+    )
+    .await?;
+    shared.proxy_shared.stage_user_credential(
+        &body.username,
+        credential_id,
+        cfg.access.is_user_enabled(&body.username),
+    );

    if let Some(limit) = updated_limit {
        shared
@@ -132,6 +157,7 @@ pub(in crate::api) async fn create_user(
            .set_user_limit(&body.username, limit)
            .await;
    }
+    drop(_guard);
    let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();

    let users = users_from_config(
@@ -1,10 +1,27 @@
 use super::*;
+use tracing::warn;

 pub(in crate::api) async fn rotate_secret(
    user: &str,
    body: RotateSecretRequest,
    expected_revision: Option<String>,
    shared: &ApiShared,
+) -> Result<(CreateUserResponse, String), ApiFailure> {
+    let shared = shared.clone();
+    let user = user.to_string();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            rotate_secret_to_completion(&user, body, expected_revision, &shared).await
+        })
+        .await
+}
+
+async fn rotate_secret_to_completion(
+    user: &str,
+    body: RotateSecretRequest,
+    expected_revision: Option<String>,
+    shared: &ApiShared,
 ) -> Result<(CreateUserResponse, String), ApiFailure> {
    let secret = body.secret.unwrap_or_else(random_user_secret);
    if !is_valid_user_secret(&secret) {
@@ -12,10 +29,12 @@ pub(in crate::api) async fn rotate_secret(
            "secret must be exactly 32 hex characters",
        ));
    }
+    let credential_id = credential_id_from_hex(&secret)
+        .ok_or_else(|| ApiFailure::internal("validated user secret could not be decoded"))?;

    let _guard = shared.mutation_lock.lock().await;
-    let mut cfg = load_config_from_disk(&shared.config_path).await?;
-    ensure_expected_revision(&shared.config_path, expected_revision.as_deref()).await?;
+    let (mut cfg, base_revision) =
+        load_config_for_mutation(&shared.config_path, expected_revision.as_deref()).await?;

    if !cfg.access.users.contains_key(user) {
        return Err(ApiFailure::new(
@@ -28,8 +47,18 @@ pub(in crate::api) async fn rotate_secret(
    cfg.access.users.insert(user.to_string(), secret.clone());
    cfg.validate()
        .map_err(|e| ApiFailure::bad_request(format!("config validation failed: {}", e)))?;
-    let revision =
-        save_access_sections_to_disk(&shared.config_path, &cfg, &[AccessSection::Users]).await?;
+    let revision = save_access_sections_to_disk_if_revision(
+        &shared.config_path,
+        &cfg,
+        &[AccessSection::Users],
+        Some(&base_revision),
+    )
+    .await?;
+    shared.proxy_shared.stage_user_credential(
+        user,
+        credential_id,
+        cfg.access.is_user_enabled(user),
+    );
    drop(_guard);

    let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();
@@ -60,10 +89,25 @@ pub(in crate::api) async fn delete_user(
    user: &str,
    expected_revision: Option<String>,
    shared: &ApiShared,
+) -> Result<(String, String), ApiFailure> {
+    let shared = shared.clone();
+    let user = user.to_string();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            delete_user_to_completion(&user, expected_revision, &shared).await
+        })
+        .await
+}
+
+async fn delete_user_to_completion(
+    user: &str,
+    expected_revision: Option<String>,
+    shared: &ApiShared,
 ) -> Result<(String, String), ApiFailure> {
    let _guard = shared.mutation_lock.lock().await;
-    let mut cfg = load_config_from_disk(&shared.config_path).await?;
-    ensure_expected_revision(&shared.config_path, expected_revision.as_deref()).await?;
+    let (mut cfg, base_revision) =
+        load_config_for_mutation(&shared.config_path, expected_revision.as_deref()).await?;

    if !cfg.access.users.contains_key(user) {
        return Err(ApiFailure::new(
@@ -106,11 +150,32 @@ pub(in crate::api) async fn delete_user(

    cfg.validate()
        .map_err(|e| ApiFailure::bad_request(format!("config validation failed: {}", e)))?;
-    let revision =
-        save_access_sections_to_disk(&shared.config_path, &cfg, &touched_sections).await?;
-    drop(_guard);
+    let revision = save_access_sections_to_disk_if_revision(
+        &shared.config_path,
+        &cfg,
+        &touched_sections,
+        Some(&base_revision),
+    )
+    .await?;
+    let deleted_incarnation = shared.proxy_shared.delete_user(user).incarnation;
+    let configured_users = cfg.access.users.keys().cloned().collect();
+    if let Err(error) = shared
+        .quota_state
+        .remove_user(&configured_users, user)
+        .await
+    {
+        warn!(
+            user,
+            error = %error,
+            "Deleted user quota checkpoint cleanup will be reconciled on restart"
+        );
+    }
    shared.ip_tracker.remove_user_limit(user).await;
-    shared.ip_tracker.clear_user_ips(user).await;
+    shared
+        .ip_tracker
+        .clear_user_ips_if_not_newer(user, deleted_incarnation)
+        .await;
+    drop(_guard);

    Ok((user.to_string(), revision))
 }
@@ -5,6 +5,22 @@ pub(in crate::api) async fn patch_user(
    body: PatchUserRequest,
    expected_revision: Option<String>,
    shared: &ApiShared,
+) -> Result<(UserInfo, String), ApiFailure> {
+    let shared = shared.clone();
+    let user = user.to_string();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            patch_user_to_completion(&user, body, expected_revision, &shared).await
+        })
+        .await
+}
+
+async fn patch_user_to_completion(
+    user: &str,
+    body: PatchUserRequest,
+    expected_revision: Option<String>,
+    shared: &ApiShared,
 ) -> Result<(UserInfo, String), ApiFailure> {
    let touches_users = body.secret.is_some();
    let touches_user_ad_tags = !matches!(&body.user_ad_tag, Patch::Unchanged);
@@ -32,8 +48,8 @@ pub(in crate::api) async fn patch_user(
    }
    let expiration = parse_patch_expiration(&body.expiration_rfc3339)?;
    let _guard = shared.mutation_lock.lock().await;
-    let mut cfg = load_config_from_disk(&shared.config_path).await?;
-    ensure_expected_revision(&shared.config_path, expected_revision.as_deref()).await?;
+    let (mut cfg, base_revision) =
+        load_config_for_mutation(&shared.config_path, expected_revision.as_deref()).await?;

    if !cfg.access.users.contains_key(user) {
        return Err(ApiFailure::new(
@@ -138,6 +154,19 @@ pub(in crate::api) async fn patch_user(

    cfg.validate()
        .map_err(|e| ApiFailure::bad_request(format!("config validation failed: {}", e)))?;
+    let staged_credential =
+        if touches_users || touches_user_enabled {
+            let secret = cfg
+                .access
+                .users
+                .get(user)
+                .ok_or_else(|| ApiFailure::internal("updated user secret is missing"))?;
+            Some(credential_id_from_hex(secret).ok_or_else(|| {
+                ApiFailure::internal("validated user secret could not be decoded")
+            })?)
+        } else {
+            None
+        };

    let mut touched_sections = Vec::new();
    if touches_users {
@@ -168,14 +197,27 @@ pub(in crate::api) async fn patch_user(
    let revision = if touched_sections.is_empty() {
        current_revision(&shared.config_path).await?
    } else {
-        save_access_sections_to_disk(&shared.config_path, &cfg, &touched_sections).await?
+        save_access_sections_to_disk_if_revision(
+            &shared.config_path,
+            &cfg,
+            &touched_sections,
+            Some(&base_revision),
+        )
+        .await?
    };
-    drop(_guard);
+    if let Some(credential_id) = staged_credential {
+        shared.proxy_shared.stage_user_credential(
+            user,
+            credential_id,
+            cfg.access.is_user_enabled(user),
+        );
+    }
    match max_unique_ips_change {
        Some(Some(limit)) => shared.ip_tracker.set_user_limit(user, limit).await,
        Some(None) => shared.ip_tracker.remove_user_limit(user).await,
        None => {}
    }
+    drop(_guard);
    let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();
    let users = users_from_config(
        &cfg,
@@ -199,10 +241,26 @@ pub(in crate::api) async fn set_user_enabled(
    enabled: bool,
    expected_revision: Option<String>,
    shared: &ApiShared,
+) -> Result<(UserInfo, String), ApiFailure> {
+    let shared = shared.clone();
+    let user = user.to_string();
+    shared
+        .clone()
+        .run_mutation_completion(async move {
+            set_user_enabled_to_completion(&user, enabled, expected_revision, &shared).await
+        })
+        .await
+}
+
+async fn set_user_enabled_to_completion(
+    user: &str,
+    enabled: bool,
+    expected_revision: Option<String>,
+    shared: &ApiShared,
 ) -> Result<(UserInfo, String), ApiFailure> {
    let _guard = shared.mutation_lock.lock().await;
-    let mut cfg = load_config_from_disk(&shared.config_path).await?;
-    ensure_expected_revision(&shared.config_path, expected_revision.as_deref()).await?;
+    let (mut cfg, base_revision) =
+        load_config_for_mutation(&shared.config_path, expected_revision.as_deref()).await?;

    if !cfg.access.users.contains_key(user) {
        return Err(ApiFailure::new(
@@ -220,9 +278,22 @@ pub(in crate::api) async fn set_user_enabled(

    cfg.validate()
        .map_err(|e| ApiFailure::bad_request(format!("config validation failed: {}", e)))?;
-    let revision =
-        save_access_sections_to_disk(&shared.config_path, &cfg, &[AccessSection::UserEnabled])
-            .await?;
+    let credential_id = cfg
+        .access
+        .users
+        .get(user)
+        .and_then(|secret| credential_id_from_hex(secret))
+        .ok_or_else(|| ApiFailure::internal("validated user secret could not be decoded"))?;
+    let revision = save_access_sections_to_disk_if_revision(
+        &shared.config_path,
+        &cfg,
+        &[AccessSection::UserEnabled],
+        Some(&base_revision),
+    )
+    .await?;
+    shared
+        .proxy_shared
+        .stage_user_credential(user, credential_id, enabled);
    drop(_guard);

    let (detected_ip_v4, detected_ip_v6) = shared.detected_link_ips();
@@ -71,7 +71,7 @@ pub(in crate::api) async fn users_from_config(
                .filter(|limit| *limit > 0)
                .or((cfg.access.user_max_unique_ips_global_each > 0)
                    .then_some(cfg.access.user_max_unique_ips_global_each)),
-            current_connections: stats.get_user_curr_connects(&username),
+            current_connections: stats.get_process_user_curr_connects(&username),
            active_unique_ips: active_ip_list.len(),
            active_unique_ips_list: active_ip_list,
            recent_unique_ips: recent_ip_list.len(),
@@ -0,0 +1,533 @@
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use http_body_util::Full;
+use hyper::body::{Bytes, Incoming};
+use hyper::header::CONTENT_TYPE;
+use hyper::{Method, Request, Response, StatusCode};
+use serde::Serialize;
+
+use super::config_store::current_revision;
+use super::http_utils::{read_json, success_response};
+use super::model::ApiFailure;
+use super::{ALLOW_GET, ALLOW_POST, ApiShared};
+use crate::config::ProxyConfig;
+use crate::web::control::{WebRuntimeLifecycle, WebRuntimePublication};
+use crate::web::manager::{ControlError, OperatorLifecycleError, SessionDetail, WebProcessRuntime};
+
+// Exact JSON DTOs and strict query parsing stay independent from route dispatch.
+mod request;
+// Ingress, capacity, and decoy telemetry remain separate availability planes.
+mod observability;
+use observability::{
+    WebCapacityStatus, WebCarrierNegotiationStatus, WebDecoyFastTrackStatus,
+    WebDecoyUpstreamStatus, WebIngressStatus, WebLifecycleCountersStatus,
+};
+use request::{
+    CloseRequest, DrainRequest, RuntimeInstanceRequest, parse_session_query, parse_session_ref,
+    valid_runtime_instance,
+};
+
+const STATUS_PATH: &str = "/v1/runtime/web/status";
+const SESSIONS_PATH: &str = "/v1/runtime/web/sessions";
+const CLOSE_PATH: &str = "/v1/runtime/web/sessions/close";
+const DEBUG_CLEAR_PATH: &str = "/v1/runtime/web/debug/clear";
+const LEARNING_RESET_PATH: &str = "/v1/runtime/web/carrier-learning/reset";
+const LIFECYCLE_PAUSE_PATH: &str = "/v1/runtime/web/lifecycle/pause";
+const LIFECYCLE_DRAIN_PATH: &str = "/v1/runtime/web/lifecycle/drain";
+const LIFECYCLE_RESUME_PATH: &str = "/v1/runtime/web/lifecycle/resume";
+const SESSION_DETAIL_PREFIX: &str = "/v1/runtime/web/sessions/";
+const OPERATION_PREFIX: &str = "/v1/runtime/web/operations/";
+const MAX_CONTROL_BODY_BYTES: usize = 64 * 1024;
+
+/// Returns the exact allowed method set for a WEB runtime route.
+pub(super) fn allowed_methods(path: &str) -> Option<&'static str> {
+    match path {
+        STATUS_PATH | SESSIONS_PATH => Some(ALLOW_GET),
+        CLOSE_PATH
+        | DEBUG_CLEAR_PATH
+        | LEARNING_RESET_PATH
+        | LIFECYCLE_PAUSE_PATH
+        | LIFECYCLE_DRAIN_PATH
+        | LIFECYCLE_RESUME_PATH => Some(ALLOW_POST),
+        _ if detail_ref(path).is_some() || operation_ref(path).is_some() => Some(ALLOW_GET),
+        _ => None,
+    }
+}
+
+/// Returns whether the normalized API path belongs to WEB runtime control.
+pub(super) fn is_route(path: &str) -> bool {
+    allowed_methods(path).is_some()
+}
+
+/// Dispatches one authenticated WEB runtime status or control request.
+pub(super) async fn handle(
+    method: Method,
+    path: &str,
+    query: Option<&str>,
+    request: Request<Incoming>,
+    shared: &ApiShared,
+    config: &ProxyConfig,
+    _request_id: u64,
+    body_limit: usize,
+) -> Result<Response<Full<Bytes>>, ApiFailure> {
+    let revision = current_revision(&shared.config_path).await?;
+    match (method.as_str(), path) {
+        ("GET", STATUS_PATH) => {
+            reject_query(query)?;
+            let publication = shared.web_runtime_rx.borrow().clone();
+            let runtime = publication.runtime.upgrade();
+            let data = WebStatusData::new(publication, runtime.as_deref(), config);
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("GET", SESSIONS_PATH) => {
+            let runtime = readable_runtime(shared)?;
+            let request = parse_session_query(&runtime, query)?;
+            let page = runtime.list_sessions(request);
+            Ok(success_response(StatusCode::OK, page, revision))
+        }
+        ("GET", _) if detail_ref(path).is_some() => {
+            reject_query(query)?;
+            let runtime = readable_runtime(shared)?;
+            let session_ref = detail_ref(path).expect("route guard checked detail reference");
+            let trace_session_id = parse_session_ref(&runtime, session_ref)?;
+            match runtime.session_detail(trace_session_id) {
+                SessionDetail::Active(row) => Ok(success_response(StatusCode::OK, row, revision)),
+                SessionDetail::Gone {
+                    attempt,
+                    carrier,
+                    reason,
+                    closed_age_ms,
+                } => Ok(success_response(
+                    StatusCode::GONE,
+                    GoneSessionData {
+                        session_ref: session_ref.to_string(),
+                        state: "closed",
+                        attempt,
+                        carrier,
+                        reason,
+                        closed_age_ms,
+                    },
+                    revision,
+                )),
+                SessionDetail::Busy => Err(snapshot_busy()),
+                SessionDetail::NotFound => Err(ApiFailure::new(
+                    StatusCode::NOT_FOUND,
+                    "web_session_not_found",
+                    "WEB session was not found",
+                )),
+            }
+        }
+        ("GET", _) if operation_ref(path).is_some() => {
+            reject_query(query)?;
+            let runtime = readable_runtime(shared)?;
+            let operation_id = operation_ref(path).expect("route guard checked operation id");
+            let status = runtime
+                .control_operation(operation_id)
+                .map_err(control_failure)?;
+            Ok(success_response(StatusCode::OK, status, revision))
+        }
+        ("POST", LIFECYCLE_PAUSE_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<RuntimeInstanceRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let status = runtime.pause_operator().await.map_err(lifecycle_failure)?;
+            shared.runtime_events.record(
+                "api.web.lifecycle.pause.ok",
+                format!("epoch={}", status.epoch),
+            );
+            Ok(success_response(StatusCode::OK, status, revision))
+        }
+        ("POST", LIFECYCLE_DRAIN_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<DrainRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let timeout = drain_timeout(request.timeout_secs)?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let status = runtime
+                .drain_operator(timeout)
+                .await
+                .map_err(lifecycle_failure)?;
+            shared.runtime_events.record(
+                "api.web.lifecycle.drain.accepted",
+                format!(
+                    "epoch={} timeout_secs={}",
+                    status.epoch, request.timeout_secs
+                ),
+            );
+            Ok(success_response(StatusCode::ACCEPTED, status, revision))
+        }
+        ("POST", LIFECYCLE_RESUME_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<RuntimeInstanceRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let status = runtime.resume_operator().await.map_err(lifecycle_failure)?;
+            shared.runtime_events.record(
+                "api.web.lifecycle.resume.ok",
+                format!("epoch={}", status.epoch),
+            );
+            Ok(success_response(StatusCode::OK, status, revision))
+        }
+        ("POST", CLOSE_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<CloseRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let selector = request.selector.resolve(&runtime)?;
+            let status = runtime
+                .start_close_operation(&request.runtime_instance, selector)
+                .map_err(control_failure)?;
+            shared.runtime_events.record(
+                "api.web.sessions.close.accepted",
+                format!(
+                    "operation_id={} requested={}",
+                    status.operation_id, status.requested
+                ),
+            );
+            Ok(success_response(StatusCode::ACCEPTED, status, revision))
+        }
+        ("POST", DEBUG_CLEAR_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<RuntimeInstanceRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let outcome = runtime.clear_debug().map_err(control_failure)?;
+            let data = DebugClearData {
+                runtime_instance: runtime.runtime_instance().to_string(),
+                records_cleared: outcome.records_cleared,
+                leased_bytes: outcome.leased_bytes,
+                epoch: outcome.epoch,
+            };
+            shared.runtime_events.record(
+                "api.web.debug.clear.ok",
+                format!("records={} epoch={}", data.records_cleared, data.epoch),
+            );
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        ("POST", LEARNING_RESET_PATH) => {
+            require_mutable(config)?;
+            reject_query(query)?;
+            require_json_content_type(&request)?;
+            let request = read_json::<RuntimeInstanceRequest>(
+                request.into_body(),
+                body_limit.min(MAX_CONTROL_BODY_BYTES),
+            )
+            .await?;
+            let runtime = control_runtime(shared)?;
+            require_runtime_instance(&runtime, &request.runtime_instance)?;
+            let outcome = runtime
+                .reset_carrier_learning()
+                .map_err(|_| runtime_unavailable(WebRuntimeLifecycle::Draining))?;
+            let data = LearningResetData {
+                runtime_instance: runtime.runtime_instance().to_string(),
+                entries_cleared: outcome.entries_cleared,
+                epoch: outcome.epoch,
+            };
+            shared.runtime_events.record(
+                "api.web.carrier_learning.reset.ok",
+                format!("entries={} epoch={}", data.entries_cleared, data.epoch),
+            );
+            Ok(success_response(StatusCode::OK, data, revision))
+        }
+        _ => Err(ApiFailure::method_not_allowed(
+            allowed_methods(path).unwrap_or(ALLOW_GET),
+        )),
+    }
+}
+
+#[derive(Serialize)]
+struct WebStatusData {
+    lifecycle: &'static str,
+    lifecycle_epoch: u64,
+    lifecycle_age_ms: u64,
+    available: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reason: Option<&'static str>,
+    listeners: Vec<String>,
+    effective_config_enabled: bool,
+    ingress: WebIngressStatus,
+    capacity: WebCapacityStatus,
+    decoy_upstream: WebDecoyUpstreamStatus,
+    decoy_fasttrack: WebDecoyFastTrackStatus,
+    carrier_negotiation: WebCarrierNegotiationStatus,
+    lifecycle_counters: WebLifecycleCountersStatus,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    operator_lifecycle: Option<crate::web::manager::OperatorLifecycleStatus>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    runtime: Option<crate::web::manager::WebRuntimeStatus>,
+}
+
+impl WebStatusData {
+    fn new(
+        publication: WebRuntimePublication,
+        runtime: Option<&WebProcessRuntime>,
+        config: &ProxyConfig,
+    ) -> Self {
+        let available = runtime.is_some()
+            && matches!(
+                publication.lifecycle,
+                WebRuntimeLifecycle::Running | WebRuntimeLifecycle::Draining
+            );
+        let reason = if available {
+            None
+        } else {
+            Some(match publication.lifecycle {
+                WebRuntimeLifecycle::Starting => "starting",
+                WebRuntimeLifecycle::NoWebListener => "no_web_listener",
+                WebRuntimeLifecycle::Running => "runtime_released",
+                WebRuntimeLifecycle::Draining => "runtime_released",
+                WebRuntimeLifecycle::Drained => "drained",
+                WebRuntimeLifecycle::DeadlineExceeded => "deadline_exceeded",
+            })
+        };
+        let operator_lifecycle = runtime.map(WebProcessRuntime::operator_lifecycle_status);
+        let ingress = WebIngressStatus::new(&publication, runtime.is_some());
+        let capacity = WebCapacityStatus::new(&publication, runtime, config);
+        let decoy_upstream = WebDecoyUpstreamStatus::new(&publication);
+        let decoy_fasttrack = WebDecoyFastTrackStatus::new(&publication, config);
+        let carrier_negotiation = WebCarrierNegotiationStatus::new(&publication);
+        let lifecycle_counters = WebLifecycleCountersStatus::new(&publication, config);
+        Self {
+            lifecycle: publication.lifecycle.as_str(),
+            lifecycle_epoch: publication.epoch,
+            lifecycle_age_ms: millis(Instant::now().saturating_duration_since(publication.since)),
+            available,
+            reason,
+            listeners: publication
+                .listeners
+                .iter()
+                .map(ToString::to_string)
+                .collect(),
+            effective_config_enabled: config.web.enabled,
+            ingress,
+            capacity,
+            decoy_upstream,
+            decoy_fasttrack,
+            carrier_negotiation,
+            lifecycle_counters,
+            operator_lifecycle,
+            runtime: runtime.map(WebProcessRuntime::try_status),
+        }
+    }
+}
+
+#[derive(Serialize)]
+struct GoneSessionData {
+    session_ref: String,
+    state: &'static str,
+    attempt: u8,
+    carrier: crate::config::WebCarrier,
+    reason: &'static str,
+    closed_age_ms: u64,
+}
+
+#[derive(Serialize)]
+struct DebugClearData {
+    runtime_instance: String,
+    records_cleared: usize,
+    leased_bytes: usize,
+    epoch: u64,
+}
+
+#[derive(Serialize)]
+struct LearningResetData {
+    runtime_instance: String,
+    entries_cleared: usize,
+    epoch: u64,
+}
+
+fn readable_runtime(shared: &ApiShared) -> Result<Arc<WebProcessRuntime>, ApiFailure> {
+    let publication = shared.web_runtime_rx.borrow().clone();
+    if !matches!(
+        publication.lifecycle,
+        WebRuntimeLifecycle::Running | WebRuntimeLifecycle::Draining
+    ) {
+        return Err(runtime_unavailable(publication.lifecycle));
+    }
+    publication
+        .runtime
+        .upgrade()
+        .ok_or_else(|| runtime_unavailable(publication.lifecycle))
+}
+
+fn control_runtime(shared: &ApiShared) -> Result<Arc<WebProcessRuntime>, ApiFailure> {
+    let publication = shared.web_runtime_rx.borrow().clone();
+    if publication.lifecycle != WebRuntimeLifecycle::Running {
+        return Err(runtime_unavailable(publication.lifecycle));
+    }
+    publication
+        .runtime
+        .upgrade()
+        .ok_or_else(|| runtime_unavailable(publication.lifecycle))
+}
+
+fn runtime_unavailable(lifecycle: WebRuntimeLifecycle) -> ApiFailure {
+    ApiFailure::new(
+        StatusCode::SERVICE_UNAVAILABLE,
+        "web_runtime_unavailable",
+        format!("WEB runtime is unavailable: {}", lifecycle.as_str()),
+    )
+}
+
+fn require_mutable(config: &ProxyConfig) -> Result<(), ApiFailure> {
+    if config.server.api.read_only {
+        return Err(ApiFailure::new(
+            StatusCode::FORBIDDEN,
+            "read_only",
+            "API runs in read-only mode",
+        ));
+    }
+    Ok(())
+}
+
+fn require_json_content_type<B>(request: &Request<B>) -> Result<(), ApiFailure> {
+    let mut values = request.headers().get_all(CONTENT_TYPE).iter();
+    let exact = values
+        .next()
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| value == "application/json")
+        && values.next().is_none();
+    if !exact {
+        return Err(ApiFailure::new(
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "unsupported_media_type",
+            "Content-Type must be exactly application/json",
+        ));
+    }
+    Ok(())
+}
+
+fn require_runtime_instance(
+    runtime: &WebProcessRuntime,
+    runtime_instance: &str,
+) -> Result<(), ApiFailure> {
+    if !valid_runtime_instance(runtime_instance) {
+        return Err(ApiFailure::bad_request(
+            "runtime_instance must be 32 lowercase hexadecimal characters",
+        ));
+    }
+    if runtime.runtime_instance() != runtime_instance {
+        return Err(ApiFailure::new(
+            StatusCode::CONFLICT,
+            "web_runtime_mismatch",
+            "WEB runtime instance no longer matches",
+        ));
+    }
+    Ok(())
+}
+
+fn control_failure(error: ControlError) -> ApiFailure {
+    match error {
+        ControlError::StaleInstance => ApiFailure::new(
+            StatusCode::CONFLICT,
+            "web_runtime_mismatch",
+            "WEB runtime instance no longer matches",
+        ),
+        ControlError::InvalidSelector | ControlError::InvalidOperation => {
+            ApiFailure::bad_request("Invalid WEB control request")
+        }
+        ControlError::IssuanceEnabled => ApiFailure::new(
+            StatusCode::CONFLICT,
+            "web_issuance_enabled",
+            "Close-all requires effective WEB issuance to be disabled",
+        ),
+        ControlError::OperationInProgress => ApiFailure::new(
+            StatusCode::CONFLICT,
+            "web_operation_in_progress",
+            "Another WEB close operation is active",
+        ),
+        ControlError::OperationNotFound => ApiFailure::new(
+            StatusCode::NOT_FOUND,
+            "web_operation_not_found",
+            "WEB control operation was not found",
+        ),
+        ControlError::Closed => runtime_unavailable(WebRuntimeLifecycle::Draining),
+    }
+}
+
+fn lifecycle_failure(error: OperatorLifecycleError) -> ApiFailure {
+    match error {
+        OperatorLifecycleError::Closed => runtime_unavailable(WebRuntimeLifecycle::Draining),
+        OperatorLifecycleError::OperationInProgress => ApiFailure::new(
+            StatusCode::CONFLICT,
+            "web_lifecycle_in_progress",
+            "Another WEB drain operation is active",
+        ),
+    }
+}
+
+fn snapshot_busy() -> ApiFailure {
+    ApiFailure::new(
+        StatusCode::SERVICE_UNAVAILABLE,
+        "web_snapshot_busy",
+        "WEB runtime snapshot is temporarily busy",
+    )
+}
+
+fn drain_timeout(timeout_secs: u64) -> Result<Duration, ApiFailure> {
+    if !(1..=3600).contains(&timeout_secs) {
+        return Err(ApiFailure::bad_request(
+            "timeout_secs must be within 1..=3600",
+        ));
+    }
+    Ok(Duration::from_secs(timeout_secs))
+}
+
+fn reject_query(query: Option<&str>) -> Result<(), ApiFailure> {
+    if query.is_some_and(|query| !query.is_empty()) {
+        return Err(ApiFailure::bad_request(
+            "This endpoint does not accept query parameters",
+        ));
+    }
+    Ok(())
+}
+
+fn detail_ref(path: &str) -> Option<&str> {
+    path.strip_prefix(SESSION_DETAIL_PREFIX)
+        .filter(|value| !value.is_empty() && !value.contains('/') && *value != "close")
+}
+
+fn operation_ref(path: &str) -> Option<&str> {
+    path.strip_prefix(OPERATION_PREFIX)
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}
+
+fn millis(duration: std::time::Duration) -> u64 {
+    duration.as_millis().min(u128::from(u64::MAX)) as u64
+}
+
+#[cfg(test)]
+#[path = "web_runtime/tests.rs"]
+mod tests;
@@ -0,0 +1,274 @@
+use serde::Serialize;
+
+use crate::config::{ProxyConfig, WebDecoyFastTrackMode, WebHttpConnectionCapacityAction};
+use crate::web::control::{WebRuntimeLifecycle, WebRuntimePublication};
+use crate::web::manager::{WebCapacityResourceStatus, WebCapacitySnapshot, WebProcessRuntime};
+use crate::web::telemetry::{
+    WebBridgeRecoveryCounter, WebCarrierFailureCounter, WebCarrierLearningCounter,
+    WebCarrierSelectionCounter, WebDecoyFastTrackCounter, WebSessionCloseCounter,
+    WebSessionLifecycleObservationCounter,
+};
+use crate::web::telemetry::{WebOutcomeCounter, WebRejectionCounter};
+
+/// Private WEB ingress state owned by this Telemt process.
+#[derive(Serialize)]
+pub(super) struct WebIngressStatus {
+    configured_listeners: usize,
+    live_acceptors: usize,
+    accepting_connections: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reason: Option<&'static str>,
+    tcp_accept_total: u64,
+    tcp_accept_error_total: u64,
+}
+
+impl WebIngressStatus {
+    /// Builds a process-ingress snapshot without probing external TLS termination.
+    pub(super) fn new(publication: &WebRuntimePublication, runtime_available: bool) -> Self {
+        let configured_listeners = publication.listeners.len();
+        let live_acceptors = publication.telemetry.live_acceptors();
+        let accepting_connections = publication.lifecycle == WebRuntimeLifecycle::Running
+            && runtime_available
+            && configured_listeners != 0
+            && live_acceptors == configured_listeners;
+        let reason = if accepting_connections {
+            None
+        } else {
+            Some(match publication.lifecycle {
+                WebRuntimeLifecycle::Starting => "starting",
+                WebRuntimeLifecycle::NoWebListener => "no_web_listener",
+                WebRuntimeLifecycle::Draining => "ingress_draining",
+                WebRuntimeLifecycle::Drained => "ingress_drained",
+                WebRuntimeLifecycle::DeadlineExceeded => "deadline_exceeded",
+                WebRuntimeLifecycle::Running if !runtime_available => "runtime_released",
+                WebRuntimeLifecycle::Running if configured_listeners == 0 => "no_web_listener",
+                WebRuntimeLifecycle::Running => "acceptor_unavailable",
+            })
+        };
+        Self {
+            configured_listeners,
+            live_acceptors,
+            accepting_connections,
+            reason,
+            tcp_accept_total: publication.telemetry.accepted(),
+            tcp_accept_error_total: publication.telemetry.accept_errors(),
+        }
+    }
+}
+
+/// Bounded process-wide WEB capacity and terminal rejection view.
+#[derive(Serialize)]
+pub(super) struct WebCapacityStatus {
+    http_connection_capacity_action: WebHttpConnectionCapacityAction,
+    max_http_overload_connections: usize,
+    http_overload_timeout_ms: u64,
+    resources: Vec<WebCapacityResourceStatus>,
+    saturated_resources: Vec<&'static str>,
+    partial: Vec<&'static str>,
+    rejections: Vec<WebRejectionCounter>,
+    http_connection_overload_outcomes: Vec<WebOutcomeCounter>,
+}
+
+impl WebCapacityStatus {
+    /// Builds a bounded capacity snapshot from non-blocking runtime observations.
+    pub(super) fn new(
+        publication: &WebRuntimePublication,
+        runtime: Option<&WebProcessRuntime>,
+        config: &ProxyConfig,
+    ) -> Self {
+        let snapshot = runtime
+            .map(WebProcessRuntime::capacity_snapshot)
+            .unwrap_or_else(runtime_unavailable_snapshot);
+        Self {
+            http_connection_capacity_action: config.web.http_connection_capacity_action,
+            max_http_overload_connections: config.web.limits.max_http_overload_connections,
+            http_overload_timeout_ms: config.web.timeouts.http_overload_timeout_ms,
+            resources: snapshot.resources,
+            saturated_resources: snapshot.saturated_resources,
+            partial: snapshot.partial,
+            rejections: publication.telemetry.rejection_counters(),
+            http_connection_overload_outcomes: publication.telemetry.overload_counters(),
+        }
+    }
+}
+
+fn runtime_unavailable_snapshot() -> WebCapacitySnapshot {
+    WebCapacitySnapshot {
+        resources: Vec::new(),
+        saturated_resources: Vec::new(),
+        partial: vec!["runtime"],
+    }
+}
+
+/// Passive health of Telemt's internal plain-HTTP decoy origin hop.
+#[derive(Serialize)]
+pub(super) struct WebDecoyUpstreamStatus {
+    outcomes: Vec<WebOutcomeCounter>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    last_outcome: Option<&'static str>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    last_outcome_age_ms: Option<u64>,
+}
+
+impl WebDecoyUpstreamStatus {
+    /// Builds the fixed internal decoy-origin outcome snapshot.
+    pub(super) fn new(publication: &WebRuntimePublication) -> Self {
+        let last = publication.telemetry.last_decoy();
+        Self {
+            outcomes: publication.telemetry.decoy_counters(),
+            last_outcome: last.map(|value| value.0),
+            last_outcome_age_ms: last.map(|value| value.1),
+        }
+    }
+}
+
+/// Fixed-cardinality process-lifetime decoy capability-routing counters.
+#[derive(Serialize)]
+pub(super) struct WebDecoyFastTrackStatus {
+    mode: WebDecoyFastTrackMode,
+    requests: Vec<WebDecoyFastTrackCounter>,
+}
+
+impl WebDecoyFastTrackStatus {
+    /// Builds effective policy and counters without requiring the runtime manager.
+    pub(super) fn new(publication: &WebRuntimePublication, config: &ProxyConfig) -> Self {
+        Self {
+            mode: config.web.decoy_fasttrack_mode,
+            requests: publication.telemetry.decoy_fasttrack_counters(),
+        }
+    }
+}
+
+/// Fixed-cardinality process-lifetime carrier negotiation counters.
+#[derive(Serialize)]
+pub(super) struct WebCarrierNegotiationStatus {
+    selections: Vec<WebCarrierSelectionCounter>,
+    reported_failures: Vec<WebCarrierFailureCounter>,
+    learning_outcomes: Vec<WebCarrierLearningCounter>,
+}
+
+impl WebCarrierNegotiationStatus {
+    /// Builds counters from publication ownership even when runtime state is unavailable.
+    pub(super) fn new(publication: &WebRuntimePublication) -> Self {
+        Self {
+            selections: publication.telemetry.carrier_selection_counters(),
+            reported_failures: publication.telemetry.carrier_failure_counters(),
+            learning_outcomes: publication.telemetry.carrier_learning_counters(),
+        }
+    }
+}
+
+/// Fixed-cardinality process-lifetime WEB lifecycle counters.
+#[derive(Serialize)]
+pub(super) struct WebLifecycleCountersStatus {
+    bridge_recovery_secs: u64,
+    session_closures: Vec<WebSessionCloseCounter>,
+    session_observations: Vec<WebSessionLifecycleObservationCounter>,
+    bridge_recovery_events: Vec<WebBridgeRecoveryCounter>,
+}
+
+impl WebLifecycleCountersStatus {
+    /// Builds a complete counter set from process-owned telemetry.
+    pub(super) fn new(publication: &WebRuntimePublication, config: &ProxyConfig) -> Self {
+        Self {
+            bridge_recovery_secs: config.web.timeouts.bridge_recovery_secs,
+            session_closures: publication.telemetry.session_close_counters(),
+            session_observations: publication.telemetry.session_observation_counters(),
+            bridge_recovery_events: publication.telemetry.bridge_recovery_counters(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::config::ProxyConfig;
+    use crate::web::control::WebRuntimeControl;
+
+    #[test]
+    fn starting_ingress_does_not_claim_external_availability() {
+        let control = WebRuntimeControl::new();
+        let publication = control.subscribe().borrow().clone();
+        let value =
+            serde_json::to_value(super::WebIngressStatus::new(&publication, false)).unwrap();
+        assert_eq!(value["configured_listeners"], 0);
+        assert_eq!(value["live_acceptors"], 0);
+        assert_eq!(value["accepting_connections"], false);
+        assert_eq!(value["reason"], "starting");
+    }
+
+    #[test]
+    fn unavailable_runtime_keeps_fixed_counter_sets_visible() {
+        let control = WebRuntimeControl::new();
+        let publication = control.subscribe().borrow().clone();
+        let config = ProxyConfig::default();
+        let capacity =
+            serde_json::to_value(super::WebCapacityStatus::new(&publication, None, &config))
+                .unwrap();
+        let decoy = serde_json::to_value(super::WebDecoyUpstreamStatus::new(&publication)).unwrap();
+        let fasttrack =
+            serde_json::to_value(super::WebDecoyFastTrackStatus::new(&publication, &config))
+                .unwrap();
+        let carrier =
+            serde_json::to_value(super::WebCarrierNegotiationStatus::new(&publication)).unwrap();
+        let lifecycle = serde_json::to_value(super::WebLifecycleCountersStatus::new(
+            &publication,
+            &config,
+        ))
+        .unwrap();
+
+        assert_eq!(
+            capacity["rejections"].as_array().unwrap().len(),
+            crate::web::telemetry::WebRejectionReason::ALL.len()
+        );
+        assert_eq!(
+            capacity["http_connection_overload_outcomes"]
+                .as_array()
+                .unwrap()
+                .len(),
+            crate::web::telemetry::WebHttpConnectionOverloadOutcome::ALL.len()
+        );
+        assert_eq!(
+            decoy["outcomes"].as_array().unwrap().len(),
+            crate::web::telemetry::WebDecoyUpstreamOutcome::ALL.len()
+        );
+        assert_eq!(fasttrack["mode"], "off");
+        assert_eq!(
+            fasttrack["requests"].as_array().unwrap().len(),
+            crate::web::telemetry::WebDecoyFastTrackDisposition::ALL.len()
+        );
+        assert_eq!(capacity["partial"][0], "runtime");
+        assert_eq!(
+            carrier["selections"].as_array().unwrap().len(),
+            crate::config::WebCarrier::ALL.len()
+                * crate::web::telemetry::WebCarrierSelectionDisposition::ALL.len()
+        );
+        assert_eq!(
+            carrier["reported_failures"].as_array().unwrap().len(),
+            crate::config::WebCarrier::ALL.len()
+                * crate::web::telemetry::WebCarrierFailurePhase::ALL.len()
+                * crate::web::manager::CarrierFailure::ALL.len()
+        );
+        assert_eq!(
+            carrier["learning_outcomes"].as_array().unwrap().len(),
+            crate::config::WebCarrier::ALL.len()
+                * crate::web::telemetry::WebCarrierLearningOutcome::ALL.len()
+        );
+        assert_eq!(
+            lifecycle["session_closures"].as_array().unwrap().len(),
+            crate::config::WebCarrier::ALL.len()
+                * crate::web::session::SessionCloseReason::ALL.len()
+        );
+        assert_eq!(
+            lifecycle["session_observations"].as_array().unwrap().len(),
+            crate::config::WebCarrier::ALL.len()
+                * crate::web::telemetry::WebSessionLifecycleObservation::ALL.len()
+        );
+        assert_eq!(
+            lifecycle["bridge_recovery_events"]
+                .as_array()
+                .unwrap()
+                .len(),
+            crate::web::telemetry::WebBridgeRecoveryEvent::ALL.len()
+        );
+    }
+}
@@ -0,0 +1,409 @@
+use std::collections::BTreeSet;
+use std::net::IpAddr;
+
+use hyper::StatusCode;
+use serde::Deserialize;
+
+use crate::config::WebCarrier;
+use crate::web::manager::{
+    CloseOperationSelector, SessionFilter, SessionListRequest, SessionRefError, WebProcessRuntime,
+};
+
+use super::super::model::ApiFailure;
+
+const DEFAULT_SESSION_LIMIT: usize = 50;
+const MAX_SESSION_LIMIT: usize = 200;
+
+/// Exact process-instance fence for one runtime mutation.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct RuntimeInstanceRequest {
+    /// Random process identifier copied from WEB runtime status.
+    pub(super) runtime_instance: String,
+}
+
+/// Process-fenced graceful drain request with one bounded relative deadline.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct DrainRequest {
+    /// Random process identifier copied from WEB runtime status.
+    pub(super) runtime_instance: String,
+    /// Relative drain deadline frozen into one monotonic server deadline.
+    pub(super) timeout_secs: u64,
+}
+
+/// One process-fenced asynchronous close request.
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct CloseRequest {
+    /// Random process identifier copied from WEB runtime status.
+    pub(super) runtime_instance: String,
+    /// Exact point-in-time close selector.
+    pub(super) selector: CloseSelectorRequest,
+}
+
+/// Strict tagged selector accepted by the WEB close endpoint.
+#[derive(Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub(super) enum CloseSelectorRequest {
+    /// Closes an explicit bounded set of logical sessions.
+    Refs {
+        /// Unique current-instance opaque session references.
+        session_refs: Vec<String>,
+    },
+    /// Closes the point-in-time sessions matching every supplied field.
+    Filter {
+        #[serde(default)]
+        session_ref: Option<String>,
+        #[serde(default)]
+        ip: Option<String>,
+        #[serde(default)]
+        host: Option<String>,
+        #[serde(default)]
+        user: Option<String>,
+        #[serde(default)]
+        user_agent_id: Option<String>,
+        #[serde(default)]
+        key_id: Option<String>,
+        #[serde(default)]
+        carrier: Option<WebCarrier>,
+        #[serde(default)]
+        state: Option<String>,
+    },
+    /// Closes every point-in-time session below the submission high-water mark.
+    All {},
+}
+
+impl CloseSelectorRequest {
+    /// Validates external identifiers and resolves them to manager-owned values.
+    pub(super) fn resolve(
+        self,
+        runtime: &WebProcessRuntime,
+    ) -> Result<CloseOperationSelector, ApiFailure> {
+        match self {
+            Self::Refs { session_refs } => resolve_refs(runtime, session_refs),
+            Self::Filter {
+                session_ref,
+                ip,
+                host,
+                user,
+                user_agent_id,
+                key_id,
+                carrier,
+                state,
+            } => {
+                validate_filter_strings(
+                    host.as_deref(),
+                    user.as_deref(),
+                    key_id.as_deref(),
+                    state.as_deref(),
+                )?;
+                let trace_session_id = session_ref
+                    .as_deref()
+                    .map(|value| parse_session_ref(runtime, value))
+                    .transpose()?;
+                let client_ip = ip.as_deref().map(parse_canonical_ip).transpose()?;
+                let filter = SessionFilter {
+                    trace_session_id,
+                    client_ip,
+                    host,
+                    user,
+                    user_agent_id: user_agent_id
+                        .as_deref()
+                        .map(parse_user_agent_id)
+                        .transpose()?,
+                    key_id,
+                    carrier,
+                    state,
+                };
+                if filter.is_empty() {
+                    return Err(ApiFailure::bad_request(
+                        "filter selector requires at least one filter",
+                    ));
+                }
+                Ok(CloseOperationSelector::Filter(filter))
+            }
+            Self::All {} => Ok(CloseOperationSelector::All),
+        }
+    }
+}
+
+fn resolve_refs(
+    runtime: &WebProcessRuntime,
+    session_refs: Vec<String>,
+) -> Result<CloseOperationSelector, ApiFailure> {
+    if session_refs.is_empty() || session_refs.len() > 200 {
+        return Err(ApiFailure::bad_request(
+            "session_refs must contain 1..200 references",
+        ));
+    }
+    let mut resolved = Vec::with_capacity(session_refs.len());
+    let mut unique = BTreeSet::new();
+    for session_ref in session_refs {
+        let id = parse_session_ref(runtime, &session_ref)?;
+        if !unique.insert(id) {
+            return Err(ApiFailure::bad_request(
+                "session_refs must not contain duplicates",
+            ));
+        }
+        resolved.push(id);
+    }
+    Ok(CloseOperationSelector::Refs(resolved))
+}
+
+/// Parses one duplicate-free bounded session-list query.
+pub(super) fn parse_session_query(
+    runtime: &WebProcessRuntime,
+    raw: Option<&str>,
+) -> Result<SessionListRequest, ApiFailure> {
+    let mut limit = DEFAULT_SESSION_LIMIT;
+    let mut cursor = None;
+    let mut filter = SessionFilter::default();
+    let mut seen = BTreeSet::new();
+    for (name, value) in url::form_urlencoded::parse(raw.unwrap_or_default().as_bytes()) {
+        if !seen.insert(name.to_string()) {
+            return Err(ApiFailure::bad_request(format!("{} must not repeat", name)));
+        }
+        match name.as_ref() {
+            "limit" => {
+                limit = value
+                    .parse::<usize>()
+                    .ok()
+                    .filter(|value| (1..=MAX_SESSION_LIMIT).contains(value))
+                    .ok_or_else(|| ApiFailure::bad_request("limit must be within 1..200"))?;
+            }
+            "cursor" => cursor = Some(parse_session_ref(runtime, &value)?),
+            "session_ref" => {
+                let id = parse_session_ref(runtime, &value)?;
+                filter.trace_session_id = Some(id);
+                cursor = id.checked_sub(1);
+                limit = 1;
+            }
+            "ip" => {
+                filter.client_ip = Some(parse_canonical_ip(&value)?);
+            }
+            "host" => filter.host = Some(value.into_owned()),
+            "user" => filter.user = Some(value.into_owned()),
+            "user_agent_id" => filter.user_agent_id = Some(parse_user_agent_id(&value)?),
+            "key_id" => filter.key_id = Some(value.into_owned()),
+            "carrier" => filter.carrier = Some(parse_carrier(&value)?),
+            "state" => filter.state = Some(value.into_owned()),
+            _ => {
+                return Err(ApiFailure::bad_request(format!(
+                    "unknown query field `{}`",
+                    name
+                )));
+            }
+        }
+    }
+    if filter.trace_session_id.is_some() && (seen.contains("cursor") || seen.contains("limit")) {
+        return Err(ApiFailure::bad_request(
+            "session_ref must not be combined with cursor or limit",
+        ));
+    }
+    validate_filter_strings(
+        filter.host.as_deref(),
+        filter.user.as_deref(),
+        filter.key_id.as_deref(),
+        filter.state.as_deref(),
+    )?;
+    Ok(SessionListRequest {
+        limit,
+        cursor,
+        filter,
+    })
+}
+
+/// Maps one opaque session-reference failure to the stable API error contract.
+pub(super) fn parse_session_ref(
+    runtime: &WebProcessRuntime,
+    session_ref: &str,
+) -> Result<u64, ApiFailure> {
+    runtime
+        .parse_session_ref(session_ref)
+        .map_err(|error| match error {
+            SessionRefError::Invalid => ApiFailure::bad_request("Invalid WEB session reference"),
+            SessionRefError::StaleInstance => ApiFailure::new(
+                StatusCode::CONFLICT,
+                "web_runtime_mismatch",
+                "WEB session reference belongs to another runtime instance",
+            ),
+        })
+}
+
+fn parse_carrier(value: &str) -> Result<WebCarrier, ApiFailure> {
+    WebCarrier::ALL
+        .into_iter()
+        .find(|carrier| carrier.as_str() == value)
+        .ok_or_else(|| {
+            ApiFailure::bad_request(
+                "carrier must be https, https-lanes, websocket, or websocket-lanes",
+            )
+        })
+}
+
+fn validate_filter_strings(
+    host: Option<&str>,
+    user: Option<&str>,
+    key_id: Option<&str>,
+    state: Option<&str>,
+) -> Result<(), ApiFailure> {
+    if host.is_some_and(|value| value.is_empty() || value.len() > 253) {
+        return Err(ApiFailure::bad_request("host must contain 1..253 bytes"));
+    }
+    if user.is_some_and(|value| value.is_empty() || value.len() > 64) {
+        return Err(ApiFailure::bad_request("user must contain 1..64 bytes"));
+    }
+    if key_id.is_some_and(|value| !lower_hex(value, 16)) {
+        return Err(ApiFailure::bad_request(
+            "key_id must be 16 lowercase hexadecimal characters",
+        ));
+    }
+    if state.is_some_and(|value| {
+        !matches!(
+            value,
+            "provisional"
+                | "replacing"
+                | "committed"
+                | "healthy"
+                | "closing"
+                | "superseded"
+                | "closed"
+        )
+    }) {
+        return Err(ApiFailure::bad_request("Invalid WEB session state"));
+    }
+    Ok(())
+}
+
+fn parse_user_agent_id(value: &str) -> Result<[u8; 16], ApiFailure> {
+    if !lower_hex(value, 32) {
+        return Err(ApiFailure::bad_request(
+            "user_agent_id must be 32 lowercase hexadecimal characters",
+        ));
+    }
+    let mut id = [0; 16];
+    hex::decode_to_slice(value, &mut id).map_err(|_| {
+        ApiFailure::bad_request("user_agent_id must be 32 lowercase hexadecimal characters")
+    })?;
+    Ok(id)
+}
+
+fn lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+/// Returns whether a process instance uses its canonical lowercase form.
+pub(super) fn valid_runtime_instance(value: &str) -> bool {
+    lower_hex(value, 32)
+}
+
+fn parse_canonical_ip(value: &str) -> Result<IpAddr, ApiFailure> {
+    let ip = value
+        .parse::<IpAddr>()
+        .map_err(|_| ApiFailure::bad_request("ip must be a canonical IP address"))?;
+    if ip.to_string() != value {
+        return Err(ApiFailure::bad_request("ip must use canonical formatting"));
+    }
+    Ok(ip)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn filter_identifiers_are_exact_lowercase_hex() {
+        assert!(lower_hex("0123456789abcdef", 16));
+        assert!(!lower_hex("0123456789ABCDEF", 16));
+        assert!(!lower_hex("0123", 16));
+        assert!(valid_runtime_instance("0123456789abcdef0123456789abcdef"));
+        assert!(!valid_runtime_instance("0123456789ABCDEF0123456789ABCDEF"));
+    }
+
+    #[test]
+    fn mutation_dtos_reject_unknown_fields() {
+        let runtime_instance = "0123456789abcdef0123456789abcdef";
+        assert!(
+            serde_json::from_value::<RuntimeInstanceRequest>(serde_json::json!({
+                "runtime_instance": runtime_instance,
+                "extra": true,
+            }))
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<CloseRequest>(serde_json::json!({
+                "runtime_instance": runtime_instance,
+                "selector": {"kind": "all", "extra": true},
+            }))
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<DrainRequest>(serde_json::json!({
+                "runtime_instance": runtime_instance,
+                "timeout_secs": 30,
+                "extra": true,
+            }))
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn filter_ips_require_canonical_text() {
+        assert!(parse_canonical_ip("2001:db8::1").is_ok());
+        assert!(parse_canonical_ip("2001:0db8::1").is_err());
+    }
+
+    #[test]
+    fn state_filter_accepts_every_emitted_session_state() {
+        for state in [
+            "provisional",
+            "replacing",
+            "committed",
+            "healthy",
+            "closing",
+            "superseded",
+            "closed",
+        ] {
+            assert!(
+                validate_filter_strings(None, None, None, Some(state)).is_ok(),
+                "state {state} must be accepted"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn exact_session_query_rejects_pagination_fields_in_any_order() {
+        let generation = crate::maestro::generation::test_runtime_generation(
+            1,
+            crate::config::ProxyConfig::default(),
+        );
+        let runtime = WebProcessRuntime::start(std::sync::Arc::new(arc_swap::ArcSwap::from(
+            generation.clone(),
+        )));
+        let session_ref = runtime.session_ref(1);
+        let cursor = runtime.session_ref(2);
+
+        assert!(
+            parse_session_query(
+                &runtime,
+                Some(&format!("session_ref={session_ref}&cursor={cursor}")),
+            )
+            .is_err()
+        );
+        assert!(
+            parse_session_query(
+                &runtime,
+                Some(&format!("limit=2&session_ref={session_ref}")),
+            )
+            .is_err()
+        );
+
+        runtime.shutdown().await;
+        generation.stop_sessions().await;
+        generation.stop_background_tasks().await;
+    }
+}
@@ -0,0 +1,51 @@
+use super::*;
+
+use hyper::header::HeaderValue;
+
+#[test]
+fn route_table_keeps_status_read_only_and_controls_post_only() {
+    assert_eq!(allowed_methods(STATUS_PATH), Some(ALLOW_GET));
+    assert_eq!(allowed_methods(SESSIONS_PATH), Some(ALLOW_GET));
+    assert_eq!(allowed_methods(CLOSE_PATH), Some(ALLOW_POST));
+    assert_eq!(allowed_methods(DEBUG_CLEAR_PATH), Some(ALLOW_POST));
+    assert_eq!(allowed_methods(LEARNING_RESET_PATH), Some(ALLOW_POST));
+    assert_eq!(allowed_methods(LIFECYCLE_PAUSE_PATH), Some(ALLOW_POST));
+    assert_eq!(allowed_methods(LIFECYCLE_DRAIN_PATH), Some(ALLOW_POST));
+    assert_eq!(allowed_methods(LIFECYCLE_RESUME_PATH), Some(ALLOW_POST));
+    assert_eq!(
+        allowed_methods("/v1/runtime/web/sessions/ws1.instance.0000000000000001"),
+        Some(ALLOW_GET)
+    );
+}
+
+#[test]
+fn control_content_type_is_exact_and_single() {
+    let exact = Request::builder()
+        .header(CONTENT_TYPE, "application/json")
+        .body(())
+        .unwrap();
+    assert!(require_json_content_type(&exact).is_ok());
+
+    let parameterized = Request::builder()
+        .header(CONTENT_TYPE, "application/json; charset=utf-8")
+        .body(())
+        .unwrap();
+    assert!(require_json_content_type(&parameterized).is_err());
+
+    let mut duplicated = Request::builder()
+        .header(CONTENT_TYPE, "application/json")
+        .body(())
+        .unwrap();
+    duplicated
+        .headers_mut()
+        .append(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+    assert!(require_json_content_type(&duplicated).is_err());
+}
+
+#[test]
+fn drain_timeout_is_bounded_to_the_public_contract() {
+    assert_eq!(drain_timeout(1).unwrap(), Duration::from_secs(1));
+    assert_eq!(drain_timeout(3600).unwrap(), Duration::from_secs(3600));
+    assert!(drain_timeout(0).is_err());
+    assert!(drain_timeout(3601).is_err());
+}
@@ -18,7 +18,7 @@ mod details;
 // Query parsing and matching remain independent from bounded HTML rendering.
 mod query;

-use details::{push_body, push_frames, push_headers};
+use details::{push_body, push_frames, push_headers, push_lifecycle};
 use query::{GroupBy, StatusQuery, client_ip, parse_query, record_matches};

 struct GroupSummary {
@@ -41,10 +41,9 @@ impl AsRef<[u8]> for RenderedPage {
 pub(super) async fn render(
    raw_query: Option<&str>,
    store: &Arc<WebTraceStore>,
-    policy: &WebDebugConfig,
 ) -> Response<Full<Bytes>> {
-    store.apply_policy(policy);
-    let query = match parse_query(raw_query, policy) {
+    let status = store.status();
+    let query = match parse_query(raw_query, &status.policy) {
        Ok(query) => query,
        Err(error) => return html_error(StatusCode::BAD_REQUEST, "Invalid query", &error),
    };
@@ -56,19 +55,23 @@ pub(super) async fn render(
        );
    };
    let now_millis = crate::web::trace::store_epoch_millis();
-    let since_millis = query
-        .record
-        .is_none()
-        .then(|| now_millis.saturating_sub(query.window_secs.saturating_mul(1000)))
-        .unwrap_or(0);
+    let since_millis = if query.record.is_none() {
+        now_millis.saturating_sub(query.window_secs.saturating_mul(1000))
+    } else {
+        0
+    };
    let records = store.snapshot_matching(|record| record_matches(record, &query, since_millis));
-    let status = store.status();
    let mut html = String::with_capacity(MAX_PAGE_BYTES);
    push_page_start(&mut html);
    html.push_str("<h1>WEB status</h1>");
    push_filter_form(&mut html, &query);
    html.push_str("<section><h2>Store</h2><table><tbody>");
    summary_row(&mut html, "debug enabled", yes_no(status.policy.enabled));
+    summary_row(
+        &mut html,
+        "sideband",
+        yes_no(status.policy.bridge_diagnostics_enabled()),
+    );
    summary_row(&mut html, "body capture", body_mode(&status.policy));
    summary_row(&mut html, "window seconds", &query.window_secs.to_string());
    summary_row(
@@ -367,20 +370,7 @@ fn push_record(html: &mut String, record: &TraceRecord) {
            push_body(html, "message body", message.body.as_ref());
            push_frames(html, &message.frames);
        }
-        TraceRecordKind::Lifecycle(event) => {
-            html.push_str("<pre>event: ");
-            html.push_str(event.event.as_str());
-            html.push_str("\nstream: ");
-            html.push_str(
-                &event
-                    .stream_id
-                    .map(|v| v.to_string())
-                    .unwrap_or_else(|| "-".to_string()),
-            );
-            html.push_str("\nreason: ");
-            html.push_str(event.reason.unwrap_or("-"));
-            html.push_str("</pre>");
-        }
+        TraceRecordKind::Lifecycle(event) => push_lifecycle(html, event),
    }
    html.push_str("</details></td></tr>");
 }
@@ -84,3 +84,48 @@ pub(super) fn push_body(
    }
    html.push_str("</pre>");
 }
+
+pub(super) fn push_lifecycle(html: &mut String, event: &crate::web::trace::TraceLifecycleRecord) {
+    html.push_str("<pre>event: ");
+    html.push_str(event.event.as_str());
+    html.push_str("\nstream: ");
+    html.push_str(
+        &event
+            .stream_id
+            .map(|value| value.to_string())
+            .unwrap_or_else(|| "-".to_string()),
+    );
+    html.push_str("\nreason: ");
+    html.push_str(event.reason.unwrap_or("-"));
+    html.push_str("\npeer gap ms: ");
+    html.push_str(
+        &event
+            .peer_gap_ms
+            .map(|value| value.to_string())
+            .unwrap_or_else(|| "-".to_string()),
+    );
+    html.push_str("\npredecessor session: ");
+    html.push_str(
+        &event
+            .predecessor_session_id
+            .map(|value| value.to_string())
+            .unwrap_or_else(|| "-".to_string()),
+    );
+    if let Some(carrier) = &event.carrier {
+        html.push_str("\nclient class: ");
+        html.push_str(carrier.client_class);
+        html.push_str("\ncarrier: ");
+        html.push_str(carrier.carrier.as_str());
+        html.push_str("\nattempt: ");
+        html.push_str(&carrier.attempt.to_string());
+        html.push_str("\nscores: https=");
+        html.push_str(&carrier.scores[0].to_string());
+        html.push_str(" https-lanes=");
+        html.push_str(&carrier.scores[1].to_string());
+        html.push_str(" websocket=");
+        html.push_str(&carrier.scores[2].to_string());
+        html.push_str(" websocket-lanes=");
+        html.push_str(&carrier.scores[3].to_string());
+    }
+    html.push_str("</pre>");
+}
@@ -20,11 +20,16 @@ fn html_escaping_covers_active_markup_characters() {

 #[tokio::test]
 async fn renderer_filters_groups_and_sets_control_plane_security_headers() {
-    let mut policy = WebDebugConfig::default();
-    policy.enabled = true;
-    let mut limits = crate::config::WebLimitsConfig::default();
-    limits.debug_records_capacity = 8;
-    limits.debug_bytes_global = 16 * 1024;
+    let policy = WebDebugConfig {
+        enabled: true,
+        sideband: true,
+        ..Default::default()
+    };
+    let limits = crate::config::WebLimitsConfig {
+        debug_records_capacity: 8,
+        debug_bytes_global: 16 * 1024,
+        ..Default::default()
+    };
    let store = WebTraceStore::new(policy.clone(), &limits);
    store.record_lifecycle(
        None,
@@ -42,7 +47,6 @@ async fn renderer_filters_groups_and_sets_control_plane_security_headers() {
    let response = render(
        Some("ip=192.0.2.40&session=42&key=0123456789abcdef&group_by=ip&group_by=key"),
        &store,
-        &policy,
    )
    .await;
    assert_eq!(response.status(), StatusCode::OK);
@@ -55,6 +59,7 @@ async fn renderer_filters_groups_and_sets_control_plane_security_headers() {
    let body = response.into_body().collect().await.unwrap().to_bytes();
    let body = std::str::from_utf8(&body).unwrap();
    assert!(body.contains("session_created"));
+    assert!(body.contains("<th>sideband</th><td>yes</td>"));
    assert!(body.contains("0123456789abcdef"));
    assert!(body.contains("192.0.2.40"));
 }
@@ -65,21 +70,39 @@ async fn render_permits_remain_owned_by_inflight_response_bodies() {
    let limits = crate::config::WebLimitsConfig::default();
    let store = WebTraceStore::new(policy.clone(), &limits);

-    let first = render(None, &store, &policy).await;
-    let second = render(None, &store, &policy).await;
-    let busy = render(None, &store, &policy).await;
+    let first = render(None, &store).await;
+    let second = render(None, &store).await;
+    let busy = render(None, &store).await;
    assert_eq!(busy.status(), StatusCode::SERVICE_UNAVAILABLE);

    drop(first);
-    let admitted = render(None, &store, &policy).await;
+    let admitted = render(None, &store).await;
    assert_eq!(admitted.status(), StatusCode::OK);
    drop(second);
    drop(admitted);
 }

+#[tokio::test]
+async fn stale_renderer_cannot_restore_an_old_debug_policy() {
+    let stale_policy = WebDebugConfig::default();
+    let active_policy = WebDebugConfig {
+        enabled: true,
+        capture_headers: false,
+        ..Default::default()
+    };
+    let limits = crate::config::WebLimitsConfig::default();
+    let store = WebTraceStore::new(stale_policy.clone(), &limits);
+    store.apply_policy(2, &active_policy);
+
+    let response = render(None, &store).await;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(store.status().policy.as_ref(), &active_policy);
+}
+
 #[test]
 fn page_truncation_preserves_utf8_boundary_and_cap() {
-    let mut html = "я".repeat(MAX_PAGE_BYTES);
+    let mut html = "\u{044f}".repeat(MAX_PAGE_BYTES);
    truncate_page(&mut html);
    assert!(html.len() <= MAX_PAGE_BYTES);
    assert!(html.ends_with("[page output truncated]"));
@@ -8,15 +8,22 @@
 //! - `run [OPTIONS] [config.toml]` - Run in foreground (default behavior)
 //! - `healthcheck [OPTIONS] [config.toml]` - Run control-plane health probe

-use rand::RngExt;
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::process::Command;
+use std::path::PathBuf;

 use crate::healthcheck::{self, HealthcheckMode};

 #[cfg(unix)]
-use crate::daemon::{self, DEFAULT_PID_FILE, DaemonOptions};
+use crate::daemon::{DEFAULT_PID_FILE, DaemonOptions};
+
+// Unix daemon control and argument parsing.
+#[cfg(unix)]
+mod daemon_commands;
+// Fire-and-forget installation workflow.
+mod init;
+
+#[cfg(unix)]
+pub use daemon_commands::parse_daemon_args;
+pub use init::{InitOptions, parse_init_args, run_init};

 /// CLI subcommand to execute.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -40,13 +47,20 @@ pub enum Subcommand {
 /// Parsed subcommand with its options.
 #[derive(Debug)]
 pub struct ParsedCommand {
+    /// Selected command mode.
    pub subcommand: Subcommand,
+    /// PID file used by daemon-control commands.
    pub pid_file: PathBuf,
+    /// Configuration file passed to runtime or healthcheck.
    pub config_path: String,
+    /// Requested healthcheck mode.
    pub healthcheck_mode: HealthcheckMode,
+    /// Invalid healthcheck mode retained for command diagnostics.
    pub healthcheck_mode_invalid: Option<String>,
    #[cfg(unix)]
+    /// Unix daemon lifecycle options.
    pub daemon_opts: DaemonOptions,
+    /// Fire-and-forget initialization options.
    pub init_opts: Option<InitOptions>,
 }

@@ -79,7 +93,6 @@ pub fn parse_command(args: &[String]) -> ParsedCommand {
        return cmd;
    }

-    // Check for subcommand as first argument
    if let Some(first) = args.first() {
        match first.as_str() {
            "start" => {
@@ -120,11 +133,9 @@ pub fn parse_command(args: &[String]) -> ParsedCommand {
        }
    }

-    // Parse remaining options
    let mut i = 0;
    while i < args.len() {
        match args[i].as_str() {
-            // Skip subcommand names
            "start" | "stop" | "reload" | "status" | "run" | "healthcheck" => {}
            "--mode" => {
                i += 1;
@@ -154,7 +165,6 @@ pub fn parse_command(args: &[String]) -> ParsedCommand {
                    }
                }
            }
-            // PID file option (for stop/reload/status)
            "--pid-file" => {
                i += 1;
                if i < args.len() {
@@ -189,9 +199,9 @@ pub fn parse_command(args: &[String]) -> ParsedCommand {
 #[cfg(unix)]
 pub fn execute_subcommand(cmd: &ParsedCommand) -> Option<i32> {
    match cmd.subcommand {
-        Subcommand::Stop => Some(cmd_stop(&cmd.pid_file)),
-        Subcommand::Reload => Some(cmd_reload(&cmd.pid_file)),
-        Subcommand::Status => Some(cmd_status(&cmd.pid_file)),
+        Subcommand::Stop => Some(daemon_commands::stop(&cmd.pid_file)),
+        Subcommand::Reload => Some(daemon_commands::reload(&cmd.pid_file)),
+        Subcommand::Status => Some(daemon_commands::status(&cmd.pid_file)),
        Subcommand::Healthcheck => {
            if let Some(invalid_mode) = cmd.healthcheck_mode_invalid.as_ref() {
                if invalid_mode.is_empty() {
@@ -224,6 +234,7 @@ pub fn execute_subcommand(cmd: &ParsedCommand) -> Option<i32> {
    }
 }

+/// Executes a non-server subcommand on platforms without daemon support.
 #[cfg(not(unix))]
 pub fn execute_subcommand(cmd: &ParsedCommand) -> Option<i32> {
    match cmd.subcommand {
@@ -261,487 +272,3 @@ pub fn execute_subcommand(cmd: &ParsedCommand) -> Option<i32> {
        Subcommand::Run | Subcommand::Start => None,
    }
 }
-
-/// Stop command: send SIGTERM to the running daemon.
-#[cfg(unix)]
-fn cmd_stop(pid_file: &Path) -> i32 {
-    use nix::sys::signal::Signal;
-
-    println!("Stopping telemt daemon...");
-
-    match daemon::signal_pid_file(pid_file, Signal::SIGTERM) {
-        Ok(()) => {
-            println!("Stop signal sent successfully");
-
-            // Wait for process to exit (up to 10 seconds)
-            for _ in 0..20 {
-                std::thread::sleep(std::time::Duration::from_millis(500));
-                if let daemon::DaemonStatus::NotRunning = daemon::check_status(pid_file) {
-                    println!("Daemon stopped");
-                    return 0;
-                }
-            }
-            println!("Daemon may still be shutting down");
-            0
-        }
-        Err(e) => {
-            eprintln!("Failed to stop daemon: {}", e);
-            1
-        }
-    }
-}
-
-/// Reload command: send SIGHUP to trigger config reload.
-#[cfg(unix)]
-fn cmd_reload(pid_file: &Path) -> i32 {
-    use nix::sys::signal::Signal;
-
-    println!("Reloading telemt configuration...");
-
-    match daemon::signal_pid_file(pid_file, Signal::SIGHUP) {
-        Ok(()) => {
-            println!("Reload signal sent successfully");
-            0
-        }
-        Err(e) => {
-            eprintln!("Failed to reload daemon: {}", e);
-            1
-        }
-    }
-}
-
-/// Status command: check if daemon is running.
-#[cfg(unix)]
-fn cmd_status(pid_file: &Path) -> i32 {
-    match daemon::check_status(pid_file) {
-        daemon::DaemonStatus::Running(pid) => {
-            println!("telemt is running (pid {})", pid);
-            0
-        }
-        daemon::DaemonStatus::Stale(pid) => {
-            println!("telemt is not running (stale pid file, was pid {})", pid);
-            // Clean up stale PID file
-            let _ = std::fs::remove_file(pid_file);
-            1
-        }
-        daemon::DaemonStatus::NotRunning => {
-            println!("telemt is not running");
-            1
-        }
-    }
-}
-
-/// Options for the init command
-#[derive(Debug, Clone)]
-pub struct InitOptions {
-    pub port: u16,
-    pub domain: String,
-    pub secret: Option<String>,
-    pub username: String,
-    pub config_dir: PathBuf,
-    pub no_start: bool,
-}
-
-/// Parse daemon-related options from CLI args.
-#[cfg(unix)]
-pub fn parse_daemon_args(args: &[String]) -> DaemonOptions {
-    let mut opts = DaemonOptions::default();
-    let mut i = 0;
-
-    while i < args.len() {
-        match args[i].as_str() {
-            "--daemon" | "-d" => {
-                opts.daemonize = true;
-            }
-            "--foreground" | "-f" => {
-                opts.foreground = true;
-            }
-            "--pid-file" => {
-                i += 1;
-                if i < args.len() {
-                    opts.pid_file = Some(PathBuf::from(&args[i]));
-                }
-            }
-            s if s.starts_with("--pid-file=") => {
-                opts.pid_file = Some(PathBuf::from(s.trim_start_matches("--pid-file=")));
-            }
-            "--run-as-user" => {
-                i += 1;
-                if i < args.len() {
-                    opts.user = Some(args[i].clone());
-                }
-            }
-            s if s.starts_with("--run-as-user=") => {
-                opts.user = Some(s.trim_start_matches("--run-as-user=").to_string());
-            }
-            "--run-as-group" => {
-                i += 1;
-                if i < args.len() {
-                    opts.group = Some(args[i].clone());
-                }
-            }
-            s if s.starts_with("--run-as-group=") => {
-                opts.group = Some(s.trim_start_matches("--run-as-group=").to_string());
-            }
-            "--working-dir" => {
-                i += 1;
-                if i < args.len() {
-                    opts.working_dir = Some(PathBuf::from(&args[i]));
-                }
-            }
-            s if s.starts_with("--working-dir=") => {
-                opts.working_dir = Some(PathBuf::from(s.trim_start_matches("--working-dir=")));
-            }
-            _ => {}
-        }
-        i += 1;
-    }
-
-    opts
-}
-
-impl Default for InitOptions {
-    fn default() -> Self {
-        Self {
-            port: 443,
-            domain: "www.google.com".to_string(),
-            secret: None,
-            username: "user".to_string(),
-            config_dir: PathBuf::from("/etc/telemt"),
-            no_start: false,
-        }
-    }
-}
-
-/// Parse --init subcommand options from CLI args.
-///
-/// Returns `Some(InitOptions)` if `--init` was found, `None` otherwise.
-pub fn parse_init_args(args: &[String]) -> Option<InitOptions> {
-    if !args.iter().any(|a| a == "--init") {
-        return None;
-    }
-
-    let mut opts = InitOptions::default();
-    let mut i = 0;
-
-    while i < args.len() {
-        match args[i].as_str() {
-            "--port" => {
-                i += 1;
-                if i < args.len() {
-                    opts.port = args[i].parse().unwrap_or(443);
-                }
-            }
-            "--domain" => {
-                i += 1;
-                if i < args.len() {
-                    opts.domain = args[i].clone();
-                }
-            }
-            "--secret" => {
-                i += 1;
-                if i < args.len() {
-                    opts.secret = Some(args[i].clone());
-                }
-            }
-            "--user" => {
-                i += 1;
-                if i < args.len() {
-                    opts.username = args[i].clone();
-                }
-            }
-            "--config-dir" => {
-                i += 1;
-                if i < args.len() {
-                    opts.config_dir = PathBuf::from(&args[i]);
-                }
-            }
-            "--no-start" => {
-                opts.no_start = true;
-            }
-            _ => {}
-        }
-        i += 1;
-    }
-
-    Some(opts)
-}
-
-/// Run the fire-and-forget setup.
-pub fn run_init(opts: InitOptions) -> Result<(), Box<dyn std::error::Error>> {
-    use crate::service::{self, InitSystem, ServiceOptions};
-
-    eprintln!("[telemt] Fire-and-forget setup");
-    eprintln!();
-
-    // 1. Detect init system
-    let init_system = service::detect_init_system();
-    eprintln!("[+] Detected init system: {}", init_system);
-
-    // 2. Generate or validate secret
-    let secret = match opts.secret {
-        Some(s) => {
-            if s.len() != 32 || !s.chars().all(|c| c.is_ascii_hexdigit()) {
-                eprintln!("[error] Secret must be exactly 32 hex characters");
-                std::process::exit(1);
-            }
-            s
-        }
-        None => generate_secret(),
-    };
-
-    eprintln!("[+] Secret: {}", secret);
-    eprintln!("[+] User:   {}", opts.username);
-    eprintln!("[+] Port:   {}", opts.port);
-    eprintln!("[+] Domain: {}", opts.domain);
-
-    // 3. Create config directory
-    fs::create_dir_all(&opts.config_dir)?;
-    let config_path = opts.config_dir.join("config.toml");
-
-    // 4. Write config
-    let config_content = generate_config(&opts.username, &secret, opts.port, &opts.domain);
-    fs::write(&config_path, &config_content)?;
-    eprintln!("[+] Config written to {}", config_path.display());
-
-    // 5. Generate and write service file
-    let exe_path =
-        std::env::current_exe().unwrap_or_else(|_| PathBuf::from("/usr/local/bin/telemt"));
-
-    let service_opts = ServiceOptions {
-        exe_path: &exe_path,
-        config_path: &config_path,
-        user: None, // Let systemd/init handle user
-        group: None,
-        pid_file: "/var/run/telemt.pid",
-        working_dir: Some("/var/lib/telemt"),
-        description: "Telemt MTProxy - Telegram MTProto Proxy",
-    };
-
-    let service_path = service::service_file_path(init_system);
-    let service_content = service::generate_service_file(init_system, &service_opts);
-
-    // Ensure parent directory exists
-    if let Some(parent) = Path::new(service_path).parent() {
-        let _ = fs::create_dir_all(parent);
-    }
-
-    match fs::write(service_path, &service_content) {
-        Ok(()) => {
-            eprintln!("[+] Service file written to {}", service_path);
-
-            // Make script executable for OpenRC/FreeBSD
-            #[cfg(unix)]
-            if init_system == InitSystem::OpenRC || init_system == InitSystem::FreeBSDRc {
-                use std::os::unix::fs::PermissionsExt;
-                let mut perms = fs::metadata(service_path)?.permissions();
-                perms.set_mode(0o755);
-                fs::set_permissions(service_path, perms)?;
-            }
-        }
-        Err(e) => {
-            eprintln!("[!] Cannot write service file (run as root?): {}", e);
-            eprintln!("[!] Manual service file content:");
-            eprintln!("{}", service_content);
-
-            // Still print links and installation instructions
-            eprintln!();
-            eprintln!("{}", service::installation_instructions(init_system));
-            print_links(&opts.username, &secret, opts.port, &opts.domain);
-            return Ok(());
-        }
-    }
-
-    // 6. Install and enable service based on init system
-    match init_system {
-        InitSystem::Systemd => {
-            run_cmd("systemctl", &["daemon-reload"]);
-            run_cmd("systemctl", &["enable", "telemt.service"]);
-            eprintln!("[+] Service enabled");
-
-            if !opts.no_start {
-                run_cmd("systemctl", &["start", "telemt.service"]);
-                eprintln!("[+] Service started");
-
-                std::thread::sleep(std::time::Duration::from_secs(1));
-                let status = Command::new("systemctl")
-                    .args(["is-active", "telemt.service"])
-                    .output();
-
-                match status {
-                    Ok(out) if out.status.success() => {
-                        eprintln!("[+] Service is running");
-                    }
-                    _ => {
-                        eprintln!("[!] Service may not have started correctly");
-                        eprintln!("[!] Check: journalctl -u telemt.service -n 20");
-                    }
-                }
-            } else {
-                eprintln!("[+] Service not started (--no-start)");
-                eprintln!("[+] Start manually: systemctl start telemt.service");
-            }
-        }
-        InitSystem::OpenRC => {
-            run_cmd("rc-update", &["add", "telemt", "default"]);
-            eprintln!("[+] Service enabled");
-
-            if !opts.no_start {
-                run_cmd("rc-service", &["telemt", "start"]);
-                eprintln!("[+] Service started");
-            } else {
-                eprintln!("[+] Service not started (--no-start)");
-                eprintln!("[+] Start manually: rc-service telemt start");
-            }
-        }
-        InitSystem::FreeBSDRc => {
-            run_cmd("sysrc", &["telemt_enable=YES"]);
-            eprintln!("[+] Service enabled");
-
-            if !opts.no_start {
-                run_cmd("service", &["telemt", "start"]);
-                eprintln!("[+] Service started");
-            } else {
-                eprintln!("[+] Service not started (--no-start)");
-                eprintln!("[+] Start manually: service telemt start");
-            }
-        }
-        InitSystem::Unknown => {
-            eprintln!("[!] Unknown init system - service file written but not installed");
-            eprintln!("[!] You may need to install it manually");
-        }
-    }
-
-    eprintln!();
-
-    // 7. Print links
-    print_links(&opts.username, &secret, opts.port, &opts.domain);
-
-    Ok(())
-}
-
-fn generate_secret() -> String {
-    let mut rng = rand::rng();
-    let bytes: Vec<u8> = (0..16).map(|_| rng.random::<u8>()).collect();
-    hex::encode(bytes)
-}
-
-fn generate_config(username: &str, secret: &str, port: u16, domain: &str) -> String {
-    format!(
-        r#"# Telemt MTProxy — auto-generated config
-# Re-run `telemt --init` to regenerate
-
-show_link = ["{username}"]
-
-[general]
-# prefer_ipv6 is deprecated; use [network].prefer
-prefer_ipv6 = false
-fast_mode = true
-use_middle_proxy = false
-log_level = "normal"
-desync_all_full = false
-update_every = 43200
-hardswap = false
-me_pool_drain_ttl_secs = 90
-me_instadrain = false
-me_pool_drain_threshold = 32
-me_pool_drain_soft_evict_grace_secs = 10
-me_pool_drain_soft_evict_per_writer = 2
-me_pool_drain_soft_evict_budget_per_core = 16
-me_pool_drain_soft_evict_cooldown_ms = 1000
-me_bind_stale_mode = "never"
-me_pool_min_fresh_ratio = 0.8
-me_reinit_drain_timeout_secs = 90
-tg_connect = 10
-
-[network]
-ipv4 = true
-ipv6 = true
-prefer = 4
-multipath = false
-
-[general.modes]
-classic = false
-secure = false
-tls = true
-
-[server]
-listen_addr_ipv4 = "0.0.0.0"
-listen_addr_ipv6 = "::"
-
-[[server.listeners]]
-ip = "0.0.0.0"
-port = {port}
-# reuse_allow = false # Set true only when intentionally running multiple telemt instances on same port
-
-[[server.listeners]]
-ip = "::"
-port = {port}
-
-[timeouts]
-client_first_byte_idle_secs = 300
-client_handshake = 60
-client_keepalive = 60
-client_ack = 300
-
-[censorship]
-tls_domain = "{domain}"
-mask = true
-mask_port = 443
-fake_cert_len = 2048
-serverhello_compact = false
-tls_full_cert_ttl_secs = 90
-
-[access]
-user_max_tcp_conns_global_each = 0
-replay_check_len = 65536
-replay_window_secs = 120
-ignore_time_skew = false
-
-[access.users]
-{username} = "{secret}"
-
-[[upstreams]]
-type = "direct"
-enabled = true
-weight = 10
-# Optional per-upstream DC family policy:
-# ipv6 = true
-# prefer = 6
-"#,
-        username = username,
-        secret = secret,
-        port = port,
-        domain = domain,
-    )
-}
-
-fn run_cmd(cmd: &str, args: &[&str]) {
-    match Command::new(cmd).args(args).output() {
-        Ok(output) => {
-            if !output.status.success() {
-                let stderr = String::from_utf8_lossy(&output.stderr);
-                eprintln!("[!] {} {} failed: {}", cmd, args.join(" "), stderr.trim());
-            }
-        }
-        Err(e) => {
-            eprintln!("[!] Failed to run {} {}: {}", cmd, args.join(" "), e);
-        }
-    }
-}
-
-fn print_links(username: &str, secret: &str, port: u16, domain: &str) {
-    let domain_hex = hex::encode(domain);
-
-    println!("=== Proxy Links ===");
-    println!("[{}]", username);
-    println!(
-        "  EE-TLS:  tg://proxy?server=YOUR_SERVER_IP&port={}&secret=ee{}{}",
-        port, secret, domain_hex
-    );
-    println!();
-    println!("Replace YOUR_SERVER_IP with your server's public IP.");
-    println!("The proxy will auto-detect and display the correct link on startup.");
-    println!("Check: journalctl -u telemt.service | head -30");
-    println!("===================");
-}
@@ -0,0 +1,141 @@
+use std::path::{Path, PathBuf};
+
+use crate::daemon::{self, DaemonOptions};
+
+/// Parses daemon-related options from CLI arguments.
+pub fn parse_daemon_args(args: &[String]) -> DaemonOptions {
+    let mut opts = DaemonOptions::default();
+    let mut i = 0;
+
+    while i < args.len() {
+        match args[i].as_str() {
+            "--daemon" | "-d" => {
+                opts.daemonize = true;
+            }
+            "--foreground" | "-f" => {
+                opts.foreground = true;
+            }
+            "--pid-file" => {
+                i += 1;
+                if i < args.len() {
+                    opts.pid_file = Some(PathBuf::from(&args[i]));
+                }
+            }
+            s if s.starts_with("--pid-file=") => {
+                opts.pid_file = Some(PathBuf::from(s.trim_start_matches("--pid-file=")));
+            }
+            "--run-as-user" => {
+                i += 1;
+                if i < args.len() {
+                    opts.user = Some(args[i].clone());
+                }
+            }
+            s if s.starts_with("--run-as-user=") => {
+                opts.user = Some(s.trim_start_matches("--run-as-user=").to_string());
+            }
+            "--run-as-group" => {
+                i += 1;
+                if i < args.len() {
+                    opts.group = Some(args[i].clone());
+                }
+            }
+            s if s.starts_with("--run-as-group=") => {
+                opts.group = Some(s.trim_start_matches("--run-as-group=").to_string());
+            }
+            "--working-dir" => {
+                i += 1;
+                if i < args.len() {
+                    opts.working_dir = Some(PathBuf::from(&args[i]));
+                }
+            }
+            s if s.starts_with("--working-dir=") => {
+                opts.working_dir = Some(PathBuf::from(s.trim_start_matches("--working-dir=")));
+            }
+            _ => {}
+        }
+        i += 1;
+    }
+
+    opts
+}
+
+/// Sends SIGTERM and waits briefly for graceful PID-file cleanup.
+pub(super) fn stop(pid_file: &Path) -> i32 {
+    use nix::sys::signal::Signal;
+
+    println!("Stopping telemt daemon...");
+
+    match daemon::signal_pid_file(pid_file, Signal::SIGTERM) {
+        Ok(()) => {
+            println!("Stop signal sent successfully");
+
+            // Wait for process to exit for up to ten seconds.
+            for _ in 0..20 {
+                std::thread::sleep(std::time::Duration::from_millis(500));
+                if let daemon::DaemonStatus::NotRunning = daemon::check_status(pid_file) {
+                    println!("Daemon stopped");
+                    return 0;
+                }
+            }
+            println!("Daemon may still be shutting down");
+            0
+        }
+        Err(e) => {
+            eprintln!("Failed to stop daemon: {}", e);
+            1
+        }
+    }
+}
+
+/// Sends SIGHUP to trigger configuration reload.
+pub(super) fn reload(pid_file: &Path) -> i32 {
+    use nix::sys::signal::Signal;
+
+    println!("Reloading telemt configuration...");
+
+    match daemon::signal_pid_file(pid_file, Signal::SIGHUP) {
+        Ok(()) => {
+            println!("Reload signal sent successfully");
+            0
+        }
+        Err(e) => {
+            eprintln!("Failed to reload daemon: {}", e);
+            1
+        }
+    }
+}
+
+/// Reports daemon status without mutating PID lifecycle state.
+pub(super) fn status(pid_file: &Path) -> i32 {
+    match daemon::check_status(pid_file) {
+        daemon::DaemonStatus::Running(pid) => {
+            println!("telemt is running (pid {})", pid);
+            0
+        }
+        daemon::DaemonStatus::Stale(pid) => {
+            println!("telemt is not running (stale pid file, was pid {})", pid);
+            1
+        }
+        daemon::DaemonStatus::NotRunning => {
+            println!("telemt is not running");
+            1
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+
+    use super::*;
+
+    #[test]
+    fn status_does_not_remove_stale_pid_file() {
+        let directory = tempfile::tempdir().unwrap();
+        let pid_file = directory.path().join("telemt.pid");
+        fs::write(&pid_file, b"2000000000\n").unwrap();
+
+        assert_eq!(status(&pid_file), 1);
+        assert!(pid_file.exists());
+    }
+}
@@ -0,0 +1,368 @@
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use rand::RngExt;
+
+use crate::util::trusted_command::resolve_trusted_helper;
+
+/// Options for the fire-and-forget init command.
+#[derive(Debug, Clone)]
+pub struct InitOptions {
+    /// Public listener port.
+    pub port: u16,
+    /// TLS camouflage domain.
+    pub domain: String,
+    /// Optional pre-generated proxy secret.
+    pub secret: Option<String>,
+    /// Initial access username.
+    pub username: String,
+    /// Destination directory for generated configuration.
+    pub config_dir: PathBuf,
+    /// Generate service files without starting the service.
+    pub no_start: bool,
+}
+
+impl Default for InitOptions {
+    fn default() -> Self {
+        Self {
+            port: 443,
+            domain: "www.google.com".to_string(),
+            secret: None,
+            username: "user".to_string(),
+            config_dir: PathBuf::from("/etc/telemt"),
+            no_start: false,
+        }
+    }
+}
+
+/// Parse --init subcommand options from CLI args.
+///
+/// Returns `Some(InitOptions)` if `--init` was found, `None` otherwise.
+pub fn parse_init_args(args: &[String]) -> Option<InitOptions> {
+    if !args.iter().any(|a| a == "--init") {
+        return None;
+    }
+
+    let mut opts = InitOptions::default();
+    let mut i = 0;
+
+    while i < args.len() {
+        match args[i].as_str() {
+            "--port" => {
+                i += 1;
+                if i < args.len() {
+                    opts.port = args[i].parse().unwrap_or(443);
+                }
+            }
+            "--domain" => {
+                i += 1;
+                if i < args.len() {
+                    opts.domain = args[i].clone();
+                }
+            }
+            "--secret" => {
+                i += 1;
+                if i < args.len() {
+                    opts.secret = Some(args[i].clone());
+                }
+            }
+            "--user" => {
+                i += 1;
+                if i < args.len() {
+                    opts.username = args[i].clone();
+                }
+            }
+            "--config-dir" => {
+                i += 1;
+                if i < args.len() {
+                    opts.config_dir = PathBuf::from(&args[i]);
+                }
+            }
+            "--no-start" => {
+                opts.no_start = true;
+            }
+            _ => {}
+        }
+        i += 1;
+    }
+
+    Some(opts)
+}
+
+/// Run the fire-and-forget setup.
+pub fn run_init(opts: InitOptions) -> Result<(), Box<dyn std::error::Error>> {
+    use crate::service::{self, InitSystem, ServiceOptions};
+
+    eprintln!("[telemt] Fire-and-forget setup");
+    eprintln!();
+
+    let init_system = service::detect_init_system();
+    eprintln!("[+] Detected init system: {}", init_system);
+
+    let secret = match opts.secret {
+        Some(s) => {
+            if s.len() != 32 || !s.chars().all(|c| c.is_ascii_hexdigit()) {
+                eprintln!("[error] Secret must be exactly 32 hex characters");
+                std::process::exit(1);
+            }
+            s
+        }
+        None => generate_secret(),
+    };
+
+    eprintln!("[+] Secret: {}", secret);
+    eprintln!("[+] User:   {}", opts.username);
+    eprintln!("[+] Port:   {}", opts.port);
+    eprintln!("[+] Domain: {}", opts.domain);
+
+    let config_path = opts.config_dir.join("config.toml");
+    let config_content = generate_config(&opts.username, &secret, opts.port, &opts.domain);
+    write_init_file(&config_path, &config_content, 0o600)?;
+    eprintln!("[+] Config written to {}", config_path.display());
+
+    let exe_path =
+        std::env::current_exe().unwrap_or_else(|_| PathBuf::from("/usr/local/bin/telemt"));
+    let service_opts = ServiceOptions {
+        exe_path: &exe_path,
+        config_path: &config_path,
+        // Let the selected init system manage process identity.
+        user: None,
+        group: None,
+        pid_file: "/var/run/telemt.pid",
+        working_dir: Some("/var/lib/telemt"),
+        description: "Telemt MTProxy - Telegram MTProto Proxy",
+    };
+
+    let service_path = service::service_file_path(init_system);
+    let service_content = service::generate_service_file(init_system, &service_opts);
+    let service_mode = if init_system == InitSystem::OpenRC || init_system == InitSystem::FreeBSDRc
+    {
+        0o755
+    } else {
+        0o644
+    };
+    match write_init_file(Path::new(service_path), &service_content, service_mode) {
+        Ok(()) => {
+            eprintln!("[+] Service file written to {}", service_path);
+        }
+        Err(e) => {
+            eprintln!("[!] Cannot write service file (run as root?): {}", e);
+            eprintln!("[!] Manual service file content:");
+            eprintln!("{}", service_content);
+            eprintln!();
+            eprintln!("{}", service::installation_instructions(init_system));
+            print_links(&opts.username, &secret, opts.port, &opts.domain);
+            return Ok(());
+        }
+    }
+
+    match init_system {
+        InitSystem::Systemd => {
+            run_cmd("systemctl", &["daemon-reload"]);
+            run_cmd("systemctl", &["enable", "telemt.service"]);
+            eprintln!("[+] Service enabled");
+
+            if !opts.no_start {
+                run_cmd("systemctl", &["start", "telemt.service"]);
+                eprintln!("[+] Service started");
+
+                std::thread::sleep(std::time::Duration::from_secs(1));
+                let status = resolve_trusted_helper("systemctl").and_then(|command_path| {
+                    Command::new(command_path)
+                        .args(["is-active", "telemt.service"])
+                        .output()
+                        .ok()
+                });
+                match status {
+                    Some(out) if out.status.success() => {
+                        eprintln!("[+] Service is running");
+                    }
+                    _ => {
+                        eprintln!("[!] Service may not have started correctly");
+                        eprintln!("[!] Check: journalctl -u telemt.service -n 20");
+                    }
+                }
+            } else {
+                eprintln!("[+] Service not started (--no-start)");
+                eprintln!("[+] Start manually: systemctl start telemt.service");
+            }
+        }
+        InitSystem::OpenRC => {
+            run_cmd("rc-update", &["add", "telemt", "default"]);
+            eprintln!("[+] Service enabled");
+
+            if !opts.no_start {
+                run_cmd("rc-service", &["telemt", "start"]);
+                eprintln!("[+] Service started");
+            } else {
+                eprintln!("[+] Service not started (--no-start)");
+                eprintln!("[+] Start manually: rc-service telemt start");
+            }
+        }
+        InitSystem::FreeBSDRc => {
+            run_cmd("sysrc", &["telemt_enable=YES"]);
+            eprintln!("[+] Service enabled");
+
+            if !opts.no_start {
+                run_cmd("service", &["telemt", "start"]);
+                eprintln!("[+] Service started");
+            } else {
+                eprintln!("[+] Service not started (--no-start)");
+                eprintln!("[+] Start manually: service telemt start");
+            }
+        }
+        InitSystem::Unknown => {
+            eprintln!("[!] Unknown init system - service file written but not installed");
+            eprintln!("[!] You may need to install it manually");
+        }
+    }
+
+    eprintln!();
+    print_links(&opts.username, &secret, opts.port, &opts.domain);
+    Ok(())
+}
+
+fn write_init_file(path: &Path, contents: &str, mode: u32) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        crate::util::secure_fs::atomic_replace(path, contents.as_bytes(), mode)
+    }
+    #[cfg(not(unix))]
+    {
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+        let _ = mode;
+        std::fs::write(path, contents)
+    }
+}
+
+fn generate_secret() -> String {
+    let mut rng = rand::rng();
+    let bytes: Vec<u8> = (0..16).map(|_| rng.random::<u8>()).collect();
+    hex::encode(bytes)
+}
+
+fn generate_config(username: &str, secret: &str, port: u16, domain: &str) -> String {
+    format!(
+        r#"# Telemt MTProxy — auto-generated config
+# Re-run `telemt --init` to regenerate
+
+show_link = ["{username}"]
+
+[general]
+# prefer_ipv6 is deprecated; use [network].prefer
+prefer_ipv6 = false
+fast_mode = true
+use_middle_proxy = false
+log_level = "normal"
+desync_all_full = false
+update_every = 43200
+hardswap = false
+me_pool_drain_ttl_secs = 90
+me_instadrain = false
+me_pool_drain_threshold = 32
+me_pool_drain_soft_evict_grace_secs = 10
+me_pool_drain_soft_evict_per_writer = 2
+me_pool_drain_soft_evict_budget_per_core = 16
+me_pool_drain_soft_evict_cooldown_ms = 1000
+me_bind_stale_mode = "never"
+me_pool_min_fresh_ratio = 0.8
+me_reinit_drain_timeout_secs = 90
+tg_connect = 10
+
+[network]
+ipv4 = true
+ipv6 = true
+prefer = 4
+multipath = false
+
+[general.modes]
+classic = false
+secure = false
+tls = true
+
+[server]
+listen_addr_ipv4 = "0.0.0.0"
+listen_addr_ipv6 = "::"
+
+[[server.listeners]]
+ip = "0.0.0.0"
+port = {port}
+# reuse_allow = false # Set true only when intentionally running multiple telemt instances on same port
+
+[[server.listeners]]
+ip = "::"
+port = {port}
+
+[timeouts]
+client_first_byte_idle_secs = 300
+client_handshake = 60
+client_keepalive = 60
+client_ack = 300
+
+[censorship]
+tls_domain = "{domain}"
+mask = true
+mask_port = 443
+fake_cert_len = 2048
+serverhello_compact = false
+tls_full_cert_ttl_secs = 90
+
+[access]
+user_max_tcp_conns_global_each = 0
+replay_check_len = 65536
+replay_window_secs = 120
+ignore_time_skew = false
+
+[access.users]
+{username} = "{secret}"
+
+[[upstreams]]
+type = "direct"
+enabled = true
+weight = 10
+# Optional per-upstream DC family policy:
+# ipv6 = true
+# prefer = 6
+"#,
+        username = username,
+        secret = secret,
+        port = port,
+        domain = domain,
+    )
+}
+
+fn run_cmd(cmd: &str, args: &[&str]) {
+    let Some(command_path) = resolve_trusted_helper(cmd) else {
+        eprintln!("[!] Refusing unavailable or untrusted command: {}", cmd);
+        return;
+    };
+    match Command::new(command_path).args(args).output() {
+        Ok(output) => {
+            if !output.status.success() {
+                let stderr = String::from_utf8_lossy(&output.stderr);
+                eprintln!("[!] {} {} failed: {}", cmd, args.join(" "), stderr.trim());
+            }
+        }
+        Err(e) => {
+            eprintln!("[!] Failed to run {} {}: {}", cmd, args.join(" "), e);
+        }
+    }
+}
+
+fn print_links(username: &str, secret: &str, port: u16, domain: &str) {
+    let domain_hex = hex::encode(domain);
+
+    println!("=== Proxy Links ===");
+    println!("[{}]", username);
+    println!(
+        "  EE-TLS:  tg://proxy?server=YOUR_SERVER_IP&port={}&secret=ee{}{}",
+        port, secret, domain_hex
+    );
+    println!();
+    println!("Replace YOUR_SERVER_IP with your server's public IP.");
+    println!("The proxy will auto-detect and display the correct link on startup.");
+    println!("Check: journalctl -u telemt.service | head -30");
+    println!("===================");
+}
@@ -1,6 +1,9 @@
 use ipnetwork::IpNetwork;
-use serde::Deserialize;
-use std::collections::HashMap;
+
+// Extended transport, masking, and ME default values.
+mod extended;
+
+pub(crate) use extended::*;

 // Helper defaults kept private to the config module.
 const DEFAULT_NETWORK_IPV6: Option<bool> = Some(false);
@@ -520,447 +523,3 @@ pub(crate) fn default_direct_relay_copy_buf_s2c_bytes() -> usize {
 pub(crate) fn default_direct_relay_buffer_budget_max_bytes() -> usize {
    DEFAULT_DIRECT_RELAY_BUFFER_BUDGET_MAX_BYTES
 }
-
-pub(crate) fn default_me_writer_pick_sample_size() -> u8 {
-    DEFAULT_ME_WRITER_PICK_SAMPLE_SIZE
-}
-
-pub(crate) fn default_me_health_interval_ms_unhealthy() -> u64 {
-    DEFAULT_ME_HEALTH_INTERVAL_MS_UNHEALTHY
-}
-
-pub(crate) fn default_me_health_interval_ms_healthy() -> u64 {
-    DEFAULT_ME_HEALTH_INTERVAL_MS_HEALTHY
-}
-
-pub(crate) fn default_me_admission_poll_ms() -> u64 {
-    DEFAULT_ME_ADMISSION_POLL_MS
-}
-
-pub(crate) fn default_me_warn_rate_limit_ms() -> u64 {
-    DEFAULT_ME_WARN_RATE_LIMIT_MS
-}
-
-pub(crate) fn default_me_route_hybrid_max_wait_ms() -> u64 {
-    DEFAULT_ME_ROUTE_HYBRID_MAX_WAIT_MS
-}
-
-pub(crate) fn default_me_route_blocking_send_timeout_ms() -> u64 {
-    DEFAULT_ME_ROUTE_BLOCKING_SEND_TIMEOUT_MS
-}
-
-pub(crate) fn default_me_c2me_send_timeout_ms() -> u64 {
-    DEFAULT_ME_C2ME_SEND_TIMEOUT_MS
-}
-
-pub(crate) fn default_upstream_connect_retry_attempts() -> u32 {
-    DEFAULT_UPSTREAM_CONNECT_RETRY_ATTEMPTS
-}
-
-pub(crate) fn default_upstream_connect_retry_backoff_ms() -> u64 {
-    100
-}
-
-pub(crate) fn default_upstream_unhealthy_fail_threshold() -> u32 {
-    DEFAULT_UPSTREAM_UNHEALTHY_FAIL_THRESHOLD
-}
-
-pub(crate) fn default_upstream_connect_budget_ms() -> u64 {
-    DEFAULT_UPSTREAM_CONNECT_BUDGET_MS
-}
-
-pub(crate) fn default_upstream_connect_failfast_hard_errors() -> bool {
-    false
-}
-
-pub(crate) fn default_rpc_proxy_req_every() -> u64 {
-    0
-}
-
-pub(crate) fn default_crypto_pending_buffer() -> usize {
-    256 * 1024
-}
-
-pub(crate) fn default_max_client_frame() -> usize {
-    16 * 1024 * 1024
-}
-
-pub(crate) fn default_desync_all_full() -> bool {
-    false
-}
-
-pub(crate) fn default_me_route_backpressure_base_timeout_ms() -> u64 {
-    25
-}
-
-pub(crate) fn default_me_route_backpressure_enabled() -> bool {
-    DEFAULT_ME_ROUTE_BACKPRESSURE_ENABLED
-}
-
-pub(crate) fn default_me_route_fairshare_enabled() -> bool {
-    DEFAULT_ME_ROUTE_FAIRSHARE_ENABLED
-}
-
-pub(crate) fn default_me_route_backpressure_high_timeout_ms() -> u64 {
-    120
-}
-
-pub(crate) fn default_me_route_backpressure_high_watermark_pct() -> u8 {
-    80
-}
-
-pub(crate) fn default_me_route_no_writer_wait_ms() -> u64 {
-    250
-}
-
-pub(crate) fn default_me_route_inline_recovery_attempts() -> u32 {
-    3
-}
-
-pub(crate) fn default_me_route_inline_recovery_wait_ms() -> u64 {
-    3000
-}
-
-pub(crate) fn default_beobachten_minutes() -> u64 {
-    10
-}
-
-pub(crate) fn default_beobachten_flush_secs() -> u64 {
-    15
-}
-
-pub(crate) fn default_beobachten_file() -> String {
-    "beobachten.txt".to_string()
-}
-
-pub(crate) fn default_tls_new_session_tickets() -> u8 {
-    0
-}
-
-pub(crate) fn default_serverhello_compact() -> bool {
-    false
-}
-
-pub(crate) fn default_tls_full_cert_ttl_secs() -> u64 {
-    90
-}
-
-pub(crate) fn default_server_hello_delay_min_ms() -> u64 {
-    8
-}
-
-pub(crate) fn default_server_hello_delay_max_ms() -> u64 {
-    24
-}
-
-pub(crate) fn default_alpn_enforce() -> bool {
-    true
-}
-
-pub(crate) fn default_mask_shape_hardening() -> bool {
-    true
-}
-
-pub(crate) fn default_mask_shape_hardening_aggressive_mode() -> bool {
-    false
-}
-
-pub(crate) fn default_mask_shape_bucket_floor_bytes() -> usize {
-    512
-}
-
-pub(crate) fn default_mask_shape_bucket_cap_bytes() -> usize {
-    4096
-}
-
-pub(crate) fn default_mask_shape_above_cap_blur() -> bool {
-    false
-}
-
-pub(crate) fn default_mask_shape_above_cap_blur_max_bytes() -> usize {
-    512
-}
-
-#[cfg(not(test))]
-pub(crate) fn default_mask_relay_max_bytes() -> usize {
-    5 * 1024 * 1024
-}
-
-#[cfg(test)]
-pub(crate) fn default_mask_relay_max_bytes() -> usize {
-    32 * 1024
-}
-
-#[cfg(not(test))]
-pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
-    60_000
-}
-
-#[cfg(test)]
-pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
-    200
-}
-
-#[cfg(not(test))]
-pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
-    5_000
-}
-
-#[cfg(test)]
-pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
-    100
-}
-
-pub(crate) fn default_mask_classifier_prefetch_timeout_ms() -> u64 {
-    5
-}
-
-pub(crate) fn default_mask_timing_normalization_enabled() -> bool {
-    false
-}
-
-pub(crate) fn default_mask_timing_normalization_floor_ms() -> u64 {
-    0
-}
-
-pub(crate) fn default_mask_timing_normalization_ceiling_ms() -> u64 {
-    0
-}
-
-pub(crate) fn default_stun_servers() -> Vec<String> {
-    vec![
-        "stun.l.google.com:5349".to_string(),
-        "stun1.l.google.com:3478".to_string(),
-        "stun.gmx.net:3478".to_string(),
-        "stun.l.google.com:19302".to_string(),
-        "stun.1und1.de:3478".to_string(),
-        "stun1.l.google.com:19302".to_string(),
-        "stun2.l.google.com:19302".to_string(),
-        "stun3.l.google.com:19302".to_string(),
-        "stun4.l.google.com:19302".to_string(),
-        "stun.services.mozilla.com:3478".to_string(),
-        "stun.stunprotocol.org:3478".to_string(),
-        "stun.nextcloud.com:3478".to_string(),
-        "stun.voip.eutelia.it:3478".to_string(),
-    ]
-}
-
-pub(crate) fn default_http_ip_detect_urls() -> Vec<String> {
-    vec![
-        "https://ifconfig.me/ip".to_string(),
-        "https://api.ipify.org".to_string(),
-    ]
-}
-
-pub(crate) fn default_cache_public_ip_path() -> String {
-    "cache/public_ip.txt".to_string()
-}
-
-pub(crate) fn default_proxy_secret_reload_secs() -> u64 {
-    60 * 60
-}
-
-pub(crate) fn default_proxy_config_reload_secs() -> u64 {
-    60 * 60
-}
-
-pub(crate) fn default_update_every_secs() -> u64 {
-    5 * 60
-}
-
-pub(crate) fn default_update_every() -> Option<u64> {
-    Some(default_update_every_secs())
-}
-
-pub(crate) fn default_me_reinit_every_secs() -> u64 {
-    15 * 60
-}
-
-pub(crate) fn default_me_reinit_singleflight() -> bool {
-    true
-}
-
-pub(crate) fn default_me_reinit_trigger_channel() -> usize {
-    64
-}
-
-pub(crate) fn default_me_reinit_coalesce_window_ms() -> u64 {
-    200
-}
-
-pub(crate) fn default_me_hardswap_warmup_delay_min_ms() -> u64 {
-    1000
-}
-
-pub(crate) fn default_me_hardswap_warmup_delay_max_ms() -> u64 {
-    2000
-}
-
-pub(crate) fn default_me_hardswap_warmup_extra_passes() -> u8 {
-    3
-}
-
-pub(crate) fn default_me_hardswap_warmup_pass_backoff_base_ms() -> u64 {
-    500
-}
-
-pub(crate) fn default_me_config_stable_snapshots() -> u8 {
-    2
-}
-
-pub(crate) fn default_me_config_apply_cooldown_secs() -> u64 {
-    300
-}
-
-pub(crate) fn default_me_snapshot_require_http_2xx() -> bool {
-    true
-}
-
-pub(crate) fn default_me_snapshot_reject_empty_map() -> bool {
-    true
-}
-
-pub(crate) fn default_me_snapshot_min_proxy_for_lines() -> u32 {
-    1
-}
-
-pub(crate) fn default_proxy_secret_stable_snapshots() -> u8 {
-    2
-}
-
-pub(crate) fn default_proxy_secret_rotate_runtime() -> bool {
-    true
-}
-
-pub(crate) fn default_me_secret_atomic_snapshot() -> bool {
-    true
-}
-
-pub(crate) fn default_proxy_secret_len_max() -> usize {
-    256
-}
-
-pub(crate) fn default_me_reinit_drain_timeout_secs() -> u64 {
-    90
-}
-
-pub(crate) fn default_me_pool_drain_ttl_secs() -> u64 {
-    90
-}
-
-pub(crate) fn default_me_instadrain() -> bool {
-    false
-}
-
-pub(crate) fn default_me_pool_drain_threshold() -> u64 {
-    32
-}
-
-pub(crate) fn default_me_pool_drain_soft_evict_enabled() -> bool {
-    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_ENABLED
-}
-
-pub(crate) fn default_me_pool_drain_soft_evict_grace_secs() -> u64 {
-    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_GRACE_SECS
-}
-
-pub(crate) fn default_me_pool_drain_soft_evict_per_writer() -> u8 {
-    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_PER_WRITER
-}
-
-pub(crate) fn default_me_pool_drain_soft_evict_budget_per_core() -> u16 {
-    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_BUDGET_PER_CORE
-}
-
-pub(crate) fn default_me_pool_drain_soft_evict_cooldown_ms() -> u64 {
-    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_COOLDOWN_MS
-}
-
-pub(crate) fn default_me_bind_stale_ttl_secs() -> u64 {
-    default_me_pool_drain_ttl_secs()
-}
-
-pub(crate) fn default_me_pool_min_fresh_ratio() -> f32 {
-    0.8
-}
-
-pub(crate) fn default_me_deterministic_writer_sort() -> bool {
-    true
-}
-
-pub(crate) fn default_hardswap() -> bool {
-    true
-}
-
-pub(crate) fn default_ntp_check() -> bool {
-    true
-}
-
-pub(crate) fn default_ntp_servers() -> Vec<String> {
-    vec!["pool.ntp.org".to_string()]
-}
-
-pub(crate) fn default_fast_mode_min_tls_record() -> usize {
-    0
-}
-
-pub(crate) fn default_degradation_min_unavailable_dc_groups() -> u8 {
-    2
-}
-
-pub(crate) fn default_listen_addr_ipv6() -> String {
-    DEFAULT_LISTEN_ADDR_IPV6.to_string()
-}
-
-pub(crate) fn default_listen_addr_ipv6_opt() -> Option<String> {
-    Some(default_listen_addr_ipv6())
-}
-
-pub(crate) fn default_access_users() -> HashMap<String, String> {
-    HashMap::from([(
-        DEFAULT_ACCESS_USER.to_string(),
-        DEFAULT_ACCESS_SECRET.to_string(),
-    )])
-}
-
-pub(crate) fn default_user_max_unique_ips_window_secs() -> u64 {
-    DEFAULT_USER_MAX_UNIQUE_IPS_WINDOW_SECS
-}
-
-pub(crate) fn default_user_max_tcp_conns_global_each() -> usize {
-    0
-}
-
-pub(crate) fn default_user_max_unique_ips_global_each() -> usize {
-    0
-}
-
-// Custom deserializer helpers
-
-#[derive(Deserialize)]
-#[serde(untagged)]
-pub(crate) enum OneOrMany {
-    One(String),
-    Many(Vec<String>),
-}
-
-pub(crate) fn deserialize_dc_overrides<'de, D>(
-    deserializer: D,
-) -> std::result::Result<HashMap<String, Vec<String>>, D::Error>
-where
-    D: serde::de::Deserializer<'de>,
-{
-    let raw: HashMap<String, OneOrMany> = HashMap::deserialize(deserializer)?;
-    let mut out = HashMap::new();
-    for (dc, val) in raw {
-        let mut addrs = match val {
-            OneOrMany::One(s) => vec![s],
-            OneOrMany::Many(v) => v,
-        };
-        addrs.retain(|s| !s.trim().is_empty());
-        if !addrs.is_empty() {
-            out.insert(dc, addrs);
-        }
-    }
-    Ok(out)
-}
@@ -0,0 +1,453 @@
+use std::collections::HashMap;
+
+use serde::Deserialize;
+
+use super::*;
+
+pub(crate) fn default_me_writer_pick_sample_size() -> u8 {
+    DEFAULT_ME_WRITER_PICK_SAMPLE_SIZE
+}
+
+pub(crate) fn default_me_health_interval_ms_unhealthy() -> u64 {
+    DEFAULT_ME_HEALTH_INTERVAL_MS_UNHEALTHY
+}
+
+pub(crate) fn default_me_health_interval_ms_healthy() -> u64 {
+    DEFAULT_ME_HEALTH_INTERVAL_MS_HEALTHY
+}
+
+pub(crate) fn default_me_admission_poll_ms() -> u64 {
+    DEFAULT_ME_ADMISSION_POLL_MS
+}
+
+pub(crate) fn default_me_warn_rate_limit_ms() -> u64 {
+    DEFAULT_ME_WARN_RATE_LIMIT_MS
+}
+
+pub(crate) fn default_me_route_hybrid_max_wait_ms() -> u64 {
+    DEFAULT_ME_ROUTE_HYBRID_MAX_WAIT_MS
+}
+
+pub(crate) fn default_me_route_blocking_send_timeout_ms() -> u64 {
+    DEFAULT_ME_ROUTE_BLOCKING_SEND_TIMEOUT_MS
+}
+
+pub(crate) fn default_me_c2me_send_timeout_ms() -> u64 {
+    DEFAULT_ME_C2ME_SEND_TIMEOUT_MS
+}
+
+pub(crate) fn default_upstream_connect_retry_attempts() -> u32 {
+    DEFAULT_UPSTREAM_CONNECT_RETRY_ATTEMPTS
+}
+
+pub(crate) fn default_upstream_connect_retry_backoff_ms() -> u64 {
+    100
+}
+
+pub(crate) fn default_upstream_unhealthy_fail_threshold() -> u32 {
+    DEFAULT_UPSTREAM_UNHEALTHY_FAIL_THRESHOLD
+}
+
+pub(crate) fn default_upstream_connect_budget_ms() -> u64 {
+    DEFAULT_UPSTREAM_CONNECT_BUDGET_MS
+}
+
+pub(crate) fn default_upstream_connect_failfast_hard_errors() -> bool {
+    false
+}
+
+pub(crate) fn default_rpc_proxy_req_every() -> u64 {
+    0
+}
+
+pub(crate) fn default_crypto_pending_buffer() -> usize {
+    256 * 1024
+}
+
+pub(crate) fn default_max_client_frame() -> usize {
+    16 * 1024 * 1024
+}
+
+pub(crate) fn default_desync_all_full() -> bool {
+    false
+}
+
+pub(crate) fn default_me_route_backpressure_base_timeout_ms() -> u64 {
+    25
+}
+
+pub(crate) fn default_me_route_backpressure_enabled() -> bool {
+    DEFAULT_ME_ROUTE_BACKPRESSURE_ENABLED
+}
+
+pub(crate) fn default_me_route_fairshare_enabled() -> bool {
+    DEFAULT_ME_ROUTE_FAIRSHARE_ENABLED
+}
+
+pub(crate) fn default_me_route_backpressure_high_timeout_ms() -> u64 {
+    120
+}
+
+pub(crate) fn default_me_route_backpressure_high_watermark_pct() -> u8 {
+    80
+}
+
+pub(crate) fn default_me_route_no_writer_wait_ms() -> u64 {
+    250
+}
+
+pub(crate) fn default_me_route_inline_recovery_attempts() -> u32 {
+    3
+}
+
+pub(crate) fn default_me_route_inline_recovery_wait_ms() -> u64 {
+    3000
+}
+
+pub(crate) fn default_beobachten_minutes() -> u64 {
+    10
+}
+
+pub(crate) fn default_beobachten_flush_secs() -> u64 {
+    15
+}
+
+pub(crate) fn default_beobachten_file() -> String {
+    "beobachten.txt".to_string()
+}
+
+pub(crate) fn default_tls_new_session_tickets() -> u8 {
+    0
+}
+
+pub(crate) fn default_serverhello_compact() -> bool {
+    false
+}
+
+pub(crate) fn default_tls_full_cert_ttl_secs() -> u64 {
+    90
+}
+
+pub(crate) fn default_server_hello_delay_min_ms() -> u64 {
+    8
+}
+
+pub(crate) fn default_server_hello_delay_max_ms() -> u64 {
+    24
+}
+
+pub(crate) fn default_alpn_enforce() -> bool {
+    true
+}
+
+pub(crate) fn default_mask_shape_hardening() -> bool {
+    true
+}
+
+pub(crate) fn default_mask_shape_hardening_aggressive_mode() -> bool {
+    false
+}
+
+pub(crate) fn default_mask_shape_bucket_floor_bytes() -> usize {
+    512
+}
+
+pub(crate) fn default_mask_shape_bucket_cap_bytes() -> usize {
+    4096
+}
+
+pub(crate) fn default_mask_shape_above_cap_blur() -> bool {
+    false
+}
+
+pub(crate) fn default_mask_shape_above_cap_blur_max_bytes() -> usize {
+    512
+}
+
+#[cfg(not(test))]
+pub(crate) fn default_mask_relay_max_bytes() -> usize {
+    5 * 1024 * 1024
+}
+
+#[cfg(test)]
+pub(crate) fn default_mask_relay_max_bytes() -> usize {
+    32 * 1024
+}
+
+#[cfg(not(test))]
+pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
+    60_000
+}
+
+#[cfg(test)]
+pub(crate) fn default_mask_relay_timeout_ms() -> u64 {
+    200
+}
+
+#[cfg(not(test))]
+pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
+    5_000
+}
+
+#[cfg(test)]
+pub(crate) fn default_mask_relay_idle_timeout_ms() -> u64 {
+    100
+}
+
+pub(crate) fn default_mask_classifier_prefetch_timeout_ms() -> u64 {
+    5
+}
+
+pub(crate) fn default_mask_timing_normalization_enabled() -> bool {
+    false
+}
+
+pub(crate) fn default_mask_timing_normalization_floor_ms() -> u64 {
+    0
+}
+
+pub(crate) fn default_mask_timing_normalization_ceiling_ms() -> u64 {
+    0
+}
+
+pub(crate) fn default_stun_servers() -> Vec<String> {
+    vec![
+        "stun.l.google.com:5349".to_string(),
+        "stun1.l.google.com:3478".to_string(),
+        "stun.gmx.net:3478".to_string(),
+        "stun.l.google.com:19302".to_string(),
+        "stun.1und1.de:3478".to_string(),
+        "stun1.l.google.com:19302".to_string(),
+        "stun2.l.google.com:19302".to_string(),
+        "stun3.l.google.com:19302".to_string(),
+        "stun4.l.google.com:19302".to_string(),
+        "stun.services.mozilla.com:3478".to_string(),
+        "stun.stunprotocol.org:3478".to_string(),
+        "stun.nextcloud.com:3478".to_string(),
+        "stun.voip.eutelia.it:3478".to_string(),
+    ]
+}
+
+pub(crate) fn default_http_ip_detect_urls() -> Vec<String> {
+    vec![
+        "https://ifconfig.me/ip".to_string(),
+        "https://api.ipify.org".to_string(),
+    ]
+}
+
+pub(crate) fn default_cache_public_ip_path() -> String {
+    "cache/public_ip.txt".to_string()
+}
+
+pub(crate) fn default_proxy_secret_reload_secs() -> u64 {
+    60 * 60
+}
+
+pub(crate) fn default_proxy_config_reload_secs() -> u64 {
+    60 * 60
+}
+
+pub(crate) fn default_update_every_secs() -> u64 {
+    5 * 60
+}
+
+pub(crate) fn default_update_every() -> Option<u64> {
+    Some(default_update_every_secs())
+}
+
+pub(crate) fn default_me_reinit_every_secs() -> u64 {
+    15 * 60
+}
+
+pub(crate) fn default_me_reinit_singleflight() -> bool {
+    true
+}
+
+pub(crate) fn default_me_reinit_max_concurrency() -> usize {
+    2
+}
+
+pub(crate) fn default_me_reinit_trigger_channel() -> usize {
+    64
+}
+
+pub(crate) fn default_me_reinit_coalesce_window_ms() -> u64 {
+    200
+}
+
+pub(crate) fn default_me_hardswap_warmup_delay_min_ms() -> u64 {
+    1000
+}
+
+pub(crate) fn default_me_hardswap_warmup_delay_max_ms() -> u64 {
+    2000
+}
+
+pub(crate) fn default_me_hardswap_warmup_extra_passes() -> u8 {
+    3
+}
+
+pub(crate) fn default_me_hardswap_warmup_pass_backoff_base_ms() -> u64 {
+    500
+}
+
+pub(crate) fn default_me_config_stable_snapshots() -> u8 {
+    2
+}
+
+pub(crate) fn default_me_config_apply_cooldown_secs() -> u64 {
+    300
+}
+
+pub(crate) fn default_me_snapshot_require_http_2xx() -> bool {
+    true
+}
+
+pub(crate) fn default_me_snapshot_reject_empty_map() -> bool {
+    true
+}
+
+pub(crate) fn default_me_snapshot_min_proxy_for_lines() -> u32 {
+    1
+}
+
+pub(crate) fn default_proxy_secret_stable_snapshots() -> u8 {
+    2
+}
+
+pub(crate) fn default_proxy_secret_rotate_runtime() -> bool {
+    true
+}
+
+pub(crate) fn default_me_secret_atomic_snapshot() -> bool {
+    true
+}
+
+pub(crate) fn default_proxy_secret_len_max() -> usize {
+    256
+}
+
+pub(crate) fn default_me_reinit_drain_timeout_secs() -> u64 {
+    90
+}
+
+pub(crate) fn default_me_pool_drain_ttl_secs() -> u64 {
+    90
+}
+
+pub(crate) fn default_me_instadrain() -> bool {
+    false
+}
+
+pub(crate) fn default_me_pool_drain_threshold() -> u64 {
+    32
+}
+
+pub(crate) fn default_me_pool_drain_soft_evict_enabled() -> bool {
+    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_ENABLED
+}
+
+pub(crate) fn default_me_pool_drain_soft_evict_grace_secs() -> u64 {
+    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_GRACE_SECS
+}
+
+pub(crate) fn default_me_pool_drain_soft_evict_per_writer() -> u8 {
+    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_PER_WRITER
+}
+
+pub(crate) fn default_me_pool_drain_soft_evict_budget_per_core() -> u16 {
+    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_BUDGET_PER_CORE
+}
+
+pub(crate) fn default_me_pool_drain_soft_evict_cooldown_ms() -> u64 {
+    DEFAULT_ME_POOL_DRAIN_SOFT_EVICT_COOLDOWN_MS
+}
+
+pub(crate) fn default_me_bind_stale_ttl_secs() -> u64 {
+    default_me_pool_drain_ttl_secs()
+}
+
+pub(crate) fn default_me_pool_min_fresh_ratio() -> f32 {
+    0.8
+}
+
+pub(crate) fn default_me_deterministic_writer_sort() -> bool {
+    true
+}
+
+pub(crate) fn default_hardswap() -> bool {
+    true
+}
+
+pub(crate) fn default_ntp_check() -> bool {
+    true
+}
+
+pub(crate) fn default_ntp_servers() -> Vec<String> {
+    vec!["pool.ntp.org".to_string()]
+}
+
+pub(crate) fn default_fast_mode_min_tls_record() -> usize {
+    0
+}
+
+pub(crate) fn default_degradation_min_unavailable_dc_groups() -> u8 {
+    2
+}
+
+pub(crate) fn default_listen_addr_ipv6() -> String {
+    DEFAULT_LISTEN_ADDR_IPV6.to_string()
+}
+
+pub(crate) fn default_listen_addr_ipv6_opt() -> Option<String> {
+    Some(default_listen_addr_ipv6())
+}
+
+pub(crate) fn default_access_users() -> HashMap<String, String> {
+    HashMap::from([(
+        DEFAULT_ACCESS_USER.to_string(),
+        DEFAULT_ACCESS_SECRET.to_string(),
+    )])
+}
+
+pub(crate) fn default_user_max_unique_ips_window_secs() -> u64 {
+    DEFAULT_USER_MAX_UNIQUE_IPS_WINDOW_SECS
+}
+
+pub(crate) fn default_user_max_tcp_conns_global_each() -> usize {
+    0
+}
+
+pub(crate) fn default_user_max_unique_ips_global_each() -> usize {
+    0
+}
+
+// Custom deserializer helpers
+
+#[derive(Deserialize)]
+#[serde(untagged)]
+pub(crate) enum OneOrMany {
+    One(String),
+    Many(Vec<String>),
+}
+
+pub(crate) fn deserialize_dc_overrides<'de, D>(
+    deserializer: D,
+) -> std::result::Result<HashMap<String, Vec<String>>, D::Error>
+where
+    D: serde::de::Deserializer<'de>,
+{
+    let raw: HashMap<String, OneOrMany> = HashMap::deserialize(deserializer)?;
+    let mut out = HashMap::new();
+    for (dc, val) in raw {
+        let mut addrs = match val {
+            OneOrMany::One(s) => vec![s],
+            OneOrMany::Many(v) => v,
+        };
+        addrs.retain(|s| !s.trim().is_empty());
+        if !addrs.is_empty() {
+            out.insert(dc, addrs);
+        }
+    }
+    Ok(out)
+}
@@ -16,10 +16,13 @@
 //! | `general` | `telemetry` / `me_*_policy`    | Applied immediately                            |
 //! | `network` | `dns_overrides`                | Applied immediately                            |
 //! | `access`  | All user/quota fields          | Effective immediately                          |
+//! | `web`     | Carrier, timing, and debug policy | Applied to newly issued sessions             |
 //! Fields that require re-binding sockets (`server.listeners`, legacy
 //! `server.port`, `censorship.*`, `network.*`, `use_middle_proxy`) are **not**
 //! applied; a warning is emitted. SYN limiter rules are process-owned and are
 //! reconciled only during privileged startup.
+//! `web.decoy_fasttrack_mode` is also restart-only so one process never mixes
+//! capability timing policies or process-lifetime counter semantics.
 //! Non-hot changes are never mixed into the runtime config snapshot.

 use std::collections::BTreeSet;
@@ -36,7 +39,7 @@ use super::load::{LoadedConfig, ProxyConfig};
 #[allow(unused_imports)]
 use crate::config::{
    CidrRateLimitKey, LogLevel, MeBindStaleMode, MeFloorMode, MeSocksKdfPolicy, MeTelemetryLevel,
-    MeWriterPickMode, WebDebugConfig, web_debug_fits_limits,
+    MeWriterPickMode, WEB_CARRIER_LEARNING_MIN_ENTRIES, WebDebugConfig, web_debug_fits_limits,
 };
 #[cfg(test)]
 use crate::config::{ListenerConfig, SynLimitMode};
@@ -59,5 +62,8 @@ use reporting::log_changes;
 #[cfg(test)]
 use watcher::{ReloadState, reload_config};

+#[cfg(test)]
+#[path = "hot_reload/base_path_tests.rs"]
+mod base_path_tests;
 #[cfg(test)]
 mod tests;
@@ -0,0 +1,81 @@
+use base64::Engine as _;
+
+use super::*;
+
+fn write_base_path_config(path: &Path, base_path: &str) {
+    let base_path = if base_path.is_empty() {
+        String::new()
+    } else {
+        format!("base_path = \"{base_path}\"\n")
+    };
+    let config = format!(
+        r#"
+[access.users]
+alice = "000102030405060708090a0b0c0d0e0f"
+
+[[server.listeners]]
+ip = "127.0.0.1"
+port = 18080
+transport = "web"
+proxy_protocol = false
+web_client_ip_source = "x_forwarded_for"
+web_trusted_proxy_cidrs = ["127.0.0.1/32"]
+
+[web]
+enabled = true
+
+[[web.vhosts]]
+host = "proxy.example.com"
+{base_path}public_addr = "203.0.113.10:443"
+
+[web.vhosts.decoy]
+mode = "http_upstream"
+upstream = "http://127.0.0.1:18081"
+
+[[web.vhosts.profiles]]
+user = "alice"
+secret_mode = "plain"
+"#,
+    );
+    std::fs::write(path, config).unwrap();
+}
+
+#[test]
+fn reload_rejects_invalid_base_then_publishes_route_identity_together() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("config.toml");
+    write_base_path_config(&path, "");
+    let initial = Arc::new(ProxyConfig::load(&path).unwrap());
+    let initial_hash = ProxyConfig::load_with_metadata(&path)
+        .unwrap()
+        .rendered_hash;
+    let initial_capability = initial.web.runtime.as_ref().unwrap().capabilities[0];
+    let (config_tx, _config_rx) = watch::channel(Arc::clone(&initial));
+    let (log_tx, _log_rx) = watch::channel(initial.general.log_level.clone());
+    let mut reload_state = ReloadState::new(Some(initial_hash));
+
+    write_base_path_config(&path, "/invalid");
+    reload_config(&path, &config_tx, &log_tx, None, None, &mut reload_state);
+    let unchanged = config_tx.borrow().clone();
+    assert!(Arc::ptr_eq(&unchanged, &initial));
+    assert_eq!(unchanged.web.vhosts[0].base_path, "");
+    assert_eq!(
+        unchanged.web.runtime.as_ref().unwrap().capabilities[0],
+        initial_capability
+    );
+
+    write_base_path_config(&path, "dobry-cola-super-app");
+    reload_config(&path, &config_tx, &log_tx, None, None, &mut reload_state);
+    let applied = config_tx.borrow().clone();
+    let runtime = applied.web.runtime.as_ref().unwrap();
+    let vhost = &runtime.vhosts["proxy.example.com"];
+    assert_eq!(applied.web.vhosts[0].base_path, "dobry-cola-super-app");
+    assert_eq!(vhost.base, "/dobry-cola-super-app/");
+    assert_eq!(vhost.capabilities[0], vhost.profiles[0].capability);
+    assert_eq!(runtime.capabilities.as_ref(), vhost.capabilities.as_ref());
+    assert!(!runtime.capabilities.contains(&initial_capability));
+    assert_eq!(
+        base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(vhost.capabilities[0]),
+        "hHz99Xs93EN1j91G9gpNepXwGNNt5YdAFkEVk_LlqdQ"
+    );
+}
@@ -85,6 +85,10 @@ pub(super) fn warn_non_hot_changes(old: &ProxyConfig, new: &ProxyConfig, non_hot
        warned = true;
        warn!("config reload: server listener settings changed; restart required");
    }
+    if old.web.decoy_fasttrack_mode != new.web.decoy_fasttrack_mode {
+        warned = true;
+        warn!("config reload: web.decoy_fasttrack_mode changed; restart required");
+    }
    if old.censorship.tls_domain != new.censorship.tls_domain
        || old.censorship.tls_domains != new.censorship.tls_domains
        || old.censorship.tls_fetch_scope != new.censorship.tls_fetch_scope
@@ -10,6 +10,7 @@ pub struct HotFields {
    pub update_every_secs: u64,
    pub me_reinit_every_secs: u64,
    pub me_reinit_singleflight: bool,
+    pub me_reinit_max_concurrency: usize,
    pub me_reinit_coalesce_window_ms: u64,
    pub hardswap: bool,
    pub me_pool_drain_ttl_secs: u64,
@@ -102,6 +103,7 @@ impl HotFields {
            update_every_secs: cfg.general.effective_update_every_secs(),
            me_reinit_every_secs: cfg.general.me_reinit_every_secs,
            me_reinit_singleflight: cfg.general.me_reinit_singleflight,
+            me_reinit_max_concurrency: cfg.general.me_reinit_max_concurrency,
            me_reinit_coalesce_window_ms: cfg.general.me_reinit_coalesce_window_ms,
            hardswap: cfg.general.hardswap,
            me_pool_drain_ttl_secs: cfg.general.me_pool_drain_ttl_secs,
@@ -236,6 +238,7 @@ pub(super) fn overlay_hot_fields(old: &ProxyConfig, new: &ProxyConfig) -> ProxyC
    cfg.general.proxy_config_auto_reload_secs = new.general.proxy_config_auto_reload_secs;
    cfg.general.me_reinit_every_secs = new.general.me_reinit_every_secs;
    cfg.general.me_reinit_singleflight = new.general.me_reinit_singleflight;
+    cfg.general.me_reinit_max_concurrency = new.general.me_reinit_max_concurrency;
    cfg.general.me_reinit_coalesce_window_ms = new.general.me_reinit_coalesce_window_ms;
    cfg.general.hardswap = new.general.hardswap;
    cfg.general.me_pool_drain_ttl_secs = new.general.me_pool_drain_ttl_secs;
@@ -340,17 +343,26 @@ pub(super) fn overlay_hot_fields(old: &ProxyConfig, new: &ProxyConfig) -> ProxyC
    cfg.access.user_max_unique_ips_mode = new.access.user_max_unique_ips_mode;
    cfg.access.user_max_unique_ips_window_secs = new.access.user_max_unique_ips_window_secs;
    let process_limits = cfg.web.limits.clone();
+    let decoy_fasttrack_mode = cfg.web.decoy_fasttrack_mode;
    cfg.web = new.web.clone();
    cfg.web.limits = process_limits;
+    cfg.web.decoy_fasttrack_mode = decoy_fasttrack_mode;
+    if cfg.web.carrier_negotiation_enabled()
+        && cfg.web.carrier_learning
+        && cfg.web.limits.max_carrier_learning_entries < WEB_CARRIER_LEARNING_MIN_ENTRIES
+    {
+        if old.web.carrier_learning != new.web.carrier_learning {
+            cfg.web.carrier_learning = old.web.carrier_learning;
+        } else {
+            cfg.web.carriers = old.web.carriers.clone();
+        }
+    }
    if !web_debug_fits_limits(&cfg.web.debug, &cfg.web.limits) {
        cfg.web.debug = old.web.debug.clone();
    }
    if cfg.rebuild_runtime_user_auth().is_err() {
        cfg.runtime_user_auth = None;
    }
-    if cfg.rebuild_runtime_web().is_err() {
-        cfg.web = old.web.clone();
-    }

    cfg
 }
@@ -114,12 +114,14 @@ pub(super) fn log_changes(
    }
    if old_hot.me_reinit_every_secs != new_hot.me_reinit_every_secs
        || old_hot.me_reinit_singleflight != new_hot.me_reinit_singleflight
+        || old_hot.me_reinit_max_concurrency != new_hot.me_reinit_max_concurrency
        || old_hot.me_reinit_coalesce_window_ms != new_hot.me_reinit_coalesce_window_ms
    {
        info!(
-            "config reload: me_reinit: interval={}s singleflight={} coalesce={}ms",
+            "config reload: me_reinit: interval={}s singleflight={} max_concurrency={} coalesce={}ms",
            new_hot.me_reinit_every_secs,
            new_hot.me_reinit_singleflight,
+            new_hot.me_reinit_max_concurrency,
            new_hot.me_reinit_coalesce_window_ms
        );
    }
@@ -30,6 +30,60 @@ fn write_reload_config(path: &Path, ad_tag: Option<&str>, server_port: Option<u1
    std::fs::write(path, config).unwrap();
 }

+fn write_web_reload_config(path: &Path, carriers: &str, carrier_learning: bool) {
+    let config = format!(
+        r#"
+                [censorship]
+                tls_domain = "example.com"
+
+                [access.users]
+                user = "00000000000000000000000000000000"
+
+                [web]
+                carriers = {carriers}
+                carrier_learning = {carrier_learning}
+            "#,
+    );
+    std::fs::write(path, config).unwrap();
+}
+
+fn write_web_fasttrack_reload_config(path: &Path, mode: &str, ad_tag: &str) {
+    let config = format!(
+        r#"
+                [general]
+                ad_tag = "{ad_tag}"
+
+                [access.users]
+                alice = "000102030405060708090a0b0c0d0e0f"
+
+                [[server.listeners]]
+                ip = "127.0.0.1"
+                port = 18080
+                transport = "web"
+                proxy_protocol = false
+                web_client_ip_source = "x_forwarded_for"
+                web_trusted_proxy_cidrs = ["127.0.0.1/32"]
+
+                [web]
+                enabled = true
+                decoy_fasttrack_mode = "{mode}"
+
+                [[web.vhosts]]
+                host = "proxy.example.com"
+                public_addr = "203.0.113.10:443"
+
+                [web.vhosts.decoy]
+                mode = "http_upstream"
+                upstream = "http://127.0.0.1:18081"
+
+                [[web.vhosts.profiles]]
+                user = "alice"
+                secret_mode = "plain"
+            "#,
+    );
+    std::fs::write(path, config).unwrap();
+}
+
 fn temp_config_path(prefix: &str) -> PathBuf {
    let nonce = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
@@ -90,11 +144,13 @@ fn web_debug_policy_is_hot_while_debug_capacity_is_process_owned() {
    let old = sample_config();
    let mut new = old.clone();
    new.web.debug.enabled = true;
+    new.web.debug.sideband = true;
    new.web.debug.default_window_secs = 60;
    new.web.limits.debug_records_capacity += 1;

    let applied = overlay_hot_fields(&old, &new);
    assert!(applied.web.debug.enabled);
+    assert!(applied.web.debug.sideband);
    assert_eq!(applied.web.debug.default_window_secs, 60);
    assert_eq!(
        applied.web.limits.debug_records_capacity,
@@ -106,6 +162,65 @@ fn web_debug_policy_is_hot_while_debug_capacity_is_process_owned() {
    );
 }

+#[test]
+fn decoy_fasttrack_mode_is_deferred_until_restart() {
+    let old = sample_config();
+    let mut new = old.clone();
+    new.web.decoy_fasttrack_mode = crate::config::WebDecoyFastTrackMode::Enforce;
+
+    let applied = overlay_hot_fields(&old, &new);
+
+    assert_eq!(
+        applied.web.decoy_fasttrack_mode,
+        old.web.decoy_fasttrack_mode
+    );
+    assert_eq!(
+        HotFields::from_config(&old),
+        HotFields::from_config(&applied)
+    );
+}
+
+#[test]
+fn hot_overlay_defers_learning_that_requires_new_process_capacity() {
+    let mut old = sample_config();
+    old.web.limits.max_carrier_learning_entries = 1;
+    old.web.carriers = crate::config::WebCarriers::Disabled;
+    old.web.carrier_learning = false;
+    let mut new = old.clone();
+    new.web.limits.max_carrier_learning_entries = 3;
+    new.web.carriers = crate::config::WebCarriers::Enabled(vec![
+        crate::config::WebCarrier::Websocket,
+        crate::config::WebCarrier::Https,
+    ]);
+    new.web.carrier_learning = true;
+
+    let applied = overlay_hot_fields(&old, &new);
+
+    assert_eq!(applied.web.limits.max_carrier_learning_entries, 1);
+    assert!(applied.web.carrier_negotiation_enabled());
+    assert!(!applied.web.carrier_learning);
+}
+
+#[test]
+fn hot_overlay_defers_carriers_for_dormant_learning_with_small_capacity() {
+    let mut old = sample_config();
+    old.web.limits.max_carrier_learning_entries = 1;
+    old.web.carriers = crate::config::WebCarriers::Disabled;
+    old.web.carrier_learning = true;
+    let mut new = old.clone();
+    new.web.limits.max_carrier_learning_entries = 3;
+    new.web.carriers = crate::config::WebCarriers::Enabled(vec![
+        crate::config::WebCarrier::Websocket,
+        crate::config::WebCarrier::Https,
+    ]);
+
+    let applied = overlay_hot_fields(&old, &new);
+
+    assert_eq!(applied.web.limits.max_carrier_learning_entries, 1);
+    assert!(!applied.web.carrier_negotiation_enabled());
+    assert!(applied.web.carrier_learning);
+}
+
 #[test]
 fn web_debug_prefix_requiring_deferred_capacity_is_not_hot_applied() {
    let old = sample_config();
@@ -239,6 +354,47 @@ fn reload_applies_hot_change_on_first_observed_snapshot() {
    let _ = std::fs::remove_file(path);
 }

+#[tokio::test]
+async fn candidate_watcher_waits_for_activation_and_reconciles_disk() {
+    let initial_tag = "10101010101010101010101010101010";
+    let disk_tag = "20202020202020202020202020202020";
+    let path = temp_config_path("telemt_hot_reload_activation_gate");
+    write_reload_config(&path, Some(initial_tag), None);
+    let initial = Arc::new(ProxyConfig::load(&path).unwrap());
+    write_reload_config(&path, Some(disk_tag), None);
+    let cancellation = tokio_util::sync::CancellationToken::new();
+    let (activation_tx, activation_rx) = watch::channel(false);
+    let (mut config_rx, _log_rx, watcher) = spawn_config_watcher(
+        path.clone(),
+        initial,
+        None,
+        None,
+        cancellation.clone(),
+        None,
+        Some(activation_rx),
+    );
+    let watcher = tokio::spawn(watcher);
+
+    tokio::task::yield_now().await;
+    assert_eq!(
+        config_rx.borrow().general.ad_tag.as_deref(),
+        Some(initial_tag)
+    );
+    activation_tx.send_replace(true);
+    tokio::time::timeout(Duration::from_secs(2), config_rx.changed())
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        config_rx.borrow_and_update().general.ad_tag.as_deref(),
+        Some(disk_tag)
+    );
+
+    cancellation.cancel();
+    watcher.await.unwrap();
+    let _ = std::fs::remove_file(path);
+}
+
 #[test]
 fn reload_keeps_hot_apply_when_non_hot_fields_change() {
    let initial_tag = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
@@ -264,6 +420,62 @@ fn reload_keeps_hot_apply_when_non_hot_fields_change() {
    let _ = std::fs::remove_file(path);
 }

+#[test]
+fn reload_rebuilds_vhosts_with_the_effective_fasttrack_mode() {
+    let initial_tag = "abababababababababababababababab";
+    let final_tag = "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd";
+    let path = temp_config_path("telemt_web_fasttrack_reload");
+
+    write_web_fasttrack_reload_config(&path, "off", initial_tag);
+    let initial_cfg = Arc::new(ProxyConfig::load(&path).unwrap());
+    let initial_hash = ProxyConfig::load_with_metadata(&path)
+        .unwrap()
+        .rendered_hash;
+    let (config_tx, _config_rx) = watch::channel(Arc::clone(&initial_cfg));
+    let (log_tx, _log_rx) = watch::channel(initial_cfg.general.log_level.clone());
+    let mut reload_state = ReloadState::new(Some(initial_hash));
+
+    write_web_fasttrack_reload_config(&path, "enforce", final_tag);
+    reload_config(&path, &config_tx, &log_tx, None, None, &mut reload_state).unwrap();
+
+    let applied = config_tx.borrow().clone();
+    assert_eq!(applied.general.ad_tag.as_deref(), Some(final_tag));
+    assert_eq!(
+        applied.web.decoy_fasttrack_mode,
+        crate::config::WebDecoyFastTrackMode::Off
+    );
+    let runtime = applied.web.runtime.as_ref().unwrap();
+    assert_eq!(
+        runtime.vhosts["proxy.example.com"].decoy_fasttrack_mode,
+        crate::config::WebDecoyFastTrackMode::Off
+    );
+
+    let _ = std::fs::remove_file(path);
+}
+
+#[test]
+fn reload_publishes_web_negotiation_policy_outside_hot_field_reporting() {
+    let path = temp_config_path("telemt_web_negotiation_reload");
+
+    write_web_reload_config(&path, "false", true);
+    let initial_cfg = Arc::new(ProxyConfig::load(&path).unwrap());
+    let initial_hash = ProxyConfig::load_with_metadata(&path)
+        .unwrap()
+        .rendered_hash;
+    let (config_tx, _config_rx) = watch::channel(initial_cfg.clone());
+    let (log_tx, _log_rx) = watch::channel(initial_cfg.general.log_level.clone());
+    let mut reload_state = ReloadState::new(Some(initial_hash));
+
+    write_web_reload_config(&path, "[\"websocket\", \"https\"]", false);
+    reload_config(&path, &config_tx, &log_tx, None, None, &mut reload_state).unwrap();
+
+    let applied = config_tx.borrow().clone();
+    assert!(applied.web.carrier_negotiation_enabled());
+    assert!(!applied.web.carrier_learning);
+
+    let _ = std::fs::remove_file(path);
+}
+
 #[test]
 fn classify_sni_change_requires_restart() {
    // censorship.* is not in overlay_hot_fields -> restart.
@@ -52,15 +52,24 @@ impl ReloadState {
 }

 fn normalize_watch_path(path: &Path) -> PathBuf {
-    path.canonicalize().unwrap_or_else(|_| {
-        if path.is_absolute() {
-            path.to_path_buf()
-        } else {
-            std::env::current_dir()
-                .map(|cwd| cwd.join(path))
-                .unwrap_or_else(|_| path.to_path_buf())
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()
+            .map(|cwd| cwd.join(path))
+            .unwrap_or_else(|_| path.to_path_buf())
+    };
+    let mut normalized = PathBuf::new();
+    for component in absolute.components() {
+        match component {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                normalized.pop();
+            }
+            component => normalized.push(component.as_os_str()),
        }
-    })
+    }
+    normalized
 }

 fn sync_watch_paths<W: Watcher>(
@@ -124,13 +133,14 @@ fn apply_watch_manifest<W1: Watcher, W2: Watcher>(
 }

 /// Load config, validate, diff against current, and broadcast if changed.
-pub(super) fn reload_config(
+fn reload_config_with_resolver(
    config_path: &PathBuf,
    config_tx: &watch::Sender<Arc<ProxyConfig>>,
    log_tx: &watch::Sender<LogLevel>,
    detected_ip_v4: Option<IpAddr>,
    detected_ip_v6: Option<IpAddr>,
    reload_state: &mut ReloadState,
+    dns_resolver: Option<&crate::network::dns_overrides::GenerationDnsResolver>,
 ) -> Option<WatchManifest> {
    let loaded = match ProxyConfig::load_with_metadata(config_path) {
        Ok(loaded) => loaded,
@@ -160,11 +170,21 @@ pub(super) fn reload_config(
    }

    let old_cfg = config_tx.borrow().clone();
-    let applied_cfg = overlay_hot_fields(&old_cfg, &new_cfg);
+    let mut applied_cfg = overlay_hot_fields(&old_cfg, &new_cfg);
+    if let Err(error) = applied_cfg
+        .validate_effective_web()
+        .and_then(|_| applied_cfg.rebuild_runtime_web())
+    {
+        error!(
+            "config reload: effective WEB validation failed: {}; keeping old config",
+            error
+        );
+        return Some(next_manifest);
+    }
    let old_hot = HotFields::from_config(&old_cfg);
    let applied_hot = HotFields::from_config(&applied_cfg);
    let non_hot_changed = !config_equal(&applied_cfg, &new_cfg);
-    let hot_changed = old_hot != applied_hot;
+    let hot_changed = !config_equal(&old_cfg, &applied_cfg);

    if non_hot_changed {
        warn_non_hot_changes(&old_cfg, &new_cfg, non_hot_changed);
@@ -176,7 +196,8 @@ pub(super) fn reload_config(
    }

    if old_hot.dns_overrides != applied_hot.dns_overrides
-        && let Err(e) = crate::network::dns_overrides::install_entries(&applied_hot.dns_overrides)
+        && let Some(dns_resolver) = dns_resolver
+        && let Err(e) = dns_resolver.apply_entries(&applied_hot.dns_overrides)
    {
        error!(
            "config reload: invalid network.dns_overrides: {}; keeping old config",
@@ -198,6 +219,26 @@ pub(super) fn reload_config(
    Some(next_manifest)
 }

+#[cfg(test)]
+pub(super) fn reload_config(
+    config_path: &PathBuf,
+    config_tx: &watch::Sender<Arc<ProxyConfig>>,
+    log_tx: &watch::Sender<LogLevel>,
+    detected_ip_v4: Option<IpAddr>,
+    detected_ip_v6: Option<IpAddr>,
+    reload_state: &mut ReloadState,
+) -> Option<WatchManifest> {
+    reload_config_with_resolver(
+        config_path,
+        config_tx,
+        log_tx,
+        detected_ip_v4,
+        detected_ip_v6,
+        reload_state,
+        None,
+    )
+}
+
 /// Spawn the hot-reload watcher task.
 ///
 /// Uses `notify` (inotify on Linux) to detect file changes instantly.
@@ -213,20 +254,48 @@ pub fn spawn_config_watcher(
    detected_ip_v4: Option<IpAddr>,
    detected_ip_v6: Option<IpAddr>,
    cancellation: tokio_util::sync::CancellationToken,
-) -> (watch::Receiver<Arc<ProxyConfig>>, watch::Receiver<LogLevel>) {
+    dns_resolver: Option<Arc<crate::network::dns_overrides::GenerationDnsResolver>>,
+    mut activation: Option<watch::Receiver<bool>>,
+) -> (
+    watch::Receiver<Arc<ProxyConfig>>,
+    watch::Receiver<LogLevel>,
+    impl std::future::Future<Output = ()> + Send + 'static,
+) {
    let initial_level = initial.general.log_level.clone();
    let (config_tx, config_rx) = watch::channel(initial);
    let (log_tx, log_rx) = watch::channel(initial_level);

    let config_path = normalize_watch_path(&config_path);
-    let initial_loaded = ProxyConfig::load_with_metadata(&config_path).ok();
-    let initial_manifest = initial_loaded
-        .as_ref()
-        .map(|loaded| WatchManifest::from_source_files(&loaded.source_files))
-        .unwrap_or_else(|| WatchManifest::from_source_files(std::slice::from_ref(&config_path)));
-    let initial_snapshot_hash = initial_loaded.as_ref().map(|loaded| loaded.rendered_hash);
-
-    tokio::spawn(async move {
+    let task = async move {
+        if let Some(activation) = activation.as_mut() {
+            loop {
+                if *activation.borrow_and_update() {
+                    break;
+                }
+                tokio::select! {
+                    result = activation.changed() => {
+                        if result.is_err() {
+                            return;
+                        }
+                    }
+                    _ = cancellation.cancelled() => return,
+                }
+            }
+        }
+        let initial_loaded = ProxyConfig::load_with_metadata(&config_path).ok();
+        let initial_manifest = initial_loaded
+            .as_ref()
+            .map(|loaded| WatchManifest::from_source_files(&loaded.source_files))
+            .unwrap_or_else(|| {
+                WatchManifest::from_source_files(std::slice::from_ref(&config_path))
+            });
+        let initial_matches_disk = initial_loaded
+            .as_ref()
+            .is_some_and(|loaded| config_equal(config_tx.borrow().as_ref(), &loaded.config));
+        let initial_snapshot_hash = initial_loaded
+            .as_ref()
+            .filter(|_| initial_matches_disk)
+            .map(|loaded| loaded.rendered_hash);
        let (notify_tx, mut notify_rx) = mpsc::channel::<()>(4);
        let manifest_state = Arc::new(StdRwLock::new(WatchManifest::default()));
        let mut reload_state = ReloadState::new(initial_snapshot_hash);
@@ -304,6 +373,9 @@ pub fn spawn_config_watcher(
        if poll_watcher.is_some() {
            info!("config watcher: poll watcher active (Docker/NFS safe)");
        }
+        if initial_loaded.is_some() && !initial_matches_disk {
+            let _ = notify_tx.try_send(());
+        }

        #[cfg(unix)]
        let mut sighup = {
@@ -334,24 +406,26 @@ pub fn spawn_config_watcher(
            tokio::time::sleep(HOT_RELOAD_DEBOUNCE).await;
            while notify_rx.try_recv().is_ok() {}

-            let mut next_manifest = reload_config(
+            let mut next_manifest = reload_config_with_resolver(
                &config_path,
                &config_tx,
                &log_tx,
                detected_ip_v4,
                detected_ip_v6,
                &mut reload_state,
+                dns_resolver.as_deref(),
            );
            if next_manifest.is_none() {
                tokio::time::sleep(HOT_RELOAD_DEBOUNCE).await;
                while notify_rx.try_recv().is_ok() {}
-                next_manifest = reload_config(
+                next_manifest = reload_config_with_resolver(
                    &config_path,
                    &config_tx,
                    &log_tx,
                    detected_ip_v4,
                    detected_ip_v6,
                    &mut reload_state,
+                    dns_resolver.as_deref(),
                );
            }

@@ -364,7 +438,25 @@ pub fn spawn_config_watcher(
                );
            }
        }
-    });
+    };

-    (config_rx, log_rx)
+    (config_rx, log_rx, task)
+}
+
+#[cfg(all(test, unix))]
+mod path_tests {
+    use std::os::unix::fs::symlink;
+
+    use super::normalize_watch_path;
+
+    #[test]
+    fn watch_path_normalization_preserves_symlinks() {
+        let dir = tempfile::tempdir().unwrap();
+        let real = dir.path().join("real.toml");
+        let linked = dir.path().join("linked.toml");
+        std::fs::write(&real, "").unwrap();
+        symlink(&real, &linked).unwrap();
+
+        assert_eq!(normalize_watch_path(&linked), linked);
+    }
 }
@@ -9,6 +9,7 @@ use rand::RngExt;
 use serde::{Deserialize, Serialize};
 use tracing::warn;

+use crate::crypto::sha256;
 use crate::error::{ProxyError, Result};

 use super::defaults::*;
@@ -35,7 +36,9 @@ mod validate_server;
 mod validate_web;
 mod validation;

-use self::includes::{hash_rendered_snapshot, normalize_config_path, preprocess_includes};
+use self::includes::{
+    hash_rendered_snapshot, normalize_config_path, preprocess_includes, read_config_source,
+};
 use self::normalize::{
    is_valid_ad_tag, is_valid_tls_domain_name, normalize_domain_to_ascii,
    normalize_exclusive_mask_target, normalize_mask_host_to_ascii, parse_exclusive_mask_target,
@@ -63,9 +66,9 @@ const MAX_API_REQUEST_BODY_LIMIT_BYTES: usize = 1024 * 1024;
 pub(crate) struct LoadedConfig {
    /// Validated and normalized effective configuration.
    pub(crate) config: ProxyConfig,
-    /// Canonical paths participating in the recursive include graph.
+    /// Normalized absolute paths participating in the recursive include graph.
    pub(crate) source_files: Vec<PathBuf>,
-    /// Raw source bytes keyed by canonical source path.
+    /// Raw source bytes keyed by normalized absolute source path.
    pub(crate) source_contents: BTreeMap<PathBuf, String>,
    /// Legacy hash of the include-expanded rendered snapshot.
    pub(crate) rendered_hash: u64,
@@ -74,7 +77,7 @@ pub(crate) struct LoadedConfig {
 /// Raw recursive source graph captured before typed deserialization.
 #[derive(Debug, Clone)]
 pub(crate) struct ConfigSourceGraph {
-    /// Raw source bytes keyed by canonical source path.
+    /// Raw source bytes keyed by normalized absolute source path.
    pub(crate) source_contents: BTreeMap<PathBuf, String>,
    /// Include-expanded TOML used for typed deserialization.
    pub(crate) rendered: String,
@@ -174,21 +177,42 @@ impl ProxyConfig {
        source_overrides: &BTreeMap<PathBuf, String>,
    ) -> Result<ConfigSourceGraph> {
        let path = path.as_ref();
-        let normalized_path = normalize_config_path(path);
+        let mut previous = Self::capture_source_graph(path, source_overrides)?;
+        for _ in 0..2 {
+            let current = Self::capture_source_graph(path, source_overrides)?;
+            if current.source_contents == previous.source_contents
+                && current.rendered == previous.rendered
+            {
+                return Ok(current);
+            }
+            previous = current;
+        }
+        Err(ProxyError::Config(
+            "config source graph changed repeatedly while it was read".to_string(),
+        ))
+    }
+
+    fn capture_source_graph(
+        path: &Path,
+        source_overrides: &BTreeMap<PathBuf, String>,
+    ) -> Result<ConfigSourceGraph> {
+        let path = path.as_ref();
+        let (normalized_path, disk_content) = read_config_source(path)?;
        let content = source_overrides
            .get(&normalized_path)
            .cloned()
-            .map(Ok)
-            .unwrap_or_else(|| std::fs::read_to_string(path))
-            .map_err(|e| ProxyError::Config(e.to_string()))?;
-        let base_dir = path.parent().unwrap_or(Path::new("."));
+            .unwrap_or(disk_content);
+        let base_dir = normalized_path
+            .parent()
+            .unwrap_or(Path::new("."))
+            .to_path_buf();
        let mut source_files = BTreeSet::new();
        source_files.insert(normalized_path.clone());
        let mut source_contents = BTreeMap::new();
        source_contents.insert(normalized_path, content.clone());
        let processed = preprocess_includes(
            &content,
-            base_dir,
+            &base_dir,
            0,
            &mut source_files,
            &mut source_contents,
@@ -216,10 +240,39 @@ impl ProxyConfig {
        runtime_web::rebuild(self)
    }

+    /// Validates the mixed effective WEB snapshot after restart fields are retained.
+    pub(crate) fn validate_effective_web(&mut self) -> Result<()> {
+        validate_web::validate(self)
+    }
+
+    /// Revalidates decoy separation after restart-only listener fields are resolved.
+    pub(crate) fn validate_web_decoy_listener_separation(&self) -> Result<()> {
+        validate_web::validate_decoy_listener_separation(self)
+    }
+
    pub(crate) fn runtime_user_auth(&self) -> Option<&UserAuthSnapshot> {
        self.runtime_user_auth.as_deref()
    }

+    /// Returns the credential identity frozen into this runtime snapshot.
+    pub(crate) fn runtime_user_credential_id(&self, user: &str) -> Option<[u8; 16]> {
+        self.runtime_user_auth()
+            .and_then(|snapshot| snapshot.credential_id_by_name(user))
+            .or_else(|| {
+                self.access
+                    .users
+                    .get(user)
+                    .and_then(|secret| hex::decode(secret).ok())
+                    .and_then(|secret| <[u8; 16]>::try_from(secret).ok())
+                    .map(|secret| {
+                        let digest = sha256(&secret);
+                        let mut credential_id = [0; 16];
+                        credential_id.copy_from_slice(&digest[..16]);
+                        credential_id
+                    })
+            })
+    }
+
    /// Validates cross-field configuration invariants after deserialization.
    pub fn validate(&self) -> Result<()> {
        if self.access.users.is_empty() {
@@ -4,16 +4,27 @@ use std::path::{Path, PathBuf};

 use crate::error::{ProxyError, Result};

+const MAX_CONFIG_SOURCE_BYTES: usize = 8 * 1024 * 1024;
+
 pub(super) fn normalize_config_path(path: &Path) -> PathBuf {
-    path.canonicalize().unwrap_or_else(|_| {
-        if path.is_absolute() {
-            path.to_path_buf()
-        } else {
-            std::env::current_dir()
-                .map(|cwd| cwd.join(path))
-                .unwrap_or_else(|_| path.to_path_buf())
+    let absolute = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()
+            .map(|cwd| cwd.join(path))
+            .unwrap_or_else(|_| path.to_path_buf())
+    };
+    let mut normalized = PathBuf::new();
+    for component in absolute.components() {
+        match component {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                normalized.pop();
+            }
+            component => normalized.push(component.as_os_str()),
        }
-    })
+    }
+    normalized
 }

 pub(super) fn hash_rendered_snapshot(rendered: &str) -> u64 {
@@ -22,6 +33,29 @@ pub(super) fn hash_rendered_snapshot(rendered: &str) -> u64 {
    hasher.finish()
 }

+pub(super) fn read_config_source(path: &Path) -> Result<(PathBuf, String)> {
+    #[cfg(unix)]
+    let bytes = crate::util::secure_fs::read_regular_limited(path, MAX_CONFIG_SOURCE_BYTES)
+        .map_err(|error| ProxyError::Config(error.to_string()))?;
+    #[cfg(not(unix))]
+    let bytes = std::fs::read(path).map_err(|error| ProxyError::Config(error.to_string()))?;
+    if bytes.len() > MAX_CONFIG_SOURCE_BYTES {
+        return Err(ProxyError::Config(format!(
+            "config source `{}` exceeds {} bytes",
+            path.display(),
+            MAX_CONFIG_SOURCE_BYTES
+        )));
+    }
+    let contents = String::from_utf8(bytes).map_err(|error| {
+        ProxyError::Config(format!(
+            "config source `{}` is not valid UTF-8: {error}",
+            path.display()
+        ))
+    })?;
+    let normalized = normalize_config_path(path);
+    Ok((normalized, contents))
+}
+
 pub(super) fn preprocess_includes(
    content: &str,
    base_dir: &Path,
@@ -41,16 +75,17 @@ pub(super) fn preprocess_includes(
            if let Some(rest) = rest.strip_prefix('=') {
                let path_str = rest.trim().trim_matches('"');
                let resolved = base_dir.join(path_str);
-                let normalized = normalize_config_path(&resolved);
-                source_files.insert(normalized.clone());
+                let (normalized, disk_contents) = read_config_source(&resolved)?;
                let included = source_overrides
                    .get(&normalized)
                    .cloned()
-                    .map(Ok)
-                    .unwrap_or_else(|| std::fs::read_to_string(&resolved))
-                    .map_err(|e| ProxyError::Config(e.to_string()))?;
-                source_contents.insert(normalized, included.clone());
-                let included_dir = resolved.parent().unwrap_or(base_dir);
+                    .or_else(|| source_contents.get(&normalized).cloned())
+                    .unwrap_or(disk_contents);
+                source_files.insert(normalized.clone());
+                source_contents
+                    .entry(normalized.clone())
+                    .or_insert_with(|| included.clone());
+                let included_dir = normalized.parent().unwrap_or(base_dir);
                output.push_str(&preprocess_includes(
                    &included,
                    included_dir,
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::collections::hash_map::DefaultHasher;
 use std::hash::Hasher;

+use crate::crypto::sha256;
 use crate::error::{ProxyError, Result};

 const ACCESS_SECRET_BYTES: usize = 16;
@@ -11,6 +12,7 @@ const ACCESS_SECRET_BYTES: usize = 16;
 pub(crate) struct UserAuthSnapshot {
    entries: Vec<UserAuthEntry>,
    by_name: HashMap<String, u32>,
+    by_hint_key: HashMap<u64, Vec<u32>>,
    sni_index: HashMap<u64, Vec<u32>>,
    sni_initial_index: HashMap<u8, Vec<u32>>,
 }
@@ -19,16 +21,23 @@ pub(crate) struct UserAuthSnapshot {
 pub(crate) struct UserAuthEntry {
    pub(crate) user: String,
    pub(crate) secret: [u8; ACCESS_SECRET_BYTES],
+    /// Stable secret identity used by process-wide admission fencing.
+    pub(crate) credential_id: [u8; 16],
+    /// Stable compact key used only to resolve bounded authentication hints.
+    pub(crate) hint_key: u64,
 }

 impl UserAuthSnapshot {
    pub(super) fn from_users(users: &HashMap<String, String>) -> Result<Self> {
        let mut entries = Vec::with_capacity(users.len());
        let mut by_name = HashMap::with_capacity(users.len());
+        let mut by_hint_key = HashMap::with_capacity(users.len());
        let mut sni_index = HashMap::with_capacity(users.len());
        let mut sni_initial_index = HashMap::with_capacity(users.len());

-        for (user, secret_hex) in users {
+        let mut ordered_users = users.iter().collect::<Vec<_>>();
+        ordered_users.sort_unstable_by(|(left, _), (right, _)| left.cmp(right));
+        for (user, secret_hex) in ordered_users {
            let decoded = hex::decode(secret_hex).map_err(|_| ProxyError::InvalidSecret {
                user: user.clone(),
                reason: "Must be 32 hex characters".to_string(),
@@ -46,11 +55,30 @@ impl UserAuthSnapshot {

            let mut secret = [0u8; ACCESS_SECRET_BYTES];
            secret.copy_from_slice(&decoded);
+            let digest = sha256(&secret);
+            let mut credential_id = [0; 16];
+            credential_id.copy_from_slice(&digest[..16]);
+            let hint_key = u64::from_le_bytes([
+                credential_id[0],
+                credential_id[1],
+                credential_id[2],
+                credential_id[3],
+                credential_id[4],
+                credential_id[5],
+                credential_id[6],
+                credential_id[7],
+            ]) | 1;
            entries.push(UserAuthEntry {
                user: user.clone(),
                secret,
+                credential_id,
+                hint_key,
            });
            by_name.insert(user.clone(), user_id);
+            by_hint_key
+                .entry(hint_key)
+                .or_insert_with(Vec::new)
+                .push(user_id);
            sni_index
                .entry(Self::sni_lookup_hash(user))
                .or_insert_with(Vec::new)
@@ -70,6 +98,7 @@ impl UserAuthSnapshot {
        Ok(Self {
            entries,
            by_name,
+            by_hint_key,
            sni_index,
            sni_initial_index,
        })
@@ -88,6 +117,18 @@ impl UserAuthSnapshot {
        self.entries.get(idx)
    }

+    /// Returns the stable credential identity for an exact configured username.
+    pub(crate) fn credential_id_by_name(&self, user: &str) -> Option<[u8; 16]> {
+        self.user_id_by_name(user)
+            .and_then(|user_id| self.entry_by_id(user_id))
+            .map(|entry| entry.credential_id)
+    }
+
+    /// Returns every bounded authentication candidate sharing a stable hint key.
+    pub(crate) fn candidate_ids_by_hint_key(&self, hint_key: u64) -> Option<&[u32]> {
+        self.by_hint_key.get(&hint_key).map(Vec::as_slice)
+    }
+
    pub(crate) fn sni_candidates(&self, sni: &str) -> Option<&[u32]> {
        self.sni_index
            .get(&Self::sni_lookup_hash(sni))
@@ -110,3 +151,48 @@ impl UserAuthSnapshot {
        hasher.finish()
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn credential_hint_survives_positional_id_shift() {
+        let mut initial = HashMap::new();
+        initial.insert(
+            "alice".to_string(),
+            "11111111111111111111111111111111".to_string(),
+        );
+        initial.insert(
+            "bob".to_string(),
+            "22222222222222222222222222222222".to_string(),
+        );
+        let initial = UserAuthSnapshot::from_users(&initial).unwrap();
+        let initial_id = initial.user_id_by_name("alice").unwrap();
+        let hint_key = initial.entry_by_id(initial_id).unwrap().hint_key;
+
+        let mut reloaded = HashMap::new();
+        reloaded.insert(
+            "aaron".to_string(),
+            "33333333333333333333333333333333".to_string(),
+        );
+        reloaded.insert(
+            "alice".to_string(),
+            "11111111111111111111111111111111".to_string(),
+        );
+        reloaded.insert(
+            "bob".to_string(),
+            "22222222222222222222222222222222".to_string(),
+        );
+        let reloaded = UserAuthSnapshot::from_users(&reloaded).unwrap();
+        let reloaded_id = reloaded.user_id_by_name("alice").unwrap();
+
+        assert_ne!(initial_id, reloaded_id);
+        assert!(
+            reloaded
+                .candidate_ids_by_hint_key(hint_key)
+                .unwrap()
+                .contains(&reloaded_id)
+        );
+    }
+}
@@ -5,15 +5,33 @@ use std::path::Path;
 use std::sync::Arc;

 #[cfg(unix)]
-use std::os::unix::fs::OpenOptionsExt;
+use std::ffi::OsString;
+#[cfg(unix)]
+use std::os::unix::ffi::OsStringExt;
+#[cfg(unix)]
+use std::os::unix::fs::MetadataExt;
+
+#[cfg(unix)]
+use nix::dir::Dir;
+#[cfg(unix)]
+use nix::fcntl::{OFlag, openat};
+#[cfg(unix)]
+use nix::sys::stat::Mode;

 use bytes::Bytes;
 use hmac::{Hmac, Mac};
 use sha2::{Digest, Sha256};

 use super::*;
+#[cfg(unix)]
+use crate::util::secure_fs::open_dir_nofollow;

-const WEB_CAPABILITY_CONTEXT: &[u8] = b"tdesktop-web-proxy-bridge-v1\n";
+// Path-based static snapshot fallback for platforms without directory descriptors.
+#[cfg(not(unix))]
+mod static_site_fallback;
+
+const WEB_CAPABILITY_CONTEXT_V1: &[u8] = b"tdesktop-web-proxy-bridge-v1\n";
+const WEB_CAPABILITY_CONTEXT_V2: &[u8] = b"tdesktop-web-proxy-bridge-v2\n";
 const WEB_DEBUG_FINGERPRINT_CONTEXT: &[u8] = b"telemt-web-debug-key-fingerprint-v1\0";
 const MAX_WEB_STATIC_DEPTH: usize = 64;

@@ -24,9 +42,11 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
    })?;
    let mut runtime_vhosts = BTreeMap::new();
    let mut runtime_profiles = Vec::new();
+    let mut runtime_capabilities = Vec::new();
    let mut static_files = 0usize;
    let mut static_bytes = 0usize;

+    let carrier_candidates: Arc<[WebCarrier]> = config.web.carrier_candidates().into();
    for vhost in &config.web.vhosts {
        let decoy = build_decoy(
            vhost,
@@ -35,6 +55,7 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
            &mut static_bytes,
        )?;
        let mut profiles = Vec::with_capacity(vhost.profiles.len());
+        let mut capability_table = Vec::with_capacity(vhost.profiles.len());
        let mut capabilities = HashSet::with_capacity(vhost.profiles.len());
        for profile in &vhost.profiles {
            let user_id = auth.user_id_by_name(&profile.user).ok_or_else(|| {
@@ -48,8 +69,11 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
            })?;
            let (client_secret, client_secret_len) =
                client_secret(auth_entry.secret, profile.secret_mode);
-            let capability =
-                derive_web_capability(&client_secret[..client_secret_len], vhost.host.as_bytes())?;
+            let capability = derive_web_capability(
+                &client_secret[..client_secret_len],
+                vhost.host.as_bytes(),
+                vhost.base_path.as_bytes(),
+            )?;
            let key_fingerprint = debug_key_fingerprint(&client_secret[..client_secret_len]);
            if !capabilities.insert(capability) {
                return Err(ProxyError::Config(format!(
@@ -61,8 +85,17 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
                host: vhost.host.clone(),
                public_addr: vhost.public_addr,
                user: profile.user.clone(),
+                credential_id: auth_entry.credential_id,
                secret_mode: profile.secret_mode,
                carrier: config.web.carrier,
+                carrier_negotiation_enabled: config.web.carrier_negotiation_enabled(),
+                carrier_learning: config.web.carrier_negotiation_enabled()
+                    && config.web.carrier_learning,
+                carriers: Arc::clone(&carrier_candidates),
+                carrier_negotiation_deadlines_secs: config
+                    .web
+                    .timeouts
+                    .carrier_negotiation_deadlines_secs,
                capability,
                key_fingerprint,
                max_sessions: profile
@@ -75,6 +108,8 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
                    .max_streams_per_session
                    .unwrap_or(config.web.limits.max_streams_per_session),
            });
+            capability_table.push(capability);
+            runtime_capabilities.push(capability);
            profiles.push(Arc::clone(&runtime_profile));
            runtime_profiles.push(runtime_profile);
        }
@@ -82,9 +117,16 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
            vhost.host.clone(),
            Arc::new(WebRuntimeVhost {
                host: vhost.host.clone(),
+                base: if vhost.base_path.is_empty() {
+                    "/".to_string()
+                } else {
+                    format!("/{}/", vhost.base_path)
+                },
+                decoy_fasttrack_mode: config.web.decoy_fasttrack_mode,
                decoy,
                decoy_header_secs: config.web.timeouts.decoy_header_secs,
                profiles,
+                capabilities: capability_table.into_boxed_slice(),
            }),
        );
    }
@@ -92,6 +134,7 @@ pub(super) fn rebuild(config: &mut ProxyConfig) -> Result<()> {
    config.web.runtime = Some(Arc::new(WebRuntimeConfig {
        vhosts: runtime_vhosts,
        profiles: runtime_profiles,
+        capabilities: runtime_capabilities.into_boxed_slice(),
    }));
    Ok(())
 }
@@ -103,12 +146,23 @@ fn debug_key_fingerprint(secret: &[u8]) -> String {
    hex::encode(&digest.finalize()[..8])
 }

-/// Derives the Telegram Desktop WEB capability for one exact secret and host.
-pub(crate) fn derive_web_capability(secret: &[u8], host: &[u8]) -> Result<[u8; 32]> {
+/// Derives the Telegram Desktop WEB capability for one exact secret, host, and base path.
+pub(crate) fn derive_web_capability(
+    secret: &[u8],
+    host: &[u8],
+    base_path: &[u8],
+) -> Result<[u8; 32]> {
    let mut mac = Hmac::<Sha256>::new_from_slice(secret)
        .map_err(|_| ProxyError::Config("WEB capability secret must not be empty".to_string()))?;
-    mac.update(WEB_CAPABILITY_CONTEXT);
-    mac.update(host);
+    if base_path.is_empty() {
+        mac.update(WEB_CAPABILITY_CONTEXT_V1);
+        mac.update(host);
+    } else {
+        mac.update(WEB_CAPABILITY_CONTEXT_V2);
+        mac.update(host);
+        mac.update(b"\n");
+        mac.update(base_path);
+    }
    Ok(mac.finalize().into_bytes().into())
 }

@@ -179,34 +233,31 @@ fn load_static_site(
    total_files: &mut usize,
    total_bytes: &mut usize,
 ) -> Result<WebStaticSite> {
-    let root_metadata = fs::symlink_metadata(root).map_err(|error| {
-        ProxyError::Config(format!(
-            "failed to inspect WEB static directory `{}`: {error}",
-            root.display()
-        ))
-    })?;
-    if root_metadata.file_type().is_symlink() || !root_metadata.is_dir() {
-        return Err(ProxyError::Config(format!(
-            "WEB static directory `{}` must be a real directory, not a symlink",
-            root.display()
-        )));
-    }
-    let canonical_root = fs::canonicalize(root).map_err(|error| {
-        ProxyError::Config(format!(
-            "failed to canonicalize WEB static directory `{}`: {error}",
-            root.display()
-        ))
-    })?;
    let mut assets = BTreeMap::new();
-    load_static_directory(
-        &canonical_root,
-        &canonical_root,
-        &mut assets,
-        total_files,
-        total_bytes,
-        limits,
-        0,
-    )?;
+    #[cfg(unix)]
+    {
+        let directory = open_static_root(root)?;
+        load_static_directory(
+            directory,
+            Path::new(""),
+            root,
+            &mut assets,
+            total_files,
+            total_bytes,
+            limits,
+            0,
+        )?;
+    }
+    #[cfg(not(unix))]
+    {
+        static_site_fallback::load_static_site_by_path(
+            root,
+            limits,
+            &mut assets,
+            total_files,
+            total_bytes,
+        )?;
+    }
    if !assets.contains_key(&format!("/{index}")) {
        return Err(ProxyError::Config(format!(
            "WEB static directory `{}` does not contain index `{index}`",
@@ -219,54 +270,95 @@ fn load_static_site(
    })
 }

+#[cfg(unix)]
+fn open_static_root(root: &Path) -> Result<Dir> {
+    let descriptor = open_dir_nofollow(root).map_err(|error| {
+        ProxyError::Config(format!(
+            "WEB static directory `{}` must be a real directory, not a symlink: {error}",
+            root.display()
+        ))
+    })?;
+    Dir::from_fd(descriptor).map_err(|error| {
+        ProxyError::Config(format!(
+            "failed to read WEB static directory `{}`: {error}",
+            root.display()
+        ))
+    })
+}
+
+#[cfg(unix)]
 fn load_static_directory(
+    mut directory: Dir,
+    relative: &Path,
    root: &Path,
-    directory: &Path,
    assets: &mut BTreeMap<String, WebStaticAsset>,
    total_files: &mut usize,
    total_bytes: &mut usize,
    limits: &WebLimitsConfig,
    depth: usize,
 ) -> Result<()> {
-    let entries = fs::read_dir(directory).map_err(|error| {
-        ProxyError::Config(format!(
-            "failed to read WEB static directory `{}`: {error}",
-            directory.display()
-        ))
-    })?;
-    for entry in entries {
+    let mut entries = Vec::new();
+    for entry in directory.iter() {
        let entry = entry.map_err(|error| {
-            ProxyError::Config(format!("failed to read WEB static entry: {error}"))
+            ProxyError::Config(format!(
+                "failed to read WEB static directory `{}`: {error}",
+                root.join(relative).display()
+            ))
        })?;
+        let name = entry.file_name().to_bytes();
+        if name == b"." || name == b".." {
+            continue;
+        }
        if *total_files >= limits.max_static_files {
            return Err(ProxyError::Config(
                "WEB static entries exceed process-wide web.limits.max_static_files".to_string(),
            ));
        }
        *total_files += 1;
-        let path = entry.path();
-        let file_type = entry.file_type().map_err(|error| {
+        entries.push(OsString::from_vec(name.to_vec()));
+    }
+    entries.sort_unstable();
+
+    for name in entries {
+        let relative_path = relative.join(&name);
+        let display_path = root.join(&relative_path);
+        let descriptor = openat(
+            &directory,
+            name.as_os_str(),
+            OFlag::O_RDONLY | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC,
+            Mode::empty(),
+        )
+        .map_err(|error| {
            ProxyError::Config(format!(
-                "failed to inspect WEB static entry `{}`: {error}",
-                path.display()
+                "failed to open WEB static entry `{}` without following symlinks: {error}",
+                display_path.display()
            ))
        })?;
-        if file_type.is_symlink() {
-            return Err(ProxyError::Config(format!(
-                "WEB static entry `{}` must not be a symlink",
-                path.display()
-            )));
-        }
-        if file_type.is_dir() {
+        let file = fs::File::from(descriptor);
+        let metadata = file.metadata().map_err(|error| {
+            ProxyError::Config(format!(
+                "failed to inspect WEB static entry `{}`: {error}",
+                display_path.display()
+            ))
+        })?;
+        if metadata.is_dir() {
            if depth >= MAX_WEB_STATIC_DEPTH {
                return Err(ProxyError::Config(format!(
                    "WEB static directory `{}` exceeds the maximum nesting depth",
-                    path.display()
+                    display_path.display()
                )));
            }
+            let descriptor = file.into();
+            let child = Dir::from_fd(descriptor).map_err(|error| {
+                ProxyError::Config(format!(
+                    "failed to open WEB static directory `{}`: {error}",
+                    display_path.display()
+                ))
+            })?;
            load_static_directory(
+                child,
+                &relative_path,
                root,
-                &path,
                assets,
                total_files,
                total_bytes,
@@ -275,83 +367,107 @@ fn load_static_directory(
            )?;
            continue;
        }
-        if !file_type.is_file() {
-            return Err(ProxyError::Config(format!(
-                "WEB static entry `{}` must be a regular file",
-                path.display()
-            )));
-        }
-        let mut options = fs::OpenOptions::new();
-        options.read(true);
-        #[cfg(unix)]
-        options.custom_flags(libc::O_CLOEXEC | libc::O_NOFOLLOW);
-        let file = options.open(&path).map_err(|error| {
-            ProxyError::Config(format!(
-                "failed to open WEB static file `{}`: {error}",
-                path.display()
-            ))
-        })?;
-        let metadata = file.metadata().map_err(|error| {
-            ProxyError::Config(format!(
-                "failed to inspect WEB static file `{}`: {error}",
-                path.display()
-            ))
-        })?;
        if !metadata.is_file() {
            return Err(ProxyError::Config(format!(
-                "WEB static entry `{}` changed before it was opened",
-                path.display()
+                "WEB static entry `{}` must be a regular file",
+                display_path.display()
            )));
        }
-        let file_len = usize::try_from(metadata.len()).map_err(|_| {
-            ProxyError::Config(format!("WEB static file `{}` is too large", path.display()))
-        })?;
-        if file_len > limits.max_static_file_bytes {
-            return Err(ProxyError::Config(format!(
-                "WEB static file `{}` exceeds web.limits.max_static_file_bytes",
-                path.display()
-            )));
-        }
-        *total_bytes = total_bytes.checked_add(file_len).ok_or_else(|| {
-            ProxyError::Config("WEB static snapshot byte count overflowed usize".to_string())
-        })?;
-        if *total_bytes > limits.max_static_bytes {
-            return Err(ProxyError::Config(
-                "WEB static snapshots exceed process-wide web.limits.max_static_bytes".to_string(),
-            ));
-        }
-        let relative = path.strip_prefix(root).map_err(|_| {
-            ProxyError::Config("WEB static path escaped its configured root".to_string())
-        })?;
-        let route = static_route(relative)?;
-        let mut body = Vec::with_capacity(file_len);
-        file.take(limits.max_static_file_bytes as u64 + 1)
-            .read_to_end(&mut body)
-            .map_err(|error| {
-                ProxyError::Config(format!(
-                    "failed to read WEB static file `{}`: {error}",
-                    path.display()
-                ))
-            })?;
-        if body.len() != file_len {
-            return Err(ProxyError::Config(format!(
-                "WEB static file `{}` changed while its snapshot was built",
-                path.display()
-            )));
-        }
-        let etag = format!("\"{}\"", hex::encode(Sha256::digest(&body)));
-        assets.insert(
-            route,
-            WebStaticAsset {
-                body: Bytes::from(body),
-                content_type: static_content_type(&path),
-                etag,
-            },
-        );
+        load_static_file(
+            file,
+            &metadata,
+            &relative_path,
+            &display_path,
+            assets,
+            total_bytes,
+            limits,
+        )?;
    }
    Ok(())
 }

+fn load_static_file(
+    mut file: fs::File,
+    metadata: &fs::Metadata,
+    relative: &Path,
+    display_path: &Path,
+    assets: &mut BTreeMap<String, WebStaticAsset>,
+    total_bytes: &mut usize,
+    limits: &WebLimitsConfig,
+) -> Result<()> {
+    let file_len = usize::try_from(metadata.len()).map_err(|_| {
+        ProxyError::Config(format!(
+            "WEB static file `{}` is too large",
+            display_path.display()
+        ))
+    })?;
+    if file_len > limits.max_static_file_bytes {
+        return Err(ProxyError::Config(format!(
+            "WEB static file `{}` exceeds web.limits.max_static_file_bytes",
+            display_path.display()
+        )));
+    }
+    *total_bytes = total_bytes.checked_add(file_len).ok_or_else(|| {
+        ProxyError::Config("WEB static snapshot byte count overflowed usize".to_string())
+    })?;
+    if *total_bytes > limits.max_static_bytes {
+        return Err(ProxyError::Config(
+            "WEB static snapshots exceed process-wide web.limits.max_static_bytes".to_string(),
+        ));
+    }
+    let route = static_route(relative)?;
+    let mut body = Vec::with_capacity(file_len);
+    file.by_ref()
+        .take(limits.max_static_file_bytes as u64 + 1)
+        .read_to_end(&mut body)
+        .map_err(|error| {
+            ProxyError::Config(format!(
+                "failed to read WEB static file `{}`: {error}",
+                display_path.display()
+            ))
+        })?;
+    let final_metadata = file.metadata().map_err(|error| {
+        ProxyError::Config(format!(
+            "failed to recheck WEB static file `{}`: {error}",
+            display_path.display()
+        ))
+    })?;
+    if body.len() != file_len || !static_file_version_matches(metadata, &final_metadata) {
+        return Err(ProxyError::Config(format!(
+            "WEB static file `{}` changed while its snapshot was built",
+            display_path.display()
+        )));
+    }
+    let etag = format!("\"{}\"", hex::encode(Sha256::digest(&body)));
+    assets.insert(
+        route,
+        WebStaticAsset {
+            body: Bytes::from(body),
+            content_type: static_content_type(relative),
+            etag,
+        },
+    );
+    Ok(())
+}
+
+#[cfg(unix)]
+fn static_file_version_matches(before: &fs::Metadata, after: &fs::Metadata) -> bool {
+    before.dev() == after.dev()
+        && before.ino() == after.ino()
+        && before.len() == after.len()
+        && before.mtime() == after.mtime()
+        && before.mtime_nsec() == after.mtime_nsec()
+        && before.ctime() == after.ctime()
+        && before.ctime_nsec() == after.ctime_nsec()
+}
+
+#[cfg(not(unix))]
+fn static_file_version_matches(before: &fs::Metadata, after: &fs::Metadata) -> bool {
+    before.len() == after.len()
+        && before.modified().ok() == after.modified().ok()
+        && before.created().ok() == after.created().ok()
+}
+
 fn static_route(relative: &Path) -> Result<String> {
    let mut route = String::new();
    for component in relative.components() {
@@ -389,26 +505,7 @@ fn static_content_type(path: &Path) -> &'static str {
    }
 }

+// Runtime WEB construction tests remain separate from the production loader.
 #[cfg(test)]
-mod tests {
-    use base64::Engine as _;
-
-    use super::*;
-
-    #[test]
-    fn capability_matches_reference_vectors() {
-        let secret = hex::decode("000102030405060708090a0b0c0d0e0f").unwrap();
-        let plain = derive_web_capability(&secret, b"proxy.example.com").unwrap();
-        assert_eq!(
-            base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(plain),
-            "MHLEY5PmW1GWqJkSrlmJpvJUiLhBH_QKy6yKg8a0JPk"
-        );
-        let mut dd_secret = vec![0xdd];
-        dd_secret.extend_from_slice(&secret);
-        let dd = derive_web_capability(&dd_secret, b"proxy.example.com").unwrap();
-        assert_eq!(
-            base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(dd),
-            "IpJrt3e7sKtzPyoXy6w-Zj6GGEvsvclN66JzQEfPYLA"
-        );
-    }
-}
+#[path = "runtime_web/tests.rs"]
+mod tests;
@@ -0,0 +1,138 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::Path;
+
+use super::*;
+
+/// Builds a bounded static-site snapshot on platforms without directory descriptors.
+pub(super) fn load_static_site_by_path(
+    root: &Path,
+    limits: &WebLimitsConfig,
+    assets: &mut BTreeMap<String, WebStaticAsset>,
+    total_files: &mut usize,
+    total_bytes: &mut usize,
+) -> Result<()> {
+    let root_metadata = fs::symlink_metadata(root).map_err(|error| {
+        ProxyError::Config(format!(
+            "failed to inspect WEB static directory `{}`: {error}",
+            root.display()
+        ))
+    })?;
+    if root_metadata.file_type().is_symlink() || !root_metadata.is_dir() {
+        return Err(ProxyError::Config(format!(
+            "WEB static directory `{}` must be a real directory, not a symlink",
+            root.display()
+        )));
+    }
+    let canonical_root = fs::canonicalize(root).map_err(|error| {
+        ProxyError::Config(format!(
+            "failed to canonicalize WEB static directory `{}`: {error}",
+            root.display()
+        ))
+    })?;
+    load_static_directory(
+        &canonical_root,
+        &canonical_root,
+        assets,
+        total_files,
+        total_bytes,
+        limits,
+        0,
+    )
+}
+
+fn load_static_directory(
+    root: &Path,
+    directory: &Path,
+    assets: &mut BTreeMap<String, WebStaticAsset>,
+    total_files: &mut usize,
+    total_bytes: &mut usize,
+    limits: &WebLimitsConfig,
+    depth: usize,
+) -> Result<()> {
+    let entries = fs::read_dir(directory).map_err(|error| {
+        ProxyError::Config(format!(
+            "failed to read WEB static directory `{}`: {error}",
+            directory.display()
+        ))
+    })?;
+    for entry in entries {
+        let entry = entry.map_err(|error| {
+            ProxyError::Config(format!("failed to read WEB static entry: {error}"))
+        })?;
+        if *total_files >= limits.max_static_files {
+            return Err(ProxyError::Config(
+                "WEB static entries exceed process-wide web.limits.max_static_files".to_string(),
+            ));
+        }
+        *total_files += 1;
+        let path = entry.path();
+        let file_type = entry.file_type().map_err(|error| {
+            ProxyError::Config(format!(
+                "failed to inspect WEB static entry `{}`: {error}",
+                path.display()
+            ))
+        })?;
+        if file_type.is_symlink() {
+            return Err(ProxyError::Config(format!(
+                "WEB static entry `{}` must not be a symlink",
+                path.display()
+            )));
+        }
+        if file_type.is_dir() {
+            if depth >= MAX_WEB_STATIC_DEPTH {
+                return Err(ProxyError::Config(format!(
+                    "WEB static directory `{}` exceeds the maximum nesting depth",
+                    path.display()
+                )));
+            }
+            load_static_directory(
+                root,
+                &path,
+                assets,
+                total_files,
+                total_bytes,
+                limits,
+                depth + 1,
+            )?;
+            continue;
+        }
+        if !file_type.is_file() {
+            return Err(ProxyError::Config(format!(
+                "WEB static entry `{}` must be a regular file",
+                path.display()
+            )));
+        }
+        let file = fs::File::open(&path).map_err(|error| {
+            ProxyError::Config(format!(
+                "failed to open WEB static file `{}`: {error}",
+                path.display()
+            ))
+        })?;
+        let metadata = file.metadata().map_err(|error| {
+            ProxyError::Config(format!(
+                "failed to inspect WEB static file `{}`: {error}",
+                path.display()
+            ))
+        })?;
+        if !metadata.is_file() {
+            return Err(ProxyError::Config(format!(
+                "WEB static entry `{}` changed before it was opened",
+                path.display()
+            )));
+        }
+        let relative = path.strip_prefix(root).map_err(|_| {
+            ProxyError::Config("WEB static path escaped its configured root".to_string())
+        })?;
+        load_static_file(
+            file,
+            &metadata,
+            relative,
+            &path,
+            assets,
+            total_bytes,
+            limits,
+        )?;
+    }
+    Ok(())
+}
@@ -0,0 +1,92 @@
+use base64::Engine as _;
+
+use super::*;
+
+#[test]
+fn capability_matches_reference_vectors() {
+    let secret = hex::decode("000102030405060708090a0b0c0d0e0f").unwrap();
+    let mut dd_secret = vec![0xdd];
+    dd_secret.extend_from_slice(&secret);
+    for (client_secret, base_path, expected) in [
+        (
+            secret.as_slice(),
+            b"".as_slice(),
+            "MHLEY5PmW1GWqJkSrlmJpvJUiLhBH_QKy6yKg8a0JPk",
+        ),
+        (
+            dd_secret.as_slice(),
+            b"".as_slice(),
+            "IpJrt3e7sKtzPyoXy6w-Zj6GGEvsvclN66JzQEfPYLA",
+        ),
+        (
+            secret.as_slice(),
+            b"dobry-cola-super-app".as_slice(),
+            "hHz99Xs93EN1j91G9gpNepXwGNNt5YdAFkEVk_LlqdQ",
+        ),
+        (
+            dd_secret.as_slice(),
+            b"dobry-cola-super-app".as_slice(),
+            "TGUkZaevsavLbHvlNWipnRoYxgzZ51ioWvbxgGT3wHo",
+        ),
+    ] {
+        let capability =
+            derive_web_capability(client_secret, b"proxy.example.com", base_path).unwrap();
+        assert_eq!(
+            base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(capability),
+            expected
+        );
+    }
+}
+
+#[test]
+fn capability_binds_the_exact_host_and_base_path_identity() {
+    let secret = hex::decode("000102030405060708090a0b0c0d0e0f").unwrap();
+    let root = derive_web_capability(&secret, b"proxy.example.com", b"").unwrap();
+    let mixed = derive_web_capability(&secret, b"proxy.example.com", b"MixedCase/path").unwrap();
+    let lower = derive_web_capability(&secret, b"proxy.example.com", b"mixedcase/path").unwrap();
+    let other_path =
+        derive_web_capability(&secret, b"proxy.example.com", b"MixedCase/other").unwrap();
+    let other_host =
+        derive_web_capability(&secret, b"other.example.com", b"MixedCase/path").unwrap();
+
+    let identities = [root, mixed, lower, other_path, other_host]
+        .into_iter()
+        .collect::<std::collections::HashSet<_>>();
+    assert_eq!(identities.len(), 5);
+}
+
+#[cfg(unix)]
+#[test]
+fn static_snapshot_remains_anchored_after_root_path_replacement() {
+    use std::os::unix::fs::symlink;
+
+    let temp = tempfile::tempdir().unwrap();
+    let root = temp.path().join("site");
+    let detached = temp.path().join("detached");
+    let replacement = temp.path().join("replacement");
+    fs::create_dir(&root).unwrap();
+    fs::write(root.join("index.html"), b"original").unwrap();
+    fs::create_dir(&replacement).unwrap();
+    fs::write(replacement.join("index.html"), b"replacement").unwrap();
+
+    let directory = open_static_root(&root).unwrap();
+    fs::rename(&root, &detached).unwrap();
+    symlink(&replacement, &root).unwrap();
+
+    let mut assets = BTreeMap::new();
+    let mut total_files = 0;
+    let mut total_bytes = 0;
+    load_static_directory(
+        directory,
+        Path::new(""),
+        &root,
+        &mut assets,
+        &mut total_files,
+        &mut total_bytes,
+        &WebLimitsConfig::default(),
+        0,
+    )
+    .unwrap();
+
+    assert_eq!(assets["/index.html"].body.as_ref(), b"original");
+}
@@ -161,6 +161,7 @@ const GENERAL_CONFIG_KEYS: &[&str] = &[
    "proxy_secret_auto_reload_secs",
    "proxy_config_auto_reload_secs",
    "me_reinit_singleflight",
+    "me_reinit_max_concurrency",
    "me_reinit_trigger_channel",
    "me_reinit_coalesce_window_ms",
    "me_deterministic_writer_sort",
@@ -260,7 +261,17 @@ const LISTENER_CONFIG_KEYS: &[&str] = &[
 ];

 const WEB_CONFIG_KEYS: &[&str] = &[
-    "enabled", "carrier", "debug", "limits", "timeouts", "vhosts",
+    "enabled",
+    "carrier",
+    "carriers",
+    "carrier_learning",
+    "carrier_negotiation_aggressiveness",
+    "decoy_fasttrack_mode",
+    "http_connection_capacity_action",
+    "debug",
+    "limits",
+    "timeouts",
+    "vhosts",
 ];

 const WEB_LIMITS_CONFIG_KEYS: &[&str] = &[
@@ -270,11 +281,17 @@ const WEB_LIMITS_CONFIG_KEYS: &[&str] = &[
    "carrier_batch_bytes",
    "max_frames_per_body",
    "max_http_connections",
+    "max_http_overload_connections",
    "max_http_handlers",
+    "max_lane_open_waits_per_session",
+    "pending_bytes_per_lane",
+    "pending_items_per_lane",
    "websocket_bytes_global",
    "websocket_admission_watermark_pct",
    "websocket_eviction_watermark_pct",
    "websocket_http_connection_reserve",
+    "max_websocket_evictions_in_flight",
+    "max_carrier_learning_entries",
    "max_body_readers",
    "max_body_bytes_global",
    "max_sessions_global",
@@ -309,6 +326,7 @@ const WEB_LIMITS_CONFIG_KEYS: &[&str] = &[

 const WEB_DEBUG_CONFIG_KEYS: &[&str] = &[
    "enabled",
+    "sideband",
    "capture_lifecycle",
    "capture_headers",
    "capture_timings",
@@ -324,18 +342,30 @@ const WEB_TIMEOUTS_CONFIG_KEYS: &[&str] = &[
    "header_secs",
    "body_secs",
    "stream_handshake_secs",
+    "stream_first_byte_secs",
    "long_poll_secs",
+    "bridge_request_secs",
+    "bridge_retry_secs",
+    "bridge_recovery_secs",
+    "carrier_probe_coalesce_ms",
+    "lane_open_wait_secs",
+    "carrier_health_secs",
+    "websocket_upgrade_secs",
+    "websocket_open_secs",
    "websocket_write_secs",
    "websocket_backpressure_secs",
    "websocket_eviction_secs",
+    "carrier_negotiation_deadlines_secs",
+    "carrier_learning_secs",
    "bootstrap_lifetime_secs",
    "reconnect_grace_secs",
    "http_idle_secs",
+    "http_overload_timeout_ms",
    "shutdown_secs",
    "decoy_header_secs",
 ];

-const WEB_VHOST_CONFIG_KEYS: &[&str] = &["host", "public_addr", "decoy", "profiles"];
+const WEB_VHOST_CONFIG_KEYS: &[&str] = &["host", "base_path", "public_addr", "decoy", "profiles"];
 const WEB_DECOY_CONFIG_KEYS: &[&str] = &["mode", "upstream", "directory", "index"];
 const WEB_PROFILE_CONFIG_KEYS: &[&str] = &[
    "user",
@@ -143,9 +143,15 @@ pub(super) fn validate(config: &mut ProxyConfig) -> Result<()> {
        ));
    }

-    if config.general.me_reinit_trigger_channel == 0 {
+    if !(1..=8).contains(&config.general.me_reinit_max_concurrency) {
        return Err(ProxyError::Config(
-            "general.me_reinit_trigger_channel must be > 0".to_string(),
+            "general.me_reinit_max_concurrency must be within [1, 8]".to_string(),
+        ));
+    }
+
+    if !(1..=4096).contains(&config.general.me_reinit_trigger_channel) {
+        return Err(ProxyError::Config(
+            "general.me_reinit_trigger_channel must be within [1, 4096]".to_string(),
        ));
    }

@@ -196,6 +196,13 @@ pub(super) fn validate(config: &mut ProxyConfig) -> Result<()> {
                "access.user_rate_limits.{user} must set at least one non-zero direction"
            )));
        }
+        for (direction, value) in [("up_bps", limit.up_bps), ("down_bps", limit.down_bps)] {
+            if value > MAX_RATE_LIMIT_BPS {
+                return Err(ProxyError::Config(format!(
+                    "access.user_rate_limits.{user}.{direction} must be within [0, {MAX_RATE_LIMIT_BPS}]"
+                )));
+            }
+        }
    }

    for (cidr, limit) in &config.access.cidr_rate_limits {
@@ -204,6 +211,13 @@ pub(super) fn validate(config: &mut ProxyConfig) -> Result<()> {
                "access.cidr_rate_limits.{cidr} must set at least one non-zero direction"
            )));
        }
+        for (direction, value) in [("up_bps", limit.up_bps), ("down_bps", limit.down_bps)] {
+            if value > MAX_RATE_LIMIT_BPS {
+                return Err(ProxyError::Config(format!(
+                    "access.cidr_rate_limits.{cidr}.{direction} must be within [0, {MAX_RATE_LIMIT_BPS}]"
+                )));
+            }
+        }
    }
    let mut cidr_auto_templates = HashSet::new();
    for cidr in config.access.cidr_rate_limits.keys() {
@@ -6,6 +6,10 @@ use super::*;
 mod debug;
 // Memory-envelope arithmetic remains isolated from protocol validation.
 mod memory;
+// Carrier ordering, cumulative deadlines, and fallback identity are validated together.
+mod negotiation;
+// Request and lifecycle timeout relationships are validated together.
+mod timeouts;
 // WebSocket transport policy is validated independently from HTTP body policy.
 mod websocket;

@@ -67,15 +71,71 @@ pub(super) fn validate(config: &mut ProxyConfig) -> Result<()> {

    validate_limits(&config.web.limits)?;
    debug::validate(&config.web.debug, &config.web.limits)?;
-    if config.web.carrier == WebCarrier::HttpsLanes && config.web.limits.max_http_handlers < 2 {
-        return config_error("web.carrier=https-lanes requires web.limits.max_http_handlers >= 2");
+    let carriers = negotiation::validate(&config.web)?;
+    if carriers.contains(&WebCarrier::Https) && config.web.limits.max_http_handlers < 2 {
+        return config_error("WEB https candidates require web.limits.max_http_handlers >= 2");
    }
-    validate_timeouts(&config.web.timeouts)?;
-    websocket::validate(config.web.carrier, &config.web.limits, &config.web.timeouts)?;
+    if carriers.contains(&WebCarrier::HttpsLanes) && config.web.limits.max_http_handlers < 4 {
+        return config_error(
+            "WEB https-lanes candidates require web.limits.max_http_handlers >= 4",
+        );
+    }
+    timeouts::validate(&config.web.timeouts)?;
+    websocket::validate(&carriers, &config.web.limits, &config.web.timeouts)?;
    validate_vhosts(config)?;
+    validate_decoy_listener_separation(config)?;
    Ok(())
 }

+/// Rejects a direct decoy recursion into an effective WEB listener.
+pub(super) fn validate_decoy_listener_separation(config: &ProxyConfig) -> Result<()> {
+    let web_listeners = config
+        .server
+        .listeners
+        .iter()
+        .filter(|listener| listener.transport == ListenerTransport::Web)
+        .filter(|listener| {
+            (listener.ip.is_ipv4() && config.network.ipv4)
+                || (listener.ip.is_ipv6() && config.network.ipv6 != Some(false))
+        })
+        .map(|listener| SocketAddr::new(listener.ip, listener.port.unwrap_or(config.server.port)))
+        .collect::<Vec<_>>();
+    for (vhost_idx, vhost) in config.web.vhosts.iter().enumerate() {
+        let WebDecoyConfig::HttpUpstream { upstream } = &vhost.decoy else {
+            continue;
+        };
+        let parsed = url::Url::parse(upstream).map_err(|error| {
+            ProxyError::Config(format!(
+                "web.vhosts[{vhost_idx}].decoy.upstream is invalid: {error}"
+            ))
+        })?;
+        let Some(port) = parsed.port_or_known_default() else {
+            continue;
+        };
+        let upstream_ip = match parsed.host() {
+            Some(url::Host::Ipv4(ip)) => IpAddr::V4(ip),
+            Some(url::Host::Ipv6(ip)) => IpAddr::V6(ip),
+            _ => continue,
+        };
+        let upstream_addr = SocketAddr::new(upstream_ip, port);
+        if web_listeners
+            .iter()
+            .any(|listener| listener_covers(*listener, upstream_addr))
+        {
+            return config_error(&format!(
+                "web.vhosts[{vhost_idx}].decoy upstream overlaps WEB listener {upstream_addr}"
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn listener_covers(listener: SocketAddr, target: SocketAddr) -> bool {
+    listener.port() == target.port()
+        && (listener.ip() == target.ip()
+            || (listener.ip().is_unspecified() && listener.is_ipv4() == target.is_ipv4()))
+}
+
 fn validate_web_listener(
    config: &ProxyConfig,
    idx: usize,
@@ -136,6 +196,11 @@ fn validate_limits(limits: &WebLimitsConfig) -> Result<()> {
    if !(1..=MAX_WEB_TOMBSTONES_PER_SESSION).contains(&limits.max_tombstones_per_session) {
        return config_error("web.limits.max_tombstones_per_session must be within [1, 4096]");
    }
+    if limits.pending_bytes_per_lane <= WEB_FRAME_HEADER_BYTES + WEB_QUEUE_ITEM_COST {
+        return config_error(
+            "web.limits.pending_bytes_per_lane must preserve one non-empty DATA frame",
+        );
+    }
    if limits.carrier_batch_bytes > limits.max_body_bytes
        || limits.carrier_batch_bytes
            < limits
@@ -154,7 +219,25 @@ fn validate_limits(limits: &WebLimitsConfig) -> Result<()> {

    let positive = [
        ("max_http_connections", limits.max_http_connections),
+        (
+            "max_http_overload_connections",
+            limits.max_http_overload_connections,
+        ),
        ("max_http_handlers", limits.max_http_handlers),
+        (
+            "max_lane_open_waits_per_session",
+            limits.max_lane_open_waits_per_session,
+        ),
+        ("pending_bytes_per_lane", limits.pending_bytes_per_lane),
+        ("pending_items_per_lane", limits.pending_items_per_lane),
+        (
+            "max_websocket_evictions_in_flight",
+            limits.max_websocket_evictions_in_flight,
+        ),
+        (
+            "max_carrier_learning_entries",
+            limits.max_carrier_learning_entries,
+        ),
        ("max_body_readers", limits.max_body_readers),
        ("max_body_bytes_global", limits.max_body_bytes_global),
        ("max_sessions_global", limits.max_sessions_global),
@@ -193,6 +276,10 @@ fn validate_limits(limits: &WebLimitsConfig) -> Result<()> {
    }
    for (field, value) in [
        ("max_http_connections", limits.max_http_connections),
+        (
+            "max_http_overload_connections",
+            limits.max_http_overload_connections,
+        ),
        ("max_http_handlers", limits.max_http_handlers),
        ("max_body_readers", limits.max_body_readers),
        ("max_body_bytes_global", limits.max_body_bytes_global),
@@ -227,8 +314,11 @@ fn validate_limits(limits: &WebLimitsConfig) -> Result<()> {
        || limits.max_bootstraps_per_ip > limits.max_bootstraps_global
        || limits.max_http_handlers > limits.max_http_connections
        || limits.max_body_readers > limits.max_http_handlers
+        || limits.max_lane_open_waits_per_session > limits.max_streams_per_session
        || limits.pending_bytes_per_session > limits.pending_bytes_global
        || limits.pending_items_per_session > limits.pending_items_global
+        || limits.pending_bytes_per_lane > limits.pending_bytes_per_session
+        || limits.pending_items_per_lane > limits.pending_items_per_session
        || limits.control_bytes_per_session > limits.control_bytes_global
        || limits.control_bytes_per_session > limits.pending_bytes_per_session
        || limits.control_bytes_global > limits.pending_bytes_global
@@ -324,226 +414,9 @@ fn validate_limits(limits: &WebLimitsConfig) -> Result<()> {
    Ok(())
 }

-fn validate_timeouts(timeouts: &WebTimeoutsConfig) -> Result<()> {
-    let values = [
-        ("header_secs", timeouts.header_secs),
-        ("body_secs", timeouts.body_secs),
-        ("stream_handshake_secs", timeouts.stream_handshake_secs),
-        ("long_poll_secs", timeouts.long_poll_secs),
-        ("websocket_write_secs", timeouts.websocket_write_secs),
-        (
-            "websocket_backpressure_secs",
-            timeouts.websocket_backpressure_secs,
-        ),
-        ("websocket_eviction_secs", timeouts.websocket_eviction_secs),
-        ("bootstrap_lifetime_secs", timeouts.bootstrap_lifetime_secs),
-        ("reconnect_grace_secs", timeouts.reconnect_grace_secs),
-        ("http_idle_secs", timeouts.http_idle_secs),
-        ("shutdown_secs", timeouts.shutdown_secs),
-        ("decoy_header_secs", timeouts.decoy_header_secs),
-    ];
-    if let Some((field, _)) = values
-        .into_iter()
-        .find(|(_, value)| !(1..=3600).contains(value))
-    {
-        return config_error(&format!("web.timeouts.{field} must be within [1, 3600]"));
-    }
-    let request_deadline = timeouts
-        .header_secs
-        .max(timeouts.body_secs)
-        .max(timeouts.long_poll_secs)
-        .max(timeouts.decoy_header_secs);
-    if request_deadline >= timeouts.http_idle_secs {
-        return config_error("web.timeouts request deadlines must be lower than http_idle_secs");
-    }
-    Ok(())
-}
-
-fn validate_vhosts(config: &mut ProxyConfig) -> Result<()> {
-    let limits = &config.web.limits;
-    if config.web.vhosts.len() > limits.max_vhosts {
-        return config_error("web.vhosts exceeds web.limits.max_vhosts");
-    }
-    let mut hosts = HashSet::with_capacity(config.web.vhosts.len());
-    let mut profile_count = 0usize;
-    for (vhost_idx, vhost) in config.web.vhosts.iter_mut().enumerate() {
-        vhost.host = normalize_web_host(&vhost.host, &format!("web.vhosts[{vhost_idx}].host"))?;
-        if !hosts.insert(vhost.host.clone()) {
-            return config_error(&format!("duplicate WEB vhost host `{}`", vhost.host));
-        }
-        if vhost.public_addr.port() != 443 || vhost.public_addr.ip().is_unspecified() {
-            return config_error(&format!(
-                "web.vhosts[{vhost_idx}].public_addr must be a concrete socket address on port 443"
-            ));
-        }
-        if config.web.enabled && vhost.profiles.is_empty() {
-            return config_error(&format!(
-                "web.vhosts[{vhost_idx}].profiles must be non-empty when web.enabled=true"
-            ));
-        }
-        validate_decoy(vhost_idx, &vhost.decoy)?;
-        let mut profiles = HashSet::with_capacity(vhost.profiles.len());
-        for (profile_idx, profile) in vhost.profiles.iter().enumerate() {
-            if !config.access.users.contains_key(&profile.user) {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].profiles[{profile_idx}].user references unknown access user `{}`",
-                    profile.user
-                ));
-            }
-            if !profiles.insert((profile.user.as_str(), profile.secret_mode)) {
-                return config_error(&format!(
-                    "duplicate WEB profile for user `{}` in vhost `{}`",
-                    profile.user, vhost.host
-                ));
-            }
-            let max_streams = profile.max_streams.unwrap_or(limits.max_streams_global);
-            let max_streams_per_session = profile
-                .max_streams_per_session
-                .unwrap_or(limits.max_streams_per_session);
-            if profile.max_sessions == Some(0)
-                || profile
-                    .max_sessions
-                    .is_some_and(|value| value > limits.max_sessions_global)
-                || profile.max_streams == Some(0)
-                || profile
-                    .max_streams
-                    .is_some_and(|value| value > limits.max_streams_global)
-                || profile.max_streams_per_session == Some(0)
-                || profile
-                    .max_streams_per_session
-                    .is_some_and(|value| value > limits.max_streams_per_session)
-                || max_streams_per_session > max_streams
-            {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].profiles[{profile_idx}] limits must be non-zero and within global WEB limits"
-                ));
-            }
-            profile_count = profile_count.checked_add(1).ok_or_else(|| {
-                ProxyError::Config("WEB profile count overflowed usize".to_string())
-            })?;
-        }
-    }
-    if profile_count > limits.max_profiles {
-        return config_error("WEB profiles exceed web.limits.max_profiles");
-    }
-    Ok(())
-}
-
-fn normalize_web_host(value: &str, field: &str) -> Result<String> {
-    let input = value.trim();
-    if input.is_empty()
-        || input.ends_with('.')
-        || input
-            .chars()
-            .any(|character| matches!(character, ':' | '/' | '?' | '#' | '@'))
-    {
-        return config_error(&format!(
-            "{field} must be a hostname without a port, path, credentials, or trailing dot"
-        ));
-    }
-    let host = normalize_domain_to_ascii(input, field)?;
-    if host.len() > 253
-        || !host.contains('.')
-        || host.parse::<IpAddr>().is_ok()
-        || web_host_last_label_is_numeric(&host)
-    {
-        return config_error(&format!(
-            "{field} must be a non-IP fully-qualified hostname accepted by Telegram Desktop"
-        ));
-    }
-    for label in host.split('.') {
-        if label.is_empty()
-            || label.len() > 63
-            || label.starts_with('-')
-            || label.ends_with('-')
-            || !label
-                .bytes()
-                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
-        {
-            return config_error(&format!(
-                "{field} contains a hostname label rejected by Telegram Desktop"
-            ));
-        }
-    }
-    Ok(host)
-}
-
-fn web_host_last_label_is_numeric(host: &str) -> bool {
-    let label = host.rsplit('.').next().unwrap_or_default();
-    let digits = label
-        .strip_prefix("0x")
-        .or_else(|| label.strip_prefix("0X"));
-    if let Some(digits) = digits {
-        return digits.bytes().all(|byte| byte.is_ascii_hexdigit());
-    }
-    label.bytes().all(|byte| byte.is_ascii_digit())
-}
-
-fn validate_decoy(vhost_idx: usize, decoy: &WebDecoyConfig) -> Result<()> {
-    match decoy {
-        WebDecoyConfig::HttpUpstream { upstream } => {
-            let parsed = url::Url::parse(upstream).map_err(|error| {
-                ProxyError::Config(format!(
-                    "web.vhosts[{vhost_idx}].decoy.upstream is invalid: {error}"
-                ))
-            })?;
-            if parsed.scheme() != "http"
-                || parsed.host_str().is_none()
-                || !parsed.username().is_empty()
-                || parsed.password().is_some()
-                || parsed.query().is_some()
-                || parsed.fragment().is_some()
-                || parsed.path() != "/"
-                || parsed.port() == Some(0)
-            {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].decoy.upstream must be an http origin without credentials, path, query, or fragment"
-                ));
-            }
-            let ip = match parsed.host() {
-                Some(url::Host::Ipv4(ip)) => IpAddr::V4(ip),
-                Some(url::Host::Ipv6(ip)) => IpAddr::V6(ip),
-                _ => {
-                    return config_error(&format!(
-                        "web.vhosts[{vhost_idx}].decoy.upstream host must be a loopback or private IP literal"
-                    ));
-                }
-            };
-            let private = match ip {
-                IpAddr::V4(ip) => ip.is_loopback() || ip.is_private() || ip.is_link_local(),
-                IpAddr::V6(ip) => {
-                    ip.is_loopback() || ip.is_unique_local() || ip.is_unicast_link_local()
-                }
-            };
-            if !private {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].decoy.upstream must remain inside loopback or a private network"
-                ));
-            }
-        }
-        WebDecoyConfig::StaticDirectory { directory, index } => {
-            if !directory.is_absolute() {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].decoy.directory must be absolute"
-                ));
-            }
-            if index.is_empty()
-                || index.contains('\\')
-                || std::path::Path::new(index).components().count() != 1
-                || matches!(index.as_str(), "." | "..")
-            {
-                return config_error(&format!(
-                    "web.vhosts[{vhost_idx}].decoy.index must be one safe file name"
-                ));
-            }
-        }
-    }
-    Ok(())
-}
-
-fn config_error<T>(message: &str) -> Result<T> {
-    Err(ProxyError::Config(message.to_string()))
-}
+// Virtual-host, hostname, and decoy validation.
+mod vhosts;
+use vhosts::*;

 #[cfg(test)]
 mod tests;
@@ -3,9 +3,17 @@ use super::*;
 const WEB_DEBUG_RENDERERS: usize = 2;
 const WEB_DEBUG_STATUS_PAGE_BYTES: usize = 8 * 1024 * 1024;
 const WEB_DEBUG_GROUP_SCRATCH_BYTES: usize = 4 * 1024 * 1024;
+const WEB_CARRIER_LEARNING_ENTRY_BYTES: usize = 512;
+const WEB_LANE_STATE_BYTES: usize = 512;
+const WEB_OVERLOAD_CONNECTION_BYTES: usize = 4 * 1024;
+// Each profile capability is stored in its vhost and in the global containment table.
+const WEB_CAPABILITY_INDEX_ENTRY_BYTES: usize = 64;

 /// Validates process-wide body, header, queue, static, and debug reservations.
 pub(super) fn validate(limits: &WebLimitsConfig) -> Result<()> {
+    if limits.max_carrier_learning_entries == 0 {
+        return config_error("web.limits.max_carrier_learning_entries must be > 0");
+    }
    let body_reservation = limits
        .max_body_readers
        .checked_mul(limits.max_body_bytes)
@@ -25,6 +33,12 @@ pub(super) fn validate(limits: &WebLimitsConfig) -> Result<()> {
        .ok_or_else(|| {
            ProxyError::Config("web.limits HTTP header reservations overflow usize".to_string())
        })?;
+    let overload_connection_reservation = limits
+        .max_http_overload_connections
+        .checked_mul(WEB_OVERLOAD_CONNECTION_BYTES)
+        .ok_or_else(|| {
+            ProxyError::Config("web.limits HTTP overload reservations overflow usize".to_string())
+        })?;
    let debug_ring_index = limits
        .debug_records_capacity
        .checked_mul(std::mem::size_of::<usize>())
@@ -47,6 +61,27 @@ pub(super) fn validate(limits: &WebLimitsConfig) -> Result<()> {
                .and_then(|scratch| value.checked_add(scratch))
        })
        .ok_or_else(|| ProxyError::Config("web.debug reservations overflowed usize".to_string()))?;
+    let carrier_learning_reservation = limits
+        .max_carrier_learning_entries
+        .checked_mul(WEB_CARRIER_LEARNING_ENTRY_BYTES)
+        .ok_or_else(|| {
+            ProxyError::Config("web.carrier learning reservation overflowed usize".to_string())
+        })?;
+    let capability_index_reservation = limits
+        .max_profiles
+        .checked_mul(WEB_CAPABILITY_INDEX_ENTRY_BYTES)
+        .ok_or_else(|| {
+            ProxyError::Config("web capability index reservation overflowed usize".to_string())
+        })?;
+    let lane_state_reservation = limits
+        .max_streams_per_session
+        .checked_add(limits.max_tombstones_per_session)
+        .and_then(|value| value.checked_add(1))
+        .and_then(|value| value.checked_mul(limits.max_sessions_global))
+        .and_then(|value| value.checked_mul(WEB_LANE_STATE_BYTES))
+        .ok_or_else(|| {
+            ProxyError::Config("web.limits lane state reservation overflowed usize".to_string())
+        })?;
    let reserved = limits
        .pending_bytes_global
        .checked_add(limits.max_body_bytes_global)
@@ -54,7 +89,11 @@ pub(super) fn validate(limits: &WebLimitsConfig) -> Result<()> {
        .and_then(|value| value.checked_add(debug_ring_index))
        .and_then(|value| value.checked_add(status_pages))
        .and_then(|value| value.checked_add(debug_reservation))
+        .and_then(|value| value.checked_add(carrier_learning_reservation))
+        .and_then(|value| value.checked_add(capability_index_reservation))
+        .and_then(|value| value.checked_add(lane_state_reservation))
        .and_then(|value| value.checked_add(http_header_reservation))
+        .and_then(|value| value.checked_add(overload_connection_reservation))
        .ok_or_else(|| ProxyError::Config("web.limits byte ceilings overflow usize".to_string()))?;
    if reserved > limits.memory_envelope_bytes
        || limits.memory_envelope_bytes > MAX_WEB_MEMORY_ENVELOPE_BYTES
@@ -65,3 +104,30 @@ pub(super) fn validate(limits: &WebLimitsConfig) -> Result<()> {
    }
    Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_envelope_includes_bounded_lane_and_learning_metadata() {
+        let limits = WebLimitsConfig::default();
+        assert!(validate(&limits).is_ok());
+
+        let previous_envelope = WebLimitsConfig {
+            memory_envelope_bytes: 768 * 1024 * 1024,
+            ..limits
+        };
+        assert!(validate(&previous_envelope).is_err());
+    }
+
+    #[test]
+    fn capability_index_reservation_rejects_size_overflow() {
+        let limits = WebLimitsConfig {
+            max_profiles: usize::MAX,
+            ..WebLimitsConfig::default()
+        };
+        let error = validate(&limits).unwrap_err().to_string();
+        assert!(error.contains("web capability index reservation overflowed usize"));
+    }
+}
@@ -0,0 +1,123 @@
+use std::collections::HashSet;
+
+use super::*;
+
+/// Validates bounded carrier selection and learning policy.
+pub(super) fn validate(config: &WebConfig) -> Result<Vec<WebCarrier>> {
+    if let Some(carriers) = config.carriers.enabled() {
+        if carriers.is_empty() {
+            return config_error("web.carriers must contain at least one carrier");
+        }
+        let mut unique = HashSet::with_capacity(carriers.len());
+        if carriers.iter().any(|carrier| !unique.insert(*carrier)) {
+            return config_error("web.carriers must not contain duplicate carriers");
+        }
+    }
+    let candidates = config.carrier_candidates();
+    if config.carrier_negotiation_enabled()
+        && config.carrier_learning
+        && config.limits.max_carrier_learning_entries < WEB_CARRIER_LEARNING_MIN_ENTRIES
+    {
+        return config_error(
+            "web.limits.max_carrier_learning_entries must be >= 3 when carrier learning is enabled",
+        );
+    }
+    if candidates.len() > WebCarrier::ALL.len() {
+        return config_error(
+            "web.carriers and the web.carrier fallback must contain at most four carriers",
+        );
+    }
+    let deadlines = config.timeouts.carrier_negotiation_deadlines_secs;
+    if deadlines[0] == 0 || deadlines.windows(2).any(|pair| pair[0] >= pair[1]) {
+        return config_error(
+            "web.timeouts.carrier_negotiation_deadlines_secs must be non-zero and strictly increasing",
+        );
+    }
+    let retained_chain_secs = deadlines[3]
+        .checked_add(config.timeouts.carrier_health_secs)
+        .and_then(|value| value.checked_add(1));
+    if retained_chain_secs.is_none_or(|value| value >= config.timeouts.bootstrap_lifetime_secs) {
+        return config_error(
+            "web.timeouts final carrier deadline plus health and cleanup must be lower than bootstrap_lifetime_secs",
+        );
+    }
+    Ok(candidates)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fallback_is_appended_once() {
+        let config = WebConfig {
+            carrier: WebCarrier::Https,
+            carriers: WebCarriers::Enabled(vec![WebCarrier::Websocket, WebCarrier::Https]),
+            ..Default::default()
+        };
+        assert_eq!(
+            validate(&config).unwrap(),
+            vec![WebCarrier::Websocket, WebCarrier::Https]
+        );
+    }
+
+    #[test]
+    fn duplicate_carriers_are_rejected() {
+        let config = WebConfig {
+            carriers: WebCarriers::Enabled(vec![WebCarrier::Websocket, WebCarrier::Websocket]),
+            ..Default::default()
+        };
+        assert!(validate(&config).is_err());
+    }
+
+    #[test]
+    fn missing_or_false_carriers_disable_negotiation() {
+        #[derive(serde::Deserialize)]
+        struct Wrapper {
+            value: WebCarriers,
+        }
+
+        let config = WebConfig::default();
+        assert!(!config.carrier_negotiation_enabled());
+        assert_eq!(validate(&config).unwrap(), [WebCarrier::Https]);
+
+        let disabled: Wrapper = toml::from_str("value = false").unwrap();
+        assert_eq!(disabled.value, WebCarriers::Disabled);
+        assert!(toml::from_str::<Wrapper>("value = true").is_err());
+    }
+
+    #[test]
+    fn fallback_cannot_expand_the_candidate_set_beyond_four() {
+        let mut config = WebConfig {
+            carrier: WebCarrier::Https,
+            carriers: WebCarriers::Enabled(vec![
+                WebCarrier::HttpsLanes,
+                WebCarrier::Websocket,
+                WebCarrier::WebsocketLanes,
+                WebCarrier::Https,
+            ]),
+            ..Default::default()
+        };
+        assert_eq!(validate(&config).unwrap().len(), 4);
+
+        config.carriers = WebCarriers::Enabled(vec![
+            WebCarrier::HttpsLanes,
+            WebCarrier::Websocket,
+            WebCarrier::WebsocketLanes,
+        ]);
+        assert_eq!(validate(&config).unwrap().len(), 4);
+    }
+
+    #[test]
+    fn deadlines_are_cumulative_and_bounded_by_bootstrap_lifetime() {
+        let mut config = WebConfig::default();
+        config.timeouts.carrier_negotiation_deadlines_secs = [3, 3, 8, 12];
+        assert!(validate(&config).is_err());
+        config.timeouts.carrier_negotiation_deadlines_secs = [3, 5, 8, 121];
+        assert!(validate(&config).is_err());
+        config.timeouts.carrier_negotiation_deadlines_secs = [3, 5, 8, 89];
+        assert!(validate(&config).is_err());
+        config.timeouts.carrier_negotiation_deadlines_secs = [3, 5, 8, 88];
+        assert!(validate(&config).is_ok());
+    }
+}
@@ -0,0 +1,80 @@
+use super::*;
+
+/// Validates WEB request, learning, and lifecycle timeouts.
+pub(super) fn validate(timeouts: &WebTimeoutsConfig) -> Result<()> {
+    if !(1..=60_000).contains(&timeouts.http_overload_timeout_ms) {
+        return config_error("web.timeouts.http_overload_timeout_ms must be within [1, 60000]");
+    }
+    let values = [
+        ("header_secs", timeouts.header_secs),
+        ("body_secs", timeouts.body_secs),
+        ("stream_handshake_secs", timeouts.stream_handshake_secs),
+        ("stream_first_byte_secs", timeouts.stream_first_byte_secs),
+        ("long_poll_secs", timeouts.long_poll_secs),
+        ("lane_open_wait_secs", timeouts.lane_open_wait_secs),
+        ("carrier_health_secs", timeouts.carrier_health_secs),
+        ("websocket_upgrade_secs", timeouts.websocket_upgrade_secs),
+        ("websocket_open_secs", timeouts.websocket_open_secs),
+        ("websocket_write_secs", timeouts.websocket_write_secs),
+        (
+            "websocket_backpressure_secs",
+            timeouts.websocket_backpressure_secs,
+        ),
+        ("websocket_eviction_secs", timeouts.websocket_eviction_secs),
+        ("bootstrap_lifetime_secs", timeouts.bootstrap_lifetime_secs),
+        ("reconnect_grace_secs", timeouts.reconnect_grace_secs),
+        ("http_idle_secs", timeouts.http_idle_secs),
+        ("shutdown_secs", timeouts.shutdown_secs),
+        ("decoy_header_secs", timeouts.decoy_header_secs),
+    ];
+    if let Some((field, _)) = values
+        .into_iter()
+        .find(|(_, value)| !(1..=3600).contains(value))
+    {
+        return config_error(&format!("web.timeouts.{field} must be within [1, 3600]"));
+    }
+    if !(2..=86_400).contains(&timeouts.carrier_learning_secs) {
+        return config_error("web.timeouts.carrier_learning_secs must be within [2, 86400]");
+    }
+    if !(1..=60).contains(&timeouts.bridge_request_secs) {
+        return config_error("web.timeouts.bridge_request_secs must be within [1, 60]");
+    }
+    if !(1..=300).contains(&timeouts.bridge_retry_secs) {
+        return config_error("web.timeouts.bridge_retry_secs must be within [1, 300]");
+    }
+    if !(1..=60).contains(&timeouts.bridge_recovery_secs) {
+        return config_error("web.timeouts.bridge_recovery_secs must be within [1, 60]");
+    }
+    if timeouts.bridge_request_secs > timeouts.bridge_retry_secs {
+        return config_error("web.timeouts.bridge_request_secs must not exceed bridge_retry_secs");
+    }
+    if timeouts.carrier_probe_coalesce_ms > 10 {
+        return config_error("web.timeouts.carrier_probe_coalesce_ms must be within [0, 10]");
+    }
+    if timeouts.stream_first_byte_secs > 300 {
+        return config_error("web.timeouts.stream_first_byte_secs must be within [1, 300]");
+    }
+    if timeouts.websocket_upgrade_secs > 60 {
+        return config_error("web.timeouts.websocket_upgrade_secs must be within [1, 60]");
+    }
+    if timeouts.websocket_open_secs > 300 {
+        return config_error("web.timeouts.websocket_open_secs must be within [1, 300]");
+    }
+    if timeouts.lane_open_wait_secs > timeouts.long_poll_secs {
+        return config_error("web.timeouts.lane_open_wait_secs must not exceed long_poll_secs");
+    }
+    if timeouts.carrier_health_secs > timeouts.reconnect_grace_secs {
+        return config_error(
+            "web.timeouts.carrier_health_secs must not exceed reconnect_grace_secs",
+        );
+    }
+    let request_deadline = timeouts
+        .header_secs
+        .max(timeouts.body_secs)
+        .max(timeouts.long_poll_secs)
+        .max(timeouts.decoy_header_secs);
+    if request_deadline >= timeouts.http_idle_secs {
+        return config_error("web.timeouts request deadlines must be lower than http_idle_secs");
+    }
+    Ok(())
+}
@@ -0,0 +1,215 @@
+use super::*;
+
+pub(super) fn validate_vhosts(config: &mut ProxyConfig) -> Result<()> {
+    let limits = &config.web.limits;
+    if config.web.vhosts.len() > limits.max_vhosts {
+        return config_error("web.vhosts exceeds web.limits.max_vhosts");
+    }
+    let mut hosts = HashSet::with_capacity(config.web.vhosts.len());
+    let mut profile_count = 0usize;
+    for (vhost_idx, vhost) in config.web.vhosts.iter_mut().enumerate() {
+        vhost.host = normalize_web_host(&vhost.host, &format!("web.vhosts[{vhost_idx}].host"))?;
+        validate_web_base_path(
+            &vhost.base_path,
+            &format!("web.vhosts[{vhost_idx}].base_path"),
+        )?;
+        if !hosts.insert(vhost.host.clone()) {
+            return config_error(&format!("duplicate WEB vhost host `{}`", vhost.host));
+        }
+        if vhost.public_addr.port() != 443 || vhost.public_addr.ip().is_unspecified() {
+            return config_error(&format!(
+                "web.vhosts[{vhost_idx}].public_addr must be a concrete socket address on port 443"
+            ));
+        }
+        if config.web.enabled && vhost.profiles.is_empty() {
+            return config_error(&format!(
+                "web.vhosts[{vhost_idx}].profiles must be non-empty when web.enabled=true"
+            ));
+        }
+        validate_decoy(vhost_idx, &vhost.decoy)?;
+        let mut profiles = HashSet::with_capacity(vhost.profiles.len());
+        for (profile_idx, profile) in vhost.profiles.iter().enumerate() {
+            if profile.user.is_empty() || profile.user.len() > 64 {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].profiles[{profile_idx}].user must contain 1..64 bytes"
+                ));
+            }
+            if !config.access.users.contains_key(&profile.user) {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].profiles[{profile_idx}].user references unknown access user `{}`",
+                    profile.user
+                ));
+            }
+            if !profiles.insert((profile.user.as_str(), profile.secret_mode)) {
+                return config_error(&format!(
+                    "duplicate WEB profile for user `{}` in vhost `{}`",
+                    profile.user, vhost.host
+                ));
+            }
+            let max_streams = profile.max_streams.unwrap_or(limits.max_streams_global);
+            let max_streams_per_session = profile
+                .max_streams_per_session
+                .unwrap_or(limits.max_streams_per_session);
+            if profile.max_sessions == Some(0)
+                || profile
+                    .max_sessions
+                    .is_some_and(|value| value > limits.max_sessions_global)
+                || profile.max_streams == Some(0)
+                || profile
+                    .max_streams
+                    .is_some_and(|value| value > limits.max_streams_global)
+                || profile.max_streams_per_session == Some(0)
+                || profile
+                    .max_streams_per_session
+                    .is_some_and(|value| value > limits.max_streams_per_session)
+                || max_streams_per_session > max_streams
+            {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].profiles[{profile_idx}] limits must be non-zero and within global WEB limits"
+                ));
+            }
+            profile_count = profile_count.checked_add(1).ok_or_else(|| {
+                ProxyError::Config("WEB profile count overflowed usize".to_string())
+            })?;
+        }
+    }
+    if profile_count > limits.max_profiles {
+        return config_error("WEB profiles exceed web.limits.max_profiles");
+    }
+    Ok(())
+}
+
+fn validate_web_base_path(value: &str, field: &str) -> Result<()> {
+    let valid = value.len() <= 128
+        && !value.starts_with('/')
+        && !value.ends_with('/')
+        && value.split('/').all(|segment| {
+            let mut bytes = segment.bytes();
+            bytes
+                .next()
+                .is_some_and(|byte| byte.is_ascii_alphanumeric())
+                && bytes.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+        });
+    if value.is_empty() || valid {
+        return Ok(());
+    }
+    config_error(&format!(
+        "{field} must be empty or contain at most 128 ASCII bytes in slash-separated [A-Za-z0-9][A-Za-z0-9_-]* segments"
+    ))
+}
+
+pub(super) fn normalize_web_host(value: &str, field: &str) -> Result<String> {
+    let input = value.trim();
+    if input.is_empty()
+        || input.ends_with('.')
+        || input
+            .chars()
+            .any(|character| matches!(character, ':' | '/' | '?' | '#' | '@'))
+    {
+        return config_error(&format!(
+            "{field} must be a hostname without a port, path, credentials, or trailing dot"
+        ));
+    }
+    let host = normalize_domain_to_ascii(input, field)?;
+    if host.len() > 253
+        || !host.contains('.')
+        || host.parse::<IpAddr>().is_ok()
+        || web_host_last_label_is_numeric(&host)
+    {
+        return config_error(&format!(
+            "{field} must be a non-IP fully-qualified hostname accepted by Telegram Desktop"
+        ));
+    }
+    for label in host.split('.') {
+        if label.is_empty()
+            || label.len() > 63
+            || label.starts_with('-')
+            || label.ends_with('-')
+            || !label
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+        {
+            return config_error(&format!(
+                "{field} contains a hostname label rejected by Telegram Desktop"
+            ));
+        }
+    }
+    Ok(host)
+}
+
+pub(super) fn web_host_last_label_is_numeric(host: &str) -> bool {
+    let label = host.rsplit('.').next().unwrap_or_default();
+    let digits = label
+        .strip_prefix("0x")
+        .or_else(|| label.strip_prefix("0X"));
+    if let Some(digits) = digits {
+        return digits.bytes().all(|byte| byte.is_ascii_hexdigit());
+    }
+    label.bytes().all(|byte| byte.is_ascii_digit())
+}
+
+pub(super) fn validate_decoy(vhost_idx: usize, decoy: &WebDecoyConfig) -> Result<()> {
+    match decoy {
+        WebDecoyConfig::HttpUpstream { upstream } => {
+            let parsed = url::Url::parse(upstream).map_err(|error| {
+                ProxyError::Config(format!(
+                    "web.vhosts[{vhost_idx}].decoy.upstream is invalid: {error}"
+                ))
+            })?;
+            if parsed.scheme() != "http"
+                || parsed.host_str().is_none()
+                || !parsed.username().is_empty()
+                || parsed.password().is_some()
+                || parsed.query().is_some()
+                || parsed.fragment().is_some()
+                || parsed.path() != "/"
+                || parsed.port() == Some(0)
+            {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].decoy.upstream must be an http origin without credentials, path, query, or fragment"
+                ));
+            }
+            let ip = match parsed.host() {
+                Some(url::Host::Ipv4(ip)) => IpAddr::V4(ip),
+                Some(url::Host::Ipv6(ip)) => IpAddr::V6(ip),
+                _ => {
+                    return config_error(&format!(
+                        "web.vhosts[{vhost_idx}].decoy.upstream host must be a loopback or private IP literal"
+                    ));
+                }
+            };
+            let private = match ip {
+                IpAddr::V4(ip) => ip.is_loopback() || ip.is_private() || ip.is_link_local(),
+                IpAddr::V6(ip) => {
+                    ip.is_loopback() || ip.is_unique_local() || ip.is_unicast_link_local()
+                }
+            };
+            if !private {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].decoy.upstream must remain inside loopback or a private network"
+                ));
+            }
+        }
+        WebDecoyConfig::StaticDirectory { directory, index } => {
+            if !directory.is_absolute() {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].decoy.directory must be absolute"
+                ));
+            }
+            if index.is_empty()
+                || index.contains('\\')
+                || std::path::Path::new(index).components().count() != 1
+                || matches!(index.as_str(), "." | "..")
+            {
+                return config_error(&format!(
+                    "web.vhosts[{vhost_idx}].decoy.index must be one safe file name"
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn config_error<T>(message: &str) -> Result<T> {
+    Err(ProxyError::Config(message.to_string()))
+}
@@ -7,7 +7,7 @@ const WEBSOCKET_FRAME_OVERHEAD_BYTES: usize = 14;

 /// Validates WebSocket admission, memory, and deadline invariants.
 pub(super) fn validate(
-    carrier: WebCarrier,
+    carriers: &[WebCarrier],
    limits: &WebLimitsConfig,
    timeouts: &WebTimeoutsConfig,
 ) -> Result<()> {
@@ -27,7 +27,7 @@ pub(super) fn validate(
            "web.timeouts.websocket_eviction_secs must not exceed websocket_write_secs",
        );
    }
-    if !carrier.uses_websocket() {
+    if !carriers.iter().any(|carrier| carrier.uses_websocket()) {
        return Ok(());
    }
    if limits.carrier_batch_bytes > MAX_WEBSOCKET_BATCH_BYTES {
@@ -42,6 +42,14 @@ pub(super) fn validate(
            "WebSocket carriers require websocket_http_connection_reserve within [1, max_http_connections)",
        );
    }
+    let websocket_capacity = limits
+        .max_http_connections
+        .saturating_sub(limits.websocket_http_connection_reserve);
+    if limits.max_websocket_evictions_in_flight > websocket_capacity {
+        return config_error(
+            "web.limits.max_websocket_evictions_in_flight must not exceed WebSocket connection capacity",
+        );
+    }
    let socket_base = WEBSOCKET_IO_BUFFER_BYTES
        .checked_mul(2)
        .and_then(|value| value.checked_add(WEBSOCKET_DRIVER_OVERHEAD_BYTES))
@@ -46,6 +46,8 @@ mod legacy_policy_tests;
 mod me_route_tests;
 #[path = "load_basic_tests/me_startup_tests.rs"]
 mod me_startup_tests;
+#[path = "load_basic_tests/source_security_tests.rs"]
+mod source_security_tests;
 #[path = "load_basic_tests/synlimit_mss_tests.rs"]
 mod synlimit_mss_tests;
 #[path = "load_basic_tests/tls_fetch_tests.rs"]
@@ -288,6 +288,68 @@ fn cidr_rate_limits_reject_duplicate_normalized_auto_templates() {
    assert!(error.contains("duplicates normalized auto-template *6/128"));
 }

+#[test]
+fn rate_limits_accept_the_packed_counter_maximum() {
+    let cfg = load_config_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.user_rate_limits]
+            user = { up_bps = 100000000000, down_bps = 0 }
+
+            [access.cidr_rate_limits]
+            "203.0.113.0/24" = { up_bps = 0, down_bps = 100000000000 }
+        "#,
+    );
+
+    assert_eq!(cfg.access.user_rate_limits["user"].up_bps, 100_000_000_000);
+    assert_eq!(
+        cfg.access.cidr_rate_limits[&CidrRateLimitKey::Network("203.0.113.0/24".parse().unwrap())]
+            .down_bps,
+        100_000_000_000
+    );
+}
+
+#[test]
+fn user_rate_limits_reject_values_above_the_packed_counter_maximum() {
+    let error = load_config_error_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.user_rate_limits]
+            user = { up_bps = 100000000001, down_bps = 0 }
+        "#,
+    );
+
+    assert!(error.contains("access.user_rate_limits.user.up_bps must be within"));
+}
+
+#[test]
+fn cidr_rate_limits_reject_values_above_the_packed_counter_maximum() {
+    let error = load_config_error_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.cidr_rate_limits]
+            "203.0.113.0/24" = { up_bps = 0, down_bps = 100000000001 }
+        "#,
+    );
+
+    assert!(error.contains("access.cidr_rate_limits.203.0.113.0/24.down_bps must be within"));
+}
+
 #[test]
 fn file_logging_requires_path() {
    let error = load_config_error_from_temp_toml(
@@ -0,0 +1,42 @@
+#[cfg(unix)]
+use std::os::unix::fs::symlink;
+
+use super::*;
+
+#[cfg(unix)]
+#[test]
+fn config_loader_rejects_final_and_intermediate_symlinks() {
+    let directory = tempfile::tempdir().unwrap();
+    let real_directory = directory.path().join("real");
+    let linked_directory = directory.path().join("linked");
+    std::fs::create_dir(&real_directory).unwrap();
+    let real_config = real_directory.join("config.toml");
+    let final_link = directory.path().join("config.toml");
+    std::fs::write(&real_config, "[general]\n").unwrap();
+    symlink(&real_config, &final_link).unwrap();
+    symlink(&real_directory, &linked_directory).unwrap();
+
+    assert!(ProxyConfig::load(&final_link).is_err());
+    assert!(ProxyConfig::load(linked_directory.join("config.toml")).is_err());
+}
+
+#[test]
+fn config_loader_rejects_oversized_source() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("config.toml");
+    std::fs::write(&path, vec![b' '; 8 * 1024 * 1024 + 1]).unwrap();
+
+    let error = ProxyConfig::load(&path).unwrap_err().to_string();
+
+    assert!(error.contains("size limit") || error.contains("exceeds"));
+}
+
+#[cfg(unix)]
+#[test]
+fn config_loader_rejects_fifo_without_blocking() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("config.toml");
+    nix::unistd::mkfifo(&path, nix::sys::stat::Mode::S_IRUSR).unwrap();
+
+    assert!(ProxyConfig::load(&path).is_err());
+}
@@ -1,5 +1,8 @@
 use super::*;

+#[path = "web_tests/base_path_tests.rs"]
+mod base_path_tests;
+
 const WEB_CONFIG: &str = r#"
 [access.users]
 alice = "000102030405060708090a0b0c0d0e0f"
@@ -40,7 +43,12 @@ fn web_config_builds_canonical_runtime_snapshot() {
        .vhosts
        .get("proxy.example.com")
        .expect("canonical WEB vhost");
+    assert_eq!(vhost.base, "/");
    assert_eq!(vhost.profiles.len(), 1);
+    assert_eq!(vhost.capabilities.len(), vhost.profiles.len());
+    assert_eq!(vhost.capabilities[0], vhost.profiles[0].capability);
+    assert_eq!(runtime.capabilities.as_ref(), vhost.capabilities.as_ref());
+    assert_eq!(vhost.decoy_fasttrack_mode, WebDecoyFastTrackMode::Off);
    assert_eq!(vhost.profiles[0].user, "alice");
    assert_eq!(vhost.profiles[0].secret_mode, WebSecretMode::Dd);
    assert_eq!(vhost.profiles[0].carrier, WebCarrier::HttpsLanes);
@@ -49,21 +57,340 @@ fn web_config_builds_canonical_runtime_snapshot() {
    assert_eq!(vhost.profiles[0].max_streams_per_session, 16);
    assert_eq!(vhost.profiles[0].key_fingerprint.len(), 16);
    assert_ne!(vhost.profiles[0].key_fingerprint, "0001020304050607");
+    assert!(!vhost.profiles[0].carrier_negotiation_enabled);
+    assert_eq!(
+        vhost.profiles[0].carriers.as_ref(),
+        [WebCarrier::HttpsLanes]
+    );
+}
+
+#[test]
+fn web_base_path_is_canonical_and_precomputed() {
+    let maximum = "a".repeat(128);
+    for base_path in ["a", "a/b/c9_x-y", "Dobry-Cola/super_app", maximum.as_str()] {
+        let configured = WEB_CONFIG.replace(
+            "host = \"Proxy.Example.COM\"",
+            &format!("host = \"Proxy.Example.COM\"\nbase_path = \"{base_path}\""),
+        );
+        let config = load_config_from_temp_toml(&configured);
+        assert_eq!(config.web.vhosts[0].base_path, base_path);
+        assert_eq!(
+            config.web.runtime.as_ref().unwrap().vhosts["proxy.example.com"].base,
+            format!("/{base_path}/")
+        );
+    }
+
+    let strict = format!(
+        "[general]\nconfig_strict = true\n{}",
+        WEB_CONFIG.replace(
+            "host = \"Proxy.Example.COM\"",
+            "host = \"Proxy.Example.COM\"\nbase_path = \"relay\"",
+        )
+    );
+    assert_eq!(
+        load_config_from_temp_toml(&strict).web.vhosts[0].base_path,
+        "relay"
+    );
+}
+
+#[test]
+fn web_base_path_rejects_noncanonical_forms() {
+    let oversized = "a".repeat(129);
+    for base_path in [
+        "/relay",
+        "relay/",
+        "relay//nested",
+        "-relay",
+        "_relay",
+        "a/-lead",
+        "a/_lead",
+        "dot.ted",
+        "..",
+        "/",
+        "relay/.hidden",
+        "relay/%2fhidden",
+        "relay path",
+        "relay/тест",
+        oversized.as_str(),
+    ] {
+        let invalid = WEB_CONFIG.replace(
+            "host = \"Proxy.Example.COM\"",
+            &format!("host = \"Proxy.Example.COM\"\nbase_path = \"{base_path}\""),
+        );
+        assert!(
+            load_config_error_from_temp_toml(&invalid).contains("web.vhosts[0].base_path"),
+            "base path {base_path:?} was accepted"
+        );
+    }
+}
+
+#[test]
+fn web_decoy_fasttrack_mode_is_typed_and_defaults_off() {
+    let defaults = ProxyConfig::default();
+    assert_eq!(
+        defaults.web.decoy_fasttrack_mode,
+        WebDecoyFastTrackMode::Off
+    );
+
+    for (token, expected) in [
+        ("shadow", WebDecoyFastTrackMode::Shadow),
+        ("enforce", WebDecoyFastTrackMode::Enforce),
+    ] {
+        let configured = WEB_CONFIG.replace(
+            "carrier = \"https-lanes\"",
+            &format!("carrier = \"https-lanes\"\ndecoy_fasttrack_mode = \"{token}\""),
+        );
+        let config = load_config_from_temp_toml(&configured);
+        assert_eq!(config.web.decoy_fasttrack_mode, expected);
+        assert_eq!(
+            config.web.runtime.as_ref().unwrap().vhosts["proxy.example.com"].decoy_fasttrack_mode,
+            expected
+        );
+    }
+
+    let invalid = WEB_CONFIG.replace(
+        "carrier = \"https-lanes\"",
+        "carrier = \"https-lanes\"\ndecoy_fasttrack_mode = \"automatic\"",
+    );
+    assert!(load_config_error_from_temp_toml(&invalid).contains("decoy_fasttrack_mode"));
+}
+
+#[test]
+fn web_http_connection_capacity_policy_is_bounded_and_configurable() {
+    let configured = WEB_CONFIG
+        .replace(
+            "carrier = \"https-lanes\"",
+            "carrier = \"https-lanes\"\nhttp_connection_capacity_action = \"wait\"",
+        )
+        .replace(
+            "[[web.vhosts]]",
+            "[web.limits]\nmax_http_overload_connections = 23\n\n[web.timeouts]\nhttp_overload_timeout_ms = 731\n\n[[web.vhosts]]",
+        );
+    let config = load_config_from_temp_toml(&configured);
+
+    assert_eq!(
+        config.web.http_connection_capacity_action,
+        WebHttpConnectionCapacityAction::Wait
+    );
+    assert_eq!(config.web.limits.max_http_overload_connections, 23);
+    assert_eq!(config.web.timeouts.http_overload_timeout_ms, 731);
+
+    let defaults = ProxyConfig::default();
+    assert_eq!(
+        defaults.web.http_connection_capacity_action,
+        WebHttpConnectionCapacityAction::Drop
+    );
+    assert_eq!(defaults.web.limits.max_http_overload_connections, 64);
+    assert_eq!(defaults.web.timeouts.http_overload_timeout_ms, 250);
+}
+
+#[test]
+fn web_http_connection_capacity_policy_rejects_unknown_or_unbounded_values() {
+    let unknown = WEB_CONFIG.replace(
+        "carrier = \"https-lanes\"",
+        "carrier = \"https-lanes\"\nhttp_connection_capacity_action = \"queue\"",
+    );
+    assert!(load_config_error_from_temp_toml(&unknown).contains("http_connection_capacity_action"));
+
+    for timeout in [0, 60_001] {
+        let invalid = WEB_CONFIG.replace(
+            "[[web.vhosts]]",
+            &format!("[web.timeouts]\nhttp_overload_timeout_ms = {timeout}\n\n[[web.vhosts]]"),
+        );
+        assert!(
+            load_config_error_from_temp_toml(&invalid)
+                .contains("web.timeouts.http_overload_timeout_ms")
+        );
+    }
+
+    let no_overload_slots = WEB_CONFIG.replace(
+        "[[web.vhosts]]",
+        "[web.limits]\nmax_http_overload_connections = 0\n\n[[web.vhosts]]",
+    );
+    assert!(
+        load_config_error_from_temp_toml(&no_overload_slots)
+            .contains("web.limits.max_http_overload_connections")
+    );
+}
+
+#[test]
+fn web_decoy_rejects_direct_and_wildcard_listener_loops() {
+    let direct = WEB_CONFIG.replace("http://127.0.0.1:18081", "http://127.0.0.1:18080");
+    assert!(
+        load_config_error_from_temp_toml(&direct).contains("decoy upstream overlaps WEB listener")
+    );
+
+    let wildcard = direct.replace("ip = \"127.0.0.1\"", "ip = \"0.0.0.0\"");
+    assert!(
+        load_config_error_from_temp_toml(&wildcard)
+            .contains("decoy upstream overlaps WEB listener")
+    );
+}
+
+#[test]
+fn web_profile_user_labels_are_bounded_for_runtime_status() {
+    let user = "a".repeat(65);
+    let invalid = WEB_CONFIG.replace("alice", &user);
+
+    assert!(
+        load_config_error_from_temp_toml(&invalid)
+            .contains("web.vhosts[0].profiles[0].user must contain 1..64 bytes")
+    );
+}
+
+#[test]
+fn web_carriers_missing_or_false_disable_negotiation() {
+    let missing = load_config_from_temp_toml(WEB_CONFIG);
+    assert!(!missing.web.carrier_negotiation_enabled());
+    assert!(!missing.web.runtime.unwrap().profiles[0].carrier_learning);
+
+    let disabled = WEB_CONFIG.replace(
+        "carrier = \"https-lanes\"",
+        "carrier = \"https-lanes\"\ncarriers = false",
+    );
+    let disabled = load_config_from_temp_toml(&disabled);
+    assert!(!disabled.web.carrier_negotiation_enabled());
+    assert!(!disabled.web.runtime.as_ref().unwrap().profiles[0].carrier_learning);
+    assert_eq!(
+        disabled.web.runtime.unwrap().profiles[0].carriers.as_ref(),
+        [WebCarrier::HttpsLanes]
+    );
+}
+
+#[test]
+fn web_carrier_array_enables_ordered_negotiation_and_appends_fallback() {
+    let configured = WEB_CONFIG.replace(
+        "carrier = \"https-lanes\"",
+        "carrier = \"https-lanes\"\ncarriers = [\"websocket\", \"https\"]\ncarrier_learning = false",
+    );
+    let config = load_config_from_temp_toml(&configured);
+    assert!(config.web.carrier_negotiation_enabled());
+    assert!(!config.web.carrier_learning);
+    let profile = &config.web.runtime.unwrap().profiles[0];
+    assert_eq!(
+        profile.carriers.as_ref(),
+        [
+            WebCarrier::Websocket,
+            WebCarrier::Https,
+            WebCarrier::HttpsLanes
+        ]
+    );
+    assert!(!profile.carrier_learning);
+}
+
+#[test]
+fn web_carriers_reject_true_empty_and_duplicates() {
+    for value in ["true", "[]", "[\"https\", \"https\"]"] {
+        let invalid = WEB_CONFIG.replace(
+            "carrier = \"https-lanes\"",
+            &format!("carrier = \"https-lanes\"\ncarriers = {value}"),
+        );
+        assert!(load_config_error_from_temp_toml(&invalid).contains("web.carriers"));
+    }
+}
+
+#[test]
+fn web_carrier_and_bridge_deadlines_are_configurable() {
+    let configured = WEB_CONFIG.replace(
+        "[[web.vhosts]]",
+        "[web.timeouts]\ncarrier_negotiation_deadlines_secs = [1, 2, 4, 9]\ncarrier_learning_secs = 30\nbridge_request_secs = 7\nbridge_retry_secs = 41\nbridge_recovery_secs = 13\ncarrier_probe_coalesce_ms = 4\n\n[[web.vhosts]]",
+    );
+    let config = load_config_from_temp_toml(&configured);
+    assert_eq!(
+        config.web.timeouts.carrier_negotiation_deadlines_secs,
+        [1, 2, 4, 9]
+    );
+    assert_eq!(config.web.timeouts.carrier_learning_secs, 30);
+    assert_eq!(config.web.timeouts.bridge_request_secs, 7);
+    assert_eq!(config.web.timeouts.bridge_retry_secs, 41);
+    assert_eq!(config.web.timeouts.bridge_recovery_secs, 13);
+    assert_eq!(config.web.timeouts.carrier_probe_coalesce_ms, 4);
+}
+
+#[test]
+fn web_bridge_deadlines_are_known_in_strict_mode() {
+    let configured = WEB_CONFIG.replace(
+        "[[web.vhosts]]",
+        "[web.timeouts]\nbridge_request_secs = 7\nbridge_retry_secs = 41\nbridge_recovery_secs = 13\ncarrier_probe_coalesce_ms = 4\n\n[[web.vhosts]]",
+    );
+    let configured = format!("[general]\nconfig_strict = true\n{configured}");
+    let config = load_config_from_temp_toml(&configured);
+
+    assert_eq!(config.web.timeouts.bridge_request_secs, 7);
+    assert_eq!(config.web.timeouts.bridge_retry_secs, 41);
+    assert_eq!(config.web.timeouts.bridge_recovery_secs, 13);
+    assert_eq!(config.web.timeouts.carrier_probe_coalesce_ms, 4);
+}
+
+#[test]
+fn web_bridge_deadlines_are_bounded_and_ordered() {
+    for (field, value) in [
+        ("bridge_request_secs", "0"),
+        ("bridge_request_secs", "61"),
+        ("bridge_retry_secs", "0"),
+        ("bridge_retry_secs", "301"),
+        ("bridge_recovery_secs", "0"),
+        ("bridge_recovery_secs", "61"),
+        ("carrier_probe_coalesce_ms", "11"),
+    ] {
+        let invalid = WEB_CONFIG.replace(
+            "[[web.vhosts]]",
+            &format!("[web.timeouts]\n{field} = {value}\n\n[[web.vhosts]]"),
+        );
+        assert!(
+            load_config_error_from_temp_toml(&invalid).contains(&format!("web.timeouts.{field}"))
+        );
+    }
+
+    let reversed = WEB_CONFIG.replace(
+        "[[web.vhosts]]",
+        "[web.timeouts]\nbridge_request_secs = 20\nbridge_retry_secs = 10\n\n[[web.vhosts]]",
+    );
+    assert!(
+        load_config_error_from_temp_toml(&reversed)
+            .contains("bridge_request_secs must not exceed bridge_retry_secs")
+    );
+}
+
+#[test]
+fn web_carrier_learning_capacity_must_remain_nonzero() {
+    let invalid = WEB_CONFIG.replace(
+        "[[web.vhosts]]",
+        "[web.limits]\nmax_carrier_learning_entries = 0\n\n[[web.vhosts]]",
+    );
+    assert!(
+        load_config_error_from_temp_toml(&invalid)
+            .contains("web.limits.max_carrier_learning_entries")
+    );
 }

 #[test]
 fn web_debug_table_uses_debug_name_and_bounded_defaults() {
+    assert!(!crate::config::WebDebugConfig::default().sideband);
+    let mut ineffective = crate::config::WebDebugConfig {
+        enabled: true,
+        sideband: true,
+        ..Default::default()
+    };
+    ineffective.capture_lifecycle = false;
+    assert!(!ineffective.bridge_diagnostics_enabled());
+
    let configured = WEB_CONFIG.replace(
        "[[web.vhosts]]",
-        "[web.debug]\nenabled = true\nbody_capture = \"prefix\"\nbody_prefix_bytes = 2048\ndefault_window_secs = 180\nmax_window_secs = 900\n\n[[web.vhosts]]",
+        "[web.debug]\nenabled = true\nsideband = true\nbody_capture = \"prefix\"\nbody_prefix_bytes = 2048\ndefault_window_secs = 180\nmax_window_secs = 900\n\n[[web.vhosts]]",
    );
    let config = load_config_from_temp_toml(&configured);
    assert!(config.web.debug.enabled);
+    assert!(config.web.debug.sideband);
+    assert!(config.web.debug.bridge_diagnostics_enabled());
    assert_eq!(config.web.debug.body_capture, WebDebugBodyCapture::Prefix);
    assert_eq!(config.web.debug.body_prefix_bytes, 2048);
    assert_eq!(config.web.debug.default_window_secs, 180);
    assert_eq!(config.web.debug.max_window_secs, 900);

+    let strict = format!("[general]\nconfig_strict = true\n{configured}");
+    assert!(load_config_from_temp_toml(&strict).web.debug.sideband);
+
    let old_name = format!(
        "[general]\nconfig_strict = true\n{}",
        WEB_CONFIG.replace(
@@ -73,6 +400,16 @@ fn web_debug_table_uses_debug_name_and_bounded_defaults() {
    );
    let error = load_config_error_from_temp_toml(&old_name);
    assert!(error.contains("web.trace"));
+
+    let old_parameter = format!(
+        "[general]\nconfig_strict = true\n{}",
+        WEB_CONFIG.replace(
+            "[[web.vhosts]]",
+            "[web.debug]\nbridge_diagnostics = true\n\n[[web.vhosts]]",
+        )
+    );
+    let error = load_config_error_from_temp_toml(&old_parameter);
+    assert!(error.contains("web.debug.bridge_diagnostics"));
 }

 #[test]
@@ -106,7 +443,7 @@ fn https_lanes_requires_separate_poll_and_control_handler_capacity() {
        "carrier = \"https-lanes\"\n\n[web.limits]\nmax_http_handlers = 1\nmax_body_readers = 1",
    );
    let error = load_config_error_from_temp_toml(&invalid);
-    assert!(error.contains("web.carrier=https-lanes requires"));
+    assert!(error.contains("WEB https-lanes candidates require"));
 }

 #[test]
@@ -0,0 +1,33 @@
+use super::*;
+
+#[test]
+fn web_runtime_collects_every_vhost_capability() {
+    let configured = format!(
+        "{WEB_CONFIG}\n{}",
+        r#"
+[[web.vhosts]]
+host = "Other.Example.COM"
+base_path = "other/path"
+public_addr = "203.0.113.11:443"
+
+[web.vhosts.decoy]
+mode = "http_upstream"
+upstream = "http://127.0.0.1:18082"
+
+[[web.vhosts.profiles]]
+user = "alice"
+secret_mode = "dd"
+"#
+    );
+    let config = load_config_from_temp_toml(&configured);
+    let runtime = config.web.runtime.as_ref().unwrap();
+    let first = &runtime.vhosts["proxy.example.com"];
+    let second = &runtime.vhosts["other.example.com"];
+
+    assert_eq!(runtime.capabilities.len(), 2);
+    assert_eq!(first.capabilities[0], first.profiles[0].capability);
+    assert_eq!(second.capabilities[0], second.profiles[0].capability);
+    assert_ne!(first.capabilities[0], second.capabilities[0]);
+    assert!(runtime.capabilities.contains(&first.capabilities[0]));
+    assert!(runtime.capabilities.contains(&second.capabilities[0]));
+}
@@ -24,12 +24,14 @@ mod network;
 mod policies;
 mod server;
 mod web;
+// WEB carrier tokens and fixed-slot policy helpers remain independent from bulky config types.
+mod web_carrier;
 // WEB debug capture policy is reusable by config reload and process storage.
 mod web_debug;

 pub use access::{AccessConfig, CidrRateLimitKey, RateLimitBps};
 #[allow(unused_imports)]
-pub(crate) use access::{CidrAutoTemplate, CidrAutoTemplateFamily};
+pub(crate) use access::{CidrAutoTemplate, CidrAutoTemplateFamily, MAX_RATE_LIMIT_BPS};
 pub use api::{ApiConfig, ApiGrayAction};
 pub use censorship::{
    AntiCensorshipConfig, ExclusiveMaskTarget, TlsFetchConfig, TlsFetchProfile, UnknownSniAction,
@@ -51,13 +53,17 @@ pub use server::{
 };
 #[allow(unused_imports)]
 pub use web::{
-    WebCarrier, WebConfig, WebDecoyConfig, WebLimitsConfig, WebProfileConfig, WebSecretMode,
+    WebCarrierNegotiationAggressiveness, WebConfig, WebDecoyConfig, WebDecoyFastTrackMode,
+    WebHttpConnectionCapacityAction, WebLimitsConfig, WebProfileConfig, WebSecretMode,
    WebTimeoutsConfig, WebVhostConfig,
 };
 pub(crate) use web::{
    WebRuntimeConfig, WebRuntimeDecoy, WebRuntimeProfile, WebRuntimeVhost, WebStaticAsset,
    WebStaticSite,
 };
+pub(crate) use web_carrier::WEB_CARRIER_LEARNING_MIN_ENTRIES;
+#[allow(unused_imports)]
+pub use web_carrier::{WebCarrier, WebCarriers};
 pub(crate) use web_debug::web_debug_fits_limits;
 pub use web_debug::{WebDebugBodyCapture, WebDebugConfig};

@@ -1,5 +1,8 @@
 use super::*;

+/// Highest rate that fits one packed 20 ms shaping epoch.
+pub(crate) const MAX_RATE_LIMIT_BPS: u64 = 100_000_000_000;
+
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct AccessConfig {
    #[serde(default = "default_access_users")]
@@ -260,10 +263,10 @@ fn parse_cidr_auto_prefix(
 /// Transport rate limit in bits-per-second.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct RateLimitBps {
-    /// Upload direction limit in bits-per-second; `0` means unlimited.
+    /// Upload limit in bits-per-second within `0..=100_000_000_000`; `0` means unlimited.
    #[serde(default)]
    pub up_bps: u64,
-    /// Download direction limit in bits-per-second; `0` means unlimited.
+    /// Download limit in bits-per-second within `0..=100_000_000_000`; `0` means unlimited.
    #[serde(default)]
    pub down_bps: u64,
 }
@@ -441,6 +441,9 @@ pub struct GeneralConfig {
    /// Serialize ME reinit cycles across all trigger sources.
    #[serde(default = "default_me_reinit_singleflight")]
    pub me_reinit_singleflight: bool,
+    /// Maximum concurrent ME reinit warmups when single-flight mode is disabled.
+    #[serde(default = "default_me_reinit_max_concurrency")]
+    pub me_reinit_max_concurrency: usize,
    /// Trigger queue capacity for reinit scheduler.
    #[serde(default = "default_me_reinit_trigger_channel")]
    pub me_reinit_trigger_channel: usize,
@@ -159,6 +159,7 @@ impl Default for GeneralConfig {
            proxy_secret_auto_reload_secs: default_proxy_secret_reload_secs(),
            proxy_config_auto_reload_secs: default_proxy_config_reload_secs(),
            me_reinit_singleflight: default_me_reinit_singleflight(),
+            me_reinit_max_concurrency: default_me_reinit_max_concurrency(),
            me_reinit_trigger_channel: default_me_reinit_trigger_channel(),
            me_reinit_coalesce_window_ms: default_me_reinit_coalesce_window_ms(),
            me_deterministic_writer_sort: default_me_deterministic_writer_sort(),
@@ -6,8 +6,19 @@ use std::sync::Arc;
 use bytes::Bytes;
 use serde::{Deserialize, Serialize};

+use super::web_carrier::{WebCarrier, WebCarriers};
 use super::web_debug::WebDebugConfig;

+// Serialized WEB defaults remain separate from the runtime data model.
+mod defaults;
+use defaults::*;
+// Decoy fast-track policy remains isolated from the bulky WEB data model.
+mod fasttrack;
+pub use fasttrack::WebDecoyFastTrackMode;
+// Accepted-socket overload policy remains separate from the bulky WEB data model.
+mod overload;
+pub use overload::WebHttpConnectionCapacityAction;
+
 /// Client-facing secret representation used to derive a WEB capability.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
@@ -18,48 +29,6 @@ pub enum WebSecretMode {
    Dd,
 }

-/// Carrier selected for newly issued WEB bridge sessions.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "kebab-case")]
-pub enum WebCarrier {
-    /// Serialize all logical streams through one uplink and one downlink sequence.
-    #[default]
-    Https,
-    /// Give every logical stream independent HTTPS sequencing and polling state.
-    HttpsLanes,
-    /// Multiplex all logical streams over one ordered WebSocket.
-    Websocket,
-    /// Give every logical stream an independently owned WebSocket lane.
-    WebsocketLanes,
-}
-
-impl WebCarrier {
-    /// Returns the exact carrier token advertised to the browser bridge.
-    pub(crate) const fn as_str(self) -> &'static str {
-        match self {
-            Self::Https => "https",
-            Self::HttpsLanes => "https-lanes",
-            Self::Websocket => "websocket",
-            Self::WebsocketLanes => "websocket-lanes",
-        }
-    }
-
-    /// Returns whether one carrier owns independent state per logical stream.
-    pub(crate) const fn uses_lanes(self) -> bool {
-        matches!(self, Self::HttpsLanes | Self::WebsocketLanes)
-    }
-
-    /// Returns whether carrier messages use RFC 6455 instead of HTTP bodies.
-    pub(crate) const fn uses_websocket(self) -> bool {
-        matches!(self, Self::Websocket | Self::WebsocketLanes)
-    }
-
-    /// Returns whether all logical streams share one carrier state machine.
-    pub(crate) const fn is_multiplexed(self) -> bool {
-        matches!(self, Self::Https | Self::Websocket)
-    }
-}
-
 /// One access user explicitly exposed through a WEB virtual host.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WebProfileConfig {
@@ -102,6 +71,9 @@ pub enum WebDecoyConfig {
 pub struct WebVhostConfig {
    /// Canonical lowercase ACE hostname used by Telegram Desktop.
    pub host: String,
+    /// Optional canonical WEB endpoint prefix without surrounding slashes.
+    #[serde(default)]
+    pub base_path: String,
    /// Stable public destination tuple used by inner relay routing and KDF metadata.
    pub public_addr: SocketAddr,
    /// Ordinary-site fallback for this hostname.
@@ -132,9 +104,21 @@ pub struct WebLimitsConfig {
    /// Process-wide accepted WEB HTTP connection ceiling.
    #[serde(default = "default_web_max_http_connections")]
    pub max_http_connections: usize,
+    /// Accepted overload sockets allowed to wait or emit a retryable response.
+    #[serde(default = "default_web_max_http_overload_connections")]
+    pub max_http_overload_connections: usize,
    /// Process-wide concurrently executing HTTP handler ceiling.
    #[serde(default = "default_web_max_http_handlers")]
    pub max_http_handlers: usize,
+    /// Per-session ceiling for downlink polls waiting for a lane OPEN.
+    #[serde(default = "default_web_max_lane_open_waits_per_session")]
+    pub max_lane_open_waits_per_session: usize,
+    /// Queued and resident DATA bytes allowed for one independent lane.
+    #[serde(default = "default_web_pending_bytes_per_lane")]
+    pub pending_bytes_per_lane: usize,
+    /// Queued and resident DATA items allowed for one independent lane.
+    #[serde(default = "default_web_pending_items_per_lane")]
+    pub pending_items_per_lane: usize,
    /// Process-wide transient WebSocket byte sub-budget inside pending bytes.
    #[serde(default = "default_web_websocket_bytes_global")]
    pub websocket_bytes_global: usize,
@@ -147,6 +131,12 @@ pub struct WebLimitsConfig {
    /// Accepted HTTP connections that WebSocket upgrades must leave available.
    #[serde(default = "default_web_websocket_http_connection_reserve")]
    pub websocket_http_connection_reserve: usize,
+    /// Concurrent pressure-eviction claims allowed process-wide.
+    #[serde(default = "default_web_max_websocket_evictions_in_flight")]
+    pub max_websocket_evictions_in_flight: usize,
+    /// Process-wide bounded carrier-learning evidence entry ceiling.
+    #[serde(default = "default_web_max_carrier_learning_entries")]
+    pub max_carrier_learning_entries: usize,
    /// Process-wide concurrently collected request body ceiling.
    #[serde(default = "default_web_max_body_readers")]
    pub max_body_readers: usize,
@@ -216,7 +206,7 @@ pub struct WebLimitsConfig {
    /// Process-wide retained and in-flight WEB debug byte ceiling.
    #[serde(default = "default_web_debug_bytes_global")]
    pub debug_bytes_global: usize,
-    /// Declared process envelope for HTTP heads, bodies, queues, and static snapshots.
+    /// Declared process envelope for HTTP, queues, capabilities, learning, and static snapshots.
    #[serde(default = "default_web_memory_envelope_bytes")]
    pub memory_envelope_bytes: usize,
    /// Sustained process-wide bootstrap issuance rate.
@@ -248,11 +238,17 @@ impl Default for WebLimitsConfig {
            carrier_batch_bytes: default_web_carrier_batch_bytes(),
            max_frames_per_body: default_web_max_frames_per_body(),
            max_http_connections: default_web_max_http_connections(),
+            max_http_overload_connections: default_web_max_http_overload_connections(),
            max_http_handlers: default_web_max_http_handlers(),
+            max_lane_open_waits_per_session: default_web_max_lane_open_waits_per_session(),
+            pending_bytes_per_lane: default_web_pending_bytes_per_lane(),
+            pending_items_per_lane: default_web_pending_items_per_lane(),
            websocket_bytes_global: default_web_websocket_bytes_global(),
            websocket_admission_watermark_pct: default_web_websocket_admission_watermark_pct(),
            websocket_eviction_watermark_pct: default_web_websocket_eviction_watermark_pct(),
            websocket_http_connection_reserve: default_web_websocket_http_connection_reserve(),
+            max_websocket_evictions_in_flight: default_web_max_websocket_evictions_in_flight(),
+            max_carrier_learning_entries: default_web_max_carrier_learning_entries(),
            max_body_readers: default_web_max_body_readers(),
            max_body_bytes_global: default_web_max_body_bytes_global(),
            max_sessions_global: default_web_max_sessions_global(),
@@ -299,9 +295,36 @@ pub struct WebTimeoutsConfig {
    /// Deadline from the first inner byte through MTProxy authentication.
    #[serde(default = "default_web_stream_handshake_timeout_secs")]
    pub stream_handshake_secs: u64,
+    /// Absolute deadline for receiving the first inner MTProxy byte.
+    #[serde(default = "default_web_stream_first_byte_secs")]
+    pub stream_first_byte_secs: u64,
    /// Maximum wait for one empty downlink long poll.
    #[serde(default = "default_web_long_poll_timeout_secs")]
    pub long_poll_secs: u64,
+    /// Deadline for one generated-bridge HTTP attempt and response body.
+    #[serde(default = "default_web_bridge_request_secs")]
+    pub bridge_request_secs: u64,
+    /// Absolute generated-bridge budget for one retryable HTTP operation.
+    #[serde(default = "default_web_bridge_retry_secs")]
+    pub bridge_retry_secs: u64,
+    /// Absolute post-commit budget for one surviving bridge recovery epoch.
+    #[serde(default = "default_web_bridge_recovery_secs")]
+    pub bridge_recovery_secs: u64,
+    /// Optional delay for coalescing the first OPEN with immediate DATA.
+    #[serde(default = "default_web_carrier_probe_coalesce_ms")]
+    pub carrier_probe_coalesce_ms: u64,
+    /// Grace for a canonical downlink poll that races its lane OPEN.
+    #[serde(default = "default_web_lane_open_wait_secs")]
+    pub lane_open_wait_secs: u64,
+    /// Post-commit observation interval required before learning succeeds.
+    #[serde(default = "default_web_carrier_health_secs")]
+    pub carrier_health_secs: u64,
+    /// Maximum wait for Hyper to transfer an accepted WebSocket upgrade.
+    #[serde(default = "default_web_websocket_upgrade_secs")]
+    pub websocket_upgrade_secs: u64,
+    /// Absolute deadline for the first carrier binary message after upgrade.
+    #[serde(default = "default_web_websocket_open_secs")]
+    pub websocket_open_secs: u64,
    /// Maximum wait for one WebSocket write to complete.
    #[serde(default = "default_web_websocket_write_secs")]
    pub websocket_write_secs: u64,
@@ -311,15 +334,24 @@ pub struct WebTimeoutsConfig {
    /// Maximum graceful close wait for an evicted WebSocket.
    #[serde(default = "default_web_websocket_eviction_secs")]
    pub websocket_eviction_secs: u64,
+    /// Cumulative carrier-attempt deadlines for up to four unique candidates.
+    #[serde(default = "default_web_carrier_negotiation_deadlines_secs")]
+    pub carrier_negotiation_deadlines_secs: [u64; 4],
+    /// Fixed process-local carrier-learning evidence lifetime.
+    #[serde(default = "default_web_carrier_learning_secs")]
+    pub carrier_learning_secs: u64,
    /// Lifetime of an unused bootstrap credential and closed-token replay marker.
    #[serde(default = "default_web_bootstrap_lifetime_secs")]
    pub bootstrap_lifetime_secs: u64,
-    /// Maximum carrier inactivity before a session is closed.
+    /// Maximum validated peer inactivity before a session is closed.
    #[serde(default = "default_web_reconnect_grace_secs")]
    pub reconnect_grace_secs: u64,
    /// Maximum idle lifetime of a WEB HTTP keep-alive connection.
    #[serde(default = "default_web_http_idle_secs")]
    pub http_idle_secs: u64,
+    /// Per-phase wait or response deadline for accepted HTTP overload sockets.
+    #[serde(default = "default_web_http_overload_timeout_ms")]
+    pub http_overload_timeout_ms: u64,
    /// Maximum graceful wait for WEB connections and process-owned tasks.
    #[serde(default = "default_web_shutdown_secs")]
    pub shutdown_secs: u64,
@@ -334,28 +366,68 @@ impl Default for WebTimeoutsConfig {
            header_secs: default_web_header_timeout_secs(),
            body_secs: default_web_body_timeout_secs(),
            stream_handshake_secs: default_web_stream_handshake_timeout_secs(),
+            stream_first_byte_secs: default_web_stream_first_byte_secs(),
            long_poll_secs: default_web_long_poll_timeout_secs(),
+            bridge_request_secs: default_web_bridge_request_secs(),
+            bridge_retry_secs: default_web_bridge_retry_secs(),
+            bridge_recovery_secs: default_web_bridge_recovery_secs(),
+            carrier_probe_coalesce_ms: default_web_carrier_probe_coalesce_ms(),
+            lane_open_wait_secs: default_web_lane_open_wait_secs(),
+            carrier_health_secs: default_web_carrier_health_secs(),
+            websocket_upgrade_secs: default_web_websocket_upgrade_secs(),
+            websocket_open_secs: default_web_websocket_open_secs(),
            websocket_write_secs: default_web_websocket_write_secs(),
            websocket_backpressure_secs: default_web_websocket_backpressure_secs(),
            websocket_eviction_secs: default_web_websocket_eviction_secs(),
+            carrier_negotiation_deadlines_secs: default_web_carrier_negotiation_deadlines_secs(),
+            carrier_learning_secs: default_web_carrier_learning_secs(),
            bootstrap_lifetime_secs: default_web_bootstrap_lifetime_secs(),
            reconnect_grace_secs: default_web_reconnect_grace_secs(),
            http_idle_secs: default_web_http_idle_secs(),
+            http_overload_timeout_ms: default_web_http_overload_timeout_ms(),
            shutdown_secs: default_web_shutdown_secs(),
            decoy_header_secs: default_web_decoy_header_timeout_secs(),
        }
    }
 }

+/// Sensitivity of process-local carrier-learning evidence.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum WebCarrierNegotiationAggressiveness {
+    /// Require broad evidence and never rank by client IP.
+    #[default]
+    Conservative,
+    /// Use moderate User-Agent, client-IP, and profile thresholds.
+    Balanced,
+    /// React to the first bounded evidence sample.
+    Aggressive,
+}
+
 /// WEB ingress, carrier, fallback, and lifecycle configuration.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct WebConfig {
    /// Enables issuance of new WEB bridge and session credentials.
    #[serde(default)]
    pub enabled: bool,
-    /// Carrier selected for newly issued WEB bridge sessions.
+    /// Sole carrier when negotiation is disabled and final fallback when enabled.
    #[serde(default)]
    pub carrier: WebCarrier,
+    /// Ordered carriers considered by server-side negotiation before the fallback carrier.
+    #[serde(default)]
+    pub carriers: WebCarriers,
+    /// Enables bounded process-local carrier learning for automatic sessions.
+    #[serde(default = "default_web_carrier_learning")]
+    pub carrier_learning: bool,
+    /// Controls the evidence thresholds used by automatic carrier ranking.
+    #[serde(default)]
+    pub carrier_negotiation_aggressiveness: WebCarrierNegotiationAggressiveness,
+    /// Restart-only capability-scan policy for structurally impossible bridge requests.
+    #[serde(default)]
+    pub decoy_fasttrack_mode: WebDecoyFastTrackMode,
+    /// Action applied when accepted HTTP connection capacity is exhausted.
+    #[serde(default)]
+    pub http_connection_capacity_action: WebHttpConnectionCapacityAction,
    /// Hard process and protocol limits.
    #[serde(default)]
    pub limits: WebLimitsConfig,
@@ -373,166 +445,49 @@ pub struct WebConfig {
    pub(crate) runtime: Option<Arc<WebRuntimeConfig>>,
 }

-/// Precomputed WEB configuration consumed by listener hot paths.
-#[derive(Debug)]
-pub(crate) struct WebRuntimeConfig {
-    /// Canonical host lookup used by HTTP request routing.
-    pub(crate) vhosts: BTreeMap<String, Arc<WebRuntimeVhost>>,
-    /// Flat profile inventory used by startup link emission.
-    pub(crate) profiles: Vec<Arc<WebRuntimeProfile>>,
+impl WebConfig {
+    /// Returns the configured negotiation order with the fallback appended once.
+    pub(crate) fn carrier_candidates(&self) -> Vec<WebCarrier> {
+        let Some(configured) = self.carriers.enabled() else {
+            return vec![self.carrier];
+        };
+        let mut candidates = configured
+            .iter()
+            .copied()
+            .filter(|carrier| *carrier != self.carrier)
+            .collect::<Vec<_>>();
+        candidates.push(self.carrier);
+        candidates
+    }
+
+    /// Returns whether the explicit candidate list enables auto-negotiation.
+    pub(crate) fn carrier_negotiation_enabled(&self) -> bool {
+        self.carriers.enabled().is_some()
+    }
 }

-/// Precomputed immutable virtual-host data.
-#[derive(Debug)]
-pub(crate) struct WebRuntimeVhost {
-    /// Canonical lowercase ACE hostname.
-    pub(crate) host: String,
-    /// Immutable ordinary-site fallback snapshot.
-    pub(crate) decoy: WebRuntimeDecoy,
-    /// Upstream connect and response-head deadline.
-    pub(crate) decoy_header_secs: u64,
-    /// Exact capability profiles accepted by this host.
-    pub(crate) profiles: Vec<Arc<WebRuntimeProfile>>,
-}
-
-/// Precomputed exact-user capability entry.
-#[derive(Debug)]
-pub(crate) struct WebRuntimeProfile {
-    /// Canonical host that owns this profile.
-    pub(crate) host: String,
-    /// Stable public destination tuple supplied to relay routing.
-    pub(crate) public_addr: SocketAddr,
-    /// Exact access user authenticated by logical streams.
-    pub(crate) user: String,
-    /// Client secret representation and inner protocol policy.
-    pub(crate) secret_mode: WebSecretMode,
-    /// Carrier frozen into bridge and session state at issuance time.
-    pub(crate) carrier: WebCarrier,
-    /// HMAC-derived bridge capability.
-    pub(crate) capability: [u8; 32],
-    /// Non-secret domain-separated client-secret fingerprint for debugging.
-    pub(crate) key_fingerprint: String,
-    /// Per-profile live session ceiling.
-    pub(crate) max_sessions: usize,
-    /// Per-profile live logical-stream ceiling.
-    pub(crate) max_streams: usize,
-    /// Per-session live relay-task ceiling.
-    pub(crate) max_streams_per_session: usize,
-}
-
-/// Runtime-ready ordinary-site fallback.
-#[derive(Debug)]
-pub(crate) enum WebRuntimeDecoy {
-    HttpUpstream { addr: SocketAddr, authority: String },
-    StaticDirectory(Arc<WebStaticSite>),
-}
-
-/// Immutable bounded static-site snapshot.
-#[derive(Debug)]
-pub(crate) struct WebStaticSite {
-    /// Canonical URL-path to immutable response asset mapping.
-    pub(crate) assets: BTreeMap<String, WebStaticAsset>,
-    /// Configured root index file name.
-    pub(crate) index: String,
-}
-
-/// One immutable static response body and metadata.
-#[derive(Debug)]
-pub(crate) struct WebStaticAsset {
-    /// Immutable response body retained by the runtime snapshot.
-    pub(crate) body: Bytes,
-    /// Extension-derived static content type.
-    pub(crate) content_type: &'static str,
-    /// Strong SHA-256 entity tag.
-    pub(crate) etag: String,
-}
-
-fn default_web_static_index() -> String {
-    "index.html".to_string()
-}
-
-macro_rules! usize_default {
-    ($name:ident, $value:expr) => {
-        fn $name() -> usize {
-            $value
+impl Default for WebConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            carrier: WebCarrier::default(),
+            carriers: WebCarriers::default(),
+            carrier_learning: default_web_carrier_learning(),
+            carrier_negotiation_aggressiveness: WebCarrierNegotiationAggressiveness::default(),
+            decoy_fasttrack_mode: WebDecoyFastTrackMode::default(),
+            http_connection_capacity_action: WebHttpConnectionCapacityAction::default(),
+            limits: WebLimitsConfig::default(),
+            debug: WebDebugConfig::default(),
+            timeouts: WebTimeoutsConfig::default(),
+            vhosts: Vec::new(),
+            runtime: None,
        }
-    };
+    }
 }

-macro_rules! u32_default {
-    ($name:ident, $value:expr) => {
-        fn $name() -> u32 {
-            $value
-        }
-    };
-}
-
-macro_rules! u8_default {
-    ($name:ident, $value:expr) => {
-        fn $name() -> u8 {
-            $value
-        }
-    };
-}
-
-macro_rules! u64_default {
-    ($name:ident, $value:expr) => {
-        fn $name() -> u64 {
-            $value
-        }
-    };
-}
-
-usize_default!(default_web_max_header_bytes, 16 * 1024);
-usize_default!(default_web_max_body_bytes, 2 * 1024 * 1024);
-usize_default!(default_web_max_frame_payload_bytes, 1024 * 1024);
-usize_default!(default_web_carrier_batch_bytes, 2 * 1024 * 1024);
-usize_default!(default_web_max_frames_per_body, 4096);
-usize_default!(default_web_max_http_connections, 1024);
-usize_default!(default_web_max_http_handlers, 512);
-usize_default!(default_web_websocket_bytes_global, 256 * 1024 * 1024);
-u8_default!(default_web_websocket_admission_watermark_pct, 75);
-u8_default!(default_web_websocket_eviction_watermark_pct, 90);
-usize_default!(default_web_websocket_http_connection_reserve, 64);
-usize_default!(default_web_max_body_readers, 32);
-usize_default!(default_web_max_body_bytes_global, 64 * 1024 * 1024);
-usize_default!(default_web_max_sessions_global, 128);
-usize_default!(default_web_max_sessions_per_ip, 16);
-usize_default!(default_web_max_streams_per_session, 128);
-usize_default!(default_web_max_streams_global, 4096);
-usize_default!(default_web_max_stream_handshakes, 256);
-usize_default!(default_web_max_tombstones, 4096);
-usize_default!(default_web_pending_bytes_per_session, 32 * 1024 * 1024);
-usize_default!(default_web_pending_bytes_global, 512 * 1024 * 1024);
-usize_default!(default_web_pending_items_per_session, 16 * 1024);
-usize_default!(default_web_pending_items_global, 256 * 1024);
-usize_default!(default_web_control_bytes_per_session, 256 * 1024);
-usize_default!(default_web_control_bytes_global, 16 * 1024 * 1024);
-usize_default!(default_web_max_bootstraps_global, 512);
-usize_default!(default_web_max_bootstraps_per_ip, 64);
-usize_default!(default_web_max_vhosts, 8);
-usize_default!(default_web_max_profiles, 32);
-usize_default!(default_web_max_static_files, 4096);
-usize_default!(default_web_max_static_file_bytes, 8 * 1024 * 1024);
-usize_default!(default_web_max_static_bytes, 64 * 1024 * 1024);
-usize_default!(default_web_debug_records_capacity, 65_536);
-usize_default!(default_web_debug_bytes_global, 64 * 1024 * 1024);
-usize_default!(default_web_memory_envelope_bytes, 768 * 1024 * 1024);
-u32_default!(default_web_new_bootstraps_per_minute, 1200);
-u32_default!(default_web_new_bootstraps_burst, 256);
-u32_default!(default_web_new_sessions_per_minute, 600);
-u32_default!(default_web_new_sessions_burst, 128);
-u32_default!(default_web_new_streams_per_minute, 6000);
-u32_default!(default_web_new_streams_burst, 512);
-u64_default!(default_web_header_timeout_secs, 10);
-u64_default!(default_web_body_timeout_secs, 30);
-u64_default!(default_web_stream_handshake_timeout_secs, 10);
-u64_default!(default_web_long_poll_timeout_secs, 25);
-u64_default!(default_web_websocket_write_secs, 30);
-u64_default!(default_web_websocket_backpressure_secs, 30);
-u64_default!(default_web_websocket_eviction_secs, 1);
-u64_default!(default_web_bootstrap_lifetime_secs, 120);
-u64_default!(default_web_reconnect_grace_secs, 120);
-u64_default!(default_web_http_idle_secs, 75);
-u64_default!(default_web_shutdown_secs, 15);
-u64_default!(default_web_decoy_header_timeout_secs, 30);
+// Immutable runtime WEB configuration consumed by hot paths.
+mod runtime;
+pub(crate) use runtime::{
+    WebRuntimeConfig, WebRuntimeDecoy, WebRuntimeProfile, WebRuntimeVhost, WebStaticAsset,
+    WebStaticSite,
+};
@@ -0,0 +1,112 @@
+pub(super) fn default_web_static_index() -> String {
+    "index.html".to_string()
+}
+
+macro_rules! usize_default {
+    ($name:ident, $value:expr) => {
+        pub(super) fn $name() -> usize {
+            $value
+        }
+    };
+}
+
+macro_rules! u32_default {
+    ($name:ident, $value:expr) => {
+        pub(super) fn $name() -> u32 {
+            $value
+        }
+    };
+}
+
+macro_rules! u8_default {
+    ($name:ident, $value:expr) => {
+        pub(super) fn $name() -> u8 {
+            $value
+        }
+    };
+}
+
+macro_rules! u64_default {
+    ($name:ident, $value:expr) => {
+        pub(super) fn $name() -> u64 {
+            $value
+        }
+    };
+}
+
+usize_default!(default_web_max_header_bytes, 16 * 1024);
+usize_default!(default_web_max_body_bytes, 2 * 1024 * 1024);
+usize_default!(default_web_max_frame_payload_bytes, 1024 * 1024);
+usize_default!(default_web_carrier_batch_bytes, 2 * 1024 * 1024);
+usize_default!(default_web_max_frames_per_body, 4096);
+usize_default!(default_web_max_http_connections, 1024);
+usize_default!(default_web_max_http_overload_connections, 64);
+usize_default!(default_web_max_http_handlers, 512);
+usize_default!(default_web_max_lane_open_waits_per_session, 16);
+usize_default!(default_web_pending_bytes_per_lane, 8 * 1024 * 1024);
+usize_default!(default_web_pending_items_per_lane, 1024);
+usize_default!(default_web_websocket_bytes_global, 256 * 1024 * 1024);
+u8_default!(default_web_websocket_admission_watermark_pct, 75);
+u8_default!(default_web_websocket_eviction_watermark_pct, 90);
+usize_default!(default_web_websocket_http_connection_reserve, 64);
+usize_default!(default_web_max_websocket_evictions_in_flight, 8);
+usize_default!(default_web_max_carrier_learning_entries, 4096);
+usize_default!(default_web_max_body_readers, 32);
+usize_default!(default_web_max_body_bytes_global, 64 * 1024 * 1024);
+usize_default!(default_web_max_sessions_global, 128);
+usize_default!(default_web_max_sessions_per_ip, 16);
+usize_default!(default_web_max_streams_per_session, 128);
+usize_default!(default_web_max_streams_global, 4096);
+usize_default!(default_web_max_stream_handshakes, 256);
+usize_default!(default_web_max_tombstones, 4096);
+usize_default!(default_web_pending_bytes_per_session, 32 * 1024 * 1024);
+usize_default!(default_web_pending_bytes_global, 512 * 1024 * 1024);
+usize_default!(default_web_pending_items_per_session, 16 * 1024);
+usize_default!(default_web_pending_items_global, 256 * 1024);
+usize_default!(default_web_control_bytes_per_session, 256 * 1024);
+usize_default!(default_web_control_bytes_global, 16 * 1024 * 1024);
+usize_default!(default_web_max_bootstraps_global, 512);
+usize_default!(default_web_max_bootstraps_per_ip, 64);
+usize_default!(default_web_max_vhosts, 8);
+usize_default!(default_web_max_profiles, 32);
+usize_default!(default_web_max_static_files, 4096);
+usize_default!(default_web_max_static_file_bytes, 8 * 1024 * 1024);
+usize_default!(default_web_max_static_bytes, 64 * 1024 * 1024);
+usize_default!(default_web_debug_records_capacity, 65_536);
+usize_default!(default_web_debug_bytes_global, 64 * 1024 * 1024);
+usize_default!(default_web_memory_envelope_bytes, 1280 * 1024 * 1024);
+u32_default!(default_web_new_bootstraps_per_minute, 1200);
+u32_default!(default_web_new_bootstraps_burst, 256);
+u32_default!(default_web_new_sessions_per_minute, 600);
+u32_default!(default_web_new_sessions_burst, 128);
+u32_default!(default_web_new_streams_per_minute, 6000);
+u32_default!(default_web_new_streams_burst, 512);
+u64_default!(default_web_header_timeout_secs, 10);
+u64_default!(default_web_body_timeout_secs, 30);
+u64_default!(default_web_stream_handshake_timeout_secs, 10);
+u64_default!(default_web_stream_first_byte_secs, 30);
+u64_default!(default_web_long_poll_timeout_secs, 25);
+u64_default!(default_web_bridge_request_secs, 10);
+u64_default!(default_web_bridge_retry_secs, 90);
+u64_default!(default_web_bridge_recovery_secs, 15);
+u64_default!(default_web_carrier_probe_coalesce_ms, 0);
+u64_default!(default_web_lane_open_wait_secs, 2);
+u64_default!(default_web_carrier_health_secs, 30);
+u64_default!(default_web_websocket_upgrade_secs, 5);
+u64_default!(default_web_websocket_open_secs, 15);
+u64_default!(default_web_websocket_write_secs, 30);
+u64_default!(default_web_websocket_backpressure_secs, 30);
+u64_default!(default_web_websocket_eviction_secs, 1);
+pub(super) fn default_web_carrier_negotiation_deadlines_secs() -> [u64; 4] {
+    [3, 5, 8, 12]
+}
+u64_default!(default_web_carrier_learning_secs, 600);
+pub(super) fn default_web_carrier_learning() -> bool {
+    true
+}
+u64_default!(default_web_bootstrap_lifetime_secs, 120);
+u64_default!(default_web_reconnect_grace_secs, 120);
+u64_default!(default_web_http_idle_secs, 75);
+u64_default!(default_web_http_overload_timeout_ms, 250);
+u64_default!(default_web_shutdown_secs, 15);
+u64_default!(default_web_decoy_header_timeout_secs, 30);
@@ -0,0 +1,28 @@
+use serde::{Deserialize, Serialize};
+
+/// Capability-scan policy for structurally impossible WEB bridge requests.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum WebDecoyFastTrackMode {
+    /// Preserve the legacy full scan without collecting fast-track decisions.
+    #[default]
+    Off,
+    /// Record eligible requests while preserving the legacy full scan.
+    Shadow,
+    /// Skip the scan only when the public request shape cannot open a bridge.
+    Enforce,
+}
+
+impl WebDecoyFastTrackMode {
+    /// Complete fixed mode set in stable API and metric order.
+    pub const ALL: [Self; 3] = [Self::Off, Self::Shadow, Self::Enforce];
+
+    /// Returns the stable serialized mode token.
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Off => "off",
+            Self::Shadow => "shadow",
+            Self::Enforce => "enforce",
+        }
+    }
+}
@@ -0,0 +1,14 @@
+use serde::{Deserialize, Serialize};
+
+/// Action applied after an accepted WEB socket finds HTTP connection capacity exhausted.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum WebHttpConnectionCapacityAction {
+    /// Close the accepted socket without emitting an HTTP response.
+    #[default]
+    Drop,
+    /// Wait for ordinary HTTP connection capacity under the overload deadline.
+    Wait,
+    /// Emit a bounded retryable HTTP response without parsing the request.
+    Respond,
+}
@@ -0,0 +1,93 @@
+use super::*;
+
+/// Precomputed WEB configuration consumed by listener hot paths.
+#[derive(Debug)]
+pub(crate) struct WebRuntimeConfig {
+    /// Canonical host lookup used by HTTP request routing.
+    pub(crate) vhosts: BTreeMap<String, Arc<WebRuntimeVhost>>,
+    /// Flat profile inventory used by startup link emission.
+    pub(crate) profiles: Vec<Arc<WebRuntimeProfile>>,
+    /// Complete active capability table used to contain misplaced credentials.
+    pub(crate) capabilities: Box<[[u8; 32]]>,
+}
+
+/// Precomputed immutable virtual-host data.
+#[derive(Debug)]
+pub(crate) struct WebRuntimeVhost {
+    /// Canonical lowercase ACE hostname.
+    pub(crate) host: String,
+    /// Exact slash-delimited endpoint base, including the trailing slash.
+    pub(crate) base: String,
+    /// Restart-frozen decoy capability-scan policy.
+    pub(crate) decoy_fasttrack_mode: WebDecoyFastTrackMode,
+    /// Immutable ordinary-site fallback snapshot.
+    pub(crate) decoy: WebRuntimeDecoy,
+    /// Upstream connect and response-head deadline.
+    pub(crate) decoy_header_secs: u64,
+    /// Exact capability profiles accepted by this host.
+    pub(crate) profiles: Vec<Arc<WebRuntimeProfile>>,
+    /// Contiguous capability table aligned one-to-one with `profiles`.
+    pub(crate) capabilities: Box<[[u8; 32]]>,
+}
+
+/// Precomputed exact-user capability entry.
+#[derive(Debug)]
+pub(crate) struct WebRuntimeProfile {
+    /// Canonical host that owns this profile.
+    pub(crate) host: String,
+    /// Stable public destination tuple supplied to relay routing.
+    pub(crate) public_addr: SocketAddr,
+    /// Exact access user authenticated by logical streams.
+    pub(crate) user: String,
+    /// Stable credential identity used by process-wide admission fencing.
+    pub(crate) credential_id: [u8; 16],
+    /// Client secret representation and inner protocol policy.
+    pub(crate) secret_mode: WebSecretMode,
+    /// Sole carrier or final fallback frozen into the issued bridge policy.
+    pub(crate) carrier: WebCarrier,
+    /// Whether an explicit carrier list enabled automatic negotiation.
+    pub(crate) carrier_negotiation_enabled: bool,
+    /// Whether automatic outcomes consult and update process-local evidence.
+    pub(crate) carrier_learning: bool,
+    /// Ordered negotiation candidates including the fallback carrier exactly once.
+    pub(crate) carriers: Arc<[WebCarrier]>,
+    /// Cumulative carrier-attempt deadlines frozen when the bridge is issued.
+    pub(crate) carrier_negotiation_deadlines_secs: [u64; 4],
+    /// HMAC-derived bridge capability.
+    pub(crate) capability: [u8; 32],
+    /// Non-secret domain-separated client-secret fingerprint for debugging.
+    pub(crate) key_fingerprint: String,
+    /// Per-profile live session ceiling.
+    pub(crate) max_sessions: usize,
+    /// Per-profile live logical-stream ceiling.
+    pub(crate) max_streams: usize,
+    /// Per-session live relay-task ceiling.
+    pub(crate) max_streams_per_session: usize,
+}
+
+/// Runtime-ready ordinary-site fallback.
+#[derive(Debug)]
+pub(crate) enum WebRuntimeDecoy {
+    HttpUpstream { addr: SocketAddr, authority: String },
+    StaticDirectory(Arc<WebStaticSite>),
+}
+
+/// Immutable bounded static-site snapshot.
+#[derive(Debug)]
+pub(crate) struct WebStaticSite {
+    /// Canonical URL-path to immutable response asset mapping.
+    pub(crate) assets: BTreeMap<String, WebStaticAsset>,
+    /// Configured root index file name.
+    pub(crate) index: String,
+}
+
+/// One immutable static response body and metadata.
+#[derive(Debug)]
+pub(crate) struct WebStaticAsset {
+    /// Immutable response body retained by the runtime snapshot.
+    pub(crate) body: Bytes,
+    /// Extension-derived static content type.
+    pub(crate) content_type: &'static str,
+    /// Strong SHA-256 entity tag.
+    pub(crate) etag: String,
+}
@@ -0,0 +1,118 @@
+use serde::{Deserialize, Serialize};
+
+/// Minimum restart-owned entries required for one complete learning sample.
+pub(crate) const WEB_CARRIER_LEARNING_MIN_ENTRIES: usize = 3;
+
+/// Carrier selected for one newly issued WEB relay session.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum WebCarrier {
+    /// Serialize all logical streams through one uplink and one downlink sequence.
+    #[default]
+    Https,
+    /// Give every logical stream independent HTTPS sequencing and polling state.
+    HttpsLanes,
+    /// Multiplex all logical streams over one ordered WebSocket.
+    Websocket,
+    /// Give every logical stream an independently owned WebSocket lane.
+    WebsocketLanes,
+}
+
+impl WebCarrier {
+    /// Every carrier supported by the WEB v1 bridge.
+    pub(crate) const ALL: [Self; 4] = [
+        Self::Https,
+        Self::HttpsLanes,
+        Self::Websocket,
+        Self::WebsocketLanes,
+    ];
+
+    /// Returns the exact carrier token advertised to the browser bridge.
+    pub(crate) const fn as_str(self) -> &'static str {
+        match self {
+            Self::Https => "https",
+            Self::HttpsLanes => "https-lanes",
+            Self::Websocket => "websocket",
+            Self::WebsocketLanes => "websocket-lanes",
+        }
+    }
+
+    /// Returns the stable fixed-slot index used by bounded learning state.
+    pub(crate) const fn index(self) -> usize {
+        match self {
+            Self::Https => 0,
+            Self::HttpsLanes => 1,
+            Self::Websocket => 2,
+            Self::WebsocketLanes => 3,
+        }
+    }
+
+    /// Returns whether one carrier owns independent state per logical stream.
+    pub(crate) const fn uses_lanes(self) -> bool {
+        matches!(self, Self::HttpsLanes | Self::WebsocketLanes)
+    }
+
+    /// Returns whether carrier messages use RFC 6455 instead of HTTP bodies.
+    pub(crate) const fn uses_websocket(self) -> bool {
+        matches!(self, Self::Websocket | Self::WebsocketLanes)
+    }
+
+    /// Returns whether all logical streams share one carrier state machine.
+    pub(crate) const fn is_multiplexed(self) -> bool {
+        matches!(self, Self::Https | Self::Websocket)
+    }
+}
+
+/// Optional ordered carrier list that enables server-side auto-negotiation.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub enum WebCarriers {
+    /// Auto-negotiation is disabled and only `web.carrier` is used.
+    #[default]
+    Disabled,
+    /// Auto-negotiation uses this ordered candidate list before the fallback.
+    Enabled(Vec<WebCarrier>),
+}
+
+impl WebCarriers {
+    /// Returns the explicit candidate list when negotiation is enabled.
+    pub fn enabled(&self) -> Option<&[WebCarrier]> {
+        match self {
+            Self::Disabled => None,
+            Self::Enabled(carriers) => Some(carriers),
+        }
+    }
+}
+
+impl Serialize for WebCarriers {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        match self {
+            Self::Disabled => false.serialize(serializer),
+            Self::Enabled(carriers) => carriers.serialize(serializer),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for WebCarriers {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum Repr {
+            Flag(bool),
+            List(Vec<WebCarrier>),
+        }
+
+        match Repr::deserialize(deserializer)? {
+            Repr::Flag(false) => Ok(Self::Disabled),
+            Repr::Flag(true) => Err(serde::de::Error::custom(
+                "web.carriers accepts false or a non-empty carrier array",
+            )),
+            Repr::List(carriers) => Ok(Self::Enabled(carriers)),
+        }
+    }
+}
@@ -23,6 +23,9 @@ pub struct WebDebugConfig {
    /// Enables process-owned WEB debug collection.
    #[serde(default)]
    pub enabled: bool,
+    /// Enables generated-bridge diagnostic reports over the HTTPS sideband.
+    #[serde(default)]
+    pub sideband: bool,
    /// Records typed bridge, session, stream, handshake, and relay events.
    #[serde(default = "default_true")]
    pub capture_lifecycle: bool,
@@ -56,6 +59,7 @@ impl Default for WebDebugConfig {
    fn default() -> Self {
        Self {
            enabled: false,
+            sideband: false,
            capture_lifecycle: true,
            capture_headers: true,
            capture_timings: true,
@@ -69,6 +73,13 @@ impl Default for WebDebugConfig {
    }
 }

+impl WebDebugConfig {
+    /// Returns whether newly issued bridges may report diagnostic lifecycle events.
+    pub(crate) const fn bridge_diagnostics_enabled(&self) -> bool {
+        self.enabled && self.sideband && self.capture_lifecycle
+    }
+}
+
 fn default_true() -> bool {
    true
 }
@@ -1,20 +1,23 @@
-use std::collections::BTreeSet;
-use std::net::IpAddr;
-use std::path::PathBuf;
 use std::sync::Arc;
 use std::time::Duration;

-use tokio::io::AsyncWriteExt;
-use tokio::process::Command;
 use tokio::sync::{mpsc, watch};
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, info, warn};
+use tracing::{info, warn};

-use crate::config::{ConntrackBackend, ConntrackMode, ProxyConfig};
+use crate::config::ProxyConfig;
 use crate::proxy::middle_relay::note_global_relay_pressure;
 use crate::proxy::shared_state::{ConntrackCloseEvent, ConntrackCloseReason, ProxySharedState};
 use crate::stats::Stats;

+// Privileged netfilter rule and conntrack helper execution.
+mod firewall;
+
+pub(crate) use firewall::FirewallAuthority;
+use firewall::{
+    DeleteOutcome, delete_conntrack_entry, effective_conntrack_enabled, probe_runtime_support,
+};
+
 const CONNTRACK_EVENT_QUEUE_CAPACITY: usize = 32_768;
 const PRESSURE_RELEASE_TICKS: u8 = 3;
 const PRESSURE_SAMPLE_INTERVAL: Duration = Duration::from_secs(1);
@@ -112,7 +115,6 @@ async fn run_conntrack_controller_worker(
        runtime_support,
        false,
    );
-    reconcile_rules(&cfg, runtime_support, stats.as_ref()).await;

    loop {
        tokio::select! {
@@ -126,7 +128,6 @@ async fn run_conntrack_controller_worker(
                effective_enabled = effective_conntrack_enabled(&cfg, runtime_support);
                delete_budget_tokens = cfg.server.conntrack_control.delete_budget_per_sec;
                apply_runtime_state(stats.as_ref(), shared.as_ref(), &cfg, runtime_support, pressure_state.active);
-                reconcile_rules(&cfg, runtime_support, stats.as_ref()).await;
            }
            event = close_rx.recv() => {
                let Some(event) = event else {
@@ -310,383 +311,6 @@ fn update_pressure_state(
    state.low_streak = 0;
 }

-async fn reconcile_rules(
-    cfg: &ProxyConfig,
-    runtime_support: ConntrackRuntimeSupport,
-    stats: &Stats,
-) {
-    if !cfg.server.conntrack_control.inline_conntrack_control {
-        clear_notrack_rules_all_backends().await;
-        stats.set_conntrack_rule_apply_ok(true);
-        return;
-    }
-
-    if !effective_conntrack_enabled(cfg, runtime_support) {
-        clear_notrack_rules_all_backends().await;
-        stats.set_conntrack_rule_apply_ok(false);
-        return;
-    }
-
-    let backend = runtime_support
-        .netfilter_backend
-        .expect("netfilter backend must be available for effective conntrack control");
-
-    let apply_result = match backend {
-        NetfilterBackend::Nftables => apply_nft_rules(cfg).await,
-        NetfilterBackend::Iptables => apply_iptables_rules(cfg).await,
-    };
-
-    if let Err(error) = apply_result {
-        warn!(error = %error, "Failed to reconcile conntrack/notrack rules");
-        stats.set_conntrack_rule_apply_ok(false);
-    } else {
-        stats.set_conntrack_rule_apply_ok(true);
-    }
-}
-
-fn probe_runtime_support(configured_backend: ConntrackBackend) -> ConntrackRuntimeSupport {
-    ConntrackRuntimeSupport {
-        netfilter_backend: pick_backend(configured_backend),
-        has_cap_net_admin: has_cap_net_admin(),
-        has_conntrack_binary: command_exists("conntrack"),
-    }
-}
-
-fn effective_conntrack_enabled(
-    cfg: &ProxyConfig,
-    runtime_support: ConntrackRuntimeSupport,
-) -> bool {
-    cfg.server.conntrack_control.inline_conntrack_control
-        && runtime_support.has_cap_net_admin
-        && runtime_support.netfilter_backend.is_some()
-        && runtime_support.has_conntrack_binary
-}
-
-fn pick_backend(configured: ConntrackBackend) -> Option<NetfilterBackend> {
-    match configured {
-        ConntrackBackend::Auto => {
-            if command_exists("nft") {
-                Some(NetfilterBackend::Nftables)
-            } else if command_exists("iptables") {
-                Some(NetfilterBackend::Iptables)
-            } else {
-                None
-            }
-        }
-        ConntrackBackend::Nftables => command_exists("nft").then_some(NetfilterBackend::Nftables),
-        ConntrackBackend::Iptables => {
-            command_exists("iptables").then_some(NetfilterBackend::Iptables)
-        }
-    }
-}
-
-fn command_exists(binary: &str) -> bool {
-    let Some(path_var) = std::env::var_os("PATH") else {
-        return false;
-    };
-    std::env::split_paths(&path_var).any(|dir| {
-        let candidate: PathBuf = dir.join(binary);
-        candidate.exists() && candidate.is_file()
-    })
-}
-
-fn listener_port_set(cfg: &ProxyConfig) -> Vec<u16> {
-    let mut ports: BTreeSet<u16> = BTreeSet::new();
-    if cfg.server.listeners.is_empty() {
-        ports.insert(cfg.server.port);
-    } else {
-        for listener in &cfg.server.listeners {
-            ports.insert(listener.port.unwrap_or(cfg.server.port));
-        }
-    }
-    ports.into_iter().collect()
-}
-
-fn notrack_targets(cfg: &ProxyConfig) -> (Vec<(Option<IpAddr>, u16)>, Vec<(Option<IpAddr>, u16)>) {
-    let mode = cfg.server.conntrack_control.mode;
-    let mut v4_targets: BTreeSet<(Option<IpAddr>, u16)> = BTreeSet::new();
-    let mut v6_targets: BTreeSet<(Option<IpAddr>, u16)> = BTreeSet::new();
-
-    match mode {
-        ConntrackMode::Tracked => {}
-        ConntrackMode::Notrack => {
-            if cfg.server.listeners.is_empty() {
-                let port = cfg.server.port;
-                if let Some(ipv4) = cfg
-                    .server
-                    .listen_addr_ipv4
-                    .as_ref()
-                    .and_then(|s| s.parse::<IpAddr>().ok())
-                {
-                    if ipv4.is_unspecified() {
-                        v4_targets.insert((None, port));
-                    } else {
-                        v4_targets.insert((Some(ipv4), port));
-                    }
-                }
-                if let Some(ipv6) = cfg
-                    .server
-                    .listen_addr_ipv6
-                    .as_ref()
-                    .and_then(|s| s.parse::<IpAddr>().ok())
-                {
-                    if ipv6.is_unspecified() {
-                        v6_targets.insert((None, port));
-                    } else {
-                        v6_targets.insert((Some(ipv6), port));
-                    }
-                }
-            } else {
-                for listener in &cfg.server.listeners {
-                    let port = listener.port.unwrap_or(cfg.server.port);
-                    if listener.ip.is_ipv4() {
-                        if listener.ip.is_unspecified() {
-                            v4_targets.insert((None, port));
-                        } else {
-                            v4_targets.insert((Some(listener.ip), port));
-                        }
-                    } else if listener.ip.is_unspecified() {
-                        v6_targets.insert((None, port));
-                    } else {
-                        v6_targets.insert((Some(listener.ip), port));
-                    }
-                }
-            }
-        }
-        ConntrackMode::Hybrid => {
-            let ports = listener_port_set(cfg);
-            for ip in &cfg.server.conntrack_control.hybrid_listener_ips {
-                if ip.is_ipv4() {
-                    for port in &ports {
-                        v4_targets.insert((Some(*ip), *port));
-                    }
-                } else {
-                    for port in &ports {
-                        v6_targets.insert((Some(*ip), *port));
-                    }
-                }
-            }
-        }
-    }
-
-    (
-        v4_targets.into_iter().collect(),
-        v6_targets.into_iter().collect(),
-    )
-}
-
-async fn apply_nft_rules(cfg: &ProxyConfig) -> Result<(), String> {
-    let _ = run_command(
-        "nft",
-        &["delete", "table", "inet", "telemt_conntrack"],
-        None,
-    )
-    .await;
-    if matches!(cfg.server.conntrack_control.mode, ConntrackMode::Tracked) {
-        return Ok(());
-    }
-
-    let (v4_targets, v6_targets) = notrack_targets(cfg);
-    let mut rules = Vec::new();
-    for (ip, port) in v4_targets {
-        let rule = if let Some(ip) = ip {
-            format!("tcp dport {} ip daddr {} notrack", port, ip)
-        } else {
-            format!("tcp dport {} notrack", port)
-        };
-        rules.push(rule);
-    }
-    for (ip, port) in v6_targets {
-        let rule = if let Some(ip) = ip {
-            format!("tcp dport {} ip6 daddr {} notrack", port, ip)
-        } else {
-            format!("tcp dport {} notrack", port)
-        };
-        rules.push(rule);
-    }
-
-    let rule_blob = if rules.is_empty() {
-        String::new()
-    } else {
-        format!("    {}\n", rules.join("\n    "))
-    };
-    let script = format!(
-        "table inet telemt_conntrack {{\n  chain preraw {{\n    type filter hook prerouting priority raw; policy accept;\n{rule_blob}  }}\n}}\n"
-    );
-    run_command("nft", &["-f", "-"], Some(script)).await
-}
-
-async fn apply_iptables_rules(cfg: &ProxyConfig) -> Result<(), String> {
-    apply_iptables_rules_for_binary("iptables", cfg, true).await?;
-    apply_iptables_rules_for_binary("ip6tables", cfg, false).await?;
-    Ok(())
-}
-
-async fn apply_iptables_rules_for_binary(
-    binary: &str,
-    cfg: &ProxyConfig,
-    ipv4: bool,
-) -> Result<(), String> {
-    if !command_exists(binary) {
-        return Ok(());
-    }
-    let chain = "TELEMT_NOTRACK";
-    let _ = run_command(
-        binary,
-        &["-t", "raw", "-D", "PREROUTING", "-j", chain],
-        None,
-    )
-    .await;
-    let _ = run_command(binary, &["-t", "raw", "-F", chain], None).await;
-    let _ = run_command(binary, &["-t", "raw", "-X", chain], None).await;
-
-    if matches!(cfg.server.conntrack_control.mode, ConntrackMode::Tracked) {
-        return Ok(());
-    }
-
-    run_command(binary, &["-t", "raw", "-N", chain], None).await?;
-    run_command(binary, &["-t", "raw", "-F", chain], None).await?;
-    if run_command(
-        binary,
-        &["-t", "raw", "-C", "PREROUTING", "-j", chain],
-        None,
-    )
-    .await
-    .is_err()
-    {
-        run_command(
-            binary,
-            &["-t", "raw", "-I", "PREROUTING", "1", "-j", chain],
-            None,
-        )
-        .await?;
-    }
-
-    let (v4_targets, v6_targets) = notrack_targets(cfg);
-    let selected = if ipv4 { v4_targets } else { v6_targets };
-    for (ip, port) in selected {
-        let mut args = vec![
-            "-t".to_string(),
-            "raw".to_string(),
-            "-A".to_string(),
-            chain.to_string(),
-            "-p".to_string(),
-            "tcp".to_string(),
-            "--dport".to_string(),
-            port.to_string(),
-        ];
-        if let Some(ip) = ip {
-            args.push("-d".to_string());
-            args.push(ip.to_string());
-        }
-        args.push("-j".to_string());
-        args.push("CT".to_string());
-        args.push("--notrack".to_string());
-        let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
-        run_command(binary, &arg_refs, None).await?;
-    }
-    Ok(())
-}
-
-async fn clear_notrack_rules_all_backends() {
-    let _ = run_command(
-        "nft",
-        &["delete", "table", "inet", "telemt_conntrack"],
-        None,
-    )
-    .await;
-    let _ = run_command(
-        "iptables",
-        &["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"],
-        None,
-    )
-    .await;
-    let _ = run_command("iptables", &["-t", "raw", "-F", "TELEMT_NOTRACK"], None).await;
-    let _ = run_command("iptables", &["-t", "raw", "-X", "TELEMT_NOTRACK"], None).await;
-    let _ = run_command(
-        "ip6tables",
-        &["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"],
-        None,
-    )
-    .await;
-    let _ = run_command("ip6tables", &["-t", "raw", "-F", "TELEMT_NOTRACK"], None).await;
-    let _ = run_command("ip6tables", &["-t", "raw", "-X", "TELEMT_NOTRACK"], None).await;
-}
-
-enum DeleteOutcome {
-    Deleted,
-    NotFound,
-    Error,
-}
-
-async fn delete_conntrack_entry(event: ConntrackCloseEvent) -> DeleteOutcome {
-    if !command_exists("conntrack") {
-        return DeleteOutcome::Error;
-    }
-    let args = vec![
-        "-D".to_string(),
-        "-p".to_string(),
-        "tcp".to_string(),
-        "-s".to_string(),
-        event.src.ip().to_string(),
-        "--sport".to_string(),
-        event.src.port().to_string(),
-        "-d".to_string(),
-        event.dst.ip().to_string(),
-        "--dport".to_string(),
-        event.dst.port().to_string(),
-    ];
-    let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
-    match run_command("conntrack", &arg_refs, None).await {
-        Ok(()) => DeleteOutcome::Deleted,
-        Err(error) => {
-            if error.contains("0 flow entries have been deleted") {
-                DeleteOutcome::NotFound
-            } else {
-                debug!(error = %error, "conntrack delete failed");
-                DeleteOutcome::Error
-            }
-        }
-    }
-}
-
-async fn run_command(binary: &str, args: &[&str], stdin: Option<String>) -> Result<(), String> {
-    if !command_exists(binary) {
-        return Err(format!("{binary} is not available"));
-    }
-    let mut command = Command::new(binary);
-    command.args(args);
-    if stdin.is_some() {
-        command.stdin(std::process::Stdio::piped());
-    }
-    command.stdout(std::process::Stdio::null());
-    command.stderr(std::process::Stdio::piped());
-    let mut child = command
-        .spawn()
-        .map_err(|e| format!("spawn {binary} failed: {e}"))?;
-    if let Some(blob) = stdin
-        && let Some(mut writer) = child.stdin.take()
-    {
-        writer
-            .write_all(blob.as_bytes())
-            .await
-            .map_err(|e| format!("stdin write {binary} failed: {e}"))?;
-    }
-    let output = child
-        .wait_with_output()
-        .await
-        .map_err(|e| format!("wait {binary} failed: {e}"))?;
-    if output.status.success() {
-        return Ok(());
-    }
-    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-    Err(if stderr.is_empty() {
-        format!("{binary} exited with status {}", output.status)
-    } else {
-        stderr
-    })
-}
-
 fn fd_usage_pct() -> Option<u8> {
    let soft_limit = nofile_soft_limit()?;
    if soft_limit == 0 {
@@ -715,29 +339,6 @@ fn nofile_soft_limit() -> Option<u64> {
    }
 }

-fn has_cap_net_admin() -> bool {
-    #[cfg(target_os = "linux")]
-    {
-        let Ok(status) = std::fs::read_to_string("/proc/self/status") else {
-            return false;
-        };
-        for line in status.lines() {
-            if let Some(raw) = line.strip_prefix("CapEff:") {
-                let caps = raw.trim();
-                if let Ok(bits) = u64::from_str_radix(caps, 16) {
-                    const CAP_NET_ADMIN_BIT: u64 = 12;
-                    return (bits & (1u64 << CAP_NET_ADMIN_BIT)) != 0;
-                }
-            }
-        }
-        false
-    }
-    #[cfg(not(target_os = "linux"))]
-    {
-        false
-    }
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -0,0 +1,18 @@
+// Process-owned firewall reconciliation and privileged conntrack helpers.
+
+mod actor;
+mod command;
+mod iptables;
+mod model;
+mod nftables;
+mod runtime;
+mod transaction;
+
+pub(crate) use actor::FirewallAuthority;
+pub(super) use runtime::{
+    DeleteOutcome, delete_conntrack_entry, effective_conntrack_enabled, probe_runtime_support,
+};
+
+#[cfg(test)]
+#[path = "firewall/tests.rs"]
+mod tests;
@@ -0,0 +1,371 @@
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::Duration;
+
+use tokio::sync::{Notify, watch};
+use tokio_util::sync::CancellationToken;
+use tracing::warn;
+
+use crate::config::ProxyConfig;
+use crate::maestro::control_plane::ProcessControlPlane;
+use crate::stats::Stats;
+
+use super::command::{CommandError, FirewallCommandRunner, SystemCommandRunner};
+use super::model::{AppliedPlan, AppliedState, DesiredPolicy, DesiredState};
+use super::transaction::{InterruptibleRunner, reconcile_once, recover_to_empty};
+
+const SHUTDOWN_CLEANUP_TIMEOUT: Duration = Duration::from_secs(30);
+const SHUTDOWN_WAIT_TIMEOUT: Duration = Duration::from_secs(35);
+const INITIAL_RECONCILE_TIMEOUT: Duration = Duration::from_secs(65);
+const RETRY_DELAYS: [Duration; 6] = [
+    Duration::from_secs(1),
+    Duration::from_secs(2),
+    Duration::from_secs(4),
+    Duration::from_secs(8),
+    Duration::from_secs(16),
+    Duration::from_secs(30),
+];
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum ReconcileOutcome {
+    Applied,
+    Failed,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) struct ReconcileStatus {
+    pub(super) generation: u64,
+    pub(super) outcome: ReconcileOutcome,
+}
+
+/// Process-owned publisher and shutdown owner for conntrack firewall policy.
+#[derive(Clone)]
+pub(crate) struct FirewallAuthority {
+    desired_tx: watch::Sender<Option<DesiredState>>,
+    status_rx: watch::Receiver<Option<ReconcileStatus>>,
+    terminal: CancellationToken,
+    closed: Arc<AtomicBool>,
+    completed_flag: Arc<AtomicBool>,
+    cleanup_succeeded: Arc<AtomicBool>,
+    completed: Arc<Notify>,
+}
+
+impl FirewallAuthority {
+    /// Starts the single process-owned firewall reconciler.
+    pub(crate) fn spawn(control_plane: &ProcessControlPlane) -> Result<Self, String> {
+        let (desired_tx, desired_rx) = watch::channel(None);
+        let (status_tx, status_rx) = watch::channel(None);
+        let terminal = CancellationToken::new();
+        let closed = Arc::new(AtomicBool::new(false));
+        let completed_flag = Arc::new(AtomicBool::new(false));
+        let cleanup_succeeded = Arc::new(AtomicBool::new(false));
+        let completed = Arc::new(Notify::new());
+        let actor = FirewallReconciler::new(
+            SystemCommandRunner,
+            desired_rx,
+            status_tx,
+            terminal.clone(),
+            Arc::clone(&closed),
+            Arc::clone(&completed_flag),
+            Arc::clone(&cleanup_succeeded),
+            Arc::clone(&completed),
+        );
+        control_plane
+            .spawn_cooperative(move |process_cancellation| async move {
+                actor.run(process_cancellation).await;
+            })
+            .map_err(|_| {
+                "process control-plane admission closed before conntrack firewall startup"
+                    .to_string()
+            })?;
+        Ok(Self {
+            desired_tx,
+            status_rx,
+            terminal,
+            closed,
+            completed_flag,
+            cleanup_succeeded,
+            completed,
+        })
+    }
+
+    /// Publishes policy only after its runtime generation becomes active.
+    pub(crate) fn publish(
+        &self,
+        generation: u64,
+        config: Arc<ProxyConfig>,
+        stats: Arc<Stats>,
+    ) -> bool {
+        if self.closed.load(Ordering::Acquire) {
+            stats.set_conntrack_rule_apply_ok(false);
+            return false;
+        }
+        stats.set_conntrack_rule_apply_ok(false);
+        self.desired_tx.send_replace(Some(DesiredState {
+            generation,
+            policy: DesiredPolicy::from_config(config.as_ref()),
+            stats,
+        }));
+        true
+    }
+
+    /// Publishes startup policy and waits for its first bounded attempt.
+    pub(crate) async fn publish_initial(
+        &self,
+        generation: u64,
+        config: Arc<ProxyConfig>,
+        stats: Arc<Stats>,
+    ) -> bool {
+        let mut status_rx = self.status_rx.clone();
+        if !self.publish(generation, config, stats) {
+            return false;
+        }
+        tokio::time::timeout(INITIAL_RECONCILE_TIMEOUT, async move {
+            loop {
+                if let Some(status) = *status_rx.borrow_and_update()
+                    && status.generation == generation
+                {
+                    return status.outcome == ReconcileOutcome::Applied;
+                }
+                if status_rx.changed().await.is_err() {
+                    return false;
+                }
+            }
+        })
+        .await
+        .unwrap_or(false)
+    }
+
+    /// Stops policy admission and waits for bounded terminal cleanup.
+    pub(crate) async fn shutdown_and_clear(&self) -> bool {
+        let completed = self.completed.notified();
+        tokio::pin!(completed);
+        completed.as_mut().enable();
+        if !self.closed.swap(true, Ordering::AcqRel) {
+            if let Some(desired) = self.desired_tx.borrow().as_ref() {
+                desired.stats.set_conntrack_rule_apply_ok(false);
+            }
+            self.terminal.cancel();
+        }
+        let finished = self.completed_flag.load(Ordering::Acquire)
+            || tokio::time::timeout(SHUTDOWN_WAIT_TIMEOUT, completed)
+                .await
+                .is_ok();
+        finished && self.cleanup_succeeded.load(Ordering::Acquire)
+    }
+}
+
+struct CompletionGuard {
+    closed: Arc<AtomicBool>,
+    completed_flag: Arc<AtomicBool>,
+    completed: Arc<Notify>,
+}
+
+impl Drop for CompletionGuard {
+    fn drop(&mut self) {
+        self.closed.store(true, Ordering::Release);
+        self.completed_flag.store(true, Ordering::Release);
+        self.completed.notify_waiters();
+    }
+}
+
+pub(super) struct FirewallReconciler<R> {
+    runner: R,
+    desired_rx: watch::Receiver<Option<DesiredState>>,
+    status_tx: watch::Sender<Option<ReconcileStatus>>,
+    terminal: CancellationToken,
+    completion: CompletionGuard,
+    cleanup_succeeded: Arc<AtomicBool>,
+    applied: AppliedState,
+    last_generation: u64,
+    last_policy: Option<DesiredPolicy>,
+    last_stats: Option<Arc<Stats>>,
+}
+
+impl<R> FirewallReconciler<R>
+where
+    R: FirewallCommandRunner + 'static,
+{
+    pub(super) fn new(
+        runner: R,
+        desired_rx: watch::Receiver<Option<DesiredState>>,
+        status_tx: watch::Sender<Option<ReconcileStatus>>,
+        terminal: CancellationToken,
+        closed: Arc<AtomicBool>,
+        completed_flag: Arc<AtomicBool>,
+        cleanup_succeeded: Arc<AtomicBool>,
+        completed: Arc<Notify>,
+    ) -> Self {
+        Self {
+            runner,
+            desired_rx,
+            status_tx,
+            terminal,
+            completion: CompletionGuard {
+                closed,
+                completed_flag,
+                completed,
+            },
+            cleanup_succeeded,
+            applied: AppliedState::Unknown,
+            last_generation: 0,
+            last_policy: None,
+            last_stats: None,
+        }
+    }
+
+    pub(super) async fn run(mut self, process_cancellation: CancellationToken) {
+        let mut current = None;
+        let mut retry_index = 0usize;
+        'run: loop {
+            if current.is_none() {
+                let changed = tokio::select! {
+                    biased;
+                    _ = self.terminal.cancelled() => false,
+                    _ = process_cancellation.cancelled() => false,
+                    changed = self.desired_rx.changed() => changed.is_ok(),
+                };
+                if !changed {
+                    break;
+                }
+                current = self.take_latest_desired();
+                retry_index = 0;
+                if current.is_none() {
+                    continue;
+                }
+            }
+
+            let desired = current.as_ref().expect("desired state is present").clone();
+            let interruptible =
+                InterruptibleRunner::new(&self.runner, &self.terminal, &process_cancellation);
+            let result =
+                reconcile_once(&interruptible, &interruptible, &mut self.applied, &desired).await;
+            match result {
+                Ok(()) => {
+                    desired
+                        .stats
+                        .increment_conntrack_rule_reconcile_success_total();
+                    desired.stats.set_conntrack_rule_apply_ok(true);
+                    self.status_tx.send_replace(Some(ReconcileStatus {
+                        generation: desired.generation,
+                        outcome: ReconcileOutcome::Applied,
+                    }));
+                    if self.terminal.is_cancelled() || process_cancellation.is_cancelled() {
+                        desired.stats.set_conntrack_rule_apply_ok(false);
+                        break;
+                    }
+                    current = None;
+                    retry_index = 0;
+                }
+                Err(failure) if failure.cancelled => break,
+                Err(failure) => {
+                    desired
+                        .stats
+                        .increment_conntrack_rule_reconcile_error_total();
+                    desired.stats.set_conntrack_rule_apply_ok(false);
+                    if let Some(rollback_succeeded) = failure.rollback_succeeded {
+                        if rollback_succeeded {
+                            desired
+                                .stats
+                                .increment_conntrack_rule_rollback_success_total();
+                        } else {
+                            desired
+                                .stats
+                                .increment_conntrack_rule_rollback_error_total();
+                        }
+                    }
+                    self.status_tx.send_replace(Some(ReconcileStatus {
+                        generation: desired.generation,
+                        outcome: ReconcileOutcome::Failed,
+                    }));
+                    warn!(
+                        generation = desired.generation,
+                        error = %failure.message,
+                        "Failed to reconcile conntrack firewall policy"
+                    );
+
+                    let delay = RETRY_DELAYS[retry_index.min(RETRY_DELAYS.len() - 1)];
+                    retry_index = retry_index.saturating_add(1);
+                    let retry_deadline = tokio::time::Instant::now() + delay;
+                    loop {
+                        tokio::select! {
+                            biased;
+                            _ = self.terminal.cancelled() => break 'run,
+                            _ = process_cancellation.cancelled() => break 'run,
+                            changed = self.desired_rx.changed() => {
+                                if changed.is_err() {
+                                    break 'run;
+                                }
+                                if let Some(next) = self.take_latest_desired() {
+                                    current = Some(next);
+                                    retry_index = 0;
+                                    break;
+                                }
+                            }
+                            _ = tokio::time::sleep_until(retry_deadline) => break,
+                        }
+                    }
+                }
+            }
+
+            if self.terminal.is_cancelled() || process_cancellation.is_cancelled() {
+                break;
+            }
+            if self.desired_rx.has_changed().unwrap_or(false) {
+                if let Some(next) = self.take_latest_desired() {
+                    current = Some(next);
+                    retry_index = 0;
+                }
+            }
+        }
+
+        if let Some(stats) = &self.last_stats {
+            stats.set_conntrack_rule_apply_ok(false);
+        }
+        if let Err(error) =
+            tokio::time::timeout(SHUTDOWN_CLEANUP_TIMEOUT, recover_to_empty(&self.runner))
+                .await
+                .unwrap_or_else(|_| {
+                    Err(CommandError::failed("firewall shutdown cleanup timed out"))
+                })
+        {
+            warn!(error = %error, "Failed to clear conntrack firewall policy during shutdown");
+        } else {
+            self.applied = AppliedState::Known(AppliedPlan::Empty);
+            self.cleanup_succeeded.store(true, Ordering::Release);
+        }
+        let _completion = &self.completion;
+    }
+
+    pub(super) fn take_latest_desired(&mut self) -> Option<DesiredState> {
+        let next = self.desired_rx.borrow_and_update().clone()?;
+        if next.generation < self.last_generation {
+            warn!(
+                generation = next.generation,
+                active_generation = self.last_generation,
+                "Ignored stale conntrack firewall policy publication"
+            );
+            return None;
+        }
+        if next.generation == self.last_generation {
+            if self.last_policy.as_ref() != Some(&next.policy) {
+                warn!(
+                    generation = next.generation,
+                    "Ignored conflicting conntrack firewall policy for active generation"
+                );
+                return None;
+            }
+            self.last_stats = Some(next.stats.clone());
+            if let AppliedState::Known(applied) = &self.applied
+                && applied.matches_policy(&next.policy)
+            {
+                next.stats.set_conntrack_rule_apply_ok(true);
+            }
+            return Some(next);
+        }
+        self.last_generation = next.generation;
+        self.last_policy = Some(next.policy.clone());
+        self.last_stats = Some(next.stats.clone());
+        Some(next)
+    }
+}
@@ -0,0 +1,204 @@
+use std::time::Duration;
+
+#[cfg(unix)]
+use tokio::io::AsyncWriteExt;
+#[cfg(unix)]
+use tokio::process::Command;
+
+#[cfg(unix)]
+use crate::util::trusted_command::resolve_trusted_helper;
+
+const COMMAND_TIMEOUT: Duration = Duration::from_secs(30);
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct CommandSpec {
+    pub(super) binary: &'static str,
+    pub(super) args: Vec<String>,
+    pub(super) stdin: Option<String>,
+}
+
+impl CommandSpec {
+    pub(super) fn new(binary: &'static str, args: impl IntoIterator<Item = &'static str>) -> Self {
+        Self {
+            binary,
+            args: args.into_iter().map(str::to_string).collect(),
+            stdin: None,
+        }
+    }
+
+    pub(super) fn with_stdin(
+        binary: &'static str,
+        args: impl IntoIterator<Item = &'static str>,
+        stdin: String,
+    ) -> Self {
+        Self {
+            binary,
+            args: args.into_iter().map(str::to_string).collect(),
+            stdin: Some(stdin),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum CommandErrorKind {
+    Missing,
+    NotFound,
+    Cancelled,
+    Timeout,
+    Failed,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct CommandError {
+    pub(super) kind: CommandErrorKind,
+    pub(super) message: String,
+}
+
+impl CommandError {
+    pub(super) fn cancelled() -> Self {
+        Self {
+            kind: CommandErrorKind::Cancelled,
+            message: "firewall transaction cancelled".to_string(),
+        }
+    }
+
+    pub(super) fn failed(message: impl Into<String>) -> Self {
+        Self {
+            kind: CommandErrorKind::Failed,
+            message: message.into(),
+        }
+    }
+}
+
+impl std::fmt::Display for CommandError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+
+pub(super) trait FirewallCommandRunner: Send + Sync {
+    fn available(&self, binary: &str) -> bool;
+
+    fn has_cap_net_admin(&self) -> bool;
+
+    async fn run(&self, spec: CommandSpec) -> Result<(), CommandError>;
+}
+
+#[derive(Clone, Copy, Default)]
+pub(super) struct SystemCommandRunner;
+
+impl FirewallCommandRunner for SystemCommandRunner {
+    fn available(&self, binary: &str) -> bool {
+        #[cfg(unix)]
+        {
+            resolve_trusted_helper(binary).is_some()
+        }
+        #[cfg(not(unix))]
+        {
+            let _ = binary;
+            false
+        }
+    }
+
+    fn has_cap_net_admin(&self) -> bool {
+        #[cfg(target_os = "linux")]
+        {
+            let Ok(status) = std::fs::read_to_string("/proc/self/status") else {
+                return false;
+            };
+            for line in status.lines() {
+                if let Some(raw) = line.strip_prefix("CapEff:") {
+                    let caps = raw.trim();
+                    if let Ok(bits) = u64::from_str_radix(caps, 16) {
+                        const CAP_NET_ADMIN_BIT: u64 = 12;
+                        return (bits & (1u64 << CAP_NET_ADMIN_BIT)) != 0;
+                    }
+                }
+            }
+            false
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            false
+        }
+    }
+
+    async fn run(&self, spec: CommandSpec) -> Result<(), CommandError> {
+        #[cfg(not(unix))]
+        {
+            Err(CommandError {
+                kind: CommandErrorKind::Missing,
+                message: format!("{} is not available", spec.binary),
+            })
+        }
+        #[cfg(unix)]
+        {
+            let Some(command_path) = resolve_trusted_helper(spec.binary) else {
+                return Err(CommandError {
+                    kind: CommandErrorKind::Missing,
+                    message: format!("{} is not available", spec.binary),
+                });
+            };
+            let mut command = Command::new(command_path);
+            command.args(&spec.args);
+            command.env("LC_ALL", "C");
+            if spec.stdin.is_some() {
+                command.stdin(std::process::Stdio::piped());
+            }
+            command.stdout(std::process::Stdio::null());
+            command.stderr(std::process::Stdio::piped());
+            command.kill_on_drop(true);
+            let mut child = command.spawn().map_err(|error| CommandError {
+                kind: CommandErrorKind::Failed,
+                message: format!("spawn {} failed: {error}", spec.binary),
+            })?;
+            let binary = spec.binary;
+            let output = tokio::time::timeout(COMMAND_TIMEOUT, async move {
+                if let Some(blob) = spec.stdin
+                    && let Some(mut writer) = child.stdin.take()
+                {
+                    writer
+                        .write_all(blob.as_bytes())
+                        .await
+                        .map_err(|error| CommandError {
+                            kind: CommandErrorKind::Failed,
+                            message: format!("stdin write {binary} failed: {error}"),
+                        })?;
+                }
+                child
+                    .wait_with_output()
+                    .await
+                    .map_err(|error| CommandError {
+                        kind: CommandErrorKind::Failed,
+                        message: format!("wait {binary} failed: {error}"),
+                    })
+            })
+            .await
+            .map_err(|_| CommandError {
+                kind: CommandErrorKind::Timeout,
+                message: format!("{binary} timed out after {}s", COMMAND_TIMEOUT.as_secs()),
+            })??;
+            if output.status.success() {
+                return Ok(());
+            }
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            let message = if stderr.is_empty() {
+                format!("{binary} exited with status {}", output.status)
+            } else {
+                stderr
+            };
+            let kind = if is_not_found_error(&message) {
+                CommandErrorKind::NotFound
+            } else {
+                CommandErrorKind::Failed
+            };
+            Err(CommandError { kind, message })
+        }
+    }
+}
+
+pub(super) fn is_not_found_error(message: &str) -> bool {
+    message.contains("No chain/target/match by that name")
+        || message.contains("Bad rule (does a matching rule exist in that chain?)")
+        || message.contains("Could not process rule: No such file or directory")
+}
@@ -0,0 +1,240 @@
+use super::command::{CommandError, CommandErrorKind, CommandSpec, FirewallCommandRunner};
+use super::model::{NotrackTarget, ShadowSlot};
+
+const DISPATCH_CHAIN: &str = "TELEMT_NOTRACK";
+const SHADOW_CHAIN_A: &str = "TELEMT_NT_A";
+const SHADOW_CHAIN_B: &str = "TELEMT_NT_B";
+const MAX_OWNED_JUMPS: usize = 8;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum IpFamily {
+    V4,
+    V6,
+}
+
+impl IpFamily {
+    fn command_binary(self) -> &'static str {
+        match self {
+            Self::V4 => "iptables",
+            Self::V6 => "ip6tables",
+        }
+    }
+
+    fn restore_binary(self) -> &'static str {
+        match self {
+            Self::V4 => "iptables-restore",
+            Self::V6 => "ip6tables-restore",
+        }
+    }
+}
+
+pub(super) fn family_available<R: FirewallCommandRunner>(runner: &R, family: IpFamily) -> bool {
+    runner.available(family.command_binary()) && runner.available(family.restore_binary())
+}
+
+fn shadow_chain(slot: ShadowSlot) -> &'static str {
+    match slot {
+        ShadowSlot::A => SHADOW_CHAIN_A,
+        ShadowSlot::B => SHADOW_CHAIN_B,
+    }
+}
+
+pub(super) async fn stage_family<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+    slot: ShadowSlot,
+    targets: &[NotrackTarget],
+) -> Result<(), CommandError> {
+    if targets.is_empty() {
+        return Ok(());
+    }
+    require_family(runner, family)?;
+    ensure_owned_chains(runner, family).await?;
+    let script = render_stage_script(slot, targets);
+    runner
+        .run(CommandSpec::with_stdin(
+            family.restore_binary(),
+            ["--noflush"],
+            script,
+        ))
+        .await
+}
+
+pub(super) async fn activate_family<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+    slot: Option<ShadowSlot>,
+) -> Result<(), CommandError> {
+    require_family(runner, family)?;
+    if slot.is_some() {
+        ensure_prerouting_jump(runner, family).await?;
+    }
+    runner
+        .run(CommandSpec::with_stdin(
+            family.restore_binary(),
+            ["--noflush"],
+            render_dispatch_script(slot),
+        ))
+        .await
+}
+
+pub(super) async fn cleanup_all<R: FirewallCommandRunner>(runner: &R) -> Result<(), CommandError> {
+    let mut errors = Vec::new();
+    for family in [IpFamily::V4, IpFamily::V6] {
+        if !runner.available(family.command_binary()) {
+            continue;
+        }
+        if let Err(error) = cleanup_family(runner, family).await {
+            errors.push(error.message);
+        }
+    }
+    if errors.is_empty() {
+        Ok(())
+    } else {
+        Err(CommandError::failed(errors.join("; ")))
+    }
+}
+
+async fn cleanup_family<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+) -> Result<(), CommandError> {
+    let binary = family.command_binary();
+    let mut errors = Vec::new();
+    for _ in 0..MAX_OWNED_JUMPS {
+        let result = runner
+            .run(CommandSpec::new(
+                binary,
+                ["-t", "raw", "-D", "PREROUTING", "-j", DISPATCH_CHAIN],
+            ))
+            .await;
+        match result {
+            Ok(()) => {}
+            Err(error)
+                if matches!(
+                    error.kind,
+                    CommandErrorKind::NotFound | CommandErrorKind::Missing
+                ) =>
+            {
+                break;
+            }
+            Err(error) => {
+                errors.push(error.message);
+                break;
+            }
+        }
+    }
+    for chain in [DISPATCH_CHAIN, SHADOW_CHAIN_A, SHADOW_CHAIN_B] {
+        for operation in ["-F", "-X"] {
+            let result = runner
+                .run(CommandSpec::new(binary, ["-t", "raw", operation, chain]))
+                .await;
+            if let Err(error) = result
+                && !matches!(
+                    error.kind,
+                    CommandErrorKind::NotFound | CommandErrorKind::Missing
+                )
+            {
+                errors.push(error.message);
+            }
+        }
+    }
+    if errors.is_empty() {
+        Ok(())
+    } else {
+        Err(CommandError::failed(errors.join("; ")))
+    }
+}
+
+async fn ensure_prerouting_jump<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+) -> Result<(), CommandError> {
+    let binary = family.command_binary();
+    match runner
+        .run(CommandSpec::new(
+            binary,
+            ["-t", "raw", "-C", "PREROUTING", "-j", DISPATCH_CHAIN],
+        ))
+        .await
+    {
+        Ok(()) => Ok(()),
+        Err(error) if error.kind == CommandErrorKind::NotFound => {
+            runner
+                .run(CommandSpec::new(
+                    binary,
+                    ["-t", "raw", "-I", "PREROUTING", "1", "-j", DISPATCH_CHAIN],
+                ))
+                .await
+        }
+        Err(error) => Err(error),
+    }
+}
+
+async fn ensure_owned_chains<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+) -> Result<(), CommandError> {
+    let binary = family.command_binary();
+    for chain in [DISPATCH_CHAIN, SHADOW_CHAIN_A, SHADOW_CHAIN_B] {
+        match runner
+            .run(CommandSpec::new(binary, ["-t", "raw", "-N", chain]))
+            .await
+        {
+            Ok(()) => {}
+            Err(error) if is_chain_exists_error(&error.message) => {}
+            Err(error) => return Err(error),
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn is_chain_exists_error(message: &str) -> bool {
+    message.contains("Chain already exists")
+}
+
+fn require_family<R: FirewallCommandRunner>(
+    runner: &R,
+    family: IpFamily,
+) -> Result<(), CommandError> {
+    for binary in [family.command_binary(), family.restore_binary()] {
+        if !runner.available(binary) {
+            return Err(CommandError {
+                kind: CommandErrorKind::Missing,
+                message: format!("{binary} is required for conntrack firewall reconciliation"),
+            });
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn render_stage_script(slot: ShadowSlot, targets: &[NotrackTarget]) -> String {
+    let chain = shadow_chain(slot);
+    let mut script = format!("*raw\n-F {chain}\n");
+    for target in targets {
+        script.push_str("-A ");
+        script.push_str(chain);
+        script.push_str(" -p tcp --dport ");
+        script.push_str(&target.port.to_string());
+        if let Some(ip) = target.ip {
+            script.push_str(" -d ");
+            script.push_str(&ip.to_string());
+        }
+        script.push_str(" -j CT --notrack\n");
+    }
+    script.push_str("COMMIT\n");
+    script
+}
+
+pub(super) fn render_dispatch_script(slot: Option<ShadowSlot>) -> String {
+    let mut script = format!("*raw\n-F {DISPATCH_CHAIN}\n");
+    if let Some(slot) = slot {
+        script.push_str("-A ");
+        script.push_str(DISPATCH_CHAIN);
+        script.push_str(" -j ");
+        script.push_str(shadow_chain(slot));
+        script.push('\n');
+    }
+    script.push_str("COMMIT\n");
+    script
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alexey	717a34771f	Merge pull request #930 from telemt/thundering WEB Bridge Sideband + Atomic Lifecycle for Writer Refresh + ME Authority	2026-09-27 17:32:02 +03:00
Alexey	5adbaf85c9	Bump -> 3.5.8	2026-09-27 17:23:49 +03:00
Alexey	38eabc50e3	WEB: Base Path: security + reload coverage fixes&tests	2026-09-26 14:25:24 +03:00
Alexey	5feded2919	WEB: Base Path added	2026-09-26 13:49:28 +03:00
Alexey	326c0ecdb9	Rustfmt	2026-09-25 19:49:36 +03:00
Alexey	2d63fcf376	Update Cargo.toml	2026-09-25 19:44:47 +03:00
Alexey	c12c5c73c1	Conntrack: Firewall reconciliation process-owned&transactional	2026-09-25 19:35:31 +03:00
Alexey	26a574780e	CAS Contention in Traffic Bucket bounded	2026-09-25 06:32:01 +03:00
Alexey	08109d53e8	WEB Data Budget: Session effects until after state unlock deferred	2026-09-24 01:02:07 +03:00
Alexey	f1107c21d9	Process-wide concurrency + Cancellation ownership fixes	2026-09-23 22:30:51 +03:00
Alexey	baa9bfbb01	ME Authority + Quota Resets + WEB Replacement Rollback fixes	2026-09-22 03:01:17 +03:00
Alexey	51e706770c	WEB Manager Session + Generation Fence tests	2026-09-21 21:08:34 +03:00
Alexey	d706b3f3ba	Hardswap Invariants in tests + Quota fixes	2026-09-20 00:28:52 +03:00
Alexey	89dacbd17e	TOCTOU and lifecycle races across runtime boundaries fixes	2026-09-19 22:37:22 +03:00
Alexey	acad414cc7	Runtime paths symlink preserved + User Admission Registration	2026-09-18 23:11:09 +03:00
Alexey	02f66c542e	Descriptor-anchored Secured Filesystem Operations	2026-09-17 22:45:48 +03:00
Alexey	9a683d8b3d	Slot Budget + Config Store Atomic Writer fixes + Trusted Command	2026-09-16 22:06:59 +03:00
Alexey	55f3d19ee0	Direct-since-epoch	2026-09-15 20:37:41 +03:00
Alexey	5ec9f85530	User Admission Tests	2026-09-14 20:21:41 +03:00
Alexey	0ac236955a	Proxy Shared User Drafts	2026-09-14 20:19:48 +03:00
Alexey	b37f1ebdeb	TLS Replay Digest In-flight Ownership	2026-09-13 21:56:20 +03:00
Alexey	935b5a3527	Update LICENSING.md	2026-09-13 16:01:48 +03:00
Alexey	1ea5f7a1d6	Atomic Lifecycle for Writer Refresh + Hardswap	2026-09-12 20:14:41 +03:00
Alexey	54197e848a	Update tests.rs	2026-09-11 20:33:01 +03:00
Alexey	479899240a	WEB: websocket-lanes upgrade-fail recovery #925	2026-09-10 23:11:36 +03:00
Alexey	844e41ea34	Races in admission + accounting + publication,+ PID fixed	2026-09-09 22:45:02 +03:00
Alexey	021ad1fe68	WEB Bridge Sideband	2026-09-08 21:29:32 +03:00
Alexey	4ca7418442	Merge pull request #923 from telemt/staled-ws Stale Websocket-lanes recovers after restart + Native macOS status-schema preserved	2026-09-08 10:02:48 +03:00
Alexey	464bc180e1	Rustfmt	2026-09-07 21:01:56 +03:00
Alexey	8b0ee9bf3d	Bump -> 3.5.7	2026-09-07 20:59:31 +03:00
Alexey	24c4cefc74	Native macOS status-schema preserved Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-07 18:33:12 +03:00
Alexey	97c046757a	Stale Websocket-lanes recovers after restart Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-07 18:08:24 +03:00
Alexey	4e3d560a88	Merge pull request #919 from nikoano/fix/install-port-check-tcp-only fix(install): probe only TCP when validating the target port	2026-09-07 00:03:33 +03:00
Alexey	3693d1e2a8	GHA Workflows updated	2026-09-06 20:17:30 +03:00
Alexey	f857aefd06	Dependencies Update + Rust 1.88	2026-09-06 19:52:12 +03:00
Alexey	3cb123fbf0	Create web_decoy_fasttrack.rs	2026-09-06 18:54:17 +03:00
Alexey	597b6b0226	Bump -> 3.5.6	2026-09-06 18:52:28 +03:00
Alexey	63b9cce25f	Docs for Decoy Fast-Track Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-06 18:51:39 +03:00
Alexey	20a4d50524	Restart-gated Decoy Fast-Track Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-06 18:51:13 +03:00
Alexey	106b26a5b7	Decoy Fasttrack Drafts Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-05 21:18:48 +03:00
nikoano	9908e04e04	fix(install): probe only TCP when validating the target port	2026-09-05 17:03:34 +03:00
Alexey	9f023ff9c7	WEB Bounded Bridge Recovery added Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-04 19:01:56 +03:00
Alexey	0d044c7372	WEB WS Downlink correctness + peer-lease fixed Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-03 20:24:06 +03:00
Alexey	e796cb112c	Update activity.rs Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-03 20:13:37 +03:00
Alexey	7de6edda98	Security-regression fixed + Uplink moduled Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-03 20:11:59 +03:00
Alexey	7f4e637b99	Decoy Contract sanitized Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-03 19:01:52 +03:00
Alexey	50faaba8c5	Generation Fence against Cancellation race after HTTP-Runner Fresh Reincarnation Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-03 19:00:06 +03:00
Alexey	9170e347f5	Concurrent Uplinks w/ wrong single-flight recovery fixes Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-02 18:55:32 +03:00
Alexey	0d8d331c7c	Bridge Request/Buffers/Recovery Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-02 18:49:10 +03:00
Alexey	01ffca5d34	WEB Session Lifecycle Observability + Bridge Recovery Drafts Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-09-01 19:19:52 +03:00
Alexey	aec7d1619a	Docs for WEB Carrier Status Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-31 21:50:17 +03:00
Alexey	718ce0847e	WEB Carrier Counters + Status Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-31 21:39:09 +03:00
Alexey	66f2b8889f	Split oversized runtime modules + Async tests hardened Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-30 09:39:33 +03:00
Alexey	281f63f940	Runtime Ownership hardened Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-30 08:38:03 +03:00
Alexey	1bb6b0bdda	Docs for Web Lifecycle API Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-29 16:19:43 +03:00
Alexey	084834f5ec	API for WEB: bounded lifecycle and overload observability added Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-29 16:19:21 +03:00
Alexey	012dc07a98	WEB Ephemeral Lifecycle Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-28 22:39:18 +03:00
Alexey	ac71d92ec4	Merge pull request #910 from telemt/flow/3.5.5 Flow/3.5.5	2026-08-27 22:11:44 +03:00
Alexey	9958fb3660	Merge pull request #909 from telemt/flow-bounded-neg WEB: Lifecycle + Lane ownership + Diag fixes + Carrier negotiation + WS Lifecycle + WEB Knobs in API	2026-08-27 22:02:36 +03:00
Alexey	5d2742d674	Bump -> 3.5.5	2026-08-27 21:53:35 +03:00
Alexey	773a584041	Update metrics.rs	2026-08-27 21:51:11 +03:00
Alexey	9008c37926	API for WEB Docs Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-27 21:44:10 +03:00
Alexey	cf0cd08387	WEB Knobs in API Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-27 21:42:14 +03:00
Alexey	d41a8c3220	Docs for WEB: carriers + auto-negotiation + websocket budgets Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-27 09:05:06 +03:00
Alexey	f73f52a033	WEB: Lifecycle + Lane ownership + Diag fixes Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-27 09:02:19 +03:00
Alexey	c75cf5cc9d	Carrier negotiation + WebSocket lifecycle Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-27 07:38:42 +03:00
Alexey	80a2737eed	Merge pull request #908 from telemt/flow/3.5.4 Flow/3.5.4	2026-08-27 00:17:44 +03:00
Alexey	655c1ed4e0	Merge pull request #907 from telemt/flow-carriers Bounded Debugging + Websocket Carriers + Carriers Negotiation	2026-08-27 00:17:14 +03:00
Alexey	14e8d10ad3	Rustfmt	2026-08-27 00:06:37 +03:00
Alexey	1b3477a333	Bump -> 3.5.4	2026-08-27 00:02:47 +03:00
Alexey	7dbc2da305	Native carrier negotiation + attempt deadline mapping fixed Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 23:58:24 +03:00
Alexey	e72b1f04d1	WEB Carriers negotiation and lane lifecycle bounds hardened Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 23:08:53 +03:00
Alexey	ef6231bf17	Update README.md	2026-08-26 21:35:00 +03:00
Alexey	c09876d2c6	Update README.md	2026-08-26 21:29:29 +03:00
Alexey	34eeb2d856	WEB Carriers Safe-matrix Refactored Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 20:33:33 +03:00
Alexey	8b2b88f30c	Session Residence + Ownership Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 18:44:17 +03:00
Alexey	016ad247a4	Pending Bytes&Items in Carrier Lanes Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 18:40:06 +03:00
Alexey	75b2aae009	Lane Open Modes Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 18:36:43 +03:00
Alexey	01cb219482	StreamCompletion + Carrier Lines tuning Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 18:35:50 +03:00
Alexey	f180057973	Carriers Auto-negotiation Aggressiveness Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 18:33:56 +03:00
Alexey	159339ed4b	Merge pull request #906 from telemt/prometheus-names Prometheus names	2026-08-26 18:20:12 +03:00
Alexey	9d2fac7d62	Merge pull request #894 from Losenmann/fix/metrics Fix name metric counter	2026-08-26 18:19:02 +03:00
Alexey	923c79796a	Bounded Debugging + Websocket Carriers + Carriers Negotiation Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>	2026-08-26 17:00:20 +03:00
Maxim Voynov	1ca0ae9b96	Merge branch 'main' into fix/metrics	2026-08-26 01:15:35 +07:00
Maxim Voynov	ede3314bee	Fix name metric counter	2026-08-25 18:14:13 +00:00