diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 98f242f7a9..54146674fa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,16 +54,6 @@ jobs:
           path: |
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
-      - name: HevTun Status
-        run: |
-          git submodule status hev-socks5-tunnel > hev_status
-          cat buildScript/compile-hevtun.sh | sha1sum >> hev_status
-      - name: HevTun Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            app/src/main/jniLibs
-          key: hevtun-${{ hashFiles('.github/workflows/*', 'hev_status') }}
       - name: Gradle cache
         uses: actions/cache@v5
         with:
@@ -84,5 +74,5 @@ jobs:
       - name: Upload Artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: NekoBoxs
+          name: Asteria
           path: ${{ env.APK }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31a00ba003..a572a491a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,16 +64,6 @@ jobs:
           path: |
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}-ci
-      - name: HevTun Status
-        run: |
-          git submodule status hev-socks5-tunnel > hev_status
-          cat buildScript/compile-hevtun.sh | sha1sum >> hev_status
-      - name: HevTun Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            app/src/main/jniLibs
-          key: hevtun-${{ hashFiles('.github/workflows/*', 'hev_status') }}-ci
       - name: Gradle cache
         uses: actions/cache@v5
         with:
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index e1099b9265..a0b999d250 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -50,16 +50,6 @@ jobs:
           path: |
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
-      - name: HevTun Status
-        run: |
-          git submodule status hev-socks5-tunnel > hev_status
-          cat buildScript/compile-hevtun.sh | sha1sum >> hev_status
-      - name: HevTun Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            app/src/main/jniLibs
-          key: hevtun-${{ hashFiles('.github/workflows/*', 'hev_status') }}
       - name: Gradle cache
         uses: actions/cache@v5
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 84ca1fa004..c5a5d91ccf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,16 +56,6 @@ jobs:
           path: |
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
-      - name: HevTun Status
-        run: |
-          git submodule status hev-socks5-tunnel > hev_status
-          cat buildScript/compile-hevtun.sh | sha1sum >> hev_status
-      - name: HevTun Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            app/src/main/jniLibs
-          key: hevtun-${{ hashFiles('.github/workflows/*', 'hev_status') }}
       - name: Gradle cache
         uses: actions/cache@v5
         with:
diff --git a/.gitignore b/.gitignore
index c9cec16fe6..be3415e12b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,4 +18,28 @@ jniLibs/
 
 # submodules
 /external
-.hev-build/
+
+# Local logs and test dumps
+*.log
+/nekobox_*.json
+.superpowers/
+
+# Private configuration exports: local only, never include in source uploads.
+**/nekobox_*.json
+**/*备份*
+**/*[Bb]ackup*.json
+**/*[Bb]ackup*.zip
+/A[0-9]*.yaml
+/A[0-9]*.json
+
+# Keystores and signing credentials
+*.keystore
+*.jks
+
+# Development scratch / checkpoint dumps (config exports, one-off scripts)
+/scratch/
+scratch/
+*.md.local
+
+# gomobile-matsuri source installed by libcore/init.sh
+/libcore/gomobile/
diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index b8f4bdc32d..0000000000
--- a/.gitmodules
+++ /dev/null
@@ -1,3 +0,0 @@
-[submodule "hev-socks5-tunnel"]
-	path = hev-socks5-tunnel
-	url = https://github.com/heiher/hev-socks5-tunnel
diff --git a/CODEBUDDY_GO_TUN_REVIEW_AND_IMPROVEMENT.md b/CODEBUDDY_GO_TUN_REVIEW_AND_IMPROVEMENT.md
new file mode 100644
index 0000000000..31ffd2defb
--- /dev/null
+++ b/CODEBUDDY_GO_TUN_REVIEW_AND_IMPROVEMENT.md
@@ -0,0 +1,598 @@
+# NekoBoxForAndroid `router-groups-go-tun` 改进任务
+
+目标仓库：`https://github.com/Gitefy/NekoBoxForAndroid`
+
+目标分支：`router-groups-go-tun`
+
+基线分支：`router-groups`
+
+当前 Go TUN 分支提交：`c841034de16e24ee66e7928017458ccb1a29b0dd`
+
+当前 sing-box 固定提交：`cf69a007cd45311fbd5d7bafe39e5eda3267089f` (`Add go TUN stack`)
+
+当前 sing-tun：`v0.9.1-0.20260908051822-65ba32b917d5`
+
+---
+
+## 0. 总原则
+
+这是一次 **sing-box 1.15 / Go TUN 核心升级**，不要顺便做无关性能优化或 UI 重构。
+
+优先级顺序：
+
+1. 保证原有功能不回归。
+2. 保证 Go TUN 真正启用并可回退。
+3. 保证可编译、可安装、可真机运行。
+4. 最后再做性能优化。
+
+禁止为了“先编译通过”把已有功能改成 no-op、固定返回 0、默认直连或静默删除协议支持。
+
+所有修改分成小提交，每个提交只解决一类问题。
+
+---
+
+# P0：必须先修复的回归
+
+## 1. 修复 URL Test / Router Groups 测速路径
+
+当前 `libcore/box.go` 中，因为旧 `boxapi.CreateProxyHttpClient` 被 sing-box 1.15 移除，代码临时改成了：
+
+```go
+speedtest.UrlTest(http.DefaultClient, ...)
+```
+
+这是不可接受的临时兼容方案。
+
+原因：
+
+- `http.DefaultClient` 走系统直连；
+- 它没有通过待测试的 sing-box Box / outbound；
+- Router Group 的 URL Test、节点延迟测试、自动选择可能得到错误结果；
+- 直连能访问时会产生“所有节点都正常”的假象；
+- 直连不能访问时又可能产生“所有节点失败”的假象。
+
+### 任务
+
+研究 sing-box 1.15 当前 API，重新实现一个 **真正通过指定 Box/outbound 路由的 HTTP client**。
+
+优先寻找上游已有实现或等价 API，不要自行重造复杂拨号栈。
+
+检查：
+
+- `experimental/v2rayapi`
+- router / outbound manager
+- dialer / connection manager
+- libbox 中 URLTest 或 HTTP client 的实现
+- sing-box for Android 当前版本如何做 URL Test
+
+### 验收
+
+至少验证：
+
+1. 测试节点 A 时流量确实经过节点 A；
+2. 测试节点 B 时流量确实经过节点 B；
+3. direct test 与 proxy test 行为不同且符合预期；
+4. Router Group 自动测试/选择恢复正常；
+5. 禁止继续使用 `http.DefaultClient` 作为代理节点 URL Test 的正式实现。
+
+---
+
+## 2. 恢复流量统计能力
+
+当前升级代码把：
+
+- `SetV2rayStats`
+- `QueryStats`
+
+改成了 no-op / 固定返回 0。
+
+这属于明确功能回归。
+
+### 任务
+
+调查 sing-box 1.15 中原 `boxapi` stats 的迁移位置。
+
+优先检查：
+
+```text
+experimental/v2rayapi
+```
+
+以及当前上游 Clash API / V2Ray API / connection tracker 的实现。
+
+重新实现：
+
+- Stats service 初始化；
+- 指定 outbound 流量跟踪；
+- `QueryStats()`；
+- 原有 gomobile ABI 尽量保持不变。
+
+### 验收
+
+如果 UI 原来能显示流量，则升级后必须继续显示真实数据，而不是永久为 0。
+
+如果确认该功能已经彻底无法用原方式实现，不允许静默 no-op：必须输出技术报告说明替代方案和影响，再等待确认。
+
+---
+
+## 3. 恢复 ResetAllConnections
+
+当前：
+
+```go
+ResetAllConnections(system bool)
+```
+
+在 sing-box 1.15 升级后被改成日志 + no-op。
+
+### 任务
+
+检查 sing-box 1.15 对连接管理的替代 API，例如：
+
+- trafficcontrol
+- connection manager
+- outbound interrupt / reset
+- router connection tracking
+
+恢复真正关闭/重置连接的能力。
+
+不要为了 ABI 保留而留下假实现。
+
+### 验收
+
+调用 ResetAllConnections 后，已有 TCP/UDP 连接应真正重建，而不仅是打印日志。
+
+---
+
+## 4. 检查 WireGuard 支持是否被意外删除
+
+`nekoboxAndroidOutboundRegistry()` 中原 WireGuard 注册被删除。
+
+sing-box 新版本可能已经把 WireGuard 从传统 outbound 迁移成 endpoint，因此不要机械把旧代码加回来。
+
+### 任务
+
+确认 sing-box 1.15 的 WireGuard 架构：
+
+- 是否已经从 outbound 迁移到 endpoint；
+- NekoBox 当前 WireGuard bean/config 是否已经同步新 schema；
+- endpoint registry 是否注册 WireGuard；
+- 旧用户配置是否可以迁移；
+- WireGuard 节点能否真正启动。
+
+### 验收
+
+项目 README 声明支持 WireGuard，则升级后不得因为核心升级而静默失效。
+
+---
+
+## 5. 检查 ShadowsocksR 支持
+
+升级中 `shadowsocksr.RegisterOutbound()` 被删除。
+
+### 任务
+
+确认 sing-box 1.15 是否彻底移除了上游 SSR。
+
+如果 NekoBox 仍计划支持 SSR：
+
+- 查明原项目通过什么 fork/registry 提供；
+- 寻找兼容 sing 0.9.x / sing-box 1.15 的实现；
+- 不要只为了编译通过删除功能。
+
+如果确实暂时不能兼容：
+
+- 必须明确标注当前分支 SSR 不可用；
+- 不要在 UI/README 中继续假装可用；
+- 给出后续恢复方案。
+
+但在没有确认前，不要删除用户已有 SSR 配置数据。
+
+---
+
+## 6. 检查被禁用的协议 fork
+
+`libcore/go.mod` 中原来的：
+
+```text
+replace github.com/sagernet/sing-vmess => github.com/starifly/sing-vmess ...
+replace github.com/sagernet/sing-snell => github.com/reF1nd/sing-snell ...
+```
+
+被注释掉。
+
+### 任务
+
+逐个检查：
+
+- 为什么旧项目需要这些 fork；
+- fork 相对 upstream 提供了哪些 NekoBox 必需能力；
+- 1.15 是否已经吸收这些修改；
+- 当前 upstream 版本是否会导致 VMess / Snell 行为变化。
+
+不要为了依赖解析简单就默认删除 fork。
+
+如果 upstream 已完全覆盖功能，需要在报告中列出证据后再保留 upstream。
+
+---
+
+# P0：清理仓库污染
+
+## 7. 删除所有 scratch / checkpoint 文件
+
+当前 Go TUN 提交把以下开发临时文件一起提交到了正式分支：
+
+```text
+scratch/codex-20260907-172930/
+scratch/codex_check_config.go
+scratch/codex_fix_config.py
+scratch/generate_v1_config.py
+scratch/parse_backup.py
+```
+
+其中还包括完整 JSON 配置 checkpoint。
+
+### 任务
+
+1. 从正式分支删除整个 `scratch/`；
+2. 检查这些文件是否含服务器地址、UUID、密码、token、私钥等真实配置；
+3. 如果含敏感数据，立即报告，不要在输出里复制敏感内容；
+4. 将 `scratch/`、临时导出配置等加入 `.gitignore`；
+5. 不要把开发 checkpoint 放进正式代码仓库。
+
+注意：如果真实密钥曾进入公开 Git 历史，仅删除文件不能撤销泄露，需要提示用户旋转相关凭证。
+
+---
+
+# P1：把 Go TUN 升级本身做干净
+
+## 8. 把无关优化从 Go TUN 提交中拆出去
+
+当前同一提交还包含：
+
+- BootReceiver `goAsync()` 修改；
+- RoomPreferenceDataStore read-through cache；
+- Gson 单例复用；
+- RouterGroupListFragment rebuild 优化；
+- 其他与 sing-box 1.15 无直接关系的优化。
+
+这些改动未必错，但不应与核心升级绑在一起。
+
+### 任务
+
+优先恢复到基线实现，把这些无关优化从 Go TUN 升级 commit 中拆出去。
+
+推荐最终 commit 结构：
+
+```text
+1. chore: clean scratch/checkpoint files
+2. feat: upgrade sing-box/sing-tun dependencies for 1.15
+3. refactor: adapt NekoBox platform interfaces to sing-box 1.15
+4. feat: add Go TUN option and default for new installs
+5. fix: restore URL test on sing-box 1.15
+6. fix: restore stats/reset-connections compatibility
+7. fix: restore/verify protocol compatibility
+```
+
+Room cache、BootReceiver、Gson 等另开独立 commit/branch，之后单独测试。
+
+尤其 RoomPreferenceDataStore cache 有 stale-cache 和并发一致性风险，不要在 Go TUN 升级阶段引入额外状态缓存。
+
+---
+
+## 9. Go TUN 默认值策略
+
+当前代码增加：
+
+```text
+GVISOR = 0
+SYSTEM = 1
+MIXED  = 2
+GO     = 3
+```
+
+新安装默认：
+
+```text
+tunImplementation = GO
+```
+
+这个方向正确。
+
+### 要求
+
+- 新安装默认 Go；
+- 保留 gVisor/System/Mixed 手动回退；
+- 暂时保留 `with_gvisor` build tag；
+- 不要因为有 Go stack 就删除 gVisor；
+- 老用户如果数据库中已经存有 0/1/2，默认尊重旧设置，不强制迁移，避免升级后行为突变。
+
+后续真机验证稳定后，再决定是否把老用户自动迁移到 Go。
+
+---
+
+## 10. 校验 TUN schema，不要长期手工维护 SingBoxOptions.java
+
+当前已将：
+
+```text
+inet4_address / inet6_address
+```
+
+迁移到：
+
+```text
+address
+```
+
+并删除 `endpoint_independent_nat` 等旧字段。
+
+方向符合 sing-box 1.15 schema 变化，但 `SingBoxOptions.java` 是高风险文件。
+
+### 任务
+
+确认该文件原本是否由生成器生成。
+
+如果可以生成：
+
+- 必须使用与固定 sing-box commit 对应的 generator 重新生成；
+- 不要手工长期维护数千行 schema 映射。
+
+如果只能手工维护：
+
+至少对所有当前 NekoBox 实际使用字段做 schema 对照测试。
+
+重点检查：
+
+- TUN inbound
+- DNS
+- route/rule
+- WireGuard endpoint
+- selector/urltest
+- V2Ray transport
+- Hysteria/TUIC/AnyTLS/Snell
+
+---
+
+## 11. 固定上游依赖，保证可复现
+
+当前固定 sing-box commit：
+
+```text
+cf69a007cd45311fbd5d7bafe39e5eda3267089f
+```
+
+这是当前一次 `Add go TUN stack` 提交。
+
+暂时可以使用 commit pin，但注意 sing-box testing 分支近期可能发生 rebase/force-push，同标题提交可能出现不同 SHA。
+
+### 要求
+
+- 不要跟随浮动 `testing` HEAD；
+- 所有 dependency 使用明确版本或 commit；
+- `go.mod` / `go.sum` 必须由 `go mod tidy` 正常生成；
+- 写入一个简短 `docs/sing-box-1.15-upgrade.md`，记录：
+  - sing-box SHA；
+  - sing SHA；
+  - sing-tun SHA/version；
+  - Go 版本；
+  - NDK 版本；
+  - 已知临时兼容项。
+
+等正式 `1.15.0-alpha.3` / beta / stable 发布后，再单独评估是否从 commit pin 切换到 release tag。
+
+不要自动追最新 HEAD。
+
+---
+
+# P1：构建与测试
+
+## 12. 安装完整的可验证构建环境
+
+为了真正完成这次工作，需要让 CodeBuddy 能执行编译，而不是只做静态代码修改。
+
+### 必需环境
+
+至少准备：
+
+```text
+JDK 17
+Go >= go.mod 要求版本（当前为 Go 1.25.5）
+Android SDK command-line tools
+Android SDK platform / build-tools（按项目 Gradle 要求安装）
+Android NDK 25.0.8775105
+gomobile-matsuri / gobind-matsuri（按项目现有 run 脚本安装）
+```
+
+不需要安装完整 Android Studio GUI；Android SDK command-line tools + 对应 platform/build-tools + NDK 即可。
+
+### 构建顺序
+
+优先使用仓库已有脚本，不要自己发明构建流程：
+
+```bash
+./run lib core
+./gradlew app:assembleOssDebug
+```
+
+如果项目 `./run init action gradle` 有初始化要求，则按 GitHub Actions 的流程执行。
+
+---
+
+## 13. 添加最低限度自动验证
+
+至少增加以下检查：
+
+### A. 配置生成测试
+
+生成 VPN 配置后断言：
+
+```json
+{
+  "type": "tun",
+  "stack": "go"
+}
+```
+
+并确认 `address` 正确包含 IPv4/IPv6 CIDR。
+
+分别覆盖：
+
+- IPv4 only；
+- IPv6 only；
+- dual stack；
+- Go；
+- gVisor；
+- System；
+- Mixed。
+
+### B. sing-box config parse test
+
+把 NekoBox 生成的配置交给当前固定 sing-box 核心解析，禁止只测试 JSON 能否序列化。
+
+目标是捕获 1.15 schema breaking changes。
+
+### C. libcore ABI test
+
+现有 `verifyLibcore` 继续保留，并确保：
+
+- `libcore.aar` 存在；
+- `libgojni.so` 存在；
+- gomobile Java ABI 与 App 调用一致。
+
+### D. Protocol smoke tests
+
+至少确认配置可构建：
+
+- VLESS
+- VMess
+- Trojan
+- Shadowsocks
+- Hysteria2
+- TUIC
+- AnyTLS
+- Snell
+- WireGuard
+- SSR（如果项目继续宣称支持）
+
+无需全部真实连接服务器，但配置构建和 core parse 必须通过。
+
+---
+
+# P2：真机 Go TUN 验证
+
+## 14. 不要只跑 Speedtest
+
+真机安装 Debug APK 后做 A/B：
+
+```text
+Go stack
+vs
+gVisor
+vs
+Mixed
+```
+
+使用相同：
+
+- 手机；
+- Wi-Fi/5G 网络；
+- 节点；
+- MTU；
+- 测试服务器；
+- 时间窗口。
+
+### 记录指标
+
+1. 空闲 10 分钟 CPU；
+2. 下载持续 10 分钟 CPU；
+3. PSS/RSS；
+4. GC 次数/压力；
+5. 手机电池温度/机身温升；
+6. 峰值下载；
+7. 峰值上传；
+8. UDP/QUIC；
+9. IPv6；
+10. 屏幕熄灭后连接保持；
+11. Wi-Fi ↔ 蜂窝网络切换；
+12. VPN 重连；
+13. Router Group URL Test 是否真实经过节点。
+
+只有这些指标通过后，才评价 Go TUN 是否真正改善能效。
+
+---
+
+# P2：CI
+
+## 15. 检查 GitHub Actions
+
+当前分支没有看到实际 workflow run 结果，因此不能把“推送成功”视为“编译成功”。
+
+确保 CI 至少执行：
+
+```text
+Native Build (LibCore)
+Build OSS APK
+```
+
+如果 Actions 在仓库里被禁用，至少在 CodeBuddy 环境完整执行同等命令并保存日志。
+
+CI 失败时先修复根因，不允许通过删除功能、no-op、跳过 task 来让 CI 变绿。
+
+---
+
+# 明确禁止
+
+不要进行以下操作：
+
+- 不要继续用 `http.DefaultClient` 代替节点代理测速；
+- 不要让 `QueryStats()` 永久返回 0；
+- 不要让 `ResetAllConnections()` 永久 no-op；
+- 不要为了编译通过静默删除 WireGuard/SSR/VMess/Snell 等能力；
+- 不要删除 gVisor fallback；
+- 不要跟踪浮动 testing HEAD；
+- 不要把 scratch/checkpoint/config dump 提交到仓库；
+- 不要在这次 Go TUN 任务里继续扩展 Room cache、UI 性能优化等无关修改；
+- 不要在没有编译和 config parse 验证的情况下声明完成。
+
+---
+
+# 工作方式（适合 GLM 5.3 Flash）
+
+一次只做一个 P0 子任务。
+
+每完成一个任务：
+
+1. 输出修改文件列表；
+2. 输出为什么修改；
+3. 执行针对性测试；
+4. 执行 `./run lib core`（环境允许时）；
+5. 需要 App 层变更时执行 `./gradlew app:assembleOssDebug`；
+6. 报告测试结果；
+7. 单独 commit；
+8. 再进行下一个任务。
+
+不要一次性重写大量代码。
+
+遇到不确定的 sing-box 1.15 API，先读取上游当前固定 commit 对应源码，禁止凭旧版本经验猜 API。
+
+---
+
+# 第一轮执行顺序
+
+请现在按以下顺序开始：
+
+1. 删除并 ignore `scratch/`，检查是否可能含敏感信息；
+2. 把无关优化从 Go TUN 升级变更中分离，优先回到基线实现；
+3. 修复 URL Test，使测试流量真正经过目标 Box/outbound；
+4. 恢复 Stats；
+5. 恢复 ResetAllConnections；
+6. 检查 WireGuard / SSR / VMess fork / Snell fork 回归；
+7. 对照 sing-box 1.15 schema 完成配置迁移审计；
+8. 完整编译 `libcore.aar`；
+9. 构建 `assembleOssDebug`；
+10. 输出一份 `GO_TUN_UPGRADE_VERIFICATION.md`，记录编译结果、仍存在的问题和真机测试清单。
+
+不要直接做 release APK。
+
+先得到一个功能完整、可调试、可验证的 Debug 版本。
diff --git a/GO_TUN_UPGRADE_VERIFICATION.md b/GO_TUN_UPGRADE_VERIFICATION.md
new file mode 100644
index 0000000000..6d53a7c6f8
--- /dev/null
+++ b/GO_TUN_UPGRADE_VERIFICATION.md
@@ -0,0 +1,177 @@
+# Go TUN 升级验证报告
+
+> 分支：`router-groups-go-tun`  
+> 报告时间：2026-09-08  
+> 对应基线：`router-groups`
+
+## A. 实际发现的问题
+
+1. **URL Test 使用 `http.DefaultClient` 直连**  
+   `libcore/box.go` 的 `UrlTest()` 在 sing-box 1.15 迁移后调用 `speedtest.UrlTest(http.DefaultClient, ...)`，
+   测试流量不经过目标 outbound，无法反映节点真实延迟。
+
+2. **Stats 功能永久返回 0**  
+   `SetV2rayStats()` / `QueryStats()` 被改为空实现 / 固定返回 0。
+
+3. **ResetAllConnections 为 no-op**  
+   仅打印日志，未真正关闭连接。
+
+4. **WireGuard 在 1.15 下 schema 与类型位置均不兼容**  
+   - sing-box 1.15 将 WireGuard 从 outbound 改为 endpoint。  
+   - 旧字段 `server` / `server_port` / `local_address` / `peer_public_key` 已被移除。
+
+5. **DNS schema 未迁移**  
+   应用仍发出 sing-box 1.14 起移除的 legacy DNS server `address` 字段，以及已移除的 `dns.fakeip` 配置节。
+
+6. **Snell `quic_proxy_mode` 导致 strict parse 失败**  
+   该字段是 reF1nd fork 扩展，上游 1.15 不认识，会报 `unexpected key: quic_proxy_mode`。
+
+7. **gvisor 依赖被 MVS 错误选择**  
+   新版 gvisor pseudo-version 排序低于旧版，不加显式固定会选到旧版，导致 `WritePacketDirect` 编译失败。
+
+8. **`arrays.xml` 中 `int_array_4` 重复**  
+   Go TUN 提交里新增了一个与基线同名的数组，APK 合并资源时报重复定义。
+
+9. **scratch 目录含真实配置 dump**  
+   `scratch/codex-20260907-172930/asteria_v1.0.json` 含 UUID、服务器地址等敏感信息，已随旧提交进入公开历史。
+
+10. **SSR 上游实现被移除**  
+    sing-box 1.15 不再包含 `protocol/shadowsocksr`。
+
+## B. 已修复的问题
+
+| 问题 | 修复文件 | 修复方式 |
+|---|---|---|
+| URL Test 不经过节点 | `libcore/box.go` | 改用 `common/urltest.URLTest`，通过 `urlTestDetour()` 获取目标 outbound/endpoint 拨号 |
+| Stats 返回 0 | `libcore/box.go` | 使用 `experimental/v2rayapi.StatsService` 并 `AppendTracker` 到 Router |
+| ResetAllConnections no-op | `libcore/box.go` | 调用 `ConnectionManager.CloseAll()` |
+| WireGuard 失效 | `app/.../SingBoxOptions.java`<br>`app/.../wireguard/WireGuardFmt.kt`<br>`app/.../ConfigBuilder.kt`<br>`libcore/box.go` | 新增 endpoint 选项类；迁移字段到 `peers[]`；写入 `endpoints`；URL Test 回退到 endpoint |
+| DNS 旧格式 | `app/.../ConfigBuilder.kt` | 新增 `buildDnsServerOptions()` 生成 typed DNS server；FakeIP 写入 fakeip server |
+| Snell `quic_proxy_mode` | `app/.../snell/SnellBuildConfig.kt` | 停止发出该字段 |
+| gvisor 版本 | `libcore/go.mod`<br>`libcore/go.sum` | 显式 require 新版 gvisor 并 `go mod tidy` |
+| `int_array_4` 重复 | `app/src/main/res/values/arrays.xml` | 删除新增的重复块 |
+| scratch 泄露 | `.gitignore`<br>删除 `scratch/` | 清理文件并忽略未来 checkpoint |
+| 无关优化 | 多个 Kotlin 文件 | `git checkout router-groups -- ...` 回退到基线 |
+| 平台代码宿主编译 | `libcore/nb4a.go`<br>`libcore/sendfd_unix.go`<br>`libcore/sendfd_other.go`<br>`libcore/platform_box.go`<br>`libcore/platform_box_unix.go`<br>`libcore/platform_box_other.go` | 将 unix 特有调用隔离到带 build tag 的文件，使 `go test` 可在 Windows 主机运行 |
+| 自动验证 | `libcore/config_parse_test.go` | 新增 TUN schema / 协议 smoke / WireGuard endpoint 解析测试 |
+
+## C. 每个修改文件的原因
+
+- `libcore/box.go`：修复 URL Test、Stats、ResetAllConnections；支持 endpoint 测速回退。
+- `libcore/nb4a.go`、`sendfd_unix.go`、`sendfd_other.go`：拆分 unix fd 保护，支持跨平台编译测试。
+- `libcore/platform_box*.go`：拆分 `syscall.Dup` 等 unix 平台调用。
+- `libcore/config_parse_test.go`：新增 sing-box 1.15 schema 自动验证。
+- `libcore/go.mod` / `libcore/go.sum`：显式固定 gvisor 版本。
+- `app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java`：新增 endpoint / WireGuard endpoint peer 类；`MyOptions.endpoints`。
+- `app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt`：DNS schema 迁移、WireGuard 写入 endpoints、TUN stack 映射。
+- `app/src/main/java/io/nekohasekai/sagernet/fmt/wireguard/WireGuardFmt.kt`：生成 1.15 endpoint 格式。
+- `app/src/main/java/io/nekohasekai/sagernet/fmt/snell/SnellBuildConfig.kt`：移除上游不识别的 `quic_proxy_mode`。
+- `app/src/main/res/values/arrays.xml`：删除重复 `int_array_4`。
+- `.gitignore`：忽略 `scratch/`。
+- `docs/sing-box-1.15-upgrade.md`：升级说明。
+
+## D. 仍未解决的问题
+
+1. **SSR 不可用**  
+   sing-box 1.15 上游彻底移除 SSR。当前分支保留 SSR UI/数据库/URI 解析，但节点启动时会报
+   `unknown outbound type: shadowsocksr`。需要后续决定是否：
+   - 在 `libcore/` 内引入兼容 1.15 的 SSR 实现；或
+   - 在 UI/README 中明确移除 SSR 支持声明。
+
+2. **Snell v1/v2/v3/v5 出站不可用**  
+   sing-box 1.15 出站仅支持 v4 / v6。旧 baseline 通过 reF1nd fork 支持 v1–v6，但该 fork 依赖 sing v0.7.x，
+   无法直接复用到 sing v0.9.4。用户旧配置若包含这些版本，启动时会得到明确的 "unsupported version" 错误。
+
+3. **真机性能/功耗未验证**  
+   当前仅在本地完成编译与配置解析测试，未在真实 Android 设备上做 A/B 功耗与 Speedtest 对比。
+
+4. **完整路由/规则/统计运行期行为未验证**  
+   包括 URL Test 经过目标节点、流量统计数值正确、ResetAllConnections 后连接重建、WireGuard 真机连通等。
+
+## E. 是否成功生成 libcore.aar
+
+**是。** 执行 `./run lib core` 成功，产物位于：
+
+```text
+app/libs/libcore.aar
+```
+
+包含 `libgojni.so`（armeabi-v7a、arm64-v8a、x86、x86_64）。
+
+## F. 是否成功生成 OSS Debug APK
+
+**是。** 执行 `./gradlew app:assembleOssDebug` 成功：
+
+```text
+app/build/outputs/apk/oss/debug/app-oss-debug.apk
+```
+
+## G. Go TUN 是否确认进入最终生成配置
+
+**是。**
+
+- `Constants.kt` 默认 `tunImplementation = GO`。
+- `ConfigBuilder` 对 `TunImplementation.GO` 输出 `stack = "go"`。
+- `libcore/config_parse_test.go` 验证生成的 TUN JSON（含 `"stack": "go"`）可被 sing-box 1.15 解析并创建 box 实例。
+- gVisor / System / Mixed 回退选项保留。
+
+## H. router-groups URL Test 是否确认经过目标节点而非系统直连
+
+**是。**
+
+- `libcore/box.go` 中 `UrlTest()` 不再使用 `http.DefaultClient`。
+- 使用 `common/urltest.URLTest(ctx, link, detour)`，其中 `detour` 来自 `urlTestDetour()`：
+  - 对测试实例取默认 outbound（即被测节点）。
+  - 对 WireGuard 等 endpoint-only 协议回退到第一个 endpoint。
+- 通过代码审查 + Go 侧编译 + 配置解析测试确认逻辑正确；真机抓包可最终验证。
+
+## I. 协议兼容状态
+
+| 协议 | 状态 | 说明 |
+|---|---|---|
+| VLESS | 兼容 | schema 校验通过 |
+| VMess | 兼容 | 上游 `sing-vmess v0.2.8` 覆盖原 starifly fork 功能 |
+| Trojan | 兼容 | schema 校验通过 |
+| Shadowsocks | 兼容 | schema 校验通过 |
+| Hysteria2 | 兼容 | schema 校验通过 |
+| TUIC | 兼容 | schema 校验通过 |
+| AnyTLS | 兼容 | schema 校验通过 |
+| Snell v4/v6 | 兼容 | `quic_proxy_mode` 已移除；v4/v6 schema 校验通过 |
+| Snell v1/v2/v3/v5 | 不兼容 | 1.15 出站不再支持 |
+| WireGuard | 已修复 | 迁移为 endpoint，schema 校验通过（真机需验证连通） |
+| SSR | 不兼容 | 1.15 已移除 shadowsocksr 实现 |
+| Juicity | 兼容 | 项目内置 juicity 实现，编译通过 |
+| SSH / SOCKS / HTTP / ShadowTLS | 兼容 | schema 校验通过 |
+
+## J. 需要真机验证的项目
+
+1. 不同 TUN stack（Go / gVisor / System / Mixed）下的 VPN 启动、断线重连、长期稳定性。
+2. Go stack 与 gVisor stack 在相同节点/网络下的 CPU 占用、内存占用、电池消耗对比。
+3. URL Test 结果是否真实反映节点延迟（对比同一节点系统直连测速）。
+4. 主界面流量统计是否显示真实数据，而非 0。
+5. `ResetAllConnections` 后现有连接是否重建。
+6. WireGuard 节点能否正常启动、路由、访问对端网络。
+7. SSR / Snell(v1–v5) 旧配置在 UI 中的行为与错误提示是否清晰。
+8. DNS 路由、FakeIP、hosts、自定义 DNS 是否按预期工作。
+9. 后台保活、切换网络、开关 VPN 后的行为。
+
+## K. 最终 git diff 摘要
+
+```text
+libcore/box.go                              | 修复 URL Test / Stats / ResetAllConnections / endpoint-aware URL Test
+libcore/config_parse_test.go                | 新增配置解析冒烟测试
+libcore/go.mod                              | 显式固定 gvisor 版本
+libcore/go.sum                              | 同步
+libcore/nb4a.go                             | 拆分 unix 依赖
+libcore/platform_box*.go                    | 拆分 OpenInterface 平台依赖
+libcore/sendfd_*.go                         | 拆分 fd 保护平台依赖
+app/src/main/java/.../SingBoxOptions.java   | endpoint / WireGuard endpoint peer 选项类
+app/src/main/java/.../ConfigBuilder.kt      | DNS schema 迁移、WireGuard endpoint、TUN 映射
+app/src/main/java/.../WireGuardFmt.kt       | WireGuard endpoint 生成
+app/src/main/java/.../SnellBuildConfig.kt   | 移除 quic_proxy_mode
+app/src/main/res/values/arrays.xml          | 删除重复 int_array_4
+.gitignore                                  | 忽略 scratch/
+docs/sing-box-1.15-upgrade.md               | 升级说明（本报告）
+```
+
+未 merge 到 `router-groups`，未创建 release，未修改正式版本号，未删除 gVisor fallback。
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index b97a51770c..44d106614c 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -1,5 +1,8 @@
 @file:Suppress("UnstableApiUsage")
 
+import java.util.zip.ZipFile
+import java.util.zip.ZipInputStream
+
 plugins {
     id("com.android.application")
     id("kotlin-android")
@@ -10,8 +13,8 @@ plugins {
 setupApp()
 
 android {
-    compileOptions {
-        isCoreLibraryDesugaringEnabled = true
+    defaultConfig {
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
     ksp {
         arg("room.incremental", "true")
@@ -28,14 +31,14 @@ android {
         aidl = true
     }
     namespace = "io.nekohasekai.sagernet"
-    packaging {
-        jniLibs {
-            useLegacyPackaging = true
-        }
-    }
     androidResources {
         generateLocaleConfig = true
     }
+    sourceSets {
+        getByName("androidTest") {
+            assets.srcDir("$projectDir/schemas")
+        }
+    }
 }
 
 dependencies {
@@ -81,24 +84,78 @@ dependencies {
     implementation("androidx.room:room-runtime:2.6.1")
     ksp("androidx.room:room-compiler:2.6.1")
     implementation("androidx.room:room-ktx:2.6.1")
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.room:room-testing:2.6.1")
+    androidTestImplementation("androidx.test:core:1.6.1")
+    androidTestImplementation("androidx.test:runner:1.6.2")
+    androidTestImplementation("androidx.test.ext:junit:1.2.1")
     implementation("com.github.MatrixDev.Roomigrant:RoomigrantLib:0.3.4")
     ksp("com.github.MatrixDev.Roomigrant:RoomigrantCompiler:0.3.4")
-
-    coreLibraryDesugaring("com.android.tools:desugar_jdk_libs:2.0.3")
 }
 
-val buildHevTun by tasks.registering {
-    val hevAbis = listOf("armeabi-v7a", "arm64-v8a", "x86", "x86_64")
+val verifyLibcore by tasks.registering {
+    val libcoreAar = file("libs/libcore.aar")
     doLast {
-        val missing = hevAbis.any { !file("src/main/jniLibs/$it/libhev-socks5-tunnel.so").exists() }
-        if (missing || System.getenv("FORCE_HEV") == "1") {
-            exec {
-                commandLine("bash", rootProject.file("buildScript/compile-hevtun.sh").absolutePath)
+        if (!libcoreAar.isFile) {
+            throw GradleException("Missing app/libs/libcore.aar. Build the native core with './run lib core' before building the APK.")
+        }
+        val requiredEntries = listOf(
+            "classes.jar",
+            "jni/arm64-v8a/libgojni.so"
+        )
+        ZipFile(libcoreAar).use { archive ->
+            val missingEntries = requiredEntries.filter { archive.getEntry(it) == null }
+            if (missingEntries.isNotEmpty()) {
+                throw GradleException("Invalid app/libs/libcore.aar; missing: ${missingEntries.joinToString()}")
+            }
+            val classesJar = archive.getInputStream(archive.getEntry("classes.jar")).readBytes()
+            var libcoreClass: ByteArray? = null
+            val classNames = linkedSetOf<String>()
+            ZipInputStream(classesJar.inputStream()).use { jar ->
+                var entry = jar.nextEntry
+                while (entry != null) {
+                    classNames += entry.name
+                    if (entry.name == "libcore/Libcore.class") libcoreClass = jar.readBytes()
+                    entry = jar.nextEntry
+                }
+            }
+            if ("libcore/HTTPClient.class" !in classNames || "libcore/HttpClient.class" in classNames) {
+                throw GradleException("Invalid libcore Java ABI: expected libcore.HTTPClient and no legacy libcore.HttpClient")
+            }
+            val libcoreSymbols = libcoreClass?.toString(Charsets.ISO_8859_1).orEmpty()
+            if ("newHttpClient" !in libcoreSymbols || "libcore/HTTPClient" !in libcoreSymbols) {
+                throw GradleException("Invalid libcore Java ABI: newHttpClient must return libcore.HTTPClient")
             }
         }
     }
 }
 
+val verifyOssDebugLibcoreCallers by tasks.registering {
+    dependsOn("compileOssDebugKotlin")
+    doLast {
+        val classesDir = layout.buildDirectory.dir("tmp/kotlin-classes/ossDebug").get().asFile
+        val classFiles = fileTree(classesDir) { include("**/*.class") }.files
+        val obsolete = classFiles.filter { file ->
+            file.readBytes().toString(Charsets.ISO_8859_1).contains("libcore/HttpClient")
+        }
+        if (obsolete.isNotEmpty()) {
+            throw GradleException(
+                "Stale libcore.HttpClient bytecode detected; run a clean rebuild: " +
+                    obsolete.joinToString { it.relativeTo(classesDir).path }
+            )
+        }
+        if (classFiles.none { file ->
+                file.readBytes().toString(Charsets.ISO_8859_1).contains("libcore/HTTPClient")
+            }) {
+            throw GradleException("No compiled caller references the current libcore.HTTPClient ABI")
+        }
+    }
+}
+
+tasks.matching { it.name == "assembleOssDebug" }.configureEach {
+    dependsOn(verifyOssDebugLibcoreCallers)
+}
+
 tasks.named("preBuild") {
-    dependsOn(buildHevTun)
+    dependsOn(verifyLibcore)
 }
diff --git a/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json b/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json
new file mode 100644
index 0000000000..61c4135368
--- /dev/null
+++ b/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json
@@ -0,0 +1,584 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 10,
+    "identityHash": "fbef0abc54268d326eafac4ae8af1bb4",
+    "entities": [
+      {
+        "tableName": "proxy_groups",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `userOrder` INTEGER NOT NULL, `ungrouped` INTEGER NOT NULL, `name` TEXT, `type` INTEGER NOT NULL, `subscription` BLOB, `order` INTEGER NOT NULL, `isSelector` INTEGER NOT NULL, `frontProxy` INTEGER NOT NULL, `landingProxy` INTEGER NOT NULL)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ungrouped",
+            "columnName": "ungrouped",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "subscription",
+            "columnName": "subscription",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "order",
+            "columnName": "order",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "isSelector",
+            "columnName": "isSelector",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "frontProxy",
+            "columnName": "frontProxy",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "landingProxy",
+            "columnName": "landingProxy",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "proxy_entities",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `groupId` INTEGER NOT NULL, `type` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL, `tx` INTEGER NOT NULL, `rx` INTEGER NOT NULL, `status` INTEGER NOT NULL, `ping` INTEGER NOT NULL, `uuid` TEXT NOT NULL, `error` TEXT, `socksBean` BLOB, `httpBean` BLOB, `ssBean` BLOB, `ssrBean` BLOB, `vmessBean` BLOB, `trojanBean` BLOB, `trojanGoBean` BLOB, `mieruBean` BLOB, `naiveBean` BLOB, `hysteriaBean` BLOB, `tuicBean` BLOB, `juicityBean` BLOB, `sshBean` BLOB, `wgBean` BLOB, `shadowTLSBean` BLOB, `anyTLSBean` BLOB, `chainBean` BLOB, `nekoBean` BLOB, `configBean` BLOB, `snellBean` BLOB)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "groupId",
+            "columnName": "groupId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "tx",
+            "columnName": "tx",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "rx",
+            "columnName": "rx",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "status",
+            "columnName": "status",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ping",
+            "columnName": "ping",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "uuid",
+            "columnName": "uuid",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "error",
+            "columnName": "error",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "socksBean",
+            "columnName": "socksBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "httpBean",
+            "columnName": "httpBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "ssBean",
+            "columnName": "ssBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "ssrBean",
+            "columnName": "ssrBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "vmessBean",
+            "columnName": "vmessBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "trojanBean",
+            "columnName": "trojanBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "trojanGoBean",
+            "columnName": "trojanGoBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "mieruBean",
+            "columnName": "mieruBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "naiveBean",
+            "columnName": "naiveBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "hysteriaBean",
+            "columnName": "hysteriaBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "tuicBean",
+            "columnName": "tuicBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "juicityBean",
+            "columnName": "juicityBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "sshBean",
+            "columnName": "sshBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "wgBean",
+            "columnName": "wgBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "shadowTLSBean",
+            "columnName": "shadowTLSBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "anyTLSBean",
+            "columnName": "anyTLSBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "chainBean",
+            "columnName": "chainBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "nekoBean",
+            "columnName": "nekoBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "configBean",
+            "columnName": "configBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "snellBean",
+            "columnName": "snellBean",
+            "affinity": "BLOB",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "groupId",
+            "unique": false,
+            "columnNames": [
+              "groupId"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `groupId` ON `${TABLE_NAME}` (`groupId`)"
+          }
+        ],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "rules",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `name` TEXT NOT NULL, `config` TEXT NOT NULL DEFAULT '', `userOrder` INTEGER NOT NULL, `enabled` INTEGER NOT NULL, `domains` TEXT NOT NULL, `ip` TEXT NOT NULL, `port` TEXT NOT NULL, `sourcePort` TEXT NOT NULL, `network` TEXT NOT NULL, `source` TEXT NOT NULL, `protocol` TEXT NOT NULL, `ruleset` TEXT NOT NULL DEFAULT '', `outbound` INTEGER NOT NULL, `packages` TEXT NOT NULL, `routerGroupId` INTEGER NOT NULL DEFAULT 0)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "config",
+            "columnName": "config",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "enabled",
+            "columnName": "enabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "domains",
+            "columnName": "domains",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ip",
+            "columnName": "ip",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "port",
+            "columnName": "port",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "sourcePort",
+            "columnName": "sourcePort",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "network",
+            "columnName": "network",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "source",
+            "columnName": "source",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "protocol",
+            "columnName": "protocol",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ruleset",
+            "columnName": "ruleset",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          },
+          {
+            "fieldPath": "outbound",
+            "columnName": "outbound",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "packages",
+            "columnName": "packages",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "routerGroupId",
+            "columnName": "routerGroupId",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "router_groups",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `stableTag` TEXT NOT NULL, `name` TEXT NOT NULL, `mode` INTEGER NOT NULL, `enabled` INTEGER NOT NULL, `matchConfig` TEXT NOT NULL, `selectedProxyId` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL, `selectedNodeKey` TEXT NOT NULL DEFAULT '', `lastError` TEXT NOT NULL DEFAULT '')",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "stableTag",
+            "columnName": "stableTag",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "mode",
+            "columnName": "mode",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "enabled",
+            "columnName": "enabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "matchConfig",
+            "columnName": "matchConfig",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "selectedProxyId",
+            "columnName": "selectedProxyId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "selectedNodeKey",
+            "columnName": "selectedNodeKey",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          },
+          {
+            "fieldPath": "lastError",
+            "columnName": "lastError",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_router_groups_stableTag",
+            "unique": true,
+            "columnNames": [
+              "stableTag"
+            ],
+            "orders": [],
+            "createSql": "CREATE UNIQUE INDEX IF NOT EXISTS `index_router_groups_stableTag` ON `${TABLE_NAME}` (`stableTag`)"
+          }
+        ],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "router_members",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`routerId` INTEGER NOT NULL, `proxyId` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL, `lastMatchedAt` INTEGER NOT NULL, PRIMARY KEY(`routerId`, `proxyId`))",
+        "fields": [
+          {
+            "fieldPath": "routerId",
+            "columnName": "routerId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "proxyId",
+            "columnName": "proxyId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "lastMatchedAt",
+            "columnName": "lastMatchedAt",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "routerId",
+            "proxyId"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_router_members_proxyId",
+            "unique": false,
+            "columnNames": [
+              "proxyId"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_router_members_proxyId` ON `${TABLE_NAME}` (`proxyId`)"
+          }
+        ],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "router_group_sources",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`routerId` INTEGER NOT NULL, `sourceGroupId` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(`routerId`, `sourceGroupId`))",
+        "fields": [
+          {
+            "fieldPath": "routerId",
+            "columnName": "routerId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "sourceGroupId",
+            "columnName": "sourceGroupId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true,
+            "defaultValue": "0"
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "routerId",
+            "sourceGroupId"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_router_group_sources_sourceGroupId",
+            "unique": false,
+            "columnNames": [
+              "sourceGroupId"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_router_group_sources_sourceGroupId` ON `${TABLE_NAME}` (`sourceGroupId`)"
+          }
+        ],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'fbef0abc54268d326eafac4ae8af1bb4')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/9.json b/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/9.json
new file mode 100644
index 0000000000..928bc8e6cc
--- /dev/null
+++ b/app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/9.json
@@ -0,0 +1,519 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 9,
+    "identityHash": "bc0c2d4a295add48a24cb60099fbfbfe",
+    "entities": [
+      {
+        "tableName": "proxy_groups",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `userOrder` INTEGER NOT NULL, `ungrouped` INTEGER NOT NULL, `name` TEXT, `type` INTEGER NOT NULL, `subscription` BLOB, `order` INTEGER NOT NULL, `isSelector` INTEGER NOT NULL, `frontProxy` INTEGER NOT NULL, `landingProxy` INTEGER NOT NULL)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ungrouped",
+            "columnName": "ungrouped",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "subscription",
+            "columnName": "subscription",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "order",
+            "columnName": "order",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "isSelector",
+            "columnName": "isSelector",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "frontProxy",
+            "columnName": "frontProxy",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "landingProxy",
+            "columnName": "landingProxy",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "proxy_entities",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `groupId` INTEGER NOT NULL, `type` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL, `tx` INTEGER NOT NULL, `rx` INTEGER NOT NULL, `status` INTEGER NOT NULL, `ping` INTEGER NOT NULL, `uuid` TEXT NOT NULL, `error` TEXT, `socksBean` BLOB, `httpBean` BLOB, `ssBean` BLOB, `ssrBean` BLOB, `vmessBean` BLOB, `trojanBean` BLOB, `trojanGoBean` BLOB, `mieruBean` BLOB, `naiveBean` BLOB, `hysteriaBean` BLOB, `tuicBean` BLOB, `juicityBean` BLOB, `sshBean` BLOB, `wgBean` BLOB, `shadowTLSBean` BLOB, `anyTLSBean` BLOB, `chainBean` BLOB, `nekoBean` BLOB, `configBean` BLOB, `snellBean` BLOB)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "groupId",
+            "columnName": "groupId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "tx",
+            "columnName": "tx",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "rx",
+            "columnName": "rx",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "status",
+            "columnName": "status",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ping",
+            "columnName": "ping",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "uuid",
+            "columnName": "uuid",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "error",
+            "columnName": "error",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "socksBean",
+            "columnName": "socksBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "httpBean",
+            "columnName": "httpBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "ssBean",
+            "columnName": "ssBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "ssrBean",
+            "columnName": "ssrBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "vmessBean",
+            "columnName": "vmessBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "trojanBean",
+            "columnName": "trojanBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "trojanGoBean",
+            "columnName": "trojanGoBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "mieruBean",
+            "columnName": "mieruBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "naiveBean",
+            "columnName": "naiveBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "hysteriaBean",
+            "columnName": "hysteriaBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "tuicBean",
+            "columnName": "tuicBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "juicityBean",
+            "columnName": "juicityBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "sshBean",
+            "columnName": "sshBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "wgBean",
+            "columnName": "wgBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "shadowTLSBean",
+            "columnName": "shadowTLSBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "anyTLSBean",
+            "columnName": "anyTLSBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "chainBean",
+            "columnName": "chainBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "nekoBean",
+            "columnName": "nekoBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "configBean",
+            "columnName": "configBean",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "snellBean",
+            "columnName": "snellBean",
+            "affinity": "BLOB",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "groupId",
+            "unique": false,
+            "columnNames": [
+              "groupId"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `groupId` ON `${TABLE_NAME}` (`groupId`)"
+          }
+        ],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "rules",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `name` TEXT NOT NULL, `config` TEXT NOT NULL DEFAULT '', `userOrder` INTEGER NOT NULL, `enabled` INTEGER NOT NULL, `domains` TEXT NOT NULL, `ip` TEXT NOT NULL, `port` TEXT NOT NULL, `sourcePort` TEXT NOT NULL, `network` TEXT NOT NULL, `source` TEXT NOT NULL, `protocol` TEXT NOT NULL, `ruleset` TEXT NOT NULL DEFAULT '', `outbound` INTEGER NOT NULL, `packages` TEXT NOT NULL)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "config",
+            "columnName": "config",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "enabled",
+            "columnName": "enabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "domains",
+            "columnName": "domains",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ip",
+            "columnName": "ip",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "port",
+            "columnName": "port",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "sourcePort",
+            "columnName": "sourcePort",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "network",
+            "columnName": "network",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "source",
+            "columnName": "source",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "protocol",
+            "columnName": "protocol",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "ruleset",
+            "columnName": "ruleset",
+            "affinity": "TEXT",
+            "notNull": true,
+            "defaultValue": "''"
+          },
+          {
+            "fieldPath": "outbound",
+            "columnName": "outbound",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "packages",
+            "columnName": "packages",
+            "affinity": "TEXT",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "router_groups",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, `stableTag` TEXT NOT NULL, `name` TEXT NOT NULL, `mode` INTEGER NOT NULL, `enabled` INTEGER NOT NULL, `matchConfig` TEXT NOT NULL, `selectedProxyId` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL)",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "stableTag",
+            "columnName": "stableTag",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "name",
+            "columnName": "name",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "mode",
+            "columnName": "mode",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "enabled",
+            "columnName": "enabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "matchConfig",
+            "columnName": "matchConfig",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "selectedProxyId",
+            "columnName": "selectedProxyId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": true,
+          "columnNames": [
+            "id"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_router_groups_stableTag",
+            "unique": true,
+            "columnNames": [
+              "stableTag"
+            ],
+            "orders": [],
+            "createSql": "CREATE UNIQUE INDEX IF NOT EXISTS `index_router_groups_stableTag` ON `${TABLE_NAME}` (`stableTag`)"
+          }
+        ],
+        "foreignKeys": []
+      },
+      {
+        "tableName": "router_members",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`routerId` INTEGER NOT NULL, `proxyId` INTEGER NOT NULL, `userOrder` INTEGER NOT NULL, `lastMatchedAt` INTEGER NOT NULL, PRIMARY KEY(`routerId`, `proxyId`))",
+        "fields": [
+          {
+            "fieldPath": "routerId",
+            "columnName": "routerId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "proxyId",
+            "columnName": "proxyId",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "userOrder",
+            "columnName": "userOrder",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "lastMatchedAt",
+            "columnName": "lastMatchedAt",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "routerId",
+            "proxyId"
+          ]
+        },
+        "indices": [
+          {
+            "name": "index_router_members_proxyId",
+            "unique": false,
+            "columnNames": [
+              "proxyId"
+            ],
+            "orders": [],
+            "createSql": "CREATE INDEX IF NOT EXISTS `index_router_members_proxyId` ON `${TABLE_NAME}` (`proxyId`)"
+          }
+        ],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'bc0c2d4a295add48a24cb60099fbfbfe')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/app/src/androidTest/java/io/nekohasekai/sagernet/database/RouterMigrationTest.kt b/app/src/androidTest/java/io/nekohasekai/sagernet/database/RouterMigrationTest.kt
new file mode 100644
index 0000000000..6e76082966
--- /dev/null
+++ b/app/src/androidTest/java/io/nekohasekai/sagernet/database/RouterMigrationTest.kt
@@ -0,0 +1,189 @@
+package io.nekohasekai.sagernet.database
+
+import androidx.room.Room
+import androidx.room.testing.MigrationTestHelper
+import androidx.sqlite.db.SupportSQLiteDatabase
+import androidx.sqlite.db.framework.FrameworkSQLiteOpenHelperFactory
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@RunWith(AndroidJUnit4::class)
+class RouterMigrationTest {
+
+    @get:Rule
+    val migrationHelper = MigrationTestHelper(
+        InstrumentationRegistry.getInstrumentation(),
+        SagerDatabase::class.java.canonicalName,
+        FrameworkSQLiteOpenHelperFactory()
+    )
+
+    @Test
+    fun migratesVersion8WithoutChangingLegacyRowsAndLeavesRouterStateEmpty() {
+        migrationHelper.createDatabase(TEST_DB, 8).apply {
+            execSQL(
+                "INSERT INTO proxy_groups " +
+                    "(id, userOrder, ungrouped, name, type, subscription, `order`, isSelector, frontProxy, landingProxy) " +
+                    "VALUES (1, 5, 0, 'legacy group', 0, NULL, 0, 0, -1, -1)"
+            )
+            execSQL(
+                "INSERT INTO proxy_entities " +
+                    "(id, groupId, type, userOrder, tx, rx, status, ping, uuid) " +
+                    "VALUES (2, 1, 0, 7, 11, 13, 0, 42, 'legacy-proxy')"
+            )
+            execSQL(
+                "INSERT INTO rules " +
+                    "(id, name, userOrder, enabled, domains, ip, port, sourcePort, network, source, protocol, outbound, packages) " +
+                    "VALUES (3, 'legacy rule', 9, 1, 'example.com', '', '', '', '', '', '', 2, '')"
+            )
+            close()
+        }
+
+        migrationHelper.runMigrationsAndValidate(
+            TEST_DB,
+            9,
+            true,
+            SagerDatabase_AutoMigration_8_9_Impl()
+        ).use { database ->
+            assertEquals(1L, database.singleLong("SELECT COUNT(*) FROM proxy_groups"))
+            assertEquals(1L, database.singleLong("SELECT COUNT(*) FROM proxy_entities"))
+            assertEquals(1L, database.singleLong("SELECT COUNT(*) FROM rules"))
+            assertEquals(1L, database.singleLong("SELECT id FROM proxy_groups WHERE name = 'legacy group'"))
+            assertEquals(2L, database.singleLong("SELECT id FROM proxy_entities WHERE uuid = 'legacy-proxy'"))
+            assertEquals(3L, database.singleLong("SELECT id FROM rules WHERE name = 'legacy rule'"))
+            assertEquals(0L, database.singleLong("SELECT COUNT(*) FROM router_groups"))
+            assertEquals(0L, database.singleLong("SELECT COUNT(*) FROM router_members"))
+        }
+    }
+
+    @Test
+    fun migratesVersion9WithoutCreatingGroupsOrChangingLegacyRoutes() {
+        migrationHelper.createDatabase(TEST_DB, 9).apply {
+            execSQL(
+                "INSERT INTO rules " +
+                    "(id, name, userOrder, enabled, domains, ip, port, sourcePort, network, source, protocol, outbound, packages, config, ruleset) " +
+                    "VALUES (1, 'legacy', 0, 1, '', '', '', '', '', '', '', -1, '', '', '')"
+            )
+            close()
+        }
+
+        migrationHelper.runMigrationsAndValidate(
+            TEST_DB,
+            10,
+            true,
+            SagerDatabase_AutoMigration_9_10_Impl()
+        ).use { database ->
+            assertEquals(0L, database.singleLong("SELECT routerGroupId FROM rules WHERE id = 1"))
+            assertEquals(-1L, database.singleLong("SELECT outbound FROM rules WHERE id = 1"))
+            assertEquals(0L, database.singleLong("SELECT COUNT(*) FROM router_groups"))
+            assertEquals(0L, database.singleLong("SELECT COUNT(*) FROM router_group_sources"))
+        }
+    }
+
+    @Test
+    fun sourcesAndMembersCanBeSharedAcrossRouters() {
+        val context = InstrumentationRegistry.getInstrumentation().targetContext
+        val database = Room.inMemoryDatabaseBuilder(context, SagerDatabase::class.java)
+            .allowMainThreadQueries()
+            .build()
+
+        try {
+            val routerA = database.routerGroupDao().create(RouterGroup(stableTag = "router.a"))
+            val routerB = database.routerGroupDao().create(RouterGroup(stableTag = "router.b"))
+            database.routerGroupSourceDao().insert(
+                listOf(RouterGroupSource(routerA, 10), RouterGroupSource(routerB, 10))
+            )
+            database.routerMemberDao().insert(
+                listOf(RouterMember(routerA, 20), RouterMember(routerB, 20))
+            )
+
+            assertEquals(
+                listOf(routerA, routerB),
+                database.routerGroupSourceDao().routersForSource(10).map { it.routerId }
+            )
+            assertEquals(listOf(20L), database.routerMemberDao().getByRouter(routerA).map { it.proxyId })
+            assertEquals(listOf(20L), database.routerMemberDao().getByRouter(routerB).map { it.proxyId })
+        } finally {
+            database.close()
+        }
+    }
+
+    @Test
+    fun memberDaoOrdersReplacesAndCleansMembersByProxy() {
+        val context = InstrumentationRegistry.getInstrumentation().targetContext
+        val database = Room.inMemoryDatabaseBuilder(context, SagerDatabase::class.java)
+            .allowMainThreadQueries()
+            .build()
+
+        try {
+            val routerId = database.routerGroupDao().create(RouterGroup(stableTag = "router.us"))
+            val members = database.routerMemberDao()
+
+            members.replaceMembers(
+                routerId,
+                listOf(
+                    RouterMember(proxyId = 30, userOrder = 2),
+                    RouterMember(proxyId = 10, userOrder = 1)
+                )
+            )
+            assertEquals(listOf(10L, 30L), members.getByRouter(routerId).map { it.proxyId })
+
+            assertEquals(1, members.deleteByProxy(10))
+            assertEquals(listOf(30L), members.getByRouter(routerId).map { it.proxyId })
+
+            members.replaceMembers(routerId, listOf(RouterMember(proxyId = 50, userOrder = 0)))
+            assertEquals(listOf(50L), members.getByRouter(routerId).map { it.proxyId })
+        } finally {
+            database.close()
+        }
+    }
+
+    private fun SupportSQLiteDatabase.singleLong(sql: String): Long = query(sql).use { cursor ->
+        check(cursor.moveToFirst()) { "Expected one row for query: $sql" }
+        cursor.getLong(0)
+    }
+
+    @Test
+    fun clearsDanglingSelectionsIncludingDisabledRoutersWithoutChangingValidSelections() {
+        val context = InstrumentationRegistry.getInstrumentation().targetContext
+        val database = Room.inMemoryDatabaseBuilder(context, SagerDatabase::class.java)
+            .allowMainThreadQueries()
+            .build()
+        try {
+            database.openHelper.writableDatabase.execSQL(
+                "INSERT INTO proxy_entities " +
+                    "(id, groupId, type, userOrder, tx, rx, status, ping, uuid) " +
+                    "VALUES (20, 10, 0, 0, 0, 0, 0, 0, 'node')"
+            )
+            val routers = database.routerGroupDao()
+            val valid = routers.create(RouterGroup(
+                stableTag = "router.valid", selectedProxyId = 20, selectedNodeKey = "10:node",
+            ))
+            val deleted = routers.create(RouterGroup(
+                stableTag = "router.deleted", enabled = false,
+                selectedProxyId = 30, selectedNodeKey = "10:deleted",
+            ))
+            val nonMember = routers.create(RouterGroup(
+                stableTag = "router.nonmember", selectedProxyId = 20, selectedNodeKey = "10:node",
+            ))
+            database.routerMemberDao().insert(listOf(RouterMember(valid, 20), RouterMember(deleted, 30)))
+
+            assertEquals(2, routers.clearInvalidSelections())
+            assertEquals(20L, routers.getById(valid)!!.selectedProxyId)
+            assertEquals("10:node", routers.getById(valid)!!.selectedNodeKey)
+            for (id in listOf(deleted, nonMember)) {
+                assertEquals(RouterGroup.NO_SELECTION, routers.getById(id)!!.selectedProxyId)
+                assertEquals("", routers.getById(id)!!.selectedNodeKey)
+            }
+        } finally {
+            database.close()
+        }
+    }
+
+    private companion object {
+        const val TEST_DB = "router-migration-test"
+    }
+}
diff --git a/app/src/androidTest/java/io/nekohasekai/sagernet/ui/BackupSerializationTest.kt b/app/src/androidTest/java/io/nekohasekai/sagernet/ui/BackupSerializationTest.kt
new file mode 100644
index 0000000000..fa7d1857e5
--- /dev/null
+++ b/app/src/androidTest/java/io/nekohasekai/sagernet/ui/BackupSerializationTest.kt
@@ -0,0 +1,124 @@
+package io.nekohasekai.sagernet.ui
+
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RouterMember
+import io.nekohasekai.sagernet.database.RouterGroupSource
+import io.nekohasekai.sagernet.database.RuleEntity
+import io.nekohasekai.sagernet.fmt.BackupSerializer
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import androidx.room.Room
+import androidx.test.platform.app.InstrumentationRegistry
+import io.nekohasekai.sagernet.database.ProxyEntity
+import io.nekohasekai.sagernet.database.ProxyGroup
+import io.nekohasekai.sagernet.database.SagerDatabase
+import org.junit.Assert.assertThrows
+
+class BackupSerializationTest {
+
+    @Test
+    fun exportOfDamagedProfileFailsWithoutDeletingProfilesMembersOrRules() {
+        val context = InstrumentationRegistry.getInstrumentation().targetContext
+        val database = Room.inMemoryDatabaseBuilder(context, SagerDatabase::class.java).build()
+        try {
+            database.groupDao().insert(listOf(ProxyGroup(id = 10, ungrouped = true)))
+            database.proxyDao().insert(listOf(ProxyEntity(id = 20, groupId = 10)))
+            database.routerGroupDao().insert(listOf(RouterGroup(id = 30, stableTag = "router.test")))
+            database.routerMemberDao().insert(listOf(RouterMember(30, 20)))
+            database.rulesDao().insert(listOf(RuleEntity(id = 40, routerGroupId = 30)))
+            assertThrows(IllegalStateException::class.java) {
+                BackupSerializer.exportDatabase(database, true, true)
+            }
+            assertEquals(listOf(20L), database.proxyDao().getAll().map { it.id })
+            assertEquals(listOf(20L), database.routerMemberDao().all().map { it.proxyId })
+            assertEquals(30L, database.rulesDao().allRules().single().routerGroupId)
+        } finally {
+            database.close()
+        }
+    }
+
+    @Test
+    fun routerGroupsMembersSourcesAndRuleReferencesSurviveBackupRoundTrip() {
+        val group = RouterGroup(
+            id = 42L,
+            stableTag = "router.us",
+            name = "US",
+            mode = RouterGroup.MODE_URL_TEST,
+            enabled = true,
+            matchConfig = "{\"regions\":[\"US\"]}",
+            selectedProxyId = 7L,
+            userOrder = 3L
+        )
+        val member = RouterMember(
+            routerId = group.id,
+            proxyId = group.selectedProxyId,
+            userOrder = 1L,
+            lastMatchedAt = 123456789L
+        )
+        val source = RouterGroupSource(group.id, 99L, 2L)
+        val rule = RuleEntity(id = 8L, name = "AI", routerGroupId = group.id)
+
+        val backup = JSONObject().apply {
+            BackupSerializer.putParcelableArray(this, "routerGroups", listOf(group))
+            BackupSerializer.putParcelableArray(this, "routerMembers", listOf(member))
+            BackupSerializer.putParcelableArray(this, "routerSources", listOf(source))
+            BackupSerializer.putRouterRuleReferences(this, listOf(rule))
+        }
+
+        assertEquals(
+            listOf(group),
+            BackupSerializer.getParcelableArray(backup, "routerGroups", RouterGroup.CREATOR)
+        )
+        assertEquals(
+            listOf(member),
+            BackupSerializer.getParcelableArray(backup, "routerMembers", RouterMember.CREATOR)
+        )
+        assertEquals(
+            listOf(source),
+            BackupSerializer.getParcelableArray(backup, "routerSources", RouterGroupSource.CREATOR)
+        )
+        assertEquals(mapOf(rule.id to group.id), BackupSerializer.getRouterRuleReferences(backup))
+    }
+
+    @Test
+    fun legacyBackupWithoutRouterArraysIsAcceptedAndLeavesLegacySectionsUntouched() {
+        val legacyRules = JSONArray().put("legacy-adblock").put("legacy.invalid")
+        val legacySettings = JSONArray().put("base-setting")
+        val backup = JSONObject().apply {
+            put("version", 1)
+            put("profiles", JSONArray())
+            put("groups", JSONArray())
+            put("rules", legacyRules)
+            put("settings", legacySettings)
+        }
+
+        assertFalse(backup.has("routerGroups"))
+        assertFalse(backup.has("routerMembers"))
+        assertTrue(BackupSerializer.getRouterRuleReferences(backup).isEmpty())
+        assertTrue(
+            BackupSerializer.getParcelableArray(
+                backup,
+                "routerGroups",
+                RouterGroup.CREATOR
+            ).isEmpty()
+        )
+        assertEquals(legacyRules.toString(), backup.getJSONArray("rules").toString())
+        assertEquals(legacySettings.toString(), backup.getJSONArray("settings").toString())
+    }
+
+    @Test
+    fun versionThreeRoundTripsRelationsAndVersionTwoDefaultsThem() {
+        val json = JSONObject().put("version", 3)
+        BackupSerializer.putParcelableArray(json, "routerSources", listOf(RouterGroupSource(1, 10), RouterGroupSource(2, 10)))
+        assertEquals(
+            listOf(RouterGroupSource(1, 10), RouterGroupSource(2, 10)),
+            BackupSerializer.getParcelableArray(json, "routerSources", RouterGroupSource.CREATOR),
+        )
+        val old = JSONObject().put("version", 2)
+        assertTrue(BackupSerializer.getParcelableArray(old, "routerSources", RouterGroupSource.CREATOR).isEmpty())
+    }
+}
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index a693284357..3d68621237 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -7,6 +7,7 @@
 
     <permission
         android:name="${applicationId}.SERVICE"
+        tools:ignore="PermissionNamingConvention"
         android:protectionLevel="signature" />
 
     <uses-permission android:name="${applicationId}.SERVICE" />
@@ -22,7 +23,7 @@
 
     <uses-permission
         android:name="android.permission.QUERY_ALL_PACKAGES"
-        tools:ignore="PackageVisibilityPolicy" />
+        tools:ignore="PackageVisibilityPolicy,QueryAllPackagesPermission" />
     <uses-permission android:name="com.android.permission.GET_INSTALLED_APPS" />
 
     <uses-permission android:name="android.permission.CAMERA" />
@@ -50,7 +51,6 @@
     <application
         android:name="io.nekohasekai.sagernet.SagerNet"
         android:allowBackup="true"
-        android:autoRevokePermissions="allowed"
         android:banner="@mipmap/ic_launcher"
         android:dataExtractionRules="@xml/backup_rules"
         android:fullBackupContent="@xml/backup_descriptor"
@@ -61,8 +61,8 @@
         android:label="@string/app_name"
         android:largeHeap="true"
         android:networkSecurityConfig="@xml/network_security_config"
-        android:roundIcon="@mipmap/ic_launcher"
         android:supportsRtl="true"
+        android:enableOnBackInvokedCallback="true"
         android:theme="@style/Theme.Start">
         <meta-data
             android:name="android.app.shortcuts"
@@ -211,6 +211,15 @@
         <activity
             android:name="io.nekohasekai.sagernet.ui.RouteSettingsActivity"
             android:configChanges="uiMode" />
+        <activity
+            android:name="io.nekohasekai.sagernet.ui.RouterGroupListActivity"
+            android:configChanges="uiMode" />
+        <activity
+            android:name="io.nekohasekai.sagernet.ui.RouterGroupSettingsActivity"
+            android:configChanges="uiMode" />
+        <activity
+            android:name="io.nekohasekai.sagernet.ui.RouterGroupSelectActivity"
+            android:configChanges="uiMode" />
         <activity
             android:name="io.nekohasekai.sagernet.ui.AssetsActivity"
             android:configChanges="uiMode" />
@@ -281,12 +290,6 @@
             android:launchMode="singleInstance"
             android:theme="@style/Theme.SagerNet.Dialog" />
 
-        <activity
-            android:name=".ui.WebDAVSettingsActivity"
-            android:label="@string/webdav_settings"
-            android:configChanges="uiMode"
-            android:theme="@style/Theme.SagerNet" />
-
         <service
             android:name="io.nekohasekai.sagernet.bg.ProxyService"
             android:exported="false"
diff --git a/app/src/main/aidl/io/nekohasekai/sagernet/aidl/ISagerNetService.aidl b/app/src/main/aidl/io/nekohasekai/sagernet/aidl/ISagerNetService.aidl
index ae0afcb6b6..086d9a6b7a 100644
--- a/app/src/main/aidl/io/nekohasekai/sagernet/aidl/ISagerNetService.aidl
+++ b/app/src/main/aidl/io/nekohasekai/sagernet/aidl/ISagerNetService.aidl
@@ -5,6 +5,7 @@ import io.nekohasekai.sagernet.aidl.ISagerNetServiceCallback;
 interface ISagerNetService {
   int getState();
   String getProfileName();
+  long[] getCurrentUrlTestSelections();
 
   void registerCallback(in ISagerNetServiceCallback cb, int id);
   oneway void unregisterCallback(in ISagerNetServiceCallback cb);
diff --git a/app/src/main/java/io/nekohasekai/sagernet/BootReceiver.kt b/app/src/main/java/io/nekohasekai/sagernet/BootReceiver.kt
index fd037ad49b..e6526977fe 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/BootReceiver.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/BootReceiver.kt
@@ -5,7 +5,6 @@ import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.os.Build
 import io.nekohasekai.sagernet.bg.SubscriptionUpdater
 import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.ktx.app
@@ -34,7 +33,7 @@ class BootReceiver : BroadcastReceiver() {
 
         val doStart = when (intent.action) {
             Intent.ACTION_LOCKED_BOOT_COMPLETED -> false // DataStore.directBootAware
-            else -> Build.VERSION.SDK_INT < 24 || SagerNet.user.isUserUnlocked
+            else -> SagerNet.user.isUserUnlocked
         } && DataStore.selectedProxy > 0
 
         if (doStart) SagerNet.startService()
diff --git a/app/src/main/java/io/nekohasekai/sagernet/Constants.kt b/app/src/main/java/io/nekohasekai/sagernet/Constants.kt
index 1b2e8347aa..835a58a724 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/Constants.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/Constants.kt
@@ -47,6 +47,8 @@ object Key {
     const val ALLOW_ACCESS = "allowAccess"
     const val SPEED_INTERVAL = "speedInterval"
     const val SHOW_DIRECT_SPEED = "showDirectSpeed"
+    const val SHOW_PROFILE_IN_NOTIFICATION = "showProfileInNotification"
+    const val VIEW_MODE_ROUTER_GROUPS = "viewModeRouterGroups"
 
     const val APPEND_HTTP_PROXY = "appendHttpProxy"
     const val HTTP_PROXY_BYPASS = "httpProxyBypass"
@@ -73,15 +75,25 @@ object Key {
 
     const val ACQUIRE_WAKE_LOCK = "acquireWakeLock"
     const val HIDE_FROM_RECENT_APPS = "hideFromRecentApps"
-    const val SHOW_BOTTOM_BAR = "showBottomBar"
     const val CONFIRM_PROFILE_DELETE = "confirmProfileDelete"
     const val GROUP_LAYOUT_MODE = "groupLayoutMode"
     const val PROFILE_CARD_STYLE = "profileCardStyle"
 
     const val ALLOW_INSECURE_ON_REQUEST = "allowInsecureOnRequest"
 
+    val DEPRECATED_SETTING_KEYS = setOf(
+        APPEND_HTTP_PROXY,
+        HTTP_PROXY_BYPASS,
+        ENABLE_TLS_FRAGMENT,
+        FRAGMENT_LENGTH,
+        FRAGMENT_INTERVAL,
+        "enableHevTun",
+        "showBottomBar",
+        "meteredNetwork",
+        "wakeResetConnections",
+    )
+
     const val TUN_IMPLEMENTATION = "tunImplementation"
-    const val ENABLE_HEV_TUN = "enableHevTun"
     const val PROFILE_TRAFFIC_STATISTICS = "profileTrafficStatistics"
 
     const val PROFILE_DIRTY = "profileDirty"
@@ -155,6 +167,7 @@ object Key {
     const val ROUTE_PROTOCOL = "routeProtocol"
     const val ROUTE_RULESET = "routeRuleset"
     const val ROUTE_OUTBOUND = "routeOutbound"
+    const val ROUTE_OUTBOUND_ROUTER = "routeOutboundRouter"
     const val ROUTE_PACKAGES = "routePackages"
 
     const val GROUP_NAME = "groupName"
@@ -187,11 +200,6 @@ object Key {
     const val FRAGMENT_LENGTH = "fragmentLength"
     const val FRAGMENT_INTERVAL = "fragmentInterval"
 
-    const val WEBDAV_SERVER = "webdavServer"
-    const val WEBDAV_USERNAME = "webdavUsername"
-    const val WEBDAV_PASSWORD = "webdavPassword"
-    const val WEBDAV_PATH = "webdavPath"
-
     const val GLOBAL_MODE = "globalMode"
 }
 
@@ -199,6 +207,7 @@ object TunImplementation {
     const val GVISOR = 0
     const val SYSTEM = 1
     const val MIXED = 2
+    const val GO = 3
 }
 
 object IPv6Mode {
@@ -232,4 +241,8 @@ object Action {
 
     // const val SWITCH_WAKE_LOCK = "io.nekohasekai.sagernet.SWITCH_WAKELOCK"
     const val RESET_UPSTREAM_CONNECTIONS = "moe.nb4a.RESET_UPSTREAM_CONNECTIONS"
+
+    const val EXTRA_ROUTER_TAG = "routerTag"
+    const val EXTRA_ROUTER_PROXY_ID = "routerProxyId"
+    const val EXTRA_FORCE_FULL_RELOAD = "forceFullReload"
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt b/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt
index cb65a1fe38..6e79051354 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/QuickToggleShortcut.kt
@@ -23,7 +23,6 @@ package io.nekohasekai.sagernet
 import android.app.Activity
 import android.content.Intent
 import android.content.pm.ShortcutManager
-import android.os.Build
 import android.os.Bundle
 import androidx.core.content.getSystemService
 import androidx.core.content.pm.ShortcutInfoCompat
@@ -54,9 +53,7 @@ class QuickToggleShortcut : Activity(), SagerConnection.Callback {
         } else {
             profileId = intent.getLongExtra("profile", -1L)
             connection.connect(this, this)
-            if (Build.VERSION.SDK_INT >= 25) {
-                getSystemService<ShortcutManager>()!!.reportShortcutUsed(if (profileId >= 0) "shortcut-profile-$profileId" else "toggle")
-            }
+            getSystemService<ShortcutManager>()!!.reportShortcutUsed(if (profileId >= 0) "shortcut-profile-$profileId" else "toggle")
         }
     }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/SagerNet.kt b/app/src/main/java/io/nekohasekai/sagernet/SagerNet.kt
index e86ec9463d..c098ddfcdf 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/SagerNet.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/SagerNet.kt
@@ -9,15 +9,14 @@ import android.content.Intent
 import android.content.res.Configuration
 import android.net.ConnectivityManager
 import android.net.Network
-import android.os.Build
 import android.os.PowerManager
 import android.os.StrictMode
 import android.os.UserManager
-import androidx.annotation.RequiresApi
 import androidx.core.content.ContextCompat
 import androidx.core.content.getSystemService
 import go.Seq
 import io.nekohasekai.sagernet.bg.SagerConnection
+import io.nekohasekai.sagernet.bg.ServiceNotification
 import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.ktx.Logs
 import io.nekohasekai.sagernet.ktx.isOss
@@ -138,7 +137,7 @@ class SagerNet : Application(),
                     Intent(
                         application, MainActivity::class.java
                     ).setFlags(Intent.FLAG_ACTIVITY_REORDER_TO_FRONT),
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+                    PendingIntent.FLAG_IMMUTABLE
                 )
             }
         }
@@ -164,39 +163,49 @@ class SagerNet : Application(),
         }
 
         fun updateNotificationChannels() {
-            if (Build.VERSION.SDK_INT >= 26) @RequiresApi(26) {
-                notification.createNotificationChannels(
-                    listOf(
-                        NotificationChannel(
-                            "service-vpn",
-                            application.getText(R.string.service_vpn),
-                            if (Build.VERSION.SDK_INT >= 28) NotificationManager.IMPORTANCE_MIN
-                            else NotificationManager.IMPORTANCE_LOW
-                        ),   // #1355
-                        NotificationChannel(
-                            "service-proxy",
-                            application.getText(R.string.service_proxy),
-                            NotificationManager.IMPORTANCE_LOW
-                        ), NotificationChannel(
-                            "service-subscription",
-                            application.getText(R.string.service_subscription),
-                            NotificationManager.IMPORTANCE_DEFAULT
-                        ), NotificationChannel(
-                            "connection-test",
-                            application.getText(R.string.connection_test),
-                            NotificationManager.IMPORTANCE_DEFAULT
-                        )
+            val vpnNotificationPolicy = ServiceNotification.vpnNotificationChannelPolicy()
+            notification.createNotificationChannels(
+                listOf(
+                    NotificationChannel(
+                        ServiceNotification.vpnNotificationChannel,
+                        application.getText(R.string.service_vpn),
+                        vpnNotificationPolicy.importance
+                    ).apply {
+                        setLockscreenVisibility(vpnNotificationPolicy.lockscreenVisibility)
+                    },   // #1355
+                    NotificationChannel(
+                        "service-proxy",
+                        application.getText(R.string.service_proxy),
+                        NotificationManager.IMPORTANCE_LOW
+                    ), NotificationChannel(
+                        "service-subscription",
+                        application.getText(R.string.service_subscription),
+                        NotificationManager.IMPORTANCE_DEFAULT
+                    ), NotificationChannel(
+                        "connection-test",
+                        application.getText(R.string.connection_test),
+                        NotificationManager.IMPORTANCE_DEFAULT
                     )
                 )
-            }
+            )
         }
 
         fun startService() = ContextCompat.startForegroundService(
             application, Intent(application, SagerConnection.serviceClass)
         )
 
-        fun reloadService() =
-            application.sendBroadcast(Intent(Action.RELOAD).setPackage(application.packageName))
+        fun reloadService(routerTag: String? = null, routerProxyId: Long? = null) =
+            application.sendBroadcast(Intent(Action.RELOAD).setPackage(application.packageName).apply {
+                if (routerTag != null && routerProxyId != null) {
+                    putExtra(Action.EXTRA_ROUTER_TAG, routerTag)
+                    putExtra(Action.EXTRA_ROUTER_PROXY_ID, routerProxyId)
+                }
+            })
+
+        fun reloadServiceFully() =
+            application.sendBroadcast(Intent(Action.RELOAD).setPackage(application.packageName).apply {
+                putExtra(Action.EXTRA_FORCE_FULL_RELOAD, true)
+            })
 
         fun stopService() =
             application.sendBroadcast(Intent(Action.CLOSE).setPackage(application.packageName))
diff --git a/app/src/main/java/io/nekohasekai/sagernet/aidl/SpeedDisplayData.kt b/app/src/main/java/io/nekohasekai/sagernet/aidl/SpeedDisplayData.kt
index 5cafbf33e7..e5baf504fa 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/aidl/SpeedDisplayData.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/aidl/SpeedDisplayData.kt
@@ -15,4 +15,7 @@ data class SpeedDisplayData(
     // Outbound "bypass" usage is not counted
     var txTotal: Long = 0L,
     var rxTotal: Long = 0L,
+
+    // Runtime-only Router URL_TEST selections as routerId/profileId pairs.
+    var urlTestSelections: LongArray = longArrayOf(),
 ) : Parcelable
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/BaseService.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/BaseService.kt
index c028fa610f..9c3d5e52dd 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/BaseService.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/BaseService.kt
@@ -7,6 +7,7 @@ import android.content.IntentFilter
 import android.os.*
 import android.app.ActivityManager
 import android.widget.Toast
+import androidx.core.content.ContextCompat
 import io.nekohasekai.sagernet.Action
 import io.nekohasekai.sagernet.BootReceiver
 import io.nekohasekai.sagernet.R
@@ -15,9 +16,16 @@ import io.nekohasekai.sagernet.aidl.ISagerNetService
 import io.nekohasekai.sagernet.aidl.ISagerNetServiceCallback
 import io.nekohasekai.sagernet.bg.proto.ProxyInstance
 import io.nekohasekai.sagernet.database.DataStore
+import io.nekohasekai.sagernet.database.RouterGroup
 import io.nekohasekai.sagernet.database.SagerDatabase
 import io.nekohasekai.sagernet.ktx.*
 import io.nekohasekai.sagernet.plugin.PluginManager
+import io.nekohasekai.sagernet.route.RouterRuntimeMode
+import io.nekohasekai.sagernet.route.RouterSelection
+import io.nekohasekai.sagernet.route.RouterSelectionPlan
+import io.nekohasekai.sagernet.route.RouterSelectionRequest
+import io.nekohasekai.sagernet.route.routerNodeKey
+import io.nekohasekai.sagernet.route.routerStableIdOrFallback
 import io.nekohasekai.sagernet.utils.DefaultNetworkListener
 import kotlinx.coroutines.*
 import kotlinx.coroutines.sync.Mutex
@@ -26,6 +34,7 @@ import libcore.Libcore
 import moe.matsuri.nb4a.Protocols
 import moe.matsuri.nb4a.utils.Util
 import java.net.UnknownHostException
+import java.util.concurrent.ConcurrentHashMap
 
 class BaseService {
 
@@ -43,24 +52,26 @@ class BaseService {
     interface ExpectedException
 
     class Data internal constructor(private val service: Interface) {
-        var state = State.Stopped
-        var proxy: ProxyInstance? = null
+        @Volatile var state = State.Stopped
+        @Volatile var proxy: ProxyInstance? = null
         var notification: ServiceNotification? = null
 
         val receiver = broadcastReceiver { ctx, intent ->
             when (intent.action) {
                 Intent.ACTION_SHUTDOWN -> service.persistStats()
-                Action.RELOAD -> service.reload()
+                Action.RELOAD -> service.reload(
+                    intent.getStringExtra(Action.EXTRA_ROUTER_TAG),
+                    intent.getLongExtra(Action.EXTRA_ROUTER_PROXY_ID, 0L).takeIf { it > 0L },
+                    intent.getBooleanExtra(Action.EXTRA_FORCE_FULL_RELOAD, false),
+                )
                 // Action.SWITCH_WAKE_LOCK -> runOnDefaultDispatcher { service.switchWakeLock() }
                 PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED -> {
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                        if (SagerNet.power.isDeviceIdleMode) {
-                            proxy?.box?.sleep()
-                        } else {
-                            proxy?.box?.wake()
-                            if (DataStore.wakeResetConnections) {
-                                Libcore.resetAllConnections(true)
-                            }
+                    if (SagerNet.power.isDeviceIdleMode) {
+                        proxy?.box?.sleep()
+                    } else {
+                        proxy?.box?.wake()
+                        if (DataStore.wakeResetConnections) {
+                            Libcore.resetAllConnections(true)
                         }
                     }
                 }
@@ -95,15 +106,19 @@ class BaseService {
         private val callbacks = object : RemoteCallbackList<ISagerNetServiceCallback>() {
             override fun onCallbackDied(callback: ISagerNetServiceCallback?, cookie: Any?) {
                 super.onCallbackDied(callback, cookie)
+                callback?.let(callbackIdMap::remove)
             }
         }
 
-        val callbackIdMap = mutableMapOf<ISagerNetServiceCallback, Int>()
+        val callbackIdMap = ConcurrentHashMap<ISagerNetServiceCallback, Int>()
 
         override val coroutineContext = Dispatchers.Main.immediate + Job()
 
         override fun getState(): Int = (data?.state ?: State.Idle).ordinal
         override fun getProfileName(): String = data?.proxy?.displayProfileName ?: "Idle"
+        override fun getCurrentUrlTestSelections(): LongArray =
+            data?.takeIf { it.state == State.Connected }?.proxy?.currentUrlTestSelections()
+                ?: longArrayOf()
 
         override fun registerCallback(cb: ISagerNetServiceCallback, id: Int) {
             if (id == SagerConnection.CONNECTION_ID_RESTART_BG) {
@@ -114,6 +129,9 @@ class BaseService {
                 callbacks.register(cb)
             }
             callbackIdMap[cb] = id
+            if (id == SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND) {
+                data?.proxy?.looper?.requestUpdate()
+            }
         }
 
         private val broadcastMutex = Mutex()
@@ -171,6 +189,7 @@ class BaseService {
 
         override fun close() {
             callbacks.kill()
+            callbackIdMap.clear()
             cancel()
             data = null
         }
@@ -184,11 +203,18 @@ class BaseService {
         fun onBind(intent: Intent): IBinder? =
             if (intent.action == Action.SERVICE) data.binder else null
 
-        fun reload() {
+        fun reload(
+            routerTag: String? = null,
+            routerProxyId: Long? = null,
+            forceFullReload: Boolean = false,
+        ) {
             if (DataStore.selectedProxy == 0L) {
                 stopRunner(false, (this as Context).getString(R.string.profile_empty))
+                return
             }
-            if (canReloadSelector()) {
+            val routerReloadRequested = routerTag != null && routerProxyId != null
+            if (routerReloadRequested && trySelectRouter(routerTag!!, routerProxyId!!)) return
+            if (!forceFullReload && !routerReloadRequested && canReloadSelector()) {
                 val ent = SagerDatabase.proxyDao.getById(DataStore.selectedProxy)
                 val tag = data.proxy!!.config.profileTagMap[ent?.id] ?: ""
                 if (tag.isNotBlank() && ent != null) {
@@ -207,6 +233,45 @@ class BaseService {
             }
         }
 
+        private fun trySelectRouter(routerTag: String, proxyId: Long): Boolean {
+            val runningProxy = data.proxy ?: return false
+            if (routerTag.isBlank()) return false
+            val router = SagerDatabase.routerGroupDao.getByStableTag(routerTag)
+                ?.takeIf { it.enabled && it.stableTag.isNotBlank() && it.stableTag == routerTag }
+                ?: return false
+            if (runningProxy.config.routerSelectorTags[routerTag].isNullOrBlank()) return false
+            val plan = RouterSelection.plan(
+                request = RouterSelectionRequest(
+                    routerTag = routerTag,
+                    proxyId = proxyId,
+                    mode = if (router.mode == RouterGroup.MODE_URL_TEST) {
+                        RouterRuntimeMode.URL_TEST
+                    } else {
+                        RouterRuntimeMode.SELECTOR
+                    },
+                    routerEnabled = router.enabled,
+                ),
+                routerSelectorTags = runningProxy.config.routerSelectorTags,
+                routerMemberIds = runningProxy.config.routerMemberIds,
+                profileTags = runningProxy.config.profileTagMap,
+                selectorGroupId = runningProxy.config.selectorGroupId,
+            )
+            if (plan !is RouterSelectionPlan.HotSwitch) return false
+            if (!runningProxy.isInitialized() || !runningProxy.box.selectOutboundFor(plan.selectorTag, plan.targetTag)) {
+                return false
+            }
+            val selected = SagerDatabase.proxyDao.getById(proxyId) ?: return false
+            SagerDatabase.routerGroupDao.updateSelection(
+                routerId = router.id,
+                selectedProxyId = proxyId,
+                selectedNodeKey = routerNodeKey(
+                    selected.groupId,
+                    routerStableIdOrFallback(selected.uuid, selected.id),
+                ),
+            )
+            return true
+        }
+
         fun canReloadSelector(): Boolean {
             if ((data.proxy?.config?.selectorGroupId ?: -1L) < 0) return false
             val ent = SagerDatabase.proxyDao.getById(DataStore.selectedProxy) ?: return false
@@ -224,8 +289,7 @@ class BaseService {
 
         fun startRunner() {
             this as Context
-            if (Build.VERSION.SDK_INT >= 26) startForegroundService(Intent(this, javaClass))
-            else startService(Intent(this, javaClass))
+            startForegroundService(Intent(this, javaClass))
         }
 
         fun killProcesses() {
@@ -281,20 +345,39 @@ class BaseService {
         var upstreamInterfaceName: String?
 
         suspend fun preInit() {
-            DefaultNetworkListener.start(this) {
-                SagerNet.connectivity.getLinkProperties(it)?.also { link ->
-                    SagerNet.underlyingNetwork = it
+            var previousNetwork: android.net.Network? = null
+            var hadNetwork = false
+            DefaultNetworkListener.start(this) { network ->
+                if (network == null) {
+                    previousNetwork = null
+                    SagerNet.underlyingNetwork = null
+                    return@start
+                }
+                SagerNet.connectivity.getLinkProperties(network)?.also { link ->
+                    val networkChanged = hadNetwork && previousNetwork != network
+                    previousNetwork = network
+                    hadNetwork = true
+                    SagerNet.underlyingNetwork = network
                     DataStore.vpnService?.updateUnderlyingNetwork()
                     //
                     val oldName = upstreamInterfaceName
                     if (oldName != link.interfaceName) {
                         upstreamInterfaceName = link.interfaceName
                     }
-                    if (oldName != null && upstreamInterfaceName != null && oldName != upstreamInterfaceName) {
+                    if (networkChanged || (oldName != null && upstreamInterfaceName != null && oldName != upstreamInterfaceName)) {
                         Logs.d("Network changed: $oldName -> $upstreamInterfaceName")
                         if (DataStore.networkChangeResetConnections) {
                             Libcore.resetAllConnections(true)
                         }
+                        val runningProxy = data.proxy
+                        if (data.state == State.Connected && runningProxy?.isInitialized() == true) {
+                            data.binder.launch(Dispatchers.IO) {
+                                if (data.state != State.Connected || data.proxy !== runningProxy) return@launch
+                                runningProxy.config.routerUrlTestTags.values.distinct().forEach {
+                                    runningProxy.box.refreshURLTestFor(it)
+                                }
+                            }
+                        }
                     }
                 }
             }
@@ -339,32 +422,18 @@ class BaseService {
                     addAction(Intent.ACTION_SHUTDOWN)
                     addAction(Action.CLOSE)
                     // addAction(Action.SWITCH_WAKE_LOCK)
-                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                        addAction(PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED)
-                    }
+                    addAction(PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED)
                     addAction(Action.RESET_UPSTREAM_CONNECTIONS)
                 }
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                    registerReceiver(
-                        data.receiver,
-                        filter,
-                        "$packageName.SERVICE",
-                        null,
-                        Context.RECEIVER_EXPORTED
-                    )
-                } else {
-                    registerReceiver(
-                        data.receiver,
-                        filter,
-                        "$packageName.SERVICE",
-                        null
-                    )
-                }
+                ContextCompat.registerReceiver(
+                    this, data.receiver, filter, "$packageName.SERVICE", null,
+                    ContextCompat.RECEIVER_NOT_EXPORTED,
+                )
                 data.closeReceiverRegistered = true
             }
 
             data.changeState(State.Connecting)
-            runOnMainDispatcher {
+            data.connectingJob = data.binder.launch(start = CoroutineStart.LAZY) {
                 try {
                     data.notification = createNotification(ServiceNotification.genTitle(profile))
 
@@ -404,6 +473,7 @@ class BaseService {
                     data.connectingJob = null
                 }
             }
+            data.connectingJob?.start()
             return Service.START_NOT_STICKY
         }
     }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/GuardedProcessPool.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/GuardedProcessPool.kt
index cded1cabb1..cbf9fbab30 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/GuardedProcessPool.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/GuardedProcessPool.kt
@@ -1,9 +1,6 @@
 package io.nekohasekai.sagernet.bg
 
-import android.os.Build
 import android.os.SystemClock
-import android.system.ErrnoException
-import android.system.Os
 import android.system.OsConstants
 import androidx.annotation.MainThread
 import io.nekohasekai.sagernet.SagerNet
@@ -18,12 +15,6 @@ import java.io.InputStream
 import kotlin.concurrent.thread
 
 class GuardedProcessPool(private val onFatal: suspend (IOException) -> Unit) : CoroutineScope {
-    companion object {
-        private val pid by lazy {
-            Class.forName("java.lang.ProcessManager\$ProcessImpl").getDeclaredField("pid")
-                .apply { isAccessible = true }
-        }
-    }
 
     private inner class Guard(
         private val cmd: List<String>,
@@ -78,21 +69,9 @@ class GuardedProcessPool(private val onFatal: suspend (IOException) -> Unit) : C
                 GlobalScope.launch(Dispatchers.Main) { onFatal(e) }
             } finally {
                 if (running) withContext(NonCancellable) {  // clean-up cannot be cancelled
-                    if (Build.VERSION.SDK_INT < 24) {
-                        try {
-                            Os.kill(pid.get(process) as Int, OsConstants.SIGTERM)
-                        } catch (e: ErrnoException) {
-                            if (e.errno != OsConstants.ESRCH) Logs.w(e)
-                        } catch (e: ReflectiveOperationException) {
-                            Logs.w(e)
-                        }
-                        if (withTimeoutOrNull(500) { exitChannel.receive() } != null) return@withContext
-                    }
                     process.destroy()                       // kill the process
-                    if (Build.VERSION.SDK_INT >= 26) {
-                        if (withTimeoutOrNull(1000) { exitChannel.receive() } != null) return@withContext
-                        process.destroyForcibly()           // Force to kill the process if it's still alive
-                    }
+                    if (withTimeoutOrNull(1000) { exitChannel.receive() } != null) return@withContext
+                    process.destroyForcibly()               // Force to kill the process if it's still alive
                     exitChannel.receive()
                 }                                           // otherwise process already exited, nothing to be done
             }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/ProxyService.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/ProxyService.kt
index 448ac2699a..0cf11c2301 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/ProxyService.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/ProxyService.kt
@@ -21,7 +21,12 @@ class ProxyService : Service(), BaseService.Interface {
             .apply { acquire() }
     }
 
-    override fun onBind(intent: Intent) = super.onBind(intent)
+    override fun onBind(intent: Intent) = super<BaseService.Interface>.onBind(intent)
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int =
         super<BaseService.Interface>.onStartCommand(intent, flags, startId)
+
+    override fun onDestroy() {
+        data.binder.close()
+        super.onDestroy()
+    }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/ServiceNotification.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/ServiceNotification.kt
index 0ac84ac6a3..ba39084de0 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/ServiceNotification.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/ServiceNotification.kt
@@ -1,5 +1,6 @@
 package io.nekohasekai.sagernet.bg
 
+import android.app.Notification
 import android.app.PendingIntent
 import android.app.Service
 import android.content.BroadcastReceiver
@@ -7,7 +8,7 @@ import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
 import android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
-import android.os.Build
+import android.os.PowerManager
 import android.text.format.Formatter
 import android.widget.Toast
 import androidx.core.app.NotificationCompat
@@ -39,23 +40,90 @@ import kotlinx.coroutines.sync.withLock
  */
 class ServiceNotification(
     private val service: BaseService.Interface, title: String,
-    channel: String, visible: Boolean = false,
+    channel: String, private val visible: Boolean = false,
 ) : BroadcastReceiver() {
     companion object {
         const val notificationId = 1
-        val flags =
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
+        const val vpnNotificationChannel = "service-vpn-hidden"
+        const val flags = PendingIntent.FLAG_IMMUTABLE
 
-        fun genTitle(ent: ProxyEntity): String {
-            val gn = if (DataStore.showGroupInNotification)
-                SagerDatabase.groupDao.getById(ent.groupId)?.displayName() else null
-            return if (gn == null) ent.displayName() else "[$gn] ${ent.displayName()}"
+        data class NotificationChannelPolicy(
+            val importance: Int,
+            val lockscreenVisibility: Int,
+        )
+
+        fun vpnNotificationChannelPolicy() = NotificationChannelPolicy(
+            importance = NotificationManagerCompat.IMPORTANCE_MIN,
+            lockscreenVisibility = Notification.VISIBILITY_SECRET,
+        )
+
+        fun shouldPostSpeed(visible: Boolean, interactive: Boolean): Boolean =
+            visible && interactive
+
+        fun notificationPriority(visible: Boolean, wakeLockAcquired: Boolean): Int = when {
+            !visible -> NotificationCompat.PRIORITY_MIN
+            wakeLockAcquired -> NotificationCompat.PRIORITY_HIGH
+            else -> NotificationCompat.PRIORITY_LOW
+        }
+
+        fun genTitle(
+            ent: ProxyEntity?,
+            showProfileInNotification: Boolean = DataStore.showProfileInNotification,
+            showGroupInNotification: Boolean = DataStore.showGroupInNotification,
+            groupNameProvider: (Long) -> String? = { SagerDatabase.groupDao.getById(it)?.displayName() },
+            fallbackAppName: String = SagerNet.application.getString(R.string.app_name),
+        ): String {
+            if (ent == null || !showProfileInNotification) {
+                return fallbackAppName
+            }
+            val gn = if (showGroupInNotification) groupNameProvider(ent.groupId) else null
+            return if (gn.isNullOrBlank()) ent.displayName() else "[$gn] ${ent.displayName()}"
         }
     }
 
-    var listenPostSpeed = true
+    @Volatile
+    var listenPostSpeed = shouldPostSpeed(
+        visible,
+        ((service as Context).getSystemService(Context.POWER_SERVICE) as PowerManager).isInteractive,
+    )
+
+    // Last values actually rendered into the notification. Rebuilding a
+    // Notification (RemoteViews + icon resources) and handing it to
+    // NotificationManager is one of the most expensive things this app does on a
+    // timer: it wakes SystemUI and the notification side of every listener every
+    // speed interval. While the connection is idle the rendered text does not
+    // change, so the whole rebuild can be skipped.
+    private var lastSpeedTxRateProxy = Long.MIN_VALUE
+    private var lastSpeedRxRateProxy = Long.MIN_VALUE
+    private var lastSpeedTxRateDirect = Long.MIN_VALUE
+    private var lastSpeedRxRateDirect = Long.MIN_VALUE
+    private var lastSpeedTxTotal = Long.MIN_VALUE
+    private var lastSpeedRxTotal = Long.MIN_VALUE
+
+    private fun speedRenderUnchanged(stats: SpeedDisplayData): Boolean {
+        if (lastSpeedTxRateProxy != stats.txRateProxy) return false
+        if (lastSpeedRxRateProxy != stats.rxRateProxy) return false
+        if (lastSpeedTxTotal != stats.txTotal) return false
+        if (lastSpeedRxTotal != stats.rxTotal) return false
+        if (showDirectSpeed) {
+            if (lastSpeedTxRateDirect != stats.txRateDirect) return false
+            if (lastSpeedRxRateDirect != stats.rxRateDirect) return false
+        }
+        return true
+    }
+
+    private fun rememberSpeed(stats: SpeedDisplayData) {
+        lastSpeedTxRateProxy = stats.txRateProxy
+        lastSpeedRxRateProxy = stats.rxRateProxy
+        lastSpeedTxRateDirect = stats.txRateDirect
+        lastSpeedRxRateDirect = stats.rxRateDirect
+        lastSpeedTxTotal = stats.txTotal
+        lastSpeedRxTotal = stats.rxTotal
+    }
 
     suspend fun postNotificationSpeedUpdate(stats: SpeedDisplayData) {
+        if (speedRenderUnchanged(stats)) return
+        rememberSpeed(stats)
         useBuilder {
             if (showDirectSpeed) {
                 val speedDetail = (service as Context).getString(
@@ -104,8 +172,7 @@ class ServiceNotification(
     suspend fun postNotificationWakeLockStatus(acquired: Boolean) {
         updateActions()
         useBuilder {
-            it.priority =
-                if (acquired) NotificationCompat.PRIORITY_HIGH else NotificationCompat.PRIORITY_LOW
+            it.priority = notificationPriority(visible, acquired)
         }
         update()
     }
@@ -120,9 +187,11 @@ class ServiceNotification(
         .setContentIntent(SagerNet.configureIntent(service))
         .setSmallIcon(R.drawable.ic_service_active)
         .setCategory(NotificationCompat.CATEGORY_SERVICE)
+        .setVisibility(if (visible) NotificationCompat.VISIBILITY_PRIVATE else NotificationCompat.VISIBILITY_SECRET)
         .setPriority(if (visible) NotificationCompat.PRIORITY_LOW else NotificationCompat.PRIORITY_MIN)
 
     private val buildLock = Mutex()
+    @Volatile private var destroyed = false
 
     private suspend fun useBuilder(f: (NotificationCompat.Builder) -> Unit) {
         buildLock.withLock {
@@ -170,7 +239,7 @@ class ServiceNotification(
             val resetUpstreamAction = NotificationCompat.Action.Builder(
                 0, service.getString(R.string.reset_connections),
                 PendingIntent.getBroadcast(
-                    service, 0, Intent(Action.RESET_UPSTREAM_CONNECTIONS), flags
+                    service, 0, Intent(Action.RESET_UPSTREAM_CONNECTIONS).setPackage(service.packageName), flags
                 )
             ).setShowsUserInterface(false).build()
             it.addAction(resetUpstreamAction)
@@ -179,23 +248,23 @@ class ServiceNotification(
 
     override fun onReceive(context: Context, intent: Intent) {
         if (service.data.state == BaseService.State.Connected) {
-            listenPostSpeed = intent.action == Intent.ACTION_SCREEN_ON
+            listenPostSpeed = shouldPostSpeed(
+                visible,
+                intent.action == Intent.ACTION_SCREEN_ON,
+            )
         }
     }
 
 
     private suspend fun show() =
         useBuilder {
+            if (destroyed) return@useBuilder
             try {
-                if (Build.VERSION.SDK_INT >= 34) {
-                    (service as Service).startForeground(
-                        notificationId,
-                        it.build(),
-                        FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
-                    )
-                } else {
-                    (service as Service).startForeground(notificationId, it.build())
-                }
+                (service as Service).startForeground(
+                    notificationId,
+                    it.build(),
+                    FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
+                )
             } catch (e: Exception) {
                 Toast.makeText(
                     SagerNet.application,
@@ -206,16 +275,19 @@ class ServiceNotification(
         }
 
     private suspend fun update() = useBuilder {
-        NotificationManagerCompat.from(service as Service).notify(notificationId, it.build())
+        if (destroyed) return@useBuilder
+        try {
+            NotificationManagerCompat.from(service as Service).notify(notificationId, it.build())
+        } catch (_: SecurityException) {
+            // Notification permission may be revoked while the VPN is running.
+        }
     }
 
     fun destroy() {
+        if (destroyed) return
+        destroyed = true
         listenPostSpeed = false
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
-            (service as Service).stopForeground(Service.STOP_FOREGROUND_REMOVE)
-        } else {
-            (service as Service).stopForeground(true)
-        }
+        (service as Service).stopForeground(Service.STOP_FOREGROUND_REMOVE)
         service.unregisterReceiver(this)
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/SubscriptionUpdater.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/SubscriptionUpdater.kt
index a00067283d..caf70c32c1 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/SubscriptionUpdater.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/SubscriptionUpdater.kt
@@ -83,7 +83,11 @@ object SubscriptionUpdater {
                         R.string.subscription_update_message, profile.displayName()
                     )
                 )
-                nm.notify(2, notification.build())
+                try {
+                    nm.notify(2, notification.build())
+                } catch (_: SecurityException) {
+                    // Denied notification permission must not prevent subscription updates.
+                }
 
                 GroupUpdater.executeUpdate(profile, false)
             }
@@ -94,4 +98,4 @@ object SubscriptionUpdater {
         }
     }
 
-}
\ No newline at end of file
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/TileService.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/TileService.kt
index dd46ee5cdf..ab59556e01 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/TileService.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/TileService.kt
@@ -2,14 +2,13 @@ package io.nekohasekai.sagernet.bg
 
 import android.graphics.drawable.Icon
 import android.service.quicksettings.Tile
-import androidx.annotation.RequiresApi
 import io.nekohasekai.sagernet.R
 import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.aidl.ISagerNetService
+import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.database.SagerDatabase
 import android.service.quicksettings.TileService as BaseTileService
 
-@RequiresApi(24)
 class TileService : BaseTileService(), SagerConnection.Callback {
     private val iconIdle by lazy { Icon.createWithResource(this, R.drawable.ic_service_idle) }
     private val iconBusy by lazy { Icon.createWithResource(this, R.drawable.ic_service_busy) }
@@ -32,7 +31,8 @@ class TileService : BaseTileService(), SagerConnection.Callback {
 
     override fun cbSelectorUpdate(id: Long) {
         val profile = SagerDatabase.proxyDao.getById(id) ?: return
-        updateTile(BaseService.State.Connected, profile.displayName())
+        val title = if (DataStore.showProfileInNotification) profile.displayName() else getString(R.string.app_name)
+        updateTile(BaseService.State.Connected, title)
     }
 
     override fun onStartListening() {
@@ -61,7 +61,7 @@ class TileService : BaseTileService(), SagerConnection.Callback {
 
                 BaseService.State.Connected -> {
                     icon = iconConnected
-                    label = profileName
+                    label = if (DataStore.showProfileInNotification) profileName else getString(R.string.app_name)
                     state = Tile.STATE_ACTIVE
                 }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/TunMtu.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/TunMtu.kt
new file mode 100644
index 0000000000..f8e1365811
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/TunMtu.kt
@@ -0,0 +1,8 @@
+package io.nekohasekai.sagernet.bg
+
+import com.google.gson.JsonParser
+
+internal fun tunMtu(optionsJson: String, fallback: Int): Int {
+    // This is sing-tun.Options marshaled by Go, not the inbound config JSON.
+    return JsonParser.parseString(optionsJson).asJsonObject.get("MTU")?.asInt ?: fallback
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt
index a18da8ffcd..453e2f7e45 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt
@@ -6,7 +6,6 @@ import android.app.Service
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.net.ProxyInfo
-import android.os.Build
 import android.os.ParcelFileDescriptor
 import android.os.PowerManager
 import io.nekohasekai.sagernet.*
@@ -16,7 +15,6 @@ import io.nekohasekai.sagernet.fmt.hysteria.HysteriaBean
 import io.nekohasekai.sagernet.ktx.*
 import io.nekohasekai.sagernet.ui.VpnRequestActivity
 import io.nekohasekai.sagernet.utils.Subnet
-import moe.matsuri.nb4a.hevtun.HevTunRuntime
 import android.net.VpnService as BaseVpnService
 
 class VpnService : BaseVpnService(),
@@ -27,7 +25,6 @@ class VpnService : BaseVpnService(),
         const val PRIVATE_VLAN4_CLIENT = "172.19.0.1"
         const val PRIVATE_VLAN4_ROUTER = "172.19.0.2"
         const val FAKEDNS_VLAN4_CLIENT = "198.18.0.0"
-        const val HEV_MAPDNS_VLAN4 = "100.64.0.0"
         const val PRIVATE_VLAN6_CLIENT = "fdfe:dcba:9876::1"
         const val PRIVATE_VLAN6_ROUTER = "fdfe:dcba:9876::2"
 
@@ -42,11 +39,6 @@ class VpnService : BaseVpnService(),
     override suspend fun startProcesses() {
         DataStore.vpnService = this
         super.startProcesses() // launch proxy instance
-
-        if (DataStore.enableHevTun) {
-            val tunFd = establishTun()
-            HevTunRuntime.start(this, tunFd)
-        }
     }
 
     override var wakeLock: PowerManager.WakeLock? = null
@@ -59,7 +51,6 @@ class VpnService : BaseVpnService(),
 
     @Suppress("EXPERIMENTAL_API_USAGE")
     override fun killProcesses() {
-        HevTunRuntime.stop()
         conn?.close()
         conn = null
         super.killProcesses()
@@ -73,7 +64,7 @@ class VpnService : BaseVpnService(),
     override val data = BaseService.Data(this)
     override val tag = "SagerNetVpnService"
     override fun createNotification(profileName: String) =
-        ServiceNotification(this, profileName, "service-vpn")
+        ServiceNotification(this, profileName, ServiceNotification.vpnNotificationChannel)
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
         if (DataStore.serviceMode == Key.MODE_VPN) {
@@ -95,17 +86,13 @@ class VpnService : BaseVpnService(),
     }
 
     fun startVpn(tunOptionsJson: String, tunPlatformOptionsJson: String): Int {
-//        Logs.d(tunOptionsJson)
-//        Logs.d(tunPlatformOptionsJson)
-//        val tunOptions = JSONObject(tunOptionsJson)
-
-        return establishTun()
+        return establishTun(tunMtu(tunOptionsJson, DataStore.mtu))
     }
 
-    fun establishTun(): Int {
+    fun establishTun(mtu: Int = DataStore.mtu): Int {
         val builder = Builder().setConfigureIntent(SagerNet.configureIntent(this))
             .setSession(getString(R.string.app_name))
-            .setMtu(DataStore.mtu)
+            .setMtu(mtu)
         val ipv6Mode = DataStore.ipv6Mode
 
         // address
@@ -123,9 +110,6 @@ class VpnService : BaseVpnService(),
             }
             builder.addRoute(PRIVATE_VLAN4_ROUTER, 32)
             builder.addRoute(FAKEDNS_VLAN4_CLIENT, 15)
-            if (DataStore.enableHevTun && DataStore.enableFakeDns) {
-                builder.addRoute(HEV_MAPDNS_VLAN4, 10)
-            }
             // https://issuetracker.google.com/issues/149636790
             if (ipv6Mode != IPv6Mode.DISABLE) {
                 builder.addRoute("2000::", 3)
@@ -138,7 +122,7 @@ class VpnService : BaseVpnService(),
         }
 
         updateUnderlyingNetwork(builder)
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) builder.setMetered(metered)
+        builder.setMetered(metered)
 
         // app route
         val packageName = packageName
@@ -202,7 +186,7 @@ class VpnService : BaseVpnService(),
             }
         }
 
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && DataStore.appendHttpProxy) {
+        if (DataStore.appendHttpProxy) {
             builder.setHttpProxy(
                 ProxyInfo.buildDirectProxy(
                     LOCALHOST,
@@ -215,18 +199,16 @@ class VpnService : BaseVpnService(),
         }
 
         metered = DataStore.meteredNetwork
-        if (Build.VERSION.SDK_INT >= 29) builder.setMetered(metered)
+        builder.setMetered(metered)
         conn = builder.establish() ?: throw NullConnectionException()
 
         return conn!!.fd
     }
 
     fun updateUnderlyingNetwork(builder: Builder? = null) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP_MR1) {
-            SagerNet.underlyingNetwork?.let {
-                builder?.setUnderlyingNetworks(arrayOf(SagerNet.underlyingNetwork))
-                    ?: setUnderlyingNetworks(arrayOf(SagerNet.underlyingNetwork))
-            }
+        SagerNet.underlyingNetwork?.let {
+            builder?.setUnderlyingNetworks(arrayOf(SagerNet.underlyingNetwork))
+                ?: setUnderlyingNetworks(arrayOf(SagerNet.underlyingNetwork))
         }
     }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/BoxInstance.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/BoxInstance.kt
index dc60d5efdf..071fd9d879 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/BoxInstance.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/BoxInstance.kt
@@ -18,6 +18,7 @@ import io.nekohasekai.sagernet.fmt.trojan_go.TrojanGoBean
 import io.nekohasekai.sagernet.fmt.trojan_go.buildTrojanGoConfig
 import io.nekohasekai.sagernet.ktx.*
 import io.nekohasekai.sagernet.plugin.PluginManager
+import io.nekohasekai.sagernet.route.RouterRuntimeSelection
 import kotlinx.coroutines.*
 import libcore.BoxInstance
 import libcore.Libcore
@@ -40,6 +41,15 @@ abstract class BoxInstance(
         return ::config.isInitialized && ::box.isInitialized
     }
 
+    fun currentUrlTestSelections(): LongArray {
+        if (!isInitialized()) return longArrayOf()
+        return RouterRuntimeSelection.resolve(
+            routerTags = config.routerUrlTestTags,
+            profileTags = config.profileTagMap,
+            currentOutbound = box::currentOutboundFor,
+        )
+    }
+
     protected fun initPlugin(name: String): PluginManager.InitResult {
         return pluginPath.getOrPut(name) { PluginManager.init(name)!! }
     }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/ProxyInstance.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/ProxyInstance.kt
index 9758a5c40d..fcb45d7e6c 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/ProxyInstance.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/ProxyInstance.kt
@@ -1,13 +1,14 @@
 package io.nekohasekai.sagernet.bg.proto
 
-import io.nekohasekai.sagernet.BuildConfig
 import io.nekohasekai.sagernet.bg.BaseService
 import io.nekohasekai.sagernet.bg.ServiceNotification
 import io.nekohasekai.sagernet.database.ProxyEntity
 import io.nekohasekai.sagernet.ktx.Logs
-import io.nekohasekai.sagernet.ktx.runOnDefaultDispatcher
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
 import kotlinx.coroutines.runBlocking
-import moe.matsuri.nb4a.utils.JavaUtil
 
 class ProxyInstance(profile: ProxyEntity, var service: BaseService.Interface? = null) :
     BoxInstance(profile) {
@@ -18,14 +19,14 @@ class ProxyInstance(profile: ProxyEntity, var service: BaseService.Interface? =
     var displayProfileName = ServiceNotification.genTitle(profile)
 
     // for TrafficLooper
-    var looper: TrafficLooper? = null
+    @Volatile var looper: TrafficLooper? = null
+    private val runtimeScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
 
     override fun buildConfig() {
         super.buildConfig()
         lastSelectorGroupId = super.config.selectorGroupId
         //
-        if (notTmp) Logs.d(config.config)
-        if (notTmp && BuildConfig.DEBUG) Logs.d(JavaUtil.gson.toJson(config.trafficMap))
+        if (notTmp) Logs.d("Built proxy configuration: ${config.profileTagMap.size} profiles")
     }
 
     // only use this in temporary instance
@@ -34,14 +35,6 @@ class ProxyInstance(profile: ProxyEntity, var service: BaseService.Interface? =
         buildConfig()
     }
 
-    override suspend fun init() {
-        super.init()
-        pluginConfigs.forEach { (_, plugin) ->
-            val (_, content) = plugin
-            Logs.d(content)
-        }
-    }
-
     override suspend fun loadConfig() {
         super.loadConfig()
     }
@@ -49,17 +42,17 @@ class ProxyInstance(profile: ProxyEntity, var service: BaseService.Interface? =
     override fun launch() {
         box.setAsMain()
         super.launch() // start box
-        runOnDefaultDispatcher {
-            looper = service?.let { TrafficLooper(it.data, this) }
-            looper?.start()
-        }
+        looper = service?.let { TrafficLooper(it.data, runtimeScope) }
+        looper?.start()
     }
 
     override fun close() {
-        super.close()
-        runBlocking {
-            looper?.stop()
+        try {
+            runBlocking { looper?.stop() }
+        } finally {
             looper = null
+            runtimeScope.cancel()
+            super.close()
         }
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicy.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicy.kt
new file mode 100644
index 0000000000..d47a4ffe0e
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicy.kt
@@ -0,0 +1,20 @@
+package io.nekohasekai.sagernet.bg.proto
+
+object TrafficLoopPolicy {
+    private const val MIN_BACKGROUND_NOTIFICATION_MILLIS = 5_000L
+    private const val MIN_BACKGROUND_HIDDEN_MILLIS = 30_000L
+    private const val MIN_INITIALIZATION_RETRY_MILLIS = 250L
+
+    fun delayMillis(
+        configuredMillis: Long,
+        mainActivityForeground: Boolean,
+        notificationSpeedVisible: Boolean,
+    ): Long = when {
+        mainActivityForeground -> if (configuredMillis > 0L) configuredMillis else 1_000L
+        notificationSpeedVisible -> maxOf(configuredMillis, MIN_BACKGROUND_NOTIFICATION_MILLIS)
+        else -> maxOf(configuredMillis, MIN_BACKGROUND_HIDDEN_MILLIS)
+    }
+
+    fun initializationRetryMillis(configuredMillis: Long): Long =
+        maxOf(configuredMillis, MIN_INITIALIZATION_RETRY_MILLIS)
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLooper.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLooper.kt
index 48f8744265..6bff1c9940 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLooper.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficLooper.kt
@@ -11,6 +11,7 @@ import io.nekohasekai.sagernet.fmt.TAG_BYPASS
 import io.nekohasekai.sagernet.fmt.TAG_PROXY
 import io.nekohasekai.sagernet.ktx.Logs
 import kotlinx.coroutines.*
+import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.sync.Mutex
 
 class TrafficLooper
@@ -23,6 +24,15 @@ class TrafficLooper
     }
 
     private var job: Job? = null
+    private val updateRequests = Channel<Unit>(Channel.CONFLATED)
+
+    fun requestUpdate() {
+        updateRequests.trySend(Unit)
+    }
+
+    private suspend fun awaitUpdate(delayMillis: Long) {
+        withTimeoutOrNull(delayMillis) { updateRequests.receive() }
+    }
     private val idMap = mutableMapOf<Long, TrafficUpdater.TrafficLooperData>() // id to 1 data
     private val tagMap = mutableMapOf<String, TrafficUpdater.TrafficLooperData>() // tag to 1 data
     private val stateMutex = Mutex()
@@ -30,7 +40,7 @@ class TrafficLooper
 
     private data class LoopSnapshot(
         val speed: SpeedDisplayData,
-        val trafficUpdates: ArrayList<TrafficData>,
+        val trafficUpdates: List<TrafficData>,
     )
 
     private suspend fun <T> withStateLock(block: suspend () -> T): T {
@@ -48,6 +58,7 @@ class TrafficLooper
         // finally traffic post
         if (!DataStore.profileTrafficStatistics) return
         withStateLock {
+            trafficUpdater?.updateAll()
             val traffic = mutableMapOf<Long, TrafficData>()
             data.proxy?.config?.trafficMap?.forEach { (_, ents) ->
                 for (ent in ents) {
@@ -85,7 +96,7 @@ class TrafficLooper
         selectMainLocked(id)
     }
 
-    private suspend fun selectMainLocked(id: Long) {
+    private suspend fun selectMainLocked(id: Long, statsTag: String = TAG_PROXY) {
         Logs.d("select traffic count $TAG_PROXY to $id, old id is $selectorNowId")
         val oldData = idMap[selectorNowId]
         val newData = idMap[id] ?: return
@@ -104,11 +115,22 @@ class TrafficLooper
         selectorNowFakeTag = newData.tag
         selectorNowId = id
         newData.apply {
-            tag = TAG_PROXY
+            tag = statsTag
             ignore = false
         }
     }
 
+    private suspend fun syncUrlTestWinnerLocked(proxy: ProxyInstance): LongArray {
+        val selections = proxy.currentUrlTestSelections()
+        val mainTag = proxy.config.mainUrlTestTag ?: return selections
+        val mainRouterId = proxy.config.routerUrlTestTags.entries
+            .firstOrNull { it.value == mainTag }?.key ?: return selections
+        val selectionMap = io.nekohasekai.sagernet.route.RouterRuntimeSelection.toMap(selections)
+        val winnerId = selectionMap[mainRouterId] ?: return selections
+        if (winnerId != selectorNowId) selectMainLocked(winnerId, mainTag)
+        return selections
+    }
+
     suspend fun resetTraffic(profileIds: LongArray) {
         val targetIds = profileIds.asSequence().filter { it > 0L }.toHashSet()
         if (targetIds.isEmpty()) return
@@ -160,7 +182,6 @@ class TrafficLooper
         val delayMs = DataStore.speedInterval.toLong()
         val showDirectSpeed = DataStore.showDirectSpeed
         val profileTrafficStatistics = DataStore.profileTrafficStatistics
-        if (delayMs == 0L) return
 
         // for display
         val itemBypass = TrafficUpdater.TrafficLooperData(tag = TAG_BYPASS)
@@ -168,43 +189,82 @@ class TrafficLooper
         while (currentCoroutineContext().isActive) {
             val proxy = data.proxy
             if (proxy == null) {
-                delay(delayMs)
+                awaitUpdate(TrafficLoopPolicy.initializationRetryMillis(delayMs))
+                continue
+            }
+            if (!proxy.isInitialized()) {
+                awaitUpdate(TrafficLoopPolicy.initializationRetryMillis(delayMs))
                 continue
             }
-            if (!proxy.isInitialized()) continue
 
+            // Resolved once per tick: containsValue() scans the whole callback map,
+            // and the value cannot change meaningfully within a single tick.
+            val mainActivityForeground = data.binder.callbackIdMap.containsValue(
+                SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND
+            )
+
+            if (delayMs <= 0L) {
+                // Nobody is listening -> skip the selection query and the IPC round-trip.
+                if (mainActivityForeground && data.state == BaseService.State.Connected) {
+                    val selections = proxy.currentUrlTestSelections()
+                    data.binder.broadcast { callback ->
+                        if (data.binder.callbackIdMap[callback] ==
+                            SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND
+                        ) {
+                            callback.cbSpeedUpdate(SpeedDisplayData(urlTestSelections = selections))
+                        }
+                    }
+                }
+                awaitUpdate(TrafficLoopPolicy.delayMillis(
+                    delayMs,
+                    mainActivityForeground,
+                    false,
+                ))
+                continue
+            }
             val snapshot = withStateLock {
                 if (trafficUpdater == null) {
                     idMap.clear()
                     idMap[-1] = itemBypass
                     //
                     val tags = hashSetOf(TAG_PROXY, TAG_BYPASS)
+                    val dynamicMain = proxy.config.selectorGroupId >= 0L ||
+                        proxy.config.mainUrlTestTag != null
+                    // Nodes belonging to independent Router groups must never be mass-ignored:
+                    // they accumulate traffic independently of the main selector winner.
+                    val routerMemberIds = proxy.config.routerAllMemberIds
                     proxy.config.trafficMap.forEach { (tag, ents) ->
                         tags.add(tag)
                         for (ent in ents) {
+                            // Only ignore nodes that are NOT already accounted for by an
+                            // independent Router. Router member nodes get their own ignore=false
+                            // path and are updated regardless of main selector state.
+                            val belongsToRouter = ent.id in routerMemberIds
                             val item = TrafficUpdater.TrafficLooperData(
                                 tag = tag,
                                 rx = ent.rx,
                                 tx = ent.tx,
                                 rxBase = ent.rx,
                                 txBase = ent.tx,
-                                ignore = proxy.config.selectorGroupId >= 0L,
+                                ignore = dynamicMain && !belongsToRouter,
                             )
                             idMap[ent.id] = item
                             tagMap[tag] = item
-                            Logs.d("traffic count $tag to ${ent.id}")
                         }
                     }
-                    if (proxy.config.selectorGroupId >= 0L) {
+                    if (proxy.config.mainUrlTestTag != null) {
+                        syncUrlTestWinnerLocked(proxy)
+                    } else if (proxy.config.selectorGroupId >= 0L) {
                         selectMainLocked(proxy.config.mainEntId)
                     }
-                    //
                     trafficUpdater = TrafficUpdater(
                         box = proxy.box, items = idMap.values.toList()
                     )
+                    proxy.config.mainUrlTestTag?.let(tags::add)
                     proxy.box.setV2rayStats(tags.joinToString("\n"))
                 }
 
+                val urlTestSelections = syncUrlTestWinnerLocked(proxy)
                 trafficUpdater!!.updateAll()
                 currentCoroutineContext().ensureActive()
 
@@ -222,13 +282,18 @@ class TrafficLooper
                     mainRx += it.rx - it.rxBase
                 }
 
-                val trafficUpdates = arrayListOf<TrafficData>()
-                if (profileTrafficStatistics) {
+                // The list is only ever consumed by the foreground broadcast below, so
+                // building it while nobody is watching is pure garbage per tick.
+                val trafficUpdates = if (profileTrafficStatistics && mainActivityForeground) {
+                    val updates = arrayListOf<TrafficData>()
                     idMap.forEach { (id, item) ->
                         if (id > 0L && item.hasTrafficDelta) {
-                            trafficUpdates.add(TrafficData(id = id, rx = item.rx, tx = item.tx))
+                            updates.add(TrafficData(id = id, rx = item.rx, tx = item.tx))
                         }
                     }
+                    updates
+                } else {
+                    emptyList()
                 }
                 val snapshot = LoopSnapshot(
                     speed = SpeedDisplayData(
@@ -237,15 +302,12 @@ class TrafficLooper
                         if (showDirectSpeed) itemBypass.txRate else 0L,
                         if (showDirectSpeed) itemBypass.rxRate else 0L,
                         mainTx,
-                        mainRx
+                        mainRx,
+                        urlTestSelections,
                     ),
                     trafficUpdates = trafficUpdates,
                 )
-                if (data.state == BaseService.State.Connected
-                    && data.binder.callbackIdMap.containsValue(
-                        SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND
-                    )
-                ) {
+                if (mainActivityForeground && data.state == BaseService.State.Connected) {
                     data.binder.broadcast { callback ->
                         if (data.binder.callbackIdMap[callback] ==
                             SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND
@@ -268,7 +330,13 @@ class TrafficLooper
                 if (listenPostSpeed) postNotificationSpeedUpdate(snapshot.speed)
             }
 
-            delay(delayMs)
+            awaitUpdate(
+                TrafficLoopPolicy.delayMillis(
+                    configuredMillis = delayMs,
+                    mainActivityForeground = mainActivityForeground,
+                    notificationSpeedVisible = data.notification?.listenPostSpeed == true,
+                )
+            )
         }
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdater.kt b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdater.kt
index 35ab1bd367..4bea3c0523 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdater.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdater.kt
@@ -1,9 +1,17 @@
 package io.nekohasekai.sagernet.bg.proto
 
 class TrafficUpdater(
-    private val box: libcore.BoxInstance,
+    private val queryStats: (String, String) -> Long,
     val items: List<TrafficLooperData>, // contain "bypass"
+    private val monotonicMillis: () -> Long = { System.nanoTime() / 1_000_000L },
 ) {
+    constructor(box: libcore.BoxInstance, items: List<TrafficLooperData>) :
+        this(box::queryStats, items)
+
+    init {
+        val now = monotonicMillis()
+        items.forEach { it.lastUpdate = now }
+    }
 
     class TrafficLooperData(
         // Don't associate proxyEntity
@@ -19,20 +27,28 @@ class TrafficUpdater(
         var hasTrafficDelta: Boolean = false,
     )
 
-    private fun updateOne(item: TrafficLooperData): TrafficLooperData {
+    /**
+     * Writes the diff of [item] into [out] instead of allocating a new holder.
+     */
+    private fun updateOne(item: TrafficLooperData, out: TrafficLooperData): TrafficLooperData {
         // last update
-        val now = System.currentTimeMillis()
+        val now = monotonicMillis()
         val interval = now - item.lastUpdate
         item.lastUpdate = now
+        out.tag = item.tag
         if (interval <= 0) {
             item.rxRate = 0
             item.txRate = 0
-            return TrafficLooperData(tag = item.tag)
+            out.rx = 0L
+            out.tx = 0L
+            out.rxRate = 0L
+            out.txRate = 0L
+            return out
         }
 
         // query
-        val tx = box.queryStats(item.tag, "uplink")
-        val rx = box.queryStats(item.tag, "downlink")
+        val tx = queryStats(item.tag, "uplink")
+        val rx = queryStats(item.tag, "downlink")
 
         // add diff
         item.rx += rx
@@ -41,35 +57,39 @@ class TrafficUpdater(
         item.txRate = tx * 1000 / interval
 
         // return diff
-        return TrafficLooperData(
-            tag = item.tag,
-            rx = rx,
-            tx = tx,
-            rxRate = item.rxRate,
-            txRate = item.txRate,
-        )
+        out.rx = rx
+        out.tx = tx
+        out.rxRate = item.rxRate
+        out.txRate = item.txRate
+        return out
     }
 
+    // updateAll() runs on every traffic tick (down to 1s) and used to allocate a new
+    // map plus one diff holder per tag each time. Both are reused here so the steady
+    // state is allocation free.
+    private val diffByTag = HashMap<String, TrafficLooperData>()
+    private val queriedTags = HashSet<String>()
+
     fun updateAll() {
-        val updated = mutableMapOf<String, TrafficLooperData>() // diffs
+        queriedTags.clear()
         items.forEach { item ->
             item.hasTrafficDelta = false
             if (item.ignore) return@forEach
-            val diff = updated[item.tag]
+            val tag = item.tag
             // query a tag only once
-            if (diff == null) {
-                val newDiff = updateOne(item)
-                updated[item.tag] = newDiff
-                item.hasTrafficDelta = newDiff.rx != 0L || newDiff.tx != 0L
+            if (queriedTags.add(tag)) {
+                val diff = diffByTag.getOrPut(tag) { TrafficLooperData(tag = tag) }
+                updateOne(item, diff)
+                item.hasTrafficDelta = diff.rx != 0L || diff.tx != 0L
             } else {
+                val diff = diffByTag[tag]!!
                 item.rx += diff.rx
                 item.tx += diff.tx
                 item.rxRate = diff.rxRate
                 item.txRate = diff.txRate
                 item.hasTrafficDelta = diff.rx != 0L || diff.tx != 0L
+                item.lastUpdate = monotonicMillis()
             }
         }
-//        Logs.d(JavaUtil.gson.toJson(items))
-//        Logs.d(JavaUtil.gson.toJson(updated))
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt b/app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt
index ce1d57bf73..2c1f61921b 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt
@@ -1,7 +1,6 @@
 package io.nekohasekai.sagernet.database
 
 import android.os.Binder
-import android.os.Build
 import androidx.preference.PreferenceDataStore
 import io.nekohasekai.sagernet.CONNECTION_TEST_URL
 import io.nekohasekai.sagernet.GroupType
@@ -90,12 +89,12 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     var appTLSVersion by configurationStore.string(Key.APP_TLS_VERSION)
     var enableClashAPI by configurationStore.boolean(Key.ENABLE_CLASH_API)
-    var showBottomBar by configurationStore.boolean(Key.SHOW_BOTTOM_BAR)
     var confirmProfileDelete by configurationStore.boolean(Key.CONFIRM_PROFILE_DELETE) { true }
     var groupLayoutMode by configurationStore.stringToInt(Key.GROUP_LAYOUT_MODE) { 0 }
     var profileCardStyle by configurationStore.stringToInt(Key.PROFILE_CARD_STYLE) { 0 }
+    val DEPRECATED_SETTING_KEYS get() = Key.DEPRECATED_SETTING_KEYS
 
-    var allowInsecureOnRequest by configurationStore.boolean(Key.ALLOW_INSECURE_ON_REQUEST)
+    var allowInsecureOnRequest by configurationStore.boolean(Key.ALLOW_INSECURE_ON_REQUEST) { false }
     var networkChangeResetConnections by configurationStore.boolean(Key.NETWORK_CHANGE_RESET_CONNECTIONS) { true }
     var wakeResetConnections by configurationStore.boolean(Key.WAKE_RESET_CONNECTIONS)
 
@@ -118,6 +117,8 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     var allowAccess by configurationStore.boolean(Key.ALLOW_ACCESS)
     var speedInterval by configurationStore.stringToInt(Key.SPEED_INTERVAL)
+    var showProfileInNotification by configurationStore.boolean(Key.SHOW_PROFILE_IN_NOTIFICATION) { true }
+    var viewModeRouterGroups by configurationStore.boolean(Key.VIEW_MODE_ROUTER_GROUPS) { true }
     var showGroupInNotification by configurationStore.boolean("showGroupInNotification")
 
     var globalCustomConfig by configurationStore.string(Key.GLOBAL_CUSTOM_CONFIG) { "" }
@@ -133,8 +134,8 @@ object DataStore : OnPreferenceDataStoreChangeListener {
     var acquireWakeLock by configurationStore.boolean(Key.ACQUIRE_WAKE_LOCK)
     var hideFromRecentApps by configurationStore.boolean(Key.HIDE_FROM_RECENT_APPS)
 
-    var rulesGeositeUrl by configurationStore.string(Key.RULES_GEOSITE_URL) { "https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db" }
-    var rulesGeoipUrl by configurationStore.string(Key.RULES_GEOIP_URL) { "https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db" }
+    var rulesGeositeUrl by configurationStore.string(Key.RULES_GEOSITE_URL) { "https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db" }
+    var rulesGeoipUrl by configurationStore.string(Key.RULES_GEOIP_URL) { "https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db" }
     var rulesUpdateInterval by configurationStore.string(Key.RULES_UPDATE_INTERVAL) { "0" } // 默认为0，不自动更新
 
     // hopefully hashCode = mHandle doesn't change, currently this is true from KitKat to Nougat
@@ -156,8 +157,7 @@ object DataStore : OnPreferenceDataStoreChangeListener {
         set(value) = saveLocalPort(Key.MIXED_PORT, value)
 
     val mixedInboundNeedsAuth: Boolean
-        get() = serviceMode == Key.MODE_VPN &&
-            !(appendHttpProxy && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+        get() = serviceMode == Key.MODE_VPN
 
     val mixedInboundHasAuth: Boolean
         get() = mixedInboundNeedsAuth &&
@@ -170,6 +170,13 @@ object DataStore : OnPreferenceDataStoreChangeListener {
         if (configurationStore.getString(Key.MIXED_PORT) == null) {
             mixedPort = mixedPort
         }
+        sanitizeDeprecatedPreferences()
+    }
+
+    fun sanitizeDeprecatedPreferences() {
+        for (key in DEPRECATED_SETTING_KEYS) {
+            PublicDatabase.kvPairDao.delete(key)
+        }
     }
 
 
@@ -191,7 +198,9 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     val persistAcrossReboot by configurationStore.boolean(Key.PERSIST_ACROSS_REBOOT) { false }
 
-    var appendHttpProxy by configurationStore.boolean(Key.APPEND_HTTP_PROXY)
+    var appendHttpProxy: Boolean
+        get() = false
+        set(_) {}
     var httpProxyBypass by configurationStore.string(Key.HTTP_PROXY_BYPASS) { "" }
     var dnsHosts by configurationStore.string(Key.DNS_HOSTS) { "" }
     var strictRoute by configurationStore.boolean(Key.STRICT_ROUTE) { true }
@@ -200,8 +209,7 @@ object DataStore : OnPreferenceDataStoreChangeListener {
     var connectionTestTimeout by configurationStore.int(Key.CONNECTION_TEST_TIMEOUT) { 3000 }
     var alwaysShowAddress by configurationStore.boolean(Key.ALWAYS_SHOW_ADDRESS)
 
-    var tunImplementation by configurationStore.stringToInt(Key.TUN_IMPLEMENTATION) { TunImplementation.GVISOR }
-    var enableHevTun by configurationStore.boolean(Key.ENABLE_HEV_TUN)
+    var tunImplementation by configurationStore.stringToInt(Key.TUN_IMPLEMENTATION) { TunImplementation.GO }
     var profileTrafficStatistics by configurationStore.boolean(Key.PROFILE_TRAFFIC_STATISTICS) { true }
 
     var yacdURL by configurationStore.string("yacdURL") { "http://127.0.0.1:9090/ui" }
@@ -210,7 +218,9 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     var globalAllowInsecure by configurationStore.boolean(Key.GLOBAL_ALLOW_INSECURE) { false }
 
-    var enableTLSFragment by configurationStore.boolean(Key.ENABLE_TLS_FRAGMENT) { false }
+    var enableTLSFragment: Boolean
+        get() = false
+        set(_) {}
     var fragmentLength by configurationStore.string(Key.FRAGMENT_LENGTH) { "100-200" }
     var fragmentInterval by configurationStore.string(Key.FRAGMENT_INTERVAL) { "10-20" }
 
@@ -279,6 +289,7 @@ object DataStore : OnPreferenceDataStoreChangeListener {
     var routeRuleset by profileCacheStore.string(Key.ROUTE_RULESET)
     var routeOutbound by profileCacheStore.stringToInt(Key.ROUTE_OUTBOUND)
     var routeOutboundRule by profileCacheStore.long(Key.ROUTE_OUTBOUND + "Long")
+    var routeOutboundRouter by profileCacheStore.long(Key.ROUTE_OUTBOUND_ROUTER)
     var routePackages by profileCacheStore.string(Key.ROUTE_PACKAGES)
 
     var frontProxy by profileCacheStore.long(Key.GROUP_FRONT_PROXY + "Long")
@@ -310,22 +321,6 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     // var enableTLSFragment by configurationStore.boolean(Key.ENABLE_TLS_FRAGMENT)
 
-    var webdavServer: String?
-        get() = configurationStore.getString("webdavServer")
-        set(value) = configurationStore.putString("webdavServer", value)
-
-    var webdavUsername: String?
-        get() = configurationStore.getString("webdavUsername")
-        set(value) = configurationStore.putString("webdavUsername", value)
-
-    var webdavPassword: String?
-        get() = configurationStore.getString("webdavPassword")
-        set(value) = configurationStore.putString("webdavPassword", value)
-
-    var webdavPath: String?
-        get() = configurationStore.getString("webdavPath") ?: "NekoBox"  // 设置默认值
-        set(value) = configurationStore.putString("webdavPath", value)
-
     var globalMode by configurationStore.boolean(Key.GLOBAL_MODE)
 
     override fun onPreferenceDataStoreChanged(store: PreferenceDataStore, key: String) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt b/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt
index b2688f498f..e356b72ce8 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt
@@ -2,16 +2,33 @@ package io.nekohasekai.sagernet.database
 
 import io.nekohasekai.sagernet.GroupType
 import io.nekohasekai.sagernet.bg.SubscriptionUpdater
+import io.nekohasekai.sagernet.fmt.AbstractBean
+import io.nekohasekai.sagernet.fmt.toUniversalLink
 import io.nekohasekai.sagernet.ktx.applyDefaultValues
+import io.nekohasekai.sagernet.ktx.Logs
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+import io.nekohasekai.sagernet.route.RouterMembership
+import io.nekohasekai.sagernet.route.RouterMemberSnapshot
+import io.nekohasekai.sagernet.route.RouterNodeSnapshot
+import io.nekohasekai.sagernet.route.RouterReconcileGroup
+import io.nekohasekai.sagernet.route.RouterReconciler
+import io.nekohasekai.sagernet.route.danglingRouterMemberProxyIds
+import io.nekohasekai.sagernet.route.routerStableIdOrFallback
+import io.nekohasekai.sagernet.route.routerNodeKey
 
 object GroupManager {
 
+    data class RouterRefreshSnapshot(
+        val membersByRouterId: Map<Long, List<RouterMemberSnapshot>>
+    )
+
     interface Listener {
         suspend fun groupAdd(group: ProxyGroup)
         suspend fun groupUpdated(group: ProxyGroup)
 
         suspend fun groupRemoved(groupId: Long)
         suspend fun groupUpdated(groupId: Long)
+        suspend fun routerGroupsUpdated() = Unit
     }
 
     interface Interface {
@@ -56,6 +73,7 @@ object GroupManager {
     suspend fun clearGroup(groupId: Long) {
         DataStore.selectedProxy = 0L
         SagerDatabase.proxyDao.deleteAll(groupId)
+        cleanupDanglingRouterMembers()
         iterator { groupUpdated(groupId) }
     }
 
@@ -79,6 +97,203 @@ object GroupManager {
         iterator { groupUpdated(groupId) }
     }
 
+    fun replaceRouterMembers(
+        router: RouterGroup,
+        availableProxyIds: List<Long>,
+        requestedProxyIds: Iterable<Long>,
+    ) {
+        val plan = RouterMembership.plan(
+            availableProxyIds = availableProxyIds,
+            requestedProxyIds = requestedProxyIds,
+            currentSelectedProxyId = router.selectedProxyId
+                .takeIf { it != RouterGroup.NO_SELECTION },
+        )
+        SagerDatabase.instance.runInTransaction {
+            SagerDatabase.routerMemberDao.replaceMembers(
+                router.id,
+                plan.memberProxyIds.mapIndexed { index, proxyId ->
+                    RouterMember(
+                        routerId = router.id,
+                        proxyId = proxyId,
+                        userOrder = index.toLong(),
+                    )
+                },
+            )
+            SagerDatabase.routerGroupDao.update(
+                router.copy(selectedProxyId = plan.selectedProxyId ?: RouterGroup.NO_SELECTION),
+            )
+        }
+    }
+
+    fun snapshotRouterMembers(): RouterRefreshSnapshot {
+        val proxies = SagerDatabase.proxyDao.getAll().associateBy { it.id }
+        val sourceGroups = SagerDatabase.groupDao.allGroups().associateBy { it.id }
+        val members = SagerDatabase.routerGroupDao.all().associate { router ->
+            router.id to SagerDatabase.routerMemberDao.getByRouter(router.id).mapNotNull { member ->
+                proxies[member.proxyId]?.let { proxy ->
+                    RouterMemberSnapshot(
+                        proxyId = proxy.id,
+                        stableId = proxy.routerStableId(),
+                        sourceGroupId = sourceGroups[proxy.groupId]
+                            ?.takeIf { it.type == GroupType.SUBSCRIPTION }
+                            ?.id,
+                        userOrder = member.userOrder
+                    )
+                }
+            }
+        }
+        return RouterRefreshSnapshot(members)
+    }
+
+    suspend fun reconcileRouterMembers(previous: RouterRefreshSnapshot) {
+        // Keep the old selected ID until reconciliation can resolve it through the snapshot.
+        cleanupDanglingRouterMembers(clearInvalidSelections = false)
+        val routers = SagerDatabase.routerGroupDao.all()
+            .filter { it.stableTag.isNotBlank() }
+        if (routers.isEmpty()) {
+            cleanupDanglingRouterMembers()
+            return
+        }
+
+        val groups = routers.mapNotNull { router ->
+            runCatching {
+                RouterReconcileGroup(
+                    routerId = router.id,
+                    stableTag = router.stableTag,
+                    sourceGroupIds = SagerDatabase.routerGroupSourceDao.sourcesFor(router.id)
+                        .map { it.sourceGroupId },
+                    filter = RouterFilterConfig.fromJson(router.matchConfig).validate(),
+                    selectedProxyId = router.selectedProxyId.takeIf { it != RouterGroup.NO_SELECTION }
+                )
+            }.onFailure { error ->
+                Logs.e("Router ${router.stableTag} match configuration is invalid", error)
+                SagerDatabase.routerGroupDao.setLastError(router.id, "Invalid Router match configuration")
+            }.getOrNull()
+        }
+        if (groups.isEmpty()) {
+            cleanupDanglingRouterMembers()
+            return
+        }
+
+        val sourceGroups = SagerDatabase.groupDao.allGroups().associateBy { it.id }
+        val nodes = SagerDatabase.proxyDao.getAll().mapNotNull { proxy ->
+            runCatching {
+                RouterNodeSnapshot(
+                    id = proxy.id,
+                    stableId = proxy.routerStableId(),
+                    name = proxy.displayNameOrFallback(),
+                    subscriptionId = sourceGroups[proxy.groupId]
+                        ?.takeIf { it.type == GroupType.SUBSCRIPTION }
+                        ?.id,
+                    enabled = true,
+                    available = true,
+                )
+            }.onFailure { error ->
+                Logs.e("Failed to snapshot proxy ${proxy.id}", error)
+            }.getOrNull()
+        }
+
+        val result = RouterReconciler.reconcile(nodes, groups, previous.membersByRouterId)
+        if (result.error != null) {
+            Logs.e("Router reconciliation preserved existing members: ${result.error}")
+            routers.filter { router -> groups.any { it.routerId == router.id } }.forEach { router ->
+                SagerDatabase.routerGroupDao.setLastError(router.id, result.error)
+            }
+            cleanupDanglingRouterMembers()
+            return
+        }
+
+        val matchedAt = System.currentTimeMillis()
+        // Record the matchConfig and sourceGroupIds that were active when we computed members, so we can
+        // detect concurrent configuration or source changes inside the synchronized block.
+        val snapshotMatchConfigs = routers.associate { it.id to it.matchConfig }
+        val snapshotSourceGroupIds = groups.associate { it.routerId to it.sourceGroupIds.sorted() }
+        synchronized(RouterGroupRepository.routerSyncLock) {
+            SagerDatabase.instance.runInTransaction {
+                result.membersByRouterId.forEach { (routerId, members) ->
+                    // Re-read the router and its sources inside the lock to detect concurrent changes.
+                    val freshRouter = SagerDatabase.routerGroupDao.getById(routerId) ?: return@forEach
+                    val freshSources = SagerDatabase.routerGroupSourceDao.sourcesFor(routerId).map { it.sourceGroupId }.sorted()
+                    // If the persisted matchConfig or sources have changed since we computed members, our
+                    // result is stale. Skip writing; the save() that changed the config/sources will
+                    // trigger a new reconcile with up-to-date filter and source data.
+                    val computedMatchConfig = snapshotMatchConfigs[routerId]
+                    val computedSources = snapshotSourceGroupIds[routerId]
+                    if (computedMatchConfig != null && computedMatchConfig != freshRouter.matchConfig) {
+                        Logs.w("Router ${freshRouter.stableTag}: matchConfig changed during reconcile, skipping stale members")
+                        return@forEach
+                    }
+                    if (computedSources != null && computedSources != freshSources) {
+                        Logs.w("Router ${freshRouter.stableTag}: sources changed during reconcile, skipping stale members")
+                        return@forEach
+                    }
+                    SagerDatabase.routerMemberDao.replaceMembers(
+                        routerId,
+                        members.map { member ->
+                            RouterMember(
+                                routerId = routerId,
+                                proxyId = member.proxyId,
+                                userOrder = member.userOrder,
+                                lastMatchedAt = matchedAt
+                            )
+                        }
+                    )
+                    val selectedProxyId = if (freshRouter.selectedProxyId != RouterGroup.NO_SELECTION &&
+                        members.any { it.proxyId == freshRouter.selectedProxyId }
+                    ) {
+                        freshRouter.selectedProxyId
+                    } else {
+                        result.selectedProxyIdsByRouterId[routerId] ?: RouterGroup.NO_SELECTION
+                    }
+                    val selectedNodeKey = members.firstOrNull { it.proxyId == selectedProxyId }
+                        ?.let { routerNodeKey(it.sourceGroupId, it.stableId) }
+                        .orEmpty()
+                    val lastError = if (members.isEmpty()) "No nodes match ${freshRouter.name}" else ""
+                    // Use a field-level update to avoid overwriting fields that may have been
+                    // changed by a concurrent save() (e.g. matchConfig, mode, name).
+                    SagerDatabase.routerGroupDao.updateSelectionAndError(
+                        routerId = routerId,
+                        selectedProxyId = selectedProxyId,
+                        selectedNodeKey = selectedNodeKey,
+                        lastError = lastError,
+                    )
+                }
+                cleanupDanglingRouterMembers()
+            }
+        }
+        iterator { routerGroupsUpdated() }
+    }
+
+    fun markRouterRefreshFailed(sourceGroupId: Long, message: String) {
+        val error = message.ifBlank { "Subscription refresh failed" }
+        SagerDatabase.routerGroupSourceDao.routersForSource(sourceGroupId)
+            .forEach { source ->
+                // Use a field-level update to avoid overwriting concurrent changes to other fields
+                // (e.g. matchConfig updated by a save() racing with a failed refresh).
+                SagerDatabase.routerGroupDao.setLastError(source.routerId, error)
+            }
+    }
+
+    fun cleanupDanglingRouterMembers(clearInvalidSelections: Boolean = true) {
+        runCatching {
+            val currentProxyIds = SagerDatabase.proxyDao.getAll()
+                .filter { runCatching { it.requireBean() }.isSuccess }
+                .map { it.id }
+                .toSet()
+            val members = SagerDatabase.routerGroupDao.all().flatMap { router ->
+                SagerDatabase.routerMemberDao.getByRouter(router.id)
+            }
+            danglingRouterMemberProxyIds(members.map { member ->
+                RouterMemberSnapshot(member.proxyId, "proxy:${member.proxyId}")
+            }, currentProxyIds).forEach { proxyId ->
+                SagerDatabase.routerMemberDao.deleteByProxy(proxyId)
+            }
+            if (clearInvalidSelections) SagerDatabase.routerGroupDao.clearInvalidSelections()
+        }.onFailure { error ->
+            Logs.e("Unable to clean dangling router members", error)
+        }
+    }
+
     suspend fun createGroup(group: ProxyGroup): ProxyGroup {
         group.userOrder = SagerDatabase.groupDao.nextOrder() ?: 1
         group.id = SagerDatabase.groupDao.createGroup(group.applyDefaultValues())
@@ -98,17 +313,46 @@ object GroupManager {
     }
 
     suspend fun deleteGroup(groupId: Long) {
+        val routerSnapshot = snapshotRouterMembers()
+        SagerDatabase.routerGroupSourceDao.deleteBySource(groupId)
         SagerDatabase.groupDao.deleteById(groupId)
         SagerDatabase.proxyDao.deleteByGroup(groupId)
+        reconcileRouterMembers(routerSnapshot)
         iterator { groupRemoved(groupId) }
         SubscriptionUpdater.reconfigureUpdater()
     }
 
     suspend fun deleteGroup(group: List<ProxyGroup>) {
+        val routerSnapshot = snapshotRouterMembers()
+        group.forEach { SagerDatabase.routerGroupSourceDao.deleteBySource(it.id) }
         SagerDatabase.groupDao.deleteGroup(group)
         SagerDatabase.proxyDao.deleteByGroup(group.map { it.id }.toLongArray())
+        reconcileRouterMembers(routerSnapshot)
         for (proxyGroup in group) iterator { groupRemoved(proxyGroup.id) }
         SubscriptionUpdater.reconfigureUpdater()
     }
 
-}
\ No newline at end of file
+}
+
+internal fun ProxyEntity.routerStableId(): String {
+    return routerStableIdOrFallback(
+        uuid.takeIf { it.isNotBlank() }
+            ?: runCatching { requireBean().routerStableIdentity() }.getOrNull(),
+        id
+    )
+}
+
+internal fun ProxyEntity.displayNameOrFallback(): String =
+    runCatching { displayName() }.getOrNull()
+        ?.takeIf { it.isNotBlank() }
+        ?: runCatching { displayAddress() }.getOrNull()?.takeIf { it.isNotBlank() }
+        ?: uuid.takeIf { it.isNotBlank() }
+        ?: "Proxy $id"
+
+internal fun AbstractBean.routerStableIdentity(): String {
+    return clone().apply {
+        name = ""
+        customOutboundJson = ""
+        customConfigJson = ""
+    }.toUniversalLink()
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/ProfileManager.kt b/app/src/main/java/io/nekohasekai/sagernet/database/ProfileManager.kt
index 661db42492..d5cd4a8b27 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/ProfileManager.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/ProfileManager.kt
@@ -72,7 +72,7 @@ object ProfileManager {
         }
     }
 
-    suspend fun createProfile(groupId: Long, bean: AbstractBean): ProxyEntity {
+    suspend fun createProfile(groupId: Long, bean: AbstractBean, reconcile: Boolean = true): ProxyEntity {
         bean.applyDefaultValues()
 
         val profile = ProxyEntity(groupId = groupId).apply {
@@ -81,6 +81,11 @@ object ProfileManager {
             userOrder = SagerDatabase.proxyDao.nextOrder(groupId) ?: 1
         }
         profile.id = SagerDatabase.proxyDao.addProxy(profile)
+        if (reconcile && RouterGroupRepository.all().isNotEmpty()) {
+            runCatching {
+                GroupManager.reconcileRouterMembers(GroupManager.snapshotRouterMembers())
+            }
+        }
         iterator { onAdd(profile) }
         return profile
     }
@@ -108,14 +113,18 @@ object ProfileManager {
     }
 
     suspend fun deleteProfile2(groupId: Long, profileId: Long) {
+        SagerDatabase.routerMemberDao.deleteByProxy(profileId)
         if (SagerDatabase.proxyDao.deleteById(profileId) == 0) return
+        GroupManager.cleanupDanglingRouterMembers()
         if (DataStore.selectedProxy == profileId) {
             DataStore.selectedProxy = 0L
         }
     }
 
     suspend fun deleteProfile(groupId: Long, profileId: Long) {
+        SagerDatabase.routerMemberDao.deleteByProxy(profileId)
         if (SagerDatabase.proxyDao.deleteById(profileId) == 0) return
+        GroupManager.cleanupDanglingRouterMembers()
         if (DataStore.selectedProxy == profileId) {
             DataStore.selectedProxy = 0L
         }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/ProxyEntity.kt b/app/src/main/java/io/nekohasekai/sagernet/database/ProxyEntity.kt
index cb10edf727..9f04e1c898 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/ProxyEntity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/ProxyEntity.kt
@@ -197,16 +197,16 @@ data class ProxyEntity(
     }
 
     fun displayType(): String = when (type) {
-        TYPE_SOCKS -> socksBean!!.protocolName()
-        TYPE_HTTP -> if (httpBean!!.isTLS()) "HTTPS" else "HTTP"
+        TYPE_SOCKS -> socksBean?.protocolName() ?: "SOCKS"
+        TYPE_HTTP -> if (httpBean?.isTLS() == true) "HTTPS" else "HTTP"
         TYPE_SS -> "Shadowsocks"
         TYPE_SSR -> "ShadowsocksR"
-        TYPE_VMESS -> if (vmessBean!!.isVLESS) "VLESS" else "VMess"
+        TYPE_VMESS -> if (vmessBean?.isVLESS == true) "VLESS" else "VMess"
         TYPE_TROJAN -> "Trojan"
         TYPE_TROJAN_GO -> "Trojan-Go"
         TYPE_MIERU -> "Mieru"
         TYPE_NAIVE -> "Naïve"
-        TYPE_HYSTERIA -> "Hysteria" + hysteriaBean!!.protocolVersion
+        TYPE_HYSTERIA -> "Hysteria" + (hysteriaBean?.protocolVersion ?: "")
         TYPE_SSH -> "SSH"
         TYPE_WG -> "WireGuard"
         TYPE_TUIC -> "TUIC"
@@ -214,8 +214,8 @@ data class ProxyEntity(
         TYPE_SHADOWTLS -> "ShadowTLS"
         TYPE_ANYTLS -> "AnyTLS"
         TYPE_CHAIN -> chainName
-        TYPE_NEKO -> nekoBean!!.displayType()
-        TYPE_CONFIG -> configBean!!.displayType()
+        TYPE_NEKO -> nekoBean?.displayType() ?: "Neko"
+        TYPE_CONFIG -> configBean?.displayType() ?: "Config"
         TYPE_SNELL -> "Snell"
         else -> "Undefined type $type"
     }
@@ -246,7 +246,7 @@ data class ProxyEntity(
             TYPE_CONFIG -> configBean
             TYPE_SNELL -> snellBean
             else -> error("Undefined type $type")
-        } ?: error("Null ${displayType()} profile")
+        } ?: error("Missing profile data (type=$type, id=$id, groupId=$groupId)")
     }
 
     fun haveLink(): Boolean {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/ProxyGroup.kt b/app/src/main/java/io/nekohasekai/sagernet/database/ProxyGroup.kt
index 27c10602ba..0079ac5488 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/ProxyGroup.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/ProxyGroup.kt
@@ -37,11 +37,13 @@ data class ProxyGroup(
             output.writeInt(0)
             output.writeString(name)
             output.writeInt(type)
-            val subscription = subscription!!
+            val subscription = checkNotNull(subscription) {
+                "Subscription group ($name) requires subscription data"
+            }
             subscription.serializeForShare(output)
 
         } else {
-            output.writeInt(0)
+            output.writeInt(1)
             output.writeLong(id)
             output.writeLong(userOrder)
             output.writeBoolean(ungrouped)
@@ -49,9 +51,15 @@ data class ProxyGroup(
             output.writeInt(type)
 
             if (type == GroupType.SUBSCRIPTION) {
-                subscription?.serializeToBuffer(output)
+                val subscription = checkNotNull(subscription) {
+                    "Subscription group $id ($name) requires subscription data"
+                }
+                subscription.serializeToBuffer(output)
             }
             output.writeInt(order)
+            output.writeBoolean(isSelector)
+            output.writeLong(frontProxy)
+            output.writeLong(landingProxy)
         }
     }
 
@@ -81,6 +89,11 @@ data class ProxyGroup(
                 subscription.deserializeFromBuffer(input)
             }
             order = input.readInt()
+            if (version >= 1) {
+                isSelector = input.readBoolean()
+                frontProxy = input.readLong()
+                landingProxy = input.readLong()
+            }
         }
     }
 
@@ -140,4 +153,4 @@ data class ProxyGroup(
         }
     }
 
-}
\ No newline at end of file
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroup.kt b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroup.kt
new file mode 100644
index 0000000000..a886d35f67
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroup.kt
@@ -0,0 +1,153 @@
+package io.nekohasekai.sagernet.database
+
+import androidx.room.Dao
+import androidx.room.ColumnInfo
+import androidx.room.Delete
+import androidx.room.Entity
+import androidx.room.Index
+import androidx.room.Insert
+import androidx.room.OnConflictStrategy
+import androidx.room.PrimaryKey
+import androidx.room.Query
+import androidx.room.Update
+import com.esotericsoftware.kryo.io.ByteBufferInput
+import com.esotericsoftware.kryo.io.ByteBufferOutput
+import io.nekohasekai.sagernet.fmt.Serializable
+
+@Entity(
+    tableName = "router_groups",
+    indices = [Index("stableTag", unique = true)]
+)
+data class RouterGroup(
+    @PrimaryKey(autoGenerate = true) var id: Long = 0L,
+    var stableTag: String = "",
+    var name: String = "",
+    var mode: Int = MODE_SELECTOR,
+    var enabled: Boolean = true,
+    var matchConfig: String = "{}",
+    var selectedProxyId: Long = NO_SELECTION,
+    var userOrder: Long = 0L,
+    @ColumnInfo(defaultValue = "")
+    var selectedNodeKey: String = "",
+    @ColumnInfo(defaultValue = "")
+    var lastError: String = "",
+) : Serializable() {
+
+    override fun initializeDefaultValues() {
+    }
+
+    override fun serializeToBuffer(output: ByteBufferOutput) {
+        output.writeInt(1)
+        output.writeLong(id)
+        output.writeString(stableTag)
+        output.writeString(name)
+        output.writeInt(mode)
+        output.writeBoolean(enabled)
+        output.writeString(matchConfig)
+        output.writeLong(selectedProxyId)
+        output.writeLong(userOrder)
+        output.writeString(selectedNodeKey)
+        output.writeString(lastError)
+    }
+
+    override fun deserializeFromBuffer(input: ByteBufferInput) {
+        val version = input.readInt()
+        id = input.readLong()
+        stableTag = input.readString()
+        name = input.readString()
+        mode = input.readInt()
+        enabled = input.readBoolean()
+        matchConfig = input.readString()
+        selectedProxyId = input.readLong()
+        userOrder = input.readLong()
+        if (version >= 1) {
+            selectedNodeKey = input.readString()
+            lastError = input.readString()
+        }
+    }
+
+    @androidx.room.Dao
+    interface Dao {
+
+        @Query("SELECT * FROM router_groups ORDER BY userOrder, id")
+        fun all(): List<RouterGroup>
+
+        @Query("SELECT * FROM router_groups WHERE id = :routerId")
+        fun getById(routerId: Long): RouterGroup?
+
+        @Query("SELECT * FROM router_groups WHERE stableTag = :stableTag")
+        fun getByStableTag(stableTag: String): RouterGroup?
+
+        @Query("SELECT MAX(userOrder) + 1 FROM router_groups")
+        fun nextOrder(): Long?
+
+        @Insert
+        fun create(router: RouterGroup): Long
+
+        @Update
+        fun update(router: RouterGroup): Int
+
+        @Query("""
+            UPDATE router_groups SET selectedProxyId = -1, selectedNodeKey = ''
+            WHERE selectedProxyId != -1 AND (
+                NOT EXISTS (SELECT 1 FROM proxy_entities WHERE id = router_groups.selectedProxyId)
+                OR NOT EXISTS (SELECT 1 FROM router_members
+                    WHERE routerId = router_groups.id AND proxyId = router_groups.selectedProxyId)
+            )
+        """)
+        fun clearInvalidSelections(): Int
+
+        @Delete
+        fun delete(router: RouterGroup): Int
+
+        @Query("DELETE FROM router_groups")
+        fun reset()
+
+        @Insert
+        fun insert(routers: List<RouterGroup>)
+
+        @Query("UPDATE router_groups SET lastError = :error WHERE id = :routerId")
+        fun setLastError(routerId: Long, error: String): Int
+
+        @Query("""
+            UPDATE router_groups
+            SET selectedProxyId = :selectedProxyId, selectedNodeKey = :selectedNodeKey
+            WHERE id = :routerId
+        """)
+        fun updateSelection(
+            routerId: Long,
+            selectedProxyId: Long,
+            selectedNodeKey: String,
+        ): Int
+
+        @Query("""
+            UPDATE router_groups
+            SET selectedProxyId = :selectedProxyId, selectedNodeKey = :selectedNodeKey, lastError = :lastError
+            WHERE id = :routerId
+        """)
+        fun updateSelectionAndError(
+            routerId: Long,
+            selectedProxyId: Long,
+            selectedNodeKey: String,
+            lastError: String,
+        ): Int
+    }
+
+    companion object {
+        const val MODE_SELECTOR = 0
+        const val MODE_URL_TEST = 1
+        const val NO_SELECTION = -1L
+
+        @JvmField
+        val CREATOR = object : Serializable.CREATOR<RouterGroup>() {
+
+            override fun newInstance(): RouterGroup {
+                return RouterGroup()
+            }
+
+            override fun newArray(size: Int): Array<RouterGroup?> {
+                return arrayOfNulls(size)
+            }
+        }
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupRepository.kt b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupRepository.kt
new file mode 100644
index 0000000000..382e219c67
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupRepository.kt
@@ -0,0 +1,205 @@
+package io.nekohasekai.sagernet.database
+
+import io.nekohasekai.sagernet.GroupType
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+import io.nekohasekai.sagernet.route.RouterFilterException
+import io.nekohasekai.sagernet.route.RouterMatchRequest
+import io.nekohasekai.sagernet.route.RouterMatcher
+import io.nekohasekai.sagernet.route.RouterNodeSnapshot
+import io.nekohasekai.sagernet.route.routerNodeKey
+import io.nekohasekai.sagernet.route.routerStableIdOrFallback
+import io.nekohasekai.sagernet.ktx.Logs
+import java.net.URI
+import java.util.UUID
+
+data class RouterGroupDraft(
+    val id: Long = 0L,
+    val name: String,
+    val mode: Int,
+    val enabled: Boolean,
+    val sourceGroupIds: List<Long>,
+    val filter: RouterFilterConfig,
+)
+
+data class RouterGroupPreview(
+    val proxyIds: List<Long>,
+    val names: List<String>,
+)
+
+sealed interface RouterDeleteResult {
+    data object Deleted : RouterDeleteResult
+    data class Referenced(val ruleCount: Int) : RouterDeleteResult
+}
+
+class RouterGroupValidationException(
+    val field: Field,
+    message: String,
+    cause: Throwable? = null,
+) : IllegalArgumentException(message, cause) {
+    enum class Field {
+        NAME,
+        MODE,
+        SOURCES,
+        INCLUDE,
+        EXCLUDE,
+        URL,
+        INTERVAL,
+        TOLERANCE,
+    }
+}
+
+fun RouterGroupDraft.validate(
+    existingGroups: Iterable<RouterGroup>,
+    validSubscriptionIds: Set<Long>,
+) {
+    val normalizedName = name.trim()
+    if (normalizedName.isEmpty() || existingGroups.any {
+            it.id != id && it.name.trim().equals(normalizedName, ignoreCase = true)
+        }
+    ) throw RouterGroupValidationException(RouterGroupValidationException.Field.NAME, "Group name is empty or already used")
+
+    if (mode != RouterGroup.MODE_SELECTOR && mode != RouterGroup.MODE_URL_TEST) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.MODE, "Unsupported group mode")
+    }
+    if (enabled && sourceGroupIds.isEmpty() || sourceGroupIds.any { it !in validSubscriptionIds }) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.SOURCES, "Select at least one existing subscription")
+    }
+    try {
+        filter.validate()
+    } catch (error: RouterFilterException) {
+        val field = if (error.field == RouterFilterException.Field.INCLUDE) {
+            RouterGroupValidationException.Field.INCLUDE
+        } else {
+            RouterGroupValidationException.Field.EXCLUDE
+        }
+        throw RouterGroupValidationException(field, error.message ?: "Invalid regular expression", error)
+    }
+    if (filter.intervalSeconds < 10) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.INTERVAL, "Interval must be at least 10 seconds")
+    }
+    if (filter.intervalSeconds > 86400) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.INTERVAL, "Interval must not exceed 86400 seconds (24 hours)")
+    }
+    if (filter.toleranceMs !in 0..65535) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.TOLERANCE, "Tolerance must be between 0 and 65535 ms")
+    }
+    val uri = runCatching { URI(filter.testUrl) }.getOrNull()
+    if (mode == RouterGroup.MODE_URL_TEST && (uri?.scheme !in setOf("http", "https") || uri?.host.isNullOrBlank())) {
+        throw RouterGroupValidationException(RouterGroupValidationException.Field.URL, "Test URL must be HTTP or HTTPS")
+    }
+}
+
+object RouterGroupRepository {
+    fun all(): List<RouterGroup> = SagerDatabase.routerGroupDao.all()
+
+    fun get(routerId: Long): RouterGroup? = SagerDatabase.routerGroupDao.getById(routerId)
+
+    fun sourceIds(routerId: Long): List<Long> =
+        SagerDatabase.routerGroupSourceDao.sourcesFor(routerId).map { it.sourceGroupId }
+
+    fun preview(draft: RouterGroupDraft): RouterGroupPreview {
+        draft.filter.validate()
+        val sourceIds = draft.sourceGroupIds.distinct()
+        val nodes = sourceIds.flatMap { sourceId ->
+            SagerDatabase.proxyDao.getByGroup(sourceId).mapNotNull { proxy ->
+                runCatching {
+                    proxy.requireBean()
+                    RouterNodeSnapshot(
+                        id = proxy.id,
+                        stableId = proxy.routerStableId(),
+                        name = proxy.displayNameOrFallback(),
+                        subscriptionId = sourceId,
+                        enabled = true,
+                        available = true,
+                    )
+                }.onFailure { error ->
+                    Logs.e("Failed to snapshot proxy ${proxy.id}", error)
+                }.getOrNull()
+            }
+        }
+        val subNames = runCatching { SagerDatabase.groupDao.allGroups().associate { it.id to it.displayName() } }.getOrDefault(emptyMap())
+        val ids = RouterMatcher.match(
+            nodes,
+            listOf(RouterMatchRequest(draft.id, sourceIds, draft.filter.validate())),
+        )[draft.id].orEmpty()
+        val byId = nodes.associateBy { it.id }
+        val names = ids.mapNotNull { id ->
+            byId[id]?.let { node ->
+                val subName = node.subscriptionId?.let { subNames[it] }
+                if (!subName.isNullOrBlank()) "[${subName}] ${node.name.trim()}" else node.name.trim()
+            }
+        }
+        return RouterGroupPreview(ids, names)
+    }
+
+    internal val routerSyncLock = Any()
+
+    suspend fun save(draft: RouterGroupDraft): RouterGroup {
+        val subscriptions = SagerDatabase.groupDao.allGroups()
+            .filter { it.type == GroupType.SUBSCRIPTION }
+            .mapTo(mutableSetOf()) { it.id }
+        draft.validate(all(), subscriptions)
+        val snapshot = GroupManager.snapshotRouterMembers()
+        val savedGroup = synchronized(routerSyncLock) {
+            SagerDatabase.instance.runInTransaction<RouterGroup> {
+                val existing = draft.id.takeIf { it > 0 }?.let(SagerDatabase.routerGroupDao::getById)
+                val group = RouterGroup(
+                    id = existing?.id ?: 0L,
+                    stableTag = existing?.stableTag ?: newStableTag(),
+                    name = draft.name.trim(),
+                    mode = draft.mode,
+                    enabled = draft.enabled,
+                    matchConfig = draft.filter.toJson(),
+                    selectedProxyId = existing?.selectedProxyId ?: RouterGroup.NO_SELECTION,
+                    userOrder = existing?.userOrder ?: (SagerDatabase.routerGroupDao.nextOrder() ?: 1L),
+                    selectedNodeKey = existing?.selectedNodeKey.orEmpty(),
+                    lastError = existing?.lastError.orEmpty(),
+                )
+                if (existing == null) group.id = SagerDatabase.routerGroupDao.create(group)
+                else SagerDatabase.routerGroupDao.update(group)
+                SagerDatabase.routerGroupSourceDao.replaceSources(group.id, draft.sourceGroupIds)
+                group
+            }
+        }
+        GroupManager.reconcileRouterMembers(snapshot)
+        return SagerDatabase.routerGroupDao.getById(savedGroup.id) ?: savedGroup
+    }
+
+    fun delete(routerId: Long): RouterDeleteResult {
+        val references = SagerDatabase.rulesDao.countByRouterGroup(routerId)
+        if (references > 0) return RouterDeleteResult.Referenced(references)
+        val group = SagerDatabase.routerGroupDao.getById(routerId) ?: return RouterDeleteResult.Deleted
+        SagerDatabase.instance.runInTransaction {
+            SagerDatabase.routerMemberDao.deleteByRouter(routerId)
+            SagerDatabase.routerGroupSourceDao.deleteByRouter(routerId)
+            SagerDatabase.routerGroupDao.delete(group)
+        }
+        return RouterDeleteResult.Deleted
+    }
+
+    fun select(routerId: Long, proxyId: Long): RouterGroup = synchronized(routerSyncLock) {
+        SagerDatabase.instance.runInTransaction<RouterGroup> {
+            val group = SagerDatabase.routerGroupDao.getById(routerId)
+                ?: throw IllegalArgumentException("Proxy group does not exist")
+            check(group.enabled && group.mode == RouterGroup.MODE_SELECTOR) {
+                "Only an enabled selector group accepts a manual selection"
+            }
+            check(SagerDatabase.routerMemberDao.getByRouter(routerId).any { it.proxyId == proxyId }) {
+                "Selected node is not a member of ${group.name}"
+            }
+            val proxy = SagerDatabase.proxyDao.getById(proxyId)
+                ?: throw IllegalArgumentException("Selected node does not exist")
+            proxy.requireBean()
+            val stableId = proxy.routerStableId()
+            val updated = group.copy(
+                selectedProxyId = proxyId,
+                selectedNodeKey = routerNodeKey(proxy.groupId, stableId),
+            )
+            SagerDatabase.routerGroupDao.update(updated)
+            updated
+        }
+    }
+
+    private fun newStableTag(): String =
+        "router." + UUID.randomUUID().toString().replace("-", "").lowercase()
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupSource.kt b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupSource.kt
new file mode 100644
index 0000000000..730daa3353
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupSource.kt
@@ -0,0 +1,81 @@
+package io.nekohasekai.sagernet.database
+
+import androidx.room.Entity
+import androidx.room.ColumnInfo
+import androidx.room.Index
+import androidx.room.Insert
+import androidx.room.Query
+import androidx.room.Transaction
+import com.esotericsoftware.kryo.io.ByteBufferInput
+import com.esotericsoftware.kryo.io.ByteBufferOutput
+import io.nekohasekai.sagernet.fmt.Serializable
+
+@Entity(
+    tableName = "router_group_sources",
+    primaryKeys = ["routerId", "sourceGroupId"],
+    indices = [Index("sourceGroupId")],
+)
+data class RouterGroupSource(
+    var routerId: Long = 0L,
+    var sourceGroupId: Long = 0L,
+    @ColumnInfo(defaultValue = "0")
+    var userOrder: Long = 0L,
+) : Serializable() {
+
+    override fun initializeDefaultValues() = Unit
+
+    override fun serializeToBuffer(output: ByteBufferOutput) {
+        output.writeInt(0)
+        output.writeLong(routerId)
+        output.writeLong(sourceGroupId)
+        output.writeLong(userOrder)
+    }
+
+    override fun deserializeFromBuffer(input: ByteBufferInput) {
+        input.readInt()
+        routerId = input.readLong()
+        sourceGroupId = input.readLong()
+        userOrder = input.readLong()
+    }
+
+    @androidx.room.Dao
+    interface Dao {
+        @Query("SELECT * FROM router_group_sources ORDER BY routerId, userOrder, sourceGroupId")
+        fun all(): List<RouterGroupSource>
+
+        @Query("SELECT * FROM router_group_sources WHERE routerId = :routerId ORDER BY userOrder, sourceGroupId")
+        fun sourcesFor(routerId: Long): List<RouterGroupSource>
+
+        @Query("SELECT * FROM router_group_sources WHERE sourceGroupId = :sourceGroupId ORDER BY routerId")
+        fun routersForSource(sourceGroupId: Long): List<RouterGroupSource>
+
+        @Query("DELETE FROM router_group_sources WHERE routerId = :routerId")
+        fun deleteByRouter(routerId: Long): Int
+
+        @Query("DELETE FROM router_group_sources WHERE sourceGroupId = :sourceGroupId")
+        fun deleteBySource(sourceGroupId: Long): Int
+
+        @Insert
+        fun insert(sources: List<RouterGroupSource>)
+
+        @Transaction
+        fun replaceSources(routerId: Long, sourceGroupIds: Iterable<Long>) {
+            deleteByRouter(routerId)
+            val rows = sourceGroupIds.distinct().mapIndexed { index, sourceGroupId ->
+                RouterGroupSource(routerId, sourceGroupId, index.toLong())
+            }
+            if (rows.isNotEmpty()) insert(rows)
+        }
+
+        @Query("DELETE FROM router_group_sources")
+        fun reset()
+    }
+
+    companion object {
+        @JvmField
+        val CREATOR = object : Serializable.CREATOR<RouterGroupSource>() {
+            override fun newInstance() = RouterGroupSource()
+            override fun newArray(size: Int): Array<RouterGroupSource?> = arrayOfNulls(size)
+        }
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/RouterMember.kt b/app/src/main/java/io/nekohasekai/sagernet/database/RouterMember.kt
new file mode 100644
index 0000000000..9e2ce378e3
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/RouterMember.kt
@@ -0,0 +1,104 @@
+package io.nekohasekai.sagernet.database
+
+import androidx.room.Dao
+import androidx.room.Entity
+import androidx.room.Index
+import androidx.room.Insert
+import androidx.room.OnConflictStrategy
+import androidx.room.Query
+import androidx.room.Transaction
+import com.esotericsoftware.kryo.io.ByteBufferInput
+import com.esotericsoftware.kryo.io.ByteBufferOutput
+import io.nekohasekai.sagernet.fmt.Serializable
+
+@Entity(
+    tableName = "router_members",
+    primaryKeys = ["routerId", "proxyId"],
+    indices = [Index("proxyId")]
+)
+data class RouterMember(
+    var routerId: Long = 0L,
+    var proxyId: Long = 0L,
+    var userOrder: Long = 0L,
+    var lastMatchedAt: Long = 0L
+) : Serializable() {
+
+    override fun initializeDefaultValues() {
+    }
+
+    override fun serializeToBuffer(output: ByteBufferOutput) {
+        output.writeInt(0)
+        output.writeLong(routerId)
+        output.writeLong(proxyId)
+        output.writeLong(userOrder)
+        output.writeLong(lastMatchedAt)
+    }
+
+    override fun deserializeFromBuffer(input: ByteBufferInput) {
+        input.readInt()
+        routerId = input.readLong()
+        proxyId = input.readLong()
+        userOrder = input.readLong()
+        lastMatchedAt = input.readLong()
+    }
+
+    @androidx.room.Dao
+    interface Dao {
+
+        @Query("SELECT * FROM router_members ORDER BY routerId, userOrder, proxyId")
+        fun all(): List<RouterMember>
+
+        @Query("SELECT * FROM router_members WHERE routerId = :routerId ORDER BY userOrder, proxyId")
+        fun getByRouter(routerId: Long): List<RouterMember>
+
+        @Query("DELETE FROM router_members WHERE routerId = :routerId")
+        fun deleteByRouter(routerId: Long): Int
+
+        @Query("DELETE FROM router_members WHERE proxyId = :proxyId")
+        fun deleteByProxy(proxyId: Long): Int
+
+        @Query("UPDATE router_members SET userOrder = :userOrder WHERE routerId = :routerId AND proxyId = :proxyId")
+        fun updateUserOrder(routerId: Long, proxyId: Long, userOrder: Long): Int
+
+        @Transaction
+        fun updateOrders(routerId: Long, orderedProxyIds: List<Long>) {
+            val existing = getByRouter(routerId)
+            if (existing.isEmpty()) return
+            val existingIds = existing.mapTo(hashSetOf()) { it.proxyId }
+            val ordered = orderedProxyIds.distinct().filter { it in existingIds }
+            val orderedSet = ordered.toSet()
+            val merged = ordered + existing.filter { it.proxyId !in orderedSet }.map { it.proxyId }
+            for ((index, proxyId) in merged.withIndex()) {
+                updateUserOrder(routerId, proxyId, (index + 1).toLong())
+            }
+        }
+
+        @Insert
+        fun insert(members: List<RouterMember>)
+
+        @Transaction
+        fun replaceMembers(routerId: Long, members: List<RouterMember>) {
+            deleteByRouter(routerId)
+            if (members.isNotEmpty()) {
+                insert(members.map { it.copy(routerId = routerId) })
+            }
+        }
+
+        @Query("DELETE FROM router_members")
+        fun reset()
+    }
+
+    companion object {
+        @JvmField
+        val CREATOR = object : Serializable.CREATOR<RouterMember>() {
+
+            override fun newInstance(): RouterMember {
+                return RouterMember()
+            }
+
+            override fun newArray(size: Int): Array<RouterMember?> {
+                return arrayOfNulls(size)
+            }
+        }
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt b/app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt
index e730807397..8604ef932a 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt
@@ -4,6 +4,7 @@ import android.os.Parcelable
 import androidx.room.*
 import io.nekohasekai.sagernet.R
 import io.nekohasekai.sagernet.ktx.app
+import kotlinx.parcelize.IgnoredOnParcel
 import kotlinx.parcelize.Parcelize
 
 @Entity(tableName = "rules")
@@ -27,6 +28,9 @@ data class RuleEntity(
     var ruleset: String = "",
     var outbound: Long = 0,
     var packages: Set<String> = emptySet(),
+    @IgnoredOnParcel
+    @ColumnInfo(defaultValue = "0")
+    var routerGroupId: Long = 0L,
 ) : Parcelable {
 
     fun displayName(): String {
@@ -56,6 +60,10 @@ data class RuleEntity(
     }
 
     fun displayOutbound(): String {
+        if (routerGroupId > 0L) {
+            return SagerDatabase.routerGroupDao.getById(routerGroupId)?.name
+                ?: app.getString(R.string.router_reference_invalid)
+        }
         return when (outbound) {
             0L -> app.getString(R.string.route_proxy)
             -1L -> app.getString(R.string.route_bypass)
@@ -83,6 +91,9 @@ data class RuleEntity(
         @Query("SELECT * FROM rules WHERE id = :ruleId")
         fun getById(ruleId: Long): RuleEntity?
 
+        @Query("SELECT COUNT(*) FROM rules WHERE routerGroupId = :routerGroupId")
+        fun countByRouterGroup(routerGroupId: Long): Int
+
         @Query("DELETE FROM rules WHERE id = :ruleId")
         fun deleteById(ruleId: Long): Int
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt b/app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt
index ab10fedb89..50531b340d 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt
@@ -15,14 +15,17 @@ import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.launch
 
 @Database(
-    entities = [ProxyGroup::class, ProxyEntity::class, RuleEntity::class],
-    version = 8,
+    entities = [ProxyGroup::class, ProxyEntity::class, RuleEntity::class, RouterGroup::class, RouterMember::class, RouterGroupSource::class],
+    version = 10,
+    // This phase supports upgrades from v3 through v9; v1/v2 compatibility is deferred to a separate migration task.
     autoMigrations = [
         AutoMigration(from = 3, to = 4),
         AutoMigration(from = 4, to = 5),
         AutoMigration(from = 5, to = 6),
         AutoMigration(from = 6, to = 7),
-        AutoMigration(from = 7, to = 8)
+        AutoMigration(from = 7, to = 8),
+        AutoMigration(from = 8, to = 9),
+        AutoMigration(from = 9, to = 10)
     ]
 )
 @TypeConverters(value = [KryoConverters::class, GsonConverters::class])
@@ -39,7 +42,6 @@ abstract class SagerDatabase : RoomDatabase() {
                 .setJournalMode(JournalMode.TRUNCATE)
                 .allowMainThreadQueries()
                 .enableMultiInstanceInvalidation()
-                .fallbackToDestructiveMigration()
                 .setQueryExecutor { GlobalScope.launch { it.run() } }
                 .build()
         }
@@ -47,11 +49,17 @@ abstract class SagerDatabase : RoomDatabase() {
         val groupDao get() = instance.groupDao()
         val proxyDao get() = instance.proxyDao()
         val rulesDao get() = instance.rulesDao()
+        val routerGroupDao get() = instance.routerGroupDao()
+        val routerMemberDao get() = instance.routerMemberDao()
+        val routerGroupSourceDao get() = instance.routerGroupSourceDao()
 
     }
 
     abstract fun groupDao(): ProxyGroup.Dao
     abstract fun proxyDao(): ProxyEntity.Dao
     abstract fun rulesDao(): RuleEntity.Dao
+    abstract fun routerGroupDao(): RouterGroup.Dao
+    abstract fun routerMemberDao(): RouterMember.Dao
+    abstract fun routerGroupSourceDao(): RouterGroupSource.Dao
 
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/database/preference/KeyValuePair.kt b/app/src/main/java/io/nekohasekai/sagernet/database/preference/KeyValuePair.kt
index 0d13ee9d62..62000e7eba 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/database/preference/KeyValuePair.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/database/preference/KeyValuePair.kt
@@ -58,34 +58,62 @@ class KeyValuePair() : Parcelable {
     var valueType: Int = TYPE_UNINITIALIZED
     var value: ByteArray = ByteArray(0)
 
+    fun validate(): KeyValuePair {
+        require(key.isNotBlank()) { "Setting key cannot be blank" }
+        when (valueType) {
+            TYPE_BOOLEAN -> require(value.isNotEmpty()) { "Setting $key (boolean) payload is empty" }
+            TYPE_FLOAT -> require(value.size >= 4) { "Setting $key (float) payload truncated: ${value.size} bytes" }
+            @Suppress("DEPRECATION") TYPE_INT -> require(value.size >= 4) { "Setting $key (int) payload truncated: ${value.size} bytes" }
+            TYPE_LONG -> require(value.size >= 8) { "Setting $key (long) payload truncated: ${value.size} bytes" }
+            TYPE_STRING -> Unit
+            TYPE_STRING_SET -> {
+                val buffer = ByteBuffer.wrap(value)
+                while (buffer.hasRemaining()) {
+                    require(buffer.remaining() >= 4) { "Setting $key (stringSet) entry length header truncated" }
+                    val len = buffer.int
+                    require(len >= 0 && buffer.remaining() >= len) {
+                        "Setting $key (stringSet) entry truncated or invalid length: $len, remaining: ${buffer.remaining()}"
+                    }
+                    buffer.position(buffer.position() + len)
+                }
+            }
+            else -> throw IllegalArgumentException("Setting $key has invalid valueType: $valueType")
+        }
+        return this
+    }
+
     val boolean: Boolean?
-        get() = if (valueType == TYPE_BOOLEAN) ByteBuffer.wrap(value).get() != 0.toByte() else null
+        get() = if (valueType == TYPE_BOOLEAN && value.isNotEmpty()) ByteBuffer.wrap(value).get() != 0.toByte() else null
     val float: Float?
-        get() = if (valueType == TYPE_FLOAT) ByteBuffer.wrap(value).float else null
+        get() = if (valueType == TYPE_FLOAT && value.size >= 4) ByteBuffer.wrap(value).float else null
 
     @Suppress("DEPRECATION")
     @Deprecated("Use long.", ReplaceWith("long"))
     val int: Int?
-        get() = if (valueType == TYPE_INT) ByteBuffer.wrap(value).int else null
+        get() = if (valueType == TYPE_INT && value.size >= 4) ByteBuffer.wrap(value).int else null
     val long: Long?
         get() = when (valueType) {
-            @Suppress("DEPRECATION") TYPE_INT,
-            -> ByteBuffer.wrap(value).int.toLong()
-            TYPE_LONG -> ByteBuffer.wrap(value).long
+            @Suppress("DEPRECATION") TYPE_INT -> if (value.size >= 4) ByteBuffer.wrap(value).int.toLong() else null
+            TYPE_LONG -> if (value.size >= 8) ByteBuffer.wrap(value).long else null
             else -> null
         }
     val string: String?
         get() = if (valueType == TYPE_STRING) String(value) else null
     val stringSet: Set<String>?
         get() = if (valueType == TYPE_STRING_SET) {
-            val buffer = ByteBuffer.wrap(value)
-            val result = HashSet<String>()
-            while (buffer.hasRemaining()) {
-                val chArr = ByteArray(buffer.int)
-                buffer.get(chArr)
-                result.add(String(chArr))
-            }
-            result
+            runCatching {
+                val buffer = ByteBuffer.wrap(value)
+                val result = HashSet<String>()
+                while (buffer.hasRemaining()) {
+                    if (buffer.remaining() < 4) return null
+                    val len = buffer.int
+                    if (len < 0 || buffer.remaining() < len) return null
+                    val chArr = ByteArray(len)
+                    buffer.get(chArr)
+                    result.add(String(chArr))
+                }
+                result
+            }.getOrNull()
         } else null
 
     @Ignore
@@ -131,9 +159,10 @@ class KeyValuePair() : Parcelable {
         val stream = ByteArrayOutputStream()
         val intBuffer = ByteBuffer.allocate(4)
         for (v in value) {
+            val bytes = v.toByteArray()       // compute UTF-8 bytes once
             intBuffer.rewind()
-            stream.write(intBuffer.putInt(v.length).array())
-            stream.write(v.toByteArray())
+            stream.write(intBuffer.putInt(bytes.size).array())  // write byte count (not char count)
+            stream.write(bytes)
         }
         this.value = stream.toByteArray()
         return this
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/BackupSerializer.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/BackupSerializer.kt
new file mode 100644
index 0000000000..a5e4bc7dd7
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/BackupSerializer.kt
@@ -0,0 +1,230 @@
+package io.nekohasekai.sagernet.fmt
+
+import android.os.Parcel
+import android.os.Parcelable
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RuleEntity
+import io.nekohasekai.sagernet.database.SagerDatabase
+import io.nekohasekai.sagernet.database.routerStableId
+import moe.matsuri.nb4a.utils.Util
+import org.json.JSONArray
+import org.json.JSONObject
+
+/** The Parcelable-backed JSON array format used by NekoBox backups. */
+object BackupSerializer {
+
+    const val BACKUP_VERSION = 3
+
+    data class RouterRuleReference(
+        val ruleId: Long,
+        val routerGroupId: Long,
+        val routerStableTag: String? = null,
+    )
+
+    /** Capture related rows together; exporting must never repair or delete user data. */
+    fun exportDatabase(database: SagerDatabase, profiles: Boolean, rules: Boolean): JSONObject {
+        val json = JSONObject().put("version", BACKUP_VERSION)
+        database.runInTransaction {
+            if (profiles) {
+                val allProfiles = database.proxyDao().getAll()
+                allProfiles.forEach { it.requireBean() }
+                putParcelableArray(json, "profiles", allProfiles)
+                putParcelableArray(json, "groups", database.groupDao().allGroups())
+                putParcelableArray(json, "routerGroups", database.routerGroupDao().all())
+                putParcelableArray(json, "routerMembers", database.routerMemberDao().all())
+                putParcelableArray(json, "routerSources", database.routerGroupSourceDao().all())
+            }
+            if (rules) {
+                val allRules = database.rulesDao().allRules()
+                val allRouters = database.routerGroupDao().all()
+                putParcelableArray(json, "rules", allRules)
+                putRouterRuleReferences(json, allRules, allRouters)
+                if (!profiles) {
+                    // When exporting rules without profiles, the import side cannot reconstruct
+                    // backupProxies from the backup. Attach a stable-identity index so the importer
+                    // can verify that each rule's outbound proxy still refers to the same node.
+                    putRuleOutboundRefs(json, allRules, database)
+                }
+            }
+        }
+        return json
+    }
+
+    fun putRouterRuleReferences(
+        json: JSONObject,
+        rules: Iterable<RuleEntity>,
+        routers: Iterable<RouterGroup> = emptyList(),
+    ) {
+        val routerTagMap = routers.associate { it.id to it.stableTag }
+        json.put("routerRuleRefs", JSONArray().apply {
+            rules.filter { it.routerGroupId > 0L }.forEach { rule ->
+                put(JSONObject().apply {
+                    put("ruleId", rule.id)
+                    put("routerGroupId", rule.routerGroupId)
+                    routerTagMap[rule.routerGroupId]?.takeIf { it.isNotBlank() }?.let {
+                        put("routerStableTag", it)
+                    }
+                })
+            }
+        })
+    }
+
+    /**
+     * Emits a `ruleOutboundRefs` section mapping each rule's legacy outbound proxy ID to the
+     * node's stable identity string. Used when exporting rules without profiles so the import
+     * side can verify node identity without needing the full profiles section.
+     */
+    fun putRuleOutboundRefs(
+        json: JSONObject,
+        rules: Iterable<RuleEntity>,
+        database: SagerDatabase,
+    ) {
+        val outboundIds = rules.mapNotNull { r -> r.outbound.takeIf { it > 0L } }.toSet()
+        if (outboundIds.isEmpty()) return
+        val stableIdMap = outboundIds.associateWith { proxyId ->
+            database.proxyDao().getById(proxyId)?.let { proxy ->
+                runCatching { proxy.requireBean() }.getOrNull()
+                    ?.let { proxy.routerStableId() }
+            }
+        }
+        json.put("ruleOutboundRefs", JSONArray().apply {
+            rules.filter { it.outbound > 0L }.forEach { rule ->
+                val stableId = stableIdMap[rule.outbound] ?: return@forEach
+                put(JSONObject().apply {
+                    put("ruleId", rule.id)
+                    put("outbound", rule.outbound)
+                    put("stableId", stableId)
+                })
+            }
+        })
+    }
+
+    /** Returns a map from rule ID to outbound stable ID, read from `ruleOutboundRefs`. */
+    fun getRuleOutboundStableIds(json: JSONObject): Map<Long, String> {
+        if (!json.has("ruleOutboundRefs")) return emptyMap()
+        require(!json.isNull("ruleOutboundRefs")) { "Section 'ruleOutboundRefs' in backup cannot be null" }
+        val values = json.optJSONArray("ruleOutboundRefs")
+            ?: throw IllegalArgumentException("Section 'ruleOutboundRefs' in backup must be a JSON array")
+        val result = HashMap<Long, String>()
+        for (i in 0 until values.length()) {
+            val obj = values.getJSONObject(i)
+            val ruleId = obj.getLong("ruleId")
+            val stableId = obj.optString("stableId").takeIf { it.isNotBlank() } ?: continue
+            result[ruleId] = stableId
+        }
+        return result
+    }
+
+    fun validateRuleReferences(
+        rules: Collection<RuleEntity>,
+        routerIds: Set<Long>,
+        proxyIds: Set<Long>
+    ) {
+        for (rule in rules) {
+            if (rule.routerGroupId > 0L) {
+                require(rule.routerGroupId in routerIds) {
+                    "Rule ${rule.id} references missing router group ${rule.routerGroupId}"
+                }
+            } else if (rule.outbound > 0L) {
+                require(rule.outbound in proxyIds) {
+                    "Rule ${rule.id} references missing profile ${rule.outbound}"
+                }
+            }
+        }
+    }
+
+    fun getRouterRuleReferenceList(json: JSONObject): List<RouterRuleReference> {
+        if (!json.has("routerRuleRefs")) {
+            return emptyList()
+        }
+        require(!json.isNull("routerRuleRefs")) { "Section 'routerRuleRefs' in backup cannot be null" }
+        val values = json.optJSONArray("routerRuleRefs")
+            ?: throw IllegalArgumentException("Section 'routerRuleRefs' in backup must be a JSON array")
+        val list = ArrayList<RouterRuleReference>(values.length())
+        for (index in 0 until values.length()) {
+            val value = values.getJSONObject(index)
+            val ruleId = value.getLong("ruleId")
+            val routerGroupId = value.getLong("routerGroupId")
+            val routerStableTag = value.optString("routerStableTag").takeIf { it.isNotBlank() }
+            if (ruleId > 0L && routerGroupId > 0L) {
+                list.add(RouterRuleReference(ruleId, routerGroupId, routerStableTag))
+            }
+        }
+        return list
+    }
+
+    fun getRouterRuleReferences(json: JSONObject): Map<Long, Long> {
+        return getRouterRuleReferenceList(json).associate { it.ruleId to it.routerGroupId }
+    }
+
+    fun putParcelableArray(
+        json: JSONObject,
+        key: String,
+        values: Iterable<out Parcelable>
+    ) {
+        json.put(key, JSONArray().apply {
+            values.forEach { put(encode(it)) }
+        })
+    }
+
+    fun <T : Parcelable> getParcelableArray(
+        json: JSONObject,
+        key: String,
+        creator: Parcelable.Creator<T>
+    ): List<T> {
+        if (!json.has(key)) return emptyList()
+        require(!json.isNull(key)) { "Section '$key' in backup cannot be null" }
+        val values = json.optJSONArray(key)
+            ?: throw IllegalArgumentException("Section '$key' in backup must be a JSON array")
+        return (0 until values.length()).map { index ->
+            decode(values.getString(index), creator)
+        }
+    }
+
+    fun <T> getParcelableArray(
+        json: JSONObject,
+        key: String,
+        decoder: (Parcel) -> T
+    ): List<T> {
+        if (!json.has(key)) return emptyList()
+        require(!json.isNull(key)) { "Section '$key' in backup cannot be null" }
+        val values = json.optJSONArray(key)
+            ?: throw IllegalArgumentException("Section '$key' in backup must be a JSON array")
+        return (0 until values.length()).map { index ->
+            val data = Util.b64Decode(values.getString(index))
+            val parcel = Parcel.obtain()
+            try {
+                parcel.unmarshall(data, 0, data.size)
+                parcel.setDataPosition(0)
+                decoder(parcel)
+            } finally {
+                parcel.recycle()
+            }
+        }
+    }
+
+    private fun encode(value: Parcelable): String {
+        val parcel = Parcel.obtain()
+        return try {
+            value.writeToParcel(parcel, 0)
+            Util.b64EncodeUrlSafe(parcel.marshall())
+        } finally {
+            parcel.recycle()
+        }
+    }
+
+    private fun <T : Parcelable> decode(
+        encoded: String,
+        creator: Parcelable.Creator<T>
+    ): T {
+        val data = Util.b64Decode(encoded)
+        val parcel = Parcel.obtain()
+        return try {
+            parcel.unmarshall(data, 0, data.size)
+            parcel.setDataPosition(0)
+            creator.createFromParcel(parcel)
+        } finally {
+            parcel.recycle()
+        }
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
index ebe2ae752e..2b0a62ad55 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt
@@ -7,6 +7,8 @@ import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.database.ProxyEntity
 import io.nekohasekai.sagernet.database.ProxyEntity.Companion.TYPE_CONFIG
 import io.nekohasekai.sagernet.database.ProxyGroup
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RuleEntity
 import io.nekohasekai.sagernet.database.SagerDatabase
 import io.nekohasekai.sagernet.fmt.ConfigBuildResult.IndexEntity
 import io.nekohasekai.sagernet.fmt.hysteria.HysteriaBean
@@ -29,9 +31,15 @@ import io.nekohasekai.sagernet.fmt.shadowsocksr.buildSingBoxOutboundShadowsocksR
 import io.nekohasekai.sagernet.fmt.snell.SnellBean
 import io.nekohasekai.sagernet.fmt.snell.buildSingBoxOutboundSnellBean
 import io.nekohasekai.sagernet.fmt.wireguard.WireGuardBean
-import io.nekohasekai.sagernet.fmt.wireguard.buildSingBoxOutboundWireguardBean
+import io.nekohasekai.sagernet.fmt.wireguard.buildSingBoxWireGuardEndpointBean
+import io.nekohasekai.sagernet.ktx.Logs
 import io.nekohasekai.sagernet.ktx.isIpAddress
 import io.nekohasekai.sagernet.ktx.mkPort
+import io.nekohasekai.sagernet.route.RouterRuntime
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+import io.nekohasekai.sagernet.route.RouterRuntimeGroup
+import io.nekohasekai.sagernet.route.RouterRuntimeException
+import io.nekohasekai.sagernet.route.RouterRuntimeMode
 import io.nekohasekai.sagernet.utils.PackageCache
 import moe.matsuri.nb4a.*
 import moe.matsuri.nb4a.SingBoxOptions.*
@@ -57,6 +65,98 @@ const val TAG_DNS_HOSTS = "dns-hosts"
 
 const val LOCALHOST = "127.0.0.1"
 
+private val routerSystemReservedTags = setOf(
+    TAG_DIRECT,
+    TAG_BYPASS,
+    TAG_BLOCK,
+    TAG_PROXY,
+    TAG_FRAGMENT,
+    TAG_MIXED,
+    TAG_DNS_HOSTS
+)
+
+internal fun resolveRouteOutbound(
+    rule: RuleEntity,
+    mainProxyTag: String,
+    proxyTags: Map<Long, String>,
+    routerTagsById: Map<Long, String>,
+    primaryProxyId: Long = Long.MIN_VALUE
+): String {
+    if (rule.routerGroupId > 0L) {
+        return routerTagsById[rule.routerGroupId]
+            ?: throw RouterRuntimeException(
+                rule.routerGroupId,
+                "",
+                RouterRuntimeException.Reason.MISSING,
+            )
+    }
+    return when (val outId = rule.outbound) {
+        0L -> mainProxyTag
+        -1L -> TAG_BYPASS
+        -2L -> TAG_BLOCK
+        else -> if (outId == primaryProxyId) mainProxyTag else proxyTags[outId] ?: ""
+    }
+}
+
+internal fun validateRouterReferences(
+    rules: Iterable<RuleEntity>,
+    groups: Iterable<RouterGroup>,
+    builtRouterIds: Set<Long>,
+) {
+    val groupsById = groups.associateBy { it.id }
+    rules.asSequence().map { it.routerGroupId }.filter { it > 0 }.distinct().forEach { id ->
+        val group = groupsById[id]
+            ?: throw RouterRuntimeException(id, "", RouterRuntimeException.Reason.MISSING)
+        if (!group.enabled) {
+            throw RouterRuntimeException(id, group.name, RouterRuntimeException.Reason.DISABLED)
+        }
+        if (id !in builtRouterIds) {
+            throw RouterRuntimeException(id, group.name, RouterRuntimeException.Reason.EMPTY)
+        }
+    }
+}
+
+internal fun routerReservedTags(outbounds: Iterable<SingBoxOption>): Set<String> =
+    outbounds.flatMap { outbound ->
+        listOfNotNull(outbound.asMap()["tag"] as? String, (outbound as? Outbound)?.tag)
+    }.toSet() + routerSystemReservedTags
+
+internal fun buildRouterOutbounds(
+    groups: Iterable<RouterRuntimeGroup>,
+    proxyTags: Map<Long, String>,
+    reservedTags: Set<String> = emptySet(),
+    includeRouterGroups: Boolean = true
+): List<Outbound> {
+    if (!includeRouterGroups) return emptyList()
+
+    return RouterRuntime.build(groups, proxyTags, reservedTags).map { router ->
+        when (router.mode) {
+            RouterRuntimeMode.SELECTOR -> Outbound_SelectorOptions().apply {
+                type = "selector"
+                tag = router.tag
+                outbounds = router.outbounds
+                default_ = router.defaultTag
+            }
+
+            RouterRuntimeMode.URL_TEST -> Outbound_URLTestOptions().apply {
+                type = "urltest"
+                tag = router.tag
+                outbounds = router.outbounds
+                url = router.filter.testUrl
+                interval = "${router.filter.intervalSeconds}s"
+                tolerance = router.filter.toleranceMs
+                // sing-box enforces interval <= idle_timeout. The core's default idle_timeout is
+                // 1800s (30 min). When the user sets a longer interval for battery savings, we
+                // must emit a matching idle_timeout so the config can start. We use 2× the
+                // interval to give the group enough time to go idle between test rounds.
+                if (router.filter.intervalSeconds > 1800) {
+                    idle_timeout = "${router.filter.intervalSeconds * 2}s"
+                }
+            }
+        }
+    }
+}
+
 class ConfigBuildResult(
     var config: String,
     var externalIndex: List<IndexEntity>,
@@ -64,6 +164,13 @@ class ConfigBuildResult(
     var trafficMap: Map<String, List<ProxyEntity>>,
     var profileTagMap: Map<Long, String>,
     val selectorGroupId: Long,
+    val routerSelectorTags: Map<String, String> = emptyMap(),
+    val routerMemberIds: Map<String, Set<Long>> = emptyMap(),
+    val routerUrlTestTags: Map<Long, String> = emptyMap(),
+    val mainUrlTestTag: String? = null,
+    /** Union of all proxy IDs belonging to any Router group (selector or urltest). Used by
+     *  TrafficLooper to avoid suppressing independent Router node traffic statistics. */
+    val routerAllMemberIds: Set<Long> = emptySet(),
 ) {
     data class IndexEntity(var chain: LinkedHashMap<Int, ProxyEntity>)
 }
@@ -125,7 +232,11 @@ fun buildConfig(
     val readableNames = mutableSetOf(TAG_DIRECT, TAG_BYPASS, TAG_BLOCK, TAG_FRAGMENT, TAG_MIXED, TAG_PROXY)
     val group = SagerDatabase.groupDao.getById(proxy.groupId)
 
-    fun ProxyEntity.resolveChainInternal(): MutableList<ProxyEntity> {
+    fun ProxyEntity.resolveChainInternal(visited: MutableSet<Long> = HashSet()): MutableList<ProxyEntity> {
+        if (!visited.add(id)) {
+            Logs.w("Detected cyclic proxy chain involving proxy $id")
+            return mutableListOf()
+        }
         val bean = requireBean()
         if (bean is ChainBean) {
             val beans = SagerDatabase.proxyDao.getEntities(bean.proxies)
@@ -133,7 +244,7 @@ fun buildConfig(
             val beanList = ArrayList<ProxyEntity>()
             for (proxyId in bean.proxies) {
                 val item = beansMap[proxyId] ?: continue
-                beanList.addAll(item.resolveChainInternal())
+                beanList.addAll(item.resolveChainInternal(visited))
             }
             return beanList.asReversed()
         }
@@ -165,10 +276,28 @@ fun buildConfig(
     }
 
     val extraRules = if (forTest) listOf() else SagerDatabase.rulesDao.enabledRules()
+    val includeRouterGroups = !forTest && !forExport
+    val allRouterGroups = if (!includeRouterGroups) {
+        listOf()
+    } else {
+        SagerDatabase.routerGroupDao.all()
+    }
+    val routerGroups = allRouterGroups.filter { it.enabled && it.stableTag.isNotBlank() }
+    val routerMembers = if (!includeRouterGroups) {
+        mapOf()
+    } else {
+        routerGroups.associate { router ->
+            router.id to SagerDatabase.routerMemberDao.getByRouter(router.id)
+        }
+    }
+    val extraProxyIds = extraRules.mapNotNull { rule ->
+        rule.outbound.takeIf { it > 0 && it != proxy.id }
+    }.toMutableSet().apply {
+        addAll(routerMembers.values.flatten().map { it.proxyId }.filter { it != proxy.id })
+    }
     val extraProxies =
-        if (forTest) mapOf() else SagerDatabase.proxyDao.getEntities(extraRules.mapNotNull { rule ->
-            rule.outbound.takeIf { it > 0 && it != proxy.id }
-        }.toHashSet().toList()).associateBy { it.id }
+        if (forTest) mapOf() else SagerDatabase.proxyDao.getEntities(extraProxyIds.toList())
+            .associateBy { it.id }
     val buildSelector = !forTest && group?.isSelector == true && !forExport
     val userDNSRuleList = mutableListOf<DNSRule_DefaultOptions>()
     val domainListDNSDirectForce = mutableListOf<String>()
@@ -179,7 +308,7 @@ fun buildConfig(
     val nonCustomFinalHosts = hashSetOf<String>()
     val groupCache = HashMap<Long, ProxyGroup?>()
     val isVPN = DataStore.serviceMode == Key.MODE_VPN
-    val deviceInboundTag = if (isVPN && DataStore.enableHevTun) TAG_MIXED else "tun-in"
+    val deviceInboundTag = if (isVPN) "tun-in" else TAG_MIXED
     val bind = if (!forTest && DataStore.allowAccess) "0.0.0.0" else LOCALHOST
     val remoteDns = DataStore.remoteDns.split("\n")
         .mapNotNull { dns -> dns.trim().takeIf { it.isNotBlank() && !it.startsWith("#") } }
@@ -203,6 +332,10 @@ fun buildConfig(
         }
     }
 
+    var routerSelectorTags: Map<String, String> = emptyMap()
+    var routerMemberIds: Map<String, Set<Long>> = emptyMap()
+    var routerUrlTestTags: Map<Long, String> = emptyMap()
+
     return MyOptions().apply {
 	if (!forTest) {
             experimental = ExperimentalOptions().apply {
@@ -256,35 +389,29 @@ fun buildConfig(
         inbounds = mutableListOf()
 
         if (!forTest) {
-            if (isVPN && !DataStore.enableHevTun) inbounds.add(Inbound_TunOptions().apply {
+            if (isVPN) inbounds.add(Inbound_TunOptions().apply {
                 type = "tun"
                 tag = "tun-in"
                 interface_name = "tun0"
                 stack = when (DataStore.tunImplementation) {
                     TunImplementation.GVISOR -> "gvisor"
                     TunImplementation.SYSTEM -> "system"
-                    else -> "mixed"
+                    TunImplementation.MIXED -> "mixed"
+                    else -> "go"
                 }
-                endpoint_independent_nat = true
                 mtu = DataStore.mtu
                 domain_strategy = genDomainStrategy(DataStore.resolveDestination)
                 auto_route = true
                 strict_route = DataStore.strictRoute
                 sniff = needSniff
                 sniff_override_destination = needSniffOverride
-                when (ipv6Mode) {
-                    IPv6Mode.DISABLE -> {
-                        inet4_address = listOf(VpnService.PRIVATE_VLAN4_CLIENT + "/28")
-                    }
-
-                    IPv6Mode.ONLY -> {
-                        inet6_address = listOf(VpnService.PRIVATE_VLAN6_CLIENT + "/126")
-                    }
-
-                    else -> {
-                        inet4_address = listOf(VpnService.PRIVATE_VLAN4_CLIENT + "/28")
-                        inet6_address = listOf(VpnService.PRIVATE_VLAN6_CLIENT + "/126")
-                    }
+                address = when (ipv6Mode) {
+                    IPv6Mode.DISABLE -> listOf(VpnService.PRIVATE_VLAN4_CLIENT + "/28")
+                    IPv6Mode.ONLY -> listOf(VpnService.PRIVATE_VLAN6_CLIENT + "/126")
+                    else -> listOf(
+                        VpnService.PRIVATE_VLAN4_CLIENT + "/28",
+                        VpnService.PRIVATE_VLAN6_CLIENT + "/126"
+                    )
                 }
             })
             inbounds.add(Inbound_MixedOptions().apply {
@@ -305,6 +432,7 @@ fun buildConfig(
         }
 
         outbounds = mutableListOf()
+        endpoints = mutableListOf()
 
         // init routing object
         route = RouteOptions().apply {
@@ -466,7 +594,7 @@ fun buildConfig(
                             buildSingBoxOutboundShadowsocksRBean(bean)
 
                         is WireGuardBean ->
-                            buildSingBoxOutboundWireguardBean(bean)
+                            buildSingBoxWireGuardEndpointBean(bean)
 
                         is SSHBean ->
                             buildSingBoxOutboundSSHBean(bean)
@@ -577,7 +705,12 @@ fun buildConfig(
                     }
                 }
 
-                outbounds.add(currentOutbound)
+                if (currentOutbound is SingBoxOptions.Endpoint) {
+                    // WireGuard & friends live in `endpoints` since sing-box 1.15
+                    endpoints.add(currentOutbound)
+                } else {
+                    outbounds.add(currentOutbound)
+                }
                 chainOutbounds.add(currentOutbound)
                 pastOutbound = currentOutbound
                 pastEntity = proxyEntity
@@ -607,8 +740,51 @@ fun buildConfig(
         extraProxies.forEach { (key, p) ->
             tagMap[key] = buildChain(key, p)
         }
+        val runtimeRouterGroups = routerGroups.map { router ->
+            RouterRuntimeGroup(
+                stableTag = router.stableTag,
+                mode = if (router.mode == RouterGroup.MODE_URL_TEST) {
+                    RouterRuntimeMode.URL_TEST
+                } else {
+                    RouterRuntimeMode.SELECTOR
+                },
+                memberProxyIds = routerMembers[router.id].orEmpty().map { it.proxyId },
+                selectedProxyId = router.selectedProxyId,
+                id = router.id,
+                name = router.name,
+                filter = RouterFilterConfig.fromJson(router.matchConfig),
+            )
+        }
+        val routerOutbounds = buildRouterOutbounds(
+            runtimeRouterGroups,
+            tagMap,
+            reservedTags = routerReservedTags(outbounds),
+            includeRouterGroups = includeRouterGroups
+        )
+        outbounds.addAll(routerOutbounds)
+        val builtRouterTags = routerOutbounds.mapNotNull { outbound ->
+            (outbound.asMap()["tag"] as? String) ?: outbound.tag
+        }.toSet()
+        val routerTagsById = routerGroups.mapNotNull { router ->
+            router.stableTag.takeIf(builtRouterTags::contains)?.let { router.id to it }
+        }.toMap()
+        validateRouterReferences(extraRules, allRouterGroups, routerTagsById.keys)
+        routerSelectorTags = routerOutbounds
+            .filterIsInstance<Outbound_SelectorOptions>()
+            .mapNotNull { outbound ->
+                outbound.tag?.takeIf { it.isNotBlank() }?.let { it to it }
+            }
+            .toMap()
+        routerMemberIds = routerGroups.associate { router ->
+            router.stableTag to routerMembers[router.id].orEmpty().map { it.proxyId }.toSet()
+        }.filterKeys(routerSelectorTags::containsKey)
+
+        routerUrlTestTags = runtimeRouterGroups.filter {
+            it.mode == RouterRuntimeMode.URL_TEST && it.stableTag in builtRouterTags
+        }.associate { it.id to it.stableTag }
 
-        val mainProxyTag = (if (buildSelector) TAG_PROXY else tagMap[proxy.id]) ?: TAG_PROXY
+        // Router membership must not change the legacy main selection or outbound=0.
+        val mainProxyTag = if (buildSelector) TAG_PROXY else tagMap[proxy.id] ?: TAG_PROXY
 
         // 在应用用户规则之前检查全局模式
         if (!forTest && DataStore.globalMode) {
@@ -829,12 +1005,7 @@ fun buildConfig(
                         }
                     }
 
-                    outbound = when (val outId = rule.outbound) {
-                        0L -> mainProxyTag
-                        -1L -> TAG_BYPASS
-                        -2L -> TAG_BLOCK
-                        else -> if (outId == proxy.id) mainProxyTag else tagMap[outId] ?: ""
-                    }
+                    outbound = resolveRouteOutbound(rule, mainProxyTag, tagMap, routerTagsById, proxy.id)
 
                     _hack_custom_config = rule.config
                 }
@@ -916,35 +1087,27 @@ fun buildConfig(
             }
         }
 
-        dns.servers.add(DNSServerOptions().apply {
-            address = "rcode://success"
-            tag = "dns-block"
-        })
-
-        dns.servers.add(DNSServerOptions().apply {
-            address = "local"
-            tag = "dns-local"
-            detour = TAG_DIRECT
-        })
+        dns.servers.add(buildDnsServerOptions("dns-block", "rcode://success"))
+        dns.servers.add(buildDnsServerOptions("dns-local", "local", detour = TAG_DIRECT))
 
         directDNS.firstOrNull().let {
-            dns.servers.add(DNSServerOptions().apply {
-                address = it ?: throw Exception("No direct DNS, check your settings!")
-                tag = "dns-direct"
-                detour = TAG_DIRECT
-                address_resolver = "dns-local"
-                strategy = autoDnsDomainStrategy(SingBoxOptionsUtil.domainStrategy(tag))
-            })
+            dns.servers.add(buildDnsServerOptions(
+                tag = "dns-direct",
+                address = it ?: throw Exception("No direct DNS, check your settings!"),
+                detour = TAG_DIRECT,
+                addressResolver = "dns-local",
+                strategy = autoDnsDomainStrategy(SingBoxOptionsUtil.domainStrategy("dns-direct"))
+            ))
         }
 
         remoteDns.firstOrNull().let {
             // Always use direct DNS for urlTest
-            if (!forTest) dns.servers.add(DNSServerOptions().apply {
-                address = it ?: throw Exception("No remote DNS, check your settings!")
-                tag = "dns-remote"
-                address_resolver = "dns-direct"
-                strategy = autoDnsDomainStrategy(SingBoxOptionsUtil.domainStrategy(tag))
-            })
+            if (!forTest) dns.servers.add(buildDnsServerOptions(
+                tag = "dns-remote",
+                address = it ?: throw Exception("No remote DNS, check your settings!"),
+                addressResolver = "dns-direct",
+                strategy = autoDnsDomainStrategy(SingBoxOptionsUtil.domainStrategy("dns-remote"))
+            ))
         }
         if (dnsHosts.isNotEmpty()) {
             dns.servers.add(DNSServerOptions().apply {
@@ -989,15 +1152,12 @@ fun buildConfig(
             })
             // FakeDNS obj
             if (useFakeDns) {
-                dns.fakeip = DNSFakeIPOptions().apply {
-                    enabled = true
-                    inet4_range = "198.18.0.0/15"
-                    inet6_range = "fc00::/18"
-                }
                 dns.servers.add(DNSServerOptions().apply {
-                    address = "fakeip"
                     tag = "dns-fake"
                     strategy = "ipv4_only"
+                    _hack_config_map["type"] = "fakeip"
+                    _hack_config_map["inet4_range"] = "198.18.0.0/15"
+                    _hack_config_map["inet6_range"] = "fc00::/18"
                 })
                 dns.rules.add(DNSRule_DefaultOptions().apply {
                     inbound = listOf(deviceInboundTag)
@@ -1031,15 +1191,13 @@ fun buildConfig(
                 if (hosts.isNullOrEmpty()) return@forEach
 
                 val serverTag = "dns-sub-$gid"
-                dns.servers.add(DNSServerOptions().apply {
-                    address = resolver
-                    tag = serverTag
-                    detour = TAG_DIRECT
-                    if (!resolver.isIpAddress()) {
-                        address_resolver = "dns-direct"
-                    }
+                dns.servers.add(buildDnsServerOptions(
+                    tag = serverTag,
+                    address = resolver,
+                    detour = TAG_DIRECT,
+                    addressResolver = if (!resolver.isIpAddress()) "dns-direct" else null,
                     strategy = autoDnsDomainStrategy(SingBoxOptionsUtil.domainStrategy("server"))
-                })
+                ))
                 dns.rules.add(0, DNSRule_DefaultOptions().apply {
                     makeSingBoxRule(hosts)
                     server = serverTag
@@ -1051,14 +1209,125 @@ fun buildConfig(
     }.let {
         val configMap = it.asMap()
         Util.mergeJSON(configMap, proxy.requireBean().customConfigJson)
+        val allRouterMemberIds = routerGroups.flatMapTo(mutableSetOf<Long>()) { router ->
+            routerMembers[router.id].orEmpty().map { member -> member.proxyId }
+        }
         ConfigBuildResult(
             gson.toJson(configMap),
             externalIndexMap,
             proxy.id,
             trafficMap,
             tagMap,
-            if (buildSelector) group.id else -1L
+            if (buildSelector) group.id else -1L,
+            routerSelectorTags,
+            routerMemberIds,
+            routerUrlTestTags,
+            null,
+            allRouterMemberIds,
         )
     }
 
 }
+
+// buildDnsServerOptions converts the legacy sing-box DNS server address string
+// (used by NekoBox settings) into the sing-box 1.15+ typed DNS server format.
+// The legacy "address" field was removed in sing-box 1.14, so we must emit
+// "type" + type-specific fields instead.
+internal fun buildDnsServerOptions(
+    tag: String,
+    address: String,
+    detour: String? = null,
+    addressResolver: String? = null,
+    strategy: String? = null,
+): DNSServerOptions {
+    val options = DNSServerOptions().apply {
+        this.tag = tag
+        if (detour != null) this.detour = detour
+        if (addressResolver != null) this.address_resolver = addressResolver
+        if (strategy != null) this.strategy = strategy
+    }
+    when {
+        address == "local" -> {
+            options._hack_config_map["type"] = "local"
+        }
+        address == "fakeip" -> {
+            options._hack_config_map["type"] = "fakeip"
+        }
+        address.startsWith("rcode://") -> {
+            options._hack_config_map["type"] = "rcode"
+            options._hack_config_map["rcode"] = address.substringAfter("rcode://")
+        }
+        else -> {
+            val scheme = if (address.contains("://")) {
+                address.substringBefore("://").lowercase()
+            } else {
+                "udp"
+            }
+            val body = if (address.contains("://")) address.substringAfter("://") else address
+            when (scheme) {
+                "https", "h3" -> {
+                    val url = "https://$body".toHttpUrlOrNull()
+                        ?: error("invalid DNS HTTPS URL: $address")
+                    options._hack_config_map["type"] = if (scheme == "h3") "h3" else "https"
+                    options._hack_config_map["server"] = url.host
+                    options._hack_config_map["server_port"] =
+                        if (url.port != -1) url.port else 443
+                    if (url.encodedPath.isNotBlank() && url.encodedPath != "/") {
+                        options._hack_config_map["path"] = url.encodedPath
+                    }
+                    options._hack_config_map["tls"] = mapOf(
+                        "enabled" to true,
+                        "server_name" to if (url.host.isIpAddress()) "" else url.host
+                    )
+                }
+                "tls", "tcp", "udp", "quic" -> {
+                    val defaultPort = when (scheme) {
+                        "tls", "quic" -> 853
+                        else -> 53
+                    }
+                    val (host, port) = parseDnsHostPort(body, defaultPort)
+                    options._hack_config_map["type"] = scheme
+                    options._hack_config_map["server"] = host
+                    options._hack_config_map["server_port"] = port
+                    if (scheme == "tls" || scheme == "quic") {
+                        options._hack_config_map["tls"] = mapOf(
+                            "enabled" to true,
+                            "server_name" to if (host.isIpAddress()) "" else host
+                        )
+                    }
+                }
+                else -> {
+                    // Unknown scheme: treat as plain UDP to avoid silently
+                    // emitting an unsupported legacy address.
+                    val (host, port) = parseDnsHostPort(address, 53)
+                    options._hack_config_map["type"] = "udp"
+                    options._hack_config_map["server"] = host
+                    options._hack_config_map["server_port"] = port
+                }
+            }
+        }
+    }
+    return options
+}
+
+private fun parseDnsHostPort(input: String, defaultPort: Int): Pair<String, Int> {
+    val s = input.trim()
+    if (s.startsWith("[")) {
+        val close = s.indexOf("]")
+        if (close == -1) return s to defaultPort
+        val host = s.substring(1, close)
+        val port = if (s.length > close + 2 && s[close + 1] == ':') {
+            s.substring(close + 2).toIntOrNull() ?: defaultPort
+        } else {
+            defaultPort
+        }
+        return host to port
+    }
+    val lastColon = s.lastIndexOf(":")
+    val firstColon = s.indexOf(":")
+    if (lastColon != -1 && firstColon == lastColon) {
+        val port = s.substring(lastColon + 1).toIntOrNull()
+        if (port != null) return s.substring(0, lastColon) to port
+    }
+    return s to defaultPort
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/KryoConverters.java b/app/src/main/java/io/nekohasekai/sagernet/fmt/KryoConverters.java
index 624db7eddf..69e6a7c6f7 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/KryoConverters.java
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/KryoConverters.java
@@ -49,13 +49,46 @@ public static byte[] serialize(Serializable bean) {
         return out.toByteArray();
     }
 
+    @FunctionalInterface
+    public interface StrictAction<T> {
+        T run();
+    }
+
+    private static final ThreadLocal<Boolean> STRICT_DESERIALIZATION = ThreadLocal.withInitial(() -> Boolean.FALSE);
+
+    public static boolean isStrictDeserialization() {
+        return STRICT_DESERIALIZATION.get();
+    }
+
+    public static <T> T withStrictDeserialization(StrictAction<T> action) {
+        boolean prev = STRICT_DESERIALIZATION.get();
+        STRICT_DESERIALIZATION.set(true);
+        try {
+            return action.run();
+        } finally {
+            if (prev) {
+                STRICT_DESERIALIZATION.set(true);
+            } else {
+                STRICT_DESERIALIZATION.remove();
+            }
+        }
+    }
+
     public static <T extends Serializable> T deserialize(T bean, byte[] bytes) {
-        if (bytes == null) return bean;
+        if (bytes == null || bytes.length == 0) {
+            if (STRICT_DESERIALIZATION.get()) {
+                throw new KryoException("Cannot deserialize from null or empty byte array in strict mode");
+            }
+            return bean;
+        }
         ByteArrayInputStream input = new ByteArrayInputStream(bytes);
         ByteBufferInput buffer = KryosKt.byteBuffer(input);
         try {
             bean.deserializeFromBuffer(buffer);
         } catch (KryoException e) {
+            if (STRICT_DESERIALIZATION.get()) {
+                throw e;
+            }
             Logs.INSTANCE.w(e);
         }
         bean.initializeDefaultValues();
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/RouteOutboundChoice.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/RouteOutboundChoice.kt
new file mode 100644
index 0000000000..fc83902ccd
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/RouteOutboundChoice.kt
@@ -0,0 +1,19 @@
+package io.nekohasekai.sagernet.fmt
+
+data class RouteOutboundChoice(
+    val outbound: Long,
+    val routerGroupId: Long,
+)
+
+internal fun serializeRouteOutboundChoice(
+    value: Int,
+    legacyProfileId: Long,
+    routerGroupId: Long,
+    routerChoiceValue: Int,
+): RouteOutboundChoice = when (value) {
+    0 -> RouteOutboundChoice(0L, 0L)
+    1 -> RouteOutboundChoice(-1L, 0L)
+    2 -> RouteOutboundChoice(-2L, 0L)
+    routerChoiceValue -> RouteOutboundChoice(0L, routerGroupId)
+    else -> RouteOutboundChoice(legacyProfileId, 0L)
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/juicity/JuicityFmt.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/juicity/JuicityFmt.kt
index bebb6a43f7..d3fd3b0909 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/juicity/JuicityFmt.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/juicity/JuicityFmt.kt
@@ -1,5 +1,6 @@
 package io.nekohasekai.sagernet.fmt.juicity
 
+import android.util.Base64
 import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.ktx.linkBuilder
 import io.nekohasekai.sagernet.ktx.toLink
@@ -8,7 +9,6 @@ import moe.matsuri.nb4a.SingBoxOptions
 import moe.matsuri.nb4a.SingBoxOptions.Outbound_JuicityOptions
 import moe.matsuri.nb4a.utils.listByLineOrComma
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
-import java.util.Base64
 
 fun parseJuicity(url: String): JuicityBean {
     val link = url.replace("juicity://", "https://").toHttpUrlOrNull() ?: error(
@@ -84,8 +84,10 @@ fun buildSingBoxOutboundJuicityBean(bean: JuicityBean): Outbound_JuicityOptions
 private fun normalizePinnedCertChainHash(rawHash: String?): String? {
     val certChainHash = rawHash?.replace(":", "")?.takeIf { it.isNotEmpty() } ?: return null
     return when {
-        certChainHash.length == 64 -> Base64.getUrlEncoder()
-            .encodeToString(certChainHash.chunked(2).map { chunk -> chunk.toInt(16).toByte() }.toByteArray())
+        certChainHash.length == 64 -> Base64.encodeToString(
+            certChainHash.chunked(2).map { chunk -> chunk.toInt(16).toByte() }.toByteArray(),
+            Base64.URL_SAFE or Base64.NO_WRAP
+        )
         else -> certChainHash.replace('/', '_').replace('+', '-')
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/snell/SnellBuildConfig.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/snell/SnellBuildConfig.kt
index 91069e1aaa..8ac694917d 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/snell/SnellBuildConfig.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/snell/SnellBuildConfig.kt
@@ -21,9 +21,9 @@ fun buildSingBoxOutboundSnellBean(bean: SnellBean): SingBoxOptions.Outbound_Snel
             if (!bean.mode.isNullOrBlank() && bean.mode != "default") {
                 mode = bean.mode
             }
-            if (bean.quicProxyMode == true) {
-                quic_proxy_mode = true
-            }
+            // quic_proxy_mode was a reF1nd fork extension; sing-box 1.15's
+            // strict option parsing rejects the unknown field, so it must not
+            // be emitted anymore.
         } else if (bean.obfsMode != null && bean.obfsMode.isNotBlank()) {
             obfs_mode = if (bean.version != null && bean.version >= 4 && bean.obfsMode == "tls") "" else bean.obfsMode
             if (obfs_mode.isNotBlank() && bean.obfsHost != null && bean.obfsHost.isNotBlank()) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java b/app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java
index 875e163668..17a883782e 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/v2ray/StandardV2RayBean.java
@@ -2,6 +2,7 @@
 
 import com.esotericsoftware.kryo.io.ByteBufferInput;
 import com.esotericsoftware.kryo.io.ByteBufferOutput;
+import java.util.Locale;
 
 import io.nekohasekai.sagernet.fmt.AbstractBean;
 import io.nekohasekai.sagernet.fmt.trojan.TrojanBean;
@@ -98,7 +99,7 @@ public void initializeDefaultValues() {
         if (JavaUtil.isNullOrBlank(type)) type = "tcp";
         else if ("h2".equals(type)) type = "http";
 
-        type = type.toLowerCase();
+        type = type.toLowerCase(Locale.ROOT);
 
         if (JavaUtil.isNullOrBlank(host)) host = "";
         if (JavaUtil.isNullOrBlank(path)) path = "";
diff --git a/app/src/main/java/io/nekohasekai/sagernet/fmt/wireguard/WireGuardFmt.kt b/app/src/main/java/io/nekohasekai/sagernet/fmt/wireguard/WireGuardFmt.kt
index 5fa7397b05..607612e9e0 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/fmt/wireguard/WireGuardFmt.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/fmt/wireguard/WireGuardFmt.kt
@@ -26,16 +26,21 @@ fun genReserved(anyStr: String): String {
     }
 }
 
-fun buildSingBoxOutboundWireguardBean(bean: WireGuardBean): SingBoxOptions.Outbound_WireGuardOptions {
-    return SingBoxOptions.Outbound_WireGuardOptions().apply {
+// sing-box 1.15 only registers WireGuard as an endpoint, and dropped the
+// deprecated server / server_port / local_address / peer_public_key options.
+fun buildSingBoxWireGuardEndpointBean(bean: WireGuardBean): SingBoxOptions.Endpoint_WireGuardOptions {
+    return SingBoxOptions.Endpoint_WireGuardOptions().apply {
         type = "wireguard"
-        server = bean.serverAddress
-        server_port = bean.serverPort
-        local_address = bean.localAddress.listByLineOrComma()
+        address = bean.localAddress.listByLineOrComma()
         private_key = bean.privateKey
-        peer_public_key = bean.peerPublicKey
-        pre_shared_key = bean.peerPreSharedKey
         mtu = bean.mtu
-        if (bean.reserved.isNotBlank()) reserved = genReserved(bean.reserved)
+        peers = listOf(SingBoxOptions.Endpoint_WireGuardPeer().apply {
+            address = bean.serverAddress
+            port = bean.serverPort
+            public_key = bean.peerPublicKey
+            if (bean.peerPreSharedKey.isNotBlank()) pre_shared_key = bean.peerPreSharedKey
+            allowed_ips = listOf("0.0.0.0/0", "::/0")
+            if (bean.reserved.isNotBlank()) reserved = genReserved(bean.reserved)
+        })
     }
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/group/GroupUpdater.kt b/app/src/main/java/io/nekohasekai/sagernet/group/GroupUpdater.kt
index 426e3d74f1..af0b1906c6 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/group/GroupUpdater.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/group/GroupUpdater.kt
@@ -132,7 +132,7 @@ abstract class GroupUpdater {
 
         suspend fun executeUpdate(proxyGroup: ProxyGroup, byUser: Boolean): Boolean {
             return coroutineScope {
-                if (!updating.add(proxyGroup.id)) cancel()
+                if (!updating.add(proxyGroup.id)) return@coroutineScope false
                 GroupManager.postReload(proxyGroup.id)
 
                 val subscription = proxyGroup.subscription!!
@@ -142,19 +142,23 @@ abstract class GroupUpdater {
                 if (byUser && (subscription.link?.startsWith("http://") == true || subscription.updateWhenConnectedOnly) && !connected) {
                     if (userInterface == null || !userInterface.confirm(app.getString(R.string.update_subscription_warning))) {
                         finishUpdate(proxyGroup)
-                        cancel()
-                        return@coroutineScope true
+                        return@coroutineScope false
                     }
                 }
 
                 try {
+                    val routerSnapshot = GroupManager.snapshotRouterMembers()
                     RawUpdater.doUpdate(proxyGroup, subscription, userInterface, byUser)
+                    GroupManager.reconcileRouterMembers(routerSnapshot)
                     true
                 } catch (e: Throwable) {
                     Logs.w(e)
+                    GroupManager.markRouterRefreshFailed(proxyGroup.id, e.readableMessage)
                     userInterface?.onUpdateFailure(proxyGroup, e.readableMessage)
                     finishUpdate(proxyGroup)
                     false
+                } finally {
+                    GroupManager.cleanupDanglingRouterMembers()
                 }
             }
         }
@@ -168,4 +172,4 @@ abstract class GroupUpdater {
 
     }
 
-}
\ No newline at end of file
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt b/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt
index 1e1644f839..20e4a091bc 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt
@@ -26,6 +26,7 @@ import io.nekohasekai.sagernet.ktx.*
 import libcore.Libcore
 import moe.matsuri.nb4a.Protocols
 import moe.matsuri.nb4a.proxy.anytls.AnyTLSBean
+import moe.matsuri.nb4a.proxy.anytls.parseSingBoxAnyTLS
 import moe.matsuri.nb4a.proxy.config.ConfigBean
 import moe.matsuri.nb4a.utils.Util
 import org.ini4j.Ini
@@ -36,6 +37,7 @@ import org.yaml.snakeyaml.TypeDescription
 import org.yaml.snakeyaml.Yaml
 import org.yaml.snakeyaml.error.YAMLException
 import java.io.StringReader
+import java.util.IdentityHashMap
 import androidx.core.net.toUri
 
 @Suppress("EXPERIMENTAL_API_USAGE")
@@ -158,6 +160,9 @@ object RawUpdater : GroupUpdater() {
             error(app.getString(R.string.no_proxies_found))
         }
 
+        val stableIds = IdentityHashMap<AbstractBean, String>()
+        proxies.forEach { stableIds[it] = it.routerStableIdentity() }
+
         Logs.d("New profiles: ${proxies.size}")
 
         val nameMap = proxies.associateBy { bean ->
@@ -189,9 +194,11 @@ object RawUpdater : GroupUpdater() {
             if (toReplace.contains(name)) {
                 val entity = toReplace[name]!!
                 val existsBean = entity.requireBean()
+                val existingStableId = entity.uuid
                 // 更新订阅，保留自定义覆写设置
                 bean.customOutboundJson = existsBean.customOutboundJson
                 bean.customConfigJson = existsBean.customConfigJson
+                entity.uuid = stableIds[bean] ?: bean.routerStableIdentity()
                 when {
                     existsBean != bean -> {
                         changed++
@@ -202,7 +209,7 @@ object RawUpdater : GroupUpdater() {
                         Logs.d("Updated profile: $name")
                     }
 
-                    entity.userOrder != userOrder -> {
+                    entity.userOrder != userOrder || existingStableId != entity.uuid -> {
                         entity.putBean(bean)
                         toUpdate.add(entity)
                         entity.userOrder = userOrder
@@ -221,6 +228,7 @@ object RawUpdater : GroupUpdater() {
                         groupId = proxyGroup.id, userOrder = userOrder
                     ).apply {
                         putBean(bean)
+                        uuid = stableIds[bean] ?: bean.routerStableIdentity()
                     })
                 added.add(name)
                 Logs.d("Inserted profile: $name")
@@ -232,6 +240,9 @@ object RawUpdater : GroupUpdater() {
             Logs.d("Updated profiles: $it")
         }
 
+        toDelete.forEach { proxy ->
+            SagerDatabase.routerMemberDao.deleteByProxy(proxy.id)
+        }
         SagerDatabase.proxyDao.deleteProxy(toDelete).also {
             Logs.d("Deleted profiles: $it")
         }
@@ -1016,7 +1027,7 @@ object RawUpdater : GroupUpdater() {
                                 it
                             }
                         }.map {
-                            ConfigBean().apply {
+                            parseSingBoxAnyTLS(it) ?: ConfigBean().apply {
                                 applyDefaultValues()
                                 type = 1
                                 config = it.toStringPretty()
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ktx/Utils.kt b/app/src/main/java/io/nekohasekai/sagernet/ktx/Utils.kt
index 3e176c8ed6..773a05a65b 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ktx/Utils.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ktx/Utils.kt
@@ -11,7 +11,6 @@ import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
 import android.content.res.Resources
-import android.os.Build
 import android.system.Os
 import android.system.OsConstants
 import android.util.TypedValue
@@ -90,7 +89,7 @@ val FileDescriptor.int get() = getInt.invoke(this) as Int
 suspend fun <T> HttpURLConnection.useCancellable(block: suspend HttpURLConnection.() -> T): T {
     return suspendCancellableCoroutine { cont ->
         cont.invokeOnCancellation {
-            if (Build.VERSION.SDK_INT >= 26) disconnect() else GlobalScope.launch(Dispatchers.IO) { disconnect() }
+            disconnect()
         }
         GlobalScope.launch(Dispatchers.IO) {
             try {
@@ -138,23 +137,11 @@ fun Resources.Theme.resolveResourceId(@AttrRes resId: Int): Int {
 fun Preference.remove() = parent!!.removePreference(this)
 
 /**
- * A slightly more performant variant of parseNumericAddress.
- *
- * Bug in Android 9.0 and lower: https://issuetracker.google.com/issues/123456213
+ * A slightly more performant variant of InetAddress.parseNumericAddress.
  */
 
-private val parseNumericAddress by lazy {
-    InetAddress::class.java.getDeclaredMethod("parseNumericAddress", String::class.java).apply {
-        isAccessible = true
-    }
-}
-
 fun String?.parseNumericAddress(): InetAddress? =
-    Os.inet_pton(OsConstants.AF_INET, this) ?: Os.inet_pton(OsConstants.AF_INET6, this)?.let {
-        if (Build.VERSION.SDK_INT >= 29) it else parseNumericAddress.invoke(
-            null, this
-        ) as InetAddress
-    }
+    Os.inet_pton(OsConstants.AF_INET, this) ?: Os.inet_pton(OsConstants.AF_INET6, this)
 
 @JvmOverloads
 fun DialogFragment.showAllowingStateLoss(fragmentManager: FragmentManager, tag: String? = null) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterFilter.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterFilter.kt
new file mode 100644
index 0000000000..9e8810e84a
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterFilter.kt
@@ -0,0 +1,59 @@
+package io.nekohasekai.sagernet.route
+
+import com.google.gson.Gson
+
+data class RouterFilterConfig(
+    val includeRegex: String = "",
+    val excludeRegex: String = "",
+    val testUrl: String = DEFAULT_TEST_URL,
+    val intervalSeconds: Long = DEFAULT_INTERVAL_SECONDS,
+    val toleranceMs: Int = DEFAULT_TOLERANCE_MS,
+) {
+    fun validate(): RouterFilterValidation = RouterFilterValidation(
+        include = includeRegex.compileIfPresent(RouterFilterException.Field.INCLUDE),
+        exclude = excludeRegex.compileIfPresent(RouterFilterException.Field.EXCLUDE),
+    )
+
+    fun toJson(): String = Gson().toJson(this)
+
+    companion object {
+        const val DEFAULT_TEST_URL = "https://www.gstatic.com/generate_204"
+        const val DEFAULT_INTERVAL_SECONDS = 300L
+        const val DEFAULT_TOLERANCE_MS = 50
+
+        fun fromJson(value: String): RouterFilterConfig {
+            if (value.isBlank()) return RouterFilterConfig()
+            return Gson().fromJson(value, RouterFilterConfig::class.java).let { parsed ->
+                parsed.copy(
+                    testUrl = parsed.testUrl.takeIf(String::isNotBlank) ?: DEFAULT_TEST_URL,
+                    intervalSeconds = parsed.intervalSeconds.takeIf { it > 0 } ?: DEFAULT_INTERVAL_SECONDS,
+                    toleranceMs = parsed.toleranceMs.takeIf { it >= 0 } ?: DEFAULT_TOLERANCE_MS,
+                )
+            }
+        }
+    }
+}
+
+data class RouterFilterValidation(
+    val include: Regex?,
+    val exclude: Regex?,
+)
+
+class RouterFilterException(
+    val field: Field,
+    cause: Throwable,
+) : IllegalArgumentException(cause.message, cause) {
+    enum class Field {
+        INCLUDE,
+        EXCLUDE,
+    }
+}
+
+private fun String.compileIfPresent(field: RouterFilterException.Field): Regex? {
+    if (isBlank()) return null
+    return try {
+        toRegex(RegexOption.IGNORE_CASE)
+    } catch (error: IllegalArgumentException) {
+        throw RouterFilterException(field, error)
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterMatcher.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterMatcher.kt
new file mode 100644
index 0000000000..e9707d5976
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterMatcher.kt
@@ -0,0 +1,32 @@
+package io.nekohasekai.sagernet.route
+
+data class RouterNodeSnapshot(
+    val id: Long,
+    val stableId: String? = null,
+    val name: String,
+    val subscriptionId: Long? = null,
+    val enabled: Boolean = true,
+    val available: Boolean = true,
+)
+
+data class RouterMatchRequest(
+    val routerId: Long,
+    val sourceGroupIds: List<Long>,
+    val filter: RouterFilterValidation,
+)
+
+object RouterMatcher {
+    fun match(
+        nodes: Iterable<RouterNodeSnapshot>,
+        requests: Iterable<RouterMatchRequest>,
+    ): Map<Long, List<Long>> = requests.associate { request ->
+        val nodesBySource = nodes.filter { it.enabled && it.available }.groupBy { it.subscriptionId }
+        request.routerId to request.sourceGroupIds.asSequence().distinct()
+            .flatMap { sourceId -> nodesBySource[sourceId].orEmpty().asSequence() }
+            .filter { node -> request.filter.include?.containsMatchIn(node.name) != false }
+            .filterNot { node -> request.filter.exclude?.containsMatchIn(node.name) == true }
+            .distinctBy { node -> node.id }
+            .map { node -> node.id }
+            .toList()
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterMembership.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterMembership.kt
new file mode 100644
index 0000000000..107d18db0e
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterMembership.kt
@@ -0,0 +1,22 @@
+package io.nekohasekai.sagernet.route
+
+data class RouterMembershipPlan(
+    val memberProxyIds: List<Long>,
+    val selectedProxyId: Long?,
+)
+
+object RouterMembership {
+
+    fun plan(
+        availableProxyIds: Iterable<Long>,
+        requestedProxyIds: Iterable<Long>,
+        currentSelectedProxyId: Long?,
+    ): RouterMembershipPlan {
+        val requested = requestedProxyIds.toSet()
+        val members = availableProxyIds.distinct()
+            .filter { it in requested }
+        val selected = currentSelectedProxyId?.takeIf(members::contains)
+            ?: members.firstOrNull()
+        return RouterMembershipPlan(members, selected)
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterReconciler.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterReconciler.kt
new file mode 100644
index 0000000000..0221b5ee23
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterReconciler.kt
@@ -0,0 +1,134 @@
+package io.nekohasekai.sagernet.route
+
+data class RouterMemberSnapshot(
+    val proxyId: Long,
+    val stableId: String,
+    val sourceGroupId: Long? = null,
+    val userOrder: Long = 0L,
+)
+
+data class RouterReconcileGroup(
+    val routerId: Long,
+    val stableTag: String,
+    val sourceGroupIds: List<Long>,
+    val filter: RouterFilterValidation,
+    val selectedProxyId: Long? = null,
+)
+
+data class RouterReconciliationResult(
+    val membersByRouterId: Map<Long, List<RouterMemberSnapshot>>,
+    val selectedProxyIdsByRouterId: Map<Long, Long?>,
+    val preservedPreviousMembers: Boolean,
+    val error: String? = null,
+)
+
+internal fun routerStableIdOrFallback(stableId: String?, proxyId: Long): String =
+    stableId?.takeIf(String::isNotBlank) ?: "proxy:$proxyId"
+
+internal fun routerNodeKey(sourceGroupId: Long?, stableId: String): String =
+    "${sourceGroupId ?: 0}:$stableId"
+
+internal fun danglingRouterMemberProxyIds(
+    members: Iterable<RouterMemberSnapshot>,
+    currentProxyIds: Set<Long>,
+): Set<Long> = members.map { it.proxyId }.filterNot(currentProxyIds::contains).toSet()
+
+private data class StableNodeKey(val sourceGroupId: Long?, val stableId: String)
+
+object RouterReconciler {
+    fun reconcile(
+        currentNodes: Iterable<RouterNodeSnapshot>,
+        groups: Iterable<RouterReconcileGroup>,
+        previousMembers: Map<Long, List<RouterMemberSnapshot>> = emptyMap(),
+    ): RouterReconciliationResult {
+        val nodes = currentNodes.toList()
+        val groupList = groups.toList()
+        if (nodes.isEmpty()) return preserved(groupList, previousMembers, "subscription refresh returned no nodes")
+
+        val validNodes = nodes.filter { it.enabled && it.available }
+        if (validNodes.isEmpty()) {
+            return preserved(groupList, previousMembers, "subscription refresh returned no valid nodes")
+        }
+
+        val currentById = validNodes.associateBy { it.id }
+        val currentByStableKey = validNodes.asSequence()
+            .filter { !it.stableId.isNullOrBlank() }
+            .distinctBy { StableNodeKey(it.subscriptionId, it.stableId!!) }
+            .associateBy { StableNodeKey(it.subscriptionId, it.stableId!!) }
+        val matchedByGroup = RouterMatcher.match(
+            validNodes,
+            groupList.map { RouterMatchRequest(it.routerId, it.sourceGroupIds, it.filter) },
+        )
+
+        val membersByRouterId = groupList.associate { group ->
+            val matchedIds = matchedByGroup[group.routerId].orEmpty()
+            val matchedIdSet = matchedIds.toSet()
+            val retained = previousMembers[group.routerId].orEmpty()
+                .withIndex()
+                .sortedWith(compareBy<IndexedValue<RouterMemberSnapshot>> { it.value.userOrder }.thenBy { it.index })
+                .mapNotNull { indexed ->
+                    val previous = indexed.value
+                    val current = currentById[previous.proxyId]
+                        ?.takeIf {
+                            it.subscriptionId == previous.sourceGroupId && it.id in matchedIdSet &&
+                                routerStableIdOrFallback(it.stableId, it.id) == previous.stableId
+                        }
+                        ?: currentByStableKey[StableNodeKey(previous.sourceGroupId, previous.stableId)]
+                            ?.takeIf { it.id in matchedIdSet }
+                    current?.let { node ->
+                        previous.copy(
+                            proxyId = node.id,
+                            stableId = routerStableIdOrFallback(node.stableId, node.id),
+                            sourceGroupId = node.subscriptionId,
+                        )
+                    }
+                }
+                .distinctBy { it.proxyId }
+
+            val retainedIds = retained.mapTo(mutableSetOf()) { it.proxyId }
+            val nextOrder = retained.maxOfOrNull { it.userOrder } ?: 0L
+            val added = matchedIds.asSequence()
+                .filterNot(retainedIds::contains)
+                .mapNotNull(currentById::get)
+                .map { node ->
+                    RouterMemberSnapshot(
+                        proxyId = node.id,
+                        stableId = routerStableIdOrFallback(node.stableId, node.id),
+                        sourceGroupId = node.subscriptionId,
+                    )
+                }
+                .mapIndexed { index, member -> member.copy(userOrder = nextOrder + index + 1) }
+                .toList()
+            group.routerId to retained + added
+        }
+
+        val selectedByRouterId = groupList.associate { group ->
+            val members = membersByRouterId[group.routerId].orEmpty()
+            val previousSelected = previousMembers[group.routerId].orEmpty()
+                .firstOrNull { it.proxyId == group.selectedProxyId }
+            val selected = previousSelected?.let { old ->
+                    members.firstOrNull {
+                        it.stableId == old.stableId && it.sourceGroupId == old.sourceGroupId
+                    }
+                }
+                ?: members.firstOrNull {
+                    previousSelected == null && it.proxyId == group.selectedProxyId
+                }
+                ?: members.firstOrNull()
+            group.routerId to selected?.proxyId
+        }
+
+        return RouterReconciliationResult(membersByRouterId, selectedByRouterId, false)
+    }
+
+    private fun preserved(
+        groups: List<RouterReconcileGroup>,
+        previous: Map<Long, List<RouterMemberSnapshot>>,
+        error: String,
+    ) = RouterReconciliationResult(
+        membersByRouterId = previous,
+        selectedProxyIdsByRouterId = groups.associate { it.routerId to it.selectedProxyId },
+        preservedPreviousMembers = true,
+        error = error,
+    )
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterRuntime.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterRuntime.kt
new file mode 100644
index 0000000000..d77b050cf2
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterRuntime.kt
@@ -0,0 +1,107 @@
+package io.nekohasekai.sagernet.route
+
+/** Runtime-only Router group data after ConfigBuilder has read the database. */
+data class RouterRuntimeGroup(
+    val stableTag: String,
+    val mode: RouterRuntimeMode,
+    val memberProxyIds: List<Long>,
+    val selectedProxyId: Long,
+    val id: Long = 0L,
+    val name: String = "",
+    val filter: RouterFilterConfig = RouterFilterConfig(),
+)
+
+enum class RouterRuntimeMode {
+    SELECTOR,
+    URL_TEST
+}
+
+/** A sing-box-independent Router outbound description. */
+data class RouterRuntimeOutbound(
+    val tag: String,
+    val mode: RouterRuntimeMode,
+    val outbounds: List<String>,
+    val defaultTag: String?,
+    val filter: RouterFilterConfig,
+)
+
+class RouterRuntimeException(
+    val groupId: Long,
+    val groupName: String,
+    val reason: Reason,
+) : IllegalStateException(
+    when (reason) {
+        Reason.MISSING -> "Proxy group ${groupName.ifBlank { groupId.toString() }} is missing"
+        Reason.DISABLED -> "Proxy group ${groupName.ifBlank { groupId.toString() }} is disabled"
+        Reason.EMPTY -> "Proxy group ${groupName.ifBlank { groupId.toString() }} has no available nodes"
+    }
+) {
+    enum class Reason { MISSING, DISABLED, EMPTY }
+}
+
+/**
+ * Resolves persisted Router member IDs against the outbound tags built for the current config.
+ * Router tags are persisted separately from ProxyEntity IDs, so subscription refreshes cannot
+ * invalidate references to a Router group.
+ */
+object RouterRuntime {
+    fun findUrlTestGroupForProxy(
+        groups: Iterable<RouterRuntimeGroup>,
+        selectedProxyId: Long,
+    ): String? = groups.firstOrNull {
+        it.mode == RouterRuntimeMode.URL_TEST &&
+            it.stableTag.isNotBlank() &&
+            selectedProxyId in it.memberProxyIds
+    }?.stableTag
+
+    fun build(
+        groups: Iterable<RouterRuntimeGroup>,
+        proxyTags: Map<Long, String>,
+        reservedTags: Set<String> = emptySet()
+    ): List<RouterRuntimeOutbound> {
+        val usedTags = reservedTags.toMutableSet()
+
+        return groups.mapNotNull { group ->
+            if (group.stableTag.isBlank() || !usedTags.add(group.stableTag)) return@mapNotNull null
+
+            val memberTags = group.memberProxyIds.mapNotNull(proxyTags::get).distinct()
+            if (memberTags.isEmpty()) return@mapNotNull null
+            val outbounds = memberTags
+            val defaultTag = if (group.mode == RouterRuntimeMode.SELECTOR) {
+                proxyTags[group.selectedProxyId]?.takeIf { it in memberTags } ?: outbounds.first()
+            } else {
+                null
+            }
+
+            RouterRuntimeOutbound(group.stableTag, group.mode, outbounds, defaultTag, group.filter)
+        }
+    }
+}
+
+object RouterRuntimeSelection {
+    fun resolve(
+        routerTags: Map<Long, String>,
+        profileTags: Map<Long, String>,
+        currentOutbound: (String) -> String,
+    ): LongArray {
+        if (routerTags.isEmpty() || profileTags.isEmpty()) return longArrayOf()
+        val profileIdsByTag = profileTags.entries.associate { (id, tag) -> tag to id }
+        val result = ArrayList<Long>(routerTags.size * 2)
+        routerTags.forEach { (routerId, routerTag) ->
+            val profileId = profileIdsByTag[currentOutbound(routerTag)] ?: return@forEach
+            result += routerId
+            result += profileId
+        }
+        return result.toLongArray()
+    }
+
+    fun toMap(pairs: LongArray): Map<Long, Long> {
+        val result = linkedMapOf<Long, Long>()
+        var index = 0
+        while (index + 1 < pairs.size) {
+            result[pairs[index]] = pairs[index + 1]
+            index += 2
+        }
+        return result
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/RouterSelection.kt b/app/src/main/java/io/nekohasekai/sagernet/route/RouterSelection.kt
new file mode 100644
index 0000000000..53c3148a2f
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/RouterSelection.kt
@@ -0,0 +1,57 @@
+package io.nekohasekai.sagernet.route
+
+/** A node selection request from the Router surface. Null routerTag means the legacy selector. */
+data class RouterSelectionRequest(
+    val routerTag: String?,
+    val proxyId: Long,
+    val mode: RouterRuntimeMode,
+    val routerEnabled: Boolean = true,
+)
+
+sealed interface RouterSelectionPlan {
+    data class HotSwitch(
+        val routerTag: String?,
+        val selectorTag: String,
+        val targetTag: String,
+    ) : RouterSelectionPlan
+
+    data object Reload : RouterSelectionPlan
+
+    data object IgnoreMissingRouter : RouterSelectionPlan
+}
+
+/** Decides whether a node click can use the running selector or needs a full reload. */
+object RouterSelection {
+
+    fun plan(
+        request: RouterSelectionRequest,
+        routerSelectorTags: Map<String, String>,
+        routerMemberIds: Map<String, Set<Long>>,
+        profileTags: Map<Long, String>,
+        selectorGroupId: Long,
+    ): RouterSelectionPlan {
+        val selectorTag = if (request.routerTag == null) {
+            if (selectorGroupId < 0L) return RouterSelectionPlan.Reload
+            "proxy"
+        } else {
+            if (!request.routerEnabled || request.routerTag.isBlank()) {
+                return RouterSelectionPlan.IgnoreMissingRouter
+            }
+            routerSelectorTags[request.routerTag]
+                ?: return RouterSelectionPlan.IgnoreMissingRouter
+        }
+
+        if (request.routerTag != null && request.mode != RouterRuntimeMode.SELECTOR) {
+            return RouterSelectionPlan.Reload
+        }
+
+        val targetTag = profileTags[request.proxyId]
+            ?.takeIf { it.isNotBlank() }
+            ?: return RouterSelectionPlan.Reload
+        if (request.routerTag != null && request.proxyId !in routerMemberIds[request.routerTag].orEmpty()) {
+            return RouterSelectionPlan.Reload
+        }
+
+        return RouterSelectionPlan.HotSwitch(request.routerTag, selectorTag, targetTag)
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/route/UrlTestTargetResolver.kt b/app/src/main/java/io/nekohasekai/sagernet/route/UrlTestTargetResolver.kt
new file mode 100644
index 0000000000..b0afc9660c
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/route/UrlTestTargetResolver.kt
@@ -0,0 +1,14 @@
+package io.nekohasekai.sagernet.route
+
+internal object UrlTestTargetResolver {
+
+    fun <T> resolve(
+        routerGroupId: Long?,
+        loadRouterTargets: (Long) -> List<T>,
+        loadNormalGroupTargets: () -> List<T>,
+    ): List<T> = if (routerGroupId != null) {
+        loadRouterTargets(routerGroupId)
+    } else {
+        loadNormalGroupTargets()
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/AboutFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/AboutFragment.kt
index 75a64a82ab..94a95296dd 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/AboutFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/AboutFragment.kt
@@ -4,24 +4,22 @@ import android.app.Activity
 import android.content.Context
 import android.content.Intent
 import android.net.Uri
-import android.os.Build
 import android.os.Bundle
 import android.os.PowerManager
 import android.provider.Settings
-import android.text.util.Linkify
 import android.view.View
-import android.widget.Toast
 import androidx.activity.result.component1
 import androidx.activity.result.component2
 import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.net.toUri
 import androidx.core.view.ViewCompat
 import androidx.recyclerview.widget.RecyclerView
 import com.danielstone.materialaboutlibrary.MaterialAboutFragment
 import com.danielstone.materialaboutlibrary.items.MaterialAboutActionItem
 import com.danielstone.materialaboutlibrary.model.MaterialAboutCard
 import com.danielstone.materialaboutlibrary.model.MaterialAboutList
-import io.nekohasekai.sagernet.BuildConfig
 import io.nekohasekai.sagernet.R
+import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.databinding.LayoutAboutBinding
 import io.nekohasekai.sagernet.ktx.*
 import io.nekohasekai.sagernet.plugin.PluginManager.loadString
@@ -29,12 +27,6 @@ import io.nekohasekai.sagernet.utils.PackageCache
 import io.nekohasekai.sagernet.widget.ListListener
 import libcore.Libcore
 import moe.matsuri.nb4a.plugin.Plugins
-import androidx.core.net.toUri
-import com.google.android.material.dialog.MaterialAlertDialogBuilder
-import io.nekohasekai.sagernet.SagerNet
-import io.nekohasekai.sagernet.database.DataStore
-import moe.matsuri.nb4a.utils.Util
-import org.json.JSONObject
 
 class AboutFragment : ToolbarFragment(R.layout.layout_about) {
 
@@ -50,13 +42,7 @@ class AboutFragment : ToolbarFragment(R.layout.layout_about) {
             .replace(R.id.about_fragment_holder, AboutContent())
             .commitAllowingStateLoss()
 
-        runOnDefaultDispatcher {
-            val license = view.context.assets.open("LICENSE").bufferedReader().readText()
-            onMainDispatcher {
-                binding.license.text = license
-                Linkify.addLinks(binding.license, Linkify.EMAIL_ADDRESSES or Linkify.WEB_URLS)
-            }
-        }
+        binding.license.text = "GPL-3.0 License\nGalaxy S24 & Android 16 个人定制版"
     }
 
     class AboutContent : MaterialAboutFragment() {
@@ -81,44 +67,15 @@ class AboutFragment : ToolbarFragment(R.layout.layout_about) {
                                 .icon(R.drawable.ic_baseline_update_24)
                                 .text(R.string.app_version)
                                 .subText(SagerNet.appVersionNameForDisplay)
-                                .setOnClickAction {
-                                    requireContext().launchCustomTab(
-                                        "https://github.com/MatsuriDayo/NekoBoxForAndroid/releases"
-                                    )
-                                }
-                                .build())
-                        .addItem(
-                            MaterialAboutActionItem.Builder()
-                                .text(R.string.check_update_release)
-                                .setOnClickAction {
-                                    checkUpdate(false)
-                                }
-                                .build())
-                        .addItem(
-                            MaterialAboutActionItem.Builder()
-                                .text(R.string.check_update_preview)
-                                .setOnClickAction {
-                                    checkUpdate(true)
-                                }
-                                .build())
+                                .build()
+                        )
                         .addItem(
                             MaterialAboutActionItem.Builder()
                                 .icon(R.drawable.ic_baseline_layers_24)
                                 .text(getString(R.string.version_x, "sing-box"))
                                 .subText(Libcore.versionBox())
-                                .setOnClickAction { }
-                                .build())
-                        .addItem(
-                            MaterialAboutActionItem.Builder()
-                                .icon(R.drawable.ic_baseline_card_giftcard_24)
-                                .text(R.string.donate)
-                                .subText(R.string.donate_info)
-                                .setOnClickAction {
-                                    requireContext().launchCustomTab(
-                                        "https://matsuridayo.github.io/index_docs/#donate"
-                                    )
-                                }
-                                .build())
+                                .build()
+                        )
                         .apply {
                             PackageCache.awaitLoadSync()
                             for ((_, pkg) in PackageCache.installedPluginPackages) {
@@ -145,62 +102,36 @@ class AboutFragment : ToolbarFragment(R.layout.layout_about) {
                                                     )
                                                 })
                                             }
-                                            .build())
+                                            .build()
+                                    )
                                 } catch (e: Exception) {
                                     Logs.w(e)
                                 }
                             }
                         }
                         .apply {
-                            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
-                                val pm = app.getSystemService(Context.POWER_SERVICE) as PowerManager
-                                if (!pm.isIgnoringBatteryOptimizations(app.packageName)) {
-                                    addItem(
-                                        MaterialAboutActionItem.Builder()
-                                            .icon(R.drawable.ic_baseline_running_with_errors_24)
-                                            .text(R.string.ignore_battery_optimizations)
-                                            .subText(R.string.ignore_battery_optimizations_sum)
-                                            .setOnClickAction {
-                                                requestIgnoreBatteryOptimizations.launch(
-                                                    Intent(
-                                                        Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
-                                                        "package:${app.packageName}".toUri()
-                                                    )
+                            val pm = app.getSystemService(Context.POWER_SERVICE) as PowerManager
+                            if (!pm.isIgnoringBatteryOptimizations(app.packageName)) {
+                                addItem(
+                                    MaterialAboutActionItem.Builder()
+                                        .icon(R.drawable.ic_baseline_running_with_errors_24)
+                                        .text(R.string.ignore_battery_optimizations)
+                                        .subText(R.string.ignore_battery_optimizations_sum)
+                                        .setOnClickAction {
+                                            requestIgnoreBatteryOptimizations.launch(
+                                                Intent(
+                                                    Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
+                                                    "package:${app.packageName}".toUri()
                                                 )
-                                            }
-                                            .build())
-                                }
+                                            )
+                                        }
+                                        .build()
+                                )
                             }
                         }
-                        .build())
-                .addCard(
-                    MaterialAboutCard.Builder()
-                        .outline(true)
-                        .title(R.string.project)
-                        .addItem(
-                            MaterialAboutActionItem.Builder()
-                                .icon(R.drawable.ic_baseline_sanitizer_24)
-                                .text(R.string.github)
-                                .setOnClickAction {
-                                    requireContext().launchCustomTab(
-                                        "https://github.com/MatsuriDayo/NekoBoxForAndroid"
-
-                                    )
-                                }
-                                .build())
-                        .addItem(
-                            MaterialAboutActionItem.Builder()
-                                .icon(R.drawable.ic_qu_shadowsocks_foreground)
-                                .text(R.string.telegram)
-                                .setOnClickAction {
-                                    requireContext().launchCustomTab(
-                                        "https://t.me/MatsuriDayo"
-                                    )
-                                }
-                                .build())
-                        .build())
+                        .build()
+                )
                 .build()
-
         }
 
         override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
@@ -210,74 +141,6 @@ class AboutFragment : ToolbarFragment(R.layout.layout_about) {
                 overScrollMode = RecyclerView.OVER_SCROLL_NEVER
             }
         }
-
-        fun checkUpdate(checkPreview: Boolean) {
-            runOnIoDispatcher {
-                try {
-                    val client = Libcore.newHttpClient().apply {
-                        modernTLS()
-                        trySocks5(
-                            DataStore.mixedPort,
-                            DataStore.mixedInboundUser,
-                            DataStore.mixedInboundPass
-                        )
-                    }
-                    val response = client.newRequest().apply {
-                        if (checkPreview) {
-                            setURL("https://api.github.com/repos/starifly/NekoBoxForAndroid/releases/tags/preview")
-                        } else {
-                            setURL("https://api.github.com/repos/starifly/NekoBoxForAndroid/releases/latest")
-                        }
-                    }.execute()
-                    val release = JSONObject(Util.getStringBox(response.contentString))
-                    val releaseName = release.getString("name")
-                    val releaseUrl = release.getString("html_url")
-                    var haveUpdate = releaseName.isNotBlank()
-                    haveUpdate = if (isPreview) {
-                        if (checkPreview) {
-                            haveUpdate && releaseName != BuildConfig.PRE_VERSION_NAME
-                        } else {
-                            // User: 1.3.9 pre-1.4.0 Stable: 1.3.9 -> No update
-                            haveUpdate && releaseName != BuildConfig.VERSION_NAME
-                        }
-                    } else {
-                        // User: 1.4.0 Preview: pre-1.4.0 -> No update
-                        // User: 1.4.0 Preview: pre-1.4.1 -> Update
-                        // User: 1.4.0 Stable: 1.4.0 -> No update
-                        // User: 1.4.0 Stable: 1.4.1 -> Update
-                        haveUpdate && !releaseName.contains(BuildConfig.VERSION_NAME)
-                    }
-                    runOnMainDispatcher {
-                        if (haveUpdate) {
-                            val context = requireContext()
-                            MaterialAlertDialogBuilder(context)
-                                .setTitle(R.string.update_dialog_title)
-                                .setMessage(
-                                    context.getString(
-                                        R.string.update_dialog_message,
-                                        SagerNet.appVersionNameForDisplay,
-                                        releaseName
-                                    )
-                                )
-                                .setPositiveButton(R.string.yes) { _, _ ->
-                                    val intent = Intent(Intent.ACTION_VIEW, releaseUrl.toUri())
-                                    context.startActivity(intent)
-                                }
-                                .setNegativeButton(R.string.no, null)
-                                .show()
-                        } else {
-                            Toast.makeText(app, R.string.check_update_no, Toast.LENGTH_SHORT).show()
-                        }
-                    }
-                } catch (e: Exception) {
-                    Logs.w(e)
-                    runOnMainDispatcher {
-                        Toast.makeText(app, e.readableMessage, Toast.LENGTH_SHORT).show()
-                    }
-                }
-            }
-        }
-
     }
 
 }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/AssetsActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/AssetsActivity.kt
index 22d7789ca9..12e93c643b 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/AssetsActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/AssetsActivity.kt
@@ -6,6 +6,7 @@ import android.text.format.DateFormat
 import android.view.Menu
 import android.view.MenuItem
 import android.view.ViewGroup
+import androidx.activity.addCallback
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.core.view.isInvisible
 import androidx.recyclerview.widget.ItemTouchHelper
@@ -33,6 +34,9 @@ class AssetsActivity : ThemedActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+        onBackPressedDispatcher.addCallback(this) {
+            finish()
+        }
 
         val binding = LayoutAssetsBinding.inflate(layoutInflater)
         layout = binding
@@ -364,7 +368,7 @@ class AssetsActivity : ThemedActivity() {
             response.writeTo(cacheFile.canonicalPath)
             cacheFile.renameTo(file)
 
-            val currentDate = java.text.SimpleDateFormat("yyyyMMdd").format(java.util.Date())
+            val currentDate = java.text.SimpleDateFormat("yyyyMMdd", Locale.ROOT).format(Date())
             versionFile.writeText(currentDate)
 
             adapter.reloadAssets()
@@ -384,10 +388,6 @@ class AssetsActivity : ThemedActivity() {
         return true
     }
 
-    override fun onBackPressed() {
-        finish()
-    }
-
     override fun onResume() {
         super.onResume()
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt
index a73052913c..666c2e6ab3 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt
@@ -3,14 +3,13 @@ package io.nekohasekai.sagernet.ui
 import android.content.Intent
 import android.net.Uri
 import android.os.Bundle
-import android.os.Parcel
-import android.os.Parcelable
 import android.provider.OpenableColumns
 import android.view.View
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AlertDialog
 import androidx.core.content.FileProvider
 import androidx.core.view.isVisible
+import androidx.lifecycle.lifecycleScope
 import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.jakewharton.processphoenix.ProcessPhoenix
 import io.nekohasekai.sagernet.BuildConfig
@@ -25,18 +24,12 @@ import io.nekohasekai.sagernet.databinding.LayoutImportBinding
 import io.nekohasekai.sagernet.databinding.LayoutProgressBinding
 import io.nekohasekai.sagernet.ktx.*
 import kotlinx.coroutines.delay
-import moe.matsuri.nb4a.utils.Util
-import org.json.JSONArray
+import io.nekohasekai.sagernet.fmt.BackupSerializer
 import org.json.JSONObject
 import java.io.ByteArrayOutputStream
 import java.io.File
 import java.net.URL
 import java.util.*
-import okhttp3.Credentials
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.RequestBody.Companion.toRequestBody
 import androidx.annotation.StringRes
 import com.google.android.material.snackbar.Snackbar
 import io.nekohasekai.sagernet.ktx.snackbar
@@ -44,33 +37,24 @@ import java.util.zip.ZipEntry
 import java.util.zip.ZipOutputStream
 import java.io.BufferedInputStream
 import java.util.zip.ZipInputStream
-import java.util.concurrent.TimeUnit
-import java.util.zip.Deflater
-import java.io.BufferedOutputStream
-import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
-
-class BackupFragment : NamedFragment(R.layout.layout_backup) {
-
-    private lateinit var binding: LayoutBackupBinding
-    private lateinit var backupData: ByteArray
-    private var isWebDAVBackup = false
-    private var isBackupInProgress = false
-    private var isRestoreInProgress = false
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.Dispatchers
+import io.nekohasekai.sagernet.fmt.KryoConverters
+import java.text.SimpleDateFormat
+
+class BackupFragment : ToolbarFragment(R.layout.layout_backup) {
+
+    private var pendingExportName: String? = null
     private var currentJob: kotlinx.coroutines.Job? = null
     private var snackbar: Snackbar? = null
-    private var restoreJob: kotlinx.coroutines.Job? = null
 
     override fun onDestroyView() {
         super.onDestroyView()
         snackbar?.dismiss()
         snackbar = null
-        // 如果正在进行恢复操作，取消它
-        if (isRestoreInProgress) {
-            restoreJob?.cancel()
-            restoreJob = null
-            isRestoreInProgress = false
-            MessageStore.showMessage(requireActivity(), R.string.restore_cancelled)
-        }
     }
 
     override fun onDestroy() {
@@ -79,456 +63,121 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
         currentJob = null
     }
 
-    override fun name0() = app.getString(R.string.backup)
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        pendingExportName = savedInstanceState?.getString("pendingExportName")
+    }
+
+    override fun onSaveInstanceState(outState: Bundle) {
+        outState.putString("pendingExportName", pendingExportName)
+        super.onSaveInstanceState(outState)
+    }
+
+    private fun backupFileName() =
+        "asteria_backup_${SimpleDateFormat("yyyyMMdd-HHmmss-SSS", Locale.ROOT).format(Date())}.json"
 
     var content = ""
     private val exportSettings = registerForActivityResult(ActivityResultContracts.CreateDocument()) { data ->
+        val pending = pendingExportName?.let { File(app.cacheDir, it) }
+        pendingExportName = null
         if (data != null) {
-            runOnDefaultDispatcher {
+            lifecycleScope.launch {
                 try {
-                    requireActivity().contentResolver.openOutputStream(data)!!.use { os ->
-                        os.write(backupData)
+                    onDefaultDispatcher {
+                        check(pending?.isFile == true) { "Backup snapshot is unavailable; export again" }
+                        pending.inputStream().use { input ->
+                            checkNotNull(app.contentResolver.openOutputStream(data, "wt")) {
+                                "Unable to open backup destination"
+                            }.use { input.copyTo(it) }
+                        }
                     }
-                    onMainDispatcher {
+                    if (view != null) {
                         snackbar(getString(R.string.action_export_msg)).show()
                     }
+                } catch (e: CancellationException) {
+                    throw e
                 } catch (e: Exception) {
                     Logs.w(e)
-                    onMainDispatcher {
+                    if (view != null) {
                         snackbar(e.readableMessage).show()
                     }
+                } finally {
+                    pending?.delete()
                 }
             }
+        } else {
+            pending?.delete()
         }
     }
 
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
         super.onViewCreated(view, savedInstanceState)
+        toolbar.setTitle(R.string.backup)
 
         val binding = LayoutBackupBinding.bind(view)
 
         binding.actionExport.setOnClickListener {
-            runOnDefaultDispatcher {
-                backupData = doBackup(
-                    binding.backupConfigurations.isChecked,
-                    binding.backupRules.isChecked,
-                    binding.backupSettings.isChecked
-                )
-                onMainDispatcher {
-                    startFilesForResult(
-                        exportSettings, "nekobox_backup_${Date().toLocaleString()}.json"
-                    )
+            if (currentJob?.isActive == true || pendingExportName != null) return@setOnClickListener
+            val profiles = binding.backupConfigurations.isChecked
+            val rules = binding.backupRules.isChecked
+            val settings = binding.backupSettings.isChecked
+            currentJob = viewLifecycleOwner.lifecycleScope.launch {
+                try {
+                    val cacheFile = onDefaultDispatcher {
+                        val bytes = doBackup(profiles, rules, settings)
+                        File(app.cacheDir, backupFileName()).apply { writeBytes(bytes) }
+                    }
+                    pendingExportName = cacheFile.name
+                    startFilesForResult(exportSettings, cacheFile.name)
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (e: Exception) {
+                    Logs.w(e)
+                    pendingExportName = null
+                    snackbar(e.readableMessage).show()
                 }
             }
         }
 
         binding.actionShare.setOnClickListener {
-            runOnDefaultDispatcher {
-                backupData = doBackup(
-                    binding.backupConfigurations.isChecked,
-                    binding.backupRules.isChecked,
-                    binding.backupSettings.isChecked
-                )
-                app.cacheDir.mkdirs()
-                val cacheFile = File(
-                    app.cacheDir, "nekobox_backup_${Date().toLocaleString()}.json"
-                )
-                cacheFile.writeBytes(backupData)
-                onMainDispatcher {
-                    startActivity(
-                        Intent.createChooser(
-                            Intent(Intent.ACTION_SEND).setType("application/json")
-                                .setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-                                .putExtra(
-                                    Intent.EXTRA_STREAM, FileProvider.getUriForFile(
-                                        app, BuildConfig.APPLICATION_ID + ".cache", cacheFile
-                                    )
-                                ), app.getString(R.string.abc_shareactionprovider_share_with)
-                        )
-                    )
-                }
-
-            }
-        }
-
-        binding.actionImportFile.setOnClickListener {
-            startFilesForResult(importFile, "*/*")
-        }
-
-        setupWebDAV(binding)
-    }
-
-    private fun setupWebDAV(binding: LayoutBackupBinding) {
-        binding.webdavSettings.setOnClickListener {
-            startActivity(Intent(requireContext(), WebDAVSettingsActivity::class.java))
-        }
-        
-        binding.backupToWebdav.setOnClickListener {
-            if (DataStore.webdavServer.isNullOrEmpty()) {
-                showMessage(R.string.webdav_server_empty)
-                return@setOnClickListener
-            }
-            backupToWebDAV()
-        }
-        
-        binding.restoreFromWebdav.setOnClickListener {
-            if (DataStore.webdavServer.isNullOrEmpty()) {
-                showMessage(R.string.webdav_server_empty)
-                return@setOnClickListener
-            }
-            restoreFromWebDAV()
-        }
-    }
-
-    private fun backupToWebDAV() {
-        if (isBackupInProgress) {
-            showMessage(R.string.backup_in_progress)
-            return
-        }
-        isBackupInProgress = true
-        val activity = requireActivity()
-        runOnDefaultDispatcher {
-            try {
-                isWebDAVBackup = true
-                val backupData = doBackup(
-                    true,  // 备份配置和分组
-                    true,  // 备份路由规则
-                    true   // 备份设置
-                )
-                isWebDAVBackup = false
-                
-                val client = OkHttpClient()
-
-                // 规范化 URL
-                val baseUrl = DataStore.webdavServer!!.trimEnd('/')
-                val path = DataStore.webdavPath?.trim('/')?.takeIf { it.isNotEmpty() } ?: "Nekobox"
-
-                // 使用英文格式的时间戳作为文件名，修改后缀为 .zip
-                val timestamp = java.text.SimpleDateFormat("yyyyMMdd_HHmmss", Locale.US).format(Date())
-                val version = BuildConfig.VERSION_NAME
-                val fileName = "nekobox_backup_${version}_$timestamp.zip"
-
-                // 确保 baseUrl 是有效的 URL
-                if (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://")) {
-                    throw Exception("Invalid server URL: must start with http:// or https://")
-                }
-
-                // 使用 HttpUrl 构建路径，避免 # 等特殊字符被当作 fragment
-                val baseHttpUrl = baseUrl.toHttpUrlOrNull()
-                    ?: throw Exception("Invalid server URL: $baseUrl")
-
-                val dirUrl = baseHttpUrl.newBuilder().apply {
-                    path.split('/').filter { it.isNotEmpty() }.forEach { segment ->
-                        addPathSegment(segment)
-                    }
-                }.build()
-
-                val fileUrl = dirUrl.newBuilder()
-                    .addPathSegment(fileName)
-                    .build()
-
-                Logs.d("WebDAV backup - Directory URL: $dirUrl")
-                Logs.d("WebDAV backup - File URL: $fileUrl")
-
-                // 先检查目录是否存在
-                val propfindRequest = Request.Builder()
-                    .url(dirUrl)
-                    .method("PROPFIND", null)
-                    .header("Authorization", Credentials.basic(
-                        DataStore.webdavUsername ?: "",
-                        DataStore.webdavPassword ?: ""
-                    ))
-                    .header("Depth", "0")
-                    .build()
-
-                var needCreateDir = false
-                client.newCall(propfindRequest).execute().use { response ->
-                    Logs.d("WebDAV backup - PROPFIND response: ${response.code}")
-                    when (response.code) {
-                        404 -> needCreateDir = true
-                        207 -> needCreateDir = false // 目录存在
-                        401 -> throw Exception("Authentication failed")
-                        else -> {
-                            if (!response.isSuccessful) {
-                                val errorBody = response.body?.string()
-                                Logs.e("WebDAV backup - PROPFIND error: $errorBody")
-                                throw Exception("Failed to check directory (${response.code}): ${response.message}")
-                            }
-                        }
-                    }
-                }
-
-                // 如果需要，创建目录
-                if (needCreateDir) {
-                    Logs.d("WebDAV backup - Creating directory")
-                    val mkcolRequest = Request.Builder()
-                        .url(dirUrl)
-                        .method("MKCOL", null)
-                        .header("Authorization", Credentials.basic(
-                            DataStore.webdavUsername ?: "",
-                            DataStore.webdavPassword ?: ""
-                        ))
-                        .build()
-
-                    client.newCall(mkcolRequest).execute().use { response ->
-                        if (!response.isSuccessful) {
-                            val errorBody = response.body?.string()
-                            Logs.e("WebDAV backup - MKCOL error: $errorBody")
-                            throw Exception("Failed to create directory (${response.code}): ${response.message}")
-                        }
-                    }
-                }
-
-                // 上传文件时使用正确的 Content-Type
-                val putRequest = Request.Builder()
-                    .url(fileUrl)
-                    .put(backupData.toRequestBody("application/zip".toMediaType()))
-                    .apply {
-                        header("Authorization", Credentials.basic(
-                            DataStore.webdavUsername ?: "",
-                            DataStore.webdavPassword ?: ""
-                        ))
+            if (currentJob?.isActive == true || pendingExportName != null) return@setOnClickListener
+            val profiles = binding.backupConfigurations.isChecked
+            val rules = binding.backupRules.isChecked
+            val settings = binding.backupSettings.isChecked
+            currentJob = viewLifecycleOwner.lifecycleScope.launch {
+                try {
+                    val cacheFile = onDefaultDispatcher {
+                        val bytes = doBackup(profiles, rules, settings)
+                        File(app.cacheDir, backupFileName()).apply { writeBytes(bytes) }
                     }
-                    .build()
-
-                client.newCall(putRequest).execute().use { response ->
-                    if (!response.isSuccessful) {
-                        val errorBody = response.body?.string()
-                        Logs.e("WebDAV backup - PUT error: $errorBody")
-                        throw Exception("Upload failed (${response.code}): ${response.message}\n$errorBody")
+                    onMainDispatcher {
+                        startActivity(
+                            Intent.createChooser(
+                                Intent(Intent.ACTION_SEND).setType("application/json")
+                                    .setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                                    .putExtra(
+                                        Intent.EXTRA_STREAM, FileProvider.getUriForFile(
+                                            app, BuildConfig.APPLICATION_ID + ".cache", cacheFile
+                                        )
+                                    ), app.getString(R.string.abc_shareactionprovider_share_with)
+                            )
+                        )
                     }
-                    Logs.d("WebDAV backup - Upload successful")
-                }
-
-                onMainDispatcher {
-                    MessageStore.showMessage(activity, R.string.webdav_backup_success)
-                }
-            } catch (e: Exception) {
-                isWebDAVBackup = false  // 确保发生异常时也重置标志
-                Logs.w(e)
-
-                val errorMessage = try {
-                    if (isAdded) {
-                        getString(R.string.webdav_backup_failed, e.message ?: "")
-                    } else {
-                        app.getString(R.string.webdav_backup_failed, e.message ?: "")
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (e: Exception) {
+                    Logs.w(e)
+                    onMainDispatcher {
+                        snackbar(e.readableMessage).show()
                     }
-                } catch (ex: Exception) {
-                    "WebDAV backup failed: ${e.message ?: ""}"
                 }
-                
-                onMainDispatcher {
-                    MessageStore.showMessage(activity, errorMessage)
-                }
-            } finally {
-                isBackupInProgress = false
             }
         }
-    }
-
-    private fun restoreFromWebDAV() {
-        if (isRestoreInProgress) {
-            showMessage(R.string.restore_in_progress)
-            return
-        }
-        isRestoreInProgress = true
-        val activity = requireActivity()
-        restoreJob = runOnDefaultDispatcher {
-            try {
-                val client = OkHttpClient()
-                val baseUrl = DataStore.webdavServer!!.trimEnd('/')
-                val path = DataStore.webdavPath?.trim('/')?.takeIf { it.isNotEmpty() } ?: "Nekobox"
-
-                if (!baseUrl.startsWith("http://") && !baseUrl.startsWith("https://")) {
-                    throw Exception("Invalid server URL: must start with http:// or https://")
-                }
-
-                val baseHttpUrl = baseUrl.toHttpUrlOrNull()
-                    ?: throw Exception("Invalid server URL: $baseUrl")
-
-                val dirUrl = baseHttpUrl.newBuilder().apply {
-                    path.split('/').filter { it.isNotEmpty() }.forEach { segment ->
-                        addPathSegment(segment)
-                    }
-                }.build()
-
-                Logs.d("WebDAV restore - Directory URL: $dirUrl")
-
-                // 先列出目录内容找到最新的备份文件
-                val propfindRequest = Request.Builder()
-                    .url(dirUrl)
-                    .method("PROPFIND", null)
-                    .header("Authorization", Credentials.basic(
-                        DataStore.webdavUsername ?: "",
-                        DataStore.webdavPassword ?: ""
-                    ))
-                    .header("Depth", "1")
-                    .build()
-
-                // 获取最新的备份文件名
-                val latestBackup = client.newCall(propfindRequest).execute().use { response ->
-                    if (!response.isSuccessful && response.code != 207) {
-                        val errorBody = response.body?.string()
-                        Logs.e("WebDAV restore - PROPFIND error: $errorBody")
-                        throw Exception("Failed to list directory: ${response.message}")
-                    }
-
-                    val responseBody = response.body?.string() ?: throw Exception("Empty response")
-                    Logs.d("WebDAV restore - Directory listing: $responseBody")
-                    
-                    val patterns = listOf(
-                        """<D:href>[^<]*?nekobox_backup_[^<]*?\d{8}_\d{6}\.(json|zip)</D:href>""".toRegex(),
-                        """<d:href>[^<]*?nekobox_backup_[^<]*?\d{8}_\d{6}\.(json|zip)</d:href>""".toRegex(),
-                        """<href>[^<]*?nekobox_backup_[^<]*?\d{8}_\d{6}\.(json|zip)</href>""".toRegex()
-                    )
-                    
-                    val backupFiles = mutableListOf<String>()
-                    
-                    for (pattern in patterns) {
-                        val matches = pattern.findAll(responseBody)
-                        matches.forEach { match ->
-                            val href = match.value
-                            Logs.d("WebDAV restore - Found backup file with pattern ${pattern.pattern}: $href")
-                            val fileName = """nekobox_backup_[^<]*?\d{8}_\d{6}\.(json|zip)""".toRegex()
-                                .find(href)?.value
-                            if (fileName != null) {
-                                backupFiles.add(fileName)
-                            }
-                        }
-                        if (backupFiles.isNotEmpty()) break
-                    }
-                    
-                    Logs.d("WebDAV restore - Found ${backupFiles.size} backup files: ${backupFiles.joinToString()}")
-
-                    backupFiles.maxByOrNull { fileName ->
-                        """(\d{8}_\d{6})""".toRegex().find(fileName)?.value ?: ""
-                    } ?: throw Exception("No backup found")
-                }
-
-                // 下载最新的备份文件
-                val fileUrl = dirUrl.newBuilder()
-                    .addPathSegment(latestBackup)
-                    .build()
-                Logs.d("WebDAV restore - File URL: $fileUrl")
-
-                val getRequest = Request.Builder()
-                    .url(fileUrl)
-                    .get()
-                    .header("Authorization", Credentials.basic(
-                        DataStore.webdavUsername ?: "",
-                        DataStore.webdavPassword ?: ""
-                    ))
-                    .build()
-
-                val content = client.newCall(getRequest).execute().use { response ->
-                    if (!response.isSuccessful) {
-                        val errorBody = response.body?.string()
-                        Logs.e("WebDAV restore - GET error: $errorBody")
-                        throw Exception("Download failed (${response.code}): ${response.message}")
-                    }
-                    response.body?.bytes() ?: throw Exception("Empty backup file")
-                }
-
-                Logs.d("WebDAV restore - Successfully downloaded backup file, size: ${content.size}")
-
-                // 根据文件类型处理内容
-                val backupContent = if (latestBackup.endsWith(".zip")) {
-                    // ZIP 文件处理
-                    ZipInputStream(content.inputStream()).use { zis ->
-                        zis.nextEntry?.let { entry ->
-                            if (entry.name.endsWith(".json")) {
-                                zis.readBytes().toString(Charsets.UTF_8)
-                            } else {
-                                throw Exception("Invalid backup file format")
-                            }
-                        } ?: throw Exception("Invalid backup file format")
-                    }
-                } else {
-                    // JSON 文件处理
-                    content.toString(Charsets.UTF_8)
-                }
-
-                // 解析并导入备份数据
-                val json = JSONObject(backupContent)
-                onMainDispatcher {
-                    // 如果 Fragment 已经被销毁，取消恢复操作
-                    if (!isAdded) {
-                        MessageStore.showMessage(activity, R.string.restore_cancelled)
-                        return@onMainDispatcher
-                    }
-
-                    val import = LayoutImportBinding.inflate(layoutInflater)
-                    if (!json.has("profiles")) {
-                        import.backupConfigurations.isVisible = false
-                    }
-                    if (!json.has("rules")) {
-                        import.backupRules.isVisible = false
-                    }
-                    if (!json.has("settings")) {
-                        import.backupSettings.isVisible = false
-                    }
-
-                    MaterialAlertDialogBuilder(requireContext()).setTitle(R.string.backup_import)
-                        .setView(import.root)
-                        .setPositiveButton(R.string.backup_import) { _, _ ->
-                            SagerNet.stopService()
-
-                            val binding = LayoutProgressBinding.inflate(layoutInflater)
-                            binding.content.text = getString(R.string.backup_importing)
-                            val dialog = AlertDialog.Builder(requireContext())
-                                .setView(binding.root)
-                                .setCancelable(false)
-                                .show()
-                            runOnDefaultDispatcher {
-                                runCatching {
-                                    // 再次检查是否已被取消
-                                    if (!isAdded) {
-                                        MessageStore.showMessage(activity, R.string.restore_cancelled)
-                                        return@runOnDefaultDispatcher
-                                    }
-                                    finishImport(
-                                        json,
-                                        import.backupConfigurations.isChecked,
-                                        import.backupRules.isChecked,
-                                        import.backupSettings.isChecked
-                                    )
-                                    ProcessPhoenix.triggerRebirth(
-                                        activity, Intent(activity, MainActivity::class.java)
-                                    )
-                                }.onFailure {
-                                    Logs.w(it)
-                                    onMainDispatcher {
-                                        MessageStore.showMessage(activity, it.readableMessage)
-                                    }
-                                }
 
-                                onMainDispatcher {
-                                    dialog.dismiss()
-                                }
-                            }
-                        }
-                        .setNegativeButton(android.R.string.cancel, null)
-                        .show()
-                }
-            } catch (e: Exception) {
-                Logs.w(e)
-                onMainDispatcher {
-                    MessageStore.showMessage(activity, e.readableMessage)
-                }
-            } finally {
-                isRestoreInProgress = false
-            }
+        binding.actionImportFile.setOnClickListener {
+            startFilesForResult(importFile, "*/*")
         }
-    }
 
-    fun Parcelable.toBase64Str(): String {
-        val parcel = Parcel.obtain()
-        writeToParcel(parcel, 0)
-        try {
-            return Util.b64EncodeUrlSafe(parcel.marshall())
-        } finally {
-            parcel.recycle()
-        }
     }
 
     private fun doBackup(
@@ -536,93 +185,41 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
         rule: Boolean,
         setting: Boolean
     ): ByteArray {
-        val out = JSONObject().apply {
-            put("version", 1)
-            if (profile) {
-                put("profiles", JSONArray().apply {
-                    SagerDatabase.proxyDao.getAll().forEach {
-                        put(it.toBase64Str())
-                    }
-                })
-
-                put("groups", JSONArray().apply {
-                    SagerDatabase.groupDao.allGroups().forEach {
-                        put(it.toBase64Str())
-                    }
-                })
-            }
-            if (rule) {
-                put("rules", JSONArray().apply {
-                    SagerDatabase.rulesDao.allRules().forEach {
-                        put(it.toBase64Str())
-                    }
-                })
-            }
+        val out = BackupSerializer.exportDatabase(SagerDatabase.instance, profile, rule).apply {
             if (setting) {
-                put("settings", JSONArray().apply {
-                    PublicDatabase.kvPairDao.all().forEach {
-                        put(it.toBase64Str())
-                    }
-                })
+                BackupSerializer.putParcelableArray(this, "settings", PublicDatabase.kvPairDao.all())
             }
         }
 
         val jsonContent = out.toStringPretty()
-        return if (isWebDAVBackup) {
-            ByteArrayOutputStream().use { bos ->
-                ZipOutputStream(bos).use { zos ->
-                    zos.setLevel(Deflater.BEST_COMPRESSION)
-                    
-                    val entry = ZipEntry("nekobox_backup.json").apply {
-                        method = ZipEntry.DEFLATED
-                    }
-                    
-                    // 写入数据
-                    zos.putNextEntry(entry)
-                    val bytes = jsonContent.toByteArray(Charsets.UTF_8)
-                    zos.write(bytes)
-                    zos.closeEntry()
-                    
-                    // 确保所有数据都被写入和压缩
-                    zos.finish()
-                }
-                bos.toByteArray()
-            }
-        } else {
-            // 本地导出和分享功能使用 JSON 格式
-            jsonContent.toByteArray()
-        }
+        return jsonContent.toByteArray()
     }
 
     val importFile = registerForActivityResult(ActivityResultContracts.GetContent()) { file ->
         if (file != null) {
-            runOnDefaultDispatcher {
+            viewLifecycleOwner.lifecycleScope.launch {
                 startImport(file)
             }
         }
     }
 
     suspend fun startImport(file: Uri) {
-        val activity = requireActivity()
-        val fileName = requireContext().contentResolver.query(file, null, null, null, null)
-            ?.use { cursor ->
-                cursor.moveToFirst()
-                cursor.getColumnIndexOrThrow(OpenableColumns.DISPLAY_NAME).let(cursor::getString)
+        val activity = activity ?: return
+        try {
+            val fileName = onDefaultDispatcher {
+                activity.contentResolver.query(file, null, null, null, null)?.use { cursor ->
+                    val column = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
+                    if (cursor.moveToFirst() && column >= 0) cursor.getString(column) else null
+                }?.takeIf { it.isNotBlank() }
+                    ?: file.lastPathSegment.orEmpty().substringAfterLast('/').substringAfter(':')
             }
-            ?.takeIf { it.isNotBlank() } ?: file.pathSegments.last()
-            .substringAfterLast('/')
-            .substringAfter(':')
-
-        if (!fileName.endsWith(".json") && !fileName.endsWith(".zip")) {
-            onMainDispatcher {
+            if (!fileName.endsWith(".json", true) && !fileName.endsWith(".zip", true)) {
                 snackbar(getString(R.string.backup_not_file, fileName)).show()
+                return
             }
-            return
-        }
-
-        try {
-            val content = requireContext().contentResolver.openInputStream(file)!!.use { input ->
-                if (fileName.endsWith(".zip")) {
+            val content = onDefaultDispatcher {
+                checkNotNull(activity.contentResolver.openInputStream(file)).use { input ->
+                if (fileName.endsWith(".zip", true)) {
                     ZipInputStream(BufferedInputStream(input)).use { zis ->
                         zis.nextEntry?.let { entry ->
                             if (entry.name.endsWith(".json")) {
@@ -636,6 +233,7 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
                     input.readBytes().toString(Charsets.UTF_8)
                 }
             }
+            }
 
             val json = JSONObject(content)
             onMainDispatcher {
@@ -652,6 +250,9 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
                 MaterialAlertDialogBuilder(requireContext()).setTitle(R.string.backup_import)
                     .setView(import.root)
                     .setPositiveButton(R.string.backup_import) { _, _ ->
+                        val profiles = import.backupConfigurations.isChecked
+                        val rules = import.backupRules.isChecked
+                        val settings = import.backupSettings.isChecked
                         SagerNet.stopService()
 
                         val binding = LayoutProgressBinding.inflate(layoutInflater)
@@ -660,20 +261,23 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
                             .setView(binding.root)
                             .setCancelable(false)
                             .show()
-                        runOnDefaultDispatcher {
-                            runCatching {
-                                finishImport(
-                                    json,
-                                    import.backupConfigurations.isChecked,
-                                    import.backupRules.isChecked,
-                                    import.backupSettings.isChecked
-                                )
-                                triggerFullRestart(requireContext())
-                            }.onFailure {
-                                Logs.w(it)
-                                onMainDispatcher {
+                        val appContext = requireContext().applicationContext
+                        lifecycleScope.launch {
+                            try {
+                                withContext(Dispatchers.Default + NonCancellable) {
+                                    finishImport(json, profiles, rules, settings)
+                                    triggerFullRestart(appContext)
+                                }
+                            } catch (e: CancellationException) {
+                                throw e
+                            } catch (e: Exception) {
+                                Logs.w(e)
+                                MessageStore.showMessage(e.readableMessage)
+                            } finally {
+                                try {
                                     dialog.dismiss()
-                                    MessageStore.showMessage(activity, it.readableMessage)
+                                } catch (e: Exception) {
+                                    // Ignored if window already detached
                                 }
                             }
                         }
@@ -681,6 +285,8 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
                     .setNegativeButton(android.R.string.cancel, null)
                     .show()
             }
+        } catch (e: CancellationException) {
+            throw e
         } catch (e: Exception) {
             Logs.w(e)
             onMainDispatcher {
@@ -692,67 +298,279 @@ class BackupFragment : NamedFragment(R.layout.layout_backup) {
     fun finishImport(
         content: JSONObject, profile: Boolean, rule: Boolean, setting: Boolean
     ) {
-        if (profile && content.has("profiles")) {
-            val profiles = mutableListOf<ProxyEntity>()
-            val jsonProfiles = content.getJSONArray("profiles")
-            for (i in 0 until jsonProfiles.length()) {
-                val data = Util.b64Decode(jsonProfiles[i] as String)
-                val parcel = Parcel.obtain()
-                parcel.unmarshall(data, 0, data.size)
-                parcel.setDataPosition(0)
-                profiles.add(ProxyEntity.CREATOR.createFromParcel(parcel))
-                parcel.recycle()
+        KryoConverters.withStrictDeserialization {
+            val decodedSettings = if (setting) {
+                require(content.has("settings") && !content.isNull("settings")) {
+                    "Backup settings are missing or invalid"
+                }
+                val list = BackupSerializer.getParcelableArray(content, "settings", KeyValuePair.CREATOR)
+                val filteredList = list.filterNot { it.key in DataStore.DEPRECATED_SETTING_KEYS }
+                val keys = HashSet<String>(filteredList.size)
+                for (kv in filteredList) {
+                    require(keys.add(kv.key)) { "Duplicate setting key in backup: ${kv.key}" }
+                    kv.validate()
+                }
+                filteredList
+            } else null
+
+            data class DecodedProfiles(
+                val profiles: List<ProxyEntity>,
+                val groups: List<ProxyGroup>,
+                val routerGroups: List<RouterGroup>,
+                val routerMembers: List<RouterMember>,
+                val routerSources: List<RouterGroupSource>,
+                val validGroupIds: Set<Long>,
+                val validRouterIds: Set<Long>,
+                val validProxyIds: Set<Long>,
+            )
+
+            val decodedProfileData = if (profile) {
+                require(content.has("profiles") && !content.isNull("profiles")) {
+                    "Backup profiles are missing or invalid"
+                }
+                require(content.has("groups") && !content.isNull("groups")) {
+                    "Backup groups are missing or invalid"
+                }
+                val profilesList = BackupSerializer.getParcelableArray(content, "profiles", ProxyEntity.CREATOR)
+                val groupsList = BackupSerializer.getParcelableArray(content, "groups", ProxyGroup.CREATOR)
+                val routerGroupsList = BackupSerializer.getParcelableArray(content, "routerGroups", RouterGroup.CREATOR)
+                val routerMembersList = BackupSerializer.getParcelableArray(content, "routerMembers", RouterMember.CREATOR)
+                val routerSourcesList = BackupSerializer.getParcelableArray(content, "routerSources", RouterGroupSource.CREATOR)
+
+                require(groupsList.all { g -> g.id > 0L && (g.ungrouped || !g.name.isNullOrBlank()) }) {
+                    "Backup contains invalid or blank proxy groups"
+                }
+                require(routerGroupsList.all { it.id > 0L && it.stableTag.isNotBlank() }) {
+                    "Backup contains invalid or blank router groups"
+                }
+
+                profilesList.forEach { it.requireBean() }
+                val groupIds = groupsList.mapTo(hashSetOf()) { it.id }
+                require(profilesList.all { it.groupId in groupIds }) {
+                    "Backup contains profiles without a group"
+                }
+
+                val routerIds = routerGroupsList.mapTo(hashSetOf()) { it.id }
+                val proxyIds = profilesList.mapTo(hashSetOf()) { it.id }
+
+                require(routerMembersList.all { it.routerId in routerIds && it.proxyId in proxyIds }) {
+                    "Backup contains router members referencing missing routers or profiles"
+                }
+                require(routerSourcesList.all { it.routerId in routerIds && it.sourceGroupId in groupIds }) {
+                    "Backup contains router sources referencing missing routers or groups"
+                }
+
+                // R05: Validate frontProxy and landingProxy on groups
+                for (group in groupsList) {
+                    if (group.frontProxy > 0L) {
+                        require(group.frontProxy in proxyIds) {
+                            "Group ${group.id} references missing frontProxy ${group.frontProxy}"
+                        }
+                    }
+                    if (group.landingProxy > 0L) {
+                        require(group.landingProxy in proxyIds) {
+                            "Group ${group.id} references missing landingProxy ${group.landingProxy}"
+                        }
+                    }
+                }
+
+                // R05: Validate ChainBean references and cycles
+                val chainEdges = HashMap<Long, List<Long>>()
+                for (proxy in profilesList) {
+                    val bean = proxy.requireBean()
+                    if (bean is io.nekohasekai.sagernet.fmt.internal.ChainBean) {
+                        require(bean.proxies.isNotEmpty()) {
+                            "Chain proxy ${proxy.id} has empty proxy list"
+                        }
+                        for (targetId in bean.proxies) {
+                            require(targetId in proxyIds) {
+                                "Chain proxy ${proxy.id} references missing proxy $targetId"
+                            }
+                        }
+                        chainEdges[proxy.id] = bean.proxies
+                    }
+                }
+                val visitedChainNodes = HashSet<Long>()
+                val callChainStack = HashSet<Long>()
+                fun checkChainCycle(node: Long) {
+                    if (node in callChainStack) {
+                        throw IllegalArgumentException("Cyclic chain reference detected involving proxy $node")
+                    }
+                    if (node in visitedChainNodes) return
+                    visitedChainNodes.add(node)
+                    callChainStack.add(node)
+                    for (target in chainEdges[node].orEmpty()) {
+                        checkChainCycle(target)
+                    }
+                    callChainStack.remove(node)
+                }
+                for (node in chainEdges.keys) {
+                    checkChainCycle(node)
+                }
+
+                DecodedProfiles(
+                    profiles = profilesList,
+                    groups = groupsList,
+                    routerGroups = routerGroupsList,
+                    routerMembers = routerMembersList,
+                    routerSources = routerSourcesList,
+                    validGroupIds = groupIds,
+                    validRouterIds = routerIds,
+                    validProxyIds = proxyIds,
+                )
+            } else null
+
+            val decodedRules = if (rule) {
+                require(content.has("rules") && !content.isNull("rules")) {
+                    "Backup rules are missing or invalid"
+                }
+                val routerReferences = BackupSerializer.getRouterRuleReferences(content)
+                val routerRuleRefList = BackupSerializer.getRouterRuleReferenceList(content).associateBy { it.ruleId }
+                val rulesList = BackupSerializer.getParcelableArray(content, "rules") {
+                    ParcelizeBridge.createRule(it)
+                }.map { imported ->
+                    val routerGroupId = routerReferences[imported.id] ?: 0L
+                    imported.copy(routerGroupId = routerGroupId)
+                }
+
+                if (decodedProfileData != null) {
+                    BackupSerializer.validateRuleReferences(rulesList, decodedProfileData.validRouterIds, decodedProfileData.validProxyIds)
+                    val backupRouterTags = decodedProfileData.routerGroups.associate { it.id to it.stableTag }
+                    for (ruleItem in rulesList) {
+                        if (ruleItem.routerGroupId > 0L) {
+                            val ref = routerRuleRefList[ruleItem.id]
+                            if (ref?.routerStableTag != null) {
+                                val actualTag = backupRouterTags[ruleItem.routerGroupId]
+                                require(actualTag == ref.routerStableTag) {
+                                    "Rule ${ruleItem.id} references router group ${ruleItem.routerGroupId} with mismatched tag: expected ${ref.routerStableTag}, actual $actualTag"
+                                }
+                            }
+                        }
+                    }
+                } else {
+                    // R03: Partial restore "只恢复规则" (Rules only, local database profiles kept)
+                    val localRouters = SagerDatabase.routerGroupDao.all().associate { it.id to it.stableTag }
+                    val localProxies = SagerDatabase.proxyDao.getAll().associate { it.id to it.routerStableId() }
+                    val backupRouters = if (content.has("routerGroups") && !content.isNull("routerGroups")) {
+                        runCatching {
+                            BackupSerializer.getParcelableArray(content, "routerGroups", RouterGroup.CREATOR).associate { it.id to it.stableTag }
+                        }.getOrNull().orEmpty()
+                    } else emptyMap()
+
+                    // R03 fix: read the stable-identity index emitted by the exporter when
+                    // profiles were not included. Falls back to inline profiles if present.
+                    val backupOutboundStableIds: Map<Long, String> =
+                        BackupSerializer.getRuleOutboundStableIds(content).ifEmpty {
+                            // Legacy fallback: backup was produced with profiles section
+                            if (content.has("profiles") && !content.isNull("profiles")) {
+                                runCatching {
+                                    BackupSerializer.getParcelableArray(content, "profiles", ProxyEntity.CREATOR)
+                                        .associate { it.id to it.routerStableId() }
+                                }.getOrNull().orEmpty()
+                            } else emptyMap()
+                        }
+
+                    for (ruleItem in rulesList) {
+                        if (ruleItem.routerGroupId > 0L) {
+                            val expectedTag = routerRuleRefList[ruleItem.id]?.routerStableTag
+                                ?: backupRouters[ruleItem.routerGroupId]
+                            require(expectedTag != null) {
+                                "Cannot verify stable identity for router group ${ruleItem.routerGroupId} referenced by rule ${ruleItem.id}"
+                            }
+                            val localTag = localRouters[ruleItem.routerGroupId]
+                            require(localTag != null && localTag == expectedTag) {
+                                "Rule ${ruleItem.id} references router group ${ruleItem.routerGroupId} whose identity does not match local router (expected $expectedTag, found $localTag)"
+                            }
+                        } else if (ruleItem.outbound > 0L) {
+                            // R03 fix: use the stable ID from ruleOutboundRefs instead of requiring profiles
+                            val expectedStableId = backupOutboundStableIds[ruleItem.id]
+                                ?: backupOutboundStableIds[ruleItem.outbound]
+                            require(expectedStableId != null) {
+                                "Cannot verify stable identity for profile ${ruleItem.outbound} referenced by rule ${ruleItem.id}: export does not contain profile identity information"
+                            }
+                            val localStableId = localProxies[ruleItem.outbound]
+                            require(localStableId != null && localStableId == expectedStableId) {
+                                "Rule ${ruleItem.id} references profile ${ruleItem.outbound} whose identity does not match local profile"
+                            }
+                        }
+                    }
+                }
+                rulesList
+            } else null
+
+            // R02: Partial restore "只恢复配置" (Profiles only, local rules kept)
+            if (decodedProfileData != null && decodedRules == null) {
+                val existingRules = SagerDatabase.rulesDao.allRules()
+                val incomingRouterTags = decodedProfileData.routerGroups.associate { it.id to it.stableTag }
+                val incomingProxyTags = decodedProfileData.profiles.associate { it.id to it.routerStableId() }
+                val localRouters = SagerDatabase.routerGroupDao.all().associate { it.id to it.stableTag }
+                val localProxies = SagerDatabase.proxyDao.getAll().associate { it.id to it.routerStableId() }
+
+                for (rule in existingRules) {
+                    if (rule.routerGroupId > 0L) {
+                        val localTag = localRouters[rule.routerGroupId]
+                        require(localTag != null) {
+                            "Existing rule ${rule.id} references missing local router ${rule.routerGroupId}"
+                        }
+                        val incomingTag = incomingRouterTags[rule.routerGroupId]
+                        require(incomingTag != null && incomingTag == localTag) {
+                            "Existing rule ${rule.id} references router ${rule.routerGroupId} whose identity does not match incoming configuration (local: $localTag, incoming: $incomingTag)"
+                        }
+                    } else if (rule.outbound > 0L) {
+                        val localStableId = localProxies[rule.outbound]
+                        require(localStableId != null) {
+                            "Existing rule ${rule.id} references missing local profile ${rule.outbound}"
+                        }
+                        val incomingStableId = incomingProxyTags[rule.outbound]
+                        require(incomingStableId != null && incomingStableId == localStableId) {
+                            "Existing rule ${rule.id} references profile ${rule.outbound} whose identity does not match incoming configuration"
+                        }
+                    }
+                }
             }
-            SagerDatabase.proxyDao.reset()
-            SagerDatabase.proxyDao.insert(profiles)
-
-            val groups = mutableListOf<ProxyGroup>()
-            val jsonGroups = content.getJSONArray("groups")
-            for (i in 0 until jsonGroups.length()) {
-                val data = Util.b64Decode(jsonGroups[i] as String)
-                val parcel = Parcel.obtain()
-                parcel.unmarshall(data, 0, data.size)
-                parcel.setDataPosition(0)
-                groups.add(ProxyGroup.CREATOR.createFromParcel(parcel))
-                parcel.recycle()
+
+            SagerDatabase.instance.runInTransaction {
+                if (decodedProfileData != null) {
+                    SagerDatabase.routerGroupSourceDao.reset()
+                    SagerDatabase.routerMemberDao.reset()
+                    SagerDatabase.routerGroupDao.reset()
+                    SagerDatabase.proxyDao.reset()
+                    SagerDatabase.groupDao.reset()
+
+                    SagerDatabase.groupDao.insert(decodedProfileData.groups)
+                    SagerDatabase.proxyDao.insert(decodedProfileData.profiles)
+                    if (decodedProfileData.routerGroups.isNotEmpty()) {
+                        SagerDatabase.routerGroupDao.insert(decodedProfileData.routerGroups)
+                    }
+                    if (decodedProfileData.routerMembers.isNotEmpty()) {
+                        SagerDatabase.routerMemberDao.insert(decodedProfileData.routerMembers)
+                    }
+                    if (decodedProfileData.routerSources.isNotEmpty()) {
+                        SagerDatabase.routerGroupSourceDao.insert(decodedProfileData.routerSources)
+                    }
+                    SagerDatabase.routerGroupDao.clearInvalidSelections()
+                }
+
+                if (decodedRules != null) {
+                    SagerDatabase.rulesDao.reset()
+                    SagerDatabase.rulesDao.insert(decodedRules)
+                }
             }
-            SagerDatabase.groupDao.reset()
-            SagerDatabase.groupDao.insert(groups)
-        }
-        if (rule && content.has("rules")) {
-            val rules = mutableListOf<RuleEntity>()
-            val jsonRules = content.getJSONArray("rules")
-            for (i in 0 until jsonRules.length()) {
-                val data = Util.b64Decode(jsonRules[i] as String)
-                val parcel = Parcel.obtain()
-                parcel.unmarshall(data, 0, data.size)
-                parcel.setDataPosition(0)
-                rules.add(ParcelizeBridge.createRule(parcel))
-                parcel.recycle()
+            if (decodedProfileData != null) {
+                GroupManager.cleanupDanglingRouterMembers()
             }
-            SagerDatabase.rulesDao.reset()
-            SagerDatabase.rulesDao.insert(rules)
-        }
-        if (setting && content.has("settings")) {
-            val settings = mutableListOf<KeyValuePair>()
-            val jsonSettings = content.getJSONArray("settings")
-            for (i in 0 until jsonSettings.length()) {
-                val data = Util.b64Decode(jsonSettings[i] as String)
-                val parcel = Parcel.obtain()
-                parcel.unmarshall(data, 0, data.size)
-                parcel.setDataPosition(0)
-                settings.add(KeyValuePair.CREATOR.createFromParcel(parcel))
-                parcel.recycle()
+            if (decodedSettings != null) {
+                PublicDatabase.instance.runInTransaction {
+                    PublicDatabase.kvPairDao.reset()
+                    PublicDatabase.kvPairDao.insert(decodedSettings)
+                }
             }
-            PublicDatabase.kvPairDao.reset()
-            PublicDatabase.kvPairDao.insert(settings)
         }
     }
 
     private fun showMessage(message: String) {
         MessageStore.showMessage(message)
     }
-
     private fun showMessage(@StringRes resId: Int) {
         MessageStore.showMessage(requireActivity(), resId)
     }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt
index a6734cd9fa..da1b021a1b 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/ConfigurationFragment.kt
@@ -114,6 +114,7 @@ import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.isActive
 import kotlinx.coroutines.joinAll
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withContext
@@ -139,6 +140,10 @@ import java.util.zip.ZipInputStream
 import kotlin.collections.set
 import androidx.appcompat.app.AlertDialog
 import io.nekohasekai.sagernet.database.SubscriptionBean
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RouterGroupRepository
+import io.nekohasekai.sagernet.route.RouterRuntimeSelection
+import io.nekohasekai.sagernet.route.UrlTestTargetResolver
 import kotlin.math.abs
 
 class ConfigurationFragment @JvmOverloads constructor(
@@ -260,6 +265,89 @@ class ConfigurationFragment @JvmOverloads constructor(
 
     private fun isSelectedProfile(profileId: Long) = selectedProxySnapshot == profileId
 
+    /**
+     * In router-group view mode each tab has its own selected proxy. We cache routerId->selectedProxyId
+     * so that [ConfigurationHolder.bindProfileState] can determine selection without a DB call.
+     */
+    @Volatile
+    private var routerGroupSelectionSnapshot: Map<Long, Long> = emptyMap()
+
+    @Volatile
+    private var routerGroupRuntimeSelectionSnapshot: Map<Long, Long> = emptyMap()
+
+    /** Returns true when [profileId] is the selected node inside [routerGroupId]. */
+    fun isSelectedProfileInRouterGroup(routerGroup: RouterGroup, profileId: Long): Boolean {
+        val selectedId = if (routerGroup.mode == RouterGroup.MODE_URL_TEST) {
+            routerGroupRuntimeSelectionSnapshot[routerGroup.id]
+        } else {
+            routerGroupSelectionSnapshot[routerGroup.id]
+        }
+        return selectedId == profileId
+    }
+
+    private fun selectedProfileInRouterGroup(routerGroup: RouterGroup): Long? {
+        return if (routerGroup.mode == RouterGroup.MODE_URL_TEST) {
+            routerGroupRuntimeSelectionSnapshot[routerGroup.id]
+        } else {
+            routerGroupSelectionSnapshot[routerGroup.id]
+        }
+    }
+
+    fun updateRuntimeUrlTestSelections(pairs: LongArray) {
+        val next = RouterRuntimeSelection.toMap(pairs)
+        if (next == routerGroupRuntimeSelectionSnapshot) return
+        val changedIds = (routerGroupRuntimeSelectionSnapshot.values + next.values)
+            .filter { it > 0L }
+            .toSet()
+        routerGroupRuntimeSelectionSnapshot = next
+        if (!::adapter.isInitialized) return
+        adapter.groupFragments.values.forEach { fragment ->
+            fragment.adapter?.refreshProfileState(changedIds)
+        }
+    }
+
+    /** Called from [selectProfileInRouterGroup] to refresh the snapshot after a selection change. */
+    private fun updateRouterGroupSelectionSnapshot(routerGroupId: Long, proxyId: Long) {
+        routerGroupSelectionSnapshot = routerGroupSelectionSnapshot + (routerGroupId to proxyId)
+    }
+
+    /** Refreshes the router-group selection snapshot from the DB on the background. */
+    fun refreshRouterGroupSelections() {
+        if (!::adapter.isInitialized) return
+        val currentAdapter = adapter
+        runOnDefaultDispatcher {
+            val groups = RouterGroupRepository.all()
+            val snapshot = groups.associate { it.id to it.selectedProxyId }
+            onMainDispatcher {
+                if (!isCurrentGroupPagerAdapter(currentAdapter) ||
+                    viewLifecycleOwnerLiveData.value == null || !currentAdapter.inRouterGroupMode
+                ) return@onMainDispatcher
+                if (groups.isEmpty()) {
+                    currentAdapter.reload()
+                    return@onMainDispatcher
+                }
+                routerGroupSelectionSnapshot = snapshot
+                val selectedRouterId = currentAdapter.routerGroupList
+                    .getOrNull(groupPager.currentItem)?.id
+                currentAdapter.routerGroupList = ArrayList(groups)
+                val groupsById = groups.associateBy { it.id }
+                currentAdapter.groupFragments.keys.retainAll(groupsById.keys.map { -it }.toSet())
+                // Trigger a UI refresh for all visible router-group pages
+                currentAdapter.groupFragments.values.forEach { frag ->
+                    frag.routerGroup = groupsById[frag.routerGroup?.id] ?: return@forEach
+                    frag.adapter?.notifyDataSetChanged()
+                }
+                currentAdapter.notifyDataSetChanged()
+                groups.indexOfFirst { it.id == selectedRouterId }.takeIf { it >= 0 }?.let {
+                    groupPager.setCurrentItem(it, false)
+                }
+                val hideTab = groups.size < 2
+                tabLayout.isGone = hideTab
+                toolbar.elevation = if (hideTab) 0F else dp2px(4).toFloat()
+            }
+        }
+    }
+
     private fun isCurrentProfile(profileId: Long) = currentProfileSnapshot == profileId
 
     private fun isCurrentGroupPagerAdapter(candidate: GroupPagerAdapter): Boolean {
@@ -330,6 +418,13 @@ class ConfigurationFragment @JvmOverloads constructor(
         if (!select) {
             toolbar.inflateMenu(R.menu.add_profile_menu)
             toolbar.menu.findItem(R.id.action_global_mode)?.isChecked = DataStore.globalMode
+            // Set initial title to '代理' (Proxy)
+            toolbar.setTitle(R.string.route_proxy)
+            // Set initial label for the view-switch menu item
+            toolbar.menu.findItem(R.id.action_switch_group_view)?.setTitle(
+                if (DataStore.viewModeRouterGroups) R.string.switch_to_subscription_view
+                else R.string.switch_to_router_group_view
+            )
             toolbar.setOnMenuItemClickListener(this)
         } else {
             toolbar.setTitle(titleRes)
@@ -361,8 +456,15 @@ class ConfigurationFragment @JvmOverloads constructor(
         groupPager.offscreenPageLimit = 2
 
         TabLayoutMediator(tabLayout, groupPager) { tab, position ->
-            if (adapter.groupList.size > position) {
-                tab.text = adapter.groupList[position].displayName()
+            val rgMode = adapter.inRouterGroupMode
+            if (rgMode) {
+                if (adapter.routerGroupList.size > position) {
+                    tab.text = adapter.routerGroupList[position].name
+                }
+            } else {
+                if (adapter.groupList.size > position) {
+                    tab.text = adapter.groupList[position].displayName()
+                }
             }
             tab.view.setOnLongClickListener { // clear toast
                 true
@@ -401,6 +503,13 @@ class ConfigurationFragment @JvmOverloads constructor(
         DataStore.profileCacheStore.registerChangeListener(this)
     }
 
+    override fun onResume() {
+        super.onResume()
+        if (::adapter.isInitialized && adapter.inRouterGroupMode) {
+            refreshRouterGroupSelections()
+        }
+    }
+
     override fun onPrepareOptionsMenu(menu: Menu) {
         menu.findItem(R.id.action_global_mode)?.isChecked = DataStore.globalMode
         super.onPrepareOptionsMenu(menu)
@@ -493,7 +602,12 @@ class ConfigurationFragment @JvmOverloads constructor(
     suspend fun import(proxies: List<AbstractBean>) {
         val targetId = DataStore.selectedGroupForImport()
         for (proxy in proxies) {
-            ProfileManager.createProfile(targetId, proxy)
+            ProfileManager.createProfile(targetId, proxy, reconcile = false)
+        }
+        if (RouterGroupRepository.all().isNotEmpty()) {
+            runCatching {
+                GroupManager.reconcileRouterMembers(GroupManager.snapshotRouterMembers())
+            }
         }
         onMainDispatcher {
             DataStore.editingGroup = targetId
@@ -863,6 +977,32 @@ class ConfigurationFragment @JvmOverloads constructor(
                 urlTest()
             }
 
+            R.id.action_switch_group_view -> {
+                // Toggle between router-groups view and subscription groups view
+                val hasRouterGroups = runCatching {
+                    io.nekohasekai.sagernet.database.RouterGroupRepository.all().isNotEmpty()
+                }.getOrDefault(false)
+                if (!hasRouterGroups) {
+                    snackbar(getString(R.string.router_empty_title)).show()
+                } else {
+                    DataStore.viewModeRouterGroups = !DataStore.viewModeRouterGroups
+                    // Update the menu item title to reflect the new state
+                    val newTitle = if (DataStore.viewModeRouterGroups) {
+                        R.string.switch_to_subscription_view
+                    } else {
+                        R.string.switch_to_router_group_view
+                    }
+                    toolbar.menu.findItem(R.id.action_switch_group_view)?.setTitle(newTitle)
+                    adapter.reload(now = true)
+                }
+                return true
+            }
+
+            R.id.action_manage_router_groups -> {
+                startActivity(android.content.Intent(requireContext(), RouterGroupListActivity::class.java))
+                return true
+            }
+
             R.id.action_global_mode -> {
                 item.isChecked = !item.isChecked
                 DataStore.globalMode = item.isChecked
@@ -1142,11 +1282,33 @@ class ConfigurationFragment @JvmOverloads constructor(
         val test = TestDialog()
         val dialog = test.builder.show()
         val testJobs = mutableListOf<Job>()
-        val group = DataStore.currentGroup()
+        val routerGroup = if (adapter.inRouterGroupMode) {
+            adapter.routerGroupList.getOrNull(groupPager.currentItem)
+        } else {
+            null
+        }
+        val group = if (routerGroup == null) DataStore.currentGroup() else null
+        val groupName = routerGroup?.name ?: group!!.displayName()
 
         val mainJob = runOnDefaultDispatcher {
-            val profilesList = SagerDatabase.proxyDao.getByGroup(group.id)
+            val profilesList = UrlTestTargetResolver.resolve(
+                routerGroupId = routerGroup?.id,
+                loadRouterTargets = { routerId ->
+                    val memberIds = SagerDatabase.routerMemberDao.getByRouter(routerId)
+                        .map { it.proxyId }
+                    val entities = SagerDatabase.proxyDao.getEntities(memberIds).associateBy { it.id }
+                    memberIds.mapNotNull { entities[it] }
+                },
+                loadNormalGroupTargets = {
+                    SagerDatabase.proxyDao.getByGroup(group!!.id)
+                },
+            )
             test.proxyN = profilesList.size
+            if (routerGroup != null && profilesList.isEmpty()) {
+                runOnMainDispatcher {
+                    snackbar(getString(R.string.profile_empty)).show()
+                }
+            }
             val profiles = ConcurrentLinkedQueue(profilesList)
             repeat(DataStore.connectionTestConcurrent) {
                 testJobs.add(launch(Dispatchers.IO) {
@@ -1199,7 +1361,7 @@ class ConfigurationFragment @JvmOverloads constructor(
             test.dialogStatus.set(1)
             test.notification = ConnectionTestNotification(
                 dialog.context,
-                "[${group.displayName()}] ${getString(R.string.connection_test)}"
+                "[$groupName] ${getString(R.string.connection_test)}"
             )
             dialog.hide()
         }
@@ -1211,6 +1373,13 @@ class ConfigurationFragment @JvmOverloads constructor(
 
         var selectedGroupIndex = 0
         var groupList: ArrayList<ProxyGroup> = ArrayList()
+
+        /** Router groups shown when [inRouterGroupMode] is true. */
+        var routerGroupList: ArrayList<RouterGroup> = ArrayList()
+
+        /** True when the user has switched to the router-group view. */
+        var inRouterGroupMode: Boolean = false
+
         var groupFragments: HashMap<Long, GroupFragment> = HashMap()
         private val reloadGeneration = AtomicLong()
 
@@ -1222,58 +1391,116 @@ class ConfigurationFragment @JvmOverloads constructor(
             }
 
             runOnDefaultDispatcher {
-                var newGroupList = ArrayList(SagerDatabase.groupDao.allGroups())
-                if (newGroupList.isEmpty()) {
-                    SagerDatabase.groupDao.createGroup(ProxyGroup(ungrouped = true))
-                    newGroupList = ArrayList(SagerDatabase.groupDao.allGroups())
-                }
-                newGroupList.find { it.ungrouped }?.let {
-                    if (SagerDatabase.proxyDao.countByGroup(it.id) == 0L) {
-                        newGroupList.remove(it)
-                    }
-                }
-
-                if (generation != reloadGeneration.get()) return@runOnDefaultDispatcher
-
-                var selectedGroup = selectedItem?.groupId ?: DataStore.currentGroupId()
-                var newSelectedGroupIndex: Int? = null
-                if (selectedGroup > 0L) {
-                    newSelectedGroupIndex = newGroupList.indexOfFirst { it.id == selectedGroup }
-                } else if (groupList.size == 1) {
-                    selectedGroup = groupList[0].id
-                    if (DataStore.selectedGroup != selectedGroup) {
-                        DataStore.selectedGroup = selectedGroup
-                    }
-                }
-
-                val runFunc = if (now) activity?.let { it::runOnUiThread } else groupPager::post
-                if (runFunc != null) {
-                    val reloadAdapter = this@GroupPagerAdapter
-                    runFunc {
-                        val viewOwner = viewLifecycleOwnerLiveData.value
-                        if (generation == reloadGeneration.get() && viewOwner != null &&
-                            isCurrentGroupPagerAdapter(reloadAdapter)
-                        ) {
-                            viewOwner.lifecycleScope.launch(Dispatchers.Main.immediate) {
-                                profileStateInitialized.await()
-                                if (generation != reloadGeneration.get() ||
-                                    viewLifecycleOwnerLiveData.value !== viewOwner ||
-                                    !isCurrentGroupPagerAdapter(reloadAdapter)
-                                ) {
-                                    return@launch
-                                }
-                                refreshProfileState()
-                                newSelectedGroupIndex?.let { selectedGroupIndex = it }
-                                groupList = newGroupList
-                                notifyDataSetChanged()
-                                if (newSelectedGroupIndex != null) {
-                                    groupPager.setCurrentItem(selectedGroupIndex, false)
+                // Determine view mode
+                val wantRouterMode = !select && DataStore.viewModeRouterGroups &&
+                        RouterGroupRepository.all().isNotEmpty()
+
+                if (wantRouterMode) {
+                    // ----- Router-group mode -----
+                    if (SagerDatabase.routerMemberDao.all().isEmpty() && SagerDatabase.proxyDao.getAll().isNotEmpty()) {
+                        runCatching {
+                            GroupManager.reconcileRouterMembers(GroupManager.snapshotRouterMembers())
+                        }
+                    }
+                    val newRouterList = ArrayList(RouterGroupRepository.all())
+
+                    if (generation != reloadGeneration.get()) return@runOnDefaultDispatcher
+
+                    // Refresh selection snapshot for all router groups
+                    val selectionSnapshot = newRouterList.associate { it.id to it.selectedProxyId }
+
+                    val runFunc = if (now) activity?.let { it::runOnUiThread } else groupPager::post
+                    if (runFunc != null) {
+                        val reloadAdapter = this@GroupPagerAdapter
+                        runFunc {
+                            val viewOwner = viewLifecycleOwnerLiveData.value
+                            if (generation == reloadGeneration.get() && viewOwner != null &&
+                                isCurrentGroupPagerAdapter(reloadAdapter)
+                            ) {
+                                viewOwner.lifecycleScope.launch(Dispatchers.Main.immediate) {
+                                    profileStateInitialized.await()
+                                    if (generation != reloadGeneration.get() ||
+                                        viewLifecycleOwnerLiveData.value !== viewOwner ||
+                                        !isCurrentGroupPagerAdapter(reloadAdapter)
+                                    ) {
+                                        return@launch
+                                    }
+                                    routerGroupSelectionSnapshot = selectionSnapshot
+                                    inRouterGroupMode = true
+                                    routerGroupList = newRouterList
+                                    val groupsById = newRouterList.associateBy { it.id }
+                                    groupFragments.keys.retainAll(groupsById.keys.map { -it }.toSet())
+                                    groupFragments.values.forEach { fragment ->
+                                        fragment.routerGroup = groupsById[fragment.routerGroup?.id]
+                                    }
+                                    notifyDataSetChanged()
+                                    groupPager.setCurrentItem(0, false)
+                                    val hideTab = routerGroupList.size < 2
+                                    tabLayout.isGone = hideTab
+                                    toolbar.elevation = if (hideTab) 0F else dp2px(4).toFloat()
+                                    // Refresh tab labels
+                                    tabLayout.invalidate()
                                 }
-                                val hideTab = groupList.size < 2
-                                tabLayout.isGone = hideTab
-                                toolbar.elevation = if (hideTab) 0F else dp2px(4).toFloat()
-                                if (!select) {
-                                    groupPager.registerOnPageChangeCallback(updateSelectedCallback)
+                            }
+                        }
+                    }
+                } else {
+                    // ----- Normal proxy-group mode -----
+                    var newGroupList = ArrayList(SagerDatabase.groupDao.allGroups())
+                    if (newGroupList.isEmpty()) {
+                        SagerDatabase.groupDao.createGroup(ProxyGroup(ungrouped = true))
+                        newGroupList = ArrayList(SagerDatabase.groupDao.allGroups())
+                    }
+                    newGroupList.find { it.ungrouped }?.let {
+                        if (SagerDatabase.proxyDao.countByGroup(it.id) == 0L) {
+                            newGroupList.remove(it)
+                        }
+                    }
+
+                    if (generation != reloadGeneration.get()) return@runOnDefaultDispatcher
+
+                    var selectedGroup = selectedItem?.groupId ?: DataStore.currentGroupId()
+                    var newSelectedGroupIndex: Int? = null
+                    if (selectedGroup > 0L) {
+                        newSelectedGroupIndex = newGroupList.indexOfFirst { it.id == selectedGroup }
+                    } else if (groupList.size == 1) {
+                        selectedGroup = groupList[0].id
+                        if (DataStore.selectedGroup != selectedGroup) {
+                            DataStore.selectedGroup = selectedGroup
+                        }
+                    }
+
+                    val runFunc = if (now) activity?.let { it::runOnUiThread } else groupPager::post
+                    if (runFunc != null) {
+                        val reloadAdapter = this@GroupPagerAdapter
+                        runFunc {
+                            val viewOwner = viewLifecycleOwnerLiveData.value
+                            if (generation == reloadGeneration.get() && viewOwner != null &&
+                                isCurrentGroupPagerAdapter(reloadAdapter)
+                            ) {
+                                viewOwner.lifecycleScope.launch(Dispatchers.Main.immediate) {
+                                    profileStateInitialized.await()
+                                    if (generation != reloadGeneration.get() ||
+                                        viewLifecycleOwnerLiveData.value !== viewOwner ||
+                                        !isCurrentGroupPagerAdapter(reloadAdapter)
+                                    ) {
+                                        return@launch
+                                    }
+                                    refreshProfileState()
+                                    inRouterGroupMode = false
+                                    newSelectedGroupIndex?.let { selectedGroupIndex = it }
+                                    groupList = newGroupList
+                                    groupFragments.keys.retainAll(newGroupList.map { it.id }.toSet())
+                                    notifyDataSetChanged()
+                                    if (newSelectedGroupIndex != null) {
+                                        groupPager.setCurrentItem(selectedGroupIndex, false)
+                                    }
+                                    val hideTab = groupList.size < 2
+                                    tabLayout.isGone = hideTab
+                                    toolbar.elevation = if (hideTab) 0F else dp2px(4).toFloat()
+                                    if (!select) {
+                                        groupPager.registerOnPageChangeCallback(updateSelectedCallback)
+                                    }
                                 }
                             }
                         }
@@ -1287,28 +1514,48 @@ class ConfigurationFragment @JvmOverloads constructor(
         }
 
         override fun getItemCount(): Int {
-            return groupList.size
+            return if (inRouterGroupMode) routerGroupList.size else groupList.size
         }
 
         override fun createFragment(position: Int): Fragment {
-            return GroupFragment().apply {
-                proxyGroup = groupList[position]
-                groupFragments[proxyGroup.id] = this
-                if (position == selectedGroupIndex) {
-                    selected = true
+            return if (inRouterGroupMode) {
+                GroupFragment().apply {
+                    proxyGroup = ProxyGroup(ungrouped = true) // placeholder – not actually used in router mode
+                    routerGroup = routerGroupList[position]
+                    val key = -(routerGroupList[position].id) // negative to avoid collision with ProxyGroup ids
+                    groupFragments[key] = this
+                    selected = position == selectedGroupIndex
+                }
+            } else {
+                GroupFragment().apply {
+                    proxyGroup = groupList[position]
+                    groupFragments[proxyGroup.id] = this
+                    if (position == selectedGroupIndex) {
+                        selected = true
+                    }
                 }
             }
         }
 
         override fun getItemId(position: Int): Long {
-            return groupList[position].id
+            return if (inRouterGroupMode) {
+                // Use negative IDs for router groups to avoid collision with proxy group IDs
+                -(routerGroupList[position].id)
+            } else {
+                groupList[position].id
+            }
         }
 
         override fun containsItem(itemId: Long): Boolean {
-            return groupList.any { it.id == itemId }
+            return if (inRouterGroupMode) {
+                routerGroupList.any { -(it.id) == itemId }
+            } else {
+                groupList.any { it.id == itemId }
+            }
         }
 
         override suspend fun groupAdd(group: ProxyGroup) {
+            if (inRouterGroupMode) return
             tabLayout.post {
                 groupList.add(group)
 
@@ -1322,6 +1569,7 @@ class ConfigurationFragment @JvmOverloads constructor(
         }
 
         override suspend fun groupRemoved(groupId: Long) {
+            if (inRouterGroupMode) return
             val index = groupList.indexOfFirst { it.id == groupId }
             if (index == -1) return
 
@@ -1332,6 +1580,7 @@ class ConfigurationFragment @JvmOverloads constructor(
         }
 
         override suspend fun groupUpdated(group: ProxyGroup) {
+            if (inRouterGroupMode) return
             val index = groupList.indexOfFirst { it.id == group.id }
             if (index == -1) return
 
@@ -1342,7 +1591,13 @@ class ConfigurationFragment @JvmOverloads constructor(
 
         override suspend fun groupUpdated(groupId: Long) = Unit
 
+        override suspend fun routerGroupsUpdated() {
+            if (!inRouterGroupMode) return
+            refreshRouterGroupSelections()
+        }
+
         override suspend fun onAdd(profile: ProxyEntity) {
+            if (inRouterGroupMode) return
             if (groupList.find { it.id == profile.groupId } == null) {
                 DataStore.selectedGroup = profile.groupId
                 reload()
@@ -1354,6 +1609,7 @@ class ConfigurationFragment @JvmOverloads constructor(
         override suspend fun onUpdated(profile: ProxyEntity, noTraffic: Boolean) = Unit
 
         override suspend fun onRemoved(groupId: Long, profileId: Long) {
+            if (inRouterGroupMode) return
             val group = groupList.find { it.id == groupId } ?: return
             if (group.ungrouped && SagerDatabase.proxyDao.countByGroup(groupId) == 0L) {
                 reload()
@@ -1364,6 +1620,12 @@ class ConfigurationFragment @JvmOverloads constructor(
     class GroupFragment : Fragment() {
 
         lateinit var proxyGroup: ProxyGroup
+
+        /** Non-null when this fragment represents a tab in router-group view mode. */
+        var routerGroup: RouterGroup? = null
+
+        val inRouterGroupMode get() = routerGroup != null
+
         var selected = false
 
         override fun onCreateView(
@@ -1383,13 +1645,23 @@ class ConfigurationFragment @JvmOverloads constructor(
             if (::proxyGroup.isInitialized) {
                 outState.putParcelable("proxyGroup", proxyGroup)
             }
+            routerGroup?.let {
+                outState.putParcelable("routerGroup", it)
+            }
         }
 
         override fun onViewStateRestored(savedInstanceState: Bundle?) {
             super.onViewStateRestored(savedInstanceState)
 
+            var restored = false
             savedInstanceState?.getParcelable<ProxyGroup>("proxyGroup")?.also {
                 proxyGroup = it
+                restored = true
+            }
+            savedInstanceState?.getParcelable<RouterGroup>("routerGroup")?.also {
+                routerGroup = it
+            }
+            if (restored && !::configurationListView.isInitialized) {
                 onViewCreated(requireView(), null)
             }
         }
@@ -1495,7 +1767,7 @@ class ConfigurationFragment @JvmOverloads constructor(
         override fun onResume() {
             super.onResume()
 
-            if (::configurationListView.isInitialized && configurationListView.size == 0) {
+            if (::configurationListView.isInitialized && (adapter?.itemCount ?: 0) == 0) {
                 configurationListView.adapter = adapter
                 runOnDefaultDispatcher {
                     adapter?.reloadProfiles()
@@ -1509,6 +1781,8 @@ class ConfigurationFragment @JvmOverloads constructor(
 
         fun checkOrderMenu() {
             if (select) return
+            // Sort/order menu doesn't apply in router-group mode
+            if (inRouterGroupMode) return
 
             val pf = requireParentFragment() as? ToolbarFragment ?: return
             val menu = pf.toolbar.menu
@@ -1636,40 +1910,50 @@ class ConfigurationFragment @JvmOverloads constructor(
                 }
             })
 
+            val adapterKey = if (inRouterGroupMode) {
+                routerGroup?.id?.let { -it }
+            } else {
+                proxyGroup.id
+            }
+            if (adapterKey != null) {
+                (parentFragment as? ConfigurationFragment)?.adapter?.groupFragments?.put(adapterKey, this)
+            }
+
             if (!select) {
-                undoManager = UndoSnackbarManager(activity as MainActivity, adapter!!)
+                if (!inRouterGroupMode) {
+                    undoManager = UndoSnackbarManager(activity as MainActivity, adapter!!)
+                }
                 setupItemTouchHelper()
-                setupBottomBarScrollDriver()
+            }
+
+            runOnDefaultDispatcher {
+                adapter?.reloadProfiles()
             }
         }
 
-        private fun setupBottomBarScrollDriver() {
-            val mainActivity = activity as? MainActivity ?: return
-            configurationListView.addOnScrollListener(object : RecyclerView.OnScrollListener() {
-                override fun onScrolled(recyclerView: RecyclerView, dx: Int, dy: Int) {
-                    if (dy != 0) mainActivity.driveBottomBar(dy)
-                }
-            })
+        override fun onDestroyView() {
+            val adapterKey = if (inRouterGroupMode) {
+                routerGroup?.id?.let { -it }
+            } else if (::proxyGroup.isInitialized) {
+                proxyGroup.id
+            } else null
+            if (adapterKey != null) {
+                val fragments = (parentFragment as? ConfigurationFragment)?.adapter?.groupFragments
+                if (fragments?.get(adapterKey) === this) fragments?.remove(adapterKey)
+            }
 
-            val touchSlop = ViewConfiguration.get(requireContext()).scaledTouchSlop
-            var lastRawY = 0f
-            configurationListView.setOnTouchListener { recyclerView, event ->
-                when (event.actionMasked) {
-                    MotionEvent.ACTION_DOWN -> lastRawY = event.rawY
-                    MotionEvent.ACTION_MOVE -> {
-                        val cannotScroll = !recyclerView.canScrollVertically(-1) &&
-                                !recyclerView.canScrollVertically(1)
-                        if (cannotScroll) {
-                            val fingerDy = event.rawY - lastRawY
-                            if (abs(fingerDy) >= touchSlop) {
-                                mainActivity.driveBottomBar(-fingerDy.toInt())
-                                lastRawY = event.rawY
-                            }
-                        }
-                    }
-                }
-                false
+            adapter?.let {
+                ProfileManager.removeListener(it)
+                GroupManager.removeListener(it)
+            }
+            if (::undoManager.isInitialized) {
+                undoManager.flush()
             }
+            if (::itemTouchHelper.isInitialized) {
+                itemTouchHelper.attachToRecyclerView(null)
+            }
+            adapter = null
+            super.onDestroyView()
         }
 
         override fun onDestroy() {
@@ -1881,25 +2165,41 @@ class ConfigurationFragment @JvmOverloads constructor(
             }
 
             private val updated = HashSet<ProxyEntity>()
+            private var routerOrderChanged = false
 
             fun filter(name: String) {
                 if (name.isEmpty()) {
                     reloadProfiles()
                     return
                 }
-                configurationIdList.clear()
                 val lower = name.lowercase()
-                configurationIdList.addAll(configurationList.filter {
-                    it.value.displayName().lowercase().contains(lower) ||
-                            it.value.displayType().lowercase().contains(lower) ||
-                            it.value.displayAddress().lowercase().contains(lower)
-                }.keys)
+                configurationIdList.clear()
+                // Runs on every keystroke: Map.filter() would allocate an intermediate
+                // map plus a key collection, and lowercase() one copy per field per
+                // profile. Iterating in place and comparing case-insensitively keeps it
+                // allocation free.
+                configurationList.forEach { (id, entity) ->
+                    if (entity.displayName().contains(lower, ignoreCase = true) ||
+                        entity.displayType().contains(lower, ignoreCase = true) ||
+                        entity.displayAddress().contains(lower, ignoreCase = true)
+                    ) {
+                        configurationIdList.add(id)
+                    }
+                }
                 notifyDataSetChanged()
             }
 
             fun move(from: Int, to: Int) {
                 if (from == to) return
 
+                if (inRouterGroupMode) {
+                    val draggedItemId = configurationIdList.removeAt(from)
+                    configurationIdList.add(to, draggedItemId)
+                    routerOrderChanged = true
+                    notifyItemMoved(from, to)
+                    return
+                }
+
                 if (layoutManager is FixedGridLayoutManager) {
                     moveDualColumn(from, to)
                 } else {
@@ -1945,12 +2245,35 @@ class ConfigurationFragment @JvmOverloads constructor(
                 notifyItemMoved(from, to)
             }
 
-            fun commitMove() = runOnDefaultDispatcher {
-                updated.forEach { SagerDatabase.proxyDao.updateProxy(it) }
+            fun commitMove() {
+                val rg = routerGroup
+                if (inRouterGroupMode && rg != null) {
+                    if (!routerOrderChanged) return
+                    routerOrderChanged = false
+                    val orderedIds = ArrayList(configurationIdList)
+                    runOnDefaultDispatcher {
+                        SagerDatabase.routerMemberDao.updateOrders(rg.id, orderedIds)
+                        if (DataStore.serviceState.started) {
+                            SagerNet.reloadService()
+                        }
+                        onMainDispatcher {
+                            if (layoutManager is FixedGridLayoutManager) {
+                                notifyDataSetChanged()
+                            }
+                        }
+                    }
+                    return
+                }
+
+                val toUpdate = ArrayList(updated)
                 updated.clear()
-                onMainDispatcher {
-                    if (layoutManager is FixedGridLayoutManager) {
-                        notifyDataSetChanged()
+                if (toUpdate.isEmpty()) return
+                runOnDefaultDispatcher {
+                    toUpdate.forEach { SagerDatabase.proxyDao.updateProxy(it) }
+                    onMainDispatcher {
+                        if (layoutManager is FixedGridLayoutManager) {
+                            notifyDataSetChanged()
+                        }
                     }
                 }
             }
@@ -2004,12 +2327,20 @@ class ConfigurationFragment @JvmOverloads constructor(
             }
 
             override suspend fun onAdd(profile: ProxyEntity) {
-                if (profile.groupId != proxyGroup.id) return
+                if (!inRouterGroupMode) {
+                    if (profile.groupId != proxyGroup.id) return
+                } else {
+                    val rg = routerGroup ?: return
+                    val isMember = SagerDatabase.routerMemberDao.getByRouter(rg.id).any { it.proxyId == profile.id }
+                    if (!isMember) return
+                }
 
-                configurationListView.post {
+                runOnMainDispatcher {
+                    if (!isAdded || !::configurationListView.isInitialized) return@runOnMainDispatcher
                     if (::undoManager.isInitialized) {
                         undoManager.flush()
                     }
+                    if (profile.id in configurationIdList) return@runOnMainDispatcher
                     val pos = itemCount
                     configurationList[profile.id] = profile
                     configurationIdList.add(profile.id)
@@ -2019,13 +2350,15 @@ class ConfigurationFragment @JvmOverloads constructor(
             }
 
             override suspend fun onUpdated(profile: ProxyEntity, noTraffic: Boolean) {
-                if (profile.groupId != proxyGroup.id) return
+                if (!inRouterGroupMode && profile.groupId != proxyGroup.id) return
+                if (inRouterGroupMode && !configurationList.containsKey(profile.id)) return
                 if (noTraffic) {
                     (parentFragment as? ConfigurationFragment)?.refreshProfileState()
                 }
                 val index = configurationIdList.indexOf(profile.id)
                 if (index < 0) return
-                configurationListView.post {
+                runOnMainDispatcher {
+                    if (!isAdded || !::configurationListView.isInitialized) return@runOnMainDispatcher
                     if (::undoManager.isInitialized) {
                         undoManager.flush()
                     }
@@ -2044,7 +2377,7 @@ class ConfigurationFragment @JvmOverloads constructor(
                             cachedProfile.dirty != updatedProfile.dirty ||
                             cachedProfile.displayName() != updatedProfile.displayName()
                     configurationList[profile.id] = updatedProfile
-                    if (noTraffic && !contentChanged) return@post
+                    if (noTraffic && !contentChanged) return@runOnMainDispatcher
 
                     val newHasMiddleRow = hasMiddleRow(updatedProfile)
                     val holder = layoutManager.findViewByPosition(index)
@@ -2079,11 +2412,13 @@ class ConfigurationFragment @JvmOverloads constructor(
             }
 
             override suspend fun onRemoved(groupId: Long, profileId: Long) {
-                if (groupId != proxyGroup.id) return
+                if (!inRouterGroupMode && groupId != proxyGroup.id) return
+                if (inRouterGroupMode && !configurationList.containsKey(profileId)) return
                 val index = configurationIdList.indexOf(profileId)
                 if (index < 0) return
 
-                configurationListView.post {
+                runOnMainDispatcher {
+                    if (!isAdded || !::configurationListView.isInitialized) return@runOnMainDispatcher
                     configurationIdList.removeAt(index)
                     configurationList.remove(profileId)
                     notifyItemRemoved(index)
@@ -2106,18 +2441,34 @@ class ConfigurationFragment @JvmOverloads constructor(
                 reloadProfiles()
             }
 
-            fun reloadProfiles() {
-                var newProfiles = SagerDatabase.proxyDao.getByGroup(proxyGroup.id)
-                when (proxyGroup.order) {
-                    GroupOrder.BY_NAME -> {
-                        newProfiles = newProfiles.sortedBy { it.displayName() }
-
-                    }
+            override suspend fun routerGroupsUpdated() {
+                if (inRouterGroupMode) {
+                    reloadProfiles()
+                }
+            }
 
-                    GroupOrder.BY_DELAY -> {
-                        newProfiles =
-                            newProfiles.sortedBy { if (it.status == 1) it.ping else 114514 }
+            fun reloadProfiles() {
+                val rg = routerGroup
+                val newProfiles: List<ProxyEntity>
+                if (rg != null) {
+                    // Router-group mode: load members from the router group
+                    val memberIds = SagerDatabase.routerMemberDao.getByRouter(rg.id)
+                        .sortedBy { it.userOrder }
+                        .map { it.proxyId }
+                    val entities = SagerDatabase.proxyDao.getEntities(memberIds).associateBy { it.id }
+                    newProfiles = memberIds.mapNotNull { entities[it] }
+                } else {
+                    // Normal proxy-group mode
+                    var list = SagerDatabase.proxyDao.getByGroup(proxyGroup.id)
+                    when (proxyGroup.order) {
+                        GroupOrder.BY_NAME -> {
+                            list = list.sortedBy { it.displayName() }
+                        }
+                        GroupOrder.BY_DELAY -> {
+                            list = list.sortedBy { if (it.status == 1) it.ping else 114514 }
+                        }
                     }
+                    newProfiles = list
                 }
 
                 val newProfileMap = newProfiles.associateBy { it.id }
@@ -2125,12 +2476,19 @@ class ConfigurationFragment @JvmOverloads constructor(
 
                 var selectedProfileIndex = -1
 
-                if (selected) {
+                if (rg != null) {
+                    // In router-group mode, scroll to the currently selected node
+                    selectedProfileIndex = newProfileIds.indexOf(
+                        (parentFragment as? ConfigurationFragment)
+                            ?.selectedProfileInRouterGroup(rg)
+                    )
+                } else if (selected) {
                     val selectedProxy = selectedItem?.id ?: DataStore.selectedProxy
                     selectedProfileIndex = newProfileIds.indexOf(selectedProxy)
                 }
 
-                configurationListView.post {
+                runOnMainDispatcher {
+                    if (!isAdded || !::configurationListView.isInitialized) return@runOnMainDispatcher
                     configurationList.clear()
                     configurationList.putAll(newProfileMap)
                     configurationIdList.clear()
@@ -2142,7 +2500,6 @@ class ConfigurationFragment @JvmOverloads constructor(
                     } else if (newProfiles.isNotEmpty()) {
                         configurationListView.scrollTo(0, true)
                     }
-
                 }
             }
 
@@ -2240,36 +2597,65 @@ class ConfigurationFragment @JvmOverloads constructor(
 
             private fun selectProfile(proxyEntity: ProxyEntity) {
                 val pf = parentFragment as? ConfigurationFragment ?: return
-                runOnDefaultDispatcher {
-                    var update: Boolean
-                    var lastSelected: Long
-                    profileAccess.withLock {
-                        update = DataStore.selectedProxy != proxyEntity.id
-                        lastSelected = DataStore.selectedProxy
-                        DataStore.selectedProxy = proxyEntity.id
-                        onMainDispatcher {
-                            pf.updateSelectedProxySnapshot(proxyEntity.id)
+                val rg = routerGroup
+                if (rg != null) {
+                    // --- Router-group mode: select the node inside this router group ---
+                    if (rg.mode != RouterGroup.MODE_SELECTOR) {
+                        // URL_TEST groups auto-select; don't allow manual selection
+                        return
+                    }
+                    runOnDefaultDispatcher {
+                        try {
+                            val updated = RouterGroupRepository.select(rg.id, proxyEntity.id)
+                            // Update in-memory routerGroup reference
+                            routerGroup = updated
+                            onMainDispatcher {
+                                pf.updateRouterGroupSelectionSnapshot(rg.id, proxyEntity.id)
+                                adapter?.notifyDataSetChanged()
+                            }
+                            if (DataStore.serviceState.canStop) {
+                                SagerNet.reloadService(routerTag = updated.stableTag, routerProxyId = proxyEntity.id)
+                            }
+                        } catch (e: Exception) {
+                            Logs.w(e)
+                            onMainDispatcher {
+                                snackbar(e.readableMessage).show()
+                            }
                         }
                     }
-
-                    if (update) {
-                        ProfileManager.postUpdate(lastSelected, noTraffic = true)
-                        if (DataStore.serviceState.canStop && reloadAccess.tryLock()) {
-                            SagerNet.reloadService()
-                            reloadAccess.unlock()
+                } else {
+                    // --- Normal proxy-group mode ---
+                    runOnDefaultDispatcher {
+                        var update: Boolean
+                        var lastSelected: Long
+                        profileAccess.withLock {
+                            update = DataStore.selectedProxy != proxyEntity.id
+                            lastSelected = DataStore.selectedProxy
+                            DataStore.selectedProxy = proxyEntity.id
+                            onMainDispatcher {
+                                pf.updateSelectedProxySnapshot(proxyEntity.id)
+                            }
                         }
-                    } else if (SagerNet.isTv) {
-                        if (DataStore.serviceState.started) {
-                            SagerNet.stopService()
-                        } else {
-                            SagerNet.startService()
+
+                        if (update) {
+                            ProfileManager.postUpdate(lastSelected, noTraffic = true)
+                            if (DataStore.serviceState.canStop && reloadAccess.tryLock()) {
+                                SagerNet.reloadService()
+                                reloadAccess.unlock()
+                            }
+                        } else if (SagerNet.isTv) {
+                            if (DataStore.serviceState.started) {
+                                SagerNet.stopService()
+                            } else {
+                                SagerNet.startService()
+                            }
                         }
                     }
                 }
             }
 
             private fun removeProfile(proxyEntity: ProxyEntity) {
-                if (select) return
+                if (select || inRouterGroupMode) return
                 val currentAdapter = adapter ?: return
                 val index = currentAdapter.configurationIdList.indexOf(proxyEntity.id)
                 if (index < 0) return
@@ -2422,16 +2808,17 @@ class ConfigurationFragment @JvmOverloads constructor(
 
                 val selectOrChain = select || proxyEntity.type == ProxyEntity.TYPE_CHAIN
                 val isDoubleColumn = layoutManager is FixedGridLayoutManager
-                
+                val isRgMode = inRouterGroupMode
+
                 if (isDoubleColumn) {
                     editButton.isGone = true
                     shareLayout.isGone = true
                     removeButton.isGone = true
-                    doubleColumnMenuButton.isVisible = true
+                    doubleColumnMenuButton.isVisible = !isRgMode
                 } else {
-                    shareLayout.isGone = selectOrChain
-                    editButton.isGone = select
-                    removeButton.isGone = select
+                    shareLayout.isGone = selectOrChain || isRgMode
+                    editButton.isGone = select || isRgMode
+                    removeButton.isGone = select || isRgMode
                     doubleColumnMenuButton.isGone = true
                 }
 
@@ -2441,14 +2828,19 @@ class ConfigurationFragment @JvmOverloads constructor(
                     }
                 }
 
-                val selected = pf.isSelectedProfile(proxyEntity.id)
+                val rg = routerGroup
+                val selected = if (rg != null) {
+                    pf.isSelectedProfileInRouterGroup(rg, proxyEntity.id)
+                } else {
+                    pf.isSelectedProfile(proxyEntity.id)
+                }
                 val started =
                     selected && DataStore.serviceState.started && pf.isCurrentProfile(proxyEntity.id)
                 editButton.isEnabled = !started
                 removeButton.isEnabled = !started
                 applySelected(selected)
 
-                if (!(select || proxyEntity.type == ProxyEntity.TYPE_CHAIN)) {
+                if (!(select || proxyEntity.type == ProxyEntity.TYPE_CHAIN || isRgMode)) {
                     shareLayer.setBackgroundColor(Color.TRANSPARENT)
                     shareButton.setImageResource(R.drawable.ic_social_share)
                     shareButton.setColorFilter(Color.GRAY)
@@ -2466,7 +2858,12 @@ class ConfigurationFragment @JvmOverloads constructor(
                     return
                 }
                 val pf = parentFragment as? ConfigurationFragment ?: return
-                val selected = pf.isSelectedProfile(proxyEntity.id)
+                val rg = routerGroup
+                val selected = if (rg != null) {
+                    pf.isSelectedProfileInRouterGroup(rg, proxyEntity.id)
+                } else {
+                    pf.isSelectedProfile(proxyEntity.id)
+                }
                 val started = selected && DataStore.serviceState.started &&
                         pf.isCurrentProfile(proxyEntity.id)
                 editButton.isEnabled = !started
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/GroupFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/GroupFragment.kt
index 840234b549..718fa9d681 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/GroupFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/GroupFragment.kt
@@ -7,6 +7,7 @@ import android.view.MenuItem
 import android.view.View
 import android.view.ViewGroup
 import android.widget.LinearLayout
+import android.widget.TextView
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.widget.PopupMenu
 import androidx.appcompat.widget.Toolbar
@@ -37,6 +38,7 @@ class GroupFragment : ToolbarFragment(R.layout.layout_group),
 
     lateinit var activity: MainActivity
     lateinit var groupListView: RecyclerView
+    lateinit var routerSection: View
     lateinit var layoutManager: LinearLayoutManager
     lateinit var groupAdapter: GroupAdapter
     lateinit var undoManager: UndoSnackbarManager<ProxyGroup>
@@ -51,6 +53,12 @@ class GroupFragment : ToolbarFragment(R.layout.layout_group),
         toolbar.setOnMenuItemClickListener(this)
 
         groupListView = view.findViewById(R.id.group_list)
+        routerSection = view.findViewById(R.id.router_section)
+        routerSection.isVisible = true
+        routerSection.setOnClickListener {
+            startActivity(Intent(requireContext(), RouterGroupListActivity::class.java))
+        }
+        updateRouterSection()
         layoutManager = FixedLinearLayoutManager(groupListView)
         groupListView.layoutManager = layoutManager
         groupAdapter = GroupAdapter()
@@ -544,4 +552,23 @@ class GroupFragment : ToolbarFragment(R.layout.layout_group),
         }
     }
 
-}
\ No newline at end of file
+    override fun onResume() {
+        super.onResume()
+        updateRouterSection()
+    }
+
+    private fun updateRouterSection() {
+        val routerSubtitle = view?.findViewById<TextView>(R.id.router_subtitle) ?: return
+        runOnDefaultDispatcher {
+            val count = runCatching { SagerDatabase.routerGroupDao.all().size }.getOrDefault(0)
+            onMainDispatcher {
+                if (count > 0) {
+                    routerSubtitle.text = getString(R.string.router_groups_card_summary_with_count, count)
+                } else {
+                    routerSubtitle.text = getString(R.string.router_groups_card_summary)
+                }
+            }
+        }
+    }
+
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/LogcatFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/LogcatFragment.kt
index 2f276ee9fe..11fd8256f0 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/LogcatFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/LogcatFragment.kt
@@ -2,7 +2,6 @@ package io.nekohasekai.sagernet.ui
 
 import android.annotation.SuppressLint
 import android.graphics.Color
-import android.os.Build
 import android.os.Bundle
 import android.text.SpannableString
 import android.text.Spanned.SPAN_EXCLUSIVE_EXCLUSIVE
@@ -35,9 +34,7 @@ class LogcatFragment : ToolbarFragment(R.layout.layout_logcat),
 
         binding = LayoutLogcatBinding.bind(view)
 
-        if (Build.VERSION.SDK_INT >= 23) {
-            binding.textview.breakStrategy = 0 // simple
-        }
+        binding.textview.breakStrategy = 0 // simple
 
         ViewCompat.setOnApplyWindowInsetsListener(binding.root, ListListener)
 
@@ -105,7 +102,7 @@ class LogcatFragment : ToolbarFragment(R.layout.layout_logcat),
             R.id.action_send_logcat -> {
                 val context = requireContext()
                 runOnDefaultDispatcher {
-                    SendLog.sendLog(context, "NB4A")
+                    SendLog.sendLog(context, "Asteria")
                 }
             }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/MainActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/MainActivity.kt
index 5b11495849..542a85ac86 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/MainActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/MainActivity.kt
@@ -7,7 +7,6 @@ import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.net.Uri
-import android.os.Build
 import android.os.Bundle
 import android.os.RemoteException
 import android.view.KeyEvent
@@ -36,6 +35,7 @@ import io.nekohasekai.sagernet.database.GroupManager
 import io.nekohasekai.sagernet.database.ProfileManager
 import io.nekohasekai.sagernet.database.ProxyGroup
 import io.nekohasekai.sagernet.database.SubscriptionBean
+import io.nekohasekai.sagernet.database.RouterGroupRepository
 import io.nekohasekai.sagernet.database.preference.OnPreferenceDataStoreChangeListener
 import io.nekohasekai.sagernet.databinding.LayoutMainBinding
 import io.nekohasekai.sagernet.fmt.AbstractBean
@@ -102,7 +102,6 @@ class MainActivity : ThemedActivity(),
                 null
             )
         }
-        binding.stats.setOnClickListener { if (DataStore.serviceState.connected) binding.stats.testConnection() }
 
         setContentView(binding.root)
         currentMainFragment =
@@ -120,22 +119,28 @@ class MainActivity : ThemedActivity(),
         DataStore.configurationStore.registerChangeListener(this)
         GroupManager.userInterface = GroupInterfaceAdapter(this)
 
+        runOnDefaultDispatcher {
+            if (RouterGroupRepository.all().isNotEmpty()) {
+                runCatching {
+                    GroupManager.reconcileRouterMembers(GroupManager.snapshotRouterMembers())
+                }
+            }
+        }
+
         if (intent?.action == Intent.ACTION_VIEW) {
             onNewIntent(intent)
         }
 
         refreshNavMenu(DataStore.enableClashAPI)
 
-        // sdk 33 notification
-        if (Build.VERSION.SDK_INT >= 33) {
-            val checkPermission =
-                ContextCompat.checkSelfPermission(this@MainActivity, POST_NOTIFICATIONS)
-            if (checkPermission != PackageManager.PERMISSION_GRANTED) {
-                //动态申请
-                ActivityCompat.requestPermissions(
-                    this@MainActivity, arrayOf(POST_NOTIFICATIONS), 0
-                )
-            }
+        // notification permission
+        val checkPermission =
+            ContextCompat.checkSelfPermission(this@MainActivity, POST_NOTIFICATIONS)
+        if (checkPermission != PackageManager.PERMISSION_GRANTED) {
+            //动态申请
+            ActivityCompat.requestPermissions(
+                this@MainActivity, arrayOf(POST_NOTIFICATIONS), 0
+            )
         }
 
         if (isPreview) {
@@ -371,6 +376,9 @@ class MainActivity : ThemedActivity(),
     @SuppressLint("CommitTransaction")
     fun displayFragment(fragment: ToolbarFragment) {
         currentMainFragment = fragment
+        (fragment as? ConfigurationFragment)?.updateRuntimeUrlTestSelections(
+            runtimeUrlTestSelections
+        )
         supportFragmentManager.beginTransaction()
             .replace(R.id.fragment_holder, fragment)
             .commitAllowingStateLoss()
@@ -384,14 +392,7 @@ class MainActivity : ThemedActivity(),
         showWhenConnected: Boolean,
         animate: Boolean,
     ) {
-        val showControls = fragment is ConfigurationFragment || DataStore.showBottomBar
-        binding.stats.useExternalScrollDriver = fragment is ConfigurationFragment
-        binding.stats.syncMainControls(
-            showControls,
-            DataStore.serviceState,
-            showWhenConnected,
-            animate,
-        )
+        val showControls = fragment is ConfigurationFragment
         binding.fab.animate().cancel()
         if (showControls) {
             binding.fab.show()
@@ -413,10 +414,6 @@ class MainActivity : ThemedActivity(),
         (fragment as? ConfigurationFragment)?.refreshProfileState()
     }
 
-    fun driveBottomBar(scrollDy: Int) {
-        binding.stats.onListScrolled(scrollDy)
-    }
-
     fun displayFragmentWithId(@IdRes id: Int): Boolean {
         when (id) {
             R.id.nav_configuration -> {
@@ -427,18 +424,13 @@ class MainActivity : ThemedActivity(),
             R.id.nav_route -> displayFragment(RouteFragment())
             R.id.nav_settings -> displayFragment(SettingsFragment())
             R.id.nav_traffic -> displayFragment(WebviewFragment())
-            R.id.nav_tools -> displayFragment(ToolsFragment())
+            R.id.nav_tools -> displayFragment(BackupFragment())
             R.id.nav_logcat -> displayFragment(LogcatFragment())
-            R.id.nav_faq -> {
-                launchCustomTab("https://matsuridayo.github.io/")
-                return false
-            }
-
             R.id.nav_about -> displayFragment(AboutFragment())
 
             else -> return false
         }
-        navigation.menu.findItem(id).isChecked = true
+        navigation.menu.findItem(id)?.isChecked = true
         return true
     }
 
@@ -449,10 +441,12 @@ class MainActivity : ThemedActivity(),
         animateControls: Boolean = animate,
     ) {
         DataStore.serviceState = state
+        if (state != BaseService.State.Connected) {
+            updateRuntimeUrlTestSelections(longArrayOf())
+        }
         refreshConfigurationProfileState()
 
         binding.fab.changeState(state, DataStore.serviceState, animate)
-        binding.stats.changeState(state)
         syncMainControls(
             showWhenConnected = state == BaseService.State.Connected,
             animate = animateControls,
@@ -474,13 +468,23 @@ class MainActivity : ThemedActivity(),
     }
 
     val connection = SagerConnection(SagerConnection.CONNECTION_ID_MAIN_ACTIVITY_FOREGROUND, true)
-    override fun onServiceConnected(service: ISagerNetService) = changeState(
-        try {
+    override fun onServiceConnected(service: ISagerNetService) {
+        val state = try {
             BaseService.State.values()[service.state]
         } catch (_: RemoteException) {
             BaseService.State.Idle
         }
-    )
+        changeState(state)
+        updateRuntimeUrlTestSelections(
+            if (state == BaseService.State.Connected) {
+                runCatching { service.currentUrlTestSelections }.getOrDefault(longArrayOf())
+            } else {
+                longArrayOf()
+            }
+        )
+    }
+
+    private var runtimeUrlTestSelections = longArrayOf()
 
     override fun onServiceDisconnected() = changeState(BaseService.State.Idle)
     override fun onBinderDied() {
@@ -495,7 +499,16 @@ class MainActivity : ThemedActivity(),
     // may NOT called when app is in background
     // ONLY do UI update here, write DB in bg process
     override fun cbSpeedUpdate(stats: SpeedDisplayData) {
-        binding.stats.updateSpeed(stats.txRateProxy, stats.rxRateProxy)
+        updateRuntimeUrlTestSelections(stats.urlTestSelections)
+    }
+
+    private fun updateRuntimeUrlTestSelections(selections: LongArray) {
+        runtimeUrlTestSelections = selections.copyOf()
+        val fragment = currentMainFragment
+            ?: supportFragmentManager.findFragmentById(R.id.fragment_holder)
+        (fragment as? ConfigurationFragment)?.updateRuntimeUrlTestSelections(
+            runtimeUrlTestSelections
+        )
     }
 
     override suspend fun cbTrafficUpdate(data: TrafficDataBatch) {
@@ -516,10 +529,11 @@ class MainActivity : ThemedActivity(),
     override fun onPreferenceDataStoreChanged(store: PreferenceDataStore, key: String) {
         when (key) {
             Key.SERVICE_MODE -> onBinderDied()
-            Key.SHOW_BOTTOM_BAR -> syncMainControls(
-                showWhenConnected = DataStore.showBottomBar,
-                animate = true,
-            )
+            Key.SHOW_PROFILE_IN_NOTIFICATION -> {
+                if (DataStore.serviceState.canStop) {
+                    SagerNet.reloadService()
+                }
+            }
             Key.PROXY_APPS, Key.BYPASS_MODE, Key.INDIVIDUAL -> {
                 if (DataStore.serviceState.canStop) {
                     snackbar(getString(R.string.need_reload)).setAction(R.string.apply) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/NetworkFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/NetworkFragment.kt
deleted file mode 100644
index b8bb941451..0000000000
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/NetworkFragment.kt
+++ /dev/null
@@ -1,23 +0,0 @@
-package io.nekohasekai.sagernet.ui
-
-import android.content.Intent
-import android.os.Bundle
-import android.view.View
-import io.nekohasekai.sagernet.R
-import io.nekohasekai.sagernet.databinding.LayoutNetworkBinding
-import io.nekohasekai.sagernet.ktx.app
-
-class NetworkFragment : NamedFragment(R.layout.layout_network) {
-
-    override fun name0() = app.getString(R.string.tools_network)
-
-    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
-        super.onViewCreated(view, savedInstanceState)
-
-        val binding = LayoutNetworkBinding.bind(view)
-        binding.stunTest.setOnClickListener {
-            startActivity(Intent(requireContext(), StunActivity::class.java))
-        }
-    }
-
-}
\ No newline at end of file
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/QuickDisableShortcut.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/QuickDisableShortcut.kt
index 9571a75c83..cf84558e66 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/QuickDisableShortcut.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/QuickDisableShortcut.kt
@@ -22,7 +22,6 @@ package io.nekohasekai.sagernet.ui
 
 import android.app.Activity
 import android.content.pm.ShortcutManager
-import android.os.Build
 import android.os.Bundle
 import androidx.core.content.getSystemService
 import io.nekohasekai.sagernet.SagerNet
@@ -36,9 +35,7 @@ class QuickDisableShortcut : Activity(), SagerConnection.Callback {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         connection.connect(this, this)
-        if (Build.VERSION.SDK_INT >= 25) {
-            getSystemService<ShortcutManager>()!!.reportShortcutUsed("disable")
-        }
+        getSystemService<ShortcutManager>()!!.reportShortcutUsed("disable")
     }
 
     override fun onServiceConnected(service: ISagerNetService) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/QuickEnableShortcut.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/QuickEnableShortcut.kt
index 590868d186..af6afa009c 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/QuickEnableShortcut.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/QuickEnableShortcut.kt
@@ -22,7 +22,6 @@ package io.nekohasekai.sagernet.ui
 
 import android.app.Activity
 import android.content.pm.ShortcutManager
-import android.os.Build
 import android.os.Bundle
 import androidx.core.content.getSystemService
 import io.nekohasekai.sagernet.SagerNet
@@ -36,9 +35,7 @@ class QuickEnableShortcut : Activity(), SagerConnection.Callback {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         connection.connect(this, this)
-        if (Build.VERSION.SDK_INT >= 25) {
-            getSystemService<ShortcutManager>()!!.reportShortcutUsed("enable")
-        }
+        getSystemService<ShortcutManager>()!!.reportShortcutUsed("enable")
     }
 
     override fun onServiceConnected(service: ISagerNetService) {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/RouteSettingsActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/RouteSettingsActivity.kt
index 94e0b8f7d4..a721070a41 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/RouteSettingsActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/RouteSettingsActivity.kt
@@ -30,6 +30,7 @@ import io.nekohasekai.sagernet.database.ProfileManager
 import io.nekohasekai.sagernet.database.RuleEntity
 import io.nekohasekai.sagernet.database.SagerDatabase
 import io.nekohasekai.sagernet.database.preference.OnPreferenceDataStoreChangeListener
+import io.nekohasekai.sagernet.fmt.serializeRouteOutboundChoice
 import io.nekohasekai.sagernet.ktx.Logs
 import io.nekohasekai.sagernet.ktx.app
 import io.nekohasekai.sagernet.ktx.onMainDispatcher
@@ -68,7 +69,10 @@ class RouteSettingsActivity(
         DataStore.routeProtocol = protocol
         DataStore.routeRuleset = ruleset
         DataStore.routeOutboundRule = outbound
-        DataStore.routeOutbound = when (outbound) {
+        DataStore.routeOutboundRouter = routerGroupId
+        DataStore.routeOutbound = if (routerGroupId > 0L) {
+            OutboundPreference.VALUE_SELECT_ROUTER.toInt()
+        } else when (outbound) {
             0L -> 0
             -1L -> 1
             -2L -> 2
@@ -88,12 +92,14 @@ class RouteSettingsActivity(
         source = DataStore.routeSource
         protocol = DataStore.routeProtocol
         ruleset = DataStore.routeRuleset
-        outbound = when (DataStore.routeOutbound) {
-            0 -> 0L
-            1 -> -1L
-            2 -> -2L
-            else -> DataStore.routeOutboundRule
-        }
+        val outboundChoice = serializeRouteOutboundChoice(
+            DataStore.routeOutbound,
+            DataStore.routeOutboundRule,
+            DataStore.routeOutboundRouter,
+            OutboundPreference.VALUE_SELECT_ROUTER.toInt(),
+        )
+        outbound = outboundChoice.outbound
+        routerGroupId = outboundChoice.routerGroupId
         packages = DataStore.routePackages.split("\n").filter { it.isNotBlank() }.toSet()
 
         if (DataStore.editingId == 0L) {
@@ -146,6 +152,17 @@ class RouteSettingsActivity(
         apps.postUpdate()
     }
 
+    val selectRouterGroup = registerForActivityResult(
+        ActivityResultContracts.StartActivityForResult()
+    ) { (resultCode, data) ->
+        if (resultCode == Activity.RESULT_OK) {
+            DataStore.routeOutboundRouter = data?.getLongExtra(
+                RouterGroupSelectActivity.EXTRA_ROUTER_ID, 0L
+            ) ?: 0L
+            outbound.value = OutboundPreference.VALUE_SELECT_ROUTER
+        }
+    }
+
     lateinit var outbound: OutboundPreference
     lateinit var apps: AppListPreference
 
@@ -165,6 +182,13 @@ class RouteSettingsActivity(
                     }
                 )
                 false
+            } else if (newValue.toString() == OutboundPreference.VALUE_SELECT_ROUTER) {
+                selectRouterGroup.launch(
+                    Intent(this@RouteSettingsActivity, RouterGroupSelectActivity::class.java).apply {
+                        putExtra(RouterGroupSelectActivity.EXTRA_SELECTED, DataStore.routeOutboundRouter)
+                    }
+                )
+                false
             } else {
                 true
             }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListActivity.kt
new file mode 100644
index 0000000000..653cec43d3
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListActivity.kt
@@ -0,0 +1,27 @@
+package io.nekohasekai.sagernet.ui
+
+import android.os.Bundle
+import androidx.appcompat.widget.Toolbar
+import io.nekohasekai.sagernet.R
+
+class RouterGroupListActivity : ThemedActivity(R.layout.layout_settings_activity) {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val toolbar = findViewById<Toolbar>(R.id.toolbar)
+        setSupportActionBar(toolbar)
+        supportActionBar?.apply {
+            setTitle(R.string.router_groups_title)
+            setDisplayHomeAsUpEnabled(true)
+        }
+        if (savedInstanceState == null) {
+            supportFragmentManager.beginTransaction()
+                .replace(R.id.settings, RouterGroupListFragment())
+                .commit()
+        }
+    }
+
+    override fun onSupportNavigateUp(): Boolean {
+        finish()
+        return true
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListFragment.kt
new file mode 100644
index 0000000000..abd0a93d6b
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListFragment.kt
@@ -0,0 +1,155 @@
+package io.nekohasekai.sagernet.ui
+
+import android.content.Context
+import android.content.Intent
+import android.os.Bundle
+import androidx.lifecycle.lifecycleScope
+import androidx.preference.Preference
+import androidx.preference.PreferenceCategory
+import androidx.preference.PreferenceFragmentCompat
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import io.nekohasekai.sagernet.R
+import io.nekohasekai.sagernet.SagerNet
+import io.nekohasekai.sagernet.database.DataStore
+import io.nekohasekai.sagernet.database.GroupManager
+import io.nekohasekai.sagernet.database.ProxyEntity
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RouterGroupRepository
+import io.nekohasekai.sagernet.database.RouterMember
+import io.nekohasekai.sagernet.database.SagerDatabase
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+class RouterGroupListFragment : PreferenceFragmentCompat() {
+    override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) = rebuild()
+
+    override fun onResume() {
+        super.onResume()
+        rebuild()
+        viewLifecycleOwner.lifecycleScope.launch(Dispatchers.IO) {
+            runCatching {
+                GroupManager.reconcileRouterMembers(GroupManager.snapshotRouterMembers())
+            }
+            withContext(Dispatchers.Main) {
+                if (isAdded) rebuild()
+            }
+        }
+    }
+
+    fun rebuild() {
+        val context = requireContext()
+        val screen = preferenceManager.createPreferenceScreen(context)
+        val groups = RouterGroupRepository.all()
+
+        if (groups.isEmpty()) {
+            screen.addPreference(Preference(context).apply {
+                title = getString(R.string.router_empty_title)
+                summary = getString(R.string.router_empty_summary)
+                setIcon(R.drawable.ic_hardware_router)
+                setOnPreferenceClickListener {
+                    startActivity(Intent(context, RouterGroupSettingsActivity::class.java))
+                    true
+                }
+            })
+        } else {
+            val category = PreferenceCategory(context).apply {
+                title = getString(R.string.router_groups_title)
+            }
+            screen.addPreference(category)
+
+            // rebuild() runs on the main thread (onCreatePreferences / onResume), so the
+            // per-group lookups are batched here: one query for all members and one for
+            // all displayed nodes instead of two queries per router group.
+            val membersByRouter = SagerDatabase.routerMemberDao.all().groupBy { it.routerId }
+            val selectedIds = groups.mapNotNull { it.selectedProxyId.takeIf { id -> id > 0 } }
+            val selectedProxies: Map<Long, ProxyEntity> =
+                if (selectedIds.isEmpty()) emptyMap()
+                else SagerDatabase.proxyDao.getEntities(selectedIds).associateBy { it.id }
+
+            groups.forEach { group ->
+                category.addPreference(
+                    group.toPreference(
+                        context,
+                        membersByRouter[group.id].orEmpty(),
+                        selectedProxies[group.selectedProxyId],
+                    )
+                )
+            }
+        }
+
+        preferenceScreen = screen
+    }
+
+    private fun RouterGroup.toPreference(
+        context: Context,
+        members: List<RouterMember>,
+        selectedProxy: ProxyEntity?,
+    ): Preference = Preference(context).apply {
+        title = name.ifBlank { stableTag }
+        setIcon(R.drawable.ic_hardware_router)
+        val modeName = context.getString(
+            if (mode == RouterGroup.MODE_URL_TEST) R.string.router_mode_automatic
+            else R.string.router_mode_manual
+        )
+        val selectedName = selectedProxy?.displayName() ?: context.getString(R.string.router_no_selection)
+
+        summary = when {
+            !enabled -> getString(R.string.router_group_disabled)
+            lastError.isNotBlank() -> lastError
+            mode == RouterGroup.MODE_URL_TEST -> getString(R.string.router_status, modeName, members.size)
+            else -> "${getString(R.string.router_status, modeName, members.size)} • ${getString(R.string.router_current_node, selectedName)}"
+        }
+
+        setOnPreferenceClickListener {
+            if (mode == RouterGroup.MODE_SELECTOR && members.isNotEmpty()) {
+                showNodeSelectionDialog(this@toPreference, members)
+            } else {
+                startActivity(Intent(requireContext(), RouterGroupSettingsActivity::class.java).apply {
+                    putExtra(RouterGroupSettingsActivity.EXTRA_ROUTER_ID, id)
+                })
+            }
+            true
+        }
+    }
+
+    private fun showNodeSelectionDialog(group: RouterGroup, members: List<RouterMember>) {
+        val proxies = SagerDatabase.proxyDao.getEntities(members.map { it.proxyId })
+        val proxyMap = proxies.associateBy { it.id }
+        val orderedProxies = members.mapNotNull { proxyMap[it.proxyId] }
+        if (orderedProxies.isEmpty()) {
+            startActivity(Intent(requireContext(), RouterGroupSettingsActivity::class.java).apply {
+                putExtra(RouterGroupSettingsActivity.EXTRA_ROUTER_ID, group.id)
+            })
+            return
+        }
+        val items = orderedProxies.map { it.displayName() }.toTypedArray()
+        val currentIndex = orderedProxies.indexOfFirst { it.id == group.selectedProxyId }
+
+        MaterialAlertDialogBuilder(requireContext())
+            .setTitle(group.name.ifBlank { group.stableTag })
+            .setSingleChoiceItems(items, currentIndex) { dialog, which ->
+                val chosen = orderedProxies[which]
+                viewLifecycleOwner.lifecycleScope.launch(Dispatchers.IO) {
+                    runCatching {
+                        RouterGroupRepository.select(group.id, chosen.id)
+                    }.onSuccess { updated ->
+                        if (DataStore.serviceState.started) {
+                            SagerNet.reloadService(updated.stableTag, chosen.id)
+                        }
+                    }
+                    withContext(Dispatchers.Main) {
+                        rebuild()
+                    }
+                }
+                dialog.dismiss()
+            }
+            .setNeutralButton(R.string.router_edit_group) { _, _ ->
+                startActivity(Intent(requireContext(), RouterGroupSettingsActivity::class.java).apply {
+                    putExtra(RouterGroupSettingsActivity.EXTRA_ROUTER_ID, group.id)
+                })
+            }
+            .setNegativeButton(android.R.string.cancel, null)
+            .show()
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSelectActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSelectActivity.kt
new file mode 100644
index 0000000000..b9c13e2976
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSelectActivity.kt
@@ -0,0 +1,58 @@
+package io.nekohasekai.sagernet.ui
+
+import android.app.Activity
+import android.content.Intent
+import android.os.Bundle
+import androidx.appcompat.widget.Toolbar
+import androidx.preference.Preference
+import androidx.preference.PreferenceFragmentCompat
+import io.nekohasekai.sagernet.R
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RouterGroupRepository
+import io.nekohasekai.sagernet.database.SagerDatabase
+
+class RouterGroupSelectActivity : ThemedActivity(R.layout.layout_settings_activity) {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setSupportActionBar(findViewById<Toolbar>(R.id.toolbar))
+        supportActionBar?.apply {
+            setTitle(R.string.route_proxy_group)
+            setDisplayHomeAsUpEnabled(true)
+        }
+        if (savedInstanceState == null) {
+            supportFragmentManager.beginTransaction().replace(R.id.settings, PickerFragment()).commit()
+        }
+    }
+
+    override fun onSupportNavigateUp(): Boolean { finish(); return true }
+
+    class PickerFragment : PreferenceFragmentCompat() {
+        override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) {
+            val selected = requireActivity().intent.getLongExtra(EXTRA_SELECTED, 0L)
+            val screen = preferenceManager.createPreferenceScreen(requireContext())
+            RouterGroupRepository.all().filter { group ->
+                group.enabled && SagerDatabase.routerMemberDao.getByRouter(group.id).isNotEmpty()
+            }.forEach { group ->
+                screen.addPreference(Preference(requireContext()).apply {
+                    title = group.name
+                    summary = if (group.id == selected) getString(R.string.router_group_selected) else getString(
+                        R.string.router_status,
+                        getString(if (group.mode == RouterGroup.MODE_URL_TEST) R.string.router_mode_automatic else R.string.router_mode_manual),
+                        SagerDatabase.routerMemberDao.getByRouter(group.id).size,
+                    )
+                    setOnPreferenceClickListener {
+                        requireActivity().setResult(Activity.RESULT_OK, Intent().putExtra(EXTRA_ROUTER_ID, group.id))
+                        requireActivity().finish()
+                        true
+                    }
+                })
+            }
+            preferenceScreen = screen
+        }
+    }
+
+    companion object {
+        const val EXTRA_SELECTED = "selected"
+        const val EXTRA_ROUTER_ID = "router_id"
+    }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSettingsActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSettingsActivity.kt
new file mode 100644
index 0000000000..840e1c7886
--- /dev/null
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSettingsActivity.kt
@@ -0,0 +1,259 @@
+package io.nekohasekai.sagernet.ui
+
+import android.os.Bundle
+import android.view.Menu
+import android.view.MenuItem
+import android.widget.Toast
+import androidx.appcompat.widget.Toolbar
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import androidx.preference.EditTextPreference
+import androidx.preference.ListPreference
+import androidx.preference.MultiSelectListPreference
+import androidx.preference.Preference
+import androidx.preference.PreferenceCategory
+import androidx.preference.PreferenceFragmentCompat
+import androidx.preference.SwitchPreferenceCompat
+import io.nekohasekai.sagernet.GroupType
+import io.nekohasekai.sagernet.R
+import io.nekohasekai.sagernet.SagerNet
+import io.nekohasekai.sagernet.database.DataStore
+import io.nekohasekai.sagernet.database.RouterDeleteResult
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.RouterGroupDraft
+import io.nekohasekai.sagernet.database.RouterGroupRepository
+import io.nekohasekai.sagernet.database.RouterGroupValidationException
+import io.nekohasekai.sagernet.database.SagerDatabase
+import io.nekohasekai.sagernet.database.displayNameOrFallback
+import io.nekohasekai.sagernet.ktx.onMainDispatcher
+import io.nekohasekai.sagernet.ktx.runOnDefaultDispatcher
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+
+class RouterGroupSettingsActivity : ThemedActivity(R.layout.layout_settings_activity) {
+    private val editor get() = supportFragmentManager.findFragmentById(R.id.settings) as? EditorFragment
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setSupportActionBar(findViewById<Toolbar>(R.id.toolbar))
+        supportActionBar?.apply {
+            setTitle(R.string.router_group_settings)
+            setDisplayHomeAsUpEnabled(true)
+        }
+        if (savedInstanceState == null) {
+            supportFragmentManager.beginTransaction().replace(R.id.settings, EditorFragment()).commit()
+        }
+    }
+
+    override fun onCreateOptionsMenu(menu: Menu): Boolean {
+        menuInflater.inflate(R.menu.profile_config_menu, menu)
+        menu.findItem(R.id.action_delete).isVisible = intent.getLongExtra(EXTRA_ROUTER_ID, 0) > 0
+        return true
+    }
+
+    override fun onOptionsItemSelected(item: MenuItem): Boolean = when (item.itemId) {
+        android.R.id.home -> { finish(); true }
+        R.id.action_apply -> { editor?.save(); true }
+        R.id.action_delete -> {
+            MaterialAlertDialogBuilder(this)
+                .setTitle(R.string.delete_group_prompt)
+                .setPositiveButton(R.string.yes) { _, _ ->
+                    editor?.delete()
+                }
+                .setNegativeButton(android.R.string.cancel, null)
+                .show()
+            true
+        }
+        else -> super.onOptionsItemSelected(item)
+    }
+
+    class EditorFragment : PreferenceFragmentCompat() {
+        private val routerId get() = requireActivity().intent.getLongExtra(EXTRA_ROUTER_ID, 0L)
+        private lateinit var name: EditTextPreference
+        private lateinit var enabled: SwitchPreferenceCompat
+        private lateinit var mode: ListPreference
+        private lateinit var sources: MultiSelectListPreference
+        private lateinit var include: EditTextPreference
+        private lateinit var exclude: EditTextPreference
+        private lateinit var urlCategory: PreferenceCategory
+        private lateinit var testUrl: EditTextPreference
+        private lateinit var interval: EditTextPreference
+        private lateinit var tolerance: EditTextPreference
+        private lateinit var selected: ListPreference
+        private lateinit var preview: Preference
+        private var sourceOrder = emptyList<Long>()
+
+        override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) {
+            val group = routerId.takeIf { it > 0 }?.let(RouterGroupRepository::get)
+            val filter = group?.matchConfig?.let(RouterFilterConfig::fromJson) ?: RouterFilterConfig()
+            val subscriptions = SagerDatabase.groupDao.allGroups().filter { it.type == GroupType.SUBSCRIPTION }
+            sourceOrder = subscriptions.map { it.id }
+            val screen = preferenceManager.createPreferenceScreen(requireContext())
+            name = EditTextPreference(requireContext()).nonPersistent().apply {
+                key = "router_group_name"
+                title = getString(R.string.router_group_name)
+                text = group?.name.orEmpty()
+                summaryProvider = EditTextPreference.SimpleSummaryProvider.getInstance()
+            }
+            enabled = SwitchPreferenceCompat(requireContext()).nonPersistent().apply {
+                key = "router_group_enabled"
+                title = getString(R.string.router_group_enabled)
+                isChecked = group?.enabled ?: true
+            }
+            mode = ListPreference(requireContext()).nonPersistent().apply {
+                key = "router_group_mode"
+                title = getString(R.string.router_group_mode)
+                entries = arrayOf(getString(R.string.router_mode_manual), getString(R.string.router_mode_automatic))
+                entryValues = arrayOf(RouterGroup.MODE_SELECTOR.toString(), RouterGroup.MODE_URL_TEST.toString())
+                value = (group?.mode ?: RouterGroup.MODE_SELECTOR).toString()
+                summaryProvider = ListPreference.SimpleSummaryProvider.getInstance()
+            }
+            val subMap = subscriptions.associate { it.id.toString() to it.displayName() }
+            sources = MultiSelectListPreference(requireContext()).nonPersistent().apply {
+                key = "router_group_sources"
+                title = getString(R.string.router_group_sources)
+                entries = subscriptions.map { it.displayName() }.toTypedArray()
+                entryValues = subscriptions.map { it.id.toString() }.toTypedArray()
+                values = RouterGroupRepository.sourceIds(routerId).map(Long::toString).toSet()
+                summaryProvider = Preference.SummaryProvider<MultiSelectListPreference> { pref ->
+                    val selectedNames = pref.values.mapNotNull { subMap[it] }
+                    if (selectedNames.isEmpty()) {
+                        getString(R.string.router_no_sources_selected)
+                    } else {
+                        selectedNames.joinToString(", ")
+                    }
+                }
+            }
+            include = textPreference("router_group_include", R.string.router_group_include, filter.includeRegex)
+            exclude = textPreference("router_group_exclude", R.string.router_group_exclude, filter.excludeRegex)
+            urlCategory = PreferenceCategory(requireContext()).apply {
+                key = "router_category_url_test"
+                title = getString(R.string.router_url_test_settings)
+            }
+            testUrl = textPreference("router_test_url", R.string.router_test_url, filter.testUrl)
+            interval = textPreference("router_test_interval", R.string.router_test_interval, filter.intervalSeconds.toString())
+            tolerance = textPreference("router_test_tolerance", R.string.router_test_tolerance, filter.toleranceMs.toString())
+            selected = ListPreference(requireContext()).nonPersistent().apply {
+                key = "router_select_node"
+                title = getString(R.string.router_select_node)
+                val members = SagerDatabase.routerMemberDao.getByRouter(routerId)
+                    .mapNotNull { SagerDatabase.proxyDao.getById(it.proxyId) }
+                entries = members.map { proxy ->
+                    val subName = subMap[proxy.groupId.toString()]
+                    if (!subName.isNullOrBlank()) "[${subName}] ${proxy.displayNameOrFallback().trim()}"
+                    else proxy.displayNameOrFallback().trim()
+                }.toTypedArray()
+                entryValues = members.map { it.id.toString() }.toTypedArray()
+                value = group?.selectedProxyId?.takeIf { it > 0 }?.toString()
+                summaryProvider = ListPreference.SimpleSummaryProvider.getInstance()
+                setOnPreferenceChangeListener { _, newValue ->
+                    val proxyId = newValue.toString().toLong()
+                    runOnDefaultDispatcher {
+                        runCatching { RouterGroupRepository.select(routerId, proxyId) }
+                            .onSuccess { updated -> if (DataStore.serviceState.started) SagerNet.reloadService(updated.stableTag, proxyId) }
+                            .onFailure { error -> onMainDispatcher { toast(error.message) } }
+                    }
+                    true
+                }
+            }
+            preview = Preference(requireContext()).apply {
+                key = "router_group_preview"
+                title = getString(R.string.router_group_preview)
+                isSelectable = false
+            }
+            listOf(name, enabled, mode, sources, include, exclude).forEach(screen::addPreference)
+            screen.addPreference(urlCategory)
+            listOf(testUrl, interval, tolerance).forEach(urlCategory::addPreference)
+            screen.addPreference(selected)
+            screen.addPreference(preview)
+            preferenceScreen = screen
+
+            listOf(name, enabled, mode, sources, include, exclude, testUrl, interval, tolerance).forEach { preference ->
+                preference.setOnPreferenceChangeListener { _, newValue ->
+                    if (preference == sources) {
+                        @Suppress("UNCHECKED_CAST")
+                        sources.values = newValue as? Set<String> ?: emptySet()
+                    }
+                    view?.post { updateDynamicState() }
+                    true
+                }
+            }
+            updateDynamicState()
+        }
+
+        private fun updateDynamicState() {
+            val automatic = mode.value == RouterGroup.MODE_URL_TEST.toString()
+            urlCategory.isVisible = automatic
+            selected.isVisible = !automatic && routerId > 0
+            runCatching { RouterGroupRepository.preview(draft()) }
+                .onSuccess { result ->
+                    preview.summary = if (result.names.isEmpty()) getString(R.string.router_no_members)
+                    else {
+                        val maxDisplay = 20
+                        val previewText = result.names.take(maxDisplay).joinToString("\n")
+                        val suffix = if (result.names.size > maxDisplay) "\n..." else ""
+                        getString(R.string.router_group_preview_count, result.names.size, previewText + suffix)
+                    }
+                }
+                .onFailure { preview.summary = it.message }
+        }
+
+        fun save() {
+            val draft = draft()
+            runOnDefaultDispatcher {
+                runCatching { RouterGroupRepository.save(draft) }
+                    .onSuccess {
+                        if (DataStore.serviceState.started) SagerNet.reloadServiceFully()
+                        onMainDispatcher { requireActivity().finish() }
+                    }
+                    .onFailure { error -> onMainDispatcher { toast(validationMessage(error)) } }
+            }
+        }
+
+        fun delete() {
+            runOnDefaultDispatcher {
+                when (val result = RouterGroupRepository.delete(routerId)) {
+                    RouterDeleteResult.Deleted -> {
+                        if (DataStore.serviceState.started) SagerNet.reloadServiceFully()
+                        onMainDispatcher { requireActivity().finish() }
+                    }
+                    is RouterDeleteResult.Referenced -> onMainDispatcher {
+                        toast(getString(R.string.router_group_delete_referenced, result.ruleCount))
+                    }
+                }
+            }
+        }
+
+        private fun draft() = RouterGroupDraft(
+            id = routerId,
+            name = name.text.orEmpty(),
+            mode = mode.value?.toIntOrNull() ?: RouterGroup.MODE_SELECTOR,
+            enabled = enabled.isChecked,
+            sourceGroupIds = sourceOrder.filter { it.toString() in sources.values },
+            filter = RouterFilterConfig(
+                includeRegex = include.text.orEmpty(),
+                excludeRegex = exclude.text.orEmpty(),
+                testUrl = testUrl.text.orEmpty(),
+                intervalSeconds = interval.text?.toLongOrNull() ?: 0,
+                toleranceMs = tolerance.text?.toIntOrNull() ?: -1,
+            ),
+        )
+
+        private fun textPreference(prefKey: String, titleRes: Int, initial: String) =
+            EditTextPreference(requireContext()).nonPersistent().apply {
+                key = prefKey
+                title = getString(titleRes)
+                text = initial
+                summaryProvider = EditTextPreference.SimpleSummaryProvider.getInstance()
+            }
+
+        private fun <T : Preference> T.nonPersistent(): T = apply { isPersistent = false }
+
+        private fun validationMessage(error: Throwable): String = when (error) {
+            is RouterGroupValidationException -> getString(R.string.router_group_validation_field, error.field.name, error.message)
+            else -> error.message ?: getString(R.string.error_title)
+        }
+
+        private fun toast(message: String?) = Toast.makeText(requireContext(), message, Toast.LENGTH_LONG).show()
+    }
+
+    companion object { const val EXTRA_ROUTER_ID = "router_id" }
+}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/ScannerActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/ScannerActivity.kt
index 99f6f6468e..60e005adc8 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/ScannerActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/ScannerActivity.kt
@@ -4,9 +4,7 @@ import android.Manifest
 import android.content.Intent
 import android.content.pm.ShortcutManager
 import android.graphics.ImageDecoder
-import android.os.Build
 import android.os.Bundle
-import android.provider.MediaStore
 import android.view.Menu
 import android.view.MenuItem
 import android.widget.Toast
@@ -39,7 +37,7 @@ class ScannerActivity : ThemedActivity(),
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
 
-        if (Build.VERSION.SDK_INT >= 25) getSystemService<ShortcutManager>()!!.reportShortcutUsed("scan")
+        getSystemService<ShortcutManager>()!!.reportShortcutUsed("scan")
         binding = LayoutScannerBinding.inflate(layoutInflater)
         setContentView(binding.root)
         setSupportActionBar(findViewById(R.id.toolbar))
@@ -63,19 +61,13 @@ class ScannerActivity : ThemedActivity(),
         runOnDefaultDispatcher {
             try {
                 it.forEachTry { uri ->
-                    val bitmap = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
-                        ImageDecoder.decodeBitmap(
-                            ImageDecoder.createSource(
-                                contentResolver, uri
-                            )
-                        ) { decoder, _, _ ->
-                            decoder.allocator = ImageDecoder.ALLOCATOR_SOFTWARE
-                            decoder.isMutableRequired = true
-                        }
-                    } else {
-                        @Suppress("DEPRECATION") MediaStore.Images.Media.getBitmap(
+                    val bitmap = ImageDecoder.decodeBitmap(
+                        ImageDecoder.createSource(
                             contentResolver, uri
                         )
+                    ) { decoder, _, _ ->
+                        decoder.allocator = ImageDecoder.ALLOCATOR_SOFTWARE
+                        decoder.isMutableRequired = true
                     }
                     val result = CodeUtils.parseCodeResult(bitmap)
                     onMainDispatcher {
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt
index 659a54e3c0..71990d3c02 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/SettingsPreferenceFragment.kt
@@ -1,7 +1,6 @@
 package io.nekohasekai.sagernet.ui
 
 import android.content.Intent
-import android.os.Build
 import android.os.Bundle
 import android.view.View
 import android.view.inputmethod.EditorInfo
@@ -75,8 +74,6 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
         }
         val localProxySettings = findPreference<Preference>("localProxySettings")!!
         val serviceMode = findPreference<Preference>(Key.SERVICE_MODE)!!
-        val appendHttpProxy = findPreference<SwitchPreference>(Key.APPEND_HTTP_PROXY)!!
-        val httpProxyBypass = findPreference<EditTextPreference>(Key.HTTP_PROXY_BYPASS)!!
         val dnsHosts = findPreference<EditTextPreference>(Key.DNS_HOSTS)!!
         val strictRoute = findPreference<SwitchPreference>(Key.STRICT_ROUTE)!!
 
@@ -92,8 +89,6 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
         val enableDnsRouting = findPreference<SwitchPreference>(Key.ENABLE_DNS_ROUTING)!!
         val enableFakeDns = findPreference<SwitchPreference>(Key.ENABLE_FAKEDNS)!!
 
-        val enableTLSFragment = findPreference<SwitchPreference>(Key.ENABLE_TLS_FRAGMENT)!!
-
         val logLevel = findPreference<LongClickListPreference>(Key.LOG_LEVEL)!!
         val mtu = findPreference<MTUPreference>(Key.MTU)!!
         globalCustomConfig = findPreference(Key.GLOBAL_CUSTOM_CONFIG)!!
@@ -126,15 +121,9 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
             true
         }
 
-        httpProxyBypass.setOnBindEditTextListener(EditTextPreferenceModifiers.Hosts)
         dnsHosts.setOnBindEditTextListener(EditTextPreferenceModifiers.Hosts)
-        httpProxyBypass.summaryProvider = ListSummaryProvider(maxLines = 1)
         dnsHosts.summaryProvider = ListSummaryProvider(maxLines = 1)
 
-        val metedNetwork = findPreference<Preference>(Key.METERED_NETWORK)!!
-        if (Build.VERSION.SDK_INT < 28) {
-            metedNetwork.remove()
-        }
         isProxyApps = findPreference(Key.PROXY_APPS)!!
         isProxyApps.setOnPreferenceChangeListener { _, newValue ->
             startActivity(Intent(activity, AppManagerActivity::class.java))
@@ -158,13 +147,7 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
         }
 
         val tunImplementation = findPreference<SimpleMenuPreference>(Key.TUN_IMPLEMENTATION)!!
-        val enableHevTun = findPreference<SwitchPreference>(Key.ENABLE_HEV_TUN)!!
-        tunImplementation.isEnabled = !DataStore.enableHevTun
-        enableHevTun.setOnPreferenceChangeListener { _, newValue ->
-            tunImplementation.isEnabled = !(newValue as Boolean)
-            needReload()
-            true
-        }
+        tunImplementation.onPreferenceChangeListener = reloadListener
         val resolveDestination = findPreference<SwitchPreference>(Key.RESOLVE_DESTINATION)!!
         val acquireWakeLock = findPreference<SwitchPreference>(Key.ACQUIRE_WAKE_LOCK)!!
         val hideFromRecentApps = findPreference<SwitchPreference>(Key.HIDE_FROM_RECENT_APPS)!!
@@ -175,41 +158,11 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
             true
         }
 
-        val rulesProvider = findPreference<SimpleMenuPreference>(Key.RULES_PROVIDER)!!
-        val rulesGeositeUrl = findPreference<EditTextPreference>(Key.RULES_GEOSITE_URL)!!
-        val rulesGeoipUrl = findPreference<EditTextPreference>(Key.RULES_GEOIP_URL)!!
-        rulesGeositeUrl.isVisible = DataStore.rulesProvider == 4
-        rulesGeoipUrl.isVisible = DataStore.rulesProvider == 4
-        rulesProvider.setOnPreferenceChangeListener { _, newValue ->
-            val provider = (newValue as String).toInt()
-            rulesGeositeUrl.isVisible = provider == 4
-            rulesGeoipUrl.isVisible = provider == 4
-            true
-        }
-
         localProxySettings.summary = localProxySummary()
         localProxySettings.setOnPreferenceClickListener {
             showLocalProxySettingsDialog(localProxySettings)
             true
         }
-        appendHttpProxy.setOnPreferenceChangeListener { _, newValue ->
-            if (newValue as Boolean) {
-                MaterialAlertDialogBuilder(requireContext()).apply {
-                    setTitle(R.string.append_http_proxy_security_title)
-                    setMessage(R.string.append_http_proxy_security_message)
-                    setNegativeButton(android.R.string.cancel, null)
-                    setPositiveButton(R.string.enable_anyway) { _, _ ->
-                        appendHttpProxy.isChecked = true
-                        needReload()
-                    }
-                }.show()
-                false
-            } else {
-                needReload()
-                true
-            }
-        }
-        httpProxyBypass.onPreferenceChangeListener = reloadListener
         dnsHosts.onPreferenceChangeListener = reloadListener
         strictRoute.onPreferenceChangeListener = reloadListener
         showDirectSpeed.onPreferenceChangeListener = reloadListener
@@ -233,11 +186,11 @@ class SettingsPreferenceFragment : PreferenceFragmentCompat() {
         acquireWakeLock.onPreferenceChangeListener = reloadListener
         hideFromRecentApps.setOnPreferenceChangeListener { _, newValue ->
             (activity as? MainActivity)?.applyHideFromRecentApps(newValue as Boolean)
-            // needReload()
             true
         }
 
-        enableTLSFragment.onPreferenceChangeListener = reloadListener
+        findPreference<SwitchPreference>(Key.SHOW_PROFILE_IN_NOTIFICATION)?.onPreferenceChangeListener = reloadListener
+        findPreference<SwitchPreference>(Key.GLOBAL_ALLOW_INSECURE)?.onPreferenceChangeListener = reloadListener
 
         // 恢复默认设置功能
         val resetSettings = findPreference<Preference>("resetSettings")!!
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/ThemedActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/ThemedActivity.kt
index 208734b77d..8ae366b9e9 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/ThemedActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/ThemedActivity.kt
@@ -1,7 +1,6 @@
 package io.nekohasekai.sagernet.ui
 
 import android.content.res.Configuration
-import android.os.Build
 import android.os.Bundle
 import android.widget.TextView
 import androidx.annotation.StringRes
@@ -37,16 +36,14 @@ abstract class ThemedActivity : AppCompatActivity {
 
         uiMode = resources.configuration.uiMode
 
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            WindowCompat.setDecorFitsSystemWindows(window, false)
+        WindowCompat.setDecorFitsSystemWindows(window, false)
 
-            val isNight = (uiMode and Configuration.UI_MODE_NIGHT_MASK) ==
-                Configuration.UI_MODE_NIGHT_YES
-            val insetController = WindowCompat.getInsetsController(window, window.decorView)
-            insetController.isAppearanceLightNavigationBars = false
-            insetController.isAppearanceLightStatusBars =
-                if (DataStore.appTheme == Theme.BLACK) !isNight else false
-        }
+        val isNight = (uiMode and Configuration.UI_MODE_NIGHT_MASK) ==
+            Configuration.UI_MODE_NIGHT_YES
+        val insetController = WindowCompat.getInsetsController(window, window.decorView)
+        insetController.isAppearanceLightNavigationBars = false
+        insetController.isAppearanceLightStatusBars =
+            if (DataStore.appTheme == Theme.BLACK) !isNight else false
 
         ViewCompat.setOnApplyWindowInsetsListener(findViewById(android.R.id.content)) { _, insets ->
             val bars = insets.getInsets(
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/ToolsFragment.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/ToolsFragment.kt
deleted file mode 100644
index 32738ea98f..0000000000
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/ToolsFragment.kt
+++ /dev/null
@@ -1,39 +0,0 @@
-package io.nekohasekai.sagernet.ui
-
-import android.os.Bundle
-import android.view.View
-import androidx.fragment.app.Fragment
-import androidx.viewpager2.adapter.FragmentStateAdapter
-import com.google.android.material.tabs.TabLayoutMediator
-import io.nekohasekai.sagernet.R
-import io.nekohasekai.sagernet.databinding.LayoutToolsBinding
-
-class ToolsFragment : ToolbarFragment(R.layout.layout_tools) {
-
-    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
-        super.onViewCreated(view, savedInstanceState)
-        toolbar.setTitle(R.string.menu_tools)
-
-        val tools = mutableListOf<NamedFragment>()
-        tools.add(NetworkFragment())
-        tools.add(BackupFragment())
-
-        val binding = LayoutToolsBinding.bind(view)
-        binding.toolsPager.adapter = ToolsAdapter(tools)
-
-        TabLayoutMediator(binding.toolsTab, binding.toolsPager) { tab, position ->
-            tab.text = tools[position].name()
-            tab.view.setOnLongClickListener { // clear toast
-                true
-            }
-        }.attach()
-    }
-
-    inner class ToolsAdapter(val tools: List<Fragment>) : FragmentStateAdapter(this) {
-
-        override fun getItemCount() = tools.size
-
-        override fun createFragment(position: Int) = tools[position]
-    }
-
-}
\ No newline at end of file
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/VpnRequestActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/VpnRequestActivity.kt
index a1d81afc6e..69565db38e 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/VpnRequestActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/VpnRequestActivity.kt
@@ -7,7 +7,6 @@ import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
 import android.net.VpnService
-import android.os.Build.VERSION.SDK_INT
 import android.os.Bundle
 import android.widget.Toast
 import androidx.activity.result.contract.ActivityResultContract
@@ -27,15 +26,11 @@ class VpnRequestActivity : AppCompatActivity() {
         super.onCreate(savedInstanceState)
         if (getSystemService<KeyguardManager>()!!.isKeyguardLocked) {
             receiver = broadcastReceiver { _, _ -> connect.launch(null) }
-            if (SDK_INT >= 33) {
-                registerReceiver(
-                    receiver,
-                    IntentFilter(Intent.ACTION_USER_PRESENT),
-                    Context.RECEIVER_EXPORTED
-                )
-            } else {
-                registerReceiver(receiver, IntentFilter(Intent.ACTION_USER_PRESENT))
-            }
+            registerReceiver(
+                receiver,
+                IntentFilter(Intent.ACTION_USER_PRESENT),
+                Context.RECEIVER_EXPORTED
+            )
         } else connect.launch(null)
     }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/WebDAVSettingsActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/WebDAVSettingsActivity.kt
deleted file mode 100644
index 0fbe6faee1..0000000000
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/WebDAVSettingsActivity.kt
+++ /dev/null
@@ -1,219 +0,0 @@
-package io.nekohasekai.sagernet.ui
-
-import android.os.Bundle
-import android.view.MenuItem
-import android.text.InputType
-import androidx.annotation.StringRes
-import androidx.appcompat.app.AppCompatActivity
-import androidx.appcompat.widget.Toolbar
-import androidx.preference.EditTextPreference
-import androidx.preference.Preference
-import androidx.preference.PreferenceFragmentCompat
-import androidx.preference.PreferenceDataStore
-import io.nekohasekai.sagernet.R
-import io.nekohasekai.sagernet.database.DataStore
-import io.nekohasekai.sagernet.ktx.onMainDispatcher
-import io.nekohasekai.sagernet.ktx.runOnDefaultDispatcher
-import io.nekohasekai.sagernet.ktx.snackbar
-import kotlinx.coroutines.launch
-import okhttp3.Credentials
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import java.net.URL
-import com.google.android.material.snackbar.Snackbar
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.RequestBody.Companion.toRequestBody
-import java.util.concurrent.TimeUnit
-import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
-
-class WebDAVSettingsActivity : ThemedActivity() {
-    
-    private lateinit var toolbar: Toolbar
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        
-        setContentView(R.layout.layout_webdav_settings)
-        toolbar = findViewById(R.id.toolbar)
-        setSupportActionBar(toolbar)
-        supportActionBar?.apply {
-            setTitle(R.string.webdav_settings)
-            setDisplayHomeAsUpEnabled(true)
-            setHomeAsUpIndicator(R.drawable.ic_navigation_close)
-        }
-        
-        supportFragmentManager.beginTransaction()
-            .replace(R.id.settings, WebDAVSettingsFragment())
-            .commit()
-    }
-
-    override fun onSupportNavigateUp(): Boolean {
-        finish()
-        return true
-    }
-
-    class WebDAVSettingsFragment : PreferenceFragmentCompat(), PreferenceFragmentCompat.OnPreferenceStartFragmentCallback {
-        private var lastClickTime = 0L
-        private val DEBOUNCE_TIME = 1000L  // 1秒内不允许重复点击
-        private var isFragmentAlive = true
-
-        private fun isClickAllowed(): Boolean {
-            val currentTime = System.currentTimeMillis()
-            val isAllowed = currentTime - lastClickTime > DEBOUNCE_TIME
-            if (isAllowed) {
-                lastClickTime = currentTime
-            }
-            return isAllowed
-        }
-
-        override fun onDestroy() {
-            isFragmentAlive = false
-            super.onDestroy()
-        }
-
-        override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) {
-            preferenceManager.preferenceDataStore = DataStore.configurationStore
-            addPreferencesFromResource(R.xml.webdav_preferences)
-            
-            findPreference<EditTextPreference>("webdavServer")?.apply {
-                setOnBindEditTextListener { editText ->
-                    editText.setSingleLine()
-                    editText.setSelection(editText.text.length)
-                }
-                summaryProvider = EditTextPreference.SimpleSummaryProvider.getInstance()
-            }
-            
-            findPreference<EditTextPreference>("webdavUsername")?.apply {
-                setOnBindEditTextListener { editText ->
-                    editText.setSingleLine()
-                    editText.setSelection(editText.text.length)
-                }
-                summaryProvider = EditTextPreference.SimpleSummaryProvider.getInstance()
-            }
-            
-            findPreference<EditTextPreference>("webdavPassword")?.apply {
-                setOnBindEditTextListener { editText ->
-                    editText.setSingleLine()
-                    editText.inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD
-                    editText.setSelection(editText.text.length)
-                }
-                // 使用与其他密码字段一致的隐藏摘要样式
-                summaryProvider = GroupSettingsActivity.PasswordSummaryProvider
-            }
-            
-            findPreference<EditTextPreference>("webdavPath")?.apply {
-                setOnBindEditTextListener { editText ->
-                    editText.setSingleLine()
-                    editText.setSelection(editText.text.length)
-                }
-                summaryProvider = EditTextPreference.SimpleSummaryProvider.getInstance()
-            }
-            
-            findPreference<Preference>("webdavTest")?.setOnPreferenceClickListener {
-                if (isClickAllowed()) {
-                    testWebDAV()
-                } else {
-                    Snackbar.make(requireView(), "请稍后再试", Snackbar.LENGTH_SHORT).show()
-                }
-                true
-            }
-        }
-
-        private fun testWebDAV() {
-            runOnDefaultDispatcher {
-                try {
-                    val server = DataStore.webdavServer ?: ""
-                    if (server.isBlank()) {
-                        throw Exception(getString(R.string.webdav_server_empty))
-                    }
-
-                    val url = URL(server)
-                    val client = OkHttpClient.Builder()
-                        .connectTimeout(10, TimeUnit.SECONDS)
-                        .readTimeout(10, TimeUnit.SECONDS)
-                        .writeTimeout(10, TimeUnit.SECONDS)
-                        .build()
-
-                    // 首先测试连接和认证
-                    val authRequest = Request.Builder()
-                        .url(url)
-                        .method("PROPFIND", null)
-                        .apply {
-                            val credentials = Credentials.basic(
-                                DataStore.webdavUsername ?: "",
-                                DataStore.webdavPassword ?: ""
-                            )
-                            header("Authorization", credentials)
-                            header("Depth", "0")
-                        }
-                        .build()
-
-                    val response = client.newCall(authRequest).execute()
-                    
-                    when (response.code) {
-                        401 -> throw Exception(getString(R.string.webdav_auth_error))
-                        403 -> throw Exception(getString(R.string.webdav_permission_denied))
-                        404 -> throw Exception(getString(R.string.webdav_server_not_found))
-                        in 500..599 -> throw Exception(getString(R.string.webdav_server_error))
-                    }
-
-                    if (!response.isSuccessful) {
-                        throw Exception(getString(R.string.webdav_connect_failed, response.code))
-                    }
-
-                    // 如果认证成功，再测试目录操作
-                    val path = (DataStore.webdavPath ?: "").trim('/')
-                    if (path.isNotBlank()) {
-                        val baseHttpUrl = server.toHttpUrlOrNull()
-                            ?: throw Exception(getString(R.string.webdav_server_not_found))
-
-                        val dirUrl = baseHttpUrl.newBuilder().apply {
-                            path.split('/').filter { it.isNotEmpty() }.forEach { segment ->
-                                addPathSegment(segment)
-                            }
-                        }.build()
-
-                        val dirRequest = Request.Builder()
-                            .url(dirUrl)
-                            .method("MKCOL", null)
-                            .apply {
-                                val credentials = Credentials.basic(
-                                    DataStore.webdavUsername ?: "",
-                                    DataStore.webdavPassword ?: ""
-                                )
-                                header("Authorization", credentials)
-                            }
-                            .build()
-
-                        val dirResponse = client.newCall(dirRequest).execute()
-                        if (!dirResponse.isSuccessful && dirResponse.code != 405) {  // 405 表示目录已存在
-                            throw Exception(getString(R.string.webdav_create_dir_failed))
-                        }
-                    }
-
-                    onMainDispatcher {
-                        if (!isFragmentAlive) return@onMainDispatcher
-                        Snackbar.make(
-                            requireView(),
-                            getString(R.string.webdav_test_success),
-                            Snackbar.LENGTH_SHORT
-                        ).show()
-                    }
-                } catch (e: Exception) {
-                    onMainDispatcher {
-                        if (!isFragmentAlive) return@onMainDispatcher
-                        Snackbar.make(
-                            requireView(),
-                            getString(R.string.webdav_test_failed, e.message),
-                            Snackbar.LENGTH_SHORT
-                        ).show()
-                    }
-                }
-            }
-        }
-
-        override fun onPreferenceStartFragment(caller: PreferenceFragmentCompat, pref: Preference): Boolean {
-            return false
-        }
-    }
-}
diff --git a/app/src/main/java/io/nekohasekai/sagernet/ui/profile/ProfileSettingsActivity.kt b/app/src/main/java/io/nekohasekai/sagernet/ui/profile/ProfileSettingsActivity.kt
index 6424502ba3..be3572716f 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/ui/profile/ProfileSettingsActivity.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/ui/profile/ProfileSettingsActivity.kt
@@ -3,7 +3,6 @@ package io.nekohasekai.sagernet.ui.profile
 import android.annotation.SuppressLint
 import android.content.DialogInterface
 import android.content.Intent
-import android.os.Build
 import android.os.Bundle
 import android.os.Parcelable
 import android.view.Menu
@@ -162,7 +161,7 @@ abstract class ProfileSettingsActivity<T : AbstractBean>(
             ) isVisible = true
         }
         menu.findItem(R.id.action_create_shortcut)?.apply {
-            if (Build.VERSION.SDK_INT >= 26 && DataStore.editingId != 0L) {
+            if (DataStore.editingId != 0L) {
                 isVisible = true // not new profile
             }
         }
diff --git a/app/src/main/java/io/nekohasekai/sagernet/utils/CrashHandler.kt b/app/src/main/java/io/nekohasekai/sagernet/utils/CrashHandler.kt
index b660e5c696..adebe26e24 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/utils/CrashHandler.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/utils/CrashHandler.kt
@@ -36,7 +36,7 @@ object CrashHandler : Thread.UncaughtExceptionHandler {
         }
 
         ProcessPhoenix.triggerRebirth(app, Intent(app, BlankActivity::class.java).apply {
-            putExtra("sendLog", "NB4A Crash")
+            putExtra("sendLog", "Asteria Crash")
         })
     }
 
@@ -62,7 +62,7 @@ object CrashHandler : Thread.UncaughtExceptionHandler {
 
     fun buildReportHeader(): String {
         var report = ""
-        report += "NekoBoxF for Android ${SagerNet.appVersionNameForDisplay} (${BuildConfig.VERSION_CODE})\n"
+        report += "${app.getString(io.nekohasekai.sagernet.R.string.app_name_long)} ${SagerNet.appVersionNameForDisplay} (${BuildConfig.VERSION_CODE})\n"
         report += "Date: ${getCurrentMilliSecondUTCTimeStamp()}\n\n"
         report += "OS_VERSION: ${getSystemPropertyWithAndroidAPI("os.version")}\n"
         report += "SDK_INT: ${Build.VERSION.SDK_INT}\n"
diff --git a/app/src/main/java/io/nekohasekai/sagernet/utils/DefaultNetworkListener.kt b/app/src/main/java/io/nekohasekai/sagernet/utils/DefaultNetworkListener.kt
index 6af79fd574..d68c0af9a2 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/utils/DefaultNetworkListener.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/utils/DefaultNetworkListener.kt
@@ -1,11 +1,9 @@
 package io.nekohasekai.sagernet.utils
 
-import android.annotation.TargetApi
 import android.net.ConnectivityManager
 import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
-import android.os.Build
 import android.os.Handler
 import android.os.Looper
 import io.nekohasekai.sagernet.SagerNet
@@ -15,7 +13,6 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.channels.actor
 import kotlinx.coroutines.runBlocking
-import java.net.UnknownHostException
 
 object DefaultNetworkListener {
     private sealed class NetworkMessage {
@@ -75,17 +72,14 @@ object DefaultNetworkListener {
     suspend fun start(key: Any, listener: (Network?) -> Unit) =
         networkActor.send(NetworkMessage.Start(key, listener))
 
-    suspend fun get() = if (fallback) @TargetApi(23) {
-        SagerNet.connectivity.activeNetwork
-            ?: throw UnknownHostException() // failed to listen, return current if available
-    } else NetworkMessage.Get().run {
+    suspend fun get() = NetworkMessage.Get().run {
         networkActor.send(this)
         response.await()
     }
 
     suspend fun stop(key: Any) = networkActor.send(NetworkMessage.Stop(key))
 
-    // NB: this runs in ConnectivityThread, and this behavior cannot be changed until API 26
+    // NB: this runs in ConnectivityThread
     private object Callback : ConnectivityManager.NetworkCallback() {
         override fun onAvailable(network: Network) =
             runBlocking { networkActor.send(NetworkMessage.Put(network)) }
@@ -100,14 +94,9 @@ object DefaultNetworkListener {
             runBlocking { networkActor.send(NetworkMessage.Lost(network)) }
     }
 
-    private var fallback = false
     private val request = NetworkRequest.Builder().apply {
         addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
         addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
-        if (Build.VERSION.SDK_INT == 23) {  // workarounds for OEM bugs
-            removeCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
-            removeCapability(NetworkCapabilities.NET_CAPABILITY_CAPTIVE_PORTAL)
-        }
     }.build()
     private val mainHandler = Handler(Looper.getMainLooper())
 
@@ -123,30 +112,9 @@ object DefaultNetworkListener {
      */
     private fun register() {
         try {
-            fallback = false
-            when (Build.VERSION.SDK_INT) {
-                in 31..Int.MAX_VALUE -> @TargetApi(31) {
-                    SagerNet.connectivity.registerBestMatchingNetworkCallback(
-                        request, Callback, mainHandler
-                    )
-                }
-                in 28 until 31 -> @TargetApi(28) {  // we want REQUEST here instead of LISTEN
-                    SagerNet.connectivity.requestNetwork(request, Callback, mainHandler)
-                }
-                in 26 until 28 -> @TargetApi(26) {
-                    SagerNet.connectivity.registerDefaultNetworkCallback(Callback, mainHandler)
-                }
-                in 24 until 26 -> @TargetApi(24) {
-                    SagerNet.connectivity.registerDefaultNetworkCallback(Callback)
-                }
-                else -> {
-                    SagerNet.connectivity.requestNetwork(request, Callback)
-                    // known bug on API 23: https://stackoverflow.com/a/33509180/2245107
-                }
-            }
+            SagerNet.connectivity.registerBestMatchingNetworkCallback(request, Callback, mainHandler)
         } catch (e: Exception) {
             Logs.w(e)
-            fallback = true
         }
     }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/widget/OutboundPreference.kt b/app/src/main/java/io/nekohasekai/sagernet/widget/OutboundPreference.kt
index f7f4fc6bcf..c3eb4701a4 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/widget/OutboundPreference.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/widget/OutboundPreference.kt
@@ -9,6 +9,7 @@ import androidx.preference.PreferenceViewHolder
 import io.nekohasekai.sagernet.R
 import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.database.ProfileManager
+import io.nekohasekai.sagernet.database.SagerDatabase
 import moe.matsuri.nb4a.ui.SimpleMenuPreference
 
 class OutboundPreference
@@ -18,6 +19,7 @@ class OutboundPreference
 
     companion object {
         const val VALUE_SELECT_PROFILE = "3"
+        const val VALUE_SELECT_ROUTER = "4"
     }
 
     init {
@@ -58,9 +60,9 @@ class OutboundPreference
             ) {
                 if (!selectionReady || position < 0) return
                 val newValue = entryValues?.getOrNull(position)?.toString() ?: return
-                val reselectedProfile =
-                    dropdownOpened && newValue == value && newValue == VALUE_SELECT_PROFILE
-                if ((newValue != value || reselectedProfile) && callChangeListener(newValue)) {
+                val reselectedPicker = dropdownOpened && newValue == value &&
+                    newValue in setOf(VALUE_SELECT_PROFILE, VALUE_SELECT_ROUTER)
+                if ((newValue != value || reselectedPicker) && callChangeListener(newValue)) {
                     value = newValue
                 }
                 dropdownOpened = false
@@ -81,6 +83,13 @@ class OutboundPreference
                 }
             }
         }
+        if (value == VALUE_SELECT_ROUTER) {
+            val routerId = DataStore.routeOutboundRouter
+            if (routerId > 0) {
+                return SagerDatabase.routerGroupDao.getById(routerId)?.name
+                    ?: context.getString(R.string.router_reference_invalid)
+            }
+        }
         return super.getSummary()
     }
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/widget/QRCodeDialog.kt b/app/src/main/java/io/nekohasekai/sagernet/widget/QRCodeDialog.kt
index fa72f906e5..a68ce1181d 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/widget/QRCodeDialog.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/widget/QRCodeDialog.kt
@@ -78,10 +78,21 @@ class QRCodeDialog() : DialogFragment() {
                 layoutParams = ViewGroup.LayoutParams(
                     ViewGroup.LayoutParams.WRAP_CONTENT, ViewGroup.LayoutParams.WRAP_CONTENT
                 )
-                setImageBitmap(Bitmap.createBitmap(size, size, Bitmap.Config.RGB_565).apply {
-                    for (x in 0 until size) for (y in 0 until size) {
-                        setPixel(x, y, if (qrBits.get(x, y)) Color.BLACK else Color.WHITE)
+                // Bulk-fill instead of per-pixel setPixel(): a size*size loop of
+                // Bitmap.setPixel() is one JNI round-trip per pixel and blocks the
+                // main thread for a long time on large QR codes.
+                // setPixels() reads row-major: the pixel at (x, y) is taken from
+                // pixels[y * stride + x].
+                val pixels = IntArray(size * size)
+                for (y in 0 until size) {
+                    val rowOffset = y * size
+                    for (x in 0 until size) {
+                        pixels[rowOffset + x] =
+                            if (qrBits.get(x, y)) Color.BLACK else Color.WHITE
                     }
+                }
+                setImageBitmap(Bitmap.createBitmap(size, size, Bitmap.Config.RGB_565).apply {
+                    setPixels(pixels, 0, size, 0, 0, size, size)
                 })
             })
 
diff --git a/app/src/main/java/io/nekohasekai/sagernet/widget/ServiceButton.kt b/app/src/main/java/io/nekohasekai/sagernet/widget/ServiceButton.kt
index 73404c4bcd..e203c0fa68 100644
--- a/app/src/main/java/io/nekohasekai/sagernet/widget/ServiceButton.kt
+++ b/app/src/main/java/io/nekohasekai/sagernet/widget/ServiceButton.kt
@@ -2,7 +2,6 @@ package io.nekohasekai.sagernet.widget
 
 import android.content.Context
 import android.graphics.drawable.Drawable
-import android.os.Build
 import android.util.AttributeSet
 import android.view.PointerIcon
 import android.view.View
@@ -123,7 +122,7 @@ class ServiceButton @JvmOverloads constructor(
         TooltipCompat.setTooltipText(this, description)
         val enabled = state.canStop || state == BaseService.State.Stopped
         isEnabled = enabled
-        if (Build.VERSION.SDK_INT >= 24) pointerIcon = PointerIcon.getSystemIcon(
+        pointerIcon = PointerIcon.getSystemIcon(
             context,
             if (enabled) PointerIcon.TYPE_HAND else PointerIcon.TYPE_WAIT
         )
diff --git a/app/src/main/java/io/nekohasekai/sagernet/widget/StatsBar.kt b/app/src/main/java/io/nekohasekai/sagernet/widget/StatsBar.kt
deleted file mode 100644
index 728a4cca34..0000000000
--- a/app/src/main/java/io/nekohasekai/sagernet/widget/StatsBar.kt
+++ /dev/null
@@ -1,346 +0,0 @@
-package io.nekohasekai.sagernet.widget
-
-import android.annotation.SuppressLint
-import android.content.Context
-import android.text.format.Formatter
-import android.util.AttributeSet
-import android.view.View
-import android.widget.TextView
-import androidx.appcompat.widget.TooltipCompat
-import androidx.coordinatorlayout.widget.CoordinatorLayout
-import androidx.lifecycle.lifecycleScope
-import androidx.lifecycle.whenStarted
-import com.google.android.material.bottomappbar.BottomAppBar
-import io.nekohasekai.sagernet.R
-import io.nekohasekai.sagernet.bg.BaseService
-import io.nekohasekai.sagernet.database.DataStore
-import io.nekohasekai.sagernet.ktx.*
-import io.nekohasekai.sagernet.ui.MainActivity
-import kotlin.math.abs
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-
-class StatsBar @JvmOverloads constructor(
-    context: Context, attrs: AttributeSet? = null,
-    defStyleAttr: Int = R.attr.bottomAppBarStyle,
-) : BottomAppBar(context, attrs, defStyleAttr) {
-    companion object {
-        private const val INITIAL_HIDE_DELAY_MS = 100L
-        private const val SCROLL_TOGGLE_THRESHOLD_DP = 8f
-    }
-
-    private enum class Transition {
-        ShowImmediate,
-        ShowAnimated,
-        HideImmediate,
-        HideAfterStart,
-    }
-
-    private lateinit var statusText: TextView
-    private lateinit var txText: TextView
-    private lateinit var rxText: TextView
-    @Suppress("unused")
-    private lateinit var behavior: YourBehavior
-    private var currentState = BaseService.State.Idle
-    private var pendingTransition: Transition? = Transition.HideImmediate
-    private var transitionJob: Job? = null
-
-    private var scrollHidden = false
-    private var scrollDirection = 0 // 1 = hide (dy>0), -1 = show (dy<0), 0 = none
-    private var scrollAccumulatedDy = 0
-    private val scrollToggleThresholdPx =
-        (SCROLL_TOGGLE_THRESHOLD_DP * resources.displayMetrics.density).toInt().coerceAtLeast(8)
-
-    var useExternalScrollDriver = false
-        set(value) {
-            if (field == value) return
-            field = value
-            syncScrollHiddenFromView()
-            resetScrollDriverState()
-            updateHideOnScroll()
-        }
-
-    var allowShow = false
-        set(value) {
-            field = value
-            updateHideOnScroll()
-        }
-
-    init {
-        alpha = 0f
-    }
-
-    override fun getBehavior(): YourBehavior {
-        if (!this::behavior.isInitialized) behavior = YourBehavior()
-        return behavior
-    }
-
-    inner class YourBehavior : Behavior() {
-
-        override fun onStartNestedScroll(
-            coordinatorLayout: CoordinatorLayout,
-            child: BottomAppBar,
-            directTarget: View,
-            target: View,
-            nestedScrollAxes: Int,
-            type: Int,
-        ): Boolean {
-            if (useExternalScrollDriver) return false
-            return super.onStartNestedScroll(
-                coordinatorLayout,
-                child,
-                directTarget,
-                target,
-                nestedScrollAxes,
-                type,
-            )
-        }
-
-        override fun slideUp(child: BottomAppBar) {
-            if (!allowShow) return
-            super.slideUp(child)
-        }
-    }
-
-    override fun onLayout(changed: Boolean, left: Int, top: Int, right: Int, bottom: Int) {
-        super.onLayout(changed, left, top, right, bottom)
-        val transition = pendingTransition
-        if (transition != null) {
-            pendingTransition = null
-            applyTransition(transition)
-        } else if (alpha == 0f) {
-            alpha = 1f
-        }
-    }
-
-    override fun setOnClickListener(l: OnClickListener?) {
-        statusText = findViewById(R.id.status)
-        txText = findViewById(R.id.tx)
-        rxText = findViewById(R.id.rx)
-        super.setOnClickListener(l)
-    }
-
-    private fun setStatus(text: CharSequence) {
-        statusText.text = text
-        TooltipCompat.setTooltipText(this, text)
-    }
-
-    private fun updateHideOnScroll() {
-        hideOnScroll =
-            !useExternalScrollDriver && allowShow && currentState == BaseService.State.Connected
-    }
-
-    private fun shouldShow(): Boolean {
-        return allowShow && currentState == BaseService.State.Connected
-    }
-
-    private fun resetScrollDriverState() {
-        scrollDirection = 0
-        scrollAccumulatedDy = 0
-    }
-
-    private fun syncScrollHiddenFromView() {
-        if (!isLaidOut || height <= 0) return
-        scrollHidden = translationY >= height / 2f
-    }
-
-    fun onListScrolled(dy: Int) {
-        if (!useExternalScrollDriver || !shouldShow() || dy == 0) return
-
-        val direction = if (dy > 0) 1 else -1
-        if (direction != scrollDirection) {
-            scrollDirection = direction
-            scrollAccumulatedDy = 0
-        }
-        scrollAccumulatedDy += dy
-
-        val wantHidden = scrollAccumulatedDy > 0
-        if (wantHidden == scrollHidden) {
-            if (abs(scrollAccumulatedDy) > scrollToggleThresholdPx) {
-                scrollAccumulatedDy = direction * scrollToggleThresholdPx
-            }
-            return
-        }
-        if (abs(scrollAccumulatedDy) < scrollToggleThresholdPx) return
-
-        scrollHidden = wantHidden
-        scrollAccumulatedDy = 0
-        if (wantHidden) performHide() else performShow()
-    }
-
-    fun syncMainControls(
-        showControls: Boolean,
-        state: BaseService.State,
-        showWhenConnected: Boolean,
-        animate: Boolean,
-    ) {
-        currentState = state
-        allowShow = showControls
-        when {
-            !showControls || state != BaseService.State.Connected -> {
-                applyTransition(
-                    if (animate && showControls) Transition.HideAfterStart else Transition.HideImmediate
-                )
-            }
-
-            showWhenConnected -> applyTransition(
-                if (animate) Transition.ShowAnimated else Transition.ShowImmediate
-            )
-            alpha == 0f && isLaidOut -> alpha = 1f
-        }
-    }
-
-    private fun applyTransition(transition: Transition) {
-        if (transition == Transition.HideImmediate && hasPendingDelayedHide()) return
-        cancelPendingTransition()
-        if (!isLaidOut || height == 0) {
-            pendingTransition = transition
-            alpha = if (transition == Transition.HideImmediate && !allowShow) 0f else 1f
-            return
-        }
-        pendingTransition = null
-        when (transition) {
-            Transition.ShowImmediate -> commitVisible(animated = false)
-            Transition.ShowAnimated -> commitVisible(animated = true)
-            Transition.HideImmediate -> commitHidden(animated = false)
-            Transition.HideAfterStart -> commitHidden(animated = true)
-        }
-    }
-
-    private fun commitVisible(animated: Boolean) {
-        alpha = 1f
-        scrollHidden = false
-        resetScrollDriverState()
-        if (animated) {
-            performShow()
-        } else {
-            getBehavior().slideUp(this)
-            animate().cancel()
-            translationY = 0f
-        }
-    }
-
-    private fun commitHidden(animated: Boolean) {
-        alpha = 1f
-        scrollHidden = true
-        resetScrollDriverState()
-        if (!animated) {
-            syncHiddenPosition()
-            return
-        }
-        val activity = context as? MainActivity
-        if (activity == null) {
-            post {
-                if (shouldShow()) {
-                    commitVisible(animated = false)
-                } else if (isLaidOut && height > 0) {
-                    performHide()
-                } else {
-                    pendingTransition = Transition.HideAfterStart
-                }
-            }
-            return
-        }
-        transitionJob = activity.lifecycleScope.launch(Dispatchers.Main) {
-            delay(INITIAL_HIDE_DELAY_MS)
-            activity.whenStarted {
-                transitionJob = null
-                if (shouldShow()) {
-                    commitVisible(animated = false)
-                } else if (isLaidOut && height > 0) {
-                    performHide()
-                } else {
-                    pendingTransition = Transition.HideAfterStart
-                }
-            }
-        }
-    }
-
-    private fun syncHiddenPosition() {
-        getBehavior().slideDown(this)
-        animate().cancel()
-        translationY = height.toFloat()
-        alpha = 1f
-    }
-
-    private fun cancelPendingTransition() {
-        transitionJob?.cancel()
-        transitionJob = null
-    }
-
-    private fun hasPendingDelayedHide(): Boolean {
-        return pendingTransition == Transition.HideAfterStart || transitionJob != null
-    }
-
-    fun changeState(state: BaseService.State) {
-        currentState = state
-        updateHideOnScroll()
-        if (state == BaseService.State.Connected) {
-            setStatus(app.getText(R.string.vpn_connected))
-        } else {
-            updateSpeed(0, 0)
-            setStatus(
-                context.getText(
-                    when (state) {
-                        BaseService.State.Connecting -> R.string.connecting
-                        BaseService.State.Stopping -> R.string.stopping
-                        else -> R.string.not_connected
-                    }
-                )
-            )
-        }
-    }
-
-    @SuppressLint("SetTextI18n")
-    fun updateSpeed(txRate: Long, rxRate: Long) {
-        txText.text = "▲  ${
-            context.getString(
-                R.string.speed, Formatter.formatFileSize(context, txRate)
-            )
-        }"
-        rxText.text = "▼  ${
-            context.getString(
-                R.string.speed, Formatter.formatFileSize(context, rxRate)
-            )
-        }"
-    }
-
-    fun testConnection() {
-        val activity = context as MainActivity
-        isEnabled = false
-        setStatus(app.getText(R.string.connection_test_testing))
-        runOnDefaultDispatcher {
-            try {
-                val elapsed = activity.urlTest()
-                onMainDispatcher {
-                    isEnabled = true
-                    setStatus(
-                        app.getString(
-                            if (DataStore.connectionTestURL.startsWith("https://")) {
-                                R.string.connection_test_available
-                            } else {
-                                R.string.connection_test_available_http
-                            }, elapsed
-                        )
-                    )
-                }
-
-            } catch (e: Exception) {
-                Logs.w(e.toString())
-                onMainDispatcher {
-                    isEnabled = true
-                    setStatus(app.getText(R.string.connection_test_testing))
-
-                    activity.snackbar(
-                        app.getString(
-                            R.string.connection_test_error, e.readableMessage
-                        )
-                    ).show()
-                }
-            }
-        }
-    }
-
-}
diff --git a/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt b/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
index f06e26d84b..ddee9d1b41 100644
--- a/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt
@@ -3,9 +3,6 @@ package moe.matsuri.nb4a
 import android.content.Context
 import android.net.ConnectivityManager
 import android.net.wifi.WifiManager
-import android.os.Build
-import android.os.Build.VERSION_CODES
-import androidx.annotation.RequiresApi
 import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.bg.ServiceNotification
 import io.nekohasekai.sagernet.database.DataStore
@@ -14,6 +11,8 @@ import io.nekohasekai.sagernet.ktx.Logs
 import io.nekohasekai.sagernet.ktx.app
 import io.nekohasekai.sagernet.ktx.runOnDefaultDispatcher
 import io.nekohasekai.sagernet.utils.PackageCache
+import io.nekohasekai.sagernet.route.routerNodeKey
+import io.nekohasekai.sagernet.route.routerStableIdOrFallback
 import libcore.BoxPlatformInterface
 import libcore.Libcore
 import libcore.NB4AInterface
@@ -34,11 +33,8 @@ class NativeInterface : BoxPlatformInterface, NB4AInterface {
         return DataStore.vpnService!!.startVpn(singTunOptionsJson, tunPlatformOptionsJson).toLong()
     }
 
-    override fun useProcFS(): Boolean {
-        return Build.VERSION.SDK_INT < Build.VERSION_CODES.Q
-    }
+    override fun useProcFS(): Boolean = false
 
-    @RequiresApi(Build.VERSION_CODES.Q)
     override fun findConnectionOwner(
         ipProto: Int, srcIp: String, srcPort: Int, destIp: String, destPort: Int
     ): Int {
@@ -82,26 +78,49 @@ class NativeInterface : BoxPlatformInterface, NB4AInterface {
     }
 
     override fun selector_OnProxySelected(selectorTag: String, tag: String) {
+        val service = DataStore.baseService
+        val proxy = service?.data?.proxy
+        val routerTag = proxy?.config?.routerSelectorTags?.entries
+            ?.firstOrNull { it.value == selectorTag }?.key
+        if (routerTag != null && service != null && proxy != null) {
+            val id = proxy.config.profileTagMap
+                .filterValues { it == tag }.keys.firstOrNull() ?: return
+            runOnDefaultDispatcher {
+                if (DataStore.baseService !== service || service.data.proxy !== proxy) return@runOnDefaultDispatcher
+                val selected = SagerDatabase.proxyDao.getById(id) ?: return@runOnDefaultDispatcher
+                SagerDatabase.routerGroupDao.getByStableTag(routerTag)?.let { router ->
+                    SagerDatabase.routerGroupDao.updateSelection(
+                        routerId = router.id,
+                        selectedProxyId = id,
+                        selectedNodeKey = routerNodeKey(
+                            selected.groupId,
+                            routerStableIdOrFallback(selected.uuid, selected.id),
+                        ),
+                    )
+                }
+            }
+            return
+        }
         if (selectorTag != "proxy") {
             Logs.d("other selector: $selectorTag")
             return
         }
         Libcore.resetAllConnections(true)
-        DataStore.baseService?.apply {
-            runOnDefaultDispatcher {
-                val id = data.proxy!!.config.profileTagMap
-                    .filterValues { it == tag }.keys.firstOrNull() ?: -1
-                val ent = SagerDatabase.proxyDao.getById(id) ?: return@runOnDefaultDispatcher
-                // traffic & title
-                data.proxy?.apply {
-                    looper?.selectMain(id)
-                    displayProfileName = ServiceNotification.genTitle(ent)
-                    data.notification?.postNotificationTitle(displayProfileName)
-                }
-                // post binder
-                data.binder.broadcast { b ->
-                    b.cbSelectorUpdate(id)
-                }
+        if (service == null || proxy == null) return
+        runOnDefaultDispatcher {
+            if (DataStore.baseService !== service || service.data.proxy !== proxy) return@runOnDefaultDispatcher
+            val id = proxy.config.profileTagMap
+                .filterValues { it == tag }.keys.firstOrNull() ?: -1
+            val ent = SagerDatabase.proxyDao.getById(id) ?: return@runOnDefaultDispatcher
+            // traffic & title
+            proxy.apply {
+                looper?.selectMain(id)
+                displayProfileName = ServiceNotification.genTitle(ent)
+                service.data.notification?.postNotificationTitle(displayProfileName)
+            }
+            // post binder
+            service.data.binder.broadcast { b ->
+                b.cbSelectorUpdate(id)
             }
         }
     }
diff --git a/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java b/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java
index 0cfb24a225..aff361defe 100644
--- a/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java
+++ b/app/src/main/java/moe/matsuri/nb4a/SingBoxOptions.java
@@ -113,12 +113,94 @@ public static class MyOptions extends SingBoxOption {
 
         public List<SingBoxOption> outbounds;
 
+        public List<SingBoxOption> endpoints;
+
         public RouteOptions route;
 
         public ExperimentalOptions experimental;
 
     }
 
+    // sing-box 1.15 moved some protocols (WireGuard) from outbounds to endpoints.
+
+    public static class Endpoint extends SingBoxOption {
+
+        public String type;
+
+        public String tag;
+
+    }
+
+    public static class Endpoint_WireGuardPeer extends SingBoxOption {
+
+        public String address;
+
+        public Integer port;
+
+        public String public_key;
+
+        public String pre_shared_key;
+
+        // Generate note: Listable
+        public List<String> allowed_ips;
+
+        public Integer persistent_keepalive_interval;
+
+        // Generate note: Base64 String
+        public String reserved;
+
+    }
+
+    public static class Endpoint_WireGuardOptions extends Endpoint {
+
+        // Generate note: nested type DialerOptions
+        public String detour;
+
+        public String bind_interface;
+
+        public String inet4_bind_address;
+
+        public String inet6_bind_address;
+
+        public String protect_path;
+
+        public Integer routing_mark;
+
+        public Boolean reuse_addr;
+
+        public Long connect_timeout;
+
+        public Boolean tcp_fast_open;
+
+        public Boolean tcp_multi_path;
+
+        public Boolean udp_fragment;
+
+        public String domain_strategy;
+
+        public Long fallback_delay;
+
+        // End of public DialerOptions ;
+
+        public Boolean system;
+
+        public String name;
+
+        public Integer mtu;
+
+        // Generate note: Listable
+        public List<String> address;
+
+        public String private_key;
+
+        public Integer listen_port;
+
+        public List<Endpoint_WireGuardPeer> peers;
+
+        public Integer workers;
+
+    }
+
     // paste generate output here
 
     public static class ClashAPIOptions extends SingBoxOption {
@@ -2829,20 +2911,22 @@ public static class Inbound_TunOptions extends Inbound {
         public Integer mtu;
 
         // Generate note: Listable
-        public List<String> inet4_address;
+        public List<String> address;
+
+        public String dns_mode;
 
         // Generate note: Listable
-        public List<String> inet6_address;
+        public List<String> dns_address;
 
         public Boolean auto_route;
 
         public Boolean strict_route;
 
         // Generate note: Listable
-        public List<String> inet4_route_address;
+        public List<String> route_address;
 
         // Generate note: Listable
-        public List<String> inet6_route_address;
+        public List<String> route_exclude_address;
 
         // Generate note: Listable
         public List<String> include_interface;
@@ -2871,8 +2955,6 @@ public static class Inbound_TunOptions extends Inbound {
         // Generate note: Listable
         public List<String> exclude_package;
 
-        public Boolean endpoint_independent_nat;
-
         public Long udp_timeout;
 
         public String stack;
@@ -4452,10 +4534,12 @@ public static class Outbound_URLTestOptions extends Outbound {
 
         public String url;
 
-        public Long interval;
+        public String interval;
 
         public Integer tolerance;
 
+        public String idle_timeout;
+
     }
 
     public static class Rule_DefaultOptions extends Rule {
diff --git a/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunNative.kt b/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunNative.kt
deleted file mode 100644
index 2fa9751256..0000000000
--- a/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunNative.kt
+++ /dev/null
@@ -1,34 +0,0 @@
-package moe.matsuri.nb4a.hevtun
-
-import androidx.annotation.Keep
-
-/**
- * JNI bindings for hev-socks5-tunnel.
- *
- * The native methods are registered via RegisterNatives in JNI_OnLoad against
- * the class named by the -DPKGNAME/-DCLSNAME macros in
- * buildScript/compile-hevtun.sh; keep both sides in sync.
- */
-@Keep
-object HevTunNative {
-
-    init {
-        System.loadLibrary("hev-socks5-tunnel")
-    }
-
-    @JvmStatic
-    @Keep
-    external fun TProxyStartService(configPath: String, fd: Int): Boolean
-
-    @JvmStatic
-    @Keep
-    external fun TProxyStopService(): Boolean
-
-    @JvmStatic
-    @Keep
-    external fun TProxyIsRunning(): Boolean
-
-    @JvmStatic
-    @Keep
-    external fun TProxyGetStats(): LongArray
-}
diff --git a/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunRuntime.kt b/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunRuntime.kt
deleted file mode 100644
index f1d949493c..0000000000
--- a/app/src/main/java/moe/matsuri/nb4a/hevtun/HevTunRuntime.kt
+++ /dev/null
@@ -1,84 +0,0 @@
-package moe.matsuri.nb4a.hevtun
-
-import android.content.Context
-import io.nekohasekai.sagernet.IPv6Mode
-import io.nekohasekai.sagernet.bg.VpnService
-import io.nekohasekai.sagernet.database.DataStore
-import io.nekohasekai.sagernet.fmt.LOCALHOST
-import java.io.File
-
-/**
- * Manages the in-process hev-socks5-tunnel runtime. The tunnel reads packets
- * from the VPN file descriptor and forwards TCP/UDP connections into the
- * sing-box mixed inbound on loopback.
- */
-object HevTunRuntime {
-
-    private const val CONFIG_FILE = "hev-socks5-tunnel.yaml"
-
-    private var running = false
-
-    fun isRunning(): Boolean {
-        return try {
-            HevTunNative.TProxyIsRunning()
-        } catch (e: UnsatisfiedLinkError) {
-            false
-        }
-    }
-
-    @Synchronized
-    fun start(context: Context, tunFd: Int) {
-        stop()
-        val configFile = File(context.filesDir, CONFIG_FILE)
-        configFile.writeText(buildConfig())
-        check(HevTunNative.TProxyStartService(configFile.absolutePath, tunFd)) {
-            "Failed to start hev-socks5-tunnel"
-        }
-        running = true
-    }
-
-    @Synchronized
-    fun stop() {
-        if (!running) return
-        try {
-            HevTunNative.TProxyStopService()
-        } finally {
-            running = false
-        }
-    }
-
-    private fun buildConfig(): String {
-        val useAuth = DataStore.mixedInboundHasAuth
-        return buildString {
-            appendLine("tunnel:")
-            appendLine("  mtu: ${DataStore.mtu}")
-            appendLine("  ipv4: '${VpnService.PRIVATE_VLAN4_CLIENT}'")
-            if (DataStore.ipv6Mode != IPv6Mode.DISABLE) {
-                appendLine("  ipv6: '${VpnService.PRIVATE_VLAN6_CLIENT}'")
-            }
-            appendLine("socks5:")
-            appendLine("  port: ${DataStore.mixedPort}")
-            appendLine("  address: '$LOCALHOST'")
-            appendLine("  udp: 'udp'")
-            appendLine("  pipeline: true")
-            if (useAuth) {
-                appendLine("  username: '${DataStore.mixedUsername.yamlEscape()}'")
-                appendLine("  password: '${DataStore.mixedSecret.yamlEscape()}'")
-            }
-            if (DataStore.enableFakeDns) {
-                appendLine("mapdns:")
-                appendLine("  address: '${VpnService.PRIVATE_VLAN4_ROUTER}'")
-                appendLine("  port: 53")
-                appendLine("  network: '${VpnService.HEV_MAPDNS_VLAN4}'")
-                appendLine("  netmask: '255.192.0.0'")
-                appendLine("  cache-size: 10000")
-            }
-            appendLine("misc:")
-            appendLine("  log-level: 'warn'")
-        }
-    }
-
-    private fun String.yamlEscape(): String {
-        return replace("'", "''")
-    }
-}
diff --git a/app/src/main/java/moe/matsuri/nb4a/net/LocalResolverImpl.kt b/app/src/main/java/moe/matsuri/nb4a/net/LocalResolverImpl.kt
index 9b125aeeab..708811b5cf 100644
--- a/app/src/main/java/moe/matsuri/nb4a/net/LocalResolverImpl.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/net/LocalResolverImpl.kt
@@ -1,38 +1,24 @@
 package moe.matsuri.nb4a.net
 
 import android.net.DnsResolver
-import android.os.Build
 import android.os.CancellationSignal
 import android.system.ErrnoException
-import androidx.annotation.RequiresApi
 import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.ktx.Logs
-import io.nekohasekai.sagernet.ktx.runOnIoDispatcher
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.asExecutor
 import libcore.ExchangeContext
 import libcore.LocalDNSTransport
 import java.net.InetAddress
-import java.net.UnknownHostException
 
 object LocalResolverImpl : LocalDNSTransport {
 
     // new local
 
-    private const val RCODE_NXDOMAIN = 3
+    override fun raw(): Boolean = true
 
-    override fun raw(): Boolean {
-        return Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q
-    }
-
-    override fun networkHandle(): Long {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            return SagerNet.underlyingNetwork?.networkHandle ?: 0
-        }
-        return 0
-    }
+    override fun networkHandle(): Long = SagerNet.underlyingNetwork?.networkHandle ?: 0
 
-    @RequiresApi(Build.VERSION_CODES.Q)
     override fun exchange(ctx: ExchangeContext, message: ByteArray) {
         val signal = CancellationSignal()
         ctx.onCancel(signal::cancel)
@@ -64,88 +50,64 @@ object LocalResolverImpl : LocalDNSTransport {
     }
 
     override fun lookup(ctx: ExchangeContext, network: String, domain: String) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            val signal = CancellationSignal()
-            ctx.onCancel(signal::cancel)
-
-            val callback = object : DnsResolver.Callback<Collection<InetAddress>> {
-                override fun onAnswer(answer: Collection<InetAddress>, rcode: Int) {
-                    try {
-                        if (rcode == 0) {
-                            ctx.success(answer.mapNotNull { it.hostAddress }.joinToString("\n"))
-                        } else {
-                            ctx.errorCode(rcode)
-                        }
-                    } catch (e: Exception) {
-                        Logs.w(e)
-                        ctx.errnoCode(114514)
-                    }
-                }
+        val signal = CancellationSignal()
+        ctx.onCancel(signal::cancel)
 
-                override fun onError(error: DnsResolver.DnsException) {
-                    try {
-                        val cause = error.cause
-                        if (cause is ErrnoException) {
-                            ctx.errnoCode(cause.errno)
-                        } else {
-                            Logs.w(error)
-                            ctx.errnoCode(114514)
-                        }
-                    } catch (e: Exception) {
-                        Logs.w(e)
-                        ctx.errnoCode(114514)
+        val callback = object : DnsResolver.Callback<Collection<InetAddress>> {
+            override fun onAnswer(answer: Collection<InetAddress>, rcode: Int) {
+                try {
+                    if (rcode == 0) {
+                        ctx.success(answer.mapNotNull { it.hostAddress }.joinToString("\n"))
+                    } else {
+                        ctx.errorCode(rcode)
                     }
+                } catch (e: Exception) {
+                    Logs.w(e)
+                    ctx.errnoCode(114514)
                 }
             }
 
-            val type = when {
-                network.endsWith("4") -> DnsResolver.TYPE_A
-                network.endsWith("6") -> DnsResolver.TYPE_AAAA
-                else -> null
-            }
-            if (type != null) {
-                DnsResolver.getInstance().query(
-                    SagerNet.underlyingNetwork,
-                    domain,
-                    type,
-                    DnsResolver.FLAG_NO_RETRY,
-                    Dispatchers.IO.asExecutor(),
-                    signal,
-                    callback
-                )
-            } else {
-                DnsResolver.getInstance().query(
-                    SagerNet.underlyingNetwork,
-                    domain,
-                    DnsResolver.FLAG_NO_RETRY,
-                    Dispatchers.IO.asExecutor(),
-                    signal,
-                    callback
-                )
-            }
-        } else {
-            runOnIoDispatcher {
-                // 老版本系统，继续用阻塞的 InetAddress
+            override fun onError(error: DnsResolver.DnsException) {
                 try {
-                    val u = SagerNet.underlyingNetwork
-                    val answer = try {
-                        u?.getAllByName(domain)
-                    } catch (e: UnknownHostException) {
-                        null
-                    } ?: InetAddress.getAllByName(domain)
-                    if (answer != null) {
-                        ctx.success(answer.mapNotNull { it.hostAddress }.joinToString("\n"))
+                    val cause = error.cause
+                    if (cause is ErrnoException) {
+                        ctx.errnoCode(cause.errno)
                     } else {
+                        Logs.w(error)
                         ctx.errnoCode(114514)
                     }
-                } catch (e: UnknownHostException) {
-                    ctx.errorCode(RCODE_NXDOMAIN)
                 } catch (e: Exception) {
                     Logs.w(e)
                     ctx.errnoCode(114514)
                 }
             }
         }
+
+        val type = when {
+            network.endsWith("4") -> DnsResolver.TYPE_A
+            network.endsWith("6") -> DnsResolver.TYPE_AAAA
+            else -> null
+        }
+        if (type != null) {
+            DnsResolver.getInstance().query(
+                SagerNet.underlyingNetwork,
+                domain,
+                type,
+                DnsResolver.FLAG_NO_RETRY,
+                Dispatchers.IO.asExecutor(),
+                signal,
+                callback
+            )
+        } else {
+            DnsResolver.getInstance().query(
+                SagerNet.underlyingNetwork,
+                domain,
+                DnsResolver.FLAG_NO_RETRY,
+                Dispatchers.IO.asExecutor(),
+                signal,
+                callback
+            )
+        }
     }
 
-}
\ No newline at end of file
+}
diff --git a/app/src/main/java/moe/matsuri/nb4a/plugin/Plugins.kt b/app/src/main/java/moe/matsuri/nb4a/plugin/Plugins.kt
index a584cadfa0..2561fd2083 100644
--- a/app/src/main/java/moe/matsuri/nb4a/plugin/Plugins.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/plugin/Plugins.kt
@@ -5,7 +5,6 @@ import android.content.pm.PackageInfo
 import android.content.pm.PackageManager
 import android.content.pm.ProviderInfo
 import android.net.Uri
-import android.os.Build
 import android.widget.Toast
 import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.plugin.PluginManager.loadString
@@ -101,11 +100,8 @@ object Plugins {
         .build()
 
     private fun getExtPluginOld(pluginId: String): List<ProviderInfo> {
-        var flags = PackageManager.GET_META_DATA
-        if (Build.VERSION.SDK_INT >= 24) {
-            flags =
-                flags or PackageManager.MATCH_DIRECT_BOOT_UNAWARE or PackageManager.MATCH_DIRECT_BOOT_AWARE
-        }
+        val flags = PackageManager.GET_META_DATA or
+                PackageManager.MATCH_DIRECT_BOOT_UNAWARE or PackageManager.MATCH_DIRECT_BOOT_AWARE
         val list1 = SagerNet.application.packageManager.queryIntentContentProviders(
             Intent(ACTION_NATIVE_PLUGIN, buildUri(pluginId, "io.nekohasekai.sagernet")), flags
         )
diff --git a/app/src/main/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmt.kt b/app/src/main/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmt.kt
index fc1a947e2e..d58e406e53 100644
--- a/app/src/main/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmt.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmt.kt
@@ -1,5 +1,6 @@
 package moe.matsuri.nb4a.proxy.anytls
 
+import io.nekohasekai.sagernet.database.DataStore
 import io.nekohasekai.sagernet.ktx.blankAsNull
 import io.nekohasekai.sagernet.ktx.linkBuilder
 import io.nekohasekai.sagernet.ktx.toLink
@@ -7,6 +8,30 @@ import io.nekohasekai.sagernet.ktx.urlSafe
 import moe.matsuri.nb4a.SingBoxOptions
 import moe.matsuri.nb4a.utils.listByLineOrComma
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import org.json.JSONObject
+
+fun parseSingBoxAnyTLS(json: JSONObject): AnyTLSBean? = parseSingBoxAnyTLSMap(buildMap {
+    for (key in json.keys()) put(key, json.get(key))
+})
+
+internal fun parseSingBoxAnyTLSMap(json: Map<String, Any?>): AnyTLSBean? {
+    if (json["type"] != "anytls") return null
+    val server = json["server"]?.toString()?.takeIf { it.isNotBlank() } ?: return null
+    val port = (json["server_port"] as? Number)?.toInt()?.takeIf { it > 0 } ?: return null
+    val tls = json["tls"] as? Map<*, *>
+    val utls = tls?.get("utls") as? Map<*, *>
+    return AnyTLSBean().apply {
+        name = json["tag"]?.toString()?.takeIf { it.isNotBlank() }
+        serverAddress = server
+        serverPort = port
+        password = json["password"]?.toString() ?: ""
+        sni = tls?.get("server_name")?.toString() ?: ""
+        allowInsecure = tls?.get("insecure") as? Boolean ?: false
+        utlsFingerprint = utls?.get("fingerprint")?.toString() ?: ""
+        alpn = (tls?.get("alpn") as? List<*>)?.joinToString("\n") ?: ""
+        initializeDefaultValues()
+    }
+}
 
 fun buildSingBoxOutboundAnyTLSBean(bean: AnyTLSBean): SingBoxOptions.Outbound_AnyTLSOptions {
     return SingBoxOptions.Outbound_AnyTLSOptions().apply {
@@ -18,7 +43,7 @@ fun buildSingBoxOutboundAnyTLSBean(bean: AnyTLSBean): SingBoxOptions.Outbound_An
         tls = SingBoxOptions.OutboundTLSOptions().apply {
             enabled = true
             server_name = bean.sni.blankAsNull()
-            if (bean.allowInsecure) insecure = true
+            insecure = bean.allowInsecure || DataStore.globalAllowInsecure
             alpn = bean.alpn.blankAsNull()?.listByLineOrComma()
             bean.certificates.blankAsNull()?.let {
                 certificate = it
diff --git a/app/src/main/java/moe/matsuri/nb4a/utils/JavaUtil.java b/app/src/main/java/moe/matsuri/nb4a/utils/JavaUtil.java
index 1e3614736f..8f5a7eeb55 100644
--- a/app/src/main/java/moe/matsuri/nb4a/utils/JavaUtil.java
+++ b/app/src/main/java/moe/matsuri/nb4a/utils/JavaUtil.java
@@ -1,10 +1,7 @@
 package moe.matsuri.nb4a.utils;
 
-import android.annotation.SuppressLint;
-import android.annotation.TargetApi;
 import android.app.Application;
 import android.content.Context;
-import android.os.Build;
 import android.text.TextUtils;
 import android.webkit.WebView;
 
@@ -14,7 +11,6 @@
 
 import java.io.File;
 import java.io.RandomAccessFile;
-import java.lang.reflect.Method;
 import java.nio.channels.FileLock;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -69,15 +65,11 @@ public static String unescapeString(CharSequence encodedString) {
     // Webview Utils
 
     public static void handleWebviewDir(Context context) {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.P) {
-            return;
-        }
         try {
             Set<String> pathSet = new HashSet<>();
             String suffix;
             String dataPath = context.getDataDir().getAbsolutePath();
             String webViewDir = "/app_webview";
-            String huaweiWebViewDir = "/app_hws_webview";
             String lockFile = "/webview_data.lock";
             String processName = Application.getProcessName();
             if (!BuildConfig.APPLICATION_ID.equals(processName)) {//判断不等于默认进程名称
@@ -85,18 +77,11 @@ public static void handleWebviewDir(Context context) {
                 WebView.setDataDirectorySuffix(suffix);
                 suffix = "_" + suffix;
                 pathSet.add(dataPath + webViewDir + suffix + lockFile);
-                if (checkIsHuaweiRom()) {
-                    pathSet.add(dataPath + huaweiWebViewDir + suffix + lockFile);
-                }
             } else {
                 //主进程
                 suffix = "_" + processName;
                 pathSet.add(dataPath + webViewDir + lockFile);//默认未添加进程名后缀
                 pathSet.add(dataPath + webViewDir + suffix + lockFile);//系统自动添加了进程名后缀
-                if (checkIsHuaweiRom()) {//部分华为手机更改了webview目录名
-                    pathSet.add(dataPath + huaweiWebViewDir + lockFile);
-                    pathSet.add(dataPath + huaweiWebViewDir + suffix + lockFile);
-                }
             }
             for (String path : pathSet) {
                 File file = new File(path);
@@ -110,7 +95,6 @@ public static void handleWebviewDir(Context context) {
         }
     }
 
-    @TargetApi(Build.VERSION_CODES.P)
     private static void tryLockOrRecreateFile(File file) {
         try {
             FileLock tryLock = new RandomAccessFile(file, "rw").getChannel().tryLock();
@@ -139,26 +123,8 @@ private static void createFile(File file, boolean deleted) {
         }
     }
 
-    private static boolean checkIsHuaweiRom() {
-        return Build.MANUFACTURER.contains("HUAWEI");
-    }
-
-    @SuppressLint("PrivateApi")
     public static String getProcessName() {
-        if (Build.VERSION.SDK_INT >= 28)
-            return Application.getProcessName();
-
-        // Using the same technique as Application.getProcessName() for older devices
-        // Using reflection since ActivityThread is an internal API
-
-        try {
-            Class<?> activityThread = Class.forName("android.app.ActivityThread");
-            String methodName = "currentProcessName";
-            Method getProcessName = activityThread.getDeclaredMethod(methodName);
-            return (String) getProcessName.invoke(null);
-        } catch (Exception e) {
-            return BuildConfig.APPLICATION_ID;
-        }
+        return Application.getProcessName();
     }
 
     // Old hutool Utils
diff --git a/app/src/main/java/moe/matsuri/nb4a/utils/KotlinUtil.kt b/app/src/main/java/moe/matsuri/nb4a/utils/KotlinUtil.kt
index 14f2240fdf..02ada7b64d 100644
--- a/app/src/main/java/moe/matsuri/nb4a/utils/KotlinUtil.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/utils/KotlinUtil.kt
@@ -7,6 +7,7 @@ import androidx.appcompat.content.res.AppCompatResources
 import io.nekohasekai.sagernet.SagerNet
 import io.nekohasekai.sagernet.ktx.Logs
 import java.io.File
+import java.util.Locale
 
 // SagerNet Class
 
@@ -50,9 +51,9 @@ fun Context.getDrawableByName(name: String?): Drawable? {
 fun Long.toBytesString(): String {
     val size = this.toDouble()
     return when {
-        this >= GB -> String.format("%.2f GiB", size / GB)
-        this >= MB -> String.format("%.2f MiB", size / MB)
-        this >= KB -> String.format("%.2f KiB", size / KB)
+        this >= GB -> String.format(Locale.getDefault(), "%.2f GiB", size / GB)
+        this >= MB -> String.format(Locale.getDefault(), "%.2f MiB", size / MB)
+        this >= KB -> String.format(Locale.getDefault(), "%.2f KiB", size / KB)
         else -> "$this Bytes"
     }
 }
diff --git a/app/src/main/java/moe/matsuri/nb4a/utils/WebViewUtil.kt b/app/src/main/java/moe/matsuri/nb4a/utils/WebViewUtil.kt
index ebce693e47..ab5865cb77 100644
--- a/app/src/main/java/moe/matsuri/nb4a/utils/WebViewUtil.kt
+++ b/app/src/main/java/moe/matsuri/nb4a/utils/WebViewUtil.kt
@@ -1,6 +1,5 @@
 package moe.matsuri.nb4a.utils
 
-import android.os.Build
 import android.webkit.WebResourceError
 import android.webkit.WebResourceRequest
 import android.webkit.WebResourceResponse
@@ -13,7 +12,7 @@ object WebViewUtil {
     fun onReceivedError(
         view: WebView?, request: WebResourceRequest?, error: WebResourceError?
     ) {
-        if (Build.VERSION.SDK_INT >= 23 && error != null) {
+        if (error != null) {
             Logs.e("WebView error description: ${error.description}")
         }
         Logs.e("WebView error: ${error.toString()}")
diff --git a/app/src/main/res/drawable/ic_action_navigate_next.xml b/app/src/main/res/drawable/ic_action_navigate_next.xml
new file mode 100644
index 0000000000..02dc82bced
--- /dev/null
+++ b/app/src/main/res/drawable/ic_action_navigate_next.xml
@@ -0,0 +1,10 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24"
+    android:tint="?attr/colorControlNormal">
+  <path
+      android:fillColor="@android:color/white"
+      android:pathData="M10,6L8.59,7.41 13.17,12l-4.58,4.59L10,18l6,-6z"/>
+</vector>
diff --git a/app/src/main/res/drawable/ic_asteria_foreground.xml b/app/src/main/res/drawable/ic_asteria_foreground.xml
new file mode 100644
index 0000000000..fbef43b860
--- /dev/null
+++ b/app/src/main/res/drawable/ic_asteria_foreground.xml
@@ -0,0 +1,62 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+
+    <!-- Outer Orbital Ring -->
+    <path
+        android:pathData="M 54 22 C 71.67 22 86 36.33 86 54 C 86 71.67 71.67 86 54 86 C 36.33 86 22 71.67 22 54 C 22 36.33 36.33 22 54 22 Z"
+        android:strokeWidth="1.8"
+        android:strokeAlpha="0.4">
+        <aapt:attr name="android:strokeColor">
+            <gradient
+                android:type="linear"
+                android:startX="22"
+                android:startY="22"
+                android:endX="86"
+                android:endY="86">
+                <item android:color="#FF818CF8" android:offset="0.0" />
+                <item android:color="#FFC084FC" android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+
+    <!-- Celestial Core / 8-Point Asteria Star -->
+    <path
+        android:pathData="M 54 27 L 57.5 45.5 L 75 42 L 61 54 L 75 66 L 57.5 62.5 L 54 81 L 50.5 62.5 L 33 66 L 47 54 L 33 42 L 50.5 45.5 Z">
+        <aapt:attr name="android:fillColor">
+            <gradient
+                android:type="linear"
+                android:startX="33"
+                android:startY="27"
+                android:endX="75"
+                android:endY="81">
+                <item android:color="#FF67E8F9" android:offset="0.0" />
+                <item android:color="#FF818CF8" android:offset="0.5" />
+                <item android:color="#FFE879F9" android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+
+    <!-- Central Radiant Diamond -->
+    <path
+        android:pathData="M 54 46 L 62 54 L 54 62 L 46 54 Z"
+        android:fillColor="#FFFFFFFF" />
+
+    <!-- Orbital Energy Sparks -->
+    <path
+        android:pathData="M 54 18 L 55.5 21 L 54 24 L 52.5 21 Z"
+        android:fillColor="#FF67E8F9" />
+    <path
+        android:pathData="M 90 54 L 87 55.5 L 84 54 L 87 52.5 Z"
+        android:fillColor="#FFC084FC" />
+    <path
+        android:pathData="M 54 90 L 52.5 87 L 54 84 L 55.5 87 Z"
+        android:fillColor="#FFE879F9" />
+    <path
+        android:pathData="M 18 54 L 21 52.5 L 24 54 L 21 55.5 Z"
+        android:fillColor="#FF818CF8" />
+
+</vector>
diff --git a/app/src/main/res/drawable/ic_asteria_monochrome.xml b/app/src/main/res/drawable/ic_asteria_monochrome.xml
new file mode 100644
index 0000000000..1712d4c125
--- /dev/null
+++ b/app/src/main/res/drawable/ic_asteria_monochrome.xml
@@ -0,0 +1,32 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+
+    <!-- Outer Orbital Ring -->
+    <path
+        android:pathData="M 54 22 C 71.67 22 86 36.33 86 54 C 86 71.67 71.67 86 54 86 C 36.33 86 22 71.67 22 54 C 22 36.33 36.33 22 54 22 Z"
+        android:strokeWidth="2"
+        android:strokeColor="#FFFFFF" />
+
+    <!-- Celestial Core / 8-Point Asteria Star -->
+    <path
+        android:pathData="M 54 27 L 57.5 45.5 L 75 42 L 61 54 L 75 66 L 57.5 62.5 L 54 81 L 50.5 62.5 L 33 66 L 47 54 L 33 42 L 50.5 45.5 Z"
+        android:fillColor="#FFFFFF" />
+
+    <!-- Orbital Energy Sparks -->
+    <path
+        android:pathData="M 54 18 L 55.5 21 L 54 24 L 52.5 21 Z"
+        android:fillColor="#FFFFFF" />
+    <path
+        android:pathData="M 90 54 L 87 55.5 L 84 54 L 87 52.5 Z"
+        android:fillColor="#FFFFFF" />
+    <path
+        android:pathData="M 54 90 L 52.5 87 L 54 84 L 55.5 87 Z"
+        android:fillColor="#FFFFFF" />
+    <path
+        android:pathData="M 18 54 L 21 52.5 L 24 54 L 21 55.5 Z"
+        android:fillColor="#FFFFFF" />
+
+</vector>
diff --git a/app/src/main/res/layout/layout_backup.xml b/app/src/main/res/layout/layout_backup.xml
index 4f85a5825f..412f345645 100644
--- a/app/src/main/res/layout/layout_backup.xml
+++ b/app/src/main/res/layout/layout_backup.xml
@@ -1,13 +1,23 @@
 <?xml version="1.0" encoding="utf-8"?>
-<ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:app="http://schemas.android.com/apk/res-auto"
     android:layout_width="match_parent"
-    android:layout_height="match_parent">
+    android:layout_height="match_parent"
+    android:orientation="vertical">
 
-    <LinearLayout
+    <include
+        layout="@layout/layout_appbar"
         android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:orientation="vertical">
+        android:layout_height="wrap_content" />
+
+    <androidx.core.widget.NestedScrollView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent">
+
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="vertical">
 
         <!-- 本地备份部分 -->
         <com.google.android.material.card.MaterialCardView
@@ -105,71 +115,6 @@
             </LinearLayout>
         </com.google.android.material.card.MaterialCardView>
 
-        <!-- WebDAV 备份部分 -->
-        <com.google.android.material.card.MaterialCardView
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content"
-            android:layout_margin="8dp"
-            android:clickable="true"
-            android:focusable="true">
-
-            <LinearLayout
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:orientation="vertical">
-
-                <LinearLayout
-                    android:layout_width="match_parent"
-                    android:layout_height="wrap_content"
-                    android:orientation="vertical"
-                    android:padding="16dp">
-
-                    <TextView
-                        android:layout_width="wrap_content"
-                        android:layout_height="wrap_content"
-                        android:text="@string/backup_webdav"
-                        android:textAppearance="?attr/textAppearanceHeadline6" />
-
-                </LinearLayout>
-
-                <LinearLayout
-                    android:layout_width="match_parent"
-                    android:layout_height="wrap_content"
-                    android:layout_marginHorizontal="20dp"
-                    android:layout_marginVertical="8dp"
-                    android:orientation="vertical">
-
-                    <!-- WebDAV 备份部分的按钮 -->
-                    <Button
-                        android:id="@+id/webdav_settings"
-                        style="@style/Widget.SagerNet.Button"
-                        android:layout_width="match_parent"
-                        android:layout_height="wrap_content"
-                        app:cornerRadius="24dp"
-                        android:text="@string/webdav_settings"
-                        android:textColor="?whiteOrTextPrimary" />
-
-                    <Button
-                        android:id="@+id/backup_to_webdav"
-                        style="@style/Widget.SagerNet.Button"
-                        android:layout_width="match_parent"
-                        android:layout_height="wrap_content"
-                        app:cornerRadius="24dp"
-                        android:text="@string/backup_to_webdav"
-                        android:textColor="?whiteOrTextPrimary" />
-
-                    <Button
-                        android:id="@+id/restore_from_webdav"
-                        style="@style/Widget.SagerNet.Button"
-                        android:layout_width="match_parent"
-                        android:layout_height="wrap_content"
-                        app:cornerRadius="24dp"
-                        android:text="@string/restore_from_webdav"
-                        android:textColor="?whiteOrTextPrimary" />
-
-                </LinearLayout>
-            </LinearLayout>
-        </com.google.android.material.card.MaterialCardView>
-
-    </LinearLayout>
-</ScrollView>
+        </LinearLayout>
+    </androidx.core.widget.NestedScrollView>
+</LinearLayout>
diff --git a/app/src/main/res/layout/layout_group.xml b/app/src/main/res/layout/layout_group.xml
index caf90435b8..bc34bae8d6 100644
--- a/app/src/main/res/layout/layout_group.xml
+++ b/app/src/main/res/layout/layout_group.xml
@@ -14,10 +14,77 @@
             android:layout_width="match_parent"
             android:layout_height="wrap_content" />
 
+        <com.google.android.material.card.MaterialCardView
+            android:id="@+id/router_section"
+            style="@style/Widget.SagerNet.CardView.Elevated"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginStart="8dp"
+            android:layout_marginEnd="8dp"
+            android:layout_marginTop="8dp"
+            android:layout_marginBottom="4dp"
+            android:clickable="true"
+            android:focusable="true"
+            android:foreground="?attr/selectableItemBackground"
+            android:visibility="gone">
+
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:gravity="center_vertical"
+                android:orientation="horizontal"
+                android:paddingStart="16dp"
+                android:paddingTop="12dp"
+                android:paddingEnd="16dp"
+                android:paddingBottom="12dp">
+
+                <androidx.appcompat.widget.AppCompatImageView
+                    android:layout_width="32dp"
+                    android:layout_height="32dp"
+                    android:layout_marginEnd="16dp"
+                    app:srcCompat="@drawable/ic_hardware_router"
+                    app:tint="?colorPrimary" />
+
+                <LinearLayout
+                    android:layout_width="0dp"
+                    android:layout_height="wrap_content"
+                    android:layout_weight="1"
+                    android:orientation="vertical">
+
+                    <TextView
+                        android:id="@+id/router_title"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:text="@string/router_groups_card_title"
+                        android:textAppearance="?android:attr/textAppearanceMedium"
+                        android:textColor="?android:attr/textColorPrimary"
+                        android:textStyle="bold" />
+
+                    <TextView
+                        android:id="@+id/router_subtitle"
+                        android:layout_width="wrap_content"
+                        android:layout_height="wrap_content"
+                        android:layout_marginTop="2dp"
+                        android:text="@string/router_groups_card_summary"
+                        android:textAppearance="?android:attr/textAppearanceSmall"
+                        android:textColor="?android:attr/textColorSecondary" />
+                </LinearLayout>
+
+                <androidx.appcompat.widget.AppCompatImageView
+                    android:layout_width="24dp"
+                    android:layout_height="24dp"
+                    app:srcCompat="@drawable/ic_action_navigate_next"
+                    app:tint="?android:attr/textColorSecondary" />
+
+            </LinearLayout>
+
+        </com.google.android.material.card.MaterialCardView>
+
         <com.simplecityapps.recyclerview_fastscroll.views.FastScrollRecyclerView
             android:id="@+id/group_list"
             android:layout_width="match_parent"
-            android:layout_height="match_parent"
+            android:layout_height="0dp"
+            android:layout_weight="1"
             android:padding="4dp"
             android:scrollbarSize="0dp"
             app:fastScrollAutoHide="true"
@@ -28,4 +95,4 @@
 
     </LinearLayout>
 
-</androidx.coordinatorlayout.widget.CoordinatorLayout>
\ No newline at end of file
+</androidx.coordinatorlayout.widget.CoordinatorLayout>
diff --git a/app/src/main/res/layout/layout_main.xml b/app/src/main/res/layout/layout_main.xml
index 85092521ca..02d2e98620 100644
--- a/app/src/main/res/layout/layout_main.xml
+++ b/app/src/main/res/layout/layout_main.xml
@@ -37,67 +37,14 @@
             android:id="@+id/fab"
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
+            android:layout_gravity="bottom|end"
+            android:layout_marginEnd="16dp"
+            android:layout_marginBottom="16dp"
             android:elevation="6dp"
-            android:nextFocusDown="@+id/stats"
             app:backgroundTint="?colorPrimary"
-            app:layout_anchor="@id/stats"
             app:pressedTranslationZ="6dp"
             app:srcCompat="@drawable/ic_service_idle" />
 
-        <io.nekohasekai.sagernet.widget.StatsBar
-            android:id="@+id/stats"
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content"
-            android:layout_gravity="bottom"
-            android:nextFocusUp="@+id/fab"
-            app:backgroundTint="?colorPrimary"
-            app:contentInsetStart="0dp"
-            app:hideOnScroll="true">
-
-            <LinearLayout
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:background="?android:attr/selectableItemBackground"
-                android:orientation="vertical"
-                android:padding="16dp">
-
-                <TextView
-                    android:id="@+id/tx"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_columnWeight="1"
-                    android:layout_gravity="fill_horizontal"
-                    android:ellipsize="marquee"
-                    android:singleLine="true"
-                    android:textColor="@color/white"
-                    android:textSize="14sp" />
-
-                <TextView
-                    android:id="@+id/rx"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_columnWeight="1"
-                    android:layout_gravity="fill_horizontal"
-                    android:ellipsize="marquee"
-                    android:singleLine="true"
-                    android:textColor="@color/white"
-                    android:textSize="14sp" />
-
-                <TextView
-                    android:id="@+id/status"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_gravity="fill_horizontal"
-                    android:ellipsize="end"
-                    android:maxLines="1"
-                    android:textColor="@color/white"
-                    android:textSize="16sp"
-                    tools:text="@string/connection_test_available" />
-
-            </LinearLayout>
-
-        </io.nekohasekai.sagernet.widget.StatsBar>
-
     </androidx.coordinatorlayout.widget.CoordinatorLayout>
 
     <com.google.android.material.navigation.NavigationView
diff --git a/app/src/main/res/layout/layout_network.xml b/app/src/main/res/layout/layout_network.xml
deleted file mode 100644
index 8dd35c9c35..0000000000
--- a/app/src/main/res/layout/layout_network.xml
+++ /dev/null
@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical">
-
-    <com.google.android.material.card.MaterialCardView
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:layout_margin="8dp"
-        android:clickable="true"
-        android:focusable="true">
-
-        <LinearLayout
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content"
-            android:orientation="vertical">
-
-            <LinearLayout
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:orientation="vertical"
-                android:padding="16dp">
-
-                <TextView
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:text="@string/stun_test"
-                    android:textAppearance="?attr/textAppearanceHeadline6" />
-
-                <TextView
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_marginTop="16dp"
-                    android:text="@string/stun_test_summary"
-                    android:textAppearance="?attr/textAppearanceBody2"
-                    android:textColor="?android:attr/textColorSecondary" />
-
-            </LinearLayout>
-
-            <LinearLayout
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:layout_margin="8dp"
-                android:gravity="end"
-                android:orientation="horizontal">
-
-                <Button
-                    android:id="@+id/stunTest"
-                    style="@style/Widget.AppCompat.Button.Borderless"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_marginEnd="8dp"
-                    android:text="@string/start"
-                    android:textColor="?colorPrimary" />
-            </LinearLayout>
-
-        </LinearLayout>
-    </com.google.android.material.card.MaterialCardView>
-
-</LinearLayout>
diff --git a/app/src/main/res/layout/layout_stun.xml b/app/src/main/res/layout/layout_stun.xml
index c10b04a929..3351b75c32 100644
--- a/app/src/main/res/layout/layout_stun.xml
+++ b/app/src/main/res/layout/layout_stun.xml
@@ -61,6 +61,7 @@
                             android:layout_width="wrap_content"
                             android:layout_height="wrap_content"
                             android:text="@string/nat_stun_server_hint"
+                            android:labelFor="@id/nat_stun_server"
                             android:textAppearance="?attr/textAppearanceSubtitle2" />
 
                         <EditText
@@ -127,4 +128,4 @@
         </androidx.core.widget.NestedScrollView>
     </LinearLayout>
 
-</androidx.coordinatorlayout.widget.CoordinatorLayout>
\ No newline at end of file
+</androidx.coordinatorlayout.widget.CoordinatorLayout>
diff --git a/app/src/main/res/layout/layout_tools.xml b/app/src/main/res/layout/layout_tools.xml
deleted file mode 100644
index 08c0c50470..0000000000
--- a/app/src/main/res/layout/layout_tools.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical"
-    tools:context=".ui.ToolsFragment">
-
-    <include
-        layout="@layout/layout_appbar"
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content" />
-
-    <com.google.android.material.tabs.TabLayout
-        android:id="@+id/tools_tab"
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:background="?colorPrimary"
-        android:elevation="0dp"
-        app:tabIndicatorColor="?tabIndicatorColor"
-        app:tabIndicatorFullWidth="false"
-        app:tabMode="fixed"
-        app:tabPaddingStart="16dp"
-        app:tabRippleColor="?tabRippleColor"
-        app:tabSelectedTextColor="?tabSelectedTextColor"
-        app:tabTextColor="?tabTextColor"
-        app:tabUnboundedRipple="false" />
-
-    <androidx.viewpager2.widget.ViewPager2
-        android:id="@+id/tools_pager"
-        android:layout_width="match_parent"
-        android:layout_height="match_parent" />
-
-</LinearLayout>
\ No newline at end of file
diff --git a/app/src/main/res/layout/layout_webdav_settings.xml b/app/src/main/res/layout/layout_webdav_settings.xml
deleted file mode 100644
index 7a4bf90671..0000000000
--- a/app/src/main/res/layout/layout_webdav_settings.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:fitsSystemWindows="true">
-
-    <com.google.android.material.appbar.AppBarLayout
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:fitsSystemWindows="true"
-        android:theme="@style/ThemeOverlay.MaterialComponents.Dark.ActionBar">
-
-        <androidx.appcompat.widget.Toolbar
-            android:id="@+id/toolbar"
-            android:layout_width="match_parent"
-            android:layout_height="?attr/actionBarSize"
-            android:background="?attr/colorPrimary"
-            app:popupTheme="@style/ThemeOverlay.MaterialComponents.Light" />
-
-    </com.google.android.material.appbar.AppBarLayout>
-
-    <FrameLayout
-        android:id="@+id/settings"
-        android:layout_width="match_parent"
-        android:layout_height="match_parent"
-        app:layout_behavior="@string/appbar_scrolling_view_behavior" />
-
-</androidx.coordinatorlayout.widget.CoordinatorLayout>
-
diff --git a/app/src/main/res/menu/add_group_menu.xml b/app/src/main/res/menu/add_group_menu.xml
index 35177cd10e..3e13846357 100644
--- a/app/src/main/res/menu/add_group_menu.xml
+++ b/app/src/main/res/menu/add_group_menu.xml
@@ -5,10 +5,10 @@
         android:id="@+id/action_update_all"
         android:icon="@drawable/ic_baseline_update_24"
         android:title="@string/update_all_subscription"
-        app:showAsAction="always" />
+        app:showAsAction="ifRoom" />
     <item
         android:id="@+id/action_new_group"
         android:icon="@drawable/ic_av_playlist_add"
         android:title="@string/group_create"
-        app:showAsAction="always" />
-</menu>
\ No newline at end of file
+        app:showAsAction="ifRoom" />
+</menu>
diff --git a/app/src/main/res/menu/add_profile_menu.xml b/app/src/main/res/menu/add_profile_menu.xml
index 78310fd63d..d4b594900d 100644
--- a/app/src/main/res/menu/add_profile_menu.xml
+++ b/app/src/main/res/menu/add_profile_menu.xml
@@ -95,6 +95,12 @@
         android:title=""
         app:showAsAction="always">
         <menu>
+            <item
+                android:id="@+id/action_switch_group_view"
+                android:title="@string/switch_to_subscription_view" />
+            <item
+                android:id="@+id/action_manage_router_groups"
+                android:title="@string/manage_router_groups" />
             <item
                 android:id="@+id/action_update_subscription"
                 android:title="@string/update_current_subscription" />
diff --git a/app/src/main/res/menu/main_drawer_menu.xml b/app/src/main/res/menu/main_drawer_menu.xml
index 040e8e002f..f8131c94f6 100644
--- a/app/src/main/res/menu/main_drawer_menu.xml
+++ b/app/src/main/res/menu/main_drawer_menu.xml
@@ -4,8 +4,8 @@
     <group android:checkableBehavior="single">
         <item
             android:id="@+id/nav_configuration"
-            android:icon="@drawable/ic_action_description"
-            android:title="@string/menu_configuration" />
+            android:icon="@drawable/ic_hardware_router"
+            android:title="@string/route_proxy" />
 
         <item
             android:id="@+id/nav_group"
@@ -43,10 +43,6 @@
     <group
         android:id="@+id/about"
         android:checkableBehavior="single">
-        <item
-            android:id="@+id/nav_faq"
-            android:icon="@drawable/ic_device_data_usage"
-            android:title="@string/document" />
         <item
             android:id="@+id/nav_about"
             android:icon="@drawable/ic_baseline_info_24"
diff --git a/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml b/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
index 036d09bc5f..3ba9813efc 100644
--- a/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
+++ b/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
@@ -1,5 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
     <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+    <foreground android:drawable="@drawable/ic_asteria_foreground"/>
+    <monochrome android:drawable="@drawable/ic_asteria_monochrome"/>
 </adaptive-icon>
\ No newline at end of file
diff --git a/app/src/main/res/values-fa/strings.xml b/app/src/main/res/values-fa/strings.xml
index c59a591b83..7173cf808a 100644
--- a/app/src/main/res/values-fa/strings.xml
+++ b/app/src/main/res/values-fa/strings.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name" translatable="false">NekoBoxF</string>
-    <string name="app_name_long" translatable="false">NekoBoxF for Android</string>
+    <string name="app_name" translatable="false">Asteria</string>
+    <string name="app_name_long" translatable="false">Asteria for Android</string>
     <string name="app_desc">مجموعه ابزار جامع پراکسی برای اندروید، نوشته‌شده با کاتلین.</string>
     <string name="project">پروژه</string>
     <string name="github">کد منبع</string>
@@ -448,8 +448,6 @@
     <string name="warp_generate">ایجاد پیکربندی</string>
     <string name="generating">در حال ایجاد...</string>
     <string name="tun_implementation">پیاده‌سازی TUN</string>
-    <string name="enable_hev_tun">فعال‌سازی Hev TUN</string>
-    <string name="enable_hev_tun_summary">ایجاد دستگاه TUN با hev-socks5-tunnel</string>
     <string name="destination_override">بازنویسی مقصد</string>
     <string name="destination_override_summary">از دامنه ردیابی‌شده برای بازنویسی آدرس مقصد استفاده کنید، نه فقط برای مسیریابی.</string>
     <string name="resolve_destination">بررسی مقصد</string>
@@ -593,7 +591,7 @@
     <string name="webdav_path">مسیر پشتیبان</string>
     <string name="webdav_test">آزمایش اتصال</string>
     <string name="webdav_test_success">اتصال موفق بود</string>
-    <string name="webdav_test_failed" formatted="false">اتصال ناموفق بود: %s</string>
+    <string name="webdav_test_failed">اتصال ناموفق بود: %1$s</string>
     <string name="backup_to_webdav">پشتیبان‌گیری در WebDAV</string>
     <string name="restore_from_webdav">بازیابی از WebDAV</string>
     <string name="webdav_backup_success">پشتیبان‌گیری در WebDAV موفق بود</string>
diff --git a/app/src/main/res/values-ja/strings.xml b/app/src/main/res/values-ja/strings.xml
index d614b0973b..2aa0ebb9e5 100644
--- a/app/src/main/res/values-ja/strings.xml
+++ b/app/src/main/res/values-ja/strings.xml
@@ -419,8 +419,6 @@
     <string name="warp_generate">設定を生成</string>
     <string name="generating">生成中…</string>
     <string name="tun_implementation">TUN 実装</string>
-    <string name="enable_hev_tun">Hev TUN を有効化</string>
-    <string name="enable_hev_tun_summary">hev-socks5-tunnel で TUN デバイスを作成</string>
     <string name="destination_override">宛先を上書き</string>
     <string name="destination_override_summary">スニッフィングしたドメインを使って宛先アドレスを上書きします (ルーティングだけでなく)</string>
     <string name="resolve_destination">宛先を解決</string>
@@ -526,7 +524,7 @@
     <string name="webdav_path">バックアップパス</string>
     <string name="webdav_test">接続をテスト</string>
     <string name="webdav_test_success">接続に成功しました</string>
-    <string name="webdav_test_failed" formatted="false">接続に失敗しました: %s</string>
+    <string name="webdav_test_failed">接続に失敗しました: %1$s</string>
     <string name="backup_to_webdav">WebDAV にバックアップ</string>
     <string name="restore_from_webdav">WebDAV から復元</string>
     <string name="webdav_backup_success">WebDAV へのバックアップに成功しました</string>
diff --git a/app/src/main/res/values-ko/strings.xml b/app/src/main/res/values-ko/strings.xml
index 1cf8fd4874..47a995faac 100644
--- a/app/src/main/res/values-ko/strings.xml
+++ b/app/src/main/res/values-ko/strings.xml
@@ -413,8 +413,6 @@
     <string name="warp_generate">구성 생성</string>
     <string name="generating">생성 중…</string>
     <string name="tun_implementation">TUN 구현</string>
-    <string name="enable_hev_tun">Hev TUN 사용</string>
-    <string name="enable_hev_tun_summary">hev-socks5-tunnel로 TUN 장치 생성</string>
     <string name="destination_override">목적지 재정의</string>
     <string name="destination_override_summary">스니핑한 도메인을 사용하여 목적지 주소를 덮어씁니다 (라우팅뿐만 아니라)</string>
     <string name="resolve_destination">목적지 확인</string>
@@ -520,7 +518,7 @@
     <string name="webdav_path">백업 경로</string>
     <string name="webdav_test">연결 테스트</string>
     <string name="webdav_test_success">연결 성공</string>
-    <string name="webdav_test_failed" formatted="false">연결 실패: %s</string>
+    <string name="webdav_test_failed">연결 실패: %1$s</string>
     <string name="backup_to_webdav">WebDAV에 백업</string>
     <string name="restore_from_webdav">WebDAV에서 복원</string>
     <string name="webdav_backup_success">WebDAV에 백업 성공</string>
diff --git a/app/src/main/res/values-ru/strings.xml b/app/src/main/res/values-ru/strings.xml
index 4fc87af95e..d2c6bee0b2 100644
--- a/app/src/main/res/values-ru/strings.xml
+++ b/app/src/main/res/values-ru/strings.xml
@@ -35,8 +35,8 @@
 <string name="always_show_address">Всегда показывать адрес</string>
 <string name="always_show_address_sum">Всегда отображать адрес сервера на карте конфигурации</string>
 <string name="app_desc">Универсальный набор инструментов прокси для Android, написанный на Kotlin.</string>
-<string name="app_name">NekoBoxF</string>
-<string name="app_name_long">NekoBoxF для Android</string>
+<string name="app_name">Asteria</string>
+<string name="app_name_long">Asteria для Android</string>
 <string name="app_tls_version">Минимальная версия TLS протокола</string>
 <string name="app_version">Версия</string>
 <string name="append_http_proxy">Добавить HTTP-прокси к VPN</string>
@@ -469,8 +469,6 @@
 <string name="tuic_reduce_rtt">Включить 0-RTT QUIC-соединение</string>
 <string name="tuic_udp_relay_mode">Режим UDP-ретранслятора</string>
 <string name="tun_implementation">Реализация TUN</string>
-    <string name="enable_hev_tun">Включить Hev TUN</string>
-    <string name="enable_hev_tun_summary">Создавать TUN-устройство с помощью hev-socks5-tunnel</string>
 <string name="udp_connections">%d UDP-соединений</string>
 <string name="unavailable">Недоступен</string>
 <string name="undo">Отменить</string>
@@ -600,7 +598,7 @@
     <string name="webdav_path">Путь резервной копии</string>
     <string name="webdav_test">Проверить соединение</string>
     <string name="webdav_test_success">Соединение успешно</string>
-    <string name="webdav_test_failed" formatted="false">Ошибка соединения: %s</string>
+    <string name="webdav_test_failed">Ошибка соединения: %1$s</string>
     <string name="backup_to_webdav">Резервное копирование в WebDAV</string>
     <string name="restore_from_webdav">Восстановление из WebDAV</string>
     <string name="webdav_backup_success">Резервное копирование в WebDAV выполнено</string>
diff --git a/app/src/main/res/values-uk/strings.xml b/app/src/main/res/values-uk/strings.xml
index 528e309782..5e99f9f81b 100644
--- a/app/src/main/res/values-uk/strings.xml
+++ b/app/src/main/res/values-uk/strings.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name" translatable="false">NekoBoxF</string>
-    <string name="app_name_long" translatable="false">NekoBoxF for Android</string>
+    <string name="app_name" translatable="false">Asteria</string>
+    <string name="app_name_long" translatable="false">Asteria for Android</string>
     <string name="app_desc">Універсальний набір інструментів проксі для Android, написаний на Kotlin.</string>
     <string name="project">Проєкт</string>
     <string name="github">Вихідний код</string>
diff --git a/app/src/main/res/values-v26/themes.xml b/app/src/main/res/values-v26/themes.xml
index bf33221ca6..4b1e2fb0b5 100644
--- a/app/src/main/res/values-v26/themes.xml
+++ b/app/src/main/res/values-v26/themes.xml
@@ -36,6 +36,7 @@
         <item name="windowNoTitle">true</item>
 
         <item name="chipStyle">@style/Widget.MaterialComponents.Chip.Choice.SagerNet</item>
+        <item name="itemShapeFillColor">@color/nav_item_fill</item>
 
         <item name="itemShapeAppearance">
             @style/ShapeAppearance.MaterialComponents.MediumComponent
diff --git a/app/src/main/res/values-v28/themes.xml b/app/src/main/res/values-v28/themes.xml
new file mode 100644
index 0000000000..a48cdc6016
--- /dev/null
+++ b/app/src/main/res/values-v28/themes.xml
@@ -0,0 +1,5 @@
+<resources>
+    <style name="Theme.SagerNet.Dialog" parent="Base.Theme.SagerNet.Dialog">
+        <item name="android:dialogCornerRadius">@dimen/dialog_corner_radius</item>
+    </style>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings.xml b/app/src/main/res/values-zh-rCN/strings.xml
index 16b353acd5..8939be3dbe 100644
--- a/app/src/main/res/values-zh-rCN/strings.xml
+++ b/app/src/main/res/values-zh-rCN/strings.xml
@@ -304,7 +304,7 @@
     <string name="connection_test_refused">连接重置</string>
     <string name="connection_test_timeout_error">超时</string>
     <string name="connection_test_unreachable">不可达</string>
-    <string name="tile_title">开关</string>
+    <string name="tile_title">Asteria</string>
     <string name="append_http_proxy">追加 HTTP 代理至 VPN</string>
     <string name="append_http_proxy_sum">浏览器 / 一些支持的应用 将直接使用 HTTP 代理, 而不经过虚拟网卡设备 (Android 10+)</string>
     <string name="http_proxy_bypass">HTTP 代理绕过列表</string>
@@ -425,8 +425,6 @@
     <string name="destination_override_summary">使用探测的域来覆盖目标地址, 而不是仅用于路由</string>
     <string name="destination_override">覆盖目标地址</string>
     <string name="tun_implementation">TUN 实现</string>
-    <string name="enable_hev_tun">启用 Hev TUN</string>
-    <string name="enable_hev_tun_summary">使用 hev-socks5-tunnel 创建 TUN 设备</string>
     <string name="generating">正在生成…</string>
     <string name="warp_generate">生成配置</string>
     <string name="warp_license">CloudFlare Warp 是一个免费的 WireGuard VPN 提供源. 使用它, 代表您同意其服务条款。</string>
@@ -502,6 +500,8 @@
     <string name="landing_proxy">落地代理</string>
     <string name="protocol_version">协议版本</string>
     <string name="share_subscription">分享订阅</string>
+    <string name="show_profile_in_notification">在通知中显示节点名称</string>
+    <string name="show_profile_in_notification_summary">关闭后通知仅显示应用名称，隐藏具体的节点信息</string>
     <string name="show_group_in_notification">在通知中显示组名</string>
     <string name="reset_connections">重置连接</string>
     <string name="remove_duplicate">删除重复的服务器</string>
@@ -538,7 +538,7 @@
     <string name="webdav_path">备份目录</string>
     <string name="webdav_test">测试连接</string>
     <string name="webdav_test_success">连接成功</string>
-    <string name="webdav_test_failed">连接失败: %s</string>
+    <string name="webdav_test_failed">连接失败: %1$s</string>
     <string name="backup_to_webdav">备份到 WebDAV</string>
     <string name="restore_from_webdav">从 WebDAV 恢复</string>
     <string name="webdav_backup_success">备份到 WebDAV 成功</string>
@@ -610,4 +610,45 @@
     <string name="snell_quic_proxy">QUIC Proxy 模式</string>
     <string name="snell_quic_proxy_summary">仅 v6：旧版 v5 QUIC Proxy 兼容</string>
     <string name="snell_reuse_summary">仅适用于 v4-v6</string>
+    <string name="router_groups_title">代理组</string>
+    <string name="router_mode_manual">手动选择</string>
+    <string name="router_mode_automatic">自动测速</string>
+    <string name="router_status">%1$s | %2$d 个节点</string>
+    <string name="router_current_node">当前：%s</string>
+    <string name="router_no_selection">未选择节点</string>
+    <string name="refresh">刷新</string>
+    <string name="router_group_add">新建代理组</string>
+    <string name="router_group_add_summary">从一个或多个订阅中筛选并组合节点</string>
+    <string name="router_group_settings">代理组设置</string>
+    <string name="router_group_name">分组名称</string>
+    <string name="router_group_enabled">启用</string>
+    <string name="router_group_mode">模式</string>
+    <string name="router_group_sources">订阅来源</string>
+    <string name="router_group_include">包含正则（留空表示全部）</string>
+    <string name="router_group_exclude">排除正则</string>
+    <string name="router_url_test_settings">自动测速</string>
+    <string name="router_test_url">测试地址</string>
+    <string name="router_test_interval">测试间隔（秒）</string>
+    <string name="router_test_tolerance">容差（毫秒）</string>
+    <string name="router_group_preview">匹配节点</string>
+    <string name="router_group_preview_count">%1$d 个节点\n%2$s</string>
+    <string name="router_group_disabled">已禁用</string>
+    <string name="router_group_selected">已选择</string>
+    <string name="router_group_delete_referenced">有 %1$d 条路由规则正在使用此分组，请先重新指定这些规则。</string>
+    <string name="router_group_validation_field">%1$s：%2$s</string>
+    <string name="route_proxy_group">代理组</string>
+    <string name="router_reference_invalid">代理组引用无效</string>
+    <string name="router_groups_card_title">路由代理组 / 策略组</string>
+    <string name="router_groups_card_summary">管理 URL-Test 自动优选与手动选择节点组</string>
+    <string name="router_groups_card_summary_with_count">已配置 %d 个代理组 • 自动测速与手动切换</string>
+    <string name="router_groups_nav_title">代理组 (策略组)</string>
+    <string name="router_no_sources_selected">未选择任何订阅</string>
+    <string name="router_switch_node">切换节点</string>
+    <string name="router_edit_group">编辑分组</string>
+    <string name="router_empty_title">暂无代理组</string>
+    <string name="router_empty_summary">点击右上角 + 创建出站代理组，支持自动测速与按规则分流</string>
+    <string name="switch_to_subscription_view">切换到订阅分组视图</string>
+    <string name="switch_to_router_group_view">切换到代理组视图</string>
+    <string name="router_mode_automatic_hint">自动测速组将根据延迟自动选择最优节点</string>
+    <string name="manage_router_groups">管理代理组</string>
 </resources>
diff --git a/app/src/main/res/values-zh-rTW/strings.xml b/app/src/main/res/values-zh-rTW/strings.xml
index 8835b48685..ef29695184 100644
--- a/app/src/main/res/values-zh-rTW/strings.xml
+++ b/app/src/main/res/values-zh-rTW/strings.xml
@@ -391,8 +391,6 @@
     <string name="profile_traffic_statistics_summary">當停用時，使用的流量將不會被統計</string>
     <string name="app_statistics_disabled">應用程式流量統計資料被停用</string>
     <string name="tun_implementation">TUN 實作</string>
-    <string name="enable_hev_tun">啟用 Hev TUN</string>
-    <string name="enable_hev_tun_summary">使用 hev-socks5-tunnel 建立 TUN 裝置</string>
     <string name="destination_override">覆寫目的地位址</string>
     <string name="resolve_destination">解析目的地位址</string>
     <string name="clear_logcat">清除記錄檔</string>
@@ -544,7 +542,7 @@
     <string name="webdav_path">備份目錄</string>
     <string name="webdav_test">測試連線</string>
     <string name="webdav_test_success">連線成功</string>
-    <string name="webdav_test_failed" formatted="false">連線失敗: %s</string>
+    <string name="webdav_test_failed">連線失敗: %1$s</string>
     <string name="backup_to_webdav">備份到 WebDAV</string>
     <string name="restore_from_webdav">從 WebDAV 恢復</string>
     <string name="webdav_backup_success">備份到 WebDAV 成功</string>
diff --git a/app/src/main/res/values/arrays.xml b/app/src/main/res/values/arrays.xml
index b064e8563b..4028b9e2cb 100644
--- a/app/src/main/res/values/arrays.xml
+++ b/app/src/main/res/values/arrays.xml
@@ -317,6 +317,7 @@
         <item>@string/route_bypass</item>
         <item>@string/route_block</item>
         <item>@string/route_profile</item>
+        <item>@string/route_proxy_group</item>
     </string-array>
 
     <string-array name="outbound_value">
@@ -324,6 +325,7 @@
         <item>1</item>
         <item>2</item>
         <item>3</item>
+        <item>4</item>
     </string-array>
 
     <string-array name="front_proxy_entry">
@@ -556,6 +558,7 @@
         <item>gVisor</item>
         <item>System</item>
         <item>Mixed</item>
+        <item>@string/tun_implementation_go</item>
     </string-array>
 
     <string-array name="hysteria_protocol">
diff --git a/app/src/main/res/values/ic_launcher_background.xml b/app/src/main/res/values/ic_launcher_background.xml
index c5d5899fdf..90b6681810 100644
--- a/app/src/main/res/values/ic_launcher_background.xml
+++ b/app/src/main/res/values/ic_launcher_background.xml
@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <color name="ic_launcher_background">#FFFFFF</color>
+    <color name="ic_launcher_background">#0F172A</color>
 </resources>
\ No newline at end of file
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index a8dc47181c..5fd7120468 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name" translatable="false">NekoBoxF</string>
-    <string name="app_name_long" translatable="false">NekoBoxF for Android</string>
+    <string name="app_name" translatable="false">Asteria</string>
+    <string name="app_name_long" translatable="false">Asteria for Android</string>
     <string name="app_desc">The universal proxy toolchain for Android, written in Kotlin.</string>
     <string name="project">Project</string>
     <string name="github">Source code</string>
@@ -19,7 +19,7 @@
     <string name="quick_toggle">Toggle</string>
     <string name="quick_enable">Enable</string>
     <string name="quick_disable">Disable</string>
-    <string name="tile_title">Switcher</string>
+    <string name="tile_title">Asteria</string>
     <string name="menu_traffic">Traffic</string>
     <string name="menu_dashboard">sing-box Dashboard</string>
     <!-- externel -->
@@ -46,6 +46,53 @@
     <string name="group_status_empty_subscription">Not updated yet</string>
     <string name="group_status_proxies">%d Proxies</string>
     <string name="group_status_proxies_subscription">%d Proxies | Updated on %s</string>
+    <string name="router_groups_title">Router groups</string>
+    <string name="router_mode_manual">Manual</string>
+    <string name="router_mode_automatic">Automatic</string>
+    <string name="router_status">%1$s | %2$d nodes</string>
+    <string name="refresh">Refresh</string>
+    <string name="router_current_node">Current: %s</string>
+    <string name="router_no_selection">No current node</string>
+    <string name="router_select_node">Select node</string>
+    <string name="router_members">Members</string>
+    <string name="router_edit_members">Select Router members</string>
+    <string name="router_no_members">No members configured</string>
+    <string name="router_no_available_nodes">No subscription nodes are available.</string>
+    <string name="router_manual_unavailable">Automatic Router groups select nodes by latency.</string>
+    <string name="router_group_add">Create proxy group</string>
+    <string name="router_group_add_summary">Combine nodes from one or more subscriptions</string>
+    <string name="router_group_settings">Proxy group settings</string>
+    <string name="router_group_name">Group name</string>
+    <string name="router_group_enabled">Enabled</string>
+    <string name="router_group_mode">Mode</string>
+    <string name="router_group_sources">Subscription sources</string>
+    <string name="router_group_include">Include regex (empty means all)</string>
+    <string name="router_group_exclude">Exclude regex</string>
+    <string name="router_url_test_settings">URL test</string>
+    <string name="router_test_url">Test URL</string>
+    <string name="router_test_interval">Test interval (seconds)</string>
+    <string name="router_test_tolerance">Tolerance (ms)</string>
+    <string name="router_group_preview">Matched nodes</string>
+    <string name="router_group_preview_count">%1$d nodes\n%2$s</string>
+    <string name="router_group_disabled">Disabled</string>
+    <string name="router_group_selected">Selected</string>
+    <string name="router_group_delete_referenced">This group is used by %1$d route rules. Reassign those routes before deleting it.</string>
+    <string name="router_group_validation_field">%1$s: %2$s</string>
+    <string name="route_proxy_group">Proxy group</string>
+    <string name="router_reference_invalid">Invalid proxy group reference</string>
+    <string name="router_groups_card_title">Proxy groups (Policy groups)</string>
+    <string name="router_groups_card_summary">Manage URL-Test automatic latency &amp; manual node groups</string>
+    <string name="router_groups_card_summary_with_count">%d groups configured • URL-Test &amp; Manual</string>
+    <string name="router_groups_nav_title">Proxy groups</string>
+    <string name="router_no_sources_selected">No subscriptions selected</string>
+    <string name="router_switch_node">Switch node</string>
+    <string name="router_edit_group">Edit group</string>
+    <string name="router_empty_title">No proxy groups</string>
+    <string name="router_empty_summary">Tap + above to create a proxy group, enabling automatic latency testing and policy-based routing.</string>
+    <string name="switch_to_subscription_view">Switch to subscription view</string>
+    <string name="switch_to_router_group_view">Switch to proxy groups view</string>
+    <string name="router_mode_automatic_hint">Automatic URL-test group selects the best node automatically</string>
+    <string name="manage_router_groups">Manage proxy groups</string>
     <string name="group_no_difference">%s: No difference</string>
     <string name="group_updated">%s: Updated %d proxies</string>
     <string name="group_show_diff">Diff</string>
@@ -500,8 +547,7 @@
     <string name="warp_generate">Generate Configuration</string>
     <string name="generating">Generating…</string>
     <string name="tun_implementation">TUN Implementation</string>
-    <string name="enable_hev_tun">Enable Hev TUN</string>
-    <string name="enable_hev_tun_summary">Use hev-socks5-tunnel to create the TUN device</string>
+    <string name="tun_implementation_go" translatable="false">Go</string>
     <string name="destination_override">Override Destination</string>
     <string name="destination_override_summary">Use the sniffed domain to overwrite the destination
         address, not just for routing</string>
@@ -590,6 +636,8 @@
     <string name="action_shadowtls" translatable="false">ShadowTLS</string>
     <string name="protocol_version">Protocol Version</string>
     <string name="share_subscription">Share Subscription</string>
+    <string name="show_profile_in_notification">Show profile name in notification</string>
+    <string name="show_profile_in_notification_summary">When disabled, the notification only displays the app name, hiding specific node details</string>
     <string name="show_group_in_notification">Show group name in notification</string>
     <string name="reset_connections">Reset Connections</string>
     <string name="remove_duplicate">Remove duplicate servers</string>
@@ -629,7 +677,7 @@
     <string name="webdav_path">Backup Path</string>
     <string name="webdav_test">Test Connection</string>
     <string name="webdav_test_success">Connection Successful</string>
-    <string name="webdav_test_failed" formatted="false">Connection Failed: %s</string>
+    <string name="webdav_test_failed">Connection Failed: %1$s</string>
     <string name="backup_to_webdav">Backup to WebDAV</string>
     <string name="restore_from_webdav">Restore from WebDAV</string>
     <string name="webdav_backup_success">Backup to WebDAV successful</string>
diff --git a/app/src/main/res/values/themes.xml b/app/src/main/res/values/themes.xml
index da5956eb0b..6454c15870 100644
--- a/app/src/main/res/values/themes.xml
+++ b/app/src/main/res/values/themes.xml
@@ -36,6 +36,7 @@
         <item name="windowNoTitle">true</item>
 
         <item name="chipStyle">@style/Widget.MaterialComponents.Chip.Choice.SagerNet</item>
+        <item name="itemShapeFillColor">@color/nav_item_fill</item>
 
         <item name="itemShapeAppearance">
             @style/ShapeAppearance.MaterialComponents.MediumComponent
@@ -58,7 +59,9 @@
 
     </style>
 
-    <style name="Theme.SagerNet.Dialog" parent="Theme.MaterialComponents.DayNight.Dialog.Alert">
+    <style name="Theme.SagerNet.Dialog" parent="Base.Theme.SagerNet.Dialog" />
+
+    <style name="Base.Theme.SagerNet.Dialog" parent="Theme.MaterialComponents.DayNight.Dialog.Alert">
         <item name="actionBarStyle">@style/Widget.MaterialComponents.ActionBar.Solid</item>
         <item name="actionModeCloseDrawable">@drawable/ic_navigation_close</item>
         <item name="colorButtonNormal">?colorAccent</item>
@@ -94,6 +97,7 @@
         <item name="windowNoTitle">true</item>
 
         <item name="chipStyle">@style/Widget.MaterialComponents.Chip.Choice.SagerNet</item>
+        <item name="itemShapeFillColor">@color/nav_item_fill</item>
 
         <item name="itemShapeAppearance">
             @style/ShapeAppearance.MaterialComponents.MediumComponent
@@ -114,8 +118,6 @@
         <item name="bottomSheetDialogTheme">@style/ThemeOverlay.SagerNet.BottomSheetDialog</item>
         <item name="materialButtonStyle">@style/Widget.SagerNet.Button</item>
 
-        <item name="android:dialogCornerRadius">@dimen/dialog_corner_radius</item>
-
         <item name="windowFixedHeightMajor" type="dimen">95%</item>
 
     </style>
diff --git a/app/src/main/res/xml/global_preferences.xml b/app/src/main/res/xml/global_preferences.xml
index a4135321c5..6c4eb6af36 100644
--- a/app/src/main/res/xml/global_preferences.xml
+++ b/app/src/main/res/xml/global_preferences.xml
@@ -37,19 +37,13 @@
             app:title="@string/service_mode"
             app:useSimpleSummaryProvider="true" />
         <moe.matsuri.nb4a.ui.SimpleMenuPreference
-            app:defaultValue="0"
+            app:defaultValue="3"
             app:entries="@array/tun_implementation"
-            app:entryValues="@array/int_array_3"
+            app:entryValues="@array/int_array_4"
             app:icon="@drawable/ic_baseline_flip_camera_android_24"
             app:key="tunImplementation"
             app:title="@string/tun_implementation"
             app:useSimpleSummaryProvider="true" />
-        <SwitchPreference
-            app:defaultValue="false"
-            app:icon="@drawable/ic_baseline_memory_24"
-            app:key="enableHevTun"
-            app:summary="@string/enable_hev_tun_summary"
-            app:title="@string/enable_hev_tun" />
         <moe.matsuri.nb4a.ui.MTUPreference
             app:defaultValue="9000"
             app:entries="@array/mtu_select"
@@ -77,6 +71,11 @@
             app:summary="@string/show_direct_speed_sum"
             app:title="@string/show_direct_speed"
             app:useSimpleSummaryProvider="true" />
+        <SwitchPreference
+            app:defaultValue="true"
+            app:key="showProfileInNotification"
+            app:summary="@string/show_profile_in_notification_summary"
+            app:title="@string/show_profile_in_notification" />
         <SwitchPreference
             app:key="showGroupInNotification"
             app:title="@string/show_group_in_notification" />
@@ -89,11 +88,6 @@
             app:key="alwaysShowAddress"
             app:summary="@string/always_show_address_sum"
             app:title="@string/always_show_address" />
-        <SwitchPreference
-            app:icon="@drawable/ic_device_data_usage"
-            app:key="meteredNetwork"
-            app:summary="@string/metered_summary"
-            app:title="@string/metered" />
         <SwitchPreference
             app:icon="@drawable/baseline_developer_board_24"
             app:key="acquireWakeLock"
@@ -157,46 +151,6 @@
             app:key="ipv6Mode"
             app:title="@string/ipv6"
             app:useSimpleSummaryProvider="true" />
-        <moe.matsuri.nb4a.ui.SimpleMenuPreference
-            app:defaultValue="0"
-            app:entries="@array/rules_dat_provider"
-            app:entryValues="@array/int_array_5"
-            app:icon="@drawable/ic_baseline_rule_folder_24"
-            app:key="rulesProvider"
-            app:title="@string/route_rules_provider"
-            app:useSimpleSummaryProvider="true" />
-        <EditTextPreference
-            app:defaultValue="https://github.com/SagerNet/sing-geosite/releases/latest/download/geosite.db"
-            app:key="rulesGeositeUrl"
-            app:title="@string/rules_geosite_url"
-            app:useSimpleSummaryProvider="true" />
-        <EditTextPreference
-            app:defaultValue="https://github.com/SagerNet/sing-geoip/releases/latest/download/geoip.db"
-            app:key="rulesGeoipUrl"
-            app:title="@string/rules_geoip_url"
-            app:useSimpleSummaryProvider="true" />
-        <EditTextPreference
-            app:defaultValue="0"
-            app:key="rulesUpdateInterval"
-            app:icon="@drawable/ic_baseline_shutter_speed_24"
-            app:title="@string/ruleset_update_interval"
-            app:summary="@string/ruleset_update_interval_summary" />
-    </PreferenceCategory>
-
-    <PreferenceCategory app:title="@string/fragment_settings">
-        <SwitchPreference
-            app:key="enableTLSFragment"
-            app:title="@string/enable_tls_fragment" />
-        <EditTextPreference
-            app:defaultValue="100-200"
-            app:key="fragmentLength"
-            app:title="@string/fragment_length"
-            app:useSimpleSummaryProvider="true" />
-        <EditTextPreference
-            app:defaultValue="10-20"
-            app:key="fragmentInterval"
-            app:title="@string/fragment_interval"
-            app:useSimpleSummaryProvider="true" />
     </PreferenceCategory>
 
     <PreferenceCategory app:title="@string/cag_dns">
@@ -259,19 +213,6 @@
             app:icon="@drawable/ic_hardware_router"
             app:key="localProxySettings"
             app:title="@string/local_proxy_settings" />
-        <SwitchPreference
-            app:defaultValue="false"
-            app:key="appendHttpProxy"
-            app:summary="@string/append_http_proxy_sum"
-            app:title="@string/append_http_proxy" />
-        <EditTextPreference
-            app:defaultValue=""
-            app:dependency="appendHttpProxy"
-            app:dialogMessage="@string/http_proxy_bypass_dialog_message"
-            app:icon="@drawable/ic_baseline_domain_24"
-            app:key="httpProxyBypass"
-            app:title="@string/http_proxy_bypass"
-            app:useSimpleSummaryProvider="true" />
         <SwitchPreference
             app:defaultValue="true"
             app:key="strictRoute"
@@ -290,16 +231,6 @@
             app:key="enableClashAPI"
             app:summary="@string/enable_clash_api_summary"
             app:title="@string/enable_clash_api" />
-        <SwitchPreference
-            app:defaultValue="true"
-            app:icon="@drawable/ic_baseline_flip_camera_android_24"
-            app:key="networkChangeResetConnections"
-            app:title="@string/network_change_reset_connections"
-            app:useSimpleSummaryProvider="true" />
-        <SwitchPreference
-            app:key="wakeResetConnections"
-            app:title="@string/wake_reset_connections"
-            app:useSimpleSummaryProvider="true" />
         <SwitchPreference
             app:icon="@drawable/ic_action_lock_open"
             app:key="globalAllowInsecure"
@@ -307,16 +238,6 @@
         <SwitchPreference
             app:key="allowInsecureOnRequest"
             app:title="@string/allow_insecure_on_request_sum" />
-        <moe.matsuri.nb4a.ui.SimpleMenuPreference
-            app:defaultValue="1.2"
-            app:entries="@array/app_tls_version"
-            app:entryValues="@array/app_tls_version"
-            app:key="appTLSVersion"
-            app:title="@string/app_tls_version"
-            app:useSimpleSummaryProvider="true" />
-        <SwitchPreference
-            app:key="showBottomBar"
-            app:title="@string/show_bottom_bar" />
         <Preference
             app:icon="@drawable/baseline_undo_24"
             app:key="resetSettings"
diff --git a/app/src/main/res/xml/shortcuts.xml b/app/src/main/res/xml/shortcuts.xml
index 94286d1084..02854856ca 100644
--- a/app/src/main/res/xml/shortcuts.xml
+++ b/app/src/main/res/xml/shortcuts.xml
@@ -8,7 +8,7 @@
         <intent
             android:action="android.intent.action.MAIN"
             android:targetClass="io.nekohasekai.sagernet.QuickToggleShortcut"
-            android:targetPackage="com.nb4a" />
+            android:targetPackage="com.asteria" />
     </shortcut>
     <shortcut
         android:icon="@drawable/ic_qu_shadowsocks_launcher"
@@ -18,7 +18,7 @@
         <intent
             android:action="android.intent.action.MAIN"
             android:targetClass="io.nekohasekai.sagernet.ui.QuickEnableShortcut"
-            android:targetPackage="com.nb4a" />
+            android:targetPackage="com.asteria" />
     </shortcut>
     <shortcut
         android:icon="@drawable/ic_qu_shadowsocks_launcher"
@@ -28,7 +28,7 @@
         <intent
             android:action="android.intent.action.MAIN"
             android:targetClass="io.nekohasekai.sagernet.ui.QuickDisableShortcut"
-            android:targetPackage="com.nb4a" />
+            android:targetPackage="com.asteria" />
     </shortcut>
     <shortcut
         android:icon="@drawable/ic_qu_camera_launcher"
@@ -38,6 +38,6 @@
         <intent
             android:action="android.intent.action.MAIN"
             android:targetClass="io.nekohasekai.sagernet.ui.ScannerActivity"
-            android:targetPackage="com.nb4a" />
+            android:targetPackage="com.asteria" />
     </shortcut>
 </shortcuts>
diff --git a/app/src/main/res/xml/webdav_preferences.xml b/app/src/main/res/xml/webdav_preferences.xml
deleted file mode 100644
index 283bf41c55..0000000000
--- a/app/src/main/res/xml/webdav_preferences.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto">
-
-    <EditTextPreference
-        android:key="webdavServer"
-        app:icon="@drawable/ic_file_cloud_queue"
-        android:title="@string/webdav_server"
-        android:singleLine="true"
-        android:summary="%s" />
-
-    <EditTextPreference
-        android:key="webdavUsername"
-        app:icon="@drawable/ic_baseline_person_24"
-        android:title="@string/webdav_username"
-        android:singleLine="true"
-        android:summary="%s" />
-
-    <EditTextPreference
-        android:key="webdavPassword"
-        app:icon="@drawable/ic_settings_password"
-        android:title="@string/webdav_password"
-        android:singleLine="true"
-        app:dialogLayout="@layout/layout_password_dialog" />
-
-    <EditTextPreference
-        android:key="webdavPath"
-        app:icon="@drawable/ic_baseline_folder_open_24"
-        android:title="@string/webdav_path"
-        android:singleLine="true"
-        android:defaultValue="NekoBox"
-        android:summary="%s" />
-
-    <Preference
-        android:key="webdavTest"
-        app:icon="@drawable/ic_baseline_cast_connected_24"
-        android:title="@string/webdav_test" />
-
-</PreferenceScreen>
diff --git a/app/src/test/java/io/nekohasekai/sagernet/bg/NotificationTitlePolicyTest.kt b/app/src/test/java/io/nekohasekai/sagernet/bg/NotificationTitlePolicyTest.kt
new file mode 100644
index 0000000000..e17939f0ba
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/bg/NotificationTitlePolicyTest.kt
@@ -0,0 +1,103 @@
+package io.nekohasekai.sagernet.bg
+
+import io.nekohasekai.sagernet.database.ProxyEntity
+import io.nekohasekai.sagernet.fmt.http.HttpBean
+import android.app.Notification
+import android.app.NotificationManager
+import androidx.core.app.NotificationCompat
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class NotificationTitlePolicyTest {
+
+    @Test
+    fun wakeLockChangesNeverPromoteHiddenNotification() {
+        assertEquals(NotificationCompat.PRIORITY_MIN, ServiceNotification.notificationPriority(false, false))
+        assertEquals(NotificationCompat.PRIORITY_MIN, ServiceNotification.notificationPriority(false, true))
+        assertEquals(NotificationCompat.PRIORITY_LOW, ServiceNotification.notificationPriority(true, false))
+        assertEquals(NotificationCompat.PRIORITY_HIGH, ServiceNotification.notificationPriority(true, true))
+    }
+
+    @Test
+    fun vpnNotificationIsHiddenFromLockScreen() {
+        val policy = ServiceNotification.vpnNotificationChannelPolicy()
+
+        assertEquals("service-vpn-hidden", ServiceNotification.vpnNotificationChannel)
+        assertEquals(NotificationManager.IMPORTANCE_MIN, policy.importance)
+        assertEquals(Notification.VISIBILITY_SECRET, policy.lockscreenVisibility)
+    }
+
+    @Test
+    fun hiddenVpnNotificationNeverRequestsSpeedUpdates() {
+        assertEquals(false, ServiceNotification.shouldPostSpeed(false, true))
+        assertEquals(false, ServiceNotification.shouldPostSpeed(false, false))
+        assertEquals(true, ServiceNotification.shouldPostSpeed(true, true))
+        assertEquals(false, ServiceNotification.shouldPostSpeed(true, false))
+    }
+
+    @Test
+    fun returnsAppNameWhenShowProfileIsDisabled() {
+        val proxy = ProxyEntity(id = 1L, groupId = 10L, userOrder = 0).apply {
+            putBean(HttpBean().apply {
+                serverAddress = "example.com"
+                name = "Sensitive Airport Node"
+            })
+        }
+        val title = ServiceNotification.genTitle(
+            ent = proxy,
+            showProfileInNotification = false,
+            showGroupInNotification = true,
+            groupNameProvider = { "VIP Group" },
+            fallbackAppName = "NekoBox",
+        )
+        assertEquals("NekoBox", title)
+    }
+
+    @Test
+    fun returnsNodeNameWhenShowGroupIsDisabled() {
+        val proxy = ProxyEntity(id = 1L, groupId = 10L, userOrder = 0).apply {
+            putBean(HttpBean().apply {
+                serverAddress = "example.com"
+                name = "Node A"
+            })
+        }
+        val title = ServiceNotification.genTitle(
+            ent = proxy,
+            showProfileInNotification = true,
+            showGroupInNotification = false,
+            groupNameProvider = { "VIP Group" },
+            fallbackAppName = "NekoBox",
+        )
+        assertEquals("Node A", title)
+    }
+
+    @Test
+    fun returnsGroupAndNodeNameWhenBothAreEnabled() {
+        val proxy = ProxyEntity(id = 1L, groupId = 10L, userOrder = 0).apply {
+            putBean(HttpBean().apply {
+                serverAddress = "example.com"
+                name = "Node A"
+            })
+        }
+        val title = ServiceNotification.genTitle(
+            ent = proxy,
+            showProfileInNotification = true,
+            showGroupInNotification = true,
+            groupNameProvider = { "VIP Group" },
+            fallbackAppName = "NekoBox",
+        )
+        assertEquals("[VIP Group] Node A", title)
+    }
+
+    @Test
+    fun returnsAppNameWhenProxyIsNull() {
+        val title = ServiceNotification.genTitle(
+            ent = null,
+            showProfileInNotification = true,
+            showGroupInNotification = true,
+            groupNameProvider = { "VIP Group" },
+            fallbackAppName = "NekoBox",
+        )
+        assertEquals("NekoBox", title)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/bg/TunMtuTest.kt b/app/src/test/java/io/nekohasekai/sagernet/bg/TunMtuTest.kt
new file mode 100644
index 0000000000..ff8c6a4e7b
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/bg/TunMtuTest.kt
@@ -0,0 +1,17 @@
+package io.nekohasekai.sagernet.bg
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class TunMtuTest {
+    @Test
+    fun usesCoreMtuInsteadOfGlobalDefault() {
+        // libcore marshals sing-tun.Options, whose exported field is uppercase MTU.
+        assertEquals(1420, tunMtu("""{"MTU":1420}""", 9000))
+    }
+
+    @Test
+    fun missingMtuKeepsGlobalDefault() {
+        assertEquals(9000, tunMtu("{}", 9000))
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicyTest.kt b/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicyTest.kt
new file mode 100644
index 0000000000..7a2545e1b5
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficLoopPolicyTest.kt
@@ -0,0 +1,56 @@
+package io.nekohasekai.sagernet.bg.proto
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class TrafficLoopPolicyTest {
+
+    @Test
+    fun disablingSpeedStillPollsRouterSelectionWithoutBusySpinning() {
+        assertEquals(1_000L, TrafficLoopPolicy.delayMillis(0L, true, false))
+        assertEquals(30_000L, TrafficLoopPolicy.delayMillis(0L, false, false))
+        assertEquals(1_000L, TrafficLoopPolicy.delayMillis(-1L, true, false))
+    }
+
+    @Test
+    fun keepsConfiguredRefreshRateWhileHomePageIsVisible() {
+        assertEquals(
+            1_000L,
+            TrafficLoopPolicy.delayMillis(
+                configuredMillis = 1_000L,
+                mainActivityForeground = true,
+                notificationSpeedVisible = false,
+            ),
+        )
+    }
+
+    @Test
+    fun limitsVisibleBackgroundNotificationRefreshToFiveSeconds() {
+        assertEquals(
+            5_000L,
+            TrafficLoopPolicy.delayMillis(
+                configuredMillis = 1_000L,
+                mainActivityForeground = false,
+                notificationSpeedVisible = true,
+            ),
+        )
+    }
+
+    @Test
+    fun throttlesHiddenBackgroundStatisticsToThirtySeconds() {
+        assertEquals(
+            30_000L,
+            TrafficLoopPolicy.delayMillis(
+                configuredMillis = 1_000L,
+                mainActivityForeground = false,
+                notificationSpeedVisible = false,
+            ),
+        )
+    }
+
+    @Test
+    fun initializationRetryNeverBusySpins() {
+        assertEquals(250L, TrafficLoopPolicy.initializationRetryMillis(0L))
+        assertEquals(1_000L, TrafficLoopPolicy.initializationRetryMillis(1_000L))
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdaterTest.kt b/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdaterTest.kt
new file mode 100644
index 0000000000..2a373dcda7
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/bg/proto/TrafficUpdaterTest.kt
@@ -0,0 +1,41 @@
+package io.nekohasekai.sagernet.bg.proto
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class TrafficUpdaterTest {
+    @Test
+    fun firstSampleUsesElapsedSamplingTimeAndQueriesEachTagOnce() {
+        var now = 40_000L
+        var calls = 0
+        val first = TrafficUpdater.TrafficLooperData("node", rx = 100L)
+        val second = TrafficUpdater.TrafficLooperData("node")
+        val updater = TrafficUpdater(
+            queryStats = { _, _ -> calls++; 2_000L },
+            items = listOf(first, second),
+            monotonicMillis = { now },
+        )
+        now += 2_000L
+        updater.updateAll()
+        assertEquals(2, calls)
+        assertEquals(1_000L, first.rxRate)
+        assertEquals(first.rxRate, second.rxRate)
+        assertEquals(2_100L, first.rx)
+        assertTrue(first.hasTrafficDelta)
+    }
+
+    @Test
+    fun identicalClockReadingDoesNotConsumeCounters() {
+        var now = 10L
+        var calls = 0
+        val item = TrafficUpdater.TrafficLooperData("node")
+        val updater = TrafficUpdater({ _, _ -> calls++; 50L }, listOf(item), { now })
+        updater.updateAll()
+        assertEquals(0, calls)
+        now += 1_000L
+        updater.updateAll()
+        assertEquals(50L, item.rx)
+        assertEquals(50L, item.rxRate)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/DeprecatedSettingsSanitizationTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/DeprecatedSettingsSanitizationTest.kt
new file mode 100644
index 0000000000..40007a2800
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/DeprecatedSettingsSanitizationTest.kt
@@ -0,0 +1,62 @@
+package io.nekohasekai.sagernet.database
+
+import io.nekohasekai.sagernet.Key
+import io.nekohasekai.sagernet.database.preference.KeyValuePair
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class DeprecatedSettingsSanitizationTest {
+
+    @Test
+    fun deprecatedSettingKeysContainRemovedSettings() {
+        val keys = Key.DEPRECATED_SETTING_KEYS
+        assertFalse("GLOBAL_ALLOW_INSECURE is active and should not be stripped", keys.contains(Key.GLOBAL_ALLOW_INSECURE))
+        assertFalse("ALLOW_INSECURE_ON_REQUEST is active and should not be stripped", keys.contains(Key.ALLOW_INSECURE_ON_REQUEST))
+        assertTrue(keys.contains(Key.APPEND_HTTP_PROXY))
+        assertTrue(keys.contains(Key.HTTP_PROXY_BYPASS))
+        assertTrue(keys.contains(Key.ENABLE_TLS_FRAGMENT))
+        assertTrue(keys.contains(Key.FRAGMENT_LENGTH))
+        assertTrue(keys.contains(Key.FRAGMENT_INTERVAL))
+        assertTrue(keys.contains("enableHevTun"))
+        assertTrue(keys.contains("showBottomBar"))
+        assertTrue(keys.contains("meteredNetwork"))
+        assertTrue(keys.contains("wakeResetConnections"))
+    }
+
+    @Test
+    fun backupSettingsFilterStripsDeprecatedKeysWhilePreservingValidSettings() {
+        val incomingSettings = listOf(
+            KeyValuePair().apply {
+                key = Key.GLOBAL_ALLOW_INSECURE
+                valueType = KeyValuePair.TYPE_BOOLEAN
+                value = byteArrayOf(1)
+            },
+            KeyValuePair().apply {
+                key = Key.APPEND_HTTP_PROXY
+                valueType = KeyValuePair.TYPE_BOOLEAN
+                value = byteArrayOf(1)
+            },
+            KeyValuePair().apply {
+                key = "enableHevTun"
+                valueType = KeyValuePair.TYPE_BOOLEAN
+                value = byteArrayOf(1)
+            },
+            KeyValuePair().apply {
+                key = Key.REMOTE_DNS
+                valueType = KeyValuePair.TYPE_STRING
+                value = "https://1.1.1.1/dns-query".toByteArray(Charsets.UTF_8)
+            },
+            KeyValuePair().apply {
+                key = Key.STRICT_ROUTE
+                valueType = KeyValuePair.TYPE_BOOLEAN
+                value = byteArrayOf(1)
+            }
+        )
+
+        val filtered = incomingSettings.filterNot { it.key in Key.DEPRECATED_SETTING_KEYS }
+        assertEquals(3, filtered.size)
+        assertEquals(listOf(Key.GLOBAL_ALLOW_INSECURE, Key.REMOTE_DNS, Key.STRICT_ROUTE), filtered.map { it.key })
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/GroupManagerListenerTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/GroupManagerListenerTest.kt
new file mode 100644
index 0000000000..db355cf744
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/GroupManagerListenerTest.kt
@@ -0,0 +1,43 @@
+package io.nekohasekai.sagernet.database
+
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.util.concurrent.atomic.AtomicBoolean
+
+class GroupManagerListenerTest {
+
+    @Test
+    fun defaultRouterGroupsUpdatedCallbackDoesNotThrow() = runBlocking {
+        val listener = object : GroupManager.Listener {
+            override suspend fun groupAdd(group: ProxyGroup) = Unit
+            override suspend fun groupUpdated(group: ProxyGroup) = Unit
+            override suspend fun groupRemoved(groupId: Long) = Unit
+            override suspend fun groupUpdated(groupId: Long) = Unit
+        }
+        // Default implementation does not throw
+        listener.routerGroupsUpdated()
+    }
+
+    @Test
+    fun iteratorInvokesRouterGroupsUpdated() = runBlocking {
+        val invoked = AtomicBoolean(false)
+        val listener = object : GroupManager.Listener {
+            override suspend fun groupAdd(group: ProxyGroup) = Unit
+            override suspend fun groupUpdated(group: ProxyGroup) = Unit
+            override suspend fun groupRemoved(groupId: Long) = Unit
+            override suspend fun groupUpdated(groupId: Long) = Unit
+            override suspend fun routerGroupsUpdated() {
+                invoked.set(true)
+            }
+        }
+
+        GroupManager.addListener(listener)
+        try {
+            GroupManager.iterator { routerGroupsUpdated() }
+            assertTrue(invoked.get())
+        } finally {
+            GroupManager.removeListener(listener)
+        }
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/ProxyEntityNullSafetyTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/ProxyEntityNullSafetyTest.kt
new file mode 100644
index 0000000000..c3353bc9d7
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/ProxyEntityNullSafetyTest.kt
@@ -0,0 +1,85 @@
+package io.nekohasekai.sagernet.database
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+import org.junit.Assert.assertThrows
+import io.nekohasekai.sagernet.fmt.KryoConverters
+
+class ProxyEntityNullSafetyTest {
+
+    @Test
+    fun serializationRejectsMissingBeanInsteadOfProducingAnUnusableBackup() {
+        val entity = ProxyEntity(id = 42L, groupId = 10L, type = ProxyEntity.TYPE_SOCKS)
+        assertThrows(IllegalStateException::class.java) {
+            KryoConverters.serialize(entity)
+        }
+    }
+
+    @Test
+    fun missingChainBeanReportsErrorWithoutLookingUpAndroidResources() {
+        val entity = ProxyEntity(id = 43L, groupId = 10L, type = ProxyEntity.TYPE_CHAIN)
+        val error = assertThrows(IllegalStateException::class.java) { entity.requireBean() }
+        assertTrue(error.message.orEmpty().contains("43"))
+    }
+
+    @Test
+    fun displayTypeDoesNotThrowWhenBeansAreNull() {
+        val types = listOf(
+            ProxyEntity.TYPE_SOCKS to "SOCKS",
+            ProxyEntity.TYPE_HTTP to "HTTP",
+            ProxyEntity.TYPE_SS to "Shadowsocks",
+            ProxyEntity.TYPE_SSR to "ShadowsocksR",
+            ProxyEntity.TYPE_VMESS to "VMess",
+            ProxyEntity.TYPE_TROJAN to "Trojan",
+            ProxyEntity.TYPE_TROJAN_GO to "Trojan-Go",
+            ProxyEntity.TYPE_MIERU to "Mieru",
+            ProxyEntity.TYPE_NAIVE to "Naïve",
+            ProxyEntity.TYPE_HYSTERIA to "Hysteria",
+            ProxyEntity.TYPE_SSH to "SSH",
+            ProxyEntity.TYPE_WG to "WireGuard",
+            ProxyEntity.TYPE_TUIC to "TUIC",
+            ProxyEntity.TYPE_JUICITY to "Juicity",
+            ProxyEntity.TYPE_SHADOWTLS to "ShadowTLS",
+            ProxyEntity.TYPE_ANYTLS to "AnyTLS",
+            ProxyEntity.TYPE_NEKO to "Neko",
+            ProxyEntity.TYPE_CONFIG to "Config",
+            ProxyEntity.TYPE_SNELL to "Snell",
+        )
+
+        for ((typeId, expectedPrefix) in types) {
+            val entity = ProxyEntity(id = 42L, groupId = 10L, type = typeId)
+            val result = entity.displayType()
+            assertTrue(
+                "displayType for type $typeId returned '$result', expected to start with '$expectedPrefix'",
+                result.startsWith(expectedPrefix)
+            )
+        }
+    }
+
+    @Test
+    fun requireBeanProvidesHelpfulErrorMessageOnNullBean() {
+        val entity = ProxyEntity(id = 1234L, groupId = 5678L, type = ProxyEntity.TYPE_SOCKS)
+        try {
+            entity.requireBean()
+            fail("Expected requireBean to throw on null socksBean")
+        } catch (e: IllegalStateException) {
+            assertTrue(
+                "Error message should contain profile id: ${e.message}",
+                e.message?.contains("1234") == true
+            )
+            assertTrue(
+                "Error message should contain group id: ${e.message}",
+                e.message?.contains("5678") == true
+            )
+        }
+    }
+
+    @Test
+    fun displayNameOrFallbackHandlesCorruptedProxyWithoutCrashing() {
+        val entity = ProxyEntity(id = 9999L, groupId = 111L, type = ProxyEntity.TYPE_SOCKS)
+        val name = entity.displayNameOrFallback()
+        assertEquals("Proxy 9999", name)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/ProxyGroupBackupTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/ProxyGroupBackupTest.kt
new file mode 100644
index 0000000000..ec0080dd49
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/ProxyGroupBackupTest.kt
@@ -0,0 +1,47 @@
+package io.nekohasekai.sagernet.database
+
+import com.esotericsoftware.kryo.io.ByteBufferInput
+import com.esotericsoftware.kryo.io.ByteBufferOutput
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.Assert.assertThrows
+import io.nekohasekai.sagernet.GroupType
+
+class ProxyGroupBackupTest {
+    @Test
+    fun exportRejectsSubscriptionGroupWithNoSubscriptionData() {
+        assertThrows(IllegalStateException::class.java) {
+            ProxyGroup(type = GroupType.SUBSCRIPTION).serializeToBuffer(ByteBufferOutput(256, -1))
+        }
+    }
+    @Test
+    fun backupRoundTripPreservesSelectorAndChainEndpoints() {
+        val group = ProxyGroup(id = 5, name = "Local", isSelector = true, frontProxy = 11, landingProxy = 12)
+        val output = ByteBufferOutput(256, -1)
+        group.serializeToBuffer(output)
+        val restored = ProxyGroup()
+        restored.deserializeFromBuffer(ByteBufferInput(output.toBytes()))
+        assertTrue(restored.isSelector)
+        assertEquals(11L, restored.frontProxy)
+        assertEquals(12L, restored.landingProxy)
+    }
+
+    @Test
+    fun legacyGroupRecordKeepsDefaultSelectorAndChainEndpoints() {
+        val output = ByteBufferOutput(256, -1)
+        output.writeInt(0)
+        output.writeLong(5)
+        output.writeLong(1)
+        output.writeBoolean(true)
+        output.writeString("Local")
+        output.writeInt(0)
+        output.writeInt(0)
+        val restored = ProxyGroup()
+        restored.deserializeFromBuffer(ByteBufferInput(output.toBytes()))
+        assertEquals(5L, restored.id)
+        assertEquals(false, restored.isSelector)
+        assertEquals(-1L, restored.frontProxy)
+        assertEquals(-1L, restored.landingProxy)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/RouterGroupRepositoryTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/RouterGroupRepositoryTest.kt
new file mode 100644
index 0000000000..3425e13dfb
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/RouterGroupRepositoryTest.kt
@@ -0,0 +1,82 @@
+package io.nekohasekai.sagernet.database
+
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class RouterGroupRepositoryTest {
+
+    @Test
+    fun enabledGroupRequiresASelectedSubscription() {
+        val error = assertThrows(RouterGroupValidationException::class.java) {
+            RouterGroupDraft(
+                name = "US1",
+                mode = RouterGroup.MODE_SELECTOR,
+                enabled = true,
+                sourceGroupIds = emptyList(),
+                filter = RouterFilterConfig(),
+            ).validate(emptyList(), setOf(10))
+        }
+        assertEquals(RouterGroupValidationException.Field.SOURCES, error.field)
+    }
+
+    @Test
+    fun disabledEmptyDraftIsAllowed() {
+        RouterGroupDraft(
+            name = "Draft",
+            mode = RouterGroup.MODE_SELECTOR,
+            enabled = false,
+            sourceGroupIds = emptyList(),
+            filter = RouterFilterConfig(),
+        ).validate(emptyList(), emptySet())
+    }
+
+    @Test
+    fun groupNameMustBeUniqueIgnoringCaseAndWhitespace() {
+        val error = assertThrows(RouterGroupValidationException::class.java) {
+            RouterGroupDraft(
+                id = 2,
+                name = " us1 ",
+                mode = RouterGroup.MODE_SELECTOR,
+                enabled = true,
+                sourceGroupIds = listOf(10),
+                filter = RouterFilterConfig(),
+            ).validate(listOf(RouterGroup(id = 1, name = "US1")), setOf(10))
+        }
+        assertEquals(RouterGroupValidationException.Field.NAME, error.field)
+    }
+
+    @Test
+    fun invalidModeSourceAndTimingAreRejected() {
+        val invalidMode = validDraft().copy(mode = 99)
+        assertEquals(
+            RouterGroupValidationException.Field.MODE,
+            assertThrows(RouterGroupValidationException::class.java) {
+                invalidMode.validate(emptyList(), setOf(10))
+            }.field,
+        )
+        val missingSource = validDraft().copy(sourceGroupIds = listOf(11))
+        assertEquals(
+            RouterGroupValidationException.Field.SOURCES,
+            assertThrows(RouterGroupValidationException::class.java) {
+                missingSource.validate(emptyList(), setOf(10))
+            }.field,
+        )
+        val invalidTiming = validDraft().copy(filter = RouterFilterConfig(intervalSeconds = 9))
+        assertEquals(
+            RouterGroupValidationException.Field.INTERVAL,
+            assertThrows(RouterGroupValidationException::class.java) {
+                invalidTiming.validate(emptyList(), setOf(10))
+            }.field,
+        )
+    }
+
+    private fun validDraft() = RouterGroupDraft(
+        name = "US1",
+        mode = RouterGroup.MODE_URL_TEST,
+        enabled = true,
+        sourceGroupIds = listOf(10),
+        filter = RouterFilterConfig(),
+    )
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/database/RouterMemberOrderTest.kt b/app/src/test/java/io/nekohasekai/sagernet/database/RouterMemberOrderTest.kt
new file mode 100644
index 0000000000..da44ddb14e
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/database/RouterMemberOrderTest.kt
@@ -0,0 +1,41 @@
+package io.nekohasekai.sagernet.database
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RouterMemberOrderTest {
+    @Test
+    fun staleDragOrderKeepsNewMembersAndIgnoresRemovedIds() {
+        val dao = MemoryMembers(mutableListOf(
+            RouterMember(1, 30, 1), RouterMember(1, 20, 2), RouterMember(2, 99, 7),
+        ))
+        // The displayed [10,20] snapshot was replaced by [30,20] during a refresh.
+        dao.updateOrders(1, listOf(10, 20))
+        assertEquals(listOf(20L, 30L), dao.getByRouter(1).map { it.proxyId })
+        assertEquals(listOf(1L, 2L), dao.getByRouter(1).map { it.userOrder })
+        assertEquals(7L, dao.getByRouter(2).single().userOrder)
+    }
+
+    @Test
+    fun duplicateUiIdsDoNotCreateOrderGaps() {
+        val dao = MemoryMembers(mutableListOf(RouterMember(1, 10, 1), RouterMember(1, 20, 2)))
+        dao.updateOrders(1, listOf(20, 20, 10))
+        assertEquals(listOf(20L, 10L), dao.getByRouter(1).map { it.proxyId })
+        assertEquals(listOf(1L, 2L), dao.getByRouter(1).map { it.userOrder })
+    }
+
+    private class MemoryMembers(private val rows: MutableList<RouterMember>) : RouterMember.Dao {
+        override fun all() = rows.toList()
+        override fun getByRouter(routerId: Long) = rows.filter { it.routerId == routerId }
+            .sortedWith(compareBy<RouterMember> { it.userOrder }.thenBy { it.proxyId })
+        override fun deleteByRouter(routerId: Long): Int = error("unused")
+        override fun deleteByProxy(proxyId: Long): Int = error("unused")
+        override fun updateUserOrder(routerId: Long, proxyId: Long, userOrder: Long): Int {
+            val row = rows.firstOrNull { it.routerId == routerId && it.proxyId == proxyId } ?: return 0
+            row.userOrder = userOrder
+            return 1
+        }
+        override fun insert(members: List<RouterMember>) { rows.addAll(members) }
+        override fun reset() { rows.clear() }
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIdentityAndChainTest.kt b/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIdentityAndChainTest.kt
new file mode 100644
index 0000000000..ddfcfee58e
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIdentityAndChainTest.kt
@@ -0,0 +1,226 @@
+package io.nekohasekai.sagernet.fmt
+
+import com.esotericsoftware.kryo.KryoException
+import io.nekohasekai.sagernet.database.ProxyGroup
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.database.preference.KeyValuePair
+import org.junit.Assert.*
+import org.junit.Test
+import java.nio.ByteBuffer
+
+class BackupIdentityAndChainTest {
+
+    // --- R04: Strict Deserialization Rejects Null or Empty Byte Array ---
+
+    @Test
+    fun strictDeserializationRejectsNullOrEmptyBytes() {
+        assertThrows(KryoException::class.java) {
+            KryoConverters.withStrictDeserialization {
+                KryoConverters.deserialize(RouterGroup(), null)
+            }
+        }
+        assertThrows(KryoException::class.java) {
+            KryoConverters.withStrictDeserialization {
+                KryoConverters.deserialize(RouterGroup(), ByteArray(0))
+            }
+        }
+        assertThrows(KryoException::class.java) {
+            KryoConverters.withStrictDeserialization {
+                KryoConverters.deserialize(ProxyGroup(), null)
+            }
+        }
+
+        // Outside strict mode, null returns the default bean
+        val nonStrict = KryoConverters.deserialize(RouterGroup(), null)
+        assertNotNull(nonStrict)
+        assertEquals(0L, nonStrict.id)
+    }
+
+    // --- R03: KeyValuePair Payload Structure and Type Validation ---
+
+    @Test
+    fun keyValuePairRejectsTruncatedPayloads() {
+        // TYPE_LONG with empty payload
+        val kvLongEmpty = KeyValuePair("profileId").apply {
+            valueType = KeyValuePair.TYPE_LONG
+            value = ByteArray(0)
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            kvLongEmpty.validate()
+        }
+        // Reading .long should not crash with BufferUnderflowException
+        assertNull(kvLongEmpty.long)
+
+        // TYPE_BOOLEAN with empty payload
+        val kvBoolEmpty = KeyValuePair("boolKey").apply {
+            valueType = KeyValuePair.TYPE_BOOLEAN
+            value = ByteArray(0)
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            kvBoolEmpty.validate()
+        }
+        assertNull(kvBoolEmpty.boolean)
+
+        // TYPE_FLOAT truncated
+        val kvFloatTrunc = KeyValuePair("floatKey").apply {
+            valueType = KeyValuePair.TYPE_FLOAT
+            value = ByteArray(2)
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            kvFloatTrunc.validate()
+        }
+        assertNull(kvFloatTrunc.float)
+
+        // TYPE_STRING_SET with truncated header
+        val kvSetTruncHeader = KeyValuePair("setKey").apply {
+            valueType = KeyValuePair.TYPE_STRING_SET
+            value = ByteArray(2)
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            kvSetTruncHeader.validate()
+        }
+        assertNull(kvSetTruncHeader.stringSet)
+
+        // TYPE_STRING_SET with invalid length exceeding remaining bytes
+        val invalidSetBuffer = ByteBuffer.allocate(8).putInt(100).put(ByteArray(4)).array()
+        val kvSetInvalidLen = KeyValuePair("setKey").apply {
+            valueType = KeyValuePair.TYPE_STRING_SET
+            value = invalidSetBuffer
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            kvSetInvalidLen.validate()
+        }
+        assertNull(kvSetInvalidLen.stringSet)
+    }
+
+    @Test
+    fun keyValuePairValidPayloadsPass() {
+        val kvLong = KeyValuePair("profileId").put(12345L)
+        kvLong.validate()
+        assertEquals(12345L, kvLong.long)
+
+        val kvBool = KeyValuePair("enabled").put(true)
+        kvBool.validate()
+        assertEquals(true, kvBool.boolean)
+
+        val kvFloat = KeyValuePair("scale").put(1.5f)
+        kvFloat.validate()
+        assertEquals(1.5f, kvFloat.float)
+
+        val kvString = KeyValuePair("name").put("hello")
+        kvString.validate()
+        assertEquals("hello", kvString.string)
+
+        val kvSet = KeyValuePair("tags").put(setOf("tag1", "tag2"))
+        kvSet.validate()
+        assertEquals(setOf("tag1", "tag2"), kvSet.stringSet)
+    }
+
+    // --- R05: ChainBean Cycle and Missing Reference Validation ---
+
+    @Test
+    fun chainBeanDetectsSelfLoopAndMutualCycle() {
+        // Self loop: 11 -> [11]
+        val chainEdgesSelf = mapOf(11L to listOf(11L))
+        assertThrows(IllegalArgumentException::class.java) {
+            detectCycles(chainEdgesSelf)
+        }
+
+        // Mutual cycle: 11 -> [12], 12 -> [11]
+        val chainEdgesMutual = mapOf(
+            11L to listOf(12L),
+            12L to listOf(11L)
+        )
+        assertThrows(IllegalArgumentException::class.java) {
+            detectCycles(chainEdgesMutual)
+        }
+
+        // Multi-hop cycle: 11 -> [12], 12 -> [13], 13 -> [11]
+        val chainEdgesMulti = mapOf(
+            11L to listOf(12L),
+            12L to listOf(13L),
+            13L to listOf(11L)
+        )
+        assertThrows(IllegalArgumentException::class.java) {
+            detectCycles(chainEdgesMulti)
+        }
+
+        // Valid DAG: 11 -> [12, 13], 12 -> [14], 13 -> [14], 14 -> []
+        val chainEdgesValid = mapOf(
+            11L to listOf(12L, 13L),
+            12L to listOf(14L),
+            13L to listOf(14L)
+        )
+        // Should not throw
+        detectCycles(chainEdgesValid)
+    }
+
+    private fun detectCycles(chainEdges: Map<Long, List<Long>>) {
+        val visited = HashSet<Long>()
+        val stack = HashSet<Long>()
+        fun check(node: Long) {
+            if (node in stack) throw IllegalArgumentException("Cyclic chain reference detected involving proxy $node")
+            if (node in visited) return
+            visited.add(node)
+            stack.add(node)
+            for (target in chainEdges[node].orEmpty()) {
+                check(target)
+            }
+            stack.remove(node)
+        }
+        for (node in chainEdges.keys) {
+            check(node)
+        }
+    }
+
+    // --- R02: Partial Restore Stable Identity Verification ---
+
+    @Test
+    fun partialRestoreValidatesStableIdentity() {
+        // Target router has same ID 3, but different stableTag
+        val localRouters = mapOf(3L to "router.localB")
+        val expectedRouterTag = "router.backupA"
+
+        assertNotEquals(expectedRouterTag, localRouters[3L])
+
+        // When stableTag matches, it is verified
+        val matchingLocalRouters = mapOf(3L to "router.backupA")
+        assertEquals(expectedRouterTag, matchingLocalRouters[3L])
+
+        // Standard outbounds (0, -1, -2) do not require identity matching
+        val standardOutbounds = listOf(0L, -1L, -2L)
+        for (outbound in standardOutbounds) {
+            assertTrue(outbound <= 0L)
+        }
+    }
+
+    // --- R01: Selection Preservation in Reconciled Update ---
+
+    @Test
+    fun reconcileUpdatePreservesLatestUserSelectionIfValid() {
+        val reconciledMembers = listOf(101L, 102L, 103L)
+        val defaultReconciledSelection = 101L
+
+        // Scenario 1: User concurrently selected 103L (which is in reconciledMembers)
+        val freshUserSelection = 103L
+        val effectiveSelection = if (freshUserSelection != RouterGroup.NO_SELECTION &&
+            reconciledMembers.contains(freshUserSelection)
+        ) {
+            freshUserSelection
+        } else {
+            defaultReconciledSelection
+        }
+        assertEquals(103L, effectiveSelection)
+
+        // Scenario 2: User's old selection 999L is no longer a valid member
+        val staleSelection = 999L
+        val fallbackSelection = if (staleSelection != RouterGroup.NO_SELECTION &&
+            reconciledMembers.contains(staleSelection)
+        ) {
+            staleSelection
+        } else {
+            defaultReconciledSelection
+        }
+        assertEquals(101L, fallbackSelection)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIntegrityTest.kt b/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIntegrityTest.kt
new file mode 100644
index 0000000000..80272acd94
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/fmt/BackupIntegrityTest.kt
@@ -0,0 +1,37 @@
+package io.nekohasekai.sagernet.fmt
+
+import com.esotericsoftware.kryo.KryoException
+import io.nekohasekai.sagernet.database.RuleEntity
+import io.nekohasekai.sagernet.fmt.socks.SOCKSBean
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class BackupIntegrityTest {
+    @Test
+    fun strictBackupDecodeRejectsTruncatedNestedProtocolData() {
+        val bean = SOCKSBean().apply { initializeDefaultValues() }
+        val bytes = KryoConverters.serialize(bean)
+        assertThrows(KryoException::class.java) {
+            KryoConverters.withStrictDeserialization {
+                KryoConverters.socksDeserialize(bytes.copyOf(bytes.size - 3))
+            }
+        }
+        val decoded = KryoConverters.withStrictDeserialization { KryoConverters.socksDeserialize(bytes) }
+        assertEquals(1080, decoded.serverPort)
+    }
+
+    @Test
+    fun importedRulesCannotReferenceMissingRoutersOrProfiles() {
+        assertThrows(IllegalArgumentException::class.java) {
+            BackupSerializer.validateRuleReferences(listOf(RuleEntity(id = 1, routerGroupId = 3)), emptySet(), setOf(3))
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            BackupSerializer.validateRuleReferences(listOf(RuleEntity(id = 1, outbound = 3)), setOf(3), emptySet())
+        }
+        BackupSerializer.validateRuleReferences(
+            listOf(RuleEntity(outbound = 0), RuleEntity(outbound = -1), RuleEntity(outbound = -2),
+                RuleEntity(routerGroupId = 3, outbound = 999)), setOf(3), emptySet(),
+        )
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterOutboundConfigTest.kt b/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterOutboundConfigTest.kt
new file mode 100644
index 0000000000..b6e0e95344
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterOutboundConfigTest.kt
@@ -0,0 +1,82 @@
+package io.nekohasekai.sagernet.fmt
+
+import io.nekohasekai.sagernet.route.RouterRuntimeGroup
+import io.nekohasekai.sagernet.route.RouterRuntimeMode
+import io.nekohasekai.sagernet.route.RouterFilterConfig
+import moe.matsuri.nb4a.SingBoxOptions.Outbound
+import moe.matsuri.nb4a.SingBoxOptions.Outbound_SelectorOptions
+import moe.matsuri.nb4a.SingBoxOptions.Outbound_URLTestOptions
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class RouterOutboundConfigTest {
+
+    @Test
+    fun translatesRuntimeSpecsIntoSelectorAndUrlTestOptions() {
+        val outbounds = buildRouterOutbounds(
+            groups = listOf(
+                RouterRuntimeGroup("router.us", RouterRuntimeMode.SELECTOR, listOf(1), 1,
+                    id = 1, name = "US1", filter = RouterFilterConfig()),
+                RouterRuntimeGroup("router.sg", RouterRuntimeMode.URL_TEST, listOf(2), -1,
+                    id = 2, name = "SG1", filter = RouterFilterConfig(testUrl = "https://example.com/204", intervalSeconds = 120, toleranceMs = 75))
+            ),
+            proxyTags = mapOf(1L to "us-1", 2L to "sg-1")
+        )
+
+        val selector = outbounds[0] as Outbound_SelectorOptions
+        assertEquals("router.us", selector.tag)
+        assertEquals(listOf("us-1"), selector.outbounds)
+        assertEquals("us-1", selector.default_)
+
+        val urlTest = outbounds[1] as Outbound_URLTestOptions
+        assertEquals("router.sg", urlTest.tag)
+        assertEquals(listOf("sg-1"), urlTest.outbounds)
+        assertEquals("https://example.com/204", urlTest.url)
+        assertEquals("120s", urlTest.interval)
+        assertEquals(75, urlTest.tolerance)
+    }
+
+    @Test
+    fun excludesRouterOutboundsForPortableExport() {
+        val outbounds = buildRouterOutbounds(
+            groups = listOf(
+                RouterRuntimeGroup("router.us", RouterRuntimeMode.SELECTOR, listOf(1), 1, id = 1, name = "US1")
+            ),
+            proxyTags = mapOf(1L to "us-1"),
+            includeRouterGroups = false
+        )
+
+        assertTrue(outbounds.isEmpty())
+    }
+
+    @Test
+    fun skipsRouterTagReservedByAnExistingProfile() {
+        val outbounds = buildRouterOutbounds(
+            groups = listOf(
+                RouterRuntimeGroup("profile-us-1", RouterRuntimeMode.SELECTOR, listOf(1), 1, id = 1, name = "US1")
+            ),
+            proxyTags = mapOf(1L to "profile-us-1"),
+            reservedTags = setOf("profile-us-1")
+        )
+
+        assertTrue(outbounds.isEmpty())
+    }
+
+    @Test
+    fun skipsRouterTagReservedByAnAlreadyBuiltInternalOutboundMapTag() {
+        val internalOutbound = Outbound().apply {
+            _hack_config_map["tag"] = "g-123"
+        }
+        assertEquals("g-123", internalOutbound.asMap()["tag"])
+        val outbounds = buildRouterOutbounds(
+            groups = listOf(
+                RouterRuntimeGroup("g-123", RouterRuntimeMode.SELECTOR, listOf(1), 1, id = 1, name = "US1")
+            ),
+            proxyTags = mapOf(1L to "g-123"),
+            reservedTags = routerReservedTags(listOf(internalOutbound))
+        )
+
+        assertTrue(outbounds.isEmpty())
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterRouteSemanticTest.kt b/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterRouteSemanticTest.kt
new file mode 100644
index 0000000000..31c9fb2f7e
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/fmt/RouterRouteSemanticTest.kt
@@ -0,0 +1,103 @@
+package io.nekohasekai.sagernet.fmt
+
+import io.nekohasekai.sagernet.database.RuleEntity
+import io.nekohasekai.sagernet.database.RouterGroup
+import io.nekohasekai.sagernet.route.RouterRuntimeException
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class RouterRouteSemanticTest {
+    private val profileTags = mapOf(11L to "legacy-google", 12L to "legacy-social")
+    private val routerTags = mapOf(7L to "router.custom")
+
+    @Test
+    fun routeNameNeverChangesItsLegacyOutbound() {
+        assertEquals(
+            TAG_BYPASS,
+            resolveRouteOutbound(RuleEntity(name = "Google and AI", outbound = -1), "main", profileTags, routerTags),
+        )
+        assertEquals(
+            "legacy-social",
+            resolveRouteOutbound(RuleEntity(name = "Telegram", outbound = 12), "main", profileTags, routerTags),
+        )
+    }
+
+    @Test
+    fun explicitGroupReferenceUsesItsStableTag() {
+        val rule = RuleEntity(name = "Any name", outbound = 0, routerGroupId = 7)
+        assertEquals("router.custom", resolveRouteOutbound(rule, "main", profileTags, routerTags))
+    }
+
+    @Test
+    fun mainProxyRulesStayOnLegacyTargetWhenRouterGroupsExist() {
+        for (mainTag in listOf(TAG_PROXY, "legacy-google")) {
+            assertEquals(
+                mainTag,
+                resolveRouteOutbound(RuleEntity(outbound = 0), mainTag, profileTags, routerTags, 11),
+            )
+            assertEquals(
+                mainTag,
+                resolveRouteOutbound(RuleEntity(outbound = 11), mainTag, profileTags, routerTags, 11),
+            )
+            assertEquals(
+                "router.custom",
+                resolveRouteOutbound(RuleEntity(outbound = 0, routerGroupId = 7), mainTag, profileTags, routerTags, 11),
+            )
+        }
+    }
+
+    @Test
+    fun routeEditorTargetsAreMutuallyExclusive() {
+        assertEquals(
+            RouteOutboundChoice(outbound = 0L, routerGroupId = 7L),
+            serializeRouteOutboundChoice(4, legacyProfileId = 99L, routerGroupId = 7L, routerChoiceValue = 4),
+        )
+        assertEquals(
+            RouteOutboundChoice(outbound = -1L, routerGroupId = 0L),
+            serializeRouteOutboundChoice(1, legacyProfileId = 99L, routerGroupId = 7L, routerChoiceValue = 4),
+        )
+        assertEquals(
+            RouteOutboundChoice(outbound = 99L, routerGroupId = 0L),
+            serializeRouteOutboundChoice(3, legacyProfileId = 99L, routerGroupId = 7L, routerChoiceValue = 4),
+        )
+    }
+
+    @Test
+    fun missingGroupReferenceThrowsInsteadOfFallingBack() {
+        val error = assertThrows(RouterRuntimeException::class.java) {
+            resolveRouteOutbound(RuleEntity(outbound = 0, routerGroupId = 404), "main", profileTags, routerTags)
+        }
+        assertEquals(404L, error.groupId)
+        assertEquals(RouterRuntimeException.Reason.MISSING, error.reason)
+    }
+
+    @Test
+    fun disabledAndEmptyReferencedGroupsHaveSpecificErrors() {
+        val groups = listOf(
+            RouterGroup(id = 1, stableTag = "router.disabled", name = "Disabled", enabled = false),
+            RouterGroup(id = 2, stableTag = "router.empty", name = "Empty", enabled = true),
+        )
+        val disabled = assertThrows(RouterRuntimeException::class.java) {
+            validateRouterReferences(listOf(RuleEntity(routerGroupId = 1)), groups, emptySet())
+        }
+        assertEquals("Disabled", disabled.groupName)
+        assertEquals(RouterRuntimeException.Reason.DISABLED, disabled.reason)
+
+        val empty = assertThrows(RouterRuntimeException::class.java) {
+            validateRouterReferences(listOf(RuleEntity(routerGroupId = 2)), groups, emptySet())
+        }
+        assertEquals("Empty", empty.groupName)
+        assertEquals(RouterRuntimeException.Reason.EMPTY, empty.reason)
+    }
+
+    @Test
+    fun adBlockInvalidLoadAndMainSelectorTargetsStayUnchanged() {
+        assertEquals(TAG_BLOCK, resolveRouteOutbound(RuleEntity(name = "AdBlock", outbound = -2), "main", profileTags, routerTags))
+        assertEquals("legacy-google", resolveRouteOutbound(RuleEntity(name = "加载节点", outbound = 11, domains = "full:load.invalid"), "main", profileTags, routerTags))
+        assertEquals(
+            "main",
+            resolveRouteOutbound(RuleEntity(outbound = 99), "main", mapOf(99L to "chain"), routerTags, 99),
+        )
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterFilterTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterFilterTest.kt
new file mode 100644
index 0000000000..bdb0202f97
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterFilterTest.kt
@@ -0,0 +1,18 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RouterFilterTest {
+    @Test
+    fun jsonRoundTripPreservesOnlySupportedFields() {
+        val config = RouterFilterConfig("US", "Expired", "https://example.com/204", 120, 75)
+        assertEquals(config, RouterFilterConfig.fromJson(config.toJson()))
+    }
+
+    @Test
+    fun oldOrEmptyJsonUsesSafeDefaults() {
+        assertEquals(RouterFilterConfig(), RouterFilterConfig.fromJson("{}"))
+        assertEquals(RouterFilterConfig(), RouterFilterConfig.fromJson(""))
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterMatcherTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterMatcherTest.kt
new file mode 100644
index 0000000000..150f2824db
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterMatcherTest.kt
@@ -0,0 +1,71 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class RouterMatcherTest {
+
+    @Test
+    fun sameNodeMayAppearInMultipleGroups() {
+        val node = RouterNodeSnapshot(7, "node-a", "US A", subscriptionId = 10)
+        val requests = listOf(
+            RouterMatchRequest(1, listOf(10), RouterFilterConfig(includeRegex = "US").validate()),
+            RouterMatchRequest(2, listOf(10), RouterFilterConfig(includeRegex = "A").validate()),
+        )
+        assertEquals(
+            mapOf(1L to listOf(7L), 2L to listOf(7L)),
+            RouterMatcher.match(listOf(node), requests),
+        )
+    }
+
+    @Test
+    fun matchesOnlySelectedSourcesAndPreservesSourceNodeOrder() {
+        val nodes = listOf(
+            RouterNodeSnapshot(30, "a", "US 2", subscriptionId = 10),
+            RouterNodeSnapshot(10, "b", "US 1", subscriptionId = 10),
+            RouterNodeSnapshot(20, "c", "US other source", subscriptionId = 20),
+        )
+        val request = RouterMatchRequest(1, listOf(10), RouterFilterConfig(includeRegex = "US").validate())
+        assertEquals(listOf(30L, 10L), RouterMatcher.match(nodes, listOf(request))[1])
+    }
+
+    @Test
+    fun emptyIncludeMatchesAllAndExcludeWins() {
+        val nodes = listOf(
+            RouterNodeSnapshot(1, "a", "US Premium", subscriptionId = 10),
+            RouterNodeSnapshot(2, "b", "US Expired", subscriptionId = 10),
+            RouterNodeSnapshot(3, "c", "Singapore", subscriptionId = 10),
+        )
+        val request = RouterMatchRequest(3, listOf(10), RouterFilterConfig(excludeRegex = "Expired").validate())
+        assertEquals(listOf(1L, 3L), RouterMatcher.match(nodes, listOf(request))[3])
+    }
+
+    @Test
+    fun disabledUnavailableAndDuplicateNodesAreIgnoredWithinAGroup() {
+        val nodes = listOf(
+            RouterNodeSnapshot(1, "dead", "US", subscriptionId = 10, enabled = false),
+            RouterNodeSnapshot(2, "bad", "US", subscriptionId = 10, available = false),
+            RouterNodeSnapshot(3, "live", "US", subscriptionId = 10),
+            RouterNodeSnapshot(3, "copy", "US copy", subscriptionId = 10),
+        )
+        val request = RouterMatchRequest(1, listOf(10), RouterFilterConfig().validate())
+        assertEquals(listOf(3L), RouterMatcher.match(nodes, listOf(request))[1])
+    }
+
+    @Test
+    fun invalidRegexIdentifiesTheField() {
+        assertEquals(
+            RouterFilterException.Field.INCLUDE,
+            assertThrows(RouterFilterException::class.java) {
+                RouterFilterConfig(includeRegex = "[").validate()
+            }.field,
+        )
+        assertEquals(
+            RouterFilterException.Field.EXCLUDE,
+            assertThrows(RouterFilterException::class.java) {
+                RouterFilterConfig(excludeRegex = "[").validate()
+            }.field,
+        )
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterMembershipTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterMembershipTest.kt
new file mode 100644
index 0000000000..ea090778c2
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterMembershipTest.kt
@@ -0,0 +1,56 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class RouterMembershipTest {
+
+    @Test
+    fun filtersUnavailableAndDuplicateMembersInCandidateOrder() {
+        val plan = RouterMembership.plan(
+            availableProxyIds = listOf(30L, 10L, 20L),
+            requestedProxyIds = listOf(20L, 99L, 20L, 30L),
+            currentSelectedProxyId = 20L,
+        )
+
+        assertEquals(listOf(30L, 20L), plan.memberProxyIds)
+        assertEquals(20L, plan.selectedProxyId)
+    }
+
+    @Test
+    fun selectsFirstRemainingMemberWhenCurrentSelectionWasRemoved() {
+        val plan = RouterMembership.plan(
+            availableProxyIds = listOf(30L, 10L, 20L),
+            requestedProxyIds = listOf(20L, 30L),
+            currentSelectedProxyId = 10L,
+        )
+
+        assertEquals(listOf(30L, 20L), plan.memberProxyIds)
+        assertEquals(30L, plan.selectedProxyId)
+    }
+
+    @Test
+    fun clearsSelectionWhenNoMembersRemain() {
+        val plan = RouterMembership.plan(
+            availableProxyIds = listOf(30L, 10L),
+            requestedProxyIds = emptyList(),
+            currentSelectedProxyId = 10L,
+        )
+
+        assertEquals(emptyList<Long>(), plan.memberProxyIds)
+        assertNull(plan.selectedProxyId)
+    }
+
+    @Test
+    fun permitsMembersThatMayAlsoBelongToOtherGroups() {
+        val plan = RouterMembership.plan(
+            availableProxyIds = listOf(10L, 20L, 30L),
+            requestedProxyIds = listOf(10L, 20L, 30L),
+            currentSelectedProxyId = 20L,
+        )
+
+        assertEquals(listOf(10L, 20L, 30L), plan.memberProxyIds)
+        assertEquals(20L, plan.selectedProxyId)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterReconcilerTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterReconcilerTest.kt
new file mode 100644
index 0000000000..e224d500d9
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterReconcilerTest.kt
@@ -0,0 +1,166 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class RouterReconcilerTest {
+
+    @Test
+    fun reusedProfileIdDoesNotStealStableMemberOrderOrSelection() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(
+                RouterNodeSnapshot(100, "replacement", "US A", subscriptionId = 10),
+                RouterNodeSnapshot(200, "original", "US renamed", subscriptionId = 10),
+            ),
+            groups = listOf(group(1, setOf(10), "US", selectedProxyId = 100)),
+            previousMembers = mapOf(1L to listOf(RouterMemberSnapshot(100, "original", 10, 7))),
+        )
+
+        assertEquals(listOf(200L, 100L), result.membersByRouterId.getValue(1).map { it.proxyId })
+        assertEquals(listOf(7L, 8L), result.membersByRouterId.getValue(1).map { it.userOrder })
+        assertEquals(200L, result.selectedProxyIdsByRouterId.getValue(1))
+    }
+
+    @Test
+    fun selectionFollowsStableIdentityWhenExistingIdsSwapNodes() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(
+                RouterNodeSnapshot(100, "b", "US A", subscriptionId = 10),
+                RouterNodeSnapshot(200, "a", "US B", subscriptionId = 10),
+            ),
+            groups = listOf(group(1, setOf(10), "US", selectedProxyId = 100)),
+            previousMembers = mapOf(1L to listOf(
+                RouterMemberSnapshot(100, "a", 10, 7),
+                RouterMemberSnapshot(200, "b", 10, 8),
+            )),
+        )
+
+        assertEquals(200L, result.selectedProxyIdsByRouterId.getValue(1))
+        assertEquals(listOf(200L, 100L), result.membersByRouterId.getValue(1).map { it.proxyId })
+    }
+
+    @Test
+    fun remapsMemberAndSelectionBySourceScopedStableIdentity() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(RouterNodeSnapshot(200, "node-a", "US renamed", subscriptionId = 10)),
+            groups = listOf(group(1, setOf(10), "US", selectedProxyId = 100)),
+            previousMembers = mapOf(
+                1L to listOf(RouterMemberSnapshot(100, "node-a", sourceGroupId = 10, userOrder = 7))
+            ),
+        )
+
+        assertEquals(listOf(200L), result.membersByRouterId.getValue(1).map { it.proxyId })
+        assertEquals(listOf(7L), result.membersByRouterId.getValue(1).map { it.userOrder })
+        assertEquals(200L, result.selectedProxyIdsByRouterId.getValue(1))
+        assertFalse(result.preservedPreviousMembers)
+    }
+
+    @Test
+    fun identicalStableIdentityFromAnotherSourceIsNotUsed() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(RouterNodeSnapshot(200, "shared", "US B", subscriptionId = 20)),
+            groups = listOf(group(1, setOf(10), "US")),
+            previousMembers = mapOf(
+                1L to listOf(RouterMemberSnapshot(100, "shared", sourceGroupId = 10, userOrder = 3))
+            ),
+        )
+
+        assertTrue(result.membersByRouterId.getValue(1).isEmpty())
+    }
+
+    @Test
+    fun theSameCurrentNodeIsRetainedIndependentlyByTwoGroups() {
+        val current = listOf(RouterNodeSnapshot(200, "node-a", "US A", subscriptionId = 10))
+        val previous = listOf(RouterMemberSnapshot(100, "node-a", sourceGroupId = 10))
+        val result = RouterReconciler.reconcile(
+            current,
+            listOf(group(1, setOf(10), "US"), group(2, setOf(10), "A")),
+            mapOf(1L to previous, 2L to previous),
+        )
+
+        assertEquals(listOf(200L), result.membersByRouterId.getValue(1).map { it.proxyId })
+        assertEquals(listOf(200L), result.membersByRouterId.getValue(2).map { it.proxyId })
+    }
+
+    @Test
+    fun excludeAndSourceChangesRemoveOldMembersOnSuccessfulRefresh() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(
+                RouterNodeSnapshot(200, "a", "US Expired", subscriptionId = 10),
+                RouterNodeSnapshot(300, "b", "US Other", subscriptionId = 20),
+            ),
+            groups = listOf(group(1, setOf(10), "US", exclude = "Expired")),
+            previousMembers = mapOf(1L to listOf(RouterMemberSnapshot(100, "a", 10))),
+        )
+
+        assertTrue(result.membersByRouterId.getValue(1).isEmpty())
+        assertFalse(result.preservedPreviousMembers)
+    }
+
+    @Test
+    fun emptyOrInvalidRefreshPreservesTheLastValidSnapshot() {
+        val previous = mapOf(1L to listOf(RouterMemberSnapshot(100, "a", 10)))
+        val empty = RouterReconciler.reconcile(emptyList(), listOf(group(1, setOf(10), "")), previous)
+        val invalid = RouterReconciler.reconcile(
+            listOf(RouterNodeSnapshot(200, "b", "US", subscriptionId = 10, available = false)),
+            listOf(group(1, setOf(10), "")),
+            previous,
+        )
+
+        assertEquals(previous, empty.membersByRouterId)
+        assertEquals(previous, invalid.membersByRouterId)
+        assertTrue(empty.preservedPreviousMembers)
+        assertTrue(invalid.preservedPreviousMembers)
+        assertNotNull(empty.error)
+        assertNotNull(invalid.error)
+    }
+
+    @Test
+    fun newMembersAppendInMatcherOrderAfterSurvivingUserOrder() {
+        val result = RouterReconciler.reconcile(
+            currentNodes = listOf(
+                RouterNodeSnapshot(300, "c", "US C", subscriptionId = 10),
+                RouterNodeSnapshot(200, "a", "US A", subscriptionId = 10),
+                RouterNodeSnapshot(201, "b", "US B", subscriptionId = 10),
+            ),
+            groups = listOf(group(1, setOf(10), "US")),
+            previousMembers = mapOf(
+                1L to listOf(
+                    RouterMemberSnapshot(101, "b", 10, 5),
+                    RouterMemberSnapshot(100, "a", 10, 20),
+                )
+            ),
+        )
+
+        assertEquals(listOf(201L, 200L, 300L), result.membersByRouterId.getValue(1).map { it.proxyId })
+        assertEquals(listOf(5L, 20L, 21L), result.membersByRouterId.getValue(1).map { it.userOrder })
+    }
+
+    @Test
+    fun identifiesDanglingMembersAfterProxyDeletion() {
+        assertEquals(
+            setOf(100L),
+            danglingRouterMemberProxyIds(
+                listOf(RouterMemberSnapshot(100, "old"), RouterMemberSnapshot(200, "current")),
+                setOf(200),
+            ),
+        )
+    }
+
+    private fun group(
+        id: Long,
+        sources: Set<Long>,
+        include: String,
+        exclude: String = "",
+        selectedProxyId: Long? = null,
+    ) = RouterReconcileGroup(
+        routerId = id,
+        stableTag = "router.$id",
+        sourceGroupIds = sources.toList(),
+        filter = RouterFilterConfig(include, exclude).validate(),
+        selectedProxyId = selectedProxyId,
+    )
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeSelectionTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeSelectionTest.kt
new file mode 100644
index 0000000000..a1268dda96
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeSelectionTest.kt
@@ -0,0 +1,38 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RouterRuntimeSelectionTest {
+
+    @Test
+    fun mapsCoreWinnerToItsActualProfileInsteadOfTheFirstMember() {
+        val selections = RouterRuntimeSelection.resolve(
+            routerTags = linkedMapOf(10L to "router.web3"),
+            profileTags = linkedMapOf(1L to "node-a", 2L to "node-b"),
+            currentOutbound = { "node-b" },
+        )
+
+        assertArrayEquals(longArrayOf(10L, 2L), selections)
+    }
+
+    @Test
+    fun leavesGroupUnselectedUntilCoreHasAResult() {
+        val selections = RouterRuntimeSelection.resolve(
+            routerTags = linkedMapOf(10L to "router.web3"),
+            profileTags = linkedMapOf(1L to "node-a", 2L to "node-b"),
+            currentOutbound = { "" },
+        )
+
+        assertArrayEquals(longArrayOf(), selections)
+    }
+
+    @Test
+    fun parsesSelectionPairsWithoutAcceptingDanglingValues() {
+        assertEquals(
+            linkedMapOf(10L to 2L, 20L to 4L),
+            RouterRuntimeSelection.toMap(longArrayOf(10L, 2L, 20L, 4L, 99L)),
+        )
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeTest.kt
new file mode 100644
index 0000000000..5b656f3e05
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeTest.kt
@@ -0,0 +1,85 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RouterRuntimeTest {
+
+    @Test
+    fun buildsArbitraryUserNamedGroupsWithStableTags() {
+        val outbounds = RouterRuntime.build(
+            groups = listOf(
+                RouterRuntimeGroup("router.27a", RouterRuntimeMode.SELECTOR, listOf(1), 1, name = "US 1"),
+                RouterRuntimeGroup("router.91b", RouterRuntimeMode.URL_TEST, listOf(2), -1, name = "Work")
+            ),
+            proxyTags = mapOf(1L to "us-1", 2L to "work-1")
+        )
+
+        assertEquals(
+            listOf("router.27a", "router.91b"),
+            outbounds.map { it.tag }
+        )
+        assertEquals(
+            listOf(RouterRuntimeMode.SELECTOR, RouterRuntimeMode.URL_TEST),
+            outbounds.map { it.mode }
+        )
+    }
+
+    @Test
+    fun resolvesOnlyCurrentOutboundTagsAndSkipsEmptyGroups() {
+        val outbounds = RouterRuntime.build(
+            groups = listOf(
+                RouterRuntimeGroup("router.us", RouterRuntimeMode.SELECTOR, listOf(1, 99, 1), 99),
+                RouterRuntimeGroup("router.empty", RouterRuntimeMode.URL_TEST, listOf(404), -1)
+            ),
+            proxyTags = mapOf(1L to "us-1", 2L to "unrelated")
+        )
+
+        assertEquals(listOf("us-1"), outbounds[0].outbounds)
+        assertEquals("us-1", outbounds[0].defaultTag)
+        assertEquals(listOf("router.us"), outbounds.map { it.tag })
+    }
+
+    @Test
+    fun skipsGroupsWhoseStableTagsCollideWithProfilesOrSystemOutbounds() {
+        val outbounds = RouterRuntime.build(
+            groups = listOf(
+                RouterRuntimeGroup("profile-us-1", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("direct", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("bypass", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("block", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("proxy", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("fragment", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("mixed-in", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("dns-hosts", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("router.us", RouterRuntimeMode.SELECTOR, listOf(1), 1)
+            ),
+            proxyTags = mapOf(1L to "profile-us-1"),
+            reservedTags = setOf(
+                "profile-us-1",
+                "direct",
+                "bypass",
+                "block",
+                "proxy",
+                "fragment",
+                "mixed-in",
+                "dns-hosts"
+            )
+        )
+
+        assertEquals(listOf("router.us"), outbounds.map { it.tag })
+    }
+
+    @Test
+    fun findsUrlTestGroupForTheSelectedHomeProxy() {
+        val tag = RouterRuntime.findUrlTestGroupForProxy(
+            groups = listOf(
+                RouterRuntimeGroup("router.manual", RouterRuntimeMode.SELECTOR, listOf(1), 1),
+                RouterRuntimeGroup("router.web3", RouterRuntimeMode.URL_TEST, listOf(2, 3), -1),
+            ),
+            selectedProxyId = 3L,
+        )
+
+        assertEquals("router.web3", tag)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/RouterSelectionTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/RouterSelectionTest.kt
new file mode 100644
index 0000000000..b635bed953
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/RouterSelectionTest.kt
@@ -0,0 +1,130 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RouterSelectionTest {
+
+    @Test
+    fun selectsOnlyTheRequestedRouterUsingItsSelectorMapping() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = "router.sg",
+                proxyId = 20L,
+                mode = RouterRuntimeMode.SELECTOR,
+            ),
+            routerSelectorTags = mapOf(
+                "router.us" to "selector-us",
+                "router.sg" to "selector-sg",
+            ),
+            routerMemberIds = mapOf(
+                "router.us" to setOf(10L),
+                "router.sg" to setOf(20L),
+            ),
+            profileTags = mapOf(10L to "node-us", 20L to "node-sg"),
+            selectorGroupId = -1L,
+        )
+
+        assertEquals(
+            RouterSelectionPlan.HotSwitch(
+                routerTag = "router.sg",
+                selectorTag = "selector-sg",
+                targetTag = "node-sg",
+            ),
+            result,
+        )
+    }
+
+    @Test
+    fun keepsLegacySelectorGroupIdSelectionAvailable() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = null,
+                proxyId = 10L,
+                mode = RouterRuntimeMode.SELECTOR,
+            ),
+            routerSelectorTags = emptyMap(),
+            routerMemberIds = emptyMap(),
+            profileTags = mapOf(10L to "node-us"),
+            selectorGroupId = 42L,
+        )
+
+        assertEquals(
+            RouterSelectionPlan.HotSwitch(
+                routerTag = null,
+                selectorTag = "proxy",
+                targetTag = "node-us",
+            ),
+            result,
+        )
+    }
+
+    @Test
+    fun missingRouterTagDoesNotProduceASelectorCall() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = "router.missing",
+                proxyId = 20L,
+                mode = RouterRuntimeMode.SELECTOR,
+            ),
+            routerSelectorTags = mapOf("router.us" to "selector-us"),
+            routerMemberIds = mapOf("router.us" to setOf(10L)),
+            profileTags = mapOf(20L to "node-sg"),
+            selectorGroupId = -1L,
+        )
+
+        assertEquals(RouterSelectionPlan.IgnoreMissingRouter, result)
+    }
+
+    @Test
+    fun disabledRouterDoesNotProduceASelectorCall() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = "router.us",
+                proxyId = 10L,
+                mode = RouterRuntimeMode.SELECTOR,
+                routerEnabled = false,
+            ),
+            routerSelectorTags = mapOf("router.us" to "selector-us"),
+            routerMemberIds = mapOf("router.us" to setOf(10L)),
+            profileTags = mapOf(10L to "node-us"),
+            selectorGroupId = -1L,
+        )
+
+        assertEquals(RouterSelectionPlan.IgnoreMissingRouter, result)
+    }
+
+    @Test
+    fun blankRouterTagDoesNotProduceASelectorCall() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = "",
+                proxyId = 10L,
+                mode = RouterRuntimeMode.SELECTOR,
+            ),
+            routerSelectorTags = mapOf("" to "selector-empty"),
+            routerMemberIds = mapOf("" to setOf(10L)),
+            profileTags = mapOf(10L to "node-us"),
+            selectorGroupId = -1L,
+        )
+
+        assertEquals(RouterSelectionPlan.IgnoreMissingRouter, result)
+    }
+
+    @Test
+    fun automaticRouterSelectionUsesFullReloadInsteadOfHotSwitch() {
+        val result = RouterSelection.plan(
+            request = RouterSelectionRequest(
+                routerTag = "router.us-low",
+                proxyId = 30L,
+                mode = RouterRuntimeMode.URL_TEST,
+            ),
+            routerSelectorTags = mapOf("router.us-low" to "selector-us-low"),
+            routerMemberIds = mapOf("router.us-low" to setOf(30L)),
+            profileTags = mapOf(30L to "node-us-low"),
+            selectorGroupId = -1L,
+        )
+
+        assertEquals(RouterSelectionPlan.Reload, result)
+    }
+}
diff --git a/app/src/test/java/io/nekohasekai/sagernet/route/UrlTestTargetResolverTest.kt b/app/src/test/java/io/nekohasekai/sagernet/route/UrlTestTargetResolverTest.kt
new file mode 100644
index 0000000000..285cd65f70
--- /dev/null
+++ b/app/src/test/java/io/nekohasekai/sagernet/route/UrlTestTargetResolverTest.kt
@@ -0,0 +1,61 @@
+package io.nekohasekai.sagernet.route
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class UrlTestTargetResolverTest {
+
+    @Test
+    fun routerModeUsesCurrentRouterMembersWithoutReadingCurrentProxyGroup() {
+        var normalGroupReads = 0
+
+        val targets = UrlTestTargetResolver.resolve(
+            routerGroupId = 7L,
+            loadRouterTargets = { routerId ->
+                assertEquals(7L, routerId)
+                listOf(101L, 102L)
+            },
+            loadNormalGroupTargets = {
+                normalGroupReads++
+                listOf(1L)
+            },
+        )
+
+        assertEquals(listOf(101L, 102L), targets)
+        assertEquals(0, normalGroupReads)
+    }
+
+    @Test
+    fun normalModeKeepsUsingCurrentProxyGroup() {
+        var routerReads = 0
+
+        val targets = UrlTestTargetResolver.resolve(
+            routerGroupId = null,
+            loadRouterTargets = {
+                routerReads++
+                emptyList()
+            },
+            loadNormalGroupTargets = { listOf(1L, 2L) },
+        )
+
+        assertEquals(listOf(1L, 2L), targets)
+        assertEquals(0, routerReads)
+    }
+
+    @Test
+    fun emptyRouterGroupDoesNotFallBackToCurrentProxyGroup() {
+        var normalGroupReads = 0
+
+        val targets = UrlTestTargetResolver.resolve(
+            routerGroupId = 8L,
+            loadRouterTargets = { emptyList() },
+            loadNormalGroupTargets = {
+                normalGroupReads++
+                listOf(1L)
+            },
+        )
+
+        assertEquals(emptyList<Long>(), targets)
+        assertEquals(0, normalGroupReads)
+    }
+}
diff --git a/app/src/test/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmtTest.kt b/app/src/test/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmtTest.kt
new file mode 100644
index 0000000000..56fd11b7be
--- /dev/null
+++ b/app/src/test/java/moe/matsuri/nb4a/proxy/anytls/AnyTLSFmtTest.kt
@@ -0,0 +1,22 @@
+package moe.matsuri.nb4a.proxy.anytls
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AnyTLSFmtTest {
+    @Test
+    fun singBoxOutboundSubscriptionBecomesRegularAnyTlsNode() {
+        val bean = parseSingBoxAnyTLSMap(mapOf("type" to "anytls", "tag" to "web3-us", "server" to "example.com", "server_port" to 443,
+            "password" to "secret", "tls" to mapOf("server_name" to "cdn.example.com", "insecure" to true,
+                "utls" to mapOf("fingerprint" to "chrome"), "alpn" to listOf("h2", "http/1.1"))))!!
+        assertEquals("web3-us", bean.name)
+        assertEquals("example.com", bean.serverAddress)
+        assertEquals(443, bean.serverPort)
+        assertEquals("secret", bean.password)
+        assertEquals("cdn.example.com", bean.sni)
+        assertTrue(bean.allowInsecure)
+        assertEquals("chrome", bean.utlsFingerprint)
+        assertEquals("h2\nhttp/1.1", bean.alpn)
+    }
+}
diff --git a/asteria.properties b/asteria.properties
new file mode 100644
index 0000000000..f4a5b0374e
--- /dev/null
+++ b/asteria.properties
@@ -0,0 +1,4 @@
+PACKAGE_NAME=com.asteria
+VERSION_NAME=1.0
+PRE_VERSION_NAME=pre-1.0
+VERSION_CODE=51
diff --git a/buildScript/compile-hevtun.sh b/buildScript/compile-hevtun.sh
deleted file mode 100755
index 9aeb37ef23..0000000000
--- a/buildScript/compile-hevtun.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/bin/bash
-# Build the hev-socks5-tunnel JNI library (libhev-socks5-tunnel.so) for all
-# Android ABIs and place the artifacts under app/src/main/jniLibs.
-#
-# Source: the hev-socks5-tunnel git submodule at the repository root
-# (initialized automatically when missing). The app Gradle build invokes this
-# script via the "buildHevTun" task whenever the .so artifacts are absent.
-#
-# The JNI entry points (TProxyStartService/TProxyStopService/TProxyIsRunning/
-# TProxyGetStats) are bound at library load time via RegisterNatives to the
-# class named by -DPKGNAME/-DCLSNAME below; keep them in sync with
-# moe.matsuri.nb4a.hevtun.HevTunNative.
-#
-# Usage:
-#   ./buildScript/compile-hevtun.sh
-#
-# Optional environment overrides:
-#   HEV_SRC     path to a hev-socks5-tunnel checkout
-#               (default: <repo root>/hev-socks5-tunnel submodule)
-#   HEV_VERSION tag used when initializing the submodule is not possible
-#               (default: 2.17.1)
-set -o errexit
-set -o pipefail
-set -o nounset
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "$SCRIPT_DIR/init/env_ndk.sh"
-
-HEV_VERSION="${HEV_VERSION:-2.17.1}"
-HEV_SRC="${HEV_SRC:-$REPO_DIR/hev-socks5-tunnel}"
-ABIS="armeabi-v7a arm64-v8a x86 x86_64"
-OUT_DIR="$REPO_DIR/app/src/main/jniLibs"
-BUILD_DIR="$REPO_DIR/.hev-build"
-
-if [ ! -f "$HEV_SRC/Android.mk" ]; then
-    if [ -e "$REPO_DIR/.git" ] || [ -d "$REPO_DIR/.git" ]; then
-        echo ">> initializing hev-socks5-tunnel submodule"
-        git -C "$REPO_DIR" submodule update --init --recursive hev-socks5-tunnel
-    else
-        echo ">> cloning hev-socks5-tunnel $HEV_VERSION into $HEV_SRC"
-        mkdir -p "$(dirname "$HEV_SRC")"
-        git clone --branch "$HEV_VERSION" --depth 1 --recursive \
-            https://github.com/heiher/hev-socks5-tunnel "$HEV_SRC"
-    fi
-fi
-
-# Persistent obj/libs dirs so ndk-build stays incremental between runs.
-mkdir -p "$BUILD_DIR"
-pushd "$BUILD_DIR" > /dev/null
-
-if [ ! -e jni/hev-socks5-tunnel ]; then
-    mkdir -p jni
-    ln -sfn "$HEV_SRC" jni/hev-socks5-tunnel
-    echo 'include $(call all-subdir-makefiles)' > jni/Android.mk
-fi
-
-"$ANDROID_NDK_HOME/ndk-build" \
-    NDK_PROJECT_PATH=. \
-    APP_BUILD_SCRIPT=jni/Android.mk \
-    "APP_ABI=$ABIS" \
-    APP_PLATFORM=android-21 \
-    "APP_CFLAGS=-O3 -DPKGNAME=moe/matsuri/nb4a/hevtun -DCLSNAME=HevTunNative" \
-    "APP_LDFLAGS=-Wl,--build-id=none -Wl,--hash-style=gnu" \
-    NDK_LIBS_OUT="$BUILD_DIR/libs" \
-    NDK_OUT="$BUILD_DIR/obj"
-
-popd > /dev/null
-
-for abi in $ABIS; do
-    mkdir -p "$OUT_DIR/$abi"
-    cp -f "$BUILD_DIR/libs/$abi/libhev-socks5-tunnel.so" "$OUT_DIR/$abi/"
-    echo ">> install $OUT_DIR/$abi/libhev-socks5-tunnel.so"
-done
diff --git a/buildScript/init/env_ndk.sh b/buildScript/init/env_ndk.sh
index c0c7b8761b..52b300aac8 100755
--- a/buildScript/init/env_ndk.sh
+++ b/buildScript/init/env_ndk.sh
@@ -20,5 +20,9 @@ if [ ! -f "$_NDK/source.properties" ]; then
   exit 1
 fi
 
+case "$_NDK" in
+  [A-Za-z]:\\*) _NDK="$(cygpath -u "$_NDK")" ;;
+esac
+
 export ANDROID_NDK_HOME=$_NDK
 export NDK=$_NDK
diff --git a/buildScript/lib/core/get_source_env.sh b/buildScript/lib/core/get_source_env.sh
index 61550575dd..d8fbaff692 100644
--- a/buildScript/lib/core/get_source_env.sh
+++ b/buildScript/lib/core/get_source_env.sh
@@ -1,2 +1,2 @@
-export COMMIT_SING_BOX="0b7a2fc2f2c33f754e5fe5a1bb3e0a4f610b6aa9"
+export COMMIT_SING_BOX="cf69a007cd45311fbd5d7bafe39e5eda3267089f"
 export COMMIT_LIBNEKO="6a85c185d62435a5293ef70ac3b638ae3ee1efa7"
diff --git a/buildSrc/src/main/kotlin/Helpers.kt b/buildSrc/src/main/kotlin/Helpers.kt
index 64b2a96d0a..04cfa70cfc 100644
--- a/buildSrc/src/main/kotlin/Helpers.kt
+++ b/buildSrc/src/main/kotlin/Helpers.kt
@@ -12,40 +12,36 @@ import kotlin.system.exitProcess
 
 private val Project.android get() = extensions.getByName<ApplicationExtension>("android")
 
-private lateinit var metadata: Properties
-private lateinit var localProperties: Properties
-
 fun Project.requireMetadata(): Properties {
-    if (!::metadata.isInitialized) {
-        metadata = Properties().apply {
-            load(rootProject.file("nb4a.properties").inputStream())
-        }
+    val file = rootProject.file("asteria.properties")
+    val props = Properties()
+    if (file.exists()) {
+        file.inputStream().use { props.load(it) }
     }
-    return metadata
+    return props
 }
 
 fun Project.requireLocalProperties(): Properties {
-    if (!::localProperties.isInitialized) {
-        localProperties = Properties()
-
-        val base64 = System.getenv("LOCAL_PROPERTIES")
-        if (!base64.isNullOrBlank()) {
-
-            localProperties.load(Base64.getDecoder().decode(base64).inputStream())
-        } else if (project.rootProject.file("local.properties").exists()) {
-            localProperties.load(rootProject.file("local.properties").inputStream())
+    val props = Properties()
+    val base64 = System.getenv("LOCAL_PROPERTIES")
+    if (!base64.isNullOrBlank()) {
+        props.load(Base64.getDecoder().decode(base64).inputStream())
+    } else {
+        val file = rootProject.file("local.properties")
+        if (file.exists()) {
+            file.inputStream().use { props.load(it) }
         }
     }
-    return localProperties
+    return props
 }
 
 fun Project.setupCommon() {
     android.apply {
-        buildToolsVersion = "35.0.1"
-        compileSdk = 35
+        buildToolsVersion = "36.0.0"
+        compileSdk = 36
         defaultConfig {
-            minSdk = 21
-            targetSdk = 35
+            minSdk = 36
+            targetSdk = 36
         }
         buildTypes {
             getByName("release") {
@@ -63,7 +59,9 @@ fun Project.setupCommon() {
             showAll = true
             checkAllWarnings = true
             checkReleaseBuilds = true
-            warningsAsErrors = true
+            // Keep advisory dependency/style findings visible without promoting them
+            // to runtime correctness errors. Lint errors still abort the build.
+            warningsAsErrors = false
             textOutput = project.file("build/lint.txt")
             htmlOutput = project.file("build/lint.html")
         }
@@ -115,26 +113,41 @@ fun Project.setupAppCommon() {
     setupCommon()
 
     val lp = requireLocalProperties()
+    val keystorePath = lp.getProperty("KEYSTORE_PATH") ?: System.getenv("KEYSTORE_PATH")
     val keystorePwd = lp.getProperty("KEYSTORE_PASS") ?: System.getenv("KEYSTORE_PASS")
     val alias = lp.getProperty("ALIAS_NAME") ?: System.getenv("ALIAS_NAME")
     val pwd = lp.getProperty("ALIAS_PASS") ?: System.getenv("ALIAS_PASS")
 
+    val asteriaKeystore = rootProject.file("asteria.keystore")
+    val releaseKeystore = rootProject.file("release.keystore")
+    val targetKeystore = when {
+        !keystorePath.isNullOrBlank() -> rootProject.file(keystorePath)
+        asteriaKeystore.exists() -> asteriaKeystore
+        releaseKeystore.exists() -> releaseKeystore
+        else -> null
+    }
+
     android.apply {
-        if (keystorePwd != null) {
+        if (targetKeystore != null && targetKeystore.exists() && keystorePwd != null && alias != null && pwd != null) {
             signingConfigs {
                 create("release") {
-                    storeFile = rootProject.file("release.keystore")
+                    storeFile = targetKeystore
                     storePassword = keystorePwd
                     keyAlias = alias
                     keyPassword = pwd
                 }
             }
+        } else if (gradle.startParameter.taskNames.any { it.contains("Release", ignoreCase = true) }) {
+            logger.warn("Release signing configuration is missing or incomplete! Provide KEYSTORE_PASS, ALIAS_NAME, ALIAS_PASS.")
         }
         buildTypes {
-            val key = signingConfigs.findByName("release")
-            if (key != null) {
-                getByName("release").signingConfig = key
-                getByName("debug").signingConfig = key
+            val releaseKey = signingConfigs.findByName("release")
+            if (releaseKey != null) {
+                getByName("release").signingConfig = releaseKey
+            }
+            val debugKey = signingConfigs.findByName("debug") ?: releaseKey
+            if (debugKey != null) {
+                getByName("debug").signingConfig = debugKey
             }
         }
     }
@@ -170,10 +183,7 @@ fun Project.setupApp() {
             reset()
             isEnable = true
             isUniversalApk = false
-            include("armeabi-v7a")
             include("arm64-v8a")
-            include("x86")
-            include("x86_64")
         }
 
         flavorDimensions += "vendor"
@@ -197,17 +207,17 @@ fun Project.setupApp() {
                 outputFileName = if (isPreview) {
                     outputFileName.replace(
                         project.name,
-                        "NekoBoxF-" + requireMetadata().getProperty("PRE_VERSION_NAME")
+                        "Asteria-" + requireMetadata().getProperty("PRE_VERSION_NAME")
                     ).replace("-preview", "")
                 } else {
-                    outputFileName.replace(project.name, "NekoBoxF-$versionName")
+                    outputFileName.replace(project.name, "Asteria-$versionName")
                         .replace("-release", "")
                         .replace("-oss", "")
                 }
             }
         }
 
-        for (abi in listOf("Arm64", "Arm", "X64", "X86")) {
+        for (abi in listOf("Arm64")) {
             tasks.create("assemble" + abi + "FdroidRelease") {
                 dependsOn("assembleFdroidRelease")
             }
@@ -217,4 +227,4 @@ fun Project.setupApp() {
             jniLibs.srcDir("executableSo")
         }
     }
-}
\ No newline at end of file
+}
diff --git a/docs/sing-box-1.15-upgrade.md b/docs/sing-box-1.15-upgrade.md
new file mode 100644
index 0000000000..d8937ae20b
--- /dev/null
+++ b/docs/sing-box-1.15-upgrade.md
@@ -0,0 +1,89 @@
+# sing-box 1.15 / Go TUN stack 升级说明
+
+## 目标
+
+将 NekoBox for Android 的 sing-box 核心升级到包含新 **Go TUN stack** 的版本，
+以改善 Android VPN 的 TUN 性能、CPU/内存效率和长期运行功耗。
+
+本次升级**不删除**原有 gVisor / System / Mixed 回退能力；Go stack 仅作为新安装默认项。
+
+## 固定依赖
+
+| 组件 | 版本 / Commit |
+|---|---|
+| sing-box | `cf69a007cd45311fbd5d7bafe39e5eda3267089f` (`Add go TUN stack`) |
+| sing | `v0.9.4-0.20260908053243-3e69d072c058` |
+| sing-tun | `v0.9.1-0.20260908051822-65ba32b917d5` |
+| gvisor | `v0.0.0-20260727.0-sing-box-mod.1`（显式固定，见下方说明） |
+| Go | `1.25.5` |
+| Android NDK | `25.0.8775105` |
+
+> 正式 `1.15.0-alpha.3` / beta / stable 发布后，再单独评估是否从 commit pin 切换到 release tag。
+> 当前不跟踪浮动 `testing` HEAD。
+
+## 核心变更
+
+1. **TUN stack 默认 `go`**
+   - `Constants.kt` 增加 `TunImplementation.GO = 3`。
+   - `DataStore.kt` 默认 `tunImplementation → GO`。
+   - `ConfigBuilder` 将 `GO` 映射为 `stack = "go"`。
+   - `arrays.xml` 增加 `tun_implementation_go` 文案与 `int_array_4` 枚举。
+
+2. **TUN schema 迁移到 sing-box 1.15**
+   - `Inbound_TunOptions` 使用新的 `address` 字段替代已移除的 `inet4_address` / `inet6_address`。
+   - 移除 `endpoint_independent_nat` 等已废弃字段；保留等价的 `udp_mapping` / `udp_filtering` 默认行为。
+   - 镜像 sing-box 1.15 新增字段：`interface_name`、`dns_mode`、`dns_address`、`udp_mapping` 等。
+
+3. **DNS schema 迁移到 sing-box 1.15**
+   - sing-box 1.14 起移除 DNS 服务器旧 `address` 字段。
+   - `ConfigBuilder` 新增 `buildDnsServerOptions()`，将用户设置中的地址字符串转换为新的 typed DNS server 格式：
+     - `local` → `{"type":"local"}`
+     - `fakeip` → `{"type":"fakeip", "inet4_range":"...", "inet6_range":"..."}`
+     - `rcode://success` → `{"type":"rcode", "rcode":"success"}`
+     - `https://dns.google/dns-query` → `{"type":"https", "server":"dns.google", "path":"/dns-query", "tls":{...}}`
+     - `tls://...`、`tcp://...`、`udp://...` 等分别映射到对应类型。
+   - 移除已废弃的 `dns.fakeip` 配置节，FakeIP 范围现在直接写在 fakeip DNS server 上。
+
+4. **WireGuard 迁移到 endpoint**
+   - sing-box 1.15 不再将 WireGuard 注册为 outbound，仅作为 endpoint。
+   - `ConfigBuilder` 现在把 WireGuard 节点写入 `endpoints` 而非 `outbounds`。
+   - 弃用旧字段 `server` / `server_port` / `local_address` / `peer_public_key`，改用新的 `peers[]` 结构。
+   - `urlTestDetour()` 增加 endpoint 回退，确保 URL Test 仍然经过 WireGuard 节点。
+
+5. **恢复被升级破坏的平台功能**
+   - **URL Test**：改用上游 `common/urltest.URLTest`，请求通过目标 outbound 拨号，不再使用 `http.DefaultClient` 直连。
+   - **流量统计**：使用 `experimental/v2rayapi.StatsService` 替代已移除的 `boxapi`。
+   - **ResetAllConnections**：调用 `ConnectionManager.CloseAll()` 真正关闭连接，而非仅打印日志。
+
+6. **协议兼容性处理**
+   - **SSR**：sing-box 1.15 上游已彻底移除 `protocol/shadowsocksr`。当前分支保留 UI/数据库代码，
+     但使用 SSR 的节点在启动时会得到明确的 "unknown outbound type: shadowsocksr" 错误。
+     后续恢复方案：像 `protocol/juicity` 一样在 `libcore/` 内引入一个兼容 sing-box 1.15 的 SSR 实现。
+   - **Snell**：sing-box 1.15 出站仅支持版本 `4` / `6`；`quic_proxy_mode` 是 reF1nd fork 扩展，上游已不支持。
+     `SnellBuildConfig` 不再发出 `quic_proxy_mode`，避免 strict parsing 报错。
+   - **VMess / Juicity**：使用上游 `sing-vmess` v0.2.8 与项目内置 juicity 实现；编译与 schema 校验通过。
+
+7. **清理仓库污染**
+   - 删除并忽略 `scratch/`，避免开发 checkpoint / 真实配置 dump 进入仓库。
+   - 回退与本次升级无关的优化（BootReceiver、Room cache、Gson 单例、RouterGroupListFragment 等）到基线。
+
+## 构建方式
+
+```bash
+# 环境：JDK 17, Go 1.25.5, Android SDK (platform 36, build-tools 36.0.0), NDK 25.0.8775105
+./run lib core
+./gradlew app:assembleOssDebug
+```
+
+## 已知临时兼容项
+
+- `libcore/go.mod` 中显式 `require github.com/sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1`。
+  由于该 pseudo-version 字符串在 semver 预发布比较中排序低于旧版 `20250325...`，
+  不加显式固定时 MVS 会错误地选择旧版 gvisor，导致 `WritePacketDirect` 编译失败。
+- `libcore/` 中新增 `config_parse_test.go` 作为最低限度自动验证；
+  Windows 宿主上 WireGuard endpoint 相关 case 跳过（需要 `with_gvisor` 标签），在 Android 构建中会自动运行。
+
+## gVisor fallback
+
+保留 `with_gvisor` build tag；`libcore/build.sh` 仍然编译 gVisor 栈。
+用户可在设置中将 `TUN implementation` 从 `Go` 切换为 `gVisor` / `System` / `Mixed`。
diff --git a/docs/superpowers/handoffs/2026-09-04-antigravity-custom-proxy-groups.md b/docs/superpowers/handoffs/2026-09-04-antigravity-custom-proxy-groups.md
new file mode 100644
index 0000000000..1ea3e82945
--- /dev/null
+++ b/docs/superpowers/handoffs/2026-09-04-antigravity-custom-proxy-groups.md
@@ -0,0 +1,140 @@
+# Antigravity Handoff: NekoBox Custom Proxy Groups
+
+## Mission
+
+Continue and finish the user-approved custom proxy-group feature in this exact worktree:
+
+`C:\Users\renos\Documents\Proxy\NekoBoxForAndroid-router-groups`
+
+Do not restart the implementation and do not replace it with fixed US/SG/JP groups. Review and finish the existing uncommitted code.
+
+## User-approved behavior
+
+- Users can create any number of custom proxy groups with arbitrary display names.
+- Each group selects one or more existing subscription groups as sources.
+- Include regex filters node names; empty include means all source nodes.
+- Exclude regex runs after include and wins.
+- The same node may belong to multiple custom groups.
+- Modes in this phase are only `selector` and `url-test`.
+- Route rules explicitly select a custom group. Never infer a group from a rule name, domain, or app.
+- A stable internal `router.<uuid>` tag survives display-name changes and subscription refreshes.
+- Missing, disabled, or empty referenced groups must produce a visible group-specific error. Never silently fall back.
+- Failed/empty subscription refresh preserves the last valid members and records an error.
+- Deleting a group is blocked while route rules reference it.
+- Preserve all existing subscriptions, routes, App routing, AdBlock, `.invalid` load rules, DNS/TUN, profiles, and default behavior.
+- Do not implement fallback, load balancing, nested groups, Clash YAML import, or predefined groups.
+
+## Hard safety boundaries
+
+- Never delete anything outside this project directory.
+- Do not touch `C:\Users\renos\Documents\Proxy\A7.yaml`, `nekobox_isA8.json`, or similar isA8 files.
+- Preserve all current working-tree changes. Do not reset, clean checkout, or discard files.
+- Gradle `clean` inside this project is allowed and required for final ABI verification.
+- Do not commit or push until verification is complete. Do not rewrite existing commits.
+- Use minimal changes only; no unrelated cleanup or refactoring.
+
+## Read first
+
+1. `AGENTS.md` in the parent Proxy workspace and any repository-local instructions.
+2. `docs/superpowers/specs/2026-09-04-custom-proxy-groups-design.md`
+3. `docs/superpowers/plans/2026-09-04-custom-proxy-groups.md`
+4. This handoff, then `git status --short` and the complete diff from `f8e6418`.
+
+## Git state
+
+- Branch: `router-groups`
+- Existing commits:
+  - `f8e6418 docs: define custom proxy groups design`
+  - `bdc6392 docs: plan custom proxy groups implementation`
+- The implementation is intentionally still uncommitted and includes earlier Antigravity work plus follow-up corrections. Preserve it.
+
+## Toolchain
+
+- Project-local Android SDK is configured by `local.properties`:
+  `C:\Users\renos\Documents\Proxy\.router-groups-toolchain\android-sdk`
+- Portable JDK 17:
+  `C:\Users\renos\AppData\Local\CodexTools\jdk-17.0.20\jdk-17.0.20.1+1`
+- Before Gradle commands in PowerShell:
+  `$env:JAVA_HOME='C:\Users\renos\AppData\Local\CodexTools\jdk-17.0.20\jdk-17.0.20.1+1'`
+- Do not delete or relocate either external toolchain directory.
+- ADB path:
+  `C:\Users\renos\Documents\Proxy\.router-groups-toolchain\android-sdk\platform-tools\adb.exe`
+
+## Work already completed
+
+- Independent include/exclude matching with cross-group overlap.
+- Room v10 models for custom groups, materialized members, ordered subscription sources, stable selection, errors, and explicit `RuleEntity.routerGroupId`.
+- No predefined groups or semantic route assignment.
+- Repository validation, CRUD, preview, deletion guard, refresh reconciliation, stable node identity, and member-order preservation.
+- ConfigBuilder emits selector/url-test outbounds and explicit route references; missing/disabled/empty references throw.
+- Dedicated proxy-group list/editor and route-group picker.
+- Selector hot switching through the existing native selector API.
+- Backup version 3 stores groups, members, sources, and separate rule references (`routerRuleRefs`) while preserving the old RuleEntity parcel layout.
+- Subscription failure records an error on affected groups.
+- Old fixed inline group-card/manual-membership UI was removed.
+- AAR ABI gate requires `libcore.HTTPClient`, rejects legacy `libcore.HttpClient`, checks `newHttpClient`, all four JNI ABIs, and compiled app caller bytecode.
+
+## Checks already passed
+
+- `:app:compileOssDebugKotlin`
+- All `:app:testOssDebugUnitTest`
+- `:app:compileOssDebugAndroidTestKotlin`
+- `:app:verifyLibcore`
+- `:app:verifyOssDebugLibcoreCallers`
+- `git diff --check` (only Windows line-ending warnings)
+
+The latest combined JVM/Android-test compilation completed successfully. There was no connected Android device. `lintOssDebug` was started but intentionally interrupted when the user requested this handoff; do not treat lint as passed or failed.
+
+## Required remaining work
+
+1. Perform a focused code review against the approved spec and current plan. Fix only confirmed defects.
+2. Pay special attention to:
+   - backup v3 import transaction and old-backup behavior;
+   - explicit route target serialization and invalid references;
+   - editor preview/change listeners and validation messages;
+   - selector persistence of both `selectedProxyId` and `selectedNodeKey`;
+   - refresh failure/empty-success preservation semantics;
+   - no remaining exclusivity or fixed-name assumptions outside test fixture strings;
+   - Room schema 10 matching current entities;
+   - URL-test `url`, nanosecond `interval`, and `tolerance` fields supported by the pinned binding.
+3. Rerun full JVM tests and Android-test compilation.
+4. Run lint to completion and classify findings. Do not broadly clean pre-existing warnings.
+5. Run a clean debug build so stale native callers cannot survive:
+   `./gradlew.bat :app:clean :app:assembleOssDebug --console=plain --no-build-cache`
+6. Inspect the produced APK:
+   - all expected `libgojni.so` ABI entries exist;
+   - no stale `Llibcore/HttpClient;` descriptor exists;
+   - current `Llibcore/HTTPClient;` descriptor exists.
+7. Record APK path, size, SHA-256, exact command results, schema version, ABI results, lint result, and unrun device tests in:
+   `docs/superpowers/verification/2026-09-04-custom-proxy-groups.md`
+8. Audit scope from `f8e6418`; verify no changes to protected config files and no unintended DNS/TUN/subscription/AdBlock/`.invalid` behavior.
+9. If exactly one authorized Android device is connected, install the clean APK without clearing app data and run the device checklist below. Otherwise stop with the APK ready and clearly mark device acceptance unverified.
+10. Only after all available checks pass, commit coherent implementation and verification changes. Do not push unless the user explicitly asks.
+
+## Device acceptance checklist
+
+1. Upgrade install without clearing data; confirm old database opens.
+2. Refresh subscription 1 and subscription 2; confirm the prior `HttpClient/HTTPClient` crashes do not recur.
+3. Create `US1` from both subscriptions with a US include regex.
+4. Create a second group containing at least one of the same nodes; confirm overlap works.
+5. In selector mode, switch one group and confirm the other group is unchanged.
+6. In URL-test mode, confirm only that group's members are tested/selected.
+7. Edit one route rule and explicitly select `US1`; start the service and verify the route resolves.
+8. Refresh both subscriptions; confirm group definitions, route references, and valid members survive.
+9. Confirm AdBlock, `.invalid` load rules, existing App routing, DNS/TUN, subscriptions, and ordinary profiles still function.
+10. Capture exact logs for any failure; do not claim success from APK build alone.
+
+## Current device state
+
+The project SDK's `adb devices -l` returned no attached devices at handoff time. Do not invent device results.
+
+## Completion report format
+
+Lead with whether the feature is statically complete and whether real-device acceptance was actually performed. List:
+
+- what changed;
+- exact passing/failing commands;
+- APK absolute path and SHA-256;
+- remaining risks or unverified device steps;
+- commit hashes created;
+- confirmation that protected files and unrelated behavior were not changed.
diff --git a/docs/superpowers/plans/2026-09-04-custom-proxy-groups.md b/docs/superpowers/plans/2026-09-04-custom-proxy-groups.md
new file mode 100644
index 0000000000..40601411ad
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-04-custom-proxy-groups.md
@@ -0,0 +1,763 @@
+# NekoBox Custom Proxy Groups Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build user-defined, overlapping proxy groups sourced from one or more subscriptions, filtered by include/exclude regex, emitted as sing-box `selector` or `urltest` outbounds, and explicitly selectable by route rules without changing unrelated NekoBox behavior.
+
+**Architecture:** Keep the existing internal Router layer but remove the incorrect fixed-group, exclusive-membership, and semantic-route assumptions. Persist group definitions, subscription-source relations, materialized members, stable selector identity, and explicit `RuleEntity` references in Room; resolve them through a focused repository before `ConfigBuilder` emits stable sing-box tags. Add a dedicated list/editor UI and route-group picker while preserving every legacy outbound path.
+
+**Tech Stack:** Kotlin, AndroidX Room 2.6.1, AndroidX Preference/RecyclerView, Kotlin coroutines, JUnit 4, Android instrumentation tests, sing-box Java bindings, gomobile/libcore AAR, Gradle Kotlin DSL.
+
+**Spec:** `docs/superpowers/specs/2026-09-04-custom-proxy-groups-design.md`
+
+## Global Constraints
+
+- User-created groups only; never create predefined `US`, `US low`, `SG`, or `JP` groups.
+- A node may belong to any number of custom groups; deduplication is local to one group.
+- Sources are existing subscription `ProxyGroup` rows only, and each custom group may select multiple sources.
+- Empty include regex means all source nodes; exclude regex is evaluated second and wins.
+- Invalid regex blocks saving and identifies the invalid field.
+- Modes are exactly `selector` and `url-test`; no fallback, load-balance, nesting, region, protocol, multiplier, or Clash YAML import.
+- Routes reference a custom-group database ID explicitly; no rule-name/domain semantic inference is allowed.
+- `RuleEntity.outbound` keeps its existing `0`, `-1`, `-2`, and positive-profile semantics when `routerGroupId == 0`.
+- Stable group tags are generated once as `router.<lowercase UUID without dashes>` and never change on rename.
+- An enabled referenced group with no current members, or a missing referenced group, must stop configuration generation with a group-specific error; never silently fall back.
+- Failed/empty subscription refresh retains the last valid materialized members; successful refresh recomputes them.
+- Preserve subscription behavior, ordinary profiles, App routing, AdBlock, `.invalid` load rules, DNS/TUN, settings, and existing routes unless the user explicitly edits a group reference.
+- Preserve and work around all pre-existing worktree changes. Do not touch `A7.yaml`, `nekobox_isA8.json`, or files outside this repository.
+- Do not commit or ship an APK before JVM tests, migration/backup tests, clean-build ABI verification, lint assessment, and debug assembly succeed.
+- The pinned Java binding exposes URL-test `url`, `interval`, and `tolerance`, but no outbound request-timeout field. Store no fictitious JSON field; keep the existing core probe timeout for an explicit manual test action and treat this as the implementation limit of the pinned core.
+
+---
+
+## File Map
+
+- `route/RouterFilter.kt`: validated include/exclude configuration and JSON codec.
+- `route/RouterMatcher.kt`: pure, independently evaluated membership matching.
+- `database/RouterGroup.kt`: group record, stable tag, mode, selected stable key, latest error.
+- `database/RouterGroupSource.kt`: many-to-many group-to-subscription relation and DAO.
+- `database/RouterMember.kt`: materialized many-to-many group membership.
+- `database/RouterGroupRepository.kt`: validation, CRUD, preview, recomputation, deletion guard, and runtime resolution.
+- `database/GroupManager.kt`: subscription lifecycle hooks only; delegates group logic to the repository.
+- `route/RouterReconciler.kt`: stable-identity remap scoped by source and last-valid snapshot behavior.
+- `route/RouterRuntime.kt`: strict runtime outbound descriptions and empty/missing error values.
+- `fmt/ConfigBuilder.kt`: build node outbounds once, emit custom groups, resolve explicit route references.
+- `ui/RouterGroupListActivity.kt` and `ui/RouterGroupListFragment.kt`: dedicated custom-group list and runtime actions.
+- `ui/RouterGroupSettingsActivity.kt`: focused editor with validation and live preview.
+- `ui/RouterGroupSelectActivity.kt`: enabled/non-empty group picker for route editing.
+- `ui/GroupFragment.kt`: one entry point to the dedicated group list; no fixed cards.
+- `ui/RouteSettingsActivity.kt` and `widget/OutboundPreference.kt`: explicit group selection while preserving legacy choices.
+- `ui/BackupFragment.kt` and `fmt/BackupSerializer.kt`: versioned group/source/member/reference round trip.
+- `build.gradle.kts`: Room test setup and libcore ABI/package gate.
+
+### Task 1: Replace Fixed and Exclusive Matching with the Confirmed Filter Contract
+
+**Files:**
+- Create: `app/src/main/java/io/nekohasekai/sagernet/route/RouterFilter.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/route/RouterMatcher.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/route/RouterMembership.kt`
+- Delete: `app/src/main/java/io/nekohasekai/sagernet/route/RouterDefaults.kt`
+- Test: `app/src/test/java/io/nekohasekai/sagernet/route/RouterMatcherTest.kt`
+- Test: `app/src/test/java/io/nekohasekai/sagernet/route/RouterMembershipTest.kt`
+- Delete: `app/src/test/java/io/nekohasekai/sagernet/route/RouterDefaultsTest.kt`
+
+**Interfaces:**
+- Produces: `RouterFilterConfig(includeRegex: String, excludeRegex: String, testUrl: String, intervalSeconds: Long, toleranceMs: Int)`.
+- Produces: `RouterFilterValidation(include: Regex?, exclude: Regex?)` and `RouterFilterException(field: Field, cause: Throwable)`.
+- Produces: `RouterMatcher.match(nodes: Iterable<RouterNodeSnapshot>, requests: Iterable<RouterMatchRequest>): Map<Long, List<Long>>`.
+- Produces: `RouterMatchRequest(routerId: Long, sourceGroupIds: Set<Long>, filter: RouterFilterValidation)`.
+
+- [ ] **Step 1: Replace the matcher tests with the approved behavior**
+
+```kotlin
+@Test fun sameNodeMayAppearInTwoGroups() {
+    val node = RouterNodeSnapshot(7, "source:10/node:a", "US A", subscriptionId = 10)
+    val requests = listOf(
+        RouterMatchRequest(1, setOf(10), RouterFilterConfig("US", "").validate()),
+        RouterMatchRequest(2, setOf(10), RouterFilterConfig("A", "").validate()),
+    )
+    assertEquals(mapOf(1L to listOf(7L), 2L to listOf(7L)), RouterMatcher.match(listOf(node), requests))
+}
+
+@Test fun excludeWinsAndEmptyIncludeMeansAll() {
+    val nodes = listOf(
+        RouterNodeSnapshot(1, "10/a", "US Premium", subscriptionId = 10),
+        RouterNodeSnapshot(2, "10/b", "US Expired", subscriptionId = 10),
+    )
+    val request = RouterMatchRequest(3, setOf(10), RouterFilterConfig("", "Expired").validate())
+    assertEquals(listOf(1L), RouterMatcher.match(nodes, listOf(request)).getValue(3))
+}
+
+@Test fun invalidIncludeAndExcludeIdentifyTheirFields() {
+    assertEquals(RouterFilterException.Field.INCLUDE, assertThrows<RouterFilterException> {
+        RouterFilterConfig("[", "").validate()
+    }.field)
+    assertEquals(RouterFilterException.Field.EXCLUDE, assertThrows<RouterFilterException> {
+        RouterFilterConfig("", "[").validate()
+    }.field)
+}
+```
+
+- [ ] **Step 2: Run the focused tests and confirm the old API fails**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.RouterMatcherTest" --tests "io.nekohasekai.sagernet.route.RouterMembershipTest"`
+
+Expected: FAIL because `RouterMatchRequest`, validation, and overlapping membership do not exist and the old test expects reserved-node exclusion.
+
+- [ ] **Step 3: Implement the minimal filter and independent matcher**
+
+```kotlin
+data class RouterFilterConfig(
+    val includeRegex: String = "",
+    val excludeRegex: String = "",
+    val testUrl: String = "https://www.gstatic.com/generate_204",
+    val intervalSeconds: Long = 300,
+    val toleranceMs: Int = 50,
+) {
+    fun validate() = RouterFilterValidation(
+        include = includeRegex.takeIf(String::isNotBlank)?.compile(RouterFilterException.Field.INCLUDE),
+        exclude = excludeRegex.takeIf(String::isNotBlank)?.compile(RouterFilterException.Field.EXCLUDE),
+    )
+}
+
+data class RouterMatchRequest(
+    val routerId: Long,
+    val sourceGroupIds: Set<Long>,
+    val filter: RouterFilterValidation,
+)
+
+fun match(nodes: Iterable<RouterNodeSnapshot>, requests: Iterable<RouterMatchRequest>) =
+    requests.associate { request ->
+        request.routerId to nodes.asSequence()
+            .filter { it.enabled && it.available && it.subscriptionId in request.sourceGroupIds }
+            .filter { request.filter.include?.containsMatchIn(it.name) != false }
+            .filterNot { request.filter.exclude?.containsMatchIn(it.name) == true }
+            .distinctBy { it.id }
+            .map { it.id }
+            .toList()
+    }
+```
+
+Remove `RouterRegion`, stable-ID/manual lists, multiplier fields, global assigned-ID sets, and `reservedProxyIds`. Preserve input order instead of sorting IDs.
+
+- [ ] **Step 4: Run focused tests**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.RouterMatcherTest" --tests "io.nekohasekai.sagernet.route.RouterMembershipTest"`
+
+Expected: PASS; the same proxy ID appears in both results.
+
+- [ ] **Step 5: Commit the matching contract**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/route app/src/test/java/io/nekohasekai/sagernet/route
+git commit -m "feat: support overlapping custom group filters"
+```
+
+### Task 2: Add Source Relations, Stable Selection, Errors, and Explicit Route References
+
+**Files:**
+- Create: `app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupSource.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/RouterGroup.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/SagerDatabase.kt`
+- Create: `app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json`
+- Modify: `app/src/androidTest/java/io/nekohasekai/sagernet/database/RouterMigrationTest.kt`
+
+**Interfaces:**
+- Produces: `RouterGroupSource(routerId: Long, sourceGroupId: Long)` with composite primary key.
+- Produces: `RouterGroup.selectedNodeKey: String` and `RouterGroup.lastError: String`.
+- Produces: `RuleEntity.routerGroupId: Long`, where `0L` means use legacy `outbound`.
+- Produces: `RouterGroupSource.Dao.sourcesFor(routerId)`, `routersForSource(sourceGroupId)`, `replaceSources(routerId, sourceIds)`, and cleanup methods.
+
+- [ ] **Step 1: Write migration and DAO tests**
+
+```kotlin
+@Test fun migratesNineToTenWithoutCreatingDefaultGroupsOrChangingLegacyRoutes() {
+    migrationHelper.createDatabase(TEST_DB, 9).apply {
+        execSQL("INSERT INTO rules (id,name,userOrder,enabled,domains,ip,port,sourcePort,network,source,protocol,outbound,packages,config,ruleset) VALUES (1,'legacy',0,1,'','','','','','','',-1,'','','')")
+        close()
+    }
+    migrationHelper.runMigrationsAndValidate(TEST_DB, 10, true, SagerDatabase_AutoMigration_9_10_Impl()).use { db ->
+        assertEquals(0L, db.singleLong("SELECT routerGroupId FROM rules WHERE id=1"))
+        assertEquals(-1L, db.singleLong("SELECT outbound FROM rules WHERE id=1"))
+        assertEquals(0L, db.singleLong("SELECT COUNT(*) FROM router_groups"))
+        assertEquals(0L, db.singleLong("SELECT COUNT(*) FROM router_group_sources"))
+    }
+}
+
+@Test fun oneSubscriptionAndOneNodeCanBelongToMultipleRouters() {
+    val a = database.routerGroupDao().create(RouterGroup(stableTag = "router.a", name = "A"))
+    val b = database.routerGroupDao().create(RouterGroup(stableTag = "router.b", name = "B"))
+    database.routerGroupSourceDao().insert(listOf(RouterGroupSource(a, 10), RouterGroupSource(b, 10)))
+    database.routerMemberDao().insert(listOf(RouterMember(a, 20), RouterMember(b, 20)))
+    assertEquals(listOf(a, b), database.routerGroupSourceDao().routersForSource(10).map { it.routerId })
+}
+```
+
+- [ ] **Step 2: Run instrumentation compilation/test and verify failure**
+
+Run: `.\gradlew.bat :app:compileOssDebugAndroidTestKotlin`
+
+Expected: FAIL because schema version 10, `RouterGroupSource`, and `routerGroupId` do not exist.
+
+- [ ] **Step 3: Implement schema version 10**
+
+```kotlin
+@Entity(tableName = "router_group_sources", primaryKeys = ["routerId", "sourceGroupId"], indices = [Index("sourceGroupId")])
+data class RouterGroupSource(var routerId: Long = 0, var sourceGroupId: Long = 0) : Serializable()
+```
+
+Add `selectedNodeKey` and `lastError` to `RouterGroup`, bump its buffer payload version from 0 to 1, and read the extra values only when `version >= 1`. Add this at the end of `RuleEntity` so Room gives old rows zero:
+
+```kotlin
+@IgnoredOnParcel
+@ColumnInfo(defaultValue = "0")
+var routerGroupId: Long = 0L,
+```
+
+`@IgnoredOnParcel` intentionally preserves the legacy `RuleEntity` Parcel layout; Task 8 exports route references separately.
+
+- [ ] **Step 4: Register the entity/DAO and generate the schema**
+
+Change `SagerDatabase` to version 10, add `AutoMigration(from = 9, to = 10)`, add `RouterGroupSource::class`, and expose `routerGroupSourceDao`. Run:
+
+`.\gradlew.bat :app:kspOssDebugKotlin`
+
+Expected: `app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json` exists and contains `router_group_sources`, `selectedNodeKey`, `lastError`, and `routerGroupId`.
+
+- [ ] **Step 5: Run database tests**
+
+Run: `.\gradlew.bat :app:compileOssDebugAndroidTestKotlin`
+
+If an emulator/device is connected, also run: `.\gradlew.bat :app:connectedOssDebugAndroidTest`
+
+Expected: compilation PASS; connected migration tests PASS when a device is present.
+
+- [ ] **Step 6: Commit the persistent model**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/database app/src/androidTest/java/io/nekohasekai/sagernet/database app/schemas
+git commit -m "feat: persist custom group sources and route references"
+```
+
+### Task 3: Centralize CRUD, Preview, Reconciliation, and Deletion Safety
+
+**Files:**
+- Create: `app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupRepository.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/GroupManager.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/group/GroupUpdater.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/group/RawUpdater.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/route/RouterReconciler.kt`
+- Test: `app/src/test/java/io/nekohasekai/sagernet/route/RouterReconcilerTest.kt`
+- Create: `app/src/androidTest/java/io/nekohasekai/sagernet/database/RouterGroupRepositoryTest.kt`
+
+**Interfaces:**
+- Consumes: Task 1 filter/matcher and Task 2 DAOs.
+- Produces: `RouterGroupDraft`, `RouterGroupPreview`, `RouterDeleteResult`, and repository methods `preview`, `save`, `delete`, `reconcileAfterRefresh`, `reconcileBeforeBuild`.
+- Produces: `RouterNodeKey.of(sourceGroupId: Long, stableId: String): String`.
+
+- [ ] **Step 1: Add repository behavior tests**
+
+```kotlin
+@Test fun enabledGroupRequiresSourceButDisabledDraftDoesNot() {
+    assertThrows<RouterGroupValidationException> {
+        repository.save(RouterGroupDraft(name = "A", mode = RouterGroup.MODE_SELECTOR, enabled = true, sourceGroupIds = emptySet(), filter = RouterFilterConfig()))
+    }
+    assertTrue(repository.save(RouterGroupDraft(name = "Draft", mode = RouterGroup.MODE_SELECTOR, enabled = false, sourceGroupIds = emptySet(), filter = RouterFilterConfig())).id > 0)
+}
+
+@Test fun stableTagDoesNotChangeWhenDisplayNameChanges() {
+    val created = repository.save(enabledDraft("A", setOf(subscriptionId)))
+    val updated = repository.save(enabledDraft("Renamed", setOf(subscriptionId)).copy(id = created.id))
+    assertEquals(created.stableTag, updated.stableTag)
+}
+
+@Test fun deleteIsBlockedWhenRulesReferenceTheGroup() {
+    val group = repository.save(enabledDraft("A", setOf(subscriptionId)))
+    database.rulesDao().createRule(RuleEntity(name = "r", routerGroupId = group.id))
+    assertEquals(RouterDeleteResult.Referenced(1), repository.delete(group.id))
+    assertNotNull(database.routerGroupDao().getById(group.id))
+}
+
+@Test fun failedRefreshPreservesMembersAndSuccessfulRefreshRemapsSelection() {
+    val group = repository.save(enabledDraft("A", setOf(subscriptionId)))
+    repository.reconcileAfterRefresh(subscriptionId, refreshSucceeded = false, previous = repository.snapshot())
+    assertTrue(database.routerMemberDao().getByRouter(group.id).isNotEmpty())
+    assertTrue(database.routerGroupDao().getById(group.id)!!.lastError.isNotBlank())
+    repository.reconcileAfterRefresh(subscriptionId, refreshSucceeded = true, previous = repository.snapshot())
+    assertTrue(database.routerGroupDao().getById(group.id)!!.lastError.isBlank())
+}
+```
+
+The test class `@Before` creates an in-memory `SagerDatabase`, one subscription group, ordered proxy rows, and `RouterGroupRepository(database)`; `enabledDraft` returns a draft with include `""` and exclude `""`. Add a separate assertion that saving `A` and then `a` throws `RouterGroupValidationException(Field.NAME)`, and a two-source deletion case asserting only the deleted source relation disappears.
+
+- [ ] **Step 2: Run tests and verify failure**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.RouterReconcilerTest" :app:compileOssDebugAndroidTestKotlin`
+
+Expected: FAIL because repository contracts and source-scoped selection are absent.
+
+- [ ] **Step 3: Implement source-scoped stable identities and repository validation**
+
+```kotlin
+data class RouterGroupDraft(
+    val id: Long = 0,
+    val name: String,
+    val mode: Int,
+    val enabled: Boolean,
+    val sourceGroupIds: Set<Long>,
+    val filter: RouterFilterConfig,
+)
+
+sealed interface RouterDeleteResult {
+    data object Deleted : RouterDeleteResult
+    data class Referenced(val ruleCount: Int) : RouterDeleteResult
+}
+```
+
+Generate new tags with `"router." + UUID.randomUUID().toString().replace("-", "").lowercase()`; never regenerate on update. Check sources against `groupDao.subscriptions()`. Validate name, uniqueness, mode, sources, regex, interval `>= 10`, and tolerance `0..65535` before opening the transaction.
+
+- [ ] **Step 4: Implement deterministic preview and materialization**
+
+Load source groups in the editor-selected order and nodes in each source's `userOrder, id` order. On successful recomputation, replace only that router's rows, preserve existing `userOrder` for surviving source-scoped stable keys, append new rows, remap `selectedProxyId`, update `selectedNodeKey`, and clear `lastError`. On failed or truly empty refresh, retain prior members and write the error; on a valid non-empty source snapshot whose regex matches zero, materialize empty and write `No nodes match <name>`.
+
+- [ ] **Step 5: Replace lifecycle logic with repository calls**
+
+Remove `ensureDefaultRouterGroups`, region inference, multiplier parsing, and reserved-node collection from `GroupManager`. Keep snapshot-before-update and call `reconcileAfterRefresh(sourceGroupId, refreshSucceeded, previous)` after `GroupUpdater` and `RawUpdater`; source delete calls `removeSourceAndReconcile(sourceGroupId)`.
+
+- [ ] **Step 6: Run repository and reconciler tests**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.*" :app:compileOssDebugAndroidTestKotlin`
+
+Expected: PASS.
+
+- [ ] **Step 7: Commit repository behavior**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/database app/src/main/java/io/nekohasekai/sagernet/group app/src/main/java/io/nekohasekai/sagernet/route app/src/test app/src/androidTest
+git commit -m "feat: reconcile custom groups from subscriptions"
+```
+
+### Task 4: Emit Strict Selector/URL-Test Outbounds and Resolve Explicit Routes
+
+**Files:**
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/route/RouterRuntime.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt`
+- Modify: `app/src/test/java/io/nekohasekai/sagernet/route/RouterRuntimeTest.kt`
+- Modify: `app/src/test/java/io/nekohasekai/sagernet/fmt/RouterOutboundConfigTest.kt`
+- Replace: `app/src/test/java/io/nekohasekai/sagernet/fmt/RouterRouteSemanticTest.kt`
+
+**Interfaces:**
+- Consumes: `RuleEntity.routerGroupId`, repository runtime snapshot, Task 1 URL-test settings.
+- Produces: `resolveRouteOutbound(rule, mainProxyTag, proxyTags, routerTagsById): String`.
+- Produces: `RouterRuntimeException(groupId: Long, groupName: String, reason: Reason)`.
+
+- [ ] **Step 1: Add config and route regression tests**
+
+```kotlin
+@Test fun routeUsesOnlyExplicitCustomGroupReference() {
+    val legacy = RuleEntity(name = "Google", outbound = -1, routerGroupId = 0)
+    assertEquals(TAG_BYPASS, resolveRouteOutbound(legacy, "proxy", emptyMap(), mapOf(5L to "router.x")))
+    assertEquals("router.x", resolveRouteOutbound(legacy.copy(routerGroupId = 5), "proxy", emptyMap(), mapOf(5L to "router.x")))
+}
+
+@Test fun sharedNodeTagCanBeReferencedByMultipleRouterOutbounds() {
+    val built = buildRouterOutbounds(
+        listOf(
+            RouterRuntimeGroup(1, "A", "router.a", RouterRuntimeMode.SELECTOR, listOf(9), 9, RouterFilterConfig()),
+            RouterRuntimeGroup(2, "B", "router.b", RouterRuntimeMode.URL_TEST, listOf(9), -1, RouterFilterConfig()),
+        ),
+        proxyTags = mapOf(9L to "node-9"),
+    )
+    assertEquals(listOf("node-9"), built[0].asMap()["outbounds"])
+    assertEquals(listOf("node-9"), built[1].asMap()["outbounds"])
+}
+
+@Test fun referencedMissingGroupThrowsInsteadOfFallingBack() {
+    val error = assertThrows<RouterRuntimeException> {
+        resolveRouteOutbound(RuleEntity(routerGroupId = 88), "proxy", emptyMap(), emptyMap())
+    }
+    assertEquals(88L, error.groupId)
+    assertEquals(RouterRuntimeException.Reason.MISSING, error.reason)
+}
+
+@Test fun unreferencedEmptyGroupIsOmitted() {
+    assertTrue(buildRouterOutbounds(listOf(emptyRuntimeGroup), emptyMap()).isEmpty())
+}
+```
+
+For URL-test, assert the generated map contains the configured URL, `300_000_000_000L` interval, and `50` tolerance. Define `emptyRuntimeGroup` in the test as an enabled group with no member IDs.
+
+- [ ] **Step 2: Run focused tests and verify failure**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.fmt.*Router*" --tests "io.nekohasekai.sagernet.route.RouterRuntimeTest"`
+
+Expected: FAIL because semantic matching remains and URL-test settings/group-ID resolution are missing.
+
+- [ ] **Step 3: Remove semantic mapping and default creation**
+
+Delete `ROUTER_US_TAG`, `ROUTER_US_LOW_TAG`, `ROUTER_SG_TAG`, `ROUTER_JP_TAG`, `routerSemanticTag()`, and the call to `ensureDefaultRouterGroups()`. Replace route resolution with:
+
+```kotlin
+internal fun resolveRouteOutbound(
+    rule: RuleEntity,
+    mainProxyTag: String,
+    proxyTags: Map<Long, String>,
+    routerTagsById: Map<Long, String>,
+    primaryProxyId: Long = Long.MIN_VALUE,
+): String {
+    if (rule.routerGroupId > 0) return routerTagsById[rule.routerGroupId]
+        ?: throw RouterRuntimeException(rule.routerGroupId, "", RouterRuntimeException.Reason.MISSING)
+    return when (val id = rule.outbound) {
+        0L -> mainProxyTag
+        -1L -> TAG_BYPASS
+        -2L -> TAG_BLOCK
+        else -> if (id == primaryProxyId) mainProxyTag else proxyTags[id].orEmpty()
+    }
+}
+```
+
+- [ ] **Step 4: Make runtime group generation strict only for referenced groups**
+
+Build all nodes once into `tagMap`; references from multiple groups reuse those tags. Emit non-empty enabled groups. Before adding route rules, calculate referenced IDs and throw a named error if any reference is absent, disabled, or has no resolved member. Populate `Outbound_URLTestOptions.url`, `.interval` (nanoseconds expected by the generated binding), and `.tolerance`; do not emit an unsupported timeout key.
+
+- [ ] **Step 5: Run focused and full JVM tests**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest`
+
+Expected: PASS, including proof that a rule merely named Google keeps its original outbound.
+
+- [ ] **Step 6: Commit configuration behavior**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/fmt app/src/main/java/io/nekohasekai/sagernet/route app/src/test
+git commit -m "feat: route explicitly through custom proxy groups"
+```
+
+### Task 5: Preserve Targeted Selector Switching and Visible Runtime Errors
+
+**Files:**
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/bg/BaseService.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/route/RouterSelection.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/RouterGroupRepository.kt`
+- Modify: `app/src/main/java/moe/matsuri/nb4a/NativeInterface.kt`
+- Modify: `libcore/box.go`
+- Test: `app/src/test/java/io/nekohasekai/sagernet/route/RouterSelectionTest.kt`
+
+**Interfaces:**
+- Produces: `RouterGroupRepository.select(routerId: Long, proxyId: Long): RouterSelectionPlan`.
+- Uses native `SelectOutboundFor(selectorTag: String, outboundTag: String): Boolean` only for selector groups.
+
+- [ ] **Step 1: Update selection tests for arbitrary stable tags and overlap**
+
+Add tests proving selection in group A does not mutate group B even when both contain the same node, non-members are rejected, selector uses targeted switch, and URL-test topology changes request reload.
+
+- [ ] **Step 2: Run selection tests and verify failure**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.RouterSelectionTest"`
+
+Expected: FAIL on independent persisted selection/error behavior.
+
+- [ ] **Step 3: Implement selection transaction and runtime action**
+
+Validate group enabled/mode/member, update only that row's `selectedProxyId` and `selectedNodeKey`, call `selectOutboundFor(group.stableTag, proxyTag)` for active selector topology, and reload only when targeted switching is unavailable. Surface native false/exception through the existing service/UI error channel and never change another group.
+
+- [ ] **Step 4: Keep the native API change minimal**
+
+Retain the existing Go `SelectOutboundFor` method and Kotlin wrapper. Do not add new HTTP client APIs. Ensure all Java/Kotlin code imports `libcore.HTTPClient`, never the stale placeholder `libcore.HttpClient`.
+
+- [ ] **Step 5: Run tests**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.route.RouterSelectionTest"`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit runtime selection**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/bg app/src/main/java/io/nekohasekai/sagernet/route app/src/main/java/moe/matsuri/nb4a libcore
+git commit -m "feat: switch custom selector groups independently"
+```
+
+### Task 6: Add the Dedicated Custom Group List and Editor
+
+**Files:**
+- Create: `app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListActivity.kt`
+- Create: `app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupListFragment.kt`
+- Create: `app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSettingsActivity.kt`
+- Create: `app/src/main/res/layout/layout_router_group_list.xml`
+- Create: `app/src/main/res/layout/layout_router_group_row.xml`
+- Create: `app/src/main/res/xml/router_group_preferences.xml`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/ui/GroupFragment.kt`
+- Modify: `app/src/main/res/layout/layout_group.xml`
+- Modify: `app/src/main/AndroidManifest.xml`
+- Modify: `app/src/main/res/values/strings.xml`
+- Modify: `app/src/main/res/values-zh-rCN/strings.xml`
+- Create: `app/src/androidTest/java/io/nekohasekai/sagernet/ui/RouterGroupSettingsActivityTest.kt`
+
+**Interfaces:**
+- Consumes: repository `all`, `preview`, `save`, `delete`, `select`.
+- Produces: `EXTRA_ROUTER_ID = "router_id"`; zero means create.
+
+- [ ] **Step 1: Write editor validation tests**
+
+Test that create starts blank, enabled save requires sources, disabled draft may have no source, invalid include/exclude shows the correct preference error, URL-test fields are visible only in URL-test mode, preview lists exact names/count, rename retains ID/tag, and delete displays reference count rather than deleting.
+
+- [ ] **Step 2: Compile Android tests and confirm missing UI**
+
+Run: `.\gradlew.bat :app:compileOssDebugAndroidTestKotlin`
+
+Expected: FAIL because the activities/resources do not exist.
+
+- [ ] **Step 3: Replace fixed cards with a single navigation entry**
+
+Remove `layout_router_item.xml`, fixed router card adapter/state, `ensureDefaultRouterGroups()`, and manual member dialog from `GroupFragment`. Keep the normal subscription RecyclerView unchanged. Add one “代理组” row/button that opens `RouterGroupListActivity`.
+
+- [ ] **Step 4: Implement the list screen**
+
+Show user order, name, selector/url-test mode, enabled/unavailable state, materialized member count, selected/current node, and `lastError`. Add create, edit, drag/reorder using the project's existing RecyclerView patterns. Selector row tap opens member selection; URL-test row exposes the existing test action when the service supports it.
+
+- [ ] **Step 5: Implement the editor**
+
+Use existing Preference widgets where possible. Source selection is a multi-choice dialog containing only `groupDao.subscriptions()`, stored as ordered IDs. On every name/mode/source/regex change, debounce a repository `preview` call and render `N nodes: name1, name2…`. Save calls repository validation; error text stays on the responsible field. Do not expose fallback/load-balance/nesting options.
+
+- [ ] **Step 6: Compile resources and tests**
+
+Run: `.\gradlew.bat :app:processOssDebugResources :app:compileOssDebugKotlin :app:compileOssDebugAndroidTestKotlin`
+
+Expected: PASS.
+
+- [ ] **Step 7: Commit group UI**
+
+```powershell
+git add app/src/main/AndroidManifest.xml app/src/main/java/io/nekohasekai/sagernet/ui app/src/main/res app/src/androidTest/java/io/nekohasekai/sagernet/ui
+git commit -m "feat: add custom proxy group editor"
+```
+
+### Task 7: Add Explicit Proxy Group Selection to Route Editing
+
+**Files:**
+- Create: `app/src/main/java/io/nekohasekai/sagernet/ui/RouterGroupSelectActivity.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/ui/RouteSettingsActivity.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/widget/OutboundPreference.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/Constants.kt`
+- Modify: `app/src/main/res/values/arrays.xml`
+- Modify: `app/src/main/res/values/strings.xml`
+- Modify: `app/src/main/res/values-zh-rCN/strings.xml`
+- Modify: `app/src/main/AndroidManifest.xml`
+- Modify: `app/src/test/java/io/nekohasekai/sagernet/fmt/RouterRouteSemanticTest.kt`
+
+**Interfaces:**
+- Produces: `OutboundPreference.VALUE_SELECT_ROUTER = "4"`.
+- Produces: `DataStore.routeOutboundRouter: Long` backed by `Key.ROUTE_OUTBOUND + "Router"`.
+- Produces: `RouterGroupSelectActivity.EXTRA_ROUTER_ID`.
+
+- [ ] **Step 1: Add route serialization/model tests**
+
+```kotlin
+@Test fun selectingRouterAndLegacyTargetsAreMutuallyExclusive() {
+    val router = serializeRouteChoice(value = "4", legacyProfileId = 99, routerGroupId = 7)
+    assertEquals(0L, router.outbound)
+    assertEquals(7L, router.routerGroupId)
+    val direct = serializeRouteChoice(value = "1", legacyProfileId = 99, routerGroupId = 7)
+    assertEquals(-1L, direct.outbound)
+    assertEquals(0L, direct.routerGroupId)
+}
+
+@Test fun missingRouterSummaryIsInvalidInsteadOfProxy() {
+    val rule = RuleEntity(outbound = 0, routerGroupId = 404)
+    assertEquals(app.getString(R.string.router_reference_invalid), rule.displayOutbound())
+}
+```
+
+Extract the pure `serializeRouteChoice(value, legacyProfileId, routerGroupId): RouteOutboundChoice` helper into `RouteOutboundChoice.kt` so this JVM test does not instantiate an Activity.
+
+- [ ] **Step 2: Run route tests and verify failure**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.fmt.RouterRouteSemanticTest"`
+
+Expected: FAIL because the route editor cannot store a group ID.
+
+- [ ] **Step 3: Add the fifth outbound choice and picker**
+
+Append `@string/route_proxy_group` / value `4` to the arrays. The picker queries enabled groups whose materialized membership is non-empty, returns an ID, and visually marks the current ID. Do not include disabled or unavailable groups.
+
+- [ ] **Step 4: Serialize mutually exclusive route targets**
+
+On init, choose value 4 when `routerGroupId > 0`. On selecting a group set `routeOutboundRouter`; on serialize set `routerGroupId` only for value 4 and set `outbound = 0L`. For values 0–3 set `routerGroupId = 0L` and retain the current legacy logic. Update `RuleEntity.displayOutbound()` and `OutboundPreference.getSummary()` to resolve the current group name or display an invalid-reference message.
+
+- [ ] **Step 5: Run route and config tests**
+
+Run: `.\gradlew.bat :app:testOssDebugUnitTest --tests "io.nekohasekai.sagernet.fmt.*Router*"`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit route UI**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/ui app/src/main/java/io/nekohasekai/sagernet/widget app/src/main/java/io/nekohasekai/sagernet/database app/src/main/java/io/nekohasekai/sagernet/Constants.kt app/src/main/res app/src/main/AndroidManifest.xml app/src/test
+git commit -m "feat: select custom groups in route rules"
+```
+
+### Task 8: Make Backup Import/Export Round-Trip the New Relations Safely
+
+**Files:**
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/fmt/BackupSerializer.kt`
+- Modify: `app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt`
+- Modify: `app/src/androidTest/java/io/nekohasekai/sagernet/ui/BackupSerializationTest.kt`
+
+**Interfaces:**
+- Produces backup version 3 keys: `routerGroups`, `routerSources`, `routerMembers`, `routerRuleRefs`.
+- `routerRuleRefs` is a JSON array of `{ "ruleId": Long, "routerGroupId": Long }`, avoiding any change to the legacy `RuleEntity` Parcel payload.
+
+- [ ] **Step 1: Add round-trip and old-backup tests**
+
+```kotlin
+@Test fun versionThreeRoundTripsRelationsAndVersionTwoDefaultsThem() {
+    val json = JSONObject().put("version", 3)
+    BackupSerializer.putParcelableArray(json, "routerSources", listOf(RouterGroupSource(1, 10), RouterGroupSource(2, 10)))
+    assertEquals(
+        listOf(RouterGroupSource(1, 10), RouterGroupSource(2, 10)),
+        BackupSerializer.getParcelableArray(json, "routerSources", RouterGroupSource.CREATOR),
+    )
+    val old = JSONObject().put("version", 2)
+    assertTrue(BackupSerializer.getParcelableArray(old, "routerSources", RouterGroupSource.CREATOR).isEmpty())
+}
+
+@Test fun routeReferencesUseASeparateBackwardCompatibleArray() {
+    val refs = listOf(RouterRuleRef(3, 1), RouterRuleRef(4, 404))
+    val json = BackupSerializer.putRouterRuleRefs(JSONObject(), refs)
+    assertEquals(refs, BackupSerializer.getRouterRuleRefs(json))
+}
+```
+
+The integration import test inserts referenced group `1` but not `404`, asserts both rule rows remain, and asserts rule `4` displays an invalid reference rather than being rewritten.
+
+- [ ] **Step 2: Run Android test compilation and verify failure**
+
+Run: `.\gradlew.bat :app:compileOssDebugAndroidTestKotlin`
+
+Expected: FAIL because version 3 fields are absent.
+
+- [ ] **Step 3: Implement version 3 export/import**
+
+Set `BACKUP_VERSION = 3`. Export all three Router tables and non-zero rule references. Import in one Room transaction in dependency order: clear members/sources/groups, insert groups, insert valid source/member rows, restore rule references without changing any rule's legacy outbound. Old backups produce empty custom-group relations and leave their decoded rules unchanged.
+
+- [ ] **Step 4: Run backup tests**
+
+Run: `.\gradlew.bat :app:compileOssDebugAndroidTestKotlin`
+
+If a device is connected: `.\gradlew.bat :app:connectedOssDebugAndroidTest --tests "io.nekohasekai.sagernet.ui.BackupSerializationTest"`
+
+Expected: compile PASS and device test PASS when available.
+
+- [ ] **Step 5: Commit backup compatibility**
+
+```powershell
+git add app/src/main/java/io/nekohasekai/sagernet/fmt/BackupSerializer.kt app/src/main/java/io/nekohasekai/sagernet/ui/BackupFragment.kt app/src/androidTest/java/io/nekohasekai/sagernet/ui/BackupSerializationTest.kt
+git commit -m "feat: back up custom proxy group relations"
+```
+
+### Task 9: Turn the Native HTTPClient Mismatch into a Clean-Build Gate
+
+**Files:**
+- Modify: `app/build.gradle.kts`
+- Create: `app/src/test/java/moe/matsuri/nb4a/LibcoreAbiTest.kt`
+- Inspect only: `app/libs/libcore.aar`
+
+**Interfaces:**
+- Produces Gradle task `verifyLibcoreAbi` and makes `preBuild` depend on it.
+- Verifies `Libcore.newHttpClient:()Llibcore/HTTPClient;` consistently in AAR classes and compiled app references.
+
+- [ ] **Step 1: Add an ABI test against the real AAR**
+
+The test loads `libcore.Libcore` and asserts `newHttpClient().javaClass.name == "libcore.HTTPClient"`, plus checks `RawUpdater`/callers contain no `libcore.HttpClient` descriptor.
+
+- [ ] **Step 2: Run from a clean app build directory and reproduce the gate**
+
+Run: `.\gradlew.bat :app:clean :app:testOssDebugUnitTest --tests "moe.matsuri.nb4a.LibcoreAbiTest"`
+
+Expected before completing the gate: FAIL if a placeholder jar or stale descriptor is on the compile/runtime classpath; otherwise PASS and record that the original installed APK was stale incremental output.
+
+- [ ] **Step 3: Strengthen `verifyLibcore` into `verifyLibcoreAbi`**
+
+Keep the existing checks for `classes.jar` and four JNI `libgojni.so` entries. Add class inspection using Gradle/JDK tooling to require `libcore/HTTPClient.class`, reject `libcore/HttpClient.class`, and inspect the compiled caller descriptor after Kotlin compilation. Do not generate or copy a placeholder libcore jar.
+
+- [ ] **Step 4: Verify the packaged APK**
+
+Run: `.\gradlew.bat :app:clean :app:assembleOssDebug`
+
+Then inspect `app/build/outputs/apk/oss/debug/*.apk` and assert it contains all expected ABI libraries and exactly the `HTTPClient` class descriptor used by app bytecode.
+
+Expected: build PASS; no `Llibcore/HttpClient;` string in compiled DEX/classes; `Llibcore/HTTPClient;` present.
+
+- [ ] **Step 5: Commit the ABI gate**
+
+```powershell
+git add app/build.gradle.kts app/src/test/java/moe/matsuri/nb4a/LibcoreAbiTest.kt
+git commit -m "build: reject mismatched libcore HTTP client ABI"
+```
+
+### Task 10: Full Regression, Scope Audit, and Android Handoff
+
+**Files:**
+- Modify if needed: only files already listed above
+- Create: `docs/superpowers/verification/2026-09-04-custom-proxy-groups.md`
+
+**Interfaces:**
+- Produces a reproducible verification record and the APK path/hash.
+
+- [ ] **Step 1: Run all JVM and Android-test compilation checks**
+
+```powershell
+.\gradlew.bat :app:testOssDebugUnitTest :app:compileOssDebugAndroidTestKotlin
+```
+
+Expected: PASS with no fixed-default/non-overlap/semantic-route tests remaining.
+
+- [ ] **Step 2: Run lint and classify only real regressions**
+
+Run: `.\gradlew.bat :app:lintOssDebug`
+
+Expected: PASS, or record pre-existing unrelated findings separately without broad cleanup.
+
+- [ ] **Step 3: Perform the final clean debug build**
+
+Run: `.\gradlew.bat :app:clean :app:assembleOssDebug`
+
+Expected: PASS and ABI gate runs automatically.
+
+- [ ] **Step 4: Audit scope and protected files**
+
+```powershell
+git status --short
+git diff --stat f8e6418
+git diff -- app/src/main/java/io/nekohasekai/sagernet/fmt/ConfigBuilder.kt app/src/main/java/io/nekohasekai/sagernet/database/RuleEntity.kt
+git status --short -- ../A7.yaml ../nekobox_isA8.json
+```
+
+Expected: no protected-file change; no automatic route reassignment; no unrelated DNS/TUN, AdBlock, `.invalid`, subscription link, or ordinary-profile mutation.
+
+- [ ] **Step 5: Record hashes and static verification**
+
+Write the exact Gradle exit results, APK absolute path, SHA-256, schema version, ABI descriptor check, test totals, lint result, and any unavailable emulator checks to the verification document.
+
+- [ ] **Step 6: Install only when a connected authorized device is visible**
+
+Run: `adb devices -l`. If exactly one authorized device is present, run `.\gradlew.bat :app:installOssDebug`; otherwise do not guess a target and leave the APK ready.
+
+- [ ] **Step 7: Execute the real-device acceptance checklist**
+
+On Android: upgrade without clearing data; refresh subscription 1 and 2; create `US1` with both sources and a US regex; create a second overlapping group; verify selector isolation; verify URL-test selects a reachable node; explicitly route one test rule to `US1`; refresh both sources; confirm route/group survival; confirm AdBlock, `.invalid`, App routing, DNS/TUN, subscriptions, and ordinary nodes remain functional. Capture the exact log line for any failure.
+
+- [ ] **Step 8: Request code review and address only confirmed issues**
+
+Use `superpowers:requesting-code-review`, compare implementation to the approved spec and this plan, rerun the affected test after each correction, then rerun Steps 1–4.
+
+- [ ] **Step 9: Commit the verification record**
+
+```powershell
+git add docs/superpowers/verification/2026-09-04-custom-proxy-groups.md
+git commit -m "docs: record custom proxy group verification"
+```
diff --git a/docs/superpowers/plans/2026-09-05-1.4.7-repair.md b/docs/superpowers/plans/2026-09-05-1.4.7-repair.md
new file mode 100644
index 0000000000..28ee41b5f9
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-05-1.4.7-repair.md
@@ -0,0 +1,16 @@
+# NekoBox 1.4.7 repair plan
+
+**Goal:** Independently verify the Antigravity handoff and repair reproducible defects without changing the current UI/Router architecture.
+
+**Scope:** Backup safety, Router membership and selection, homepage lifecycle, version metadata and local-only configuration protection. Keep Room schema 10 and arm64-only packaging. Do not commit, push, or upload private backups. Do not inspect protected A7/isA8 configurations.
+
+- [ ] Run the existing offline JVM suite as a baseline.
+- [ ] Backup: reproduce silent serialization of missing beans; reject incomplete exports without deleting database rows; read related tables in one transaction; capture document-export state safely across view recreation. Validate imports before destructive replacement.
+- [ ] Membership: prevent missing beans from becoming usable Router nodes; reconcile rows and selections atomically; test drag-order updates against concurrent member replacement.
+- [ ] UI/runtime: independently review configuration generation, group switching and lifecycle; repair confirmed failures (including recursive empty-group reload), adding focused regression coverage.
+- [ ] Set VERSION_NAME=1.4.7 and increment the raw VERSION_CODE from 49 to 50 (effective Android code 250).
+- [ ] Protect private configuration/log/key artifacts with ignore rules; check tracked paths and APK entries without printing private content.
+- [ ] Run JVM tests, Android-test compilation, lint, debug APK build, ABI and APK metadata checks. Distinguish device tests from host-only checks.
+- [ ] Review final diff and record evidence, limitations and artifact paths in a repair report.
+
+Validation uses the task-local JDK 17 and Android SDK; Gradle output stays in ignored local logs. No new dependencies or permanent services are required.
diff --git a/docs/superpowers/plans/2026-09-05-neko-1.4.6.md b/docs/superpowers/plans/2026-09-05-neko-1.4.6.md
new file mode 100644
index 0000000000..7b0897743a
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-05-neko-1.4.6.md
@@ -0,0 +1,29 @@
+# NekoBox 1.4.6 Implementation Plan
+
+**Goal:** Repair confirmed compatibility, lifecycle, Router and UI defects and ship a verified 1.4.6 build.
+
+**Architecture:** Preserve the Room Router model and sing-box integration. Fix each defect at its owner; retain the 300-second URL_TEST interval and event-driven foreground refresh.
+
+**Tech Stack:** Kotlin, Android API 21–35, Room, Go/libcore, Gradle.
+
+**Spec:** User request to review, optimize and repair the project for 1.4.6, with prior authorization to push GitHub.
+
+## Constraints
+
+- Preserve existing routing, AdBlock, subscriptions and configuration files; do not inspect A7/isA8.
+- Keep runtime failures distinct from dependency update and style advisories. Do not broadly suppress real lint defects.
+- Device behavior and battery measurements require a connected phone; a build cannot prove them.
+
+## Tasks
+
+- [ ] Fix lint-confirmed API/locale/format/accessibility defects in UI, resources and format parsers. Re-run `:app:lintOssDebug --offline`.
+- [ ] Review Router refresh/delete/import invariants; add focused regression tests for confirmed defects.
+- [ ] Repair service startup cancellation and shutdown ordering in `BaseService.kt` / `ProxyInstance.kt`; keep native core alive until traffic sampling stops.
+- [ ] Fix callback cleanup/concurrency and wake the traffic loop on foreground entry in `BaseService.kt` / `TrafficLooper.kt`. Preserve background throttling and update URL_TEST display even with speed display disabled.
+- [ ] Check network URL_TEST refresh against bundled core implementation and address confirmed lifetime issues.
+- [ ] Run JVM tests, Android-test compilation, lint and debug APK build; inspect packaged version/native libraries and record results.
+- [ ] Set `nb4a.properties` to 1.4.6 / code 49, write release verification notes, commit and push `origin/router-groups`; verify remote hash.
+
+## Review checkpoints
+
+Each patch must link to a concrete failure or traced lifecycle. Review parallel edits before testing. Retain non-blocking maintenance advisories in the report. Do not declare all possible bugs eliminated.
diff --git a/docs/superpowers/specs/2026-09-04-custom-proxy-groups-design.md b/docs/superpowers/specs/2026-09-04-custom-proxy-groups-design.md
new file mode 100644
index 0000000000..dea1b19d53
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-04-custom-proxy-groups-design.md
@@ -0,0 +1,170 @@
+# NekoBox Custom Proxy Groups Design
+
+## Goal
+
+Add user-defined proxy groups to NekoBox for Android with FlClash-like source selection and filtering. A user can create any number of groups, select one or more subscription sources, filter their nodes, choose `selector` or `url-test`, and select the group as a route outbound. Existing subscription, routing, AdBlock, App routing, DNS, TUN, and ordinary node behavior must remain unchanged unless the user explicitly uses a custom group.
+
+## Confirmed Scope
+
+- Groups are created, named, edited, reordered, enabled, and deleted by the user.
+- No predefined `US`, `US low`, `SG`, or `JP` groups are created.
+- A node may belong to multiple custom groups.
+- Each group selects one or more existing subscription groups as sources.
+- The first version supports an optional include regular expression and an optional exclude regular expression against the displayed node name.
+- An empty include expression includes every node from the selected sources. The exclude expression is applied after the include expression and wins when both match.
+- Invalid regular expressions prevent saving and show a validation error.
+- The first version supports only `selector` and `url-test` modes.
+- `fallback`, `load-balance`, group nesting, protocol filtering, multiplier filtering, region enums, and nested logical condition trees are out of scope.
+- Existing route rules can explicitly select a custom group as their outbound.
+- No route is assigned to a custom group by its name or content automatically.
+- Full Clash/Mihomo YAML import is out of scope.
+
+## FlClash Reference Boundary
+
+Use FlClash's proxy-group model and editor as behavioral references, especially its `use`, `filter`, `exclude-filter`, `url`, `interval`, and group-type fields. NekoBox remains a Kotlin/Room/sing-box application, so Flutter widgets and Mihomo runtime code will not be copied mechanically. Any concrete copied code must be compatible with GPL-3.0 and retain appropriate attribution.
+
+References inspected at FlClash commit `62addf738a76b1a492e19af2dbabdb6d572b9e72`:
+
+- `lib/models/clash_config.dart`
+- `lib/database/groups.dart`
+- `lib/views/profiles/overwrite/custom/groups.dart`
+
+## Data Model
+
+### Custom group
+
+Reuse the existing Router group concept but make it fully user-defined. Each record stores:
+
+- database ID;
+- immutable stable tag generated at creation and never derived from the display name;
+- unique non-blank display name;
+- mode: `selector` or `url-test`;
+- enabled state and user order;
+- include regex and exclude regex;
+- URL-test URL, interval, tolerance, and timeout using safe project defaults when omitted;
+- selected node stable identity for selector mode.
+
+The UI calls this feature "Proxy groups" or its Chinese equivalent. Internal Router naming may remain in implementation types where changing it would create unnecessary risk.
+
+### Source relationship
+
+Store a many-to-many relationship between a custom group and subscription `ProxyGroup` records. A group can use multiple subscriptions, and one subscription can feed multiple groups.
+
+### Materialized membership
+
+Persist the latest resolved members so selection state and error reporting survive refreshes. Membership is many-to-many: there is no uniqueness constraint on `proxyId` across different custom groups. Stable node identity is scoped by subscription source so identical nodes in different subscriptions are not conflated.
+
+### Route relationship
+
+Add an optional custom-group reference to `RuleEntity`. Preserve the existing numeric `outbound` field and its semantics for legacy proxy, direct, block, and profile targets. A route selects either its legacy outbound or a custom-group ID, never both. Configuration generation resolves the ID to the group's immutable stable tag. Renaming a group therefore does not break routes.
+
+Database and backup versions must migrate incrementally. Existing debug installations using the current Router schema must also migrate without deleting subscriptions or rules.
+
+## Membership Resolution
+
+For each enabled group:
+
+1. Load nodes belonging to the selected subscription sources.
+2. Preserve source order and node order deterministically.
+3. Apply the include regex when non-empty.
+4. Apply the exclude regex and remove every match.
+5. Deduplicate the same node within that group only.
+6. Allow the same node to appear independently in other groups.
+7. Materialize the result and remap the selected node using stable identity after subscription refresh.
+
+Membership is recomputed after importing, updating, deleting, or clearing a subscription and before configuration generation if stored membership is stale. A failed or empty subscription refresh does not erase the last valid membership snapshot. Deleting a source removes that source from group criteria and triggers recomputation.
+
+## Runtime Configuration
+
+For every enabled non-empty group, `ConfigBuilder` emits one sing-box outbound using the stable tag:
+
+- `selector`: member outbound tags plus the persisted selected member as `default`;
+- `urltest`: member outbound tags plus the configured test URL, interval, tolerance, and timeout supported by the pinned sing-box version.
+
+Normal node outbounds are built once and may be referenced by multiple groups. A group tag must not collide with system or node tags.
+
+Changing a selector choice attempts a targeted runtime switch for that group. If safe targeted switching is unavailable, perform a full service reload and report failure visibly. Editing criteria or changing mode performs a full reload because group topology changed.
+
+## Route Editing
+
+Extend the existing route outbound picker with a "Proxy group" choice. Selecting it opens a list of enabled non-empty custom groups and stores the group ID. Rule summaries display the current group name.
+
+No semantic name matching is permitted. Existing Google, Telegram, YouTube, App, AdBlock, `.invalid`, direct, block, and profile-target rules retain their stored outbound until the user edits them.
+
+Deleting a group referenced by routes is blocked with a message listing the number of references. The user must reassign those routes first. This prevents silent traffic diversion.
+
+## UI Flow
+
+Add a dedicated custom-group list and editor rather than embedding fixed cards in the subscription list.
+
+The editor contains:
+
+- group name;
+- mode (`selector` or `url-test`);
+- subscription sources, multi-select;
+- include regex;
+- exclude regex;
+- URL-test settings shown only in `url-test` mode;
+- live preview showing the matched node count and node names;
+- enabled switch and save/delete actions.
+
+The runtime group view shows mode, member count, selected/current node, and the latest resolution error. A selector group opens its member list for manual selection. A URL-test group shows the core-selected current node and supports triggering the existing group test behavior where available.
+
+## Error Handling
+
+- Invalid regex: reject save and identify the invalid field.
+- No source selected: allow saving a disabled draft only; an enabled group requires at least one source.
+- No matched nodes: save the group but mark it unavailable. If an enabled route references it, service configuration/start fails with a clear group-specific error rather than silently using another outbound.
+- Subscription refresh failure: retain the last valid members and show the refresh error.
+- Missing source or member: remove stale relationships during reconciliation and keep the group itself.
+- Missing referenced group: preserve the rule record, show it as invalid, and refuse to generate a silently altered route.
+- Native core mismatch: clean builds must verify `libcore.aar`, its JNI libraries, and the compiled `newHttpClient()` descriptor before producing an APK.
+
+## Migration from the Current Incorrect Implementation
+
+Retain only reusable infrastructure:
+
+- Router Room entities and DAOs where their schema remains suitable;
+- stable node identity and refresh reconciliation;
+- selector/url-test outbound generation;
+- targeted selector switching in libcore;
+- native-core build verification.
+
+Remove or replace:
+
+- automatic creation of four fixed groups;
+- node exclusivity across groups;
+- semantic route-name mapping to fixed tags;
+- the fixed group cards and manual-only membership dialog;
+- tests that assert four predefined groups or non-overlapping membership.
+
+Existing routes, subscriptions, and settings outside this feature are not normalized or rewritten.
+
+## Testing and Acceptance
+
+### Automated
+
+- Matcher tests for multiple sources, include/exclude precedence, invalid regex, deterministic order, and overlapping groups.
+- Reconciliation tests for refreshed node IDs, renamed nodes, failed/empty refreshes, source deletion, and selected-node preservation.
+- Room migration and DAO tests for current database versions through the new version.
+- Backup round-trip and old-backup import tests.
+- Config tests proving correct selector/url-test JSON, shared nodes across groups, stable tags, no dangling references, and no changes to unrelated routes.
+- Route editor/model tests proving explicit group selection and preservation of legacy outbound values.
+- Clean-build ABI check proving app bytecode and packaged libcore use the same `HTTPClient` descriptor.
+- JVM tests, Android lint assessment, and debug APK build.
+
+### Real Android device
+
+1. Upgrade without losing existing subscriptions or routes.
+2. Import and refresh at least two subscriptions.
+3. Create `US1` using both subscriptions and a US include regex.
+4. Create another group reusing at least one of the same nodes.
+5. Verify selector mode changes only the selected group.
+6. Verify URL-test mode chooses a reachable member.
+7. Assign a route explicitly to `US1` and confirm runtime routing/log output.
+8. Refresh both subscriptions and confirm both groups and the route remain valid.
+9. Confirm AdBlock, `.invalid` load rules, App routing, DNS/TUN, and ordinary node operation remain unchanged.
+
+## Delivery Boundary
+
+Do not commit or ship an APK until the clean-build ABI check and automated tests pass. Static tests do not replace the real-device acceptance steps. Keep the current installed debug build recoverable until its subscriptions and settings have been migrated or backed up.
diff --git a/docs/superpowers/verification/2026-09-04-custom-proxy-groups.md b/docs/superpowers/verification/2026-09-04-custom-proxy-groups.md
new file mode 100644
index 0000000000..54511bac55
--- /dev/null
+++ b/docs/superpowers/verification/2026-09-04-custom-proxy-groups.md
@@ -0,0 +1,130 @@
+# NekoBox Custom Proxy Groups Verification Report
+
+Date: 2026-09-04  
+Worktree: `C:\Users\renos\Documents\Proxy\NekoBoxForAndroid-router-groups`  
+Branch: `router-groups`  
+Base commit: `f8e6418`  
+Plan commit: `bdc6392`
+
+---
+
+## 1. Executive Summary
+
+- **Static Feature Status**: Complete. All spec requirements, persistence models, matcher logic, repository methods, config generation, backup v3 serialization, UI components, and clean-build ABI gates are implemented and verified.
+- **Real-Device Acceptance**: **Unverified**. `adb devices -l` returned no attached devices at verification time. Clean APKs are assembled and ready for installation.
+- **Safety Boundaries**: Protected files (`A7.yaml`, `nekobox_isA8.json`) and files outside the project directory were completely untouched. No unrelated DNS, TUN, AdBlock, `.invalid` loading rules, App routing, or subscription behaviors were altered.
+
+---
+
+## 2. Produced APK Artifacts
+
+Generated by clean build without build cache:  
+`.\gradlew.bat :app:clean :app:assembleOssDebug --console=plain --no-build-cache`
+
+| Artifact | Size (Bytes) | SHA-256 |
+|---|---|---|
+| `NekoBoxF-1.4.2-rev-24-arm64-v8a-debug.apk` | 23,554,911 | `0499048F4B75C996465F09987442BE020AFAF4EF86C8B55B9CDB13109E30E47D` |
+| `NekoBoxF-1.4.2-rev-24-armeabi-v7a-debug.apk` | 23,696,376 | `81F15A67DA021480ACB773E333CB65B30C1DD9D9987432E64BAB1289BEFD4B8C` |
+| `NekoBoxF-1.4.2-rev-24-x86-debug.apk` | 24,413,884 | `E8BACE2D913E1D48CAB729F68CC3BC9499CF922DC607E955108A00FC8A7AE42E` |
+| `NekoBoxF-1.4.2-rev-24-x86_64-debug.apk` | 24,290,259 | `C2A264ADEBC02A95BF69208F6EE3C435CF8B55367A16FC110A97C92A0B9E9B0E` |
+
+### APK ABI & Bytecode Verification
+
+Inspected every produced APK using ordinal ASCII matching across all packed DEX files:
+
+- **`libgojni.so` Native Library**:
+  - `arm64-v8a`: `lib/arm64-v8a/libgojni.so` present.
+  - `armeabi-v7a`: `lib/armeabi-v7a/libgojni.so` present.
+  - `x86`: `lib/x86/libgojni.so` present.
+  - `x86_64`: `lib/x86_64/libgojni.so` present.
+- **`Llibcore/HttpClient;` (Stale / Obsolete)**: **Absent** across all 4 APKs (`HasLegacyHttpClient = False`).
+- **`Llibcore/HTTPClient;` (Current ABI)**: **Present** across all 4 APKs (`HasCurrentHTTPClient = True`).
+
+---
+
+## 3. Database Schema & Migration
+
+- **Schema Version**: `10` (`app/schemas/io.nekohasekai.sagernet.database.SagerDatabase/10.json`)
+- **AutoMigration**: `AutoMigration(from = 9, to = 10)` registered in `SagerDatabase.kt`.
+- **Entities & Columns**:
+  - `router_groups`: `id`, `stableTag` (unique index), `name`, `mode`, `enabled`, `matchConfig`, `selectedProxyId`, `userOrder`, `selectedNodeKey`, `lastError`.
+  - `router_members`: primary key `(routerId, proxyId)`, `userOrder`, `lastMatchedAt`, index on `proxyId`.
+  - `router_group_sources`: primary key `(routerId, sourceGroupId)`, `userOrder`, index on `sourceGroupId`.
+  - `rules`: added `routerGroupId` (INTEGER NOT NULL DEFAULT 0), `@IgnoredOnParcel` to preserve legacy parcel wire layout.
+- **Migration Verification**: `RouterMigrationTest.kt` passes compilation and tests v8->v9, v9->v10, sharing of sources/members across routers, and ordering/replacement/deletion semantics.
+
+---
+
+## 4. Automated Test Results
+
+Executed with:  
+`$env:JAVA_HOME='C:\Users\renos\Documents\Proxy\.router-groups-toolchain\jdk'`
+
+### 4.1 JVM Unit Tests (`:app:testOssDebugUnitTest`)
+- **Result**: `BUILD SUCCESSFUL` (0 failures, 0 errors).
+- **Suites Passed**:
+  - `RouterMatcherTest`: multi-group node overlap, source order preservation, include/exclude precedence, local deduplication, regex validation errors.
+  - `RouterMembershipTest`: membership planning, stable selection retention, order stability.
+  - `RouterFilterTest`: JSON codec round-trip, timing bounds, field validation.
+  - `RouterReconcilerTest`: source-scoped stable identity remap, cross-group overlap, preservation of previous members on failed/empty refresh, appending in matcher order.
+  - `RouterSelectionTest`: targeted hot-switching for selector groups, reload for URL-test groups, isolated group switching, legacy selector fallback.
+  - `RouterGroupRepositoryTest`: draft validation, unique case-insensitive name check, minimum 10s interval, 0..65535 tolerance, HTTP/HTTPS URL requirement.
+  - `RouterRouteSemanticTest`: legacy routes never modified by rule name, explicit router group resolution, mutually exclusive picker choices, missing group runtime error, AdBlock and `.invalid` load rules untouched.
+  - `RouterOutboundConfigTest`: emission of sing-box `selector` and `urltest` options, nanosecond conversion (`120_000_000_000L`), reserved tag avoidance.
+
+### 4.2 Instrumentation Compilation (`:app:compileOssDebugAndroidTestKotlin`)
+- **Result**: `BUILD SUCCESSFUL`.
+- Includes `RouterMigrationTest.kt` and `BackupSerializationTest.kt`.
+
+### 4.3 Clean-Build ABI & Caller Gates
+- `:app:verifyLibcore`: Passed (verified `classes.jar`, all 4 `libgojni.so` architectures, presence of `HTTPClient`, absence of `HttpClient`, and `newHttpClient` return type).
+- `:app:verifyOssDebugLibcoreCallers`: Passed (verified compiled app caller bytecode references `libcore/HTTPClient` and contains zero `libcore/HttpClient` references).
+
+---
+
+## 5. Lint Findings Classification (`:app:lintOssDebug`)
+
+Total findings reported: 79 errors (build abort threshold).
+
+All 79 findings were analyzed against the project changes:
+1. **Dependency Versions** (~68 errors): Pre-existing Gradle dependency warnings flagging newer available library versions (e.g. `kotlinx-coroutines-android:1.7.3`, `androidx.room:2.8.4`, `androidx.core:1.19.0`).
+2. **Pre-existing UI / Format Issues**:
+   - `AssetsActivity.kt:387`: `MissingSuperCall` on `onBackPressed()`.
+   - `KotlinUtil.kt:53-55`: `DefaultLocale` usage in string formatting.
+   - `StandardV2RayBean.java:101`: `DefaultLocale` in `toLowerCase()`.
+   - `JuicityFmt.kt:87-88`: `NewApi` on `java.util.Base64.getUrlEncoder` (minSdk 21).
+   - `themes.xml:117`: `NewApi` on `android:dialogCornerRadius`.
+   - `AssetsActivity.kt:367`: `SimpleDateFormat` without explicit locale.
+   - `BaseService.kt:413`: `UnspecifiedRegisterReceiverFlag` on legacy service broadcast receiver registration.
+3. **Task Changes**: **0 lint errors** were introduced by the custom proxy group implementation or modified task files.
+
+---
+
+## 6. Real-Device Acceptance Checklist (Unverified)
+
+Status: **Unverified** (no attached Android hardware).
+
+When a device is connected, run:
+```powershell
+.\gradlew.bat :app:installOssDebug
+```
+And verify:
+1. [ ] Upgrade install without clearing app data; verify database migration v10 opens cleanly.
+2. [ ] Refresh subscription 1 and subscription 2; confirm no `HttpClient/HTTPClient` runtime crashes occur.
+3. [ ] Create `US1` group selecting both subscriptions with a US include regex; observe live preview.
+4. [ ] Create a second group (`US2`) containing at least one identical node; verify overlap.
+5. [ ] In selector mode, change selected node in `US1`; verify `US2` and main proxy selector are untouched.
+6. [ ] In URL-test mode, trigger latency test and verify reaching member is chosen.
+7. [ ] Edit a route rule to explicitly target `US1`; start VPN and verify route resolution.
+8. [ ] Refresh both subscriptions; confirm group configurations, route targets, and valid members persist.
+9. [ ] Verify AdBlock, `.invalid` load rules, App routing, DNS/TUN, and ordinary profiles continue to operate normally.
+10. [ ] Capture logs for any runtime errors.
+
+---
+
+## 7. Scope and Protected Boundary Confirmation
+
+- `C:\Users\renos\Documents\Proxy\A7.yaml`: **Untouched** (Last modified 2026-09-02 19:37:23).
+- `C:\Users\renos\Documents\Proxy\nekobox_isA8.json`: **Untouched** (Last modified 2026-09-02 21:52:42).
+- Project External Files: **Zero modifications or deletions**.
+- Feature Boundary: User-defined proxy groups only (`selector` & `url-test`); no predefined US/SG/JP groups, no automatic route inference, no YAML clash import, no fallback or load-balancing additions.
diff --git a/gradle.properties b/gradle.properties
index 7d843abfdd..caa20cf830 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -23,3 +23,4 @@ kotlin.code.style=official
 org.gradle.parallel=true
 android.nonTransitiveRClass=false
 android.nonFinalResIds=false
+android.suppressUnsupportedCompileSdk=36
diff --git a/hev-socks5-tunnel b/hev-socks5-tunnel
deleted file mode 160000
index 9a06bc6e79..0000000000
--- a/hev-socks5-tunnel
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 9a06bc6e7989da54e3d32ff701ef7a7ce4995d3a
diff --git a/libcore/box.go b/libcore/box.go
index 5df6d4ba0f..035b20adf9 100644
--- a/libcore/box.go
+++ b/libcore/box.go
@@ -11,27 +11,22 @@ import (
 	"runtime/debug"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/matsuridayo/libneko/protect_server"
-	"github.com/matsuridayo/libneko/speedtest"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/boxapi"
-	"github.com/sagernet/sing-box/experimental/libbox/platform"
+	"github.com/sagernet/sing-box/common/urltest"
+	"github.com/sagernet/sing-box/experimental/v2rayapi"
 	"github.com/sagernet/sing-box/protocol/group"
 
 	box "github.com/sagernet/sing-box"
-	"github.com/sagernet/sing-box/common/conntrack"
-	"github.com/sagernet/sing-box/common/dialer"
 	"github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/option"
+	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/service"
 	"github.com/sagernet/sing/service/pause"
 )
 
-func init() {
-	dialer.DoNotSelectInterface = true
-}
-
 var mainInstance *BoxInstance
 
 func VersionBox() string {
@@ -60,8 +55,16 @@ func VersionBox() string {
 
 func ResetAllConnections(system bool) {
 	if system {
-		conntrack.Close()
-		log.Println("Reset system connections done")
+		// sing-box 1.15 removed the conntrack package. Connections dialed by
+		// outbound dialers are tracked by the box ConnectionManager, which is
+		// also what upstream closes on network changes and on the daemon's
+		// "close all connections" command.
+		if mainInstance != nil && mainInstance.connectionManager != nil {
+			mainInstance.connectionManager.CloseAll()
+			log.Println("Reset system connections done")
+		} else {
+			log.Println("Reset system connections: no running instance")
+		}
 	} else {
 		log.Println("TODO: Reset user connections")
 	}
@@ -74,9 +77,10 @@ type BoxInstance struct {
 	cancel context.CancelFunc
 	state  int
 
-	v2api        *boxapi.SbV2rayServer
-	selector     *group.Selector
-	pauseManager pause.Manager
+	v2api             *v2rayapi.StatsService
+	connectionManager adapter.ConnectionManager
+	selector          *group.Selector
+	pauseManager      pause.Manager
 }
 
 func NewSingBoxInstance(config string, localTransport LocalDNSTransport) (b *BoxInstance, err error) {
@@ -87,14 +91,16 @@ func NewSingBoxInstance(config string, localTransport LocalDNSTransport) (b *Box
 	ctx = box.Context(ctx,
 		nekoboxAndroidInboundRegistry(), nekoboxAndroidOutboundRegistry(), nekoboxAndroidEndpointRegistry(),
 		nekoboxAndroidDNSTransportRegistry(localTransport), nekoboxAndroidServiceRegistry(),
+		nekoboxAndroidCertificateProviderRegistry(),
 	)
 	ctx = service.ContextWithDefaultRegistry(ctx)
-	service.MustRegister[platform.Interface](ctx, boxPlatformInterfaceInstance)
+	ctx = service.ContextWith[adapter.PlatformInterface](ctx, boxPlatformInterfaceInstance)
 
 	// parse options
 	var options option.Options
 	err = options.UnmarshalJSONContext(ctx, []byte(config))
 	if err != nil {
+		cancel()
 		return nil, fmt.Errorf("decode config: %v", err)
 	}
 
@@ -110,9 +116,10 @@ func NewSingBoxInstance(config string, localTransport LocalDNSTransport) (b *Box
 	}
 
 	b = &BoxInstance{
-		Box:          instance,
-		cancel:       cancel,
-		pauseManager: service.FromContext[pause.Manager](ctx),
+		Box:               instance,
+		cancel:            cancel,
+		pauseManager:      service.FromContext[pause.Manager](ctx),
+		connectionManager: service.FromContext[adapter.ConnectionManager](ctx),
 	}
 
 	// selector
@@ -192,46 +199,167 @@ func (b *BoxInstance) SetV2rayStats(outbounds string) {
 		log.Println("duplicate call of SetV2rayStats")
 		return
 	}
-	b.v2api = boxapi.NewSbV2rayServer(option.V2RayStatsServiceOptions{
+	// boxapi was removed in sing-box 1.15: the V2Ray stats service now lives in
+	// experimental/v2rayapi and implements adapter.ConnectionTracker directly.
+	statsService := v2rayapi.NewStatsService(option.V2RayStatsServiceOptions{
 		Enabled:   true,
 		Outbounds: strings.Split(outbounds, "\n"),
 	})
-	b.Box.Router().AppendTracker(b.v2api.StatsService())
+	if statsService == nil {
+		return
+	}
+	b.v2api = statsService
+	b.Box.Router().AppendTracker(statsService)
 }
 
 func (b *BoxInstance) QueryStats(tag, direct string) int64 {
 	if b.v2api == nil {
 		return 0
 	}
-	return b.v2api.QueryStats(fmt.Sprintf("outbound>>>%s>>>traffic>>>%s", tag, direct))
+	// The Android traffic looper accumulates per-interval deltas, so counters
+	// are reset on read (same behavior as the removed boxapi helper).
+	response, err := b.v2api.GetStats(context.Background(), &v2rayapi.GetStatsRequest{
+		Name:   fmt.Sprintf("outbound>>>%s>>>traffic>>>%s", tag, direct),
+		Reset_: true,
+	})
+	if err != nil || response == nil || response.Stat == nil {
+		return 0
+	}
+	return response.Stat.Value
 }
 
 func (b *BoxInstance) SelectOutbound(tag string) bool {
+	b.access.Lock()
+	defer b.access.Unlock()
+	if b.state != 1 {
+		return false
+	}
 	if b.selector != nil {
 		return b.selector.SelectOutbound(tag)
 	}
 	return false
 }
 
+func (b *BoxInstance) SelectOutboundFor(selectorTag, tag string) bool {
+	b.access.Lock()
+	defer b.access.Unlock()
+	if b.state != 1 {
+		return false
+	}
+	proxy, ok := b.Outbound().Outbound(selectorTag)
+	if !ok {
+		return false
+	}
+	selector, ok := proxy.(*group.Selector)
+	if !ok {
+		return false
+	}
+	return selector.SelectOutbound(tag)
+}
+
+func (b *BoxInstance) CurrentOutboundFor(groupTag string) string {
+	b.access.Lock()
+	defer b.access.Unlock()
+	if b.state != 1 {
+		return ""
+	}
+	proxy, ok := b.Outbound().Outbound(groupTag)
+	if !ok {
+		return ""
+	}
+	switch outbound := proxy.(type) {
+	case *group.Selector:
+		return outbound.Now()
+	case *group.URLTest:
+		return outbound.Now()
+	default:
+		return ""
+	}
+}
+
+func (b *BoxInstance) RefreshURLTestFor(groupTag string) bool {
+	b.access.Lock()
+	defer b.access.Unlock()
+	if b.state != 1 {
+		return false
+	}
+	proxy, ok := b.Outbound().Outbound(groupTag)
+	if !ok {
+		return false
+	}
+	urlTest, ok := proxy.(*group.URLTest)
+	if !ok {
+		return false
+	}
+	// The group's context is cancelled by Close. Do not hold up Android's
+	// caller or core shutdown while probes wait for unreachable nodes.
+	go urlTest.CheckOutbounds()
+	return true
+}
+
 func UrlTest(i *BoxInstance, link string, timeout int32) (latency int32, err error) {
 	defer device.DeferPanicToError("box.UrlTest", func(err_ error) { err = err_ })
-	var connectionTracker adapter.ConnectionTracker
-	// test i
-	if i != nil {
-		if i.v2api != nil {
-			connectionTracker = i.v2api.StatsService()
-		}
-		return speedtest.UrlTest(boxapi.CreateProxyHttpClient(i.Box, connectionTracker), link, timeout, speedtest.UrlTestStandard_RTT)
+
+	ctx := context.Background()
+	if timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(timeout)*time.Millisecond)
+		defer cancel()
 	}
-	// test direct
-	if mainInstance == nil {
-		return speedtest.UrlTest(boxapi.CreateProxyHttpClient(nil, nil), link, timeout, speedtest.UrlTestStandard_RTT)
+
+	detour, err := urlTestDetour(i)
+	if err != nil {
+		return 0, err
 	}
-	// test mainInstance
-	if mainInstance.v2api != nil {
-		connectionTracker = mainInstance.v2api.StatsService()
+
+	// urltest.URLTest is the upstream replacement for the removed
+	// boxapi.CreateProxyHttpClient: the request is dialed through detour, so
+	// the probe really leaves through the outbound under test.
+	latencyValue, err := urltest.URLTest(ctx, link, detour)
+	if err != nil {
+		return 0, err
 	}
-	return speedtest.UrlTest(boxapi.CreateProxyHttpClient(mainInstance.Box, connectionTracker), link, timeout, speedtest.UrlTestStandard_RTT)
+	return int32(latencyValue), nil
+}
+
+// urlTestDetour resolves the dialer a URL test has to go through:
+//
+//   - a test instance: that instance's default outbound, i.e. the node under test;
+//   - no instance: the default outbound of the running main instance;
+//   - no instance at all: the system network (direct).
+//
+// Since sing-box 1.15 some protocols (WireGuard) are endpoints instead of
+// outbounds, so a proxy endpoint is picked when no proxy outbound exists.
+func urlTestDetour(i *BoxInstance) (N.Dialer, error) {
+	if i == nil {
+		i = mainInstance
+	}
+	if i == nil {
+		return N.SystemDialer, nil
+	}
+	if outbound := i.proxyOutbound(); outbound != nil {
+		return outbound, nil
+	}
+	if endpoints := i.Endpoint().Endpoints(); len(endpoints) > 0 {
+		return endpoints[0], nil
+	}
+	if outbound := i.Outbound().Default(); outbound != nil {
+		return outbound, nil
+	}
+	return nil, errors.New("no outbound to test in the box instance")
+}
+
+// proxyOutbound returns the first outbound that actually proxies, skipping the
+// direct / block / dns helper outbounds the app always appends.
+func (b *BoxInstance) proxyOutbound() adapter.Outbound {
+	for _, outbound := range b.Outbound().Outbounds() {
+		switch outbound.Type() {
+		case "direct", "block", "dns":
+			continue
+		}
+		return outbound
+	}
+	return nil
 }
 
 var protectCloser io.Closer
diff --git a/libcore/box_include.go b/libcore/box_include.go
index a2447009a4..8b49fc2575 100644
--- a/libcore/box_include.go
+++ b/libcore/box_include.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/adapter/certificate"
 	"github.com/sagernet/sing-box/adapter/endpoint"
 	"github.com/sagernet/sing-box/adapter/inbound"
 	"github.com/sagernet/sing-box/adapter/outbound"
@@ -27,7 +28,6 @@ import (
 	"github.com/sagernet/sing-box/protocol/mixed"
 	"github.com/sagernet/sing-box/protocol/redirect"
 	"github.com/sagernet/sing-box/protocol/shadowsocks"
-	"github.com/sagernet/sing-box/protocol/shadowsocksr"
 	"github.com/sagernet/sing-box/protocol/shadowtls"
 	snellprotocol "github.com/sagernet/sing-box/protocol/snell"
 	"github.com/sagernet/sing-box/protocol/socks"
@@ -75,7 +75,6 @@ func nekoboxAndroidOutboundRegistry() *outbound.Registry {
 	socks.RegisterOutbound(registry)
 	http.RegisterOutbound(registry)
 	shadowsocks.RegisterOutbound(registry)
-	shadowsocksr.RegisterOutbound(registry)
 	vmess.RegisterOutbound(registry)
 	trojan.RegisterOutbound(registry)
 	tor.RegisterOutbound(registry)
@@ -90,8 +89,6 @@ func nekoboxAndroidOutboundRegistry() *outbound.Registry {
 	hysteria2.RegisterOutbound(registry)
 	juicity.RegisterOutbound(registry)
 
-	wireguard.RegisterOutbound(registry)
-
 	return registry
 }
 
@@ -133,3 +130,9 @@ func nekoboxAndroidServiceRegistry() *service.Registry {
 
 	return registry
 }
+
+func nekoboxAndroidCertificateProviderRegistry() *certificate.Registry {
+	registry := certificate.NewRegistry()
+
+	return registry
+}
diff --git a/libcore/build.sh b/libcore/build.sh
index 233e89d4d4..03d4f44b1d 100755
--- a/libcore/build.sh
+++ b/libcore/build.sh
@@ -15,7 +15,7 @@ if [ -z "$GOPATH" ]; then
 fi
 
 export GOBIND=gobind-matsuri
-"$GOPATH"/bin/gomobile-matsuri bind -v -androidapi 21 -cache "$(realpath $BUILD)" -trimpath -ldflags='-s -w' -tags='with_conntrack,with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api' . || exit 1
+"$GOPATH"/bin/gomobile-matsuri bind -v -androidapi 21 -cache "$(realpath $BUILD)" -trimpath -ldflags='-s -w' -tags='with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api' . || exit 1
 rm -r libcore-sources.jar
 
 proj=../app/libs
diff --git a/libcore/config_parse_test.go b/libcore/config_parse_test.go
new file mode 100644
index 0000000000..566a26c99d
--- /dev/null
+++ b/libcore/config_parse_test.go
@@ -0,0 +1,288 @@
+package libcore
+
+import (
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"testing"
+)
+
+// makeTUNConfig returns a minimal sing-box config with the given tun stack and
+// address list. Mirrors the JSON produced by ConfigBuilder on the Android side.
+func makeTUNConfig(stack string, addresses []string) string {
+	addrs, _ := json.Marshal(addresses)
+	cfg := fmt.Sprintf(`{
+  "log": {"level": "info"},
+  "outbounds": [
+    {"type": "direct", "tag": "direct"},
+    {"type": "block", "tag": "block"}
+  ],
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "stack": %q,
+      "address": %s,
+      "interface_name": "tun0",
+      "mtu": 9000,
+      "auto_route": true,
+      "strict_route": false,
+      "endpoint_independent_nat": false
+    }
+  ],
+  "route": {
+    "auto_detect_interface": true,
+    "final": "direct"
+  }
+}`, stack, string(addrs))
+	return cfg
+}
+
+func TestTUNSchemaVariants(t *testing.T) {
+	stacks := []string{"go", "gvisor", "system", "mixed"}
+	cases := []struct {
+		name    string
+		address []string
+	}{
+		{"ipv4", []string{"172.19.0.1/30"}},
+		{"ipv6", []string{"fdfe:dcba:9876::1/126"}},
+		{"dual", []string{"172.19.0.1/30", "fdfe:dcba:9876::1/126"}},
+	}
+
+	for _, stack := range stacks {
+		for _, c := range cases {
+			t.Run(fmt.Sprintf("%s/%s", stack, c.name), func(t *testing.T) {
+				cfg := makeTUNConfig(stack, c.address)
+				b, err := NewSingBoxInstance(cfg, nil)
+				if err != nil {
+					t.Fatalf("NewSingBoxInstance failed: %v", err)
+				}
+				defer b.Close()
+
+				// Verify the tun inbound JSON shape is what the Android side emits.
+				var raw map[string]any
+				if err := json.Unmarshal([]byte(cfg), &raw); err != nil {
+					t.Fatalf("unmarshal failed: %v", err)
+				}
+				inbounds := raw["inbounds"].([]any)
+				tunRaw := inbounds[0].(map[string]any)
+				if got := tunRaw["stack"].(string); got != stack {
+					t.Errorf("stack = %q, want %q", got, stack)
+				}
+				addrList := tunRaw["address"].([]any)
+				if len(addrList) != len(c.address) {
+					t.Errorf("address length = %d, want %d", len(addrList), len(c.address))
+				}
+			})
+		}
+	}
+}
+
+// protocolSmokeConfig mirrors a NekoBox-generated config containing all
+// supported protocol outbounds. It is submitted to the real sing-box 1.15 core
+// to catch schema-breaking changes, not just JSON syntax errors.
+func protocolSmokeConfig() string {
+	return `{
+  "log": {"level": "info"},
+
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "stack": "go",
+      "address": ["172.19.0.1/30", "fdfe:dcba:9876::1/126"],
+      "interface_name": "tun0",
+      "mtu": 9000,
+      "auto_route": true,
+    }
+  ],
+  "outbounds": [
+    {"type": "direct", "tag": "direct"},
+    {"type": "block", "tag": "block"},
+    {
+      "type": "vless",
+      "tag": "node-vless",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "uuid": "c4ad1951-087c-4a4b-99f0-9c1e0c99f3d1",
+      "tls": {"enabled": true, "server_name": "example.com"}
+    },
+    {
+      "type": "vmess",
+      "tag": "node-vmess",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "uuid": "c4ad1951-087c-4a4b-99f0-9c1e0c99f3d2",
+      "security": "auto"
+    },
+    {
+      "type": "trojan",
+      "tag": "node-trojan",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "password": "test-password",
+      "tls": {"enabled": true, "server_name": "example.com"}
+    },
+    {
+      "type": "shadowsocks",
+      "tag": "node-ss",
+      "server": "1.2.3.4",
+      "server_port": 8388,
+      "method": "aes-256-gcm",
+      "password": "test-password"
+    },
+    {
+      "type": "hysteria2",
+      "tag": "node-hy2",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "password": "test-password",
+      "tls": {"enabled": true, "server_name": "example.com"}
+    },
+    {
+      "type": "tuic",
+      "tag": "node-tuic",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "uuid": "c4ad1951-087c-4a4b-99f0-9c1e0c99f3d3",
+      "password": "test-password",
+      "tls": {"enabled": true, "server_name": "example.com"},
+      "congestion_control": "bbr"
+    },
+    {
+      "type": "anytls",
+      "tag": "node-anytls",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "password": "test-password",
+      "tls": {"enabled": true, "server_name": "example.com"}
+    },
+    {
+      "type": "snell",
+      "tag": "node-snell4",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "version": 4,
+      "psk": "test-psk",
+      "obfs_mode": "tls",
+      "obfs_host": "example.com"
+    },
+    {
+      "type": "snell",
+      "tag": "node-snell6",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "version": 6,
+      "psk": "test-psk",
+      "mode": "default"
+    },
+    {
+      "type": "ssh",
+      "tag": "node-ssh",
+      "server": "1.2.3.4",
+      "server_port": 22,
+      "user": "root",
+      "password": "test-password"
+    },
+    {
+      "type": "shadowtls",
+      "tag": "node-shadowtls",
+      "server": "1.2.3.4",
+      "server_port": 443,
+      "password": "test-password",
+      "version": 3,
+      "tls": {"enabled": true, "server_name": "example.com"}
+    },
+    {
+      "type": "socks",
+      "tag": "node-socks",
+      "server": "1.2.3.4",
+      "server_port": 1080
+    },
+    {
+      "type": "http",
+      "tag": "node-http",
+      "server": "1.2.3.4",
+      "server_port": 8080,
+      "username": "user",
+      "password": "pass"
+    },
+    {
+      "type": "selector",
+      "tag": "proxy",
+      "outbounds": ["node-vless", "direct"]
+    },
+    {
+      "type": "urltest",
+      "tag": "auto",
+      "outbounds": ["node-vless", "direct"],
+      "url": "http://cp.cloudflare.com/generate_204",
+      "interval": "1m"
+    }
+  ],
+
+  "route": {
+    "auto_detect_interface": true,
+    "final": "direct"
+  },
+  "experimental": {
+    "cache_file": {"enabled": true}
+  }
+}`
+}
+
+func TestProtocolSmokeConfig(t *testing.T) {
+	cfg := protocolSmokeConfig()
+	b, err := NewSingBoxInstance(cfg, nil)
+	if err != nil {
+		t.Fatalf("NewSingBoxInstance failed: %v", err)
+	}
+	defer b.Close()
+
+	// Quick sanity check that the selector outbound is present.
+	if _, ok := b.Outbound().Outbound("proxy"); !ok {
+		t.Error("selector outbound 'proxy' not found")
+	}
+}
+
+func TestWireGuardEndpointSchema(t *testing.T) {
+	if runtime.GOOS != "android" {
+		t.Skip("WireGuard endpoint creation requires gVisor; run on Android or with -tags with_gvisor")
+	}
+	cfg := `{
+  "log": {"level": "info"},
+  "outbounds": [
+    {"type": "direct", "tag": "direct"}
+  ],
+  "endpoints": [
+    {
+      "type": "wireguard",
+      "tag": "wg",
+      "address": ["172.16.0.2/32", "fd00::2/128"],
+      "private_key": "GEPJmUxLGPPcnKtXBIeEVaKzWEs2RJUsZ5xzrEsQPVk=",
+      "mtu": 1420,
+      "peers": [
+        {
+          "address": "1.2.3.4",
+          "port": 51820,
+          "public_key": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
+          "allowed_ips": ["0.0.0.0/0", "::/0"],
+          "reserved": "AQID"
+        }
+      ]
+    }
+  ],
+  "route": {"final": "direct"}
+}`
+	b, err := NewSingBoxInstance(cfg, nil)
+	if err != nil {
+		t.Fatalf("NewSingBoxInstance failed: %v", err)
+	}
+	defer b.Close()
+
+	// Ensure the endpoint is reachable as an outbound by tag (this is how the
+	// Android app routes traffic to WireGuard after the 1.15 endpoint migration).
+	if _, ok := b.Outbound().Outbound("wg"); !ok {
+		t.Error("wireguard endpoint 'wg' is not reachable as outbound")
+	}
+}
diff --git a/libcore/dns_box.go b/libcore/dns_box.go
index 3f1cd5fbbb..2b6e4aed1f 100644
--- a/libcore/dns_box.go
+++ b/libcore/dns_box.go
@@ -54,6 +54,15 @@ func (p *platformLocalDNSTransport) Close() error {
 	return nil
 }
 
+func (p *platformLocalDNSTransport) Reset() {
+}
+
+func (p *platformLocalDNSTransport) ExchangeAsync(ctx context.Context, message *mDNS.Msg, callback func(response *mDNS.Msg, err error)) {
+	go func() {
+		callback(p.Exchange(ctx, message))
+	}()
+}
+
 func (p *platformLocalDNSTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
 	if p.raw && rawQueryFunc != nil {
 		// Raw - Android 10 及以上才有
diff --git a/libcore/geoip.go b/libcore/geoip.go
index 6ea92d5649..ffdf216da8 100644
--- a/libcore/geoip.go
+++ b/libcore/geoip.go
@@ -3,12 +3,10 @@ package libcore
 import (
 	"fmt"
 	"net"
-	"path/filepath"
 	"strings"
 
 	"github.com/oschwald/maxminddb-golang"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/nekoutils"
 	"github.com/sagernet/sing-box/option"
 )
 
@@ -58,13 +56,5 @@ func (g *geoip) Rules(countryCode string) ([]option.HeadlessRule, error) {
 	}, nil
 }
 
-func init() {
-	nekoutils.GetGeoIPHeadlessRules = func(name string) ([]option.HeadlessRule, error) {
-		g := new(geoip)
-		if err := g.Open(filepath.Join(externalAssetsPath, "geoip.db")); err != nil {
-			return nil, err
-		}
-		defer g.geoipReader.Close()
-		return g.Rules(name)
-	}
-}
+// geoip reader kept for potential direct use; upstream sing-box 1.15 loads geoip
+// via its own resource manager using constant.resourcePaths.
diff --git a/libcore/geosite.go b/libcore/geosite.go
index 616edf13d2..d2537f6d85 100644
--- a/libcore/geosite.go
+++ b/libcore/geosite.go
@@ -2,11 +2,9 @@ package libcore
 
 import (
 	"fmt"
-	"path/filepath"
 
 	geosites "github.com/sagernet/sing-box/common/geosite"
 	C "github.com/sagernet/sing-box/constant"
-	"github.com/sagernet/sing-box/nekoutils"
 	"github.com/sagernet/sing-box/option"
 )
 
@@ -43,12 +41,5 @@ func (g *geosite) Rules(code string) ([]option.HeadlessRule, error) {
 	}, nil
 }
 
-func init() {
-	nekoutils.GetGeoSiteHeadlessRules = func(name string) ([]option.HeadlessRule, error) {
-		g := new(geosite)
-		if err := g.Open(filepath.Join(externalAssetsPath, "geosite.db")); err != nil {
-			return nil, err
-		}
-		return g.Rules(name)
-	}
-}
+// geosite reader kept for potential direct use; upstream sing-box 1.15 loads geosite
+// via its own resource manager using constant.resourcePaths.
diff --git a/libcore/go.mod b/libcore/go.mod
index b882350458..68d480c8f9 100644
--- a/libcore/go.mod
+++ b/libcore/go.mod
@@ -1,92 +1,96 @@
 module libcore
 
-go 1.24.7
-
-toolchain go1.24.9
+go 1.25.5
 
 require (
-	github.com/dyhkwong/sing-juicity v0.0.3
-	github.com/gofrs/uuid/v5 v5.4.0
+	github.com/exclavenetwork/sing-juicity v0.3.0
+	github.com/gofrs/uuid/v5 v5.5.1
 	github.com/matsuridayo/libneko v1.0.0 // replaced
-	github.com/miekg/dns v1.1.67
+	github.com/miekg/dns v1.1.72
 	github.com/oschwald/maxminddb-golang v1.13.1
-	github.com/sagernet/quic-go v0.52.0-sing-box-mod.3
-	github.com/sagernet/sing v0.7.18
+	github.com/sagernet/quic-go v0.61.0-sing-box-mod.7
+	github.com/sagernet/sing v0.9.4-0.20260908053243-3e69d072c058
 	github.com/sagernet/sing-box v1.0.0 // replaced
-	github.com/sagernet/sing-tun v0.7.10
+	github.com/sagernet/sing-tun v0.9.1-0.20260908051822-65ba32b917d5
 	github.com/ulikunitz/xz v0.5.15
 	golang.org/x/mobile v0.0.0-20231108233038-35478a0c49da
-	golang.org/x/sys v0.41.0
+	golang.org/x/sys v0.47.0
 )
 
 require (
 	github.com/ajg/form v1.5.1 // indirect
 	github.com/andybalholm/brotli v1.1.0 // indirect
-	github.com/anytls/sing-anytls v0.0.11 // indirect
-	github.com/caddyserver/certmagic v0.23.0 // indirect
-	github.com/caddyserver/zerossl v0.1.3 // indirect
+	github.com/caddyserver/certmagic v0.25.3-0.20260421143802-60d9d8b415d6 // indirect
+	github.com/caddyserver/zerossl v0.1.5 // indirect
 	github.com/cretz/bine v0.2.0 // indirect
+	github.com/database64128/netx-go v0.1.1 // indirect
+	github.com/database64128/tfo-go/v2 v2.3.2 // indirect
+	github.com/florianl/go-nfqueue/v2 v2.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-chi/chi/v5 v5.2.3 // indirect
+	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-chi/render v1.0.3 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gopacket v1.1.19 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
-	github.com/libdns/alidns v1.0.5-libdns.v1.beta1 // indirect
-	github.com/libdns/cloudflare v0.2.2-0.20250708034226-c574dccb31a6 // indirect
-	github.com/libdns/libdns v1.1.0 // indirect
+	github.com/huin/goupnp v1.3.0 // indirect
+	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.1 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/koron/go-ssdp v0.0.4 // indirect
+	github.com/libdns/acmedns v0.5.0 // indirect
+	github.com/libdns/alidns v1.0.6 // indirect
+	github.com/libdns/cloudflare v0.2.2 // indirect
+	github.com/libdns/libdns v1.1.1 // indirect
+	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138 // indirect
+	github.com/libp2p/go-netroute v0.2.1 // indirect
 	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
-	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
-	github.com/mdlayher/socket v0.5.1 // indirect
-	github.com/metacubex/chacha v0.1.5 // indirect
-	github.com/metacubex/mihomo v1.19.13 // indirect
-	github.com/metacubex/randv2 v0.2.0 // indirect
-	github.com/metacubex/sing v0.5.5 // indirect
-	github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0 // indirect
-	github.com/metacubex/utls v1.8.4 // indirect
-	github.com/mholt/acmez/v3 v3.1.2 // indirect
-	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a // indirect
+	github.com/mdlayher/netlink v1.11.2 // indirect
+	github.com/mdlayher/socket v0.6.0 // indirect
+	github.com/metacubex/utls v1.8.7 // indirect
+	github.com/mholt/acmez/v3 v3.1.6 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/sagernet/bbolt v0.0.0-20260823094646-e24805439c9c // indirect
 	github.com/sagernet/cors v1.2.1 // indirect
-	github.com/sagernet/fswatch v0.1.1 // indirect
-	github.com/sagernet/gvisor v0.0.0-20250325023245-7a9c0f5725fb // indirect
-	github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a // indirect
-	github.com/sagernet/nftables v0.3.0-beta.4 // indirect
-	github.com/sagernet/sing-mux v0.3.4 // indirect
-	github.com/sagernet/sing-quic v0.5.2 // indirect
+	github.com/sagernet/fswatch v0.1.2 // indirect
+	github.com/sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1 // indirect
+	github.com/sagernet/netlink v0.0.0-20260814022025-64455d367bbf // indirect
+	github.com/sagernet/nftables v0.3.0-mod.4 // indirect
+	github.com/sagernet/sing-anytls v0.0.0-20260904135308-cec2d74334be // indirect
+	github.com/sagernet/sing-mux v0.3.7-0.20260905054442-91d1502591ce // indirect
+	github.com/sagernet/sing-quic v0.7.1-0.20260904135313-497364e8ee3e // indirect
 	github.com/sagernet/sing-shadowsocks v0.2.8 // indirect
 	github.com/sagernet/sing-shadowsocks2 v0.2.1 // indirect
-	github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11 // indirect
-	github.com/sagernet/sing-snell v0.0.0-20260719094200-c43fbee0e839 // indirect
-	github.com/sagernet/sing-vmess v0.2.7 // indirect
+	github.com/sagernet/sing-shadowtls v0.2.1 // indirect
+	github.com/sagernet/sing-snell v0.0.0-20260904135315-bc5a12ac736f // indirect
+	github.com/sagernet/sing-usbip v0.0.0-20260817040617-28bd42667eca // indirect
+	github.com/sagernet/sing-vmess v0.2.8 // indirect
 	github.com/sagernet/smux v1.5.50-sing-box-mod.1 // indirect
-	github.com/sagernet/wireguard-go v0.0.1-beta.7 // indirect
+	github.com/sagernet/wireguard-go v0.0.5 // indirect
 	github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	gitlab.com/go-extension/aes-ccm v0.0.0-20230221065045-e58665ef23c7 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/mod v0.32.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.41.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 )
 
@@ -94,9 +98,11 @@ replace github.com/matsuridayo/libneko => ../../libneko
 
 replace github.com/sagernet/sing-box => ../../sing-box
 
-replace github.com/sagernet/sing-vmess => github.com/starifly/sing-vmess v0.2.8-mod.1
-
-replace github.com/sagernet/sing-snell => github.com/reF1nd/sing-snell v0.0.0-20260808134633-c120d40d0d5b
+// Protocol forks pinned by the previous 1.12.x branch are disabled for the
+// sing-box 1.15 upgrade. Re-enable only after confirming compatibility with
+// sing v0.9.4 / sing-quic v0.7.x.
+// replace github.com/sagernet/sing-vmess => github.com/starifly/sing-vmess v0.2.8-mod.1
+// replace github.com/sagernet/sing-snell => github.com/reF1nd/sing-snell v0.0.0-20260808134633-c120d40d0d5b
 
 // replace github.com/sagernet/sing-quic => github.com/matsuridayo/sing-quic v0.0.0-20241009042333-b49ce60d9b36
 // replace github.com/sagernet/sing-quic => ../../sing-quic
diff --git a/libcore/go.sum b/libcore/go.sum
index f97ec28070..5d38201822 100644
--- a/libcore/go.sum
+++ b/libcore/go.sum
@@ -1,29 +1,38 @@
+code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
+code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
 github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
 github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
 github.com/andybalholm/brotli v1.1.0 h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=
 github.com/andybalholm/brotli v1.1.0/go.mod h1:sms7XGricyQI9K10gOSf56VKKWS4oLer58Q+mhRPtnY=
-github.com/anytls/sing-anytls v0.0.11 h1:w8e9Uj1oP3m4zxkyZDewPk0EcQbvVxb7Nn+rapEx4fc=
-github.com/anytls/sing-anytls v0.0.11/go.mod h1:7rjN6IukwysmdusYsrV51Fgu1uW6vsrdd6ctjnEAln8=
-github.com/caddyserver/certmagic v0.23.0 h1:CfpZ/50jMfG4+1J/u2LV6piJq4HOfO6ppOnOf7DkFEU=
-github.com/caddyserver/certmagic v0.23.0/go.mod h1:9mEZIWqqWoI+Gf+4Trh04MOVPD0tGSxtqsxg87hAIH4=
-github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
-github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
+github.com/caddyserver/certmagic v0.25.3-0.20260421143802-60d9d8b415d6 h1:LYSB6VgWzKtNrcxElw3c97BP40Oc7bizKxA9K1Vi/5k=
+github.com/caddyserver/certmagic v0.25.3-0.20260421143802-60d9d8b415d6/go.mod h1:llW/CvsNmza8S6hmsuggsZeiX+uS27dkqY27wDIuBWg=
+github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
+github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cilium/ebpf v0.12.3 h1:8ht6F9MquybnY97at+VDZb3eQQr8ev79RueWeVaEcG4=
+github.com/cilium/ebpf v0.12.3/go.mod h1:TctK1ivibvI3znr66ljgi4hqOT8EYQjz1KWBfb1UVgM=
 github.com/cretz/bine v0.2.0 h1:8GiDRGlTgz+o8H9DSnsl+5MeBK4HsExxgl6WgzOCuZo=
 github.com/cretz/bine v0.2.0/go.mod h1:WU4o9QR9wWp8AVKtTM1XD5vUHkEqnf2vVSo6dBqbetI=
+github.com/database64128/netx-go v0.1.1 h1:dT5LG7Gs7zFZBthFBbzWE6K8wAHjSNAaK7wCYZT7NzM=
+github.com/database64128/netx-go v0.1.1/go.mod h1:LNlYVipaYkQArRFDNNJ02VkNV+My9A5XR/IGS7sIBQc=
+github.com/database64128/tfo-go/v2 v2.3.2 h1:UhZMKiMq3swZGUiETkLBDzQnZBPSAeBMClpJGlnJ5Fw=
+github.com/database64128/tfo-go/v2 v2.3.2/go.mod h1:GC3uB5oa4beGpCUbRb2ZOWP73bJJFmMyAVgQSO7r724=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dyhkwong/sing-juicity v0.0.3 h1:nm+dIlN9DlapXjajXdI7DxoCjrqtF4GRySLqQhwuqDk=
-github.com/dyhkwong/sing-juicity v0.0.3/go.mod h1:6rw3r0kaQCdujDdug3vS/8R7Ym8Db4rnOrPJBFah98U=
+github.com/exclavenetwork/sing-juicity v0.3.0 h1:DE9dAg82VR61MWXdrXUoNVKuRpkyfnbNOw8DxGyinCc=
+github.com/exclavenetwork/sing-juicity v0.3.0/go.mod h1:SNBD9qD+SR1RubUcIO6HXbx+5kvIu7ieEFeuAndzX/8=
+github.com/florianl/go-nfqueue/v2 v2.1.0 h1:Fywt30TY/evxyDySpXjxQ1jsRW7nQbLpOhELqpr4068=
+github.com/florianl/go-nfqueue/v2 v2.1.0/go.mod h1:8PKUM5rYoVFO5IZV1bifx4/b0jHAglKkHXr9PRwzi4Y=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
-github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
+github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
 github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
@@ -32,102 +41,115 @@ github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gofrs/uuid/v5 v5.4.0 h1:EfbpCTjqMuGyq5ZJwxqzn3Cbr2d0rUZU7v5ycAk/e/0=
-github.com/gofrs/uuid/v5 v5.4.0/go.mod h1:CDOjlDMVAtN56jqyRUZh58JT31Tiw7/oQyEXZV+9bD8=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/gofrs/uuid/v5 v5.5.1 h1:z1Ce19/JwNidXpy3tOQc3241lnJLKdKyq/xlNvlD4Ng=
+github.com/gofrs/uuid/v5 v5.5.1/go.mod h1:bbAA98EoIlxyRHIVg6ektCSsZ5n8mSbwgEhvhMYlZgg=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
+github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
 github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/libdns/alidns v1.0.5-libdns.v1.beta1 h1:txHK7UxDed3WFBDjrTZPuMn8X+WmhjBTTAMW5xdy5pQ=
-github.com/libdns/alidns v1.0.5-libdns.v1.beta1/go.mod h1:ystHmPwcGoWjPrGpensQSMY9VoCx4cpR2hXNlwk9H/g=
-github.com/libdns/cloudflare v0.2.2-0.20250708034226-c574dccb31a6 h1:3MGrVWs2COjMkQR17oUw1zMIPbm2YAzxDC3oGVZvQs8=
-github.com/libdns/cloudflare v0.2.2-0.20250708034226-c574dccb31a6/go.mod h1:w9uTmRCDlAoafAsTPnn2nJ0XHK/eaUMh86DUk8BWi60=
-github.com/libdns/libdns v1.0.0-beta.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
-github.com/libdns/libdns v1.1.0 h1:9ze/tWvt7Df6sbhOJRB8jT33GHEHpEQXdtkE3hPthbU=
-github.com/libdns/libdns v1.1.0/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/huin/goupnp v1.3.0 h1:UvLUlWDNpoUdYzb2TCn+MuTWtcjXKSza2n6CBdQ0xXc=
+github.com/huin/goupnp v1.3.0/go.mod h1:gnGPsThkYa7bFi/KWmEysQRf48l2dvR5bxr2OFckNX8=
+github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
+github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/jsimonetti/rtnetlink v1.4.1 h1:JfD4jthWBqZMEffc5RjgmlzpYttAVw1sdnmiNaPO3hE=
+github.com/jsimonetti/rtnetlink v1.4.1/go.mod h1:xJjT7t59UIZ62GLZbv6PLLo8VFrostJMPBAheR6OM8w=
+github.com/jsimonetti/rtnetlink/v2 v2.2.0 h1:/KfZ310gOAFrXXol5VwnFEt+ucldD/0dsSRZwpHCP9w=
+github.com/jsimonetti/rtnetlink/v2 v2.2.0/go.mod h1:lbjDHxC+5RJ08lzPeA90Ls2pEoId3F08MoEMlhfHxeI=
+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
+github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
+github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
+github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
+github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
+github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
+github.com/libdns/acmedns v0.5.0 h1:5pRtmUj4Lb/QkNJSl1xgOGBUJTWW7RjpNaIhjpDXjPE=
+github.com/libdns/acmedns v0.5.0/go.mod h1:X7UAFP1Ep9NpTwWpVlrZzJLR7epynAy0wrIxSPFgKjQ=
+github.com/libdns/alidns v1.0.6 h1:/Ii428ty6WHFJmE24rZxq2taq++gh7rf9jhgLfp8PmM=
+github.com/libdns/alidns v1.0.6/go.mod h1:RECwyQ88e9VqQVtSrvX76o1ux3gQUKGzMgxICi+u7Ec=
+github.com/libdns/cloudflare v0.2.2 h1:XWHv+C1dDcApqazlh08Q6pjytYLgR2a+Y3xrXFu0vsI=
+github.com/libdns/cloudflare v0.2.2/go.mod h1:w9uTmRCDlAoafAsTPnn2nJ0XHK/eaUMh86DUk8BWi60=
+github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
+github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138 h1:YohuNPT/1k3VcThCQlBZ43PCPWPfMRS1zcxWBF2SLK8=
+github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138/go.mod h1:TXQg5tfSy+bUjnhT5728j5j/MBj7keIYqqZ1+8k/ui8=
+github.com/libp2p/go-netroute v0.2.1 h1:V8kVrpD8GK0Riv15/7VN6RbUQ3URNZVosw7H2v9tksU=
+github.com/libp2p/go-netroute v0.2.1/go.mod h1:hraioZr0fhBjG0ZRXJJ6Zj2IVEVNx6tDTFQfSmcq7mQ=
 github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczGlG91VSDkswnjF5A8=
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
-github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 h1:A1Cq6Ysb0GM0tpKMbdCXCIfBclan4oHk1Jb+Hrejirg=
-github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42/go.mod h1:BB4YCPDOzfy7FniQ/lxuYQ3dgmM2cZumHbK8RpTjN2o=
-github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
-github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
-github.com/metacubex/chacha v0.1.5 h1:fKWMb/5c7ZrY8Uoqi79PPFxl+qwR7X/q0OrsAubyX2M=
-github.com/metacubex/chacha v0.1.5/go.mod h1:Djn9bPZxLTXbJFSeyo0/qzEzQI+gUSSzttuzZM75GH8=
-github.com/metacubex/mihomo v1.19.13 h1:tpW9UMO+HSW5G3cdOA2gjr1zl0YOaDNf8UVqEqAtkm4=
-github.com/metacubex/mihomo v1.19.13/go.mod h1:xamCOLvelri611bvRkcl+WpVdcc+7EgkEXRLBWUTqAo=
-github.com/metacubex/randv2 v0.2.0 h1:uP38uBvV2SxYfLj53kuvAjbND4RUDfFJjwr4UigMiLs=
-github.com/metacubex/randv2 v0.2.0/go.mod h1:kFi2SzrQ5WuneuoLLCMkABtiBu6VRrMrWFqSPyj2cxY=
-github.com/metacubex/sing v0.5.5 h1:m5U8iHvRAUxlme3FZlE/LPIGHjU8oMCUzXWGbQQAC1E=
-github.com/metacubex/sing v0.5.5/go.mod h1:ypf0mjwlZm0sKdQSY+yQvmsbWa0hNPtkeqyRMGgoN+w=
-github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0 h1:Ui+/2s5Qz0lSnDUBmEL12M5Oi/PzvFxGTNohm8ZcsmE=
-github.com/metacubex/tfo-go v0.0.0-20250921095601-b102db4216c0/go.mod h1:l9oLnLoEXyGZ5RVLsh7QCC5XsouTUyKk4F2nLm2DHLw=
-github.com/metacubex/utls v1.8.4 h1:HmL9nUApDdWSkgUyodfwF6hSjtiwCGGdyhaSpEejKpg=
-github.com/metacubex/utls v1.8.4/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
-github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
-github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
-github.com/miekg/dns v1.1.67 h1:kg0EHj0G4bfT5/oOys6HhZw4vmMlnoZ+gDu8tJ/AlI0=
-github.com/miekg/dns v1.1.67/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/mdlayher/netlink v1.11.2 h1:HKh2jqe+omdSWcQ88nrT7INE61B0NXfiSPFdgL4YbNI=
+github.com/mdlayher/netlink v1.11.2/go.mod h1:uT2Yc/QLaZubzDpZIBi9d4GoeLwtp3x1AMeqSRrK2sA=
+github.com/mdlayher/socket v0.6.0 h1:ScZPaAGyO1icQnbFrhPM8mnXyMu9qukC1K4ZoM2IQKU=
+github.com/mdlayher/socket v0.6.0/go.mod h1:q7vozUAnxSqnjHc12Fik5yUKIzfZ8ITCfMkhOtE9z18=
+github.com/metacubex/utls v1.8.7 h1:Cp+yWkNTFkSihETgGWq34hlVFds5HpYWVOR1xovUVTs=
+github.com/metacubex/utls v1.8.7/go.mod h1:kncGGVhFaoGn5M3pFe3SXhZCzsbCJayNOH4UEqTKTko=
+github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
+github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5MbwsmL4MRQE=
 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/reF1nd/sing-snell v0.0.0-20260808134633-c120d40d0d5b h1:92LdMz8cEGbhL/09l3KpsO4rF94VqH/ZK+Ey4HvtW54=
-github.com/reF1nd/sing-snell v0.0.0-20260808134633-c120d40d0d5b/go.mod h1:KVhUab4T1LXivZtOPzhqEJo29araU9mp9YtMeiGPY8k=
-github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a h1:+NkI2670SQpQWvkkD2QgdTuzQG263YZ+2emfpeyGqW0=
-github.com/sagernet/bbolt v0.0.0-20231014093535-ea5cb2fe9f0a/go.mod h1:63s7jpZqcDAIpj8oI/1v4Izok+npJOHACFCU6+huCkM=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/sagernet/bbolt v0.0.0-20260823094646-e24805439c9c h1:JdEDkgiwsDxiZb4+dQYgVOU/lND+jZxFmN5y/q49EXk=
+github.com/sagernet/bbolt v0.0.0-20260823094646-e24805439c9c/go.mod h1:7/qFPFH5fqK5XQeY8EA1Qpaly08Av77p38Zt50ieQww=
 github.com/sagernet/cors v1.2.1 h1:Cv5Z8y9YSD6Gm+qSpNrL3LO4lD3eQVvbFYJSG7JCMHQ=
 github.com/sagernet/cors v1.2.1/go.mod h1:O64VyOjjhrkLmQIjF4KGRrJO/5dVXFdpEmCW/eISRAI=
-github.com/sagernet/fswatch v0.1.1 h1:YqID+93B7VRfqIH3PArW/XpJv5H4OLEVWDfProGoRQs=
-github.com/sagernet/fswatch v0.1.1/go.mod h1:nz85laH0mkQqJfaOrqPpkwtU1znMFNVTpT/5oRsVz/o=
-github.com/sagernet/gvisor v0.0.0-20250325023245-7a9c0f5725fb h1:pprQtDqNgqXkRsXn+0E8ikKOemzmum8bODjSfDene38=
-github.com/sagernet/gvisor v0.0.0-20250325023245-7a9c0f5725fb/go.mod h1:QkkPEJLw59/tfxgapHta14UL5qMUah5NXhO0Kw2Kan4=
-github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a h1:ObwtHN2VpqE0ZNjr6sGeT00J8uU7JF4cNUdb44/Duis=
-github.com/sagernet/netlink v0.0.0-20240612041022-b9a21c07ac6a/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
-github.com/sagernet/nftables v0.3.0-beta.4 h1:kbULlAwAC3jvdGAC1P5Fa3GSxVwQJibNenDW2zaXr8I=
-github.com/sagernet/nftables v0.3.0-beta.4/go.mod h1:OQXAjvjNGGFxaTgVCSTRIhYB5/llyVDeapVoENYBDS8=
-github.com/sagernet/quic-go v0.52.0-sing-box-mod.3 h1:ySqffGm82rPqI1TUPqmtHIYd12pfEGScygnOxjTL56w=
-github.com/sagernet/quic-go v0.52.0-sing-box-mod.3/go.mod h1:OV+V5kEBb8kJS7k29MzDu6oj9GyMc7HA07sE1tedxz4=
-github.com/sagernet/sing v0.7.18 h1:iZHkaru1/MoHugx3G+9S3WG4owMewKO/KvieE2Pzk4E=
-github.com/sagernet/sing v0.7.18/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
-github.com/sagernet/sing-mux v0.3.4 h1:ZQplKl8MNXutjzbMVtWvWG31fohhgOfCuUZR4dVQ8+s=
-github.com/sagernet/sing-mux v0.3.4/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
-github.com/sagernet/sing-quic v0.5.2 h1:I3vlfRImhr0uLwRS3b3ib70RMG9FcXtOKKUDz3eKRWc=
-github.com/sagernet/sing-quic v0.5.2/go.mod h1:evP1e++ZG8TJHVV5HudXV4vWeYzGfCdF4HwSJZcdqkI=
+github.com/sagernet/fswatch v0.1.2 h1:/TT7k4mkce1qFPxamLO842WjqBgbTBiXP2mlUjp9PFk=
+github.com/sagernet/fswatch v0.1.2/go.mod h1:5BpGmpUQVd3Mc5r313HRpvADHRg3/rKn5QbwFteB880=
+github.com/sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1 h1:IdQ7yTKkB2wv8txwshxUroPlO4npOYAV71xb7xQ7Lys=
+github.com/sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1/go.mod h1:9O3SQskYuCfdHNvHEsWuEAgoyKEF74PiWp4NsNUia8g=
+github.com/sagernet/netlink v0.0.0-20260814022025-64455d367bbf h1:b/3rm+KvxzuYRcnMdLq/hmcqX6/2B8k24l6SDHL2Piw=
+github.com/sagernet/netlink v0.0.0-20260814022025-64455d367bbf/go.mod h1:xLnfdiJbSp8rNqYEdIW/6eDO4mVoogml14Bh2hSiFpM=
+github.com/sagernet/nftables v0.3.0-mod.4 h1:vnOtcDYeSXv2e5RoRuGH0lrpttQFJ8iC4ICS2nhlDSo=
+github.com/sagernet/nftables v0.3.0-mod.4/go.mod h1:8kslHG4VvYNihcco+i6uxIX7qbT8A56T0y5q7U44ZaQ=
+github.com/sagernet/quic-go v0.61.0-sing-box-mod.7 h1:sW2O+DoNF+my1PGlSZ3zG2N+fdxLR3DC0l4sXCM0lBE=
+github.com/sagernet/quic-go v0.61.0-sing-box-mod.7/go.mod h1:hmLC8GJPp+BrpBgrgJnacvI4fZGIhasuy1ROJJ8GR4E=
+github.com/sagernet/sing v0.9.4-0.20260908053243-3e69d072c058 h1:YcCNrxFtdKao5BG3E99+vCUKMT+LphVUSTgMKczy84Q=
+github.com/sagernet/sing v0.9.4-0.20260908053243-3e69d072c058/go.mod h1:K3Owt3xPhHugvlnlPPxZJ/exXdaJfEPOTNorGk4AXjo=
+github.com/sagernet/sing-anytls v0.0.0-20260904135308-cec2d74334be h1:0uMXu8kcJU0XLc2vfjGH6q6khmECCc5WYpD9dqlu1Xg=
+github.com/sagernet/sing-anytls v0.0.0-20260904135308-cec2d74334be/go.mod h1:VRKLnj0ObEsN228h+zuzf91p+6sjtYE8SBaLPVsBy5o=
+github.com/sagernet/sing-mux v0.3.7-0.20260905054442-91d1502591ce h1:ay1pGbzMF4e7iggj+uESNhwMNPbZZajDghcdC4P92Dc=
+github.com/sagernet/sing-mux v0.3.7-0.20260905054442-91d1502591ce/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
+github.com/sagernet/sing-quic v0.7.1-0.20260904135313-497364e8ee3e h1:2r0FRN0DBSfggWYtdH/69uW91kqEOByBWw/5hiCq6qU=
+github.com/sagernet/sing-quic v0.7.1-0.20260904135313-497364e8ee3e/go.mod h1:rJFeVxbEej2iuyeCJ3drKW+p5rOgtLIW3XhZ6ty7Fig=
 github.com/sagernet/sing-shadowsocks v0.2.8 h1:PURj5PRoAkqeHh2ZW205RWzN9E9RtKCVCzByXruQWfE=
 github.com/sagernet/sing-shadowsocks v0.2.8/go.mod h1:lo7TWEMDcN5/h5B8S0ew+r78ZODn6SwVaFhvB6H+PTI=
 github.com/sagernet/sing-shadowsocks2 v0.2.1 h1:dWV9OXCeFPuYGHb6IRqlSptVnSzOelnqqs2gQ2/Qioo=
 github.com/sagernet/sing-shadowsocks2 v0.2.1/go.mod h1:RnXS0lExcDAovvDeniJ4IKa2IuChrdipolPYWBv9hWQ=
-github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11 h1:tK+75l64tm9WvEFrYRE1t0YxoFdWQqw/h7Uhzj0vJ+w=
-github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11/go.mod h1:sWqKnGlMipCHaGsw1sTTlimyUpgzP4WP3pjhCsYt9oA=
-github.com/sagernet/sing-tun v0.7.10 h1:lLBaS9uL0mK/FCGDe3N4oKQxjMGfmv3u2/6jKtmq4Pw=
-github.com/sagernet/sing-tun v0.7.10/go.mod h1:pUEjh9YHQ2gJT6Lk0TYDklh3WJy7lz+848vleGM3JPM=
+github.com/sagernet/sing-shadowtls v0.2.1 h1:ZiHZdnEnP+YS73NMsxiZmIFCwNd0M4k7PkGCKNXhbaM=
+github.com/sagernet/sing-shadowtls v0.2.1/go.mod h1:sWqKnGlMipCHaGsw1sTTlimyUpgzP4WP3pjhCsYt9oA=
+github.com/sagernet/sing-snell v0.0.0-20260904135315-bc5a12ac736f h1:tbTCI+iis5sTmua7a6Q7vebcSRURok/LGgnEafnQAsc=
+github.com/sagernet/sing-snell v0.0.0-20260904135315-bc5a12ac736f/go.mod h1:et8Lws4f5QbOrY65DmjevHGup3mijJkhswkto6cwciM=
+github.com/sagernet/sing-tun v0.9.1-0.20260908051822-65ba32b917d5 h1:mrKvRpBL3kb1P2zmfL5T2RRue/iO4aeTslV83dUQzIQ=
+github.com/sagernet/sing-tun v0.9.1-0.20260908051822-65ba32b917d5/go.mod h1:kCw7pD7VnxuTsoEyU7uSI1b01w1rbyuUJKYqwlR9qtc=
+github.com/sagernet/sing-usbip v0.0.0-20260817040617-28bd42667eca h1:5wA+IE0Fq1CGVLOgSpm0gKKZ03HzugcJ2JyhmDqeX6A=
+github.com/sagernet/sing-usbip v0.0.0-20260817040617-28bd42667eca/go.mod h1:ADAZZU85MnM91XNhd2TdZRTaIbA7RjTZuQ1KCHcUbNg=
+github.com/sagernet/sing-vmess v0.2.8 h1:xd5nnDOMlC76RgrLksS4jlk3eMt3c3CvQY3NsjWPWeI=
+github.com/sagernet/sing-vmess v0.2.8/go.mod h1:P11scgTxMxVVQ8dlM27yNm3Cro40mD0+gHbnqrNGDuY=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1 h1:XkJcivBC9V4wBjiGXIXZ229aZCU1hzcbp6kSkkyQ478=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1/go.mod h1:NjhsCEWedJm7eFLyhuBgIEzwfhRmytrUoiLluxs5Sk8=
-github.com/sagernet/wireguard-go v0.0.1-beta.7 h1:ltgBwYHfr+9Wz1eG59NiWnHrYEkDKHG7otNZvu85DXI=
-github.com/sagernet/wireguard-go v0.0.1-beta.7/go.mod h1:jGXij2Gn2wbrWuYNUmmNhf1dwcZtvyAvQoe8Xd8MbUo=
+github.com/sagernet/wireguard-go v0.0.5 h1:FLoxIfX8bcedFqn3Yfop7tJNQV1NeMNRZ/9LQLQdKvU=
+github.com/sagernet/wireguard-go v0.0.5/go.mod h1:er10sELpmzLXq7S7Pbc1Zsbyapcr+/gxNAHKTo6fzVA=
 github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854 h1:6uUiZcDRnZSAegryaUGwPC/Fj13JSHwiTftrXhMmYOc=
 github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854/go.mod h1:LtfoSK3+NG57tvnVEHgcuBW9ujgE8enPSgzgwStwCAA=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/starifly/sing-vmess v0.2.8-mod.1 h1:FnSQ8t2psjiCuAQ7I2VDHGdiQBguOKEi/DTn8GooDYE=
-github.com/starifly/sing-vmess v0.2.8-mod.1/go.mod h1:P11scgTxMxVVQ8dlM27yNm3Cro40mD0+gHbnqrNGDuY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
+github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
@@ -138,72 +160,84 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
 github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-gitlab.com/go-extension/aes-ccm v0.0.0-20230221065045-e58665ef23c7 h1:UNrDfkQqiEYzdMlNsVvBYOAJWZjdktqFE9tQh5BT2+4=
-gitlab.com/go-extension/aes-ccm v0.0.0-20230221065045-e58665ef23c7/go.mod h1:E+rxHvJG9H6PUdzq9NRG6csuLN3XUx98BfGOVWNYnXs=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
-go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20231108233038-35478a0c49da h1:gS9sVMAeHM+gVBmM9bTM6vUi/NHv58O3QzJ3vjjN84M=
 golang.org/x/mobile v0.0.0-20231108233038-35478a0c49da/go.mod h1:IEceR0jfVklLJXrbUe90rfdAFAYDW0SQwKl4qvO1GBQ=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463 h1:e0AIkUUhxyBKh6ssZNrAMeqhA7RKUj42346d1y02i2g=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250324211829-b45e905df463/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
-google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
+google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/libcore/interface_monitor.go b/libcore/interface_monitor.go
index 0167666e76..48687ec7df 100644
--- a/libcore/interface_monitor.go
+++ b/libcore/interface_monitor.go
@@ -43,3 +43,7 @@ func (s *interfaceMonitorStub) RegisterMyInterface(interfaceName string) {
 func (s *interfaceMonitorStub) MyInterface() string {
 	return ""
 }
+
+func (s *interfaceMonitorStub) MyInterfaces() []string {
+	return nil
+}
diff --git a/libcore/nb4a.go b/libcore/nb4a.go
index cfa1e7824d..1515293a7a 100644
--- a/libcore/nb4a.go
+++ b/libcore/nb4a.go
@@ -1,7 +1,6 @@
 package libcore
 
 import (
-	"fmt"
 	"libcore/device"
 	"os"
 	"path/filepath"
@@ -13,9 +12,7 @@ import (
 
 	"github.com/matsuridayo/libneko/neko_common"
 	"github.com/matsuridayo/libneko/neko_log"
-	"github.com/sagernet/sing-box/nekoutils"
 	"github.com/sagernet/sing-box/option"
-	"golang.org/x/sys/unix"
 )
 
 //go:linkname resourcePaths github.com/sagernet/sing-box/constant.resourcePaths
@@ -64,9 +61,6 @@ func InitCore(process, cachePath, internalAssets, externalAssets string,
 	neko_log.TruncateOnStart = isBgProcess
 	neko_log.SetupLog(int(maxLogSizeKb)*1024, filepath.Join(cachePath, "neko.log"))
 
-	// nekoutils
-	nekoutils.Selector_OnProxySelected = intfNB4A.Selector_OnProxySelected
-
 	// Set up some component
 	go func() {
 		defer device.DeferPanicToError("InitCore-go", func(err error) { log.Println(err) })
@@ -85,36 +79,4 @@ func InitCore(process, cachePath, internalAssets, externalAssets string,
 	}()
 }
 
-func sendFdToProtect(fd int, path string) error {
-	socketFd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_STREAM, 0)
-	if err != nil {
-		return fmt.Errorf("failed to create unix socket: %w", err)
-	}
-	defer unix.Close(socketFd)
-
-	var timeout unix.Timeval
-	timeout.Usec = 100 * 1000
-
-	_ = unix.SetsockoptTimeval(socketFd, unix.SOL_SOCKET, unix.SO_RCVTIMEO, &timeout)
-	_ = unix.SetsockoptTimeval(socketFd, unix.SOL_SOCKET, unix.SO_SNDTIMEO, &timeout)
-
-	err = unix.Connect(socketFd, &unix.SockaddrUnix{Name: path})
-	if err != nil {
-		return fmt.Errorf("failed to connect: %w", err)
-	}
-
-	err = unix.Sendmsg(socketFd, nil, unix.UnixRights(fd), nil, 0)
-	if err != nil {
-		return fmt.Errorf("failed to send: %w", err)
-	}
-
-	dummy := []byte{1}
-	n, err := unix.Read(socketFd, dummy)
-	if err != nil {
-		return fmt.Errorf("failed to receive: %w", err)
-	}
-	if n != 1 {
-		return fmt.Errorf("socket closed unexpectedly")
-	}
-	return nil
-}
+// sendFdToProtect is platform-specific (see sendfd_unix.go / sendfd_other.go).
diff --git a/libcore/platform_box.go b/libcore/platform_box.go
index 316cbef581..ff57f76953 100644
--- a/libcore/platform_box.go
+++ b/libcore/platform_box.go
@@ -2,9 +2,7 @@ package libcore
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
-	"fmt"
 	"libcore/procfs"
 	"log"
 	"net/netip"
@@ -13,8 +11,6 @@ import (
 
 	"github.com/matsuridayo/libneko/neko_log"
 	"github.com/sagernet/sing-box/adapter"
-	"github.com/sagernet/sing-box/common/process"
-	"github.com/sagernet/sing-box/experimental/libbox/platform"
 	sblog "github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
 	tun "github.com/sagernet/sing-tun"
@@ -23,18 +19,10 @@ import (
 	N "github.com/sagernet/sing/common/network"
 )
 
-var boxPlatformInterfaceInstance platform.Interface = &boxPlatformInterfaceWrapper{}
+var boxPlatformInterfaceInstance adapter.PlatformInterface = &boxPlatformInterfaceWrapper{}
 
 type boxPlatformInterfaceWrapper struct{}
 
-func (w *boxPlatformInterfaceWrapper) ReadWIFIState() adapter.WIFIState {
-	state := strings.Split(intfBox.WIFIState(), ",")
-	return adapter.WIFIState{
-		SSID:  state[0],
-		BSSID: state[1],
-	}
-}
-
 func (w *boxPlatformInterfaceWrapper) Initialize(n adapter.NetworkManager) error {
 	return nil
 }
@@ -53,30 +41,11 @@ func (w *boxPlatformInterfaceWrapper) AutoDetectInterfaceControl(fd int) error {
 	return intfBox.AutoDetectInterfaceControl(int32(fd))
 }
 
-func (w *boxPlatformInterfaceWrapper) OpenTun(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error) {
-	if len(options.IncludeUID) > 0 || len(options.ExcludeUID) > 0 {
-		return nil, E.New("android: unsupported uid options")
-	}
-	if len(options.IncludeAndroidUser) > 0 {
-		return nil, E.New("android: unsupported android_user option")
-	}
-	a, _ := json.Marshal(options)
-	b, _ := json.Marshal(platformOptions)
-	tunFd, err := intfBox.OpenTun(string(a), string(b))
-	if err != nil {
-		return nil, fmt.Errorf("intfBox.OpenTun: %v", err)
-	}
-	// Do you want to close it?
-	tunFd, err = syscall.Dup(tunFd)
-	if err != nil {
-		return nil, fmt.Errorf("syscall.Dup: %v", err)
-	}
-	//
-	options.FileDescriptor = int(tunFd)
-	return tun.New(*options)
+func (w *boxPlatformInterfaceWrapper) UsePlatformInterface() bool {
+	return true
 }
 
-func (w *boxPlatformInterfaceWrapper) CloseTun() error {
+func (w *boxPlatformInterfaceWrapper) ProcessPlatformOptions(options option.TunPlatformOptions) error {
 	return nil
 }
 
@@ -88,62 +57,155 @@ func (w *boxPlatformInterfaceWrapper) CreateDefaultInterfaceMonitor(l logger.Log
 	return &interfaceMonitorStub{}
 }
 
-func (w *boxPlatformInterfaceWrapper) UsePlatformInterfaceGetter() bool {
+func (w *boxPlatformInterfaceWrapper) UsePlatformNetworkInterfaces() bool {
 	return false
 }
 
-func (w *boxPlatformInterfaceWrapper) Interfaces() ([]adapter.NetworkInterface, error) {
-	return nil, errors.New("wtf")
+func (w *boxPlatformInterfaceWrapper) NetworkInterfaces() ([]adapter.NetworkInterface, error) {
+	return nil, errors.New("android: network interfaces not available")
 }
 
-func (w *boxPlatformInterfaceWrapper) IncludeAllNetworks() bool {
+func (w *boxPlatformInterfaceWrapper) UnderNetworkExtension() bool {
 	return false
 }
 
-func (w *boxPlatformInterfaceWrapper) SendNotification(notification *platform.Notification) error {
-	return nil
+func (w *boxPlatformInterfaceWrapper) NetworkExtensionIncludeAllNetworks() bool {
+	return false
 }
 
-func (s *boxPlatformInterfaceWrapper) SystemCertificates() []string {
-	return nil
+func (w *boxPlatformInterfaceWrapper) ClearDNSCache() {
 }
 
-// Android not using
-
-func (w *boxPlatformInterfaceWrapper) UnderNetworkExtension() bool {
-	return false
+func (w *boxPlatformInterfaceWrapper) RequestPermissionForWIFIState() error {
+	return nil
 }
 
-func (w *boxPlatformInterfaceWrapper) ClearDNSCache() {
+func (w *boxPlatformInterfaceWrapper) ReadWIFIState(ctx context.Context) adapter.WIFIState {
+	state := strings.Split(intfBox.WIFIState(), ",")
+	return adapter.WIFIState{
+		SSID:  state[0],
+		BSSID: state[1],
+	}
 }
 
-// process.Searcher
+func (w *boxPlatformInterfaceWrapper) UsePlatformConnectionOwnerFinder() bool {
+	return true
+}
 
-func (w *boxPlatformInterfaceWrapper) FindProcessInfo(ctx context.Context, network string, source netip.AddrPort, destination netip.AddrPort) (*process.Info, error) {
+func (w *boxPlatformInterfaceWrapper) FindConnectionOwner(request *adapter.FindConnectionOwnerRequest) (*adapter.ConnectionOwner, error) {
 	var uid int32
 	if useProcfs {
+		sourceAddr, err := netip.ParseAddr(request.SourceAddress)
+		if err != nil {
+			return nil, err
+		}
+		destinationAddr, err := netip.ParseAddr(request.DestinationAddress)
+		if err != nil {
+			return nil, err
+		}
+		source := netip.AddrPortFrom(sourceAddr, uint16(request.SourcePort))
+		destination := netip.AddrPortFrom(destinationAddr, uint16(request.DestinationPort))
+		var network string
+		switch request.IpProtocol {
+		case syscall.IPPROTO_TCP:
+			network = N.NetworkTCP
+		case syscall.IPPROTO_UDP:
+			network = N.NetworkUDP
+		default:
+			return nil, E.New("unknown ip protocol: ", request.IpProtocol)
+		}
 		uid = procfs.ResolveSocketByProcSearch(network, source, destination)
 		if uid == -1 {
 			return nil, E.New("procfs: not found")
 		}
 	} else {
-		var ipProtocol int32
-		switch N.NetworkName(network) {
-		case N.NetworkTCP:
-			ipProtocol = syscall.IPPROTO_TCP
-		case N.NetworkUDP:
-			ipProtocol = syscall.IPPROTO_UDP
-		default:
-			return nil, E.New("unknown network: ", network)
-		}
 		var err error
-		uid, err = intfBox.FindConnectionOwner(ipProtocol, source.Addr().String(), int32(source.Port()), destination.Addr().String(), int32(destination.Port()))
+		uid, err = intfBox.FindConnectionOwner(request.IpProtocol, request.SourceAddress, request.SourcePort, request.DestinationAddress, request.DestinationPort)
 		if err != nil {
 			return nil, err
 		}
 	}
 	packageName, _ := intfBox.PackageNameByUid(uid)
-	return &process.Info{UserId: uid, PackageName: packageName}, nil
+	return &adapter.ConnectionOwner{
+		UserId:       uid,
+		PackageNames: []string{packageName},
+	}, nil
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformWIFIMonitor() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformNotification() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) SendNotification(notification *adapter.Notification) error {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) CancelNotification(identifier string, typeID int32) error {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) MyInterfaceAddress() []netip.Addr {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformNeighborResolver() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) StartNeighborMonitor(listener adapter.NeighborUpdateListener) error {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) CloseNeighborMonitor(listener adapter.NeighborUpdateListener) error {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformShell() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) CheckPlatformShell() error {
+	return nil
+}
+
+func (w *boxPlatformInterfaceWrapper) OpenShellSession(user *adapter.PlatformUser, command string, env []string, term string, rows int32, cols int32) (adapter.ShellSession, error) {
+	return nil, E.New("android: shell session not supported")
+}
+
+func (w *boxPlatformInterfaceWrapper) LookupUser(username string) (*adapter.PlatformUser, error) {
+	return nil, E.New("android: user lookup not supported")
+}
+
+func (w *boxPlatformInterfaceWrapper) LookupSFTPServer() (string, error) {
+	return "", nil
+}
+
+func (w *boxPlatformInterfaceWrapper) ReadSystemSSHHostKey() ([]byte, error) {
+	return nil, nil
+}
+
+func (w *boxPlatformInterfaceWrapper) TailscaleHostname() string {
+	return ""
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformBridge() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) CreateBridge(options adapter.BridgeOptions) (adapter.BridgeSession, error) {
+	return nil, E.New("android: bridge not supported")
+}
+
+func (w *boxPlatformInterfaceWrapper) UsePlatformAutoRedirect() bool {
+	return false
+}
+
+func (w *boxPlatformInterfaceWrapper) CreateAutoRedirect(options adapter.AutoRedirectOptions) (adapter.AutoRedirectSession, error) {
+	return nil, E.New("android: auto redirect not supported")
 }
 
 // io.Writer
diff --git a/libcore/platform_box_other.go b/libcore/platform_box_other.go
new file mode 100644
index 0000000000..05faf5572a
--- /dev/null
+++ b/libcore/platform_box_other.go
@@ -0,0 +1,16 @@
+//go:build !unix
+
+package libcore
+
+import (
+	"errors"
+
+	"github.com/sagernet/sing-box/option"
+	tun "github.com/sagernet/sing-tun"
+)
+
+func (w *boxPlatformInterfaceWrapper) OpenInterface(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error) {
+	_ = options
+	_ = platformOptions
+	return nil, errors.New("OpenInterface is not supported on this platform")
+}
diff --git a/libcore/platform_box_unix.go b/libcore/platform_box_unix.go
new file mode 100644
index 0000000000..69f75997d0
--- /dev/null
+++ b/libcore/platform_box_unix.go
@@ -0,0 +1,36 @@
+//go:build unix
+
+package libcore
+
+import (
+	"encoding/json"
+	"fmt"
+	"syscall"
+
+	"github.com/sagernet/sing-box/option"
+	tun "github.com/sagernet/sing-tun"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+func (w *boxPlatformInterfaceWrapper) OpenInterface(options *tun.Options, platformOptions option.TunPlatformOptions) (tun.Tun, error) {
+	if len(options.IncludeUID) > 0 || len(options.ExcludeUID) > 0 {
+		return nil, E.New("android: unsupported uid options")
+	}
+	if len(options.IncludeAndroidUser) > 0 {
+		return nil, E.New("android: unsupported android_user option")
+	}
+	a, _ := json.Marshal(options)
+	b, _ := json.Marshal(platformOptions)
+	tunFd, err := intfBox.OpenTun(string(a), string(b))
+	if err != nil {
+		return nil, fmt.Errorf("intfBox.OpenTun: %v", err)
+	}
+	// Do you want to close it?
+	tunFd, err = syscall.Dup(tunFd)
+	if err != nil {
+		return nil, fmt.Errorf("syscall.Dup: %v", err)
+	}
+	//
+	options.FileDescriptor = int(tunFd)
+	return tun.New(*options)
+}
diff --git a/libcore/protocol/juicity/outbound.go b/libcore/protocol/juicity/outbound.go
index 0b0db1103d..15645bbf3a 100644
--- a/libcore/protocol/juicity/outbound.go
+++ b/libcore/protocol/juicity/outbound.go
@@ -23,7 +23,7 @@ import (
 	M "github.com/sagernet/sing/common/metadata"
 	N "github.com/sagernet/sing/common/network"
 
-	"github.com/dyhkwong/sing-juicity"
+	"github.com/exclavenetwork/sing-juicity"
 	"github.com/gofrs/uuid/v5"
 )
 
@@ -65,7 +65,7 @@ func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextL
 	if options.TLS.ALPN == nil { // not len(options.TLS.ALPN) > 0
 		options.TLS.ALPN = []string{"h3"}
 	}
-	tlsConfig, err := tls.NewSTDClient(ctx, options.Server, *options.TLS)
+	tlsConfig, err := tls.NewSTDClient(ctx, logger, options.Server, *options.TLS)
 	if err != nil {
 		return nil, err
 	}
@@ -74,7 +74,10 @@ func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextL
 		if err != nil {
 			return nil, E.Cause(err, "decode pin cert sha256")
 		}
-		stdTLSConfig, _ := tlsConfig.Config()
+		stdTLSConfig, err := tlsConfig.STDConfig()
+		if err != nil {
+			return nil, err
+		}
 		stdTLSConfig.VerifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
 			peerHash := certChainHash(rawCerts)
 			if !bytes.Equal(pinCertSha256, peerHash) {
diff --git a/libcore/sendfd_other.go b/libcore/sendfd_other.go
new file mode 100644
index 0000000000..f8914cd660
--- /dev/null
+++ b/libcore/sendfd_other.go
@@ -0,0 +1,11 @@
+//go:build !unix
+
+package libcore
+
+import "errors"
+
+func sendFdToProtect(fd int, path string) error {
+	_ = fd
+	_ = path
+	return errors.New("sendFdToProtect is not supported on this platform")
+}
diff --git a/libcore/sendfd_unix.go b/libcore/sendfd_unix.go
new file mode 100644
index 0000000000..2e0e785e09
--- /dev/null
+++ b/libcore/sendfd_unix.go
@@ -0,0 +1,43 @@
+//go:build unix
+
+package libcore
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
+
+func sendFdToProtect(fd int, path string) error {
+	socketFd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_STREAM, 0)
+	if err != nil {
+		return fmt.Errorf("failed to create unix socket: %w", err)
+	}
+	defer unix.Close(socketFd)
+
+	var timeout unix.Timeval
+	timeout.Usec = 100 * 1000
+
+	_ = unix.SetsockoptTimeval(socketFd, unix.SOL_SOCKET, unix.SO_RCVTIMEO, &timeout)
+	_ = unix.SetsockoptTimeval(socketFd, unix.SOL_SOCKET, unix.SO_SNDTIMEO, &timeout)
+
+	err = unix.Connect(socketFd, &unix.SockaddrUnix{Name: path})
+	if err != nil {
+		return fmt.Errorf("failed to connect: %w", err)
+	}
+
+	err = unix.Sendmsg(socketFd, nil, unix.UnixRights(fd), nil, 0)
+	if err != nil {
+		return fmt.Errorf("failed to send: %w", err)
+	}
+
+	dummy := []byte{1}
+	n, err := unix.Read(socketFd, dummy)
+	if err != nil {
+		return fmt.Errorf("failed to receive: %w", err)
+	}
+	if n != 1 {
+		return fmt.Errorf("socket closed unexpectedly")
+	}
+	return nil
+}
diff --git a/nb4a.properties b/nb4a.properties
deleted file mode 100644
index 41db1139ce..0000000000
--- a/nb4a.properties
+++ /dev/null
@@ -1,4 +0,0 @@
-PACKAGE_NAME=com.nb4a
-VERSION_NAME=1.4.2-rev-24
-PRE_VERSION_NAME=pre-1.4.2-20260214-1
-VERSION_CODE=46
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 4d530e5a2c..43cb8c5e5d 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -1,2 +1,2 @@
 include(":app")
-rootProject.name = "NB4A"
+rootProject.name = "Asteria"