From 36b43c3ca907ba8cab425dac78ab64e210fc5432 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Wed, 8 Jul 2026 19:10:24 +0800
Subject: [PATCH 01/12] android: add vpn lifecycle controls

---
 .../java/com/proxy/android/MainActivity.kt    |  79 ++++++++++-
 .../java/com/proxy/android/PlaneVpnService.kt | 125 ++++++++++++++----
 .../app/src/main/res/layout/activity_main.xml |  12 +-
 .../app/src/main/res/values/strings.xml       |   7 +-
 4 files changed, 193 insertions(+), 30 deletions(-)

diff --git a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
index 0dbdcd5..68b2af9 100644
--- a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
+++ b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
@@ -1,6 +1,9 @@
 package com.proxy.android
 
+import android.content.BroadcastReceiver
+import android.content.Context
 import android.content.Intent
+import android.content.IntentFilter
 import android.net.VpnService
 import android.os.Bundle
 import android.widget.Button
@@ -12,21 +15,40 @@ import androidx.core.content.ContextCompat
 /**
  * 主界面。
  *
- * A1 职责：
+ * 当前职责：
  *  1. 显示 native（plane-core）版本号，证明 `.so` 已加载、JNI 可调用。
- *  2. 一个开关按钮，走 [VpnService.prepare]：若未授权则拉起系统 VPN 授权框，
+ *  2. 连接前走 [VpnService.prepare]：若未授权则拉起系统 VPN 授权框，
  *     授权通过后启动前台 [PlaneVpnService]。
+ *  3. 接收 [PlaneVpnService] 的状态广播，驱动按钮与状态文本，保证 UI 不自行猜测
+ *     Service 生命周期。
  *
- * 后续阶段（B6）会把界面扩展为节点/规则配置与状态展示，这里只保留最小可验证骨架。
+ * 后续阶段（B6）会把界面扩展为节点/规则配置与统计展示。
  */
 class MainActivity : AppCompatActivity() {
 
+    private lateinit var toggleVpnButton: Button
+    private lateinit var vpnStatusText: TextView
+
+    /** Activity 只保存 UI 状态；真实生命周期以 PlaneVpnService 广播为准。 */
+    private var vpnRunning: Boolean = false
+
+    private val statusReceiver = object : BroadcastReceiver() {
+        override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action != PlaneVpnService.ACTION_STATUS_CHANGED) return
+            val running = intent.getBooleanExtra(PlaneVpnService.EXTRA_RUNNING, false)
+            val message = intent.getStringExtra(PlaneVpnService.EXTRA_STATUS_MESSAGE)
+            updateVpnUi(running, message)
+        }
+    }
+
     // 系统 VPN 授权对话框的结果回调：用户点「允许」后启动 VPN 服务。
     private val prepareLauncher = registerForActivityResult(
         ActivityResultContracts.StartActivityForResult(),
     ) { result ->
         if (result.resultCode == RESULT_OK) {
             startVpn()
+        } else {
+            updateVpnUi(false, getString(R.string.vpn_status_idle))
         }
     }
 
@@ -37,7 +59,27 @@ class MainActivity : AppCompatActivity() {
         val versionView = findViewById<TextView>(R.id.nativeVersionText)
         versionView.text = getString(R.string.native_version_label, readNativeVersion())
 
-        findViewById<Button>(R.id.toggleVpnButton).setOnClickListener { onToggleClicked() }
+        vpnStatusText = findViewById(R.id.vpnStatusText)
+        toggleVpnButton = findViewById<Button>(R.id.toggleVpnButton).apply {
+            setOnClickListener { onToggleClicked() }
+        }
+        updateVpnUi(PlaneVpnService.isRunning)
+    }
+
+    override fun onStart() {
+        super.onStart()
+        ContextCompat.registerReceiver(
+            this,
+            statusReceiver,
+            IntentFilter(PlaneVpnService.ACTION_STATUS_CHANGED),
+            ContextCompat.RECEIVER_NOT_EXPORTED,
+        )
+        updateVpnUi(PlaneVpnService.isRunning)
+    }
+
+    override fun onStop() {
+        runCatching { unregisterReceiver(statusReceiver) }
+        super.onStop()
     }
 
     private fun readNativeVersion(): String =
@@ -45,6 +87,11 @@ class MainActivity : AppCompatActivity() {
             .getOrElse { "<load failed: ${it.message}>" }
 
     private fun onToggleClicked() {
+        if (vpnRunning) {
+            stopVpn()
+            return
+        }
+
         // prepare 返回非 null Intent 表示尚未授权，需要拉起系统授权框；
         // 返回 null 表示已授权，可直接启动。
         val intent: Intent? = VpnService.prepare(this)
@@ -58,6 +105,30 @@ class MainActivity : AppCompatActivity() {
     private fun startVpn() {
         // 节点配置已在 PlaneVpnService 中写死（对接固定服务端），这里直接启动即可。
         val intent = Intent(this, PlaneVpnService::class.java)
+            .setAction(PlaneVpnService.ACTION_START)
         ContextCompat.startForegroundService(this, intent)
+        updateVpnUi(true, getString(R.string.vpn_status_connecting))
+    }
+
+    private fun stopVpn() {
+        val intent = Intent(this, PlaneVpnService::class.java)
+            .setAction(PlaneVpnService.ACTION_STOP)
+        // 用户正在前台操作时使用普通 startService 即可，避免 stop action 也触发
+        // startForegroundService 的 5 秒前台通知要求。
+        startService(intent)
+        updateVpnUi(false, getString(R.string.vpn_status_disconnecting))
+    }
+
+    private fun updateVpnUi(
+        running: Boolean,
+        message: String? = null,
+    ) {
+        vpnRunning = running
+        toggleVpnButton.text = getString(
+            if (running) R.string.disconnect_vpn else R.string.connect_vpn,
+        )
+        vpnStatusText.text = message ?: getString(
+            if (running) R.string.vpn_status_connected else R.string.vpn_status_idle,
+        )
     }
 }
diff --git a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
index 1e097ac..8a15c46 100644
--- a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
+++ b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
@@ -16,14 +16,11 @@ import org.json.JSONObject
 /**
  * 系统 VPN 服务。
  *
- * 进度：
- *
- * - A1：最小骨架——声明清单、被系统拉起并进入前台，但**不建立 TUN、不启动数据面**。
- * - A2：持有 [NativeBridge]，对接 Rust → Kotlin 的 `protect` / `onStatus` 回调。
+ * 职责：
+ * - 作为前台 [VpnService] 建立 TUN 接口并把 fd 移交给 plane-core。
+ * - 持有 [NativeBridge]，对接 Rust → Kotlin 的 `protect` / `onStatus` 回调。
  *   `protect(fd)` 复用 [VpnService] 自带方法，把出站 socket 排除出 TUN（防回环 0.3-1）。
- *
- * 真正的 `establish()` + `nativeStart(fd, configJson)` 仍在 Task A3/A6 接入；A2 不在
- * `onStartCommand` 里启动数据面，以免破坏 A1 已通过的生命周期验收。
+ * - 通过应用内状态广播把连接/断开/异常状态同步给 [MainActivity]。
  */
 class PlaneVpnService : VpnService() {
 
@@ -36,6 +33,9 @@ class PlaneVpnService : VpnService() {
     /** 当前会话 handle（0 = 未启动）。由 `nativeStart` 赋值。 */
     private var nativeHandle: Long = 0L
 
+    /** 是否已经进入前台；用于避免 stopForeground 在未前台化时被调用。 */
+    private var foregroundStarted: Boolean = false
+
     /**
      * 当前 TUN 接口（仅用于在未成功 detachFd 前的兜底关闭）。
      *
@@ -46,21 +46,31 @@ class PlaneVpnService : VpnService() {
     private var tunInterface: ParcelFileDescriptor? = null
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_STOP) {
+            Log.i(TAG, "收到停止 VPN 指令")
+            stopSelfSafely()
+            return START_NOT_STICKY
+        }
+
         ensureNotificationChannel()
-        startForegroundCompat()
+        startForegroundCompat(getString(R.string.vpn_status_connecting))
+        publishStatus(running = true, message = getString(R.string.vpn_status_connecting))
 
         // 已在运行则不重复启动（避免重复 establish/ nativeStart）。
         if (nativeHandle != 0L) {
             Log.i(TAG, "数据面已在运行，忽略重复 onStartCommand")
+            publishStatus(running = true, message = getString(R.string.vpn_status_connected))
             return START_STICKY
         }
 
         if (!startDataPlane(intent)) {
             // 启动失败：退出前台并停止自身，保证不残留半启动状态。
             Log.e(TAG, "数据面启动失败，停止服务")
+            publishStatus(running = false, message = getString(R.string.vpn_status_error))
             stopSelfSafely()
             return START_NOT_STICKY
         }
+        publishStatus(running = true, message = getString(R.string.vpn_status_connected))
         return START_STICKY
     }
 
@@ -80,10 +90,16 @@ class PlaneVpnService : VpnService() {
         tunInterface = pfd
 
         val configJson = buildConfigJson(intent)
+        val nativeBridge = runCatching { bridge }
+            .onFailure { Log.e(TAG, "NativeBridge 初始化失败", it) }
+            .getOrElse {
+                closeTunBeforeDetach()
+                return false
+            }
         val fd = pfd.detachFd() // 所有权移交 native；detach 后 pfd 不再持有 fd。
         tunInterface = null // 已移交，置空避免误 close。
 
-        val handle = runCatching { bridge.nativeStart(fd, configJson) }
+        val handle = runCatching { nativeBridge.nativeStart(fd, configJson) }
             .onFailure { Log.e(TAG, "nativeStart 抛出异常", it) }
             .getOrDefault(0L)
 
@@ -99,6 +115,19 @@ class PlaneVpnService : VpnService() {
         return true
     }
 
+    /**
+     * native 尚未接管 fd 前的失败路径清理。
+     *
+     * 一旦调用 `detachFd()`，fd 所有权就不再属于 [ParcelFileDescriptor]，Kotlin 侧也
+     * 不能安全关闭；所以所有可能在 detach 前失败的初始化都必须先走这里兜底关闭。
+     */
+    private fun closeTunBeforeDetach() {
+        tunInterface?.let {
+            runCatching { it.close() }.onFailure { e -> Log.w(TAG, "关闭未移交 TUN 失败", e) }
+        }
+        tunInterface = null
+    }
+
     /**
      * 配置并建立 TUN 接口。
      *
@@ -160,10 +189,16 @@ class PlaneVpnService : VpnService() {
     /**
      * 接收来自 Rust（经 [NativeBridge.onStatus]）的状态上报。
      *
-     * A2 阶段仅记录日志；B5/B7 会据此刷新通知与 UI 状态。
+     * 当前先同步到 Activity；后续 B7 可在这里扩展流量统计与更细的健康状态。
      */
     fun onNativeStatus(state: String) {
         Log.i(TAG, "native status: $state")
+        val message = when (state) {
+            "connected" -> getString(R.string.vpn_status_connected)
+            "error" -> getString(R.string.vpn_status_error)
+            else -> state
+        }
+        publishStatus(running = isRunning, message = message)
     }
 
     /**
@@ -175,11 +210,16 @@ class PlaneVpnService : VpnService() {
     }
 
     override fun onDestroy() {
-        stopSelfSafely()
+        cleanupDataPlane()
         super.onDestroy()
     }
 
     private fun stopSelfSafely() {
+        cleanupDataPlane()
+        stopSelf()
+    }
+
+    private fun cleanupDataPlane() {
         // 1) 回收 native 会话：nativeStop 内部 send(shutdown) 让栈/调度器优雅退出，
         //    并在 Drop 时 close(TUN fd)。handle 为 0 时为 no-op。
         if (nativeHandle != 0L) {
@@ -189,31 +229,25 @@ class PlaneVpnService : VpnService() {
         }
         // 2) 兜底：仅当 establish 成功但尚未 detach 给 native（nativeStart 之前失败）时，
         //    此处关闭未移交的接口，避免 fd 泄漏。正常路径 tunInterface 已为 null。
-        tunInterface?.let {
-            runCatching { it.close() }.onFailure { e -> Log.w(TAG, "关闭未移交 TUN 失败", e) }
-        }
-        tunInterface = null
+        closeTunBeforeDetach()
         stopForegroundRemoveCompat()
-        stopSelf()
+        publishStatus(running = false, message = getString(R.string.vpn_status_idle))
     }
 
     /** 退出前台并移除通知，兼容 API < 33（`stopForeground(int)` 重载 API 33+）。 */
     private fun stopForegroundRemoveCompat() {
+        if (!foregroundStarted) return
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
             stopForeground(STOP_FOREGROUND_REMOVE)
         } else {
             @Suppress("DEPRECATION")
             stopForeground(true)
         }
+        foregroundStarted = false
     }
 
-    private fun startForegroundCompat() {
-        val notification: Notification = NotificationCompat.Builder(this, CHANNEL_ID)
-            .setContentTitle(getString(R.string.app_name))
-            .setContentText(getString(R.string.vpn_status_idle))
-            .setSmallIcon(android.R.drawable.stat_sys_warning)
-            .setOngoing(true)
-            .build()
+    private fun startForegroundCompat(statusText: String) {
+        val notification = buildNotification(statusText)
 
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
             // targetSdk 34：前台服务必须指定类型，VPN 使用 specialUse。
@@ -225,6 +259,37 @@ class PlaneVpnService : VpnService() {
         } else {
             startForeground(NOTIFICATION_ID, notification)
         }
+        foregroundStarted = true
+    }
+
+    private fun buildNotification(statusText: String): Notification =
+        NotificationCompat.Builder(this, CHANNEL_ID)
+            .setContentTitle(getString(R.string.app_name))
+            .setContentText(statusText)
+            .setSmallIcon(android.R.drawable.stat_sys_warning)
+            .setOngoing(true)
+            .build()
+
+    private fun updateForegroundNotification(statusText: String) {
+        if (!foregroundStarted) return
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        nm.notify(NOTIFICATION_ID, buildNotification(statusText))
+    }
+
+    /**
+     * 向同应用内 Activity 广播当前 VPN 状态。
+     *
+     * 使用 `setPackage(packageName)` 限定广播只发给本应用，避免把连接状态泄露给其它应用。
+     * Activity 只负责展示，不直接推断 Service 生命周期。
+     */
+    private fun publishStatus(running: Boolean, message: String) {
+        isRunning = running
+        updateForegroundNotification(message)
+        val intent = Intent(ACTION_STATUS_CHANGED)
+            .setPackage(packageName)
+            .putExtra(EXTRA_RUNNING, running)
+            .putExtra(EXTRA_STATUS_MESSAGE, message)
+        sendBroadcast(intent)
     }
 
     private fun ensureNotificationChannel() {
@@ -247,6 +312,20 @@ class PlaneVpnService : VpnService() {
         private const val CHANNEL_ID = "plane_vpn_status"
         private const val NOTIFICATION_ID = 1001
 
+        /** 启动 / 停止 Service 的显式 action，避免 Activity 与 Service 约定隐式行为。 */
+        const val ACTION_START = "com.proxy.android.action.START_VPN"
+        const val ACTION_STOP = "com.proxy.android.action.STOP_VPN"
+
+        /** Service → Activity 状态广播 action 与 extra。 */
+        const val ACTION_STATUS_CHANGED = "com.proxy.android.action.VPN_STATUS_CHANGED"
+        const val EXTRA_RUNNING = "extra_running"
+        const val EXTRA_STATUS_MESSAGE = "extra_status_message"
+
+        /** 当前进程内的 VPN 运行态，供 Activity 首次进入时同步按钮状态。 */
+        @Volatile
+        var isRunning: Boolean = false
+            private set
+
         /** TUN MTU，与 native AndroidConfig 默认一致。 */
         private const val TUN_MTU = 1500
 
diff --git a/android-app/app/src/main/res/layout/activity_main.xml b/android-app/app/src/main/res/layout/activity_main.xml
index 5d932cd..6ecada9 100644
--- a/android-app/app/src/main/res/layout/activity_main.xml
+++ b/android-app/app/src/main/res/layout/activity_main.xml
@@ -10,14 +10,22 @@
         android:id="@+id/nativeVersionText"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
-        android:layout_marginBottom="24dp"
+        android:layout_marginBottom="12dp"
         android:textSize="16sp"
         android:text="native 版本: -" />
 
+    <TextView
+        android:id="@+id/vpnStatusText"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:layout_marginBottom="24dp"
+        android:text="@string/vpn_status_idle"
+        android:textSize="18sp" />
+
     <Button
         android:id="@+id/toggleVpnButton"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
-        android:text="@string/toggle_vpn" />
+        android:text="@string/connect_vpn" />
 
 </LinearLayout>
diff --git a/android-app/app/src/main/res/values/strings.xml b/android-app/app/src/main/res/values/strings.xml
index 69e560d..3bf3058 100644
--- a/android-app/app/src/main/res/values/strings.xml
+++ b/android-app/app/src/main/res/values/strings.xml
@@ -1,8 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
     <string name="app_name">SimplePlane</string>
-    <string name="toggle_vpn">连接 / 断开 VPN</string>
+    <string name="connect_vpn">连接 VPN</string>
+    <string name="disconnect_vpn">断开 VPN</string>
     <string name="native_version_label">native 版本: %1$s</string>
     <string name="vpn_status_idle">未连接</string>
+    <string name="vpn_status_connecting">正在连接...</string>
+    <string name="vpn_status_connected">已连接</string>
+    <string name="vpn_status_disconnecting">正在断开...</string>
+    <string name="vpn_status_error">连接异常</string>
     <string name="notification_channel_name">VPN 状态</string>
 </resources>

From cdad3abe340dd2a8649b8dfb8b6ba9be65e08f91 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Wed, 8 Jul 2026 21:56:26 +0800
Subject: [PATCH 02/12] android: add configurable connection settings

---
 .../com/proxy/android/AndroidVpnConfig.kt     |  54 +++++++
 .../java/com/proxy/android/MainActivity.kt    |  96 +++++++++++-
 .../java/com/proxy/android/PlaneVpnService.kt |  31 ++--
 .../app/src/main/res/layout/activity_main.xml | 146 +++++++++++++++---
 .../app/src/main/res/values/strings.xml       |  17 ++
 5 files changed, 301 insertions(+), 43 deletions(-)
 create mode 100644 android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt

diff --git a/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
new file mode 100644
index 0000000..7cbfc97
--- /dev/null
+++ b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
@@ -0,0 +1,54 @@
+package com.proxy.android
+
+import android.content.Context
+
+/**
+ * Android 端 VPN 节点配置。
+ *
+ * 目前 plane-core 只支持直连一个 proxy-remote 节点；后续接入多节点/路由后，
+ * 这里可以自然扩展为列表与规则配置。
+ */
+data class AndroidVpnConfig(
+    val remoteHost: String,
+    val remotePort: Int,
+    val remoteKey: String,
+    val cipher: String,
+    val tls: Boolean,
+)
+
+object VpnConfigStore {
+    const val DEFAULT_REMOTE_HOST = "54.234.196.30"
+    const val DEFAULT_REMOTE_PORT = 9090
+    const val DEFAULT_REMOTE_KEY = "your-cipher-key"
+    const val DEFAULT_CIPHER = "chacha20"
+    const val DEFAULT_TLS = false
+
+    private const val PREFS_NAME = "plane_vpn_config"
+    private const val KEY_REMOTE_HOST = "remote_host"
+    private const val KEY_REMOTE_PORT = "remote_port"
+    private const val KEY_REMOTE_KEY = "remote_key"
+    private const val KEY_CIPHER = "cipher"
+    private const val KEY_TLS = "tls"
+
+    fun load(context: Context): AndroidVpnConfig {
+        val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+        return AndroidVpnConfig(
+            remoteHost = prefs.getString(KEY_REMOTE_HOST, DEFAULT_REMOTE_HOST) ?: DEFAULT_REMOTE_HOST,
+            remotePort = prefs.getInt(KEY_REMOTE_PORT, DEFAULT_REMOTE_PORT),
+            remoteKey = prefs.getString(KEY_REMOTE_KEY, DEFAULT_REMOTE_KEY) ?: DEFAULT_REMOTE_KEY,
+            cipher = prefs.getString(KEY_CIPHER, DEFAULT_CIPHER) ?: DEFAULT_CIPHER,
+            tls = prefs.getBoolean(KEY_TLS, DEFAULT_TLS),
+        )
+    }
+
+    fun save(context: Context, config: AndroidVpnConfig) {
+        context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+            .edit()
+            .putString(KEY_REMOTE_HOST, config.remoteHost)
+            .putInt(KEY_REMOTE_PORT, config.remotePort)
+            .putString(KEY_REMOTE_KEY, config.remoteKey)
+            .putString(KEY_CIPHER, config.cipher)
+            .putBoolean(KEY_TLS, config.tls)
+            .apply()
+    }
+}
diff --git a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
index 68b2af9..920990d 100644
--- a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
+++ b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
@@ -7,7 +7,10 @@ import android.content.IntentFilter
 import android.net.VpnService
 import android.os.Bundle
 import android.widget.Button
+import android.widget.CheckBox
+import android.widget.EditText
 import android.widget.TextView
+import android.widget.Toast
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.core.content.ContextCompat
@@ -27,7 +30,13 @@ import androidx.core.content.ContextCompat
 class MainActivity : AppCompatActivity() {
 
     private lateinit var toggleVpnButton: Button
+    private lateinit var saveConfigButton: Button
     private lateinit var vpnStatusText: TextView
+    private lateinit var remoteHostInput: EditText
+    private lateinit var remotePortInput: EditText
+    private lateinit var remoteKeyInput: EditText
+    private lateinit var cipherInput: EditText
+    private lateinit var tlsCheckBox: CheckBox
 
     /** Activity 只保存 UI 状态；真实生命周期以 PlaneVpnService 广播为准。 */
     private var vpnRunning: Boolean = false
@@ -60,9 +69,18 @@ class MainActivity : AppCompatActivity() {
         versionView.text = getString(R.string.native_version_label, readNativeVersion())
 
         vpnStatusText = findViewById(R.id.vpnStatusText)
+        remoteHostInput = findViewById(R.id.remoteHostInput)
+        remotePortInput = findViewById(R.id.remotePortInput)
+        remoteKeyInput = findViewById(R.id.remoteKeyInput)
+        cipherInput = findViewById(R.id.cipherInput)
+        tlsCheckBox = findViewById(R.id.tlsCheckBox)
+        saveConfigButton = findViewById<Button>(R.id.saveConfigButton).apply {
+            setOnClickListener { saveCurrentConfig(showSavedToast = true) }
+        }
         toggleVpnButton = findViewById<Button>(R.id.toggleVpnButton).apply {
             setOnClickListener { onToggleClicked() }
         }
+        bindConfigToForm(VpnConfigStore.load(this))
         updateVpnUi(PlaneVpnService.isRunning)
     }
 
@@ -92,6 +110,8 @@ class MainActivity : AppCompatActivity() {
             return
         }
 
+        if (saveCurrentConfig(showSavedToast = false) == null) return
+
         // prepare 返回非 null Intent 表示尚未授权，需要拉起系统授权框；
         // 返回 null 表示已授权，可直接启动。
         val intent: Intent? = VpnService.prepare(this)
@@ -103,9 +123,14 @@ class MainActivity : AppCompatActivity() {
     }
 
     private fun startVpn() {
-        // 节点配置已在 PlaneVpnService 中写死（对接固定服务端），这里直接启动即可。
+        val config = saveCurrentConfig(showSavedToast = false) ?: return
         val intent = Intent(this, PlaneVpnService::class.java)
             .setAction(PlaneVpnService.ACTION_START)
+            .putExtra(PlaneVpnService.EXTRA_REMOTE_HOST, config.remoteHost)
+            .putExtra(PlaneVpnService.EXTRA_REMOTE_PORT, config.remotePort)
+            .putExtra(PlaneVpnService.EXTRA_REMOTE_KEY, config.remoteKey)
+            .putExtra(PlaneVpnService.EXTRA_CIPHER, config.cipher)
+            .putExtra(PlaneVpnService.EXTRA_TLS, config.tls)
         ContextCompat.startForegroundService(this, intent)
         updateVpnUi(true, getString(R.string.vpn_status_connecting))
     }
@@ -119,6 +144,65 @@ class MainActivity : AppCompatActivity() {
         updateVpnUi(false, getString(R.string.vpn_status_disconnecting))
     }
 
+    private fun bindConfigToForm(config: AndroidVpnConfig) {
+        remoteHostInput.setText(config.remoteHost)
+        remotePortInput.setText(config.remotePort.toString())
+        remoteKeyInput.setText(config.remoteKey)
+        cipherInput.setText(config.cipher)
+        tlsCheckBox.isChecked = config.tls
+    }
+
+    private fun saveCurrentConfig(showSavedToast: Boolean): AndroidVpnConfig? {
+        val config = readConfigFromForm() ?: return null
+        VpnConfigStore.save(this, config)
+        if (showSavedToast) {
+            Toast.makeText(this, R.string.config_saved, Toast.LENGTH_SHORT).show()
+        }
+        return config
+    }
+
+    private fun readConfigFromForm(): AndroidVpnConfig? {
+        remoteHostInput.error = null
+        remotePortInput.error = null
+        remoteKeyInput.error = null
+
+        val host = remoteHostInput.text.toString().trim()
+        if (host.isBlank()) {
+            remoteHostInput.error = getString(R.string.config_error_host)
+            remoteHostInput.requestFocus()
+            return null
+        }
+
+        val port = remotePortInput.text.toString().trim().toIntOrNull()
+        if (port == null || port !in 1..65535) {
+            remotePortInput.error = getString(R.string.config_error_port)
+            remotePortInput.requestFocus()
+            return null
+        }
+
+        val key = remoteKeyInput.text.toString()
+        if (key.isBlank()) {
+            remoteKeyInput.error = getString(R.string.config_error_key)
+            remoteKeyInput.requestFocus()
+            return null
+        }
+
+        val tls = tlsCheckBox.isChecked
+        if (tls) {
+            Toast.makeText(this, R.string.config_error_tls_unsupported, Toast.LENGTH_LONG).show()
+            tlsCheckBox.requestFocus()
+            return null
+        }
+
+        return AndroidVpnConfig(
+            remoteHost = host,
+            remotePort = port,
+            remoteKey = key,
+            cipher = VpnConfigStore.DEFAULT_CIPHER,
+            tls = tls,
+        )
+    }
+
     private fun updateVpnUi(
         running: Boolean,
         message: String? = null,
@@ -130,5 +214,15 @@ class MainActivity : AppCompatActivity() {
         vpnStatusText.text = message ?: getString(
             if (running) R.string.vpn_status_connected else R.string.vpn_status_idle,
         )
+        setConfigInputsEnabled(!running)
+    }
+
+    private fun setConfigInputsEnabled(enabled: Boolean) {
+        remoteHostInput.isEnabled = enabled
+        remotePortInput.isEnabled = enabled
+        remoteKeyInput.isEnabled = enabled
+        saveConfigButton.isEnabled = enabled
+        tlsCheckBox.isEnabled = enabled
+        cipherInput.isEnabled = false
     }
 }
diff --git a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
index 8a15c46..82fd2a7 100644
--- a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
+++ b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
@@ -163,26 +163,29 @@ class PlaneVpnService : VpnService() {
     /**
      * 组装下发给 native 的 configJson。
      *
-     * 节点配置已写死为 [DEFAULT_REMOTE_HOST]/[DEFAULT_REMOTE_PORT]/[DEFAULT_REMOTE_KEY]
-     * （对接固定服务端，cipher=chacha20）；若启动 Intent 显式传入 extra 则优先采用
-     * （保留覆盖能力，便于后续恢复可配）。
+     * 节点配置优先使用 Activity 显式传入的 extra，缺省时回落到 [VpnConfigStore]
+     * 的默认值。这样 UI、持久化和 Service 启动参数只维护一套默认配置。
      */
     private fun buildConfigJson(intent: Intent?): String {
         val host = intent?.getStringExtra(EXTRA_REMOTE_HOST)
-            ?.takeIf { it.isNotBlank() } ?: DEFAULT_REMOTE_HOST
+            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_REMOTE_HOST
         val port = (intent?.getIntExtra(EXTRA_REMOTE_PORT, 0) ?: 0)
-            .takeIf { it != 0 } ?: DEFAULT_REMOTE_PORT
+            .takeIf { it != 0 } ?: VpnConfigStore.DEFAULT_REMOTE_PORT
         val key = intent?.getStringExtra(EXTRA_REMOTE_KEY)
-            ?.takeIf { it.isNotBlank() } ?: DEFAULT_REMOTE_KEY
-        val tls = intent?.getBooleanExtra(EXTRA_TLS, DEFAULT_TLS) ?: DEFAULT_TLS
+            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_REMOTE_KEY
+        val cipher = intent?.getStringExtra(EXTRA_CIPHER)
+            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_CIPHER
+        val tls = intent?.getBooleanExtra(EXTRA_TLS, VpnConfigStore.DEFAULT_TLS)
+            ?: VpnConfigStore.DEFAULT_TLS
 
         val json = JSONObject()
             .put("mtu", TUN_MTU)
             .put("remote_host", host)
             .put("remote_port", port)
             .put("remote_key", key)
+            .put("cipher", cipher)
             .put("tls", tls)
-        Log.i(TAG, "节点配置 host=$host port=$port tls=$tls")
+        Log.i(TAG, "节点配置 host=$host port=$port cipher=$cipher tls=$tls")
         return json.toString()
     }
 
@@ -353,17 +356,7 @@ class PlaneVpnService : VpnService() {
         const val EXTRA_REMOTE_HOST = "extra_remote_host"
         const val EXTRA_REMOTE_PORT = "extra_remote_port"
         const val EXTRA_REMOTE_KEY = "extra_remote_key"
+        const val EXTRA_CIPHER = "extra_cipher"
         const val EXTRA_TLS = "extra_tls"
-
-        /**
-         * 写死的默认节点配置（对接固定 proxy-remote）。
-         * - host/port：nginx 入口 54.234.196.30:9090。
-         * - key：与服务端 remote.yml 的 cipherKey 一致。
-         * - cipher 固定 chacha20（与服务端一致，由 native 默认决定）。
-         */
-        private const val DEFAULT_REMOTE_HOST = "54.234.196.30"
-        private const val DEFAULT_REMOTE_PORT = 9090
-        private const val DEFAULT_REMOTE_KEY = "your-cipher-key"
-        private const val DEFAULT_TLS = false
     }
 }
diff --git a/android-app/app/src/main/res/layout/activity_main.xml b/android-app/app/src/main/res/layout/activity_main.xml
index 6ecada9..fff55d8 100644
--- a/android-app/app/src/main/res/layout/activity_main.xml
+++ b/android-app/app/src/main/res/layout/activity_main.xml
@@ -1,31 +1,131 @@
 <?xml version="1.0" encoding="utf-8"?>
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+<ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
     android:layout_width="match_parent"
     android:layout_height="match_parent"
-    android:orientation="vertical"
-    android:gravity="center"
-    android:padding="24dp">
+    android:fillViewport="true">
 
-    <TextView
-        android:id="@+id/nativeVersionText"
-        android:layout_width="wrap_content"
+    <LinearLayout
+        android:layout_width="match_parent"
         android:layout_height="wrap_content"
-        android:layout_marginBottom="12dp"
-        android:textSize="16sp"
-        android:text="native 版本: -" />
+        android:gravity="center_horizontal"
+        android:orientation="vertical"
+        android:padding="24dp">
 
-    <TextView
-        android:id="@+id/vpnStatusText"
-        android:layout_width="wrap_content"
-        android:layout_height="wrap_content"
-        android:layout_marginBottom="24dp"
-        android:text="@string/vpn_status_idle"
-        android:textSize="18sp" />
+        <TextView
+            android:id="@+id/nativeVersionText"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:text="native 版本: -"
+            android:textSize="16sp" />
 
-    <Button
-        android:id="@+id/toggleVpnButton"
-        android:layout_width="wrap_content"
-        android:layout_height="wrap_content"
-        android:text="@string/connect_vpn" />
+        <TextView
+            android:id="@+id/vpnStatusText"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="18dp"
+            android:text="@string/vpn_status_idle"
+            android:textSize="18sp"
+            android:textStyle="bold" />
+
+        <Button
+            android:id="@+id/toggleVpnButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/connect_vpn" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="28dp"
+            android:layout_marginBottom="12dp"
+            android:text="@string/settings_title"
+            android:textSize="18sp"
+            android:textStyle="bold" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:labelFor="@id/remoteHostInput"
+            android:text="@string/remote_host_label" />
+
+        <EditText
+            android:id="@+id/remoteHostInput"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:hint="@string/remote_host_hint"
+            android:inputType="textUri"
+            android:singleLine="true" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:labelFor="@id/remotePortInput"
+            android:text="@string/remote_port_label" />
+
+        <EditText
+            android:id="@+id/remotePortInput"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:hint="@string/remote_port_hint"
+            android:inputType="number"
+            android:maxLength="5"
+            android:singleLine="true" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:labelFor="@id/remoteKeyInput"
+            android:text="@string/remote_key_label" />
+
+        <EditText
+            android:id="@+id/remoteKeyInput"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:hint="@string/remote_key_hint"
+            android:importantForAutofill="no"
+            android:inputType="textPassword"
+            android:singleLine="true" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:labelFor="@id/cipherInput"
+            android:text="@string/cipher_label" />
+
+        <EditText
+            android:id="@+id/cipherInput"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:enabled="false"
+            android:inputType="text"
+            android:singleLine="true"
+            android:text="@string/default_cipher" />
+
+        <CheckBox
+            android:id="@+id/tlsCheckBox"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="8dp"
+            android:text="@string/tls_label" />
+
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="18dp"
+            android:text="@string/tls_hint"
+            android:textSize="12sp" />
+
+        <Button
+            android:id="@+id/saveConfigButton"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:text="@string/save_config" />
+
+    </LinearLayout>
 
-</LinearLayout>
+</ScrollView>
diff --git a/android-app/app/src/main/res/values/strings.xml b/android-app/app/src/main/res/values/strings.xml
index 3bf3058..afa8e26 100644
--- a/android-app/app/src/main/res/values/strings.xml
+++ b/android-app/app/src/main/res/values/strings.xml
@@ -10,4 +10,21 @@
     <string name="vpn_status_disconnecting">正在断开...</string>
     <string name="vpn_status_error">连接异常</string>
     <string name="notification_channel_name">VPN 状态</string>
+    <string name="settings_title">连接设置</string>
+    <string name="remote_host_label">远端地址</string>
+    <string name="remote_host_hint">例如 54.234.196.30 或 example.com</string>
+    <string name="remote_port_label">远端端口</string>
+    <string name="remote_port_hint">例如 9090</string>
+    <string name="remote_key_label">加密密钥</string>
+    <string name="remote_key_hint">与 proxy-remote 的 cipherKey 保持一致</string>
+    <string name="cipher_label">加密方式</string>
+    <string name="default_cipher">chacha20</string>
+    <string name="tls_label">启用 TLS</string>
+    <string name="tls_hint">当前 Android 数据面仅支持 h2c 明文 HTTP/2；TLS 接入后这里会开放。</string>
+    <string name="save_config">保存配置</string>
+    <string name="config_saved">配置已保存</string>
+    <string name="config_error_host">请填写远端地址</string>
+    <string name="config_error_port">端口需在 1-65535 之间</string>
+    <string name="config_error_key">请填写加密密钥</string>
+    <string name="config_error_tls_unsupported">当前 Android 出站暂不支持 TLS，请先关闭 TLS</string>
 </resources>

From ffcb7a40e9ab5188b5328a7d5614202266863162 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 08:32:30 +0800
Subject: [PATCH 03/12] android: fix settings screen visibility

---
 .../java/com/proxy/android/MainActivity.kt    |  4 +++
 .../app/src/main/res/layout/activity_main.xml | 25 +++++++++++++++++++
 .../app/src/main/res/values/colors.xml        |  4 +++
 .../app/src/main/res/values/themes.xml        |  9 ++++++-
 4 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
index 920990d..b0dbf1f 100644
--- a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
+++ b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
@@ -6,6 +6,8 @@ import android.content.Intent
 import android.content.IntentFilter
 import android.net.VpnService
 import android.os.Bundle
+import android.view.View
+import android.view.WindowManager
 import android.widget.Button
 import android.widget.CheckBox
 import android.widget.EditText
@@ -63,6 +65,7 @@ class MainActivity : AppCompatActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+        window.setSoftInputMode(WindowManager.LayoutParams.SOFT_INPUT_STATE_ALWAYS_HIDDEN)
         setContentView(R.layout.activity_main)
 
         val versionView = findViewById<TextView>(R.id.nativeVersionText)
@@ -81,6 +84,7 @@ class MainActivity : AppCompatActivity() {
             setOnClickListener { onToggleClicked() }
         }
         bindConfigToForm(VpnConfigStore.load(this))
+        findViewById<View>(R.id.mainContent).requestFocus()
         updateVpnUi(PlaneVpnService.isRunning)
     }
 
diff --git a/android-app/app/src/main/res/layout/activity_main.xml b/android-app/app/src/main/res/layout/activity_main.xml
index fff55d8..b85bc08 100644
--- a/android-app/app/src/main/res/layout/activity_main.xml
+++ b/android-app/app/src/main/res/layout/activity_main.xml
@@ -2,11 +2,16 @@
 <ScrollView xmlns:android="http://schemas.android.com/apk/res/android"
     android:layout_width="match_parent"
     android:layout_height="match_parent"
+    android:background="@color/app_background"
     android:fillViewport="true">
 
     <LinearLayout
+        android:id="@+id/mainContent"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
+        android:descendantFocusability="beforeDescendants"
+        android:focusable="true"
+        android:focusableInTouchMode="true"
         android:gravity="center_horizontal"
         android:orientation="vertical"
         android:padding="24dp">
@@ -17,6 +22,7 @@
             android:layout_height="wrap_content"
             android:layout_marginBottom="12dp"
             android:text="native 版本: -"
+            android:textColor="@color/app_text_secondary"
             android:textSize="16sp" />
 
         <TextView
@@ -25,6 +31,7 @@
             android:layout_height="wrap_content"
             android:layout_marginBottom="18dp"
             android:text="@string/vpn_status_idle"
+            android:textColor="@color/app_text_primary"
             android:textSize="18sp"
             android:textStyle="bold" />
 
@@ -32,6 +39,8 @@
             android:id="@+id/toggleVpnButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
+            android:backgroundTint="@color/app_primary"
+            android:textColor="@android:color/white"
             android:text="@string/connect_vpn" />
 
         <TextView
@@ -40,6 +49,7 @@
             android:layout_marginTop="28dp"
             android:layout_marginBottom="12dp"
             android:text="@string/settings_title"
+            android:textColor="@color/app_text_primary"
             android:textSize="18sp"
             android:textStyle="bold" />
 
@@ -47,6 +57,7 @@
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:labelFor="@id/remoteHostInput"
+            android:textColor="@color/app_text_primary"
             android:text="@string/remote_host_label" />
 
         <EditText
@@ -56,12 +67,15 @@
             android:layout_marginBottom="12dp"
             android:hint="@string/remote_host_hint"
             android:inputType="textUri"
+            android:textColor="@color/app_text_primary"
+            android:textColorHint="@color/app_text_secondary"
             android:singleLine="true" />
 
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:labelFor="@id/remotePortInput"
+            android:textColor="@color/app_text_primary"
             android:text="@string/remote_port_label" />
 
         <EditText
@@ -72,12 +86,15 @@
             android:hint="@string/remote_port_hint"
             android:inputType="number"
             android:maxLength="5"
+            android:textColor="@color/app_text_primary"
+            android:textColorHint="@color/app_text_secondary"
             android:singleLine="true" />
 
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:labelFor="@id/remoteKeyInput"
+            android:textColor="@color/app_text_primary"
             android:text="@string/remote_key_label" />
 
         <EditText
@@ -88,12 +105,15 @@
             android:hint="@string/remote_key_hint"
             android:importantForAutofill="no"
             android:inputType="textPassword"
+            android:textColor="@color/app_text_primary"
+            android:textColorHint="@color/app_text_secondary"
             android:singleLine="true" />
 
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:labelFor="@id/cipherInput"
+            android:textColor="@color/app_text_primary"
             android:text="@string/cipher_label" />
 
         <EditText
@@ -104,6 +124,7 @@
             android:enabled="false"
             android:inputType="text"
             android:singleLine="true"
+            android:textColor="@color/app_text_secondary"
             android:text="@string/default_cipher" />
 
         <CheckBox
@@ -111,6 +132,7 @@
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:layout_marginBottom="8dp"
+            android:textColor="@color/app_text_primary"
             android:text="@string/tls_label" />
 
         <TextView
@@ -118,12 +140,15 @@
             android:layout_height="wrap_content"
             android:layout_marginBottom="18dp"
             android:text="@string/tls_hint"
+            android:textColor="@color/app_text_secondary"
             android:textSize="12sp" />
 
         <Button
             android:id="@+id/saveConfigButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
+            android:backgroundTint="@color/app_primary"
+            android:textColor="@android:color/white"
             android:text="@string/save_config" />
 
     </LinearLayout>
diff --git a/android-app/app/src/main/res/values/colors.xml b/android-app/app/src/main/res/values/colors.xml
index 936f22b..7936cda 100644
--- a/android-app/app/src/main/res/values/colors.xml
+++ b/android-app/app/src/main/res/values/colors.xml
@@ -1,4 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
+    <color name="app_background">#FFFFFF</color>
+    <color name="app_primary">#1565C0</color>
+    <color name="app_text_primary">#1F2933</color>
+    <color name="app_text_secondary">#5D6673</color>
     <color name="ic_launcher_background">#1565C0</color>
 </resources>
diff --git a/android-app/app/src/main/res/values/themes.xml b/android-app/app/src/main/res/values/themes.xml
index 3b13cb5..d85c0cc 100644
--- a/android-app/app/src/main/res/values/themes.xml
+++ b/android-app/app/src/main/res/values/themes.xml
@@ -1,5 +1,12 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
     <!-- 基于 Material 3 的应用主题 -->
-    <style name="Theme.SimplePlane" parent="Theme.Material3.DayNight.NoActionBar" />
+    <style name="Theme.SimplePlane" parent="Theme.Material3.Light.NoActionBar">
+        <item name="android:windowBackground">@color/app_background</item>
+        <item name="android:statusBarColor">@color/app_background</item>
+        <item name="android:navigationBarColor">@color/app_background</item>
+        <item name="android:windowLightStatusBar">true</item>
+        <item name="colorPrimary">@color/app_primary</item>
+        <item name="colorOnPrimary">@android:color/white</item>
+    </style>
 </resources>

From 23857a6029d511d27f73c54a3f8f02bb5a1e0a11 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 09:25:12 +0800
Subject: [PATCH 04/12] android: complete mobile client features

---
 .../com/proxy/android/AndroidVpnConfig.kt     | 407 +++++++++++++--
 .../java/com/proxy/android/MainActivity.kt    | 488 ++++++++++++++----
 .../java/com/proxy/android/PlaneVpnService.kt | 264 ++++------
 .../app/src/main/res/layout/activity_main.xml | 211 +++++---
 .../app/src/main/res/values/strings.xml       |  42 +-
 .../app/src/main/res/values/themes.xml        |  11 +-
 plane-core/Cargo.lock                         | 182 ++++++-
 plane-core/Cargo.toml                         |   1 +
 plane-core/src/dispatcher.rs                  | 422 ++++++++++-----
 plane-core/src/jni_bridge.rs                  | 357 +++----------
 plane-core/src/lib.rs                         |   3 +
 plane-core/src/mobile_config.rs               | 250 +++++++++
 plane-core/src/outbound.rs                    |  19 +
 plane-core/src/routing.rs                     | 321 ++++++++++++
 plane-core/src/stats.rs                       | 118 +++++
 15 files changed, 2283 insertions(+), 813 deletions(-)
 create mode 100644 plane-core/src/mobile_config.rs
 create mode 100644 plane-core/src/routing.rs
 create mode 100644 plane-core/src/stats.rs

diff --git a/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
index 7cbfc97..cd1b9bb 100644
--- a/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
+++ b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
@@ -1,54 +1,403 @@
 package com.proxy.android
 
 import android.content.Context
+import org.json.JSONArray
+import org.json.JSONObject
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+
+data class RemoteNodeConfig(
+    val name: String,
+    val host: String,
+    val port: Int,
+    val key: String,
+    val cipher: String = VpnConfigStore.DEFAULT_CIPHER,
+    val tls: Boolean = false,
+    val enabled: Boolean = true,
+)
+
+data class RouteRuleConfig(
+    val type: String,
+    val value: String,
+    val action: String,
+)
+
+data class AndroidRoutingConfig(
+    val defaultAction: String = "proxy",
+    val rules: List<RouteRuleConfig> = emptyList(),
+)
 
-/**
- * Android 端 VPN 节点配置。
- *
- * 目前 plane-core 只支持直连一个 proxy-remote 节点；后续接入多节点/路由后，
- * 这里可以自然扩展为列表与规则配置。
- */
 data class AndroidVpnConfig(
-    val remoteHost: String,
-    val remotePort: Int,
-    val remoteKey: String,
-    val cipher: String,
-    val tls: Boolean,
+    val mtu: Int = VpnConfigStore.DEFAULT_MTU,
+    val remotes: List<RemoteNodeConfig>,
+    val routing: AndroidRoutingConfig = AndroidRoutingConfig(),
+) {
+    fun validate(): String? {
+        val enabled = remotes.filter { it.enabled }
+        if (enabled.isEmpty()) return "至少需要一个已启用节点"
+        enabled.forEachIndexed { index, node ->
+            if (node.host.isBlank()) return "节点 ${index + 1} 缺少地址"
+            if (node.port !in 1..65535) return "节点 ${index + 1} 端口必须在 1-65535"
+            if (node.key.isBlank()) return "节点 ${index + 1} 缺少加密密钥"
+            if (!node.cipher.equals(DEFAULT_SUPPORTED_CIPHER, ignoreCase = true)) {
+                return "Android core 当前支持 $DEFAULT_SUPPORTED_CIPHER，节点 ${index + 1} 使用了 ${node.cipher}"
+            }
+        }
+        if (routing.defaultAction !in setOf("proxy", "direct", "reject")) {
+            return "默认路由只能是 proxy/direct/reject"
+        }
+        routing.rules.forEachIndexed { index, rule ->
+            if (rule.type !in SUPPORTED_RULE_TYPES) return "规则 ${index + 1} 类型不支持: ${rule.type}"
+            if (rule.action !in setOf("proxy", "direct", "reject")) return "规则 ${index + 1} 动作不支持: ${rule.action}"
+            if (rule.value.isBlank()) return "规则 ${index + 1} 内容为空"
+        }
+        return null
+    }
+
+    fun toJsonString(indent: Int = 0): String {
+        val root = JSONObject()
+            .put("mtu", mtu)
+            .put("remotes", JSONArray().apply {
+                remotes.forEach { node ->
+                    put(JSONObject()
+                        .put("name", node.name)
+                        .put("host", node.host)
+                        .put("port", node.port)
+                        .put("key", node.key)
+                        .put("cipher", node.cipher)
+                        .put("tls", node.tls)
+                        .put("enabled", node.enabled))
+                }
+            })
+            .put("routing", JSONObject()
+                .put("default_action", routing.defaultAction)
+                .put("rules", JSONArray().apply {
+                    routing.rules.forEach { rule ->
+                        put(JSONObject()
+                            .put("type", rule.type)
+                            .put("value", rule.value)
+                            .put("action", rule.action))
+                    }
+                }))
+        return if (indent > 0) root.toString(indent) else root.toString()
+    }
+
+    fun toDesktopYaml(): String {
+        val builder = StringBuilder()
+        builder.appendLine("remoteServers:")
+        remotes.forEach { node ->
+            builder.appendLine("  - host: ${node.host}")
+            builder.appendLine("    port: ${node.port}")
+            builder.appendLine("    cipher: ${node.cipher}")
+            builder.appendLine("    cipherKey: \"${node.key.replace("\"", "\\\"")}\"")
+            builder.appendLine("    ssl: ${node.tls}")
+        }
+        builder.appendLine("route:")
+        builder.appendLine("  defaultRoute: ${routing.defaultAction}")
+        val proxyList = routing.rules.filter { it.type == "domain_pattern" && it.action == "proxy" }
+        val directList = routing.rules.filter { it.type == "domain_pattern" && it.action == "direct" }
+        if (proxyList.isNotEmpty()) {
+            builder.appendLine("  proxyList:")
+            proxyList.forEach { builder.appendLine("    - \"${it.value}\"") }
+        }
+        if (directList.isNotEmpty()) {
+            builder.appendLine("  directList:")
+            directList.forEach { builder.appendLine("    - \"${it.value}\"") }
+        }
+        return builder.toString()
+    }
+
+    companion object {
+        private const val DEFAULT_SUPPORTED_CIPHER = "chacha20"
+        private val SUPPORTED_RULE_TYPES = setOf(
+            "domain_pattern",
+            "domain_suffix",
+            "domain_keyword",
+            "domain_full",
+            "ip_cidr",
+            "port",
+        )
+
+        fun defaultConfig(): AndroidVpnConfig = AndroidVpnConfig(
+            remotes = listOf(
+                RemoteNodeConfig(
+                    name = "默认节点",
+                    host = VpnConfigStore.DEFAULT_REMOTE_HOST,
+                    port = VpnConfigStore.DEFAULT_REMOTE_PORT,
+                    key = VpnConfigStore.DEFAULT_REMOTE_KEY,
+                ),
+            ),
+            routing = AndroidRoutingConfig(
+                defaultAction = "proxy",
+                rules = listOf(
+                    RouteRuleConfig("domain_pattern", "*.cn", "direct"),
+                    RouteRuleConfig("domain_pattern", "baidu.com", "direct"),
+                    RouteRuleConfig("domain_pattern", "qq.com", "direct"),
+                    RouteRuleConfig("ip_cidr", "10.0.0.0/8", "direct"),
+                    RouteRuleConfig("ip_cidr", "172.16.0.0/12", "direct"),
+                    RouteRuleConfig("ip_cidr", "192.168.0.0/16", "direct"),
+                ),
+            ),
+        )
+
+        fun fromJson(text: String): AndroidVpnConfig {
+            val root = JSONObject(text)
+            val remotes = parseRemotes(root)
+            val routing = parseRouting(root)
+            return AndroidVpnConfig(
+                mtu = root.optInt("mtu", VpnConfigStore.DEFAULT_MTU),
+                remotes = remotes.ifEmpty {
+                    listOf(RemoteNodeConfig(
+                        name = "默认节点",
+                        host = root.optString("remote_host", VpnConfigStore.DEFAULT_REMOTE_HOST),
+                        port = root.optInt("remote_port", VpnConfigStore.DEFAULT_REMOTE_PORT),
+                        key = root.optString("remote_key", VpnConfigStore.DEFAULT_REMOTE_KEY),
+                        cipher = root.optString("cipher", VpnConfigStore.DEFAULT_CIPHER),
+                        tls = root.optBoolean("tls", false),
+                    ))
+                },
+                routing = routing,
+            )
+        }
+
+        fun fromImportText(text: String): AndroidVpnConfig {
+            val trimmed = text.trim()
+            if (trimmed.isBlank()) error("导入内容为空")
+            return if (trimmed.startsWith("{")) {
+                fromJson(trimmed)
+            } else {
+                parseDesktopYaml(trimmed)
+            }
+        }
+
+        private fun parseRemotes(root: JSONObject): List<RemoteNodeConfig> {
+            val array = root.optJSONArray("remotes") ?: root.optJSONArray("remoteServers") ?: return emptyList()
+            return buildList {
+                for (i in 0 until array.length()) {
+                    val item = array.optJSONObject(i) ?: continue
+                    add(RemoteNodeConfig(
+                        name = item.optString("name", "节点 ${i + 1}"),
+                        host = item.optString("host"),
+                        port = item.optInt("port", VpnConfigStore.DEFAULT_REMOTE_PORT),
+                        key = item.optString("key", item.optString("cipherKey", item.optString("password"))),
+                        cipher = item.optString("cipher", VpnConfigStore.DEFAULT_CIPHER),
+                        tls = item.optBoolean("tls", item.optBoolean("ssl", false)),
+                        enabled = item.optBoolean("enabled", true),
+                    ))
+                }
+            }
+        }
+
+        private fun parseRouting(root: JSONObject): AndroidRoutingConfig {
+            val routing = root.optJSONObject("routing")
+            if (routing != null) {
+                val rulesArray = routing.optJSONArray("rules") ?: JSONArray()
+                return AndroidRoutingConfig(
+                    defaultAction = routing.optString("default_action", routing.optString("defaultAction", "proxy")),
+                    rules = parseRulesArray(rulesArray),
+                )
+            }
+
+            val route = root.optJSONObject("route") ?: return AndroidRoutingConfig()
+            val rules = mutableListOf<RouteRuleConfig>()
+            val direct = route.optJSONArray("directList") ?: route.optJSONArray("direct_list")
+            val proxy = route.optJSONArray("proxyList") ?: route.optJSONArray("proxy_list")
+            addPatternRules(direct, "direct", rules)
+            addPatternRules(proxy, "proxy", rules)
+            return AndroidRoutingConfig(
+                defaultAction = route.optString("defaultRoute", route.optString("default_route", "proxy")),
+                rules = rules,
+            )
+        }
+
+        private fun parseRulesArray(array: JSONArray): List<RouteRuleConfig> = buildList {
+            for (i in 0 until array.length()) {
+                val item = array.optJSONObject(i) ?: continue
+                add(RouteRuleConfig(
+                    type = item.optString("type", item.optString("rule_type")),
+                    value = item.optString("value"),
+                    action = item.optString("action"),
+                ))
+            }
+        }
+
+        private fun addPatternRules(array: JSONArray?, action: String, out: MutableList<RouteRuleConfig>) {
+            if (array == null) return
+            for (i in 0 until array.length()) {
+                val value = array.optString(i).trim()
+                if (value.isNotBlank()) out += RouteRuleConfig("domain_pattern", value, action)
+            }
+        }
+
+        private fun parseDesktopYaml(text: String): AndroidVpnConfig {
+            val nodes = mutableListOf<MutableMap<String, String>>()
+            var currentNode: MutableMap<String, String>? = null
+            var inRoute = false
+            var listMode: String? = null
+            var defaultRoute = "proxy"
+            val proxyList = mutableListOf<String>()
+            val directList = mutableListOf<String>()
+
+            text.lineSequence().forEach { raw ->
+                val line = raw.substringBefore("#").trimEnd()
+                val trimmed = line.trim()
+                if (trimmed.isBlank()) return@forEach
+
+                when {
+                    trimmed == "remoteServers:" || trimmed == "remotes:" -> {
+                        inRoute = false
+                        listMode = null
+                    }
+                    trimmed == "route:" || trimmed == "routing:" -> {
+                        inRoute = true
+                        listMode = null
+                    }
+                    trimmed.startsWith("- ") && !inRoute -> {
+                        currentNode = mutableMapOf()
+                        nodes += currentNode!!
+                        parseKeyValue(trimmed.removePrefix("- "))?.let { (k, v) -> currentNode!![k] = v }
+                    }
+                    currentNode != null && !inRoute && trimmed.contains(":") -> {
+                        parseKeyValue(trimmed)?.let { (k, v) -> currentNode!![k] = v }
+                    }
+                    inRoute && trimmed.startsWith("defaultRoute:") -> {
+                        defaultRoute = cleanValue(trimmed.substringAfter(":"))
+                    }
+                    inRoute && trimmed.startsWith("default_action:") -> {
+                        defaultRoute = cleanValue(trimmed.substringAfter(":"))
+                    }
+                    inRoute && (trimmed == "proxyList:" || trimmed == "proxy_list:") -> listMode = "proxy"
+                    inRoute && (trimmed == "directList:" || trimmed == "direct_list:") -> listMode = "direct"
+                    inRoute && trimmed.startsWith("- ") && listMode == "proxy" -> proxyList += cleanValue(trimmed.removePrefix("- "))
+                    inRoute && trimmed.startsWith("- ") && listMode == "direct" -> directList += cleanValue(trimmed.removePrefix("- "))
+                }
+            }
+
+            val remotes = nodes.mapIndexed { index, map ->
+                RemoteNodeConfig(
+                    name = map["name"].orEmpty().ifBlank { "节点 ${index + 1}" },
+                    host = map["host"].orEmpty(),
+                    port = map["port"]?.toIntOrNull() ?: VpnConfigStore.DEFAULT_REMOTE_PORT,
+                    key = map["key"] ?: map["cipherKey"] ?: map["password"] ?: "",
+                    cipher = map["cipher"] ?: VpnConfigStore.DEFAULT_CIPHER,
+                    tls = (map["tls"] ?: map["ssl"]).equals("true", ignoreCase = true),
+                    enabled = !map["enabled"].equals("false", ignoreCase = true),
+                )
+            }
+            val rules = directList.map { RouteRuleConfig("domain_pattern", it, "direct") } +
+                proxyList.map { RouteRuleConfig("domain_pattern", it, "proxy") }
+
+            return AndroidVpnConfig(
+                remotes = remotes.ifEmpty { defaultConfig().remotes },
+                routing = AndroidRoutingConfig(defaultRoute, rules),
+            )
+        }
+
+        private fun parseKeyValue(text: String): Pair<String, String>? {
+            if (!text.contains(":")) return null
+            val key = text.substringBefore(":").trim()
+            val value = cleanValue(text.substringAfter(":"))
+            return key to value
+        }
+
+        private fun cleanValue(value: String): String =
+            value.trim().trim('"').trim('\'')
+    }
+}
+
+data class ConfigPreset(
+    val name: String,
+    val config: AndroidVpnConfig,
 )
 
 object VpnConfigStore {
+    const val DEFAULT_MTU = 1500
     const val DEFAULT_REMOTE_HOST = "54.234.196.30"
     const val DEFAULT_REMOTE_PORT = 9090
     const val DEFAULT_REMOTE_KEY = "your-cipher-key"
     const val DEFAULT_CIPHER = "chacha20"
-    const val DEFAULT_TLS = false
 
     private const val PREFS_NAME = "plane_vpn_config"
-    private const val KEY_REMOTE_HOST = "remote_host"
-    private const val KEY_REMOTE_PORT = "remote_port"
-    private const val KEY_REMOTE_KEY = "remote_key"
-    private const val KEY_CIPHER = "cipher"
-    private const val KEY_TLS = "tls"
+    private const val KEY_CONFIG_JSON = "config_json_v2"
+    private const val KEY_PRESETS = "presets_json"
 
     fun load(context: Context): AndroidVpnConfig {
         val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
-        return AndroidVpnConfig(
-            remoteHost = prefs.getString(KEY_REMOTE_HOST, DEFAULT_REMOTE_HOST) ?: DEFAULT_REMOTE_HOST,
-            remotePort = prefs.getInt(KEY_REMOTE_PORT, DEFAULT_REMOTE_PORT),
-            remoteKey = prefs.getString(KEY_REMOTE_KEY, DEFAULT_REMOTE_KEY) ?: DEFAULT_REMOTE_KEY,
-            cipher = prefs.getString(KEY_CIPHER, DEFAULT_CIPHER) ?: DEFAULT_CIPHER,
-            tls = prefs.getBoolean(KEY_TLS, DEFAULT_TLS),
-        )
+        val json = prefs.getString(KEY_CONFIG_JSON, null)
+        if (!json.isNullOrBlank()) {
+            return runCatching { AndroidVpnConfig.fromJson(json) }.getOrElse { AndroidVpnConfig.defaultConfig() }
+        }
+        return AndroidVpnConfig.defaultConfig()
     }
 
     fun save(context: Context, config: AndroidVpnConfig) {
         context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
             .edit()
-            .putString(KEY_REMOTE_HOST, config.remoteHost)
-            .putInt(KEY_REMOTE_PORT, config.remotePort)
-            .putString(KEY_REMOTE_KEY, config.remoteKey)
-            .putString(KEY_CIPHER, config.cipher)
-            .putBoolean(KEY_TLS, config.tls)
+            .putString(KEY_CONFIG_JSON, config.toJsonString())
+            .apply()
+    }
+
+    fun loadPresets(context: Context): List<ConfigPreset> {
+        val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+        val raw = prefs.getString(KEY_PRESETS, "[]") ?: "[]"
+        return runCatching {
+            val array = JSONArray(raw)
+            buildList {
+                for (i in 0 until array.length()) {
+                    val item = array.optJSONObject(i) ?: continue
+                    add(ConfigPreset(
+                        name = item.optString("name"),
+                        config = AndroidVpnConfig.fromJson(item.getJSONObject("config").toString()),
+                    ))
+                }
+            }
+        }.getOrDefault(emptyList())
+    }
+
+    fun savePreset(context: Context, name: String, config: AndroidVpnConfig) {
+        val trimmed = name.trim()
+        if (trimmed.isBlank()) return
+        val next = loadPresets(context)
+            .filterNot { it.name == trimmed }
+            .plus(ConfigPreset(trimmed, config))
+        writePresets(context, next)
+    }
+
+    fun deletePreset(context: Context, name: String) {
+        writePresets(context, loadPresets(context).filterNot { it.name == name })
+    }
+
+    private fun writePresets(context: Context, presets: List<ConfigPreset>) {
+        val array = JSONArray()
+        presets.forEach { preset ->
+            array.put(JSONObject()
+                .put("name", preset.name)
+                .put("config", JSONObject(preset.config.toJsonString())))
+        }
+        context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+            .edit()
+            .putString(KEY_PRESETS, array.toString())
             .apply()
     }
 }
+
+object AppLogStore {
+    private const val MAX_LINES = 200
+    private val timeFormat = SimpleDateFormat("HH:mm:ss", Locale.US)
+    private val lines = ArrayDeque<String>()
+
+    @Synchronized
+    fun add(message: String) {
+        lines.addLast("${timeFormat.format(Date())}  $message")
+        while (lines.size > MAX_LINES) lines.removeFirst()
+    }
+
+    @Synchronized
+    fun clear() {
+        lines.clear()
+    }
+
+    @Synchronized
+    fun snapshot(): List<String> = lines.toList()
+}
diff --git a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
index b0dbf1f..df9e89c 100644
--- a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
+++ b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
@@ -6,53 +6,74 @@ import android.content.Intent
 import android.content.IntentFilter
 import android.net.VpnService
 import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.text.InputType
 import android.view.View
+import android.view.ViewGroup
 import android.view.WindowManager
+import android.widget.ArrayAdapter
 import android.widget.Button
 import android.widget.CheckBox
 import android.widget.EditText
+import android.widget.LinearLayout
+import android.widget.Spinner
 import android.widget.TextView
 import android.widget.Toast
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.core.content.ContextCompat
+import org.json.JSONObject
+import java.util.Locale
 
-/**
- * 主界面。
- *
- * 当前职责：
- *  1. 显示 native（plane-core）版本号，证明 `.so` 已加载、JNI 可调用。
- *  2. 连接前走 [VpnService.prepare]：若未授权则拉起系统 VPN 授权框，
- *     授权通过后启动前台 [PlaneVpnService]。
- *  3. 接收 [PlaneVpnService] 的状态广播，驱动按钮与状态文本，保证 UI 不自行猜测
- *     Service 生命周期。
- *
- * 后续阶段（B6）会把界面扩展为节点/规则配置与统计展示。
- */
 class MainActivity : AppCompatActivity() {
+    private val routeActions = listOf("proxy", "direct", "reject")
+    private val nodeRows = mutableListOf<NodeRow>()
+    private val uiHandler = Handler(Looper.getMainLooper())
 
+    private lateinit var mainContent: LinearLayout
     private lateinit var toggleVpnButton: Button
     private lateinit var saveConfigButton: Button
     private lateinit var vpnStatusText: TextView
-    private lateinit var remoteHostInput: EditText
-    private lateinit var remotePortInput: EditText
-    private lateinit var remoteKeyInput: EditText
-    private lateinit var cipherInput: EditText
-    private lateinit var tlsCheckBox: CheckBox
+    private lateinit var statsText: TextView
+    private lateinit var nodesContainer: LinearLayout
+    private lateinit var addNodeButton: Button
+    private lateinit var defaultRouteSpinner: Spinner
+    private lateinit var directListInput: EditText
+    private lateinit var proxyListInput: EditText
+    private lateinit var advancedRulesInput: EditText
+    private lateinit var presetNameInput: EditText
+    private lateinit var presetSpinner: Spinner
+    private lateinit var importConfigInput: EditText
+    private lateinit var logText: TextView
 
-    /** Activity 只保存 UI 状态；真实生命周期以 PlaneVpnService 广播为准。 */
-    private var vpnRunning: Boolean = false
+    private var vpnRunning = false
+    private var presets: List<ConfigPreset> = emptyList()
 
     private val statusReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
-            if (intent?.action != PlaneVpnService.ACTION_STATUS_CHANGED) return
-            val running = intent.getBooleanExtra(PlaneVpnService.EXTRA_RUNNING, false)
-            val message = intent.getStringExtra(PlaneVpnService.EXTRA_STATUS_MESSAGE)
-            updateVpnUi(running, message)
+            when (intent?.action) {
+                PlaneVpnService.ACTION_STATUS_CHANGED -> {
+                    val running = intent.getBooleanExtra(PlaneVpnService.EXTRA_RUNNING, false)
+                    val message = intent.getStringExtra(PlaneVpnService.EXTRA_STATUS_MESSAGE)
+                    updateVpnUi(running, message)
+                    updateLogView()
+                }
+                PlaneVpnService.ACTION_STATS_CHANGED -> {
+                    updateStats(intent.getStringExtra(PlaneVpnService.EXTRA_STATS_JSON).orEmpty())
+                }
+            }
+        }
+    }
+
+    private val uiTicker = object : Runnable {
+        override fun run() {
+            updateStats(PlaneVpnService.latestStatsJson)
+            updateLogView()
+            uiHandler.postDelayed(this, UI_REFRESH_MS)
         }
     }
 
-    // 系统 VPN 授权对话框的结果回调：用户点「允许」后启动 VPN 服务。
     private val prepareLauncher = registerForActivityResult(
         ActivityResultContracts.StartActivityForResult(),
     ) { result ->
@@ -68,39 +89,62 @@ class MainActivity : AppCompatActivity() {
         window.setSoftInputMode(WindowManager.LayoutParams.SOFT_INPUT_STATE_ALWAYS_HIDDEN)
         setContentView(R.layout.activity_main)
 
-        val versionView = findViewById<TextView>(R.id.nativeVersionText)
-        versionView.text = getString(R.string.native_version_label, readNativeVersion())
-
+        mainContent = findViewById(R.id.mainContent)
+        findViewById<TextView>(R.id.nativeVersionText).text =
+            getString(R.string.native_version_label, readNativeVersion())
         vpnStatusText = findViewById(R.id.vpnStatusText)
-        remoteHostInput = findViewById(R.id.remoteHostInput)
-        remotePortInput = findViewById(R.id.remotePortInput)
-        remoteKeyInput = findViewById(R.id.remoteKeyInput)
-        cipherInput = findViewById(R.id.cipherInput)
-        tlsCheckBox = findViewById(R.id.tlsCheckBox)
+        statsText = findViewById(R.id.statsText)
+        nodesContainer = findViewById(R.id.nodesContainer)
+        addNodeButton = findViewById<Button>(R.id.addNodeButton).apply {
+            setOnClickListener { addNodeRow(RemoteNodeConfig(name = "节点 ${nodeRows.size + 1}", host = "", port = 9090, key = "")) }
+        }
+        defaultRouteSpinner = findViewById(R.id.defaultRouteSpinner)
+        defaultRouteSpinner.adapter = ArrayAdapter(this, android.R.layout.simple_spinner_dropdown_item, routeActions)
+        directListInput = findViewById(R.id.directListInput)
+        proxyListInput = findViewById(R.id.proxyListInput)
+        advancedRulesInput = findViewById(R.id.advancedRulesInput)
+        presetNameInput = findViewById(R.id.presetNameInput)
+        presetSpinner = findViewById(R.id.presetSpinner)
+        importConfigInput = findViewById(R.id.importConfigInput)
+        logText = findViewById(R.id.logText)
+
         saveConfigButton = findViewById<Button>(R.id.saveConfigButton).apply {
             setOnClickListener { saveCurrentConfig(showSavedToast = true) }
         }
         toggleVpnButton = findViewById<Button>(R.id.toggleVpnButton).apply {
             setOnClickListener { onToggleClicked() }
         }
+        findViewById<Button>(R.id.savePresetButton).setOnClickListener { savePreset() }
+        findViewById<Button>(R.id.loadPresetButton).setOnClickListener { loadSelectedPreset() }
+        findViewById<Button>(R.id.deletePresetButton).setOnClickListener { deleteSelectedPreset() }
+        findViewById<Button>(R.id.importConfigButton).setOnClickListener { importConfig() }
+        findViewById<Button>(R.id.exportConfigButton).setOnClickListener { exportConfig() }
+        findViewById<Button>(R.id.clearLogButton).setOnClickListener {
+            AppLogStore.clear()
+            updateLogView()
+        }
+
+        refreshPresets()
         bindConfigToForm(VpnConfigStore.load(this))
-        findViewById<View>(R.id.mainContent).requestFocus()
+        mainContent.requestFocus()
         updateVpnUi(PlaneVpnService.isRunning)
+        updateStats(PlaneVpnService.latestStatsJson)
     }
 
     override fun onStart() {
         super.onStart()
-        ContextCompat.registerReceiver(
-            this,
-            statusReceiver,
-            IntentFilter(PlaneVpnService.ACTION_STATUS_CHANGED),
-            ContextCompat.RECEIVER_NOT_EXPORTED,
-        )
+        val filter = IntentFilter().apply {
+            addAction(PlaneVpnService.ACTION_STATUS_CHANGED)
+            addAction(PlaneVpnService.ACTION_STATS_CHANGED)
+        }
+        ContextCompat.registerReceiver(this, statusReceiver, filter, ContextCompat.RECEIVER_NOT_EXPORTED)
         updateVpnUi(PlaneVpnService.isRunning)
+        uiHandler.post(uiTicker)
     }
 
     override fun onStop() {
         runCatching { unregisterReceiver(statusReceiver) }
+        uiHandler.removeCallbacks(uiTicker)
         super.onStop()
     }
 
@@ -113,120 +157,338 @@ class MainActivity : AppCompatActivity() {
             stopVpn()
             return
         }
-
         if (saveCurrentConfig(showSavedToast = false) == null) return
-
-        // prepare 返回非 null Intent 表示尚未授权，需要拉起系统授权框；
-        // 返回 null 表示已授权，可直接启动。
-        val intent: Intent? = VpnService.prepare(this)
-        if (intent != null) {
-            prepareLauncher.launch(intent)
-        } else {
-            startVpn()
-        }
+        val intent = VpnService.prepare(this)
+        if (intent != null) prepareLauncher.launch(intent) else startVpn()
     }
 
     private fun startVpn() {
         val config = saveCurrentConfig(showSavedToast = false) ?: return
         val intent = Intent(this, PlaneVpnService::class.java)
             .setAction(PlaneVpnService.ACTION_START)
-            .putExtra(PlaneVpnService.EXTRA_REMOTE_HOST, config.remoteHost)
-            .putExtra(PlaneVpnService.EXTRA_REMOTE_PORT, config.remotePort)
-            .putExtra(PlaneVpnService.EXTRA_REMOTE_KEY, config.remoteKey)
-            .putExtra(PlaneVpnService.EXTRA_CIPHER, config.cipher)
-            .putExtra(PlaneVpnService.EXTRA_TLS, config.tls)
+            .putExtra(PlaneVpnService.EXTRA_CONFIG_JSON, config.toJsonString())
         ContextCompat.startForegroundService(this, intent)
         updateVpnUi(true, getString(R.string.vpn_status_connecting))
     }
 
     private fun stopVpn() {
-        val intent = Intent(this, PlaneVpnService::class.java)
-            .setAction(PlaneVpnService.ACTION_STOP)
-        // 用户正在前台操作时使用普通 startService 即可，避免 stop action 也触发
-        // startForegroundService 的 5 秒前台通知要求。
-        startService(intent)
+        startService(Intent(this, PlaneVpnService::class.java).setAction(PlaneVpnService.ACTION_STOP))
         updateVpnUi(false, getString(R.string.vpn_status_disconnecting))
     }
 
     private fun bindConfigToForm(config: AndroidVpnConfig) {
-        remoteHostInput.setText(config.remoteHost)
-        remotePortInput.setText(config.remotePort.toString())
-        remoteKeyInput.setText(config.remoteKey)
-        cipherInput.setText(config.cipher)
-        tlsCheckBox.isChecked = config.tls
+        nodesContainer.removeAllViews()
+        nodeRows.clear()
+        config.remotes.forEach { addNodeRow(it) }
+        if (nodeRows.isEmpty()) addNodeRow(AndroidVpnConfig.defaultConfig().remotes.first())
+
+        defaultRouteSpinner.setSelection(routeActions.indexOf(config.routing.defaultAction).coerceAtLeast(0))
+        directListInput.setText(
+            config.routing.rules
+                .filter { it.type == "domain_pattern" && it.action == "direct" }
+                .joinToString("\n") { it.value },
+        )
+        proxyListInput.setText(
+            config.routing.rules
+                .filter { it.type == "domain_pattern" && it.action == "proxy" }
+                .joinToString("\n") { it.value },
+        )
+        advancedRulesInput.setText(
+            config.routing.rules
+                .filterNot { it.type == "domain_pattern" && (it.action == "direct" || it.action == "proxy") }
+                .joinToString("\n") { "${it.type},${it.value},${it.action}" },
+        )
+    }
+
+    private fun addNodeRow(node: RemoteNodeConfig) {
+        val row = NodeRow.create(this, node) {
+            if (nodeRows.size <= 1) {
+                Toast.makeText(this, R.string.node_keep_one, Toast.LENGTH_SHORT).show()
+            } else {
+                nodesContainer.removeView(it.root)
+                nodeRows.remove(it)
+            }
+        }
+        nodeRows += row
+        nodesContainer.addView(row.root)
     }
 
     private fun saveCurrentConfig(showSavedToast: Boolean): AndroidVpnConfig? {
         val config = readConfigFromForm() ?: return null
-        VpnConfigStore.save(this, config)
-        if (showSavedToast) {
-            Toast.makeText(this, R.string.config_saved, Toast.LENGTH_SHORT).show()
+        config.validate()?.let {
+            Toast.makeText(this, it, Toast.LENGTH_LONG).show()
+            return null
         }
+        VpnConfigStore.save(this, config)
+        if (showSavedToast) Toast.makeText(this, R.string.config_saved, Toast.LENGTH_SHORT).show()
         return config
     }
 
     private fun readConfigFromForm(): AndroidVpnConfig? {
-        remoteHostInput.error = null
-        remotePortInput.error = null
-        remoteKeyInput.error = null
-
-        val host = remoteHostInput.text.toString().trim()
-        if (host.isBlank()) {
-            remoteHostInput.error = getString(R.string.config_error_host)
-            remoteHostInput.requestFocus()
-            return null
+        val remotes = nodeRows.mapIndexed { index, row ->
+            row.clearErrors()
+            val port = row.portInput.text.toString().trim().toIntOrNull() ?: 0
+            if (row.enabledCheckBox.isChecked) {
+                if (row.hostInput.text.toString().trim().isBlank()) {
+                    row.hostInput.error = getString(R.string.config_error_host)
+                    row.hostInput.requestFocus()
+                    return null
+                }
+                if (port !in 1..65535) {
+                    row.portInput.error = getString(R.string.config_error_port)
+                    row.portInput.requestFocus()
+                    return null
+                }
+                if (row.keyInput.text.toString().isBlank()) {
+                    row.keyInput.error = getString(R.string.config_error_key)
+                    row.keyInput.requestFocus()
+                    return null
+                }
+            }
+            RemoteNodeConfig(
+                name = row.nameInput.text.toString().trim().ifBlank { "节点 ${index + 1}" },
+                host = row.hostInput.text.toString().trim(),
+                port = port,
+                key = row.keyInput.text.toString(),
+                cipher = row.cipherInput.text.toString().trim().ifBlank { VpnConfigStore.DEFAULT_CIPHER },
+                tls = row.tlsCheckBox.isChecked,
+                enabled = row.enabledCheckBox.isChecked,
+            )
         }
 
-        val port = remotePortInput.text.toString().trim().toIntOrNull()
-        if (port == null || port !in 1..65535) {
-            remotePortInput.error = getString(R.string.config_error_port)
-            remotePortInput.requestFocus()
-            return null
+        val rules = mutableListOf<RouteRuleConfig>()
+        rules += readDomainPatternRules(directListInput, "direct")
+        rules += readDomainPatternRules(proxyListInput, "proxy")
+        rules += readAdvancedRules() ?: return null
+
+        return AndroidVpnConfig(
+            remotes = remotes,
+            routing = AndroidRoutingConfig(
+                defaultAction = routeActions[defaultRouteSpinner.selectedItemPosition],
+                rules = rules,
+            ),
+        )
+    }
+
+    private fun readDomainPatternRules(input: EditText, action: String): List<RouteRuleConfig> =
+        input.text.lineSequence()
+            .map { it.substringBefore("#").trim() }
+            .filter { it.isNotBlank() }
+            .map { RouteRuleConfig("domain_pattern", it, action) }
+            .toList()
+
+    private fun readAdvancedRules(): List<RouteRuleConfig>? {
+        val rules = mutableListOf<RouteRuleConfig>()
+        advancedRulesInput.text.lineSequence().forEachIndexed { index, raw ->
+            val line = raw.substringBefore("#").trim()
+            if (line.isBlank()) return@forEachIndexed
+            val parts = if (line.contains(",")) {
+                line.split(",").map { it.trim() }
+            } else {
+                line.split(Regex("\\s+")).map { it.trim() }
+            }
+            if (parts.size < 3) {
+                advancedRulesInput.error = "第 ${index + 1} 行格式应为 type,value,action"
+                advancedRulesInput.requestFocus()
+                return null
+            }
+            rules += RouteRuleConfig(parts[0], parts[1], parts[2])
         }
+        advancedRulesInput.error = null
+        return rules
+    }
 
-        val key = remoteKeyInput.text.toString()
-        if (key.isBlank()) {
-            remoteKeyInput.error = getString(R.string.config_error_key)
-            remoteKeyInput.requestFocus()
-            return null
+    private fun refreshPresets() {
+        presets = VpnConfigStore.loadPresets(this)
+        val names = presets.map { it.name }.ifEmpty { listOf(getString(R.string.no_presets)) }
+        presetSpinner.adapter = ArrayAdapter(this, android.R.layout.simple_spinner_dropdown_item, names)
+    }
+
+    private fun savePreset() {
+        val config = saveCurrentConfig(showSavedToast = false) ?: return
+        val name = presetNameInput.text.toString().trim()
+        if (name.isBlank()) {
+            presetNameInput.error = getString(R.string.preset_name_required)
+            presetNameInput.requestFocus()
+            return
         }
+        VpnConfigStore.savePreset(this, name, config)
+        refreshPresets()
+        Toast.makeText(this, R.string.preset_saved, Toast.LENGTH_SHORT).show()
+    }
+
+    private fun loadSelectedPreset() {
+        val preset = selectedPreset() ?: return
+        bindConfigToForm(preset.config)
+        VpnConfigStore.save(this, preset.config)
+        Toast.makeText(this, R.string.preset_loaded, Toast.LENGTH_SHORT).show()
+    }
 
-        val tls = tlsCheckBox.isChecked
-        if (tls) {
-            Toast.makeText(this, R.string.config_error_tls_unsupported, Toast.LENGTH_LONG).show()
-            tlsCheckBox.requestFocus()
+    private fun deleteSelectedPreset() {
+        val preset = selectedPreset() ?: return
+        VpnConfigStore.deletePreset(this, preset.name)
+        refreshPresets()
+        Toast.makeText(this, R.string.preset_deleted, Toast.LENGTH_SHORT).show()
+    }
+
+    private fun selectedPreset(): ConfigPreset? {
+        if (presets.isEmpty()) {
+            Toast.makeText(this, R.string.no_presets, Toast.LENGTH_SHORT).show()
             return null
         }
+        return presets.getOrNull(presetSpinner.selectedItemPosition)
+    }
 
-        return AndroidVpnConfig(
-            remoteHost = host,
-            remotePort = port,
-            remoteKey = key,
-            cipher = VpnConfigStore.DEFAULT_CIPHER,
-            tls = tls,
-        )
+    private fun importConfig() {
+        val imported = runCatching { AndroidVpnConfig.fromImportText(importConfigInput.text.toString()) }
+            .onFailure { Toast.makeText(this, "导入失败: ${it.message}", Toast.LENGTH_LONG).show() }
+            .getOrNull() ?: return
+        imported.validate()?.let {
+            Toast.makeText(this, it, Toast.LENGTH_LONG).show()
+            return
+        }
+        bindConfigToForm(imported)
+        VpnConfigStore.save(this, imported)
+        Toast.makeText(this, R.string.config_imported, Toast.LENGTH_SHORT).show()
     }
 
-    private fun updateVpnUi(
-        running: Boolean,
-        message: String? = null,
-    ) {
+    private fun exportConfig() {
+        val config = saveCurrentConfig(showSavedToast = false) ?: return
+        importConfigInput.setText(config.toDesktopYaml())
+        Toast.makeText(this, R.string.config_exported, Toast.LENGTH_SHORT).show()
+    }
+
+    private fun updateVpnUi(running: Boolean, message: String? = null) {
         vpnRunning = running
-        toggleVpnButton.text = getString(
-            if (running) R.string.disconnect_vpn else R.string.connect_vpn,
-        )
-        vpnStatusText.text = message ?: getString(
-            if (running) R.string.vpn_status_connected else R.string.vpn_status_idle,
-        )
+        toggleVpnButton.text = getString(if (running) R.string.disconnect_vpn else R.string.connect_vpn)
+        vpnStatusText.text = message ?: getString(if (running) R.string.vpn_status_connected else R.string.vpn_status_idle)
         setConfigInputsEnabled(!running)
     }
 
     private fun setConfigInputsEnabled(enabled: Boolean) {
-        remoteHostInput.isEnabled = enabled
-        remotePortInput.isEnabled = enabled
-        remoteKeyInput.isEnabled = enabled
-        saveConfigButton.isEnabled = enabled
-        tlsCheckBox.isEnabled = enabled
-        cipherInput.isEnabled = false
+        nodeRows.forEach { it.setEnabled(enabled) }
+        listOf(
+            addNodeButton,
+            saveConfigButton,
+            defaultRouteSpinner,
+            directListInput,
+            proxyListInput,
+            advancedRulesInput,
+            presetNameInput,
+            presetSpinner,
+            importConfigInput,
+            findViewById<Button>(R.id.savePresetButton),
+            findViewById<Button>(R.id.loadPresetButton),
+            findViewById<Button>(R.id.deletePresetButton),
+            findViewById<Button>(R.id.importConfigButton),
+            findViewById<Button>(R.id.exportConfigButton),
+        ).forEach { it.isEnabled = enabled }
+    }
+
+    private fun updateStats(json: String) {
+        val text = runCatching {
+            val obj = JSONObject(json.ifBlank { "{}" })
+            val up = formatBytes(obj.optLong("upload_bytes", 0))
+            val down = formatBytes(obj.optLong("download_bytes", 0))
+            val active = obj.optLong("active_connections", 0)
+            val total = obj.optLong("total_connections", 0)
+            val proxy = obj.optLong("proxy_connections", 0)
+            val direct = obj.optLong("direct_connections", 0)
+            val rejected = obj.optLong("rejected_connections", 0)
+            val node = obj.optString("active_node", "-").ifBlank { "-" }
+            "上行 $up / 下行 $down\n连接 活跃 $active / 总计 $total · 代理 $proxy · 直连 $direct · 拒绝 $rejected\n当前节点 $node"
+        }.getOrElse {
+            getString(R.string.stats_empty)
+        }
+        statsText.text = text
+    }
+
+    private fun updateLogView() {
+        logText.text = AppLogStore.snapshot().takeLast(80).joinToString("\n")
+    }
+
+    private fun formatBytes(value: Long): String {
+        val units = arrayOf("B", "KB", "MB", "GB")
+        var size = value.toDouble()
+        var unit = 0
+        while (size >= 1024 && unit < units.lastIndex) {
+            size /= 1024
+            unit += 1
+        }
+        return if (unit == 0) "${value}B" else String.format(Locale.US, "%.1f%s", size, units[unit])
+    }
+
+    private class NodeRow private constructor(
+        val root: LinearLayout,
+        val nameInput: EditText,
+        val hostInput: EditText,
+        val portInput: EditText,
+        val keyInput: EditText,
+        val cipherInput: EditText,
+        val tlsCheckBox: CheckBox,
+        val enabledCheckBox: CheckBox,
+        private val removeButton: Button,
+    ) {
+        fun clearErrors() {
+            hostInput.error = null
+            portInput.error = null
+            keyInput.error = null
+        }
+
+        fun setEnabled(enabled: Boolean) {
+            listOf(nameInput, hostInput, portInput, keyInput, cipherInput, tlsCheckBox, enabledCheckBox, removeButton)
+                .forEach { it.isEnabled = enabled }
+        }
+
+        companion object {
+            fun create(context: Context, node: RemoteNodeConfig, onRemove: (NodeRow) -> Unit): NodeRow {
+                val root = LinearLayout(context).apply {
+                    orientation = LinearLayout.VERTICAL
+                    setPadding(0, 8.dp(context), 0, 18.dp(context))
+                    layoutParams = LinearLayout.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT)
+                }
+                fun input(hint: String, text: String, type: Int = InputType.TYPE_CLASS_TEXT): EditText =
+                    EditText(context).apply {
+                        this.hint = hint
+                        setText(text)
+                        inputType = type
+                        isSingleLine = type != (InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_FLAG_MULTI_LINE)
+                    }
+
+                val name = input("名称", node.name)
+                val host = input("地址，例如 1.2.3.4 或 example.com", node.host, InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_URI)
+                val port = input("端口", node.port.toString(), InputType.TYPE_CLASS_NUMBER)
+                val key = input("加密密钥", node.key, InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD)
+                val cipher = input("加密方式", node.cipher)
+                val tls = CheckBox(context).apply {
+                    text = "TLS 出站"
+                    isChecked = node.tls
+                }
+                val enabled = CheckBox(context).apply {
+                    text = "启用节点"
+                    isChecked = node.enabled
+                }
+                val remove = Button(context).apply { text = "删除节点" }
+                root.addView(name)
+                root.addView(host)
+                root.addView(port)
+                root.addView(key)
+                root.addView(cipher)
+                root.addView(tls)
+                root.addView(enabled)
+                root.addView(remove)
+                lateinit var row: NodeRow
+                row = NodeRow(root, name, host, port, key, cipher, tls, enabled, remove)
+                remove.setOnClickListener { onRemove(row) }
+                return row
+            }
+
+            private fun Int.dp(context: Context): Int =
+                (this * context.resources.displayMetrics.density).toInt()
+        }
+    }
+
+    companion object {
+        private const val UI_REFRESH_MS = 1000L
     }
 }
diff --git a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
index 82fd2a7..b54e9b2 100644
--- a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
+++ b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
@@ -8,46 +8,36 @@ import android.content.Intent
 import android.content.pm.ServiceInfo
 import android.net.VpnService
 import android.os.Build
+import android.os.Handler
+import android.os.Looper
 import android.os.ParcelFileDescriptor
 import android.util.Log
 import androidx.core.app.NotificationCompat
-import org.json.JSONObject
-
-/**
- * 系统 VPN 服务。
- *
- * 职责：
- * - 作为前台 [VpnService] 建立 TUN 接口并把 fd 移交给 plane-core。
- * - 持有 [NativeBridge]，对接 Rust → Kotlin 的 `protect` / `onStatus` 回调。
- *   `protect(fd)` 复用 [VpnService] 自带方法，把出站 socket 排除出 TUN（防回环 0.3-1）。
- * - 通过应用内状态广播把连接/断开/异常状态同步给 [MainActivity]。
- */
-class PlaneVpnService : VpnService() {
 
-    /**
-     * JNI 桥接实例，关联本服务以便 Rust 回调 `protect` / `onStatus`。
-     * A3/A6 起用它调用 `nativeStart` / `nativeStop`。
-     */
+class PlaneVpnService : VpnService() {
     private val bridge: NativeBridge by lazy { NativeBridge(this) }
+    private val mainHandler = Handler(Looper.getMainLooper())
 
-    /** 当前会话 handle（0 = 未启动）。由 `nativeStart` 赋值。 */
     private var nativeHandle: Long = 0L
-
-    /** 是否已经进入前台；用于避免 stopForeground 在未前台化时被调用。 */
-    private var foregroundStarted: Boolean = false
-
-    /**
-     * 当前 TUN 接口（仅用于在未成功 detachFd 前的兜底关闭）。
-     *
-     * 正常路径下 [establishTun] 会 `detachFd()` 把 fd 所有权移交 Rust，此后由
-     * native 侧在 stop/Drop 时 `close(fd)`；本字段届时为 null。仅当 establish 成功
-     * 但 nativeStart 失败时，用它关闭尚未移交的接口，避免泄漏。
-     */
+    private var foregroundStarted = false
     private var tunInterface: ParcelFileDescriptor? = null
 
+    private val statsTicker = object : Runnable {
+        override fun run() {
+            val handle = nativeHandle
+            if (handle == 0L) return
+            val json = runCatching { bridge.nativeStats(handle) }
+                .onFailure { Log.w(TAG, "nativeStats failed", it) }
+                .getOrElse { """{"running":true,"state":"stats_error"}""" }
+            latestStatsJson = json
+            publishStats(json)
+            mainHandler.postDelayed(this, STATS_INTERVAL_MS)
+        }
+    }
+
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
         if (intent?.action == ACTION_STOP) {
-            Log.i(TAG, "收到停止 VPN 指令")
+            AppLogStore.add("收到停止 VPN 指令")
             stopSelfSafely()
             return START_NOT_STICKY
         }
@@ -56,157 +46,99 @@ class PlaneVpnService : VpnService() {
         startForegroundCompat(getString(R.string.vpn_status_connecting))
         publishStatus(running = true, message = getString(R.string.vpn_status_connecting))
 
-        // 已在运行则不重复启动（避免重复 establish/ nativeStart）。
         if (nativeHandle != 0L) {
-            Log.i(TAG, "数据面已在运行，忽略重复 onStartCommand")
             publishStatus(running = true, message = getString(R.string.vpn_status_connected))
             return START_STICKY
         }
 
         if (!startDataPlane(intent)) {
-            // 启动失败：退出前台并停止自身，保证不残留半启动状态。
-            Log.e(TAG, "数据面启动失败，停止服务")
             publishStatus(running = false, message = getString(R.string.vpn_status_error))
             stopSelfSafely()
             return START_NOT_STICKY
         }
+
         publishStatus(running = true, message = getString(R.string.vpn_status_connected))
         return START_STICKY
     }
 
-    /**
-     * 建立 TUN 并拉起 native 数据面。成功返回 true。
-     *
-     * 流程（A6）：
-     *  1. [establishTun] 配置路由/DNS/MTU 并 `establish()`。
-     *  2. `detachFd()` 取出 fd，**所有权移交 Rust**（此后 Java 不再 close）。
-     *  3. [NativeBridge.nativeStart] 传入 fd 与 configJson 启动栈+调度器。
-     */
     private fun startDataPlane(intent: Intent?): Boolean {
         val pfd = establishTun() ?: run {
-            Log.e(TAG, "establish TUN 失败（可能未授权或被系统拒绝）")
+            Log.e(TAG, "establish TUN failed")
+            AppLogStore.add("建立 TUN 失败，请确认 VPN 授权")
             return false
         }
         tunInterface = pfd
 
         val configJson = buildConfigJson(intent)
         val nativeBridge = runCatching { bridge }
-            .onFailure { Log.e(TAG, "NativeBridge 初始化失败", it) }
+            .onFailure { Log.e(TAG, "NativeBridge init failed", it) }
             .getOrElse {
                 closeTunBeforeDetach()
                 return false
             }
-        val fd = pfd.detachFd() // 所有权移交 native；detach 后 pfd 不再持有 fd。
-        tunInterface = null // 已移交，置空避免误 close。
 
+        val fd = pfd.detachFd()
+        tunInterface = null
         val handle = runCatching { nativeBridge.nativeStart(fd, configJson) }
-            .onFailure { Log.e(TAG, "nativeStart 抛出异常", it) }
+            .onFailure { Log.e(TAG, "nativeStart threw", it) }
             .getOrDefault(0L)
 
         if (handle == 0L) {
-            // nativeStart 失败：fd 已 detach 给 native，但 native 启动失败时其内部
-            // 会负责回收（from_raw_fd 失败路径不持有 fd / 成功则 Drop 时 close）。
-            // 这里仅记录，无法再安全 close 已 detach 的 fd。
-            Log.e(TAG, "nativeStart 返回 0（启动失败）")
+            AppLogStore.add("nativeStart 返回 0，数据面启动失败")
             return false
         }
+
         nativeHandle = handle
-        Log.i(TAG, "数据面已启动，handle=$handle")
+        startStatsTicker()
+        AppLogStore.add("数据面已启动")
+        Log.i(TAG, "data plane started, handle=$handle")
         return true
     }
 
-    /**
-     * native 尚未接管 fd 前的失败路径清理。
-     *
-     * 一旦调用 `detachFd()`，fd 所有权就不再属于 [ParcelFileDescriptor]，Kotlin 侧也
-     * 不能安全关闭；所以所有可能在 detach 前失败的初始化都必须先走这里兜底关闭。
-     */
     private fun closeTunBeforeDetach() {
         tunInterface?.let {
-            runCatching { it.close() }.onFailure { e -> Log.w(TAG, "关闭未移交 TUN 失败", e) }
+            runCatching { it.close() }.onFailure { e -> Log.w(TAG, "close TUN failed", e) }
         }
         tunInterface = null
     }
 
-    /**
-     * 配置并建立 TUN 接口。
-     *
-     * - 地址：给 TUN 一个 FakeIP 网段内的 IPv4（198.19.255.254/15）+ IPv6（[TUN_ADDRESS_V6]/128），作为应用流量源。
-     *   **必须**与用户态 smoltcp 栈接口同网段（198.18.0.0/15），否则栈回 SYN-ACK 时
-     *   因源地址不可路由而发不出去，三次握手永不完成，表现为「开 VPN 后 TCP 全部打不开」。
-     *   选用网段高位地址 198.19.255.254，避开从 198.18.0.1 递增分配的 FakeIP 与 DNS 服务器地址。
-     * - 路由：`0.0.0.0/0` 接管所有 IPv4（含 FakeIP 段 198.18.0.0/15）；同时 `::/0`
-     *   接管所有 IPv6。native 数据面 MVP 仅做 IPv4 出站，IPv6 包进栈后被丢弃，促使
-     *   应用 fallback 到 IPv4——若不接管 IPv6，手机走 IPv6 时流量会绕过隧道（泄漏），
-     *   或因 happy-eyeballs 优先 IPv6 而表现为「开 VPN 后什么都打不开」。
-     * - DNS：指向 FakeDNS 服务器 198.18.0.1，使 DNS 查询进栈走 FakeDNS。
-     * - MTU：1500（与 native 默认一致）。
-     */
-    private fun establishTun(): ParcelFileDescriptor? {
-        return runCatching {
+    private fun establishTun(): ParcelFileDescriptor? =
+        runCatching {
             Builder()
                 .setSession(getString(R.string.app_name))
                 .setMtu(TUN_MTU)
                 .addAddress(TUN_ADDRESS, TUN_PREFIX)
-                // 全局接管所有 IPv4 流量（含 FakeIP 198.18.0.0/15）。
                 .addRoute("0.0.0.0", 0)
-                // 同时接管 IPv6：MVP 不做 IPv6 出站，进栈后丢弃，促使应用回退 IPv4，
-                // 避免 IPv6 流量绕过隧道造成泄漏 / happy-eyeballs 卡死。
                 .addAddress(TUN_ADDRESS_V6, TUN_PREFIX_V6)
                 .addRoute("::", 0)
-                // DNS 指向 FakeDNS 服务器地址，DNS 查询将被用户态栈用 FakeIP 应答。
                 .addDnsServer(FAKE_DNS_SERVER)
                 .establish()
-        }.onFailure { Log.e(TAG, "establish 异常", it) }.getOrNull()
-    }
+        }.onFailure { Log.e(TAG, "establish threw", it) }.getOrNull()
 
-    /**
-     * 组装下发给 native 的 configJson。
-     *
-     * 节点配置优先使用 Activity 显式传入的 extra，缺省时回落到 [VpnConfigStore]
-     * 的默认值。这样 UI、持久化和 Service 启动参数只维护一套默认配置。
-     */
     private fun buildConfigJson(intent: Intent?): String {
-        val host = intent?.getStringExtra(EXTRA_REMOTE_HOST)
-            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_REMOTE_HOST
-        val port = (intent?.getIntExtra(EXTRA_REMOTE_PORT, 0) ?: 0)
-            .takeIf { it != 0 } ?: VpnConfigStore.DEFAULT_REMOTE_PORT
-        val key = intent?.getStringExtra(EXTRA_REMOTE_KEY)
-            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_REMOTE_KEY
-        val cipher = intent?.getStringExtra(EXTRA_CIPHER)
-            ?.takeIf { it.isNotBlank() } ?: VpnConfigStore.DEFAULT_CIPHER
-        val tls = intent?.getBooleanExtra(EXTRA_TLS, VpnConfigStore.DEFAULT_TLS)
-            ?: VpnConfigStore.DEFAULT_TLS
-
-        val json = JSONObject()
-            .put("mtu", TUN_MTU)
-            .put("remote_host", host)
-            .put("remote_port", port)
-            .put("remote_key", key)
-            .put("cipher", cipher)
-            .put("tls", tls)
-        Log.i(TAG, "节点配置 host=$host port=$port cipher=$cipher tls=$tls")
-        return json.toString()
+        val explicit = intent?.getStringExtra(EXTRA_CONFIG_JSON)?.takeIf { it.isNotBlank() }
+        val json = explicit ?: VpnConfigStore.load(this).toJsonString()
+        val summary = runCatching {
+            val config = AndroidVpnConfig.fromJson(json)
+            "节点 ${config.remotes.count { it.enabled }}/${config.remotes.size}，规则 ${config.routing.rules.size}，默认 ${config.routing.defaultAction}"
+        }.getOrDefault("原始配置")
+        AppLogStore.add("加载配置：$summary")
+        Log.i(TAG, "VPN config: $summary")
+        return json
     }
 
-    /**
-     * 接收来自 Rust（经 [NativeBridge.onStatus]）的状态上报。
-     *
-     * 当前先同步到 Activity；后续 B7 可在这里扩展流量统计与更细的健康状态。
-     */
     fun onNativeStatus(state: String) {
         Log.i(TAG, "native status: $state")
+        AppLogStore.add("native: $state")
         val message = when (state) {
             "connected" -> getString(R.string.vpn_status_connected)
             "error" -> getString(R.string.vpn_status_error)
+            "stopped" -> getString(R.string.vpn_status_idle)
             else -> state
         }
         publishStatus(running = isRunning, message = message)
     }
 
-    /**
-     * 用户在系统设置里撤销 VPN 授权时回调。A6 起须在此 nativeStop 并清理。
-     */
     override fun onRevoke() {
         stopSelfSafely()
         super.onRevoke()
@@ -223,21 +155,28 @@ class PlaneVpnService : VpnService() {
     }
 
     private fun cleanupDataPlane() {
-        // 1) 回收 native 会话：nativeStop 内部 send(shutdown) 让栈/调度器优雅退出，
-        //    并在 Drop 时 close(TUN fd)。handle 为 0 时为 no-op。
         if (nativeHandle != 0L) {
             runCatching { bridge.nativeStop(nativeHandle) }
-                .onFailure { Log.e(TAG, "nativeStop 异常", it) }
+                .onFailure { Log.e(TAG, "nativeStop threw", it) }
             nativeHandle = 0L
         }
-        // 2) 兜底：仅当 establish 成功但尚未 detach 给 native（nativeStart 之前失败）时，
-        //    此处关闭未移交的接口，避免 fd 泄漏。正常路径 tunInterface 已为 null。
+        stopStatsTicker()
         closeTunBeforeDetach()
         stopForegroundRemoveCompat()
         publishStatus(running = false, message = getString(R.string.vpn_status_idle))
     }
 
-    /** 退出前台并移除通知，兼容 API < 33（`stopForeground(int)` 重载 API 33+）。 */
+    private fun startStatsTicker() {
+        mainHandler.removeCallbacks(statsTicker)
+        mainHandler.post(statsTicker)
+    }
+
+    private fun stopStatsTicker() {
+        mainHandler.removeCallbacks(statsTicker)
+        latestStatsJson = """{"running":false,"state":"stopped"}"""
+        publishStats(latestStatsJson)
+    }
+
     private fun stopForegroundRemoveCompat() {
         if (!foregroundStarted) return
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
@@ -251,9 +190,7 @@ class PlaneVpnService : VpnService() {
 
     private fun startForegroundCompat(statusText: String) {
         val notification = buildNotification(statusText)
-
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            // targetSdk 34：前台服务必须指定类型，VPN 使用 specialUse。
             startForeground(
                 NOTIFICATION_ID,
                 notification,
@@ -279,33 +216,37 @@ class PlaneVpnService : VpnService() {
         nm.notify(NOTIFICATION_ID, buildNotification(statusText))
     }
 
-    /**
-     * 向同应用内 Activity 广播当前 VPN 状态。
-     *
-     * 使用 `setPackage(packageName)` 限定广播只发给本应用，避免把连接状态泄露给其它应用。
-     * Activity 只负责展示，不直接推断 Service 生命周期。
-     */
     private fun publishStatus(running: Boolean, message: String) {
         isRunning = running
+        AppLogStore.add(message)
         updateForegroundNotification(message)
-        val intent = Intent(ACTION_STATUS_CHANGED)
-            .setPackage(packageName)
-            .putExtra(EXTRA_RUNNING, running)
-            .putExtra(EXTRA_STATUS_MESSAGE, message)
-        sendBroadcast(intent)
+        sendBroadcast(
+            Intent(ACTION_STATUS_CHANGED)
+                .setPackage(packageName)
+                .putExtra(EXTRA_RUNNING, running)
+                .putExtra(EXTRA_STATUS_MESSAGE, message),
+        )
+    }
+
+    private fun publishStats(json: String) {
+        sendBroadcast(
+            Intent(ACTION_STATS_CHANGED)
+                .setPackage(packageName)
+                .putExtra(EXTRA_STATS_JSON, json),
+        )
     }
 
     private fun ensureNotificationChannel() {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
             val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-            val existing = nm.getNotificationChannel(CHANNEL_ID)
-            if (existing == null) {
-                val channel = NotificationChannel(
-                    CHANNEL_ID,
-                    getString(R.string.notification_channel_name),
-                    NotificationManager.IMPORTANCE_LOW,
+            if (nm.getNotificationChannel(CHANNEL_ID) == null) {
+                nm.createNotificationChannel(
+                    NotificationChannel(
+                        CHANNEL_ID,
+                        getString(R.string.notification_channel_name),
+                        NotificationManager.IMPORTANCE_LOW,
+                    ),
                 )
-                nm.createNotificationChannel(channel)
             }
         }
     }
@@ -314,49 +255,38 @@ class PlaneVpnService : VpnService() {
         private const val TAG = "PlaneVpnService"
         private const val CHANNEL_ID = "plane_vpn_status"
         private const val NOTIFICATION_ID = 1001
+        private const val STATS_INTERVAL_MS = 1000L
 
-        /** 启动 / 停止 Service 的显式 action，避免 Activity 与 Service 约定隐式行为。 */
         const val ACTION_START = "com.proxy.android.action.START_VPN"
         const val ACTION_STOP = "com.proxy.android.action.STOP_VPN"
-
-        /** Service → Activity 状态广播 action 与 extra。 */
         const val ACTION_STATUS_CHANGED = "com.proxy.android.action.VPN_STATUS_CHANGED"
+        const val ACTION_STATS_CHANGED = "com.proxy.android.action.VPN_STATS_CHANGED"
+
         const val EXTRA_RUNNING = "extra_running"
         const val EXTRA_STATUS_MESSAGE = "extra_status_message"
+        const val EXTRA_STATS_JSON = "extra_stats_json"
+        const val EXTRA_CONFIG_JSON = "extra_config_json"
+
+        // Kept for compatibility with older local smoke tests.
+        const val EXTRA_REMOTE_HOST = "extra_remote_host"
+        const val EXTRA_REMOTE_PORT = "extra_remote_port"
+        const val EXTRA_REMOTE_KEY = "extra_remote_key"
+        const val EXTRA_CIPHER = "extra_cipher"
+        const val EXTRA_TLS = "extra_tls"
 
-        /** 当前进程内的 VPN 运行态，供 Activity 首次进入时同步按钮状态。 */
         @Volatile
         var isRunning: Boolean = false
             private set
 
-        /** TUN MTU，与 native AndroidConfig 默认一致。 */
-        private const val TUN_MTU = 1500
+        @Volatile
+        var latestStatsJson: String = """{"running":false,"state":"stopped"}"""
+            private set
 
-        /**
-         * TUN 接口地址与前缀（应用流量源地址）。
-         *
-         * 必须落在用户态 smoltcp 栈接口网段 198.18.0.0/15 内，否则栈无法把 SYN-ACK
-         * 路由回应用侧，TCP 握手无法完成。取网段高位 198.19.255.254 以避开 FakeIP 分配
-         * （从 198.18.0.1 起递增）与 DNS 服务器地址（198.18.0.1）。
-         */
+        private const val TUN_MTU = 1500
         private const val TUN_ADDRESS = "198.19.255.254"
         private const val TUN_PREFIX = 15
-
-        /**
-         * TUN 接口 IPv6 私有地址与前缀（ULA fd00::/8 段）。
-         * 仅用于接管 IPv6 流量使其进栈后丢弃、促使应用回退 IPv4，本身不做 IPv6 出站。
-         */
         private const val TUN_ADDRESS_V6 = "fd00::2"
         private const val TUN_PREFIX_V6 = 128
-
-        /** FakeDNS 服务器地址（与 native FakeIP 池 198.18.0.1 一致）。 */
         private const val FAKE_DNS_SERVER = "198.18.0.1"
-
-        /** 启动 Intent 的节点配置 extra key（可选，缺省时用下方写死默认值）。 */
-        const val EXTRA_REMOTE_HOST = "extra_remote_host"
-        const val EXTRA_REMOTE_PORT = "extra_remote_port"
-        const val EXTRA_REMOTE_KEY = "extra_remote_key"
-        const val EXTRA_CIPHER = "extra_cipher"
-        const val EXTRA_TLS = "extra_tls"
     }
 }
diff --git a/android-app/app/src/main/res/layout/activity_main.xml b/android-app/app/src/main/res/layout/activity_main.xml
index b85bc08..f038bba 100644
--- a/android-app/app/src/main/res/layout/activity_main.xml
+++ b/android-app/app/src/main/res/layout/activity_main.xml
@@ -12,145 +12,218 @@
         android:descendantFocusability="beforeDescendants"
         android:focusable="true"
         android:focusableInTouchMode="true"
-        android:gravity="center_horizontal"
         android:orientation="vertical"
-        android:padding="24dp">
+        android:padding="20dp">
 
         <TextView
             android:id="@+id/nativeVersionText"
-            android:layout_width="wrap_content"
+            android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="12dp"
-            android:text="native 版本: -"
+            android:layout_marginBottom="8dp"
+            android:text="@string/native_version_placeholder"
             android:textColor="@color/app_text_secondary"
-            android:textSize="16sp" />
+            android:textSize="14sp" />
 
         <TextView
             android:id="@+id/vpnStatusText"
-            android:layout_width="wrap_content"
+            android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="18dp"
+            android:layout_marginBottom="12dp"
             android:text="@string/vpn_status_idle"
             android:textColor="@color/app_text_primary"
             android:textSize="18sp"
             android:textStyle="bold" />
 
+        <TextView
+            android:id="@+id/statsText"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:text="@string/stats_empty"
+            android:textColor="@color/app_text_secondary"
+            android:textSize="13sp" />
+
         <Button
             android:id="@+id/toggleVpnButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
             android:backgroundTint="@color/app_primary"
-            android:textColor="@android:color/white"
-            android:text="@string/connect_vpn" />
+            android:text="@string/connect_vpn"
+            android:textColor="@android:color/white" />
 
         <TextView
+            style="@style/AppSectionTitle"
+            android:text="@string/nodes_title" />
+
+        <LinearLayout
+            android:id="@+id/nodesContainer"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginTop="28dp"
-            android:layout_marginBottom="12dp"
-            android:text="@string/settings_title"
-            android:textColor="@color/app_text_primary"
-            android:textSize="18sp"
-            android:textStyle="bold" />
+            android:orientation="vertical" />
 
-        <TextView
+        <Button
+            android:id="@+id/addNodeButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:labelFor="@id/remoteHostInput"
-            android:textColor="@color/app_text_primary"
-            android:text="@string/remote_host_label" />
+            android:text="@string/add_node" />
 
-        <EditText
-            android:id="@+id/remoteHostInput"
+        <TextView
+            style="@style/AppSectionTitle"
+            android:text="@string/routing_title" />
+
+        <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="12dp"
-            android:hint="@string/remote_host_hint"
-            android:inputType="textUri"
-            android:textColor="@color/app_text_primary"
-            android:textColorHint="@color/app_text_secondary"
-            android:singleLine="true" />
+            android:text="@string/default_route_label"
+            android:textColor="@color/app_text_primary" />
 
-        <TextView
+        <Spinner
+            android:id="@+id/defaultRouteSpinner"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:labelFor="@id/remotePortInput"
-            android:textColor="@color/app_text_primary"
-            android:text="@string/remote_port_label" />
+            android:layout_marginBottom="12dp" />
 
         <EditText
-            android:id="@+id/remotePortInput"
+            android:id="@+id/directListInput"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="12dp"
-            android:hint="@string/remote_port_hint"
-            android:inputType="number"
-            android:maxLength="5"
+            android:hint="@string/direct_list_hint"
+            android:inputType="textMultiLine|textNoSuggestions"
+            android:minLines="3"
             android:textColor="@color/app_text_primary"
-            android:textColorHint="@color/app_text_secondary"
-            android:singleLine="true" />
+            android:textColorHint="@color/app_text_secondary" />
 
-        <TextView
+        <EditText
+            android:id="@+id/proxyListInput"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:labelFor="@id/remoteKeyInput"
+            android:layout_marginTop="8dp"
+            android:hint="@string/proxy_list_hint"
+            android:inputType="textMultiLine|textNoSuggestions"
+            android:minLines="3"
             android:textColor="@color/app_text_primary"
-            android:text="@string/remote_key_label" />
+            android:textColorHint="@color/app_text_secondary" />
 
         <EditText
-            android:id="@+id/remoteKeyInput"
+            android:id="@+id/advancedRulesInput"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="12dp"
-            android:hint="@string/remote_key_hint"
-            android:importantForAutofill="no"
-            android:inputType="textPassword"
+            android:layout_marginTop="8dp"
+            android:hint="@string/advanced_rules_hint"
+            android:inputType="textMultiLine|textNoSuggestions"
+            android:minLines="3"
             android:textColor="@color/app_text_primary"
-            android:textColorHint="@color/app_text_secondary"
-            android:singleLine="true" />
+            android:textColorHint="@color/app_text_secondary" />
 
-        <TextView
+        <Button
+            android:id="@+id/saveConfigButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:labelFor="@id/cipherInput"
-            android:textColor="@color/app_text_primary"
-            android:text="@string/cipher_label" />
+            android:layout_marginTop="12dp"
+            android:backgroundTint="@color/app_primary"
+            android:text="@string/save_config"
+            android:textColor="@android:color/white" />
+
+        <TextView
+            style="@style/AppSectionTitle"
+            android:text="@string/preset_title" />
 
         <EditText
-            android:id="@+id/cipherInput"
+            android:id="@+id/presetNameInput"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="12dp"
-            android:enabled="false"
+            android:hint="@string/preset_name_hint"
             android:inputType="text"
             android:singleLine="true"
-            android:textColor="@color/app_text_secondary"
-            android:text="@string/default_cipher" />
+            android:textColor="@color/app_text_primary"
+            android:textColorHint="@color/app_text_secondary" />
 
-        <CheckBox
-            android:id="@+id/tlsCheckBox"
+        <Spinner
+            android:id="@+id/presetSpinner"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="8dp"
+            android:layout_marginTop="8dp" />
+
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:orientation="horizontal">
+
+            <Button
+                android:id="@+id/savePresetButton"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:text="@string/save_preset" />
+
+            <Button
+                android:id="@+id/loadPresetButton"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_marginStart="8dp"
+                android:layout_weight="1"
+                android:text="@string/load_preset" />
+
+            <Button
+                android:id="@+id/deletePresetButton"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_marginStart="8dp"
+                android:layout_weight="1"
+                android:text="@string/delete_preset" />
+        </LinearLayout>
+
+        <EditText
+            android:id="@+id/importConfigInput"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:hint="@string/import_config_hint"
+            android:inputType="textMultiLine|textNoSuggestions"
+            android:minLines="6"
             android:textColor="@color/app_text_primary"
-            android:text="@string/tls_label" />
+            android:textColorHint="@color/app_text_secondary" />
+
+        <LinearLayout
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:orientation="horizontal">
+
+            <Button
+                android:id="@+id/importConfigButton"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_weight="1"
+                android:text="@string/import_config" />
+
+            <Button
+                android:id="@+id/exportConfigButton"
+                android:layout_width="0dp"
+                android:layout_height="wrap_content"
+                android:layout_marginStart="8dp"
+                android:layout_weight="1"
+                android:text="@string/export_config" />
+        </LinearLayout>
+
+        <TextView
+            style="@style/AppSectionTitle"
+            android:text="@string/log_title" />
 
         <TextView
+            android:id="@+id/logText"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:layout_marginBottom="18dp"
-            android:text="@string/tls_hint"
+            android:minHeight="96dp"
             android:textColor="@color/app_text_secondary"
             android:textSize="12sp" />
 
         <Button
-            android:id="@+id/saveConfigButton"
+            android:id="@+id/clearLogButton"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:backgroundTint="@color/app_primary"
-            android:textColor="@android:color/white"
-            android:text="@string/save_config" />
+            android:text="@string/clear_log" />
 
     </LinearLayout>
-
 </ScrollView>
diff --git a/android-app/app/src/main/res/values/strings.xml b/android-app/app/src/main/res/values/strings.xml
index afa8e26..7043338 100644
--- a/android-app/app/src/main/res/values/strings.xml
+++ b/android-app/app/src/main/res/values/strings.xml
@@ -4,27 +4,45 @@
     <string name="connect_vpn">连接 VPN</string>
     <string name="disconnect_vpn">断开 VPN</string>
     <string name="native_version_label">native 版本: %1$s</string>
+    <string name="native_version_placeholder">native 版本: -</string>
     <string name="vpn_status_idle">未连接</string>
     <string name="vpn_status_connecting">正在连接...</string>
     <string name="vpn_status_connected">已连接</string>
     <string name="vpn_status_disconnecting">正在断开...</string>
     <string name="vpn_status_error">连接异常</string>
     <string name="notification_channel_name">VPN 状态</string>
-    <string name="settings_title">连接设置</string>
-    <string name="remote_host_label">远端地址</string>
-    <string name="remote_host_hint">例如 54.234.196.30 或 example.com</string>
-    <string name="remote_port_label">远端端口</string>
-    <string name="remote_port_hint">例如 9090</string>
-    <string name="remote_key_label">加密密钥</string>
-    <string name="remote_key_hint">与 proxy-remote 的 cipherKey 保持一致</string>
-    <string name="cipher_label">加密方式</string>
-    <string name="default_cipher">chacha20</string>
-    <string name="tls_label">启用 TLS</string>
-    <string name="tls_hint">当前 Android 数据面仅支持 h2c 明文 HTTP/2；TLS 接入后这里会开放。</string>
+
+    <string name="nodes_title">节点</string>
+    <string name="add_node">添加节点</string>
+    <string name="node_keep_one">至少保留一个节点</string>
+    <string name="routing_title">路由规则</string>
+    <string name="default_route_label">默认路由</string>
+    <string name="direct_list_hint">直连域名，每行一个，例如 *.cn 或 baidu.com</string>
+    <string name="proxy_list_hint">代理域名，每行一个，例如 github.com 或 *.google.com</string>
+    <string name="advanced_rules_hint">高级规则，每行 type,value,action，例如 ip_cidr,10.0.0.0/8,direct 或 port,53,reject</string>
+
+    <string name="preset_title">预设与导入</string>
+    <string name="preset_name_hint">预设名称</string>
+    <string name="save_preset">保存预设</string>
+    <string name="load_preset">载入</string>
+    <string name="delete_preset">删除</string>
+    <string name="no_presets">暂无预设</string>
+    <string name="preset_name_required">请填写预设名称</string>
+    <string name="preset_saved">预设已保存</string>
+    <string name="preset_loaded">预设已载入</string>
+    <string name="preset_deleted">预设已删除</string>
+    <string name="import_config_hint">粘贴 Android JSON 或桌面 proxy.yml 片段，可包含 remoteServers、route.proxyList、route.directList</string>
+    <string name="import_config">导入配置</string>
+    <string name="export_config">导出到输入框</string>
+    <string name="config_imported">配置已导入</string>
+    <string name="config_exported">已生成桌面兼容 YAML</string>
+
+    <string name="log_title">日志</string>
+    <string name="clear_log">清空日志</string>
+    <string name="stats_empty">暂无流量统计</string>
     <string name="save_config">保存配置</string>
     <string name="config_saved">配置已保存</string>
     <string name="config_error_host">请填写远端地址</string>
     <string name="config_error_port">端口需在 1-65535 之间</string>
     <string name="config_error_key">请填写加密密钥</string>
-    <string name="config_error_tls_unsupported">当前 Android 出站暂不支持 TLS，请先关闭 TLS</string>
 </resources>
diff --git a/android-app/app/src/main/res/values/themes.xml b/android-app/app/src/main/res/values/themes.xml
index d85c0cc..ea63c85 100644
--- a/android-app/app/src/main/res/values/themes.xml
+++ b/android-app/app/src/main/res/values/themes.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <!-- 基于 Material 3 的应用主题 -->
     <style name="Theme.SimplePlane" parent="Theme.Material3.Light.NoActionBar">
         <item name="android:windowBackground">@color/app_background</item>
         <item name="android:statusBarColor">@color/app_background</item>
@@ -9,4 +8,14 @@
         <item name="colorPrimary">@color/app_primary</item>
         <item name="colorOnPrimary">@android:color/white</item>
     </style>
+
+    <style name="AppSectionTitle">
+        <item name="android:layout_width">match_parent</item>
+        <item name="android:layout_height">wrap_content</item>
+        <item name="android:layout_marginTop">24dp</item>
+        <item name="android:layout_marginBottom">8dp</item>
+        <item name="android:textColor">@color/app_text_primary</item>
+        <item name="android:textSize">17sp</item>
+        <item name="android:textStyle">bold</item>
+    </style>
 </resources>
diff --git a/plane-core/Cargo.lock b/plane-core/Cargo.lock
index 56ca3f9..0584789 100644
--- a/plane-core/Cargo.lock
+++ b/plane-core/Cargo.lock
@@ -67,6 +67,16 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
+[[package]]
+name = "cc"
+version = "1.2.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
 [[package]]
 name = "cesu8"
 version = "1.1.0"
@@ -215,6 +225,12 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -694,6 +710,7 @@ dependencies = [
  "smoltcp",
  "thiserror 2.0.18",
  "tokio",
+ "tokio-rustls",
  "tokio-test",
  "tracing",
  "tracing-android",
@@ -816,6 +833,54 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -888,6 +953,12 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1058,6 +1129,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.18"
@@ -1187,6 +1268,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -1254,7 +1341,16 @@ version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -1272,13 +1368,29 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
 ]
 
 [[package]]
@@ -1287,42 +1399,90 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
 [[package]]
 name = "writeable"
 version = "0.6.3"
@@ -1393,6 +1553,12 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.4"
diff --git a/plane-core/Cargo.toml b/plane-core/Cargo.toml
index ea30b71..0784010 100644
--- a/plane-core/Cargo.toml
+++ b/plane-core/Cargo.toml
@@ -47,6 +47,7 @@ rand = "0.8"      # 随机 nonce 生成
 h2 = "0.4"
 bytes = "1"
 http = "1"
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 
 # tracing-android 仅在 Android 目标上启用，桌面（如 macOS 本机 cargo check）跳过，
 # 避免在非 Android 平台拉入 android 专用依赖导致编译失败。
diff --git a/plane-core/src/dispatcher.rs b/plane-core/src/dispatcher.rs
index 995a6df..8e4d314 100644
--- a/plane-core/src/dispatcher.rs
+++ b/plane-core/src/dispatcher.rs
@@ -1,60 +1,41 @@
-//! A6 —— 连接调度器：把用户态 TCP 栈上报的新连接接到加密 HTTP/2 出站。
-//!
-//! 数据流（一次完整代理）：
-//!
-//! ```text
-//! 应用发起 TCP → TUN → tcp_stack::stack_loop
-//!   → TcpEvent::NewConnection { dst_ip(FakeIP), dst_port, 双向 channel }
-//!   → dispatcher：FakeIP --FakeDNS 反查--> 真实域名
-//!   → OutboundConnection::open_proxy_stream(域名, 端口)  （首个 CONNECT）
-//!   → outbound::proxy_via_remote(stream, SmolTcpStream)   （双向搬运字节）
-//!   → proxy-remote 解密 → 回源目标站点
-//! ```
-//!
-//! ## 设计要点
-//!
-//! - **域名反查**：smoltcp 看到的目标是 FakeIP（198.18/15），必须经
-//!   [`FakeDnsEngine::lookup_domain`] 还原成真实域名后，才能告诉 proxy-remote 要连谁
-//!   （proxy-remote 在服务端做真实 DNS 解析与回源）。反查不到的 FakeIP 直接丢弃。
-//! - **protect 铁律**：到 proxy-remote 的 TCP socket 必须先 [`SocketProtector::protect`]
-//!   再 connect，否则会被 VPN 自身路由回环。
-//! - **连接复用**：所有被代理的目标共用一条到 proxy-remote 的 HTTP/2 连接（多路复用
-//!   stream），对齐 Java 客户端。本 MVP 实现「单连接 + 每目标一个 stream」。
-//! - **不破坏铁律**：纯新增模块，依赖 tcp_stack / outbound / net_probe::FakeDnsEngine，
-//!   不修改它们的现有公开行为。
-
-use std::net::Ipv4Addr;
+use std::net::{IpAddr, Ipv4Addr, SocketAddr, ToSocketAddrs};
 use std::sync::Arc;
 
-use tokio::net::TcpSocket;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::{TcpSocket, TcpStream};
 use tokio::sync::{mpsc, Mutex};
+use tokio_rustls::{rustls, TlsConnector};
 
 use crate::crypto::Cipher;
 use crate::error::{CoreError, Result};
+use crate::mobile_config::RoutingConfig;
 use crate::net_probe::FakeDnsEngine;
-use crate::outbound::{proxy_via_remote, OutboundConfig, OutboundConnection, SocketProtector};
+use crate::outbound::{
+    proxy_via_remote_counted, OutboundConfig, OutboundConnection, OutboundStream, SocketProtector,
+};
+use crate::routing::{ConnectionInfo, Protocol, RouteAction, Router};
+use crate::stats::CoreStats;
 use crate::tcp_stack::{SmolTcpStream, StreamCommand, TcpEvent};
 
-/// 默认每条代理 stream 的本地读缓冲大小（字节）。
 const PROXY_READ_BUF: usize = 16 * 1024;
 
-/// 调度器配置（节点信息从 [`crate::jni_bridge::AndroidConfig`] 转换而来）。
 #[derive(Clone)]
-pub struct DispatcherConfig {
-    /// proxy-remote 主机。
-    pub server_host: String,
-    /// proxy-remote 端口。
-    pub server_port: u16,
-    /// 共享密钥（构造 [`Cipher`]；非 32 字节会按 Java 规则 SHA-256 派生）。
+pub struct RemoteNodeConfig {
+    pub name: String,
+    pub host: String,
+    pub port: u16,
     pub key: Vec<u8>,
-    /// 是否启用 TLS（MVP 仅支持 false=h2c）。
+    pub cipher: String,
     pub tls: bool,
 }
 
-/// 调度器主循环：消费 [`TcpEvent`]，为每个新连接接出站。
-///
-/// `notify_tx` 与 stack_loop 共用，[`SmolTcpStream`] 写入后通知栈及时搬运。
-/// `shutdown_rx` 收到停止信号即退出（连带 spawn 的代理任务随 channel 关闭收敛）。
+#[derive(Clone)]
+pub struct DispatcherConfig {
+    pub nodes: Vec<RemoteNodeConfig>,
+    pub routing: RoutingConfig,
+    pub stats: Arc<CoreStats>,
+}
+
 pub async fn run_dispatcher<P>(
     mut event_rx: mpsc::Receiver<TcpEvent>,
     fake_dns: Arc<Mutex<FakeDnsEngine>>,
@@ -66,76 +47,106 @@ pub async fn run_dispatcher<P>(
 where
     P: SocketProtector + 'static,
 {
+    if config.nodes.is_empty() {
+        return Err(CoreError::InvalidArgument(
+            "dispatcher requires at least one ready remote node".to_string(),
+        ));
+    }
+
+    let router = Router::from_config(&config.routing)?;
+    let mut proxy_conn: Option<(usize, OutboundConnection)> = None;
+
     tracing::info!(
-        "调度器启动，目标 proxy-remote = {}:{} (tls={})",
-        config.server_host,
-        config.server_port,
-        config.tls
+        "dispatcher started with {} node(s), default route={}",
+        config.nodes.len(),
+        config.routing.default_action
     );
 
-    // 共享一条到 proxy-remote 的 HTTP/2 连接（懒建立 + 失败重建）。
-    let mut conn: Option<OutboundConnection> = None;
-
     loop {
         tokio::select! {
             res = shutdown_rx.changed() => {
                 if res.is_err() || *shutdown_rx.borrow() {
-                    tracing::info!("调度器收到停止信号，退出");
+                    tracing::info!("dispatcher received shutdown");
+                    config.stats.set_state("stopped");
                     return Ok(());
                 }
             }
 
             ev = event_rx.recv() => {
                 let Some(TcpEvent::NewConnection { src_ip, dst_ip, dst_port, stream_tx, stream_rx }) = ev else {
-                    tracing::info!("TCP 事件通道已关闭，调度器退出");
+                    tracing::info!("tcp event channel closed, dispatcher exiting");
+                    config.stats.set_state("stopped");
                     return Ok(());
                 };
 
-                // FakeIP → 真实域名（反查不到则丢弃该连接）。
                 let domain = {
                     let engine = fake_dns.lock().await;
                     engine.lookup_domain(&dst_ip).map(|s| s.to_string())
                 };
-                let Some(domain) = domain else {
-                    tracing::warn!(
-                        "丢弃连接：FakeIP {} 反查不到域名（src={}, port={}）",
-                        dst_ip, src_ip, dst_port
-                    );
-                    continue;
+                let target_host = domain.clone().unwrap_or_else(|| dst_ip.to_string());
+                let info = ConnectionInfo {
+                    src_ip: IpAddr::V4(src_ip),
+                    dst_ip: IpAddr::V4(dst_ip),
+                    dst_port,
+                    domain: domain.clone(),
+                    protocol: Protocol::Tcp,
                 };
+                let action = router.route(&info);
 
-                tracing::info!("代理新连接: {}:{} -> {} (FakeIP {})", src_ip, dst_port, domain, dst_ip);
-
-                // 确保到 proxy-remote 的 h2 连接可用（懒建立 / 断线重建）。
-                if conn.is_none() {
-                    match establish_outbound(&config, protector.as_ref()).await {
-                        Ok(c) => conn = Some(c),
-                        Err(e) => {
-                            tracing::error!("建立到 proxy-remote 的连接失败: {}，丢弃本次连接", e);
-                            // 通知栈关闭该 app 连接。
-                            let _ = stream_tx.try_send(StreamCommand::Close);
-                            continue;
-                        }
-                    }
-                }
+                tracing::info!(
+                    "connection {} -> {}:{} domain={:?} route={:?}",
+                    src_ip,
+                    dst_ip,
+                    dst_port,
+                    domain,
+                    action
+                );
 
-                // 在 h2 连接上开 stream（首个 CONNECT 指向真实域名）。
-                let outbound = conn.as_mut().unwrap();
-                match outbound.open_proxy_stream(&domain, dst_port).await {
-                    Ok(stream) => {
+                match action {
+                    RouteAction::Reject => {
+                        config.stats.inc_rejected();
+                        let _ = stream_tx.try_send(StreamCommand::Close);
+                    }
+                    RouteAction::Direct => {
                         let local = SmolTcpStream::new(stream_tx, stream_rx, notify_tx.clone());
-                        // 每个代理连接独立 spawn，互不阻塞。
+                        config.stats.begin_connection();
+                        config.stats.inc_direct();
+                        let stats = Arc::clone(&config.stats);
+                        let protector = Arc::clone(&protector);
                         tokio::spawn(async move {
-                            if let Err(e) = proxy_via_remote(stream, local, PROXY_READ_BUF).await {
-                                tracing::warn!("proxy_via_remote 结束: {}", e);
+                            if let Err(e) = proxy_direct(target_host, dst_port, local, protector, Arc::clone(&stats)).await {
+                                stats.inc_failed();
+                                stats.set_error(format!("direct: {e}"));
+                                tracing::warn!("direct connection ended with error: {e}");
                             }
+                            stats.end_connection();
                         });
                     }
-                    Err(e) => {
-                        tracing::error!("打开代理 stream 失败: {}（域名 {}），连接将重建", e, domain);
-                        let _ = stream_tx.try_send(StreamCommand::Close);
-                        // h2 连接可能已坏，丢弃以便下次重建。
-                        conn = None;
+                    RouteAction::Proxy => {
+                        match open_proxy_with_failover(&config, protector.as_ref(), &mut proxy_conn, &target_host, dst_port).await {
+                            Ok((stream, node_name)) => {
+                                config.stats.begin_connection();
+                                config.stats.inc_proxy();
+                                config.stats.set_active_node(node_name);
+                                let local = SmolTcpStream::new(stream_tx, stream_rx, notify_tx.clone());
+                                let stats = Arc::clone(&config.stats);
+                                tokio::spawn(async move {
+                                    if let Err(e) = proxy_via_remote_counted(stream, local, PROXY_READ_BUF, Some(Arc::clone(&stats))).await {
+                                        stats.inc_failed();
+                                        stats.set_error(format!("proxy: {e}"));
+                                        tracing::warn!("proxy connection ended with error: {e}");
+                                    }
+                                    stats.end_connection();
+                                });
+                            }
+                            Err(e) => {
+                                config.stats.inc_failed();
+                                config.stats.set_error(format!("proxy open: {e}"));
+                                tracing::error!("failed to open proxy stream for {target_host}:{dst_port}: {e}");
+                                let _ = stream_tx.try_send(StreamCommand::Close);
+                                proxy_conn = None;
+                            }
+                        }
                     }
                 }
             }
@@ -143,78 +154,229 @@ where
     }
 }
 
-/// 建立一条到 proxy-remote 的、已 protect 的 HTTP/2 连接并完成握手。
-async fn establish_outbound<P>(
+async fn open_proxy_with_failover<P>(
     config: &DispatcherConfig,
     protector: &P,
+    active: &mut Option<(usize, OutboundConnection)>,
+    host: &str,
+    port: u16,
+) -> Result<(OutboundStream, String)>
+where
+    P: SocketProtector,
+{
+    if let Some((idx, conn)) = active.as_mut() {
+        match conn.open_proxy_stream(host, port).await {
+            Ok(stream) => {
+                let name = config.nodes[*idx].name.clone();
+                return Ok((stream, name));
+            }
+            Err(e) => {
+                tracing::warn!(
+                    "active node {} failed to open stream: {e}; trying failover",
+                    config.nodes[*idx].name
+                );
+            }
+        }
+    }
+    *active = None;
+
+    let mut last_error: Option<CoreError> = None;
+    for (idx, node) in config.nodes.iter().enumerate() {
+        match establish_outbound(node, protector).await {
+            Ok(mut conn) => match conn.open_proxy_stream(host, port).await {
+                Ok(stream) => {
+                    let name = node.name.clone();
+                    *active = Some((idx, conn));
+                    return Ok((stream, name));
+                }
+                Err(e) => {
+                    tracing::warn!("node {} opened tcp/h2 but stream failed: {e}", node.name);
+                    last_error = Some(e);
+                }
+            },
+            Err(e) => {
+                tracing::warn!("node {} connect failed: {e}", node.name);
+                last_error = Some(e);
+            }
+        }
+    }
+
+    Err(last_error.unwrap_or_else(|| {
+        CoreError::Internal("no remote node could open a proxy stream".to_string())
+    }))
+}
+
+async fn establish_outbound<P>(
+    node: &RemoteNodeConfig,
+    protector: &P,
 ) -> Result<OutboundConnection>
 where
     P: SocketProtector,
 {
-    if config.tls {
-        // MVP 仅落地 h2c；TLS 待接 rustls（记技术债）。
-        return Err(CoreError::Protocol(
-            "TLS 出站暂未实现（MVP 仅支持 h2c），请将节点配置为 tls=false".to_string(),
-        ));
+    if node.cipher.to_ascii_lowercase() != "chacha20" {
+        return Err(CoreError::InvalidArgument(format!(
+            "unsupported cipher for Android data plane: {}",
+            node.cipher
+        )));
     }
 
-    let addr = resolve_server_addr(&config.server_host, config.server_port)?;
+    let tcp = connect_protected(&node.host, node.port, protector).await?;
+    let cipher = Cipher::new(&node.key)?;
+    let outbound_cfg = OutboundConfig {
+        server_host: node.host.clone(),
+        server_port: node.port,
+        tls: node.tls,
+    };
 
-    // protect 时机铁律（Android VpnService）：必须在 **connect 之前** protect 一个
-    // 尚未发起连接的 socket，否则 connect 发出的 SYN 会被 TUN（addRoute 0.0.0.0/0
-    // 全局接管）捕获形成回环，连接永远建不起来——表现为「能解析 DNS 但任何站点都打不开」。
-    //
-    // 实现：用 tokio 的 TcpSocket 建出**未连接**的 socket，立即取 fd 交 protect，
-    // protect 成功后再 connect。这样 SYN 直接走物理网卡绕过隧道。
-    // （不引入 socket2：tokio::net::TcpSocket 原生提供「先建后连」能力。）
+    if node.tls {
+        let tls = connect_tls(tcp, &node.host).await?;
+        OutboundConnection::handshake(tls, cipher, outbound_cfg).await
+    } else {
+        OutboundConnection::handshake(tcp, cipher, outbound_cfg).await
+    }
+}
+
+async fn proxy_direct<P>(
+    host: String,
+    port: u16,
+    mut local: SmolTcpStream,
+    protector: Arc<P>,
+    stats: Arc<CoreStats>,
+) -> Result<()>
+where
+    P: SocketProtector + 'static,
+{
+    let mut remote = connect_protected(&host, port, protector.as_ref()).await?;
+    let mut up = vec![0u8; PROXY_READ_BUF];
+    let mut down = vec![0u8; PROXY_READ_BUF];
+
+    loop {
+        tokio::select! {
+            read = local.read(&mut up) => {
+                let n = read.map_err(CoreError::Io)?;
+                if n == 0 {
+                    let _ = remote.shutdown().await;
+                    break;
+                }
+                stats.add_upload(n);
+                remote.write_all(&up[..n]).await.map_err(CoreError::Io)?;
+            }
+            read = remote.read(&mut down) => {
+                let n = read.map_err(CoreError::Io)?;
+                if n == 0 {
+                    let _ = local.shutdown().await;
+                    break;
+                }
+                stats.add_download(n);
+                local.write_all(&down[..n]).await.map_err(CoreError::Io)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn connect_protected<P>(host: &str, port: u16, protector: &P) -> Result<TcpStream>
+where
+    P: SocketProtector,
+{
     use std::os::unix::io::AsRawFd;
 
+    let addr = resolve_server_addr(host, port)?;
     let socket = TcpSocket::new_v4()
-        .map_err(|e| CoreError::Io(std::io::Error::other(format!("创建出站 socket 失败: {e}"))))?;
-
+        .map_err(|e| CoreError::Io(std::io::Error::other(format!("create socket failed: {e}"))))?;
     let fd = socket.as_raw_fd();
     if !protector.protect(fd) {
         return Err(CoreError::Internal(format!(
-            "protect socket fd={fd} 失败（流量会回环），放弃本连接"
+            "protect socket fd={fd} failed"
         )));
     }
-    tracing::debug!("connect 前已 protect 出站 socket fd={}", fd);
 
-    // protect 之后再发起连接（SYN 已绕过 TUN）。
     let tcp = socket.connect(addr).await.map_err(|e| {
         CoreError::Io(std::io::Error::other(format!(
-            "连接 proxy-remote {addr} 失败: {e}"
+            "connect {host}:{port} ({addr}) failed: {e}"
         )))
     })?;
-
     tcp.set_nodelay(true).ok();
+    Ok(tcp)
+}
 
-    let cipher = Cipher::new(&config.key)?;
-    let outbound_cfg = OutboundConfig {
-        server_host: config.server_host.clone(),
-        server_port: config.server_port,
-        tls: false,
-    };
-    OutboundConnection::handshake(tcp, cipher, outbound_cfg).await
+async fn connect_tls(tcp: TcpStream, host: &str) -> Result<tokio_rustls::client::TlsStream<TcpStream>> {
+    let mut tls_config = rustls::ClientConfig::builder()
+        .dangerous()
+        .with_custom_certificate_verifier(Arc::new(NoCertificateVerification))
+        .with_no_client_auth();
+    tls_config.alpn_protocols = vec![b"h2".to_vec()];
+
+    let server_name = rustls::pki_types::ServerName::try_from(host.to_string()).map_err(|e| {
+        CoreError::InvalidArgument(format!("invalid TLS server name {host}: {e}"))
+    })?;
+    let connector = TlsConnector::from(Arc::new(tls_config));
+    connector
+        .connect(server_name, tcp)
+        .await
+        .map_err(|e| CoreError::Io(std::io::Error::other(format!("TLS connect failed: {e}"))))
 }
 
-/// 解析 proxy-remote 地址（支持 IP 字面量与域名）。
-fn resolve_server_addr(host: &str, port: u16) -> Result<std::net::SocketAddr> {
-    use std::net::ToSocketAddrs;
-    // 优先按 IP 字面量解析（最常见的节点配置形态）。
+#[derive(Debug)]
+struct NoCertificateVerification;
+
+impl rustls::client::danger::ServerCertVerifier for NoCertificateVerification {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &rustls::pki_types::CertificateDer<'_>,
+        _intermediates: &[rustls::pki_types::CertificateDer<'_>],
+        _server_name: &rustls::pki_types::ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: rustls::pki_types::UnixTime,
+    ) -> std::result::Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        vec![
+            rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
+            rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
+            rustls::SignatureScheme::ED25519,
+            rustls::SignatureScheme::RSA_PSS_SHA256,
+            rustls::SignatureScheme::RSA_PSS_SHA384,
+            rustls::SignatureScheme::RSA_PKCS1_SHA256,
+            rustls::SignatureScheme::RSA_PKCS1_SHA384,
+        ]
+    }
+}
+
+fn resolve_server_addr(host: &str, port: u16) -> Result<SocketAddr> {
     if let Ok(ip) = host.parse::<Ipv4Addr>() {
-        return Ok(std::net::SocketAddr::from((ip, port)));
+        return Ok(SocketAddr::from((ip, port)));
     }
-    // 否则走系统解析（注意：此解析走系统 DNS，不经 FakeDNS）。
+
     (host, port)
         .to_socket_addrs()
         .map_err(|e| {
             CoreError::Io(std::io::Error::other(format!(
-                "解析 proxy-remote 地址 {host}:{port} 失败: {e}"
+                "resolve {host}:{port} failed: {e}"
             )))
         })?
-        .next()
-        .ok_or_else(|| CoreError::Internal(format!("proxy-remote 地址 {host}:{port} 无解析结果")))
+        .find(|addr| addr.is_ipv4())
+        .ok_or_else(|| CoreError::Internal(format!("no IPv4 address for {host}:{port}")))
 }
 
 #[cfg(test)]
@@ -229,26 +391,8 @@ mod tests {
 
     #[test]
     fn resolve_localhost() {
-        // localhost 应能解析（不触外网）。
         let addr = resolve_server_addr("localhost", 80);
         assert!(addr.is_ok());
         assert_eq!(addr.unwrap().port(), 80);
     }
-
-    #[tokio::test]
-    async fn establish_rejects_tls() {
-        let cfg = DispatcherConfig {
-            server_host: "1.2.3.4".to_string(),
-            server_port: 8443,
-            key: b"unit-test-key-please-change-1234".to_vec(),
-            tls: true,
-        };
-        let prot = Arc::new(crate::outbound::NoopProtector);
-        // 不能用 unwrap_err（OutboundConnection 未实现 Debug），改 match 断言。
-        match establish_outbound(&cfg, prot.as_ref()).await {
-            Err(CoreError::Protocol(_)) => {}
-            Err(other) => panic!("期望 Protocol 错误，实际: {other}"),
-            Ok(_) => panic!("tls=true 应被拒绝，却建立了出站连接"),
-        }
-    }
 }
diff --git a/plane-core/src/jni_bridge.rs b/plane-core/src/jni_bridge.rs
index eeee381..7c55b2a 100644
--- a/plane-core/src/jni_bridge.rs
+++ b/plane-core/src/jni_bridge.rs
@@ -1,147 +1,36 @@
-//! JNI 桥接最小闭环（Task A2）：Kotlin ↔ Rust 双向调用 + protect 回调。
-//!
-//! 本模块实现任务文档 A2 的契约：
-//!
-//! ```text
-//! Kotlin → Rust:
-//!   nativeStart(tunFd: Int, configJson: String): Long   // 返回 handle（0=失败）
-//!   nativeStop(handle: Long)
-//!   nativeStats(handle: Long): String                    // A2 先返回 "{}"
-//! Rust → Kotlin（回调）:
-//!   protect(fd: Int): Boolean
-//!   onStatus(state: String)
-//! ```
-//!
-//! ## 设计要点（对齐任务文档 0.3 / A2）
-//!
-//! - **panic 隔离**：每个 `extern "C"` 函数体用 [`std::panic::catch_unwind`] 包裹，
-//!   panic 时记日志并返回 0/false/空串，绝不让 panic 跨越 JNI 边界（铁律 0.3-4）。
-//! - **handle 管理**：`nativeStart` 返回 `Box::into_raw` 的 [`CoreHandle`] 指针（转 i64），
-//!   `nativeStop` 用 `Box::from_raw` 回收。不使用全局可变单例，以支持多次 start/stop
-//!   （切换节点场景）。
-//! - **回调机制**：保存 [`jni::JavaVM`] 与 `NativeBridge` 实例的 [`GlobalRef`]，
-//!   任意线程回调时 `attach_current_thread` 拿到 `JNIEnv` 再 `call_method`。
-//!
-//! A2 仅打通桥接与回调闭环，**不含任何数据面逻辑**（TUN/栈/出站在 A3+ 接入）。
-//! 为证明 protect 回调真实生效，`nativeStart` 在建立句柄后会立即触发一次 protect 回调
-//! （传入 tun_fd），这与 A2 验收「spy 计数 ≥ 1」对齐；A3 起改由真实出站路径触发。
-
 use std::panic::{catch_unwind, AssertUnwindSafe};
+use std::sync::Arc;
 
 use jni::objects::{GlobalRef, JObject, JString, JValue};
 use jni::sys::{jint, jlong, jstring};
 use jni::{JNIEnv, JavaVM};
-use serde::Deserialize;
 
 use crate::android_tun::AndroidTun;
-use crate::dispatcher::{run_dispatcher, DispatcherConfig};
+use crate::dispatcher::{run_dispatcher, DispatcherConfig, RemoteNodeConfig};
 use crate::error::{CoreError, Result};
+use crate::mobile_config::AndroidConfig;
 use crate::net_probe::FakeDnsEngine;
 use crate::outbound::SocketProtector;
+use crate::stats::CoreStats;
 use crate::tcp_stack::{stack_loop, TcpEvent};
 
-/// FakeIP 地址池 CIDR（与 net_probe / 桌面一致）。
 const FAKE_IP_CIDR: &str = "198.18.0.0/15";
-/// FakeDNS LRU 容量（与桌面默认对齐）。
 const FAKE_DNS_CAPACITY: usize = 4096;
-/// TcpEvent 通道缓冲（突发新连接的背压上限）。
 const TCP_EVENT_CHANNEL_CAP: usize = 256;
-/// notify 通道缓冲（栈与流之间的就绪通知）。
 const NOTIFY_CHANNEL_CAP: usize = 1024;
 
-/// 节点与运行时配置（由 Kotlin 侧 `configJson` 下发）。
-///
-/// A2 阶段仅解析最小字段，证明 JSON 通路可用；A5/B6 会扩充节点地址、密钥、cipher、
-/// 路由规则等。所有字段都给出默认值，保证旧/简化配置仍能解析（向前兼容）。
-#[derive(Debug, Clone, Deserialize)]
-pub struct AndroidConfig {
-    /// TUN 的 MTU，默认 1500（对齐桌面与 A3 Builder 配置）。
-    #[serde(default = "default_mtu")]
-    pub mtu: usize,
-
-    /// remote 节点地址（A5 起使用；A2 允许缺省）。
-    #[serde(default)]
-    pub remote_host: String,
-
-    /// remote 节点端口（A5 起使用；A2 允许缺省）。
-    #[serde(default)]
-    pub remote_port: u16,
-
-    /// A6：与 proxy-remote 共享的密钥（构造 ChaCha20-Poly1305 Cipher）。
-    /// 非 32 字节会按 Java 规则 SHA-256 派生。缺省为空串（无法真正出站，仅供占位/测试）。
-    #[serde(default)]
-    pub remote_key: String,
-
-    /// A6：cipher 名称，默认 "chacha20"（当前仅支持 chacha20，与 ChaCha20Cipher 兼容）。
-    #[serde(default = "default_cipher")]
-    pub cipher: String,
-
-    /// A6：是否启用 TLS 出站，默认 false（MVP 仅支持 h2c）。
-    #[serde(default)]
-    pub tls: bool,
-}
-
-fn default_mtu() -> usize {
-    1500
-}
-
-fn default_cipher() -> String {
-    "chacha20".to_string()
-}
-
-impl AndroidConfig {
-    /// 从 `configJson` 字符串解析配置。
-    ///
-    /// 空串视为「全部使用默认值」，便于 A2 阶段用最简配置完成闭环验证。
-    pub fn from_json(json: &str) -> Result<Self> {
-        let trimmed = json.trim();
-        if trimmed.is_empty() {
-            return Ok(Self {
-                mtu: default_mtu(),
-                remote_host: String::new(),
-                remote_port: 0,
-                remote_key: String::new(),
-                cipher: default_cipher(),
-                tls: false,
-            });
-        }
-        Ok(serde_json::from_str(trimmed)?)
-    }
-
-    /// 是否具备真正出站所需的最小配置（节点地址 + 端口 + 密钥齐全）。
-    ///
-    /// 不齐全时 [`native_start_impl`] 仅建 TUN/栈但不启用出站（避免无效连接刷错误日志），
-    /// 用于 A2/A3 阶段或占位场景。
-    pub fn outbound_ready(&self) -> bool {
-        !self.remote_host.is_empty() && self.remote_port != 0 && !self.remote_key.is_empty()
-    }
-}
-
-/// Rust → Kotlin 回调上下文：持有跨线程回调所需的 `JavaVM` 与 bridge 全局引用。
-///
-/// 单独抽出并以 [`std::sync::Arc`] 共享，使其可被 clone 进任意 tokio worker 线程
-/// 的 spawn 闭包中执行回调。`JavaVM` 与 [`GlobalRef`] 均为 `Send + Sync`，跨线程安全。
 pub struct CallbackCtx {
-    /// 进程级 `JavaVM`，用于在任意 Rust 线程 attach 后回调 Kotlin。
     vm: JavaVM,
-    /// `NativeBridge` 实例的全局引用，回调 `protect` / `onStatus` 的接收者。
     bridge: GlobalRef,
 }
 
 impl CallbackCtx {
-    /// 通过 `JavaVM` attach 当前线程，回调 Kotlin 侧 `NativeBridge.protect(fd)`。
-    ///
-    /// 这是「Rust → Kotlin」回调的核心：任意 tokio worker 线程都可调用本方法
-    /// 把出站 socket fd 交给 `VpnService.protect` 排除出 TUN（防回环，铁律 0.3-1）。
-    ///
-    /// 返回 `Ok(true)` 表示 Kotlin 侧 protect 成功。
     pub fn protect(&self, fd: i32) -> Result<bool> {
         let mut env = self.vm.attach_current_thread()?;
         let ret = env.call_method(self.bridge.as_obj(), "protect", "(I)Z", &[JValue::Int(fd)])?;
         Ok(ret.z()?)
     }
 
-    /// 回调 Kotlin 侧 `NativeBridge.onStatus(state)` 上报状态（best-effort）。
     pub fn on_status(&self, state: &str) -> Result<()> {
         let mut env = self.vm.attach_current_thread()?;
         let jstr = env.new_string(state)?;
@@ -155,13 +44,8 @@ impl CallbackCtx {
     }
 }
 
-/// 把 [`CallbackCtx`] 适配为 [`SocketProtector`]：出站 socket 的 protect 经 JNI
-/// 回调到 Kotlin 侧 `VpnService.protect(fd)`（protect 铁律 0.3-1）。
-///
-/// `dispatcher` 在 connect proxy-remote 后立即用它 protect socket fd。回调失败
-/// （含 JNI 异常）一律视为 `false`，让上层放弃该连接而非回环。
 struct JniProtector {
-    cb: std::sync::Arc<CallbackCtx>,
+    cb: Arc<CallbackCtx>,
 }
 
 impl SocketProtector for JniProtector {
@@ -169,58 +53,30 @@ impl SocketProtector for JniProtector {
         match self.cb.protect(fd) {
             Ok(ok) => ok,
             Err(e) => {
-                tracing::warn!(fd, error = %e, "JNI protect 回调失败，按未保护处理");
+                tracing::warn!(fd, error = %e, "JNI protect callback failed");
                 false
             }
         }
     }
 }
 
-/// 一次 VPN 会话的运行时上下文。
-///
-/// 由 `nativeStart` 创建并 `Box::into_raw` 交给 Kotlin 持有（以 i64 handle 形式），
-/// `nativeStop` 时 `Box::from_raw` 回收。Drop 时关闭 tokio 运行时并发出 shutdown 信号。
 pub struct CoreHandle {
-    /// 跨线程回调上下文（protect / onStatus），可 clone 进 spawn 闭包。
-    cb: std::sync::Arc<CallbackCtx>,
-    /// 数据面 tokio 运行时（A2 用于在 worker 线程验证 protect 回调，A3+ 跑栈与出站）。
+    _cb: Arc<CallbackCtx>,
     rt: tokio::runtime::Runtime,
-    /// 关停信号发送端，`nativeStop`/Drop 时置 true 通知数据面任务退出。
     shutdown: tokio::sync::watch::Sender<bool>,
-    /// 解析后的配置（A3+ 使用）。
     #[allow(dead_code)]
     config: AndroidConfig,
-}
-
-impl CoreHandle {
-    /// 在 tokio worker 线程（非 JNI 主线程）上触发一次 protect 回调。
-    ///
-    /// 用于 A2 闭环验证「Rust 任意线程 → 回调 Kotlin protect」。回调结果仅记录日志，
-    /// 不阻断启动流程。
-    fn spawn_initial_protect(&self, fd: i32) {
-        let cb = std::sync::Arc::clone(&self.cb);
-        self.rt.spawn(async move {
-            match cb.protect(fd) {
-                Ok(ok) => tracing::info!(fd, ok, "worker 线程 protect 回调完成"),
-                Err(e) => tracing::warn!(error = %e, "worker 线程 protect 回调失败"),
-            }
-        });
-    }
+    stats: Arc<CoreStats>,
 }
 
 impl Drop for CoreHandle {
     fn drop(&mut self) {
-        // 通知数据面任务退出；忽略接收端已全部关闭的错误。
         let _ = self.shutdown.send(true);
+        self.stats.set_state("stopped");
         tracing::debug!("CoreHandle dropped, shutdown signalled");
-        // rt 在字段 drop 顺序中随后被回收（Runtime::drop 完成线程回收）。
     }
 }
 
-/// 把可能 panic 的闭包执行结果归一为 `jlong`：成功返回句柄值，失败/ panic 返回 0。
-///
-/// 任务文档 A2 测试要求：「闭包 panic 时返回 0，正常返回非 0」。
-/// 这是 `nativeStart` 的 panic 防火墙（铁律 0.3-4）。
 pub(crate) fn catch_unwind_to_jlong<F>(f: F) -> jlong
 where
     F: FnOnce() -> Result<jlong>,
@@ -228,35 +84,27 @@ where
     match catch_unwind(AssertUnwindSafe(f)) {
         Ok(Ok(v)) => v,
         Ok(Err(e)) => {
-            tracing::error!(error = %e, "nativeStart 失败");
+            tracing::error!(error = %e, "nativeStart failed");
             0
         }
         Err(_) => {
-            tracing::error!("nativeStart 捕获到 panic，已隔离，返回 0");
+            tracing::error!("nativeStart isolated a panic");
             0
         }
     }
 }
 
-/// 把可能 panic 的闭包执行结果归一为 `()`：失败/ panic 仅记录日志。
-///
-/// 用于 `nativeStop` 等无返回值且必须不 panic 跨 FFI 的入口。
 pub(crate) fn catch_unwind_to_unit<F>(f: F)
 where
     F: FnOnce() -> Result<()>,
 {
     match catch_unwind(AssertUnwindSafe(f)) {
         Ok(Ok(())) => {}
-        Ok(Err(e)) => tracing::error!(error = %e, "JNI 调用失败"),
-        Err(_) => tracing::error!("JNI 调用捕获到 panic，已隔离"),
+        Ok(Err(e)) => tracing::error!(error = %e, "JNI call failed"),
+        Err(_) => tracing::error!("JNI call isolated a panic"),
     }
 }
 
-/// `nativeStart` 的纯逻辑实现（与 JNI 解耦，便于单测）。
-///
-/// 解析配置、保存 `JavaVM` 与 bridge 全局引用、构建运行时，组装成 [`CoreHandle`]
-/// 并以裸指针（i64）返回。失败返回 [`CoreError`]，由外层 `catch_unwind_to_jlong`
-/// 转成 0。
 fn native_start_impl(
     env: &mut JNIEnv,
     this: &JObject,
@@ -265,92 +113,88 @@ fn native_start_impl(
 ) -> Result<jlong> {
     if tun_fd < 0 {
         return Err(CoreError::InvalidArgument(format!(
-            "tunFd 必须 >= 0，实际为 {tun_fd}"
+            "tunFd must be >= 0, got {tun_fd}"
         )));
     }
 
     let json: String = env.get_string(config_json)?.into();
     let config = AndroidConfig::from_json(&json)?;
+    if !config.outbound_ready() {
+        // Kotlin detached the fd before calling nativeStart, so close it on early error.
+        unsafe {
+            libc::close(tun_fd);
+        }
+        return Err(CoreError::InvalidArgument(
+            "no ready remote node in config".to_string(),
+        ));
+    }
 
     let vm = env.get_java_vm()?;
     let bridge = env.new_global_ref(this)?;
-
     let rt = tokio::runtime::Builder::new_multi_thread()
         .worker_threads(2)
         .enable_all()
         .build()?;
-    // shutdown 广播：stack_loop / dispatcher 各 subscribe 一份 receiver，
-    // nativeStop/Drop 时 send(true) 让二者优雅退出。
     let (shutdown, _rx) = tokio::sync::watch::channel(false);
-
-    let cb = std::sync::Arc::new(CallbackCtx { vm, bridge });
+    let cb = Arc::new(CallbackCtx { vm, bridge });
+    let stats = Arc::new(CoreStats::new());
 
     let handle = Box::new(CoreHandle {
-        cb: std::sync::Arc::clone(&cb),
+        _cb: Arc::clone(&cb),
         rt,
         shutdown,
         config: config.clone(),
+        stats: Arc::clone(&stats),
     });
 
-    if config.outbound_ready() {
-        // A6 完整数据面：TUN → 用户态 TCP 栈 → 调度器 → 加密出站 → proxy-remote。
-        spawn_data_plane(&handle, &cb, tun_fd, &config)?;
-        let _ = cb.on_status("connected");
-    } else {
-        // 配置不足以出站（A2/A3 占位场景）：仅做一次 protect 回调自检，证明回调闭环可用。
-        tracing::warn!(
-            "remote_host/remote_port/remote_key 不全（host='{}', port={}, key_set={}），\
-             仅启动 protect 自检，不建立出站数据面",
-            config.remote_host,
-            config.remote_port,
-            !config.remote_key.is_empty()
-        );
-        handle.spawn_initial_protect(tun_fd);
-    }
+    spawn_data_plane(&handle, &cb, tun_fd, &config)?;
+    stats.set_state("connected");
+    let _ = cb.on_status("connected");
 
     Ok(Box::into_raw(handle) as jlong)
 }
 
-/// 在句柄的 tokio 运行时上拉起完整数据面：用户态 TCP 栈 + 连接调度器。
-///
-/// - `AndroidTun::from_raw_fd(tun_fd)` 接管 TUN fd（所有权移交，stop/Drop 时由其 close）。
-/// - 一个 `Arc<Mutex<FakeDnsEngine>>` 同时供栈（写入/反查 FakeIP）与调度器（反查域名）使用。
-/// - `tcp_event` 通道把栈上报的新连接交给调度器；`notify` 通道做栈/流之间的就绪通知。
-/// - 栈与调度器各订阅一份 `shutdown` receiver，stop 时一起退出。
 fn spawn_data_plane(
     handle: &CoreHandle,
-    cb: &std::sync::Arc<CallbackCtx>,
+    cb: &Arc<CallbackCtx>,
     tun_fd: jint,
     config: &AndroidConfig,
 ) -> Result<()> {
-    // SAFETY: tun_fd 由 Kotlin VpnService.establish().detachFd() 移交，独占且有效。
     let tun = unsafe { AndroidTun::from_raw_fd(tun_fd, config.mtu) }?;
     let (tun_reader, tun_writer) = tun.split();
 
-    let fake_dns = std::sync::Arc::new(tokio::sync::Mutex::new(FakeDnsEngine::new(
+    let fake_dns = Arc::new(tokio::sync::Mutex::new(FakeDnsEngine::new(
         FAKE_IP_CIDR,
         FAKE_DNS_CAPACITY,
     )));
-
     let (tcp_event_tx, tcp_event_rx) =
         tokio::sync::mpsc::channel::<TcpEvent>(TCP_EVENT_CHANNEL_CAP);
     let (notify_tx, notify_rx) = tokio::sync::mpsc::channel::<()>(NOTIFY_CHANNEL_CAP);
 
+    let nodes = config
+        .normalized_remotes()
+        .into_iter()
+        .map(|node| RemoteNodeConfig {
+            name: node.name,
+            host: node.host,
+            port: node.port,
+            key: node.key.into_bytes(),
+            cipher: node.cipher,
+            tls: node.tls,
+        })
+        .collect();
     let dispatcher_cfg = DispatcherConfig {
-        server_host: config.remote_host.clone(),
-        server_port: config.remote_port,
-        key: config.remote_key.clone().into_bytes(),
-        tls: config.tls,
+        nodes,
+        routing: config.normalized_routing(),
+        stats: Arc::clone(&handle.stats),
     };
-    let protector = std::sync::Arc::new(JniProtector {
-        cb: std::sync::Arc::clone(cb),
-    });
+    let protector = Arc::new(JniProtector { cb: Arc::clone(cb) });
 
-    // 栈循环：notify_tx 同时给栈与 SmolTcpStream 使用（调度器侧 clone）。
-    let stack_fake_dns = std::sync::Arc::clone(&fake_dns);
+    let stack_fake_dns = Arc::clone(&fake_dns);
     let stack_notify_tx = notify_tx.clone();
     let stack_shutdown_rx = handle.shutdown.subscribe();
-    let stack_cb = std::sync::Arc::clone(cb);
+    let stack_cb = Arc::clone(cb);
+    let stack_stats = Arc::clone(&handle.stats);
     handle.rt.spawn(async move {
         let res = stack_loop(
             tun_reader,
@@ -363,16 +207,19 @@ fn spawn_data_plane(
         )
         .await;
         match res {
-            Ok(()) => tracing::info!("用户态 TCP 栈已退出"),
+            Ok(()) => tracing::info!("tcp stack exited"),
             Err(e) => {
-                tracing::error!(error = %e, "用户态 TCP 栈异常退出");
+                stack_stats.set_state("error");
+                stack_stats.set_error(format!("stack: {e}"));
+                tracing::error!(error = %e, "tcp stack exited with error");
                 let _ = stack_cb.on_status("error");
             }
         }
     });
 
-    // 调度器循环：消费 TcpEvent，接出站。
     let disp_shutdown_rx = handle.shutdown.subscribe();
+    let disp_cb = Arc::clone(cb);
+    let disp_stats = Arc::clone(&handle.stats);
     handle.rt.spawn(async move {
         let res = run_dispatcher(
             tcp_event_rx,
@@ -384,21 +231,20 @@ fn spawn_data_plane(
         )
         .await;
         match res {
-            Ok(()) => tracing::info!("调度器已退出"),
-            Err(e) => tracing::error!(error = %e, "调度器异常退出"),
+            Ok(()) => tracing::info!("dispatcher exited"),
+            Err(e) => {
+                disp_stats.set_state("error");
+                disp_stats.set_error(format!("dispatcher: {e}"));
+                tracing::error!(error = %e, "dispatcher exited with error");
+                let _ = disp_cb.on_status("error");
+            }
         }
     });
 
-    tracing::info!("A6 数据面已启动（栈 + 调度器）");
+    tracing::info!("Android data plane started");
     Ok(())
 }
 
-/// Kotlin → Rust：启动数据面会话，返回 handle（0 表示失败）。
-///
-/// # Safety
-///
-/// 由 JNI 运行时调用，`env` / `this` / `config_json` 均为 JVM 保证有效的引用。
-/// 函数内部用 `catch_unwind` 隔离 panic，保证不跨越 FFI 边界。
 #[no_mangle]
 pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStart(
     mut env: JNIEnv,
@@ -406,22 +252,11 @@ pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStart(
     tun_fd: jint,
     config_json: JString,
 ) -> jlong {
-    // 幂等初始化日志：即使 Kotlin 侧未先调用 nativeVersion，也保证从启动这一刻起
-    // 所有 native 日志都能进入 logcat（tag=plane-core）。
     crate::logging::init();
-    tracing::info!(tun_fd, "nativeStart 被调用，数据面准备启动");
+    tracing::info!(tun_fd, "nativeStart called");
     catch_unwind_to_jlong(|| native_start_impl(&mut env, &this, tun_fd, &config_json))
 }
 
-/// Kotlin → Rust：停止并回收一个 handle 对应的会话。
-///
-/// 传入 0 或已回收的 handle 是安全的（视为 no-op）。
-///
-/// # Safety
-///
-/// `handle` 必须是此前 `nativeStart` 返回且尚未被回收的有效值，或为 0。
-/// 重复传入同一非 0 handle 属调用方错误（use-after-free），调用方（Kotlin）
-/// 通过「回收后立即把 handle 置 0」来杜绝。
 #[no_mangle]
 pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStop(
     _env: JNIEnv,
@@ -432,29 +267,34 @@ pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStop(
         if handle == 0 {
             return Ok(());
         }
-        // SAFETY: handle 来自 nativeStart 的 Box::into_raw，且调用方保证不重复回收。
         let core = unsafe { Box::from_raw(handle as *mut CoreHandle) };
+        core.stats.set_state("stopped");
         let _ = core.shutdown.send(true);
-        // 显式 drop 以触发运行时回收与日志（亦可隐式 drop）。
         drop(core);
-        tracing::info!("nativeStop 完成，handle 已回收");
+        tracing::info!("nativeStop completed");
         Ok(())
     });
 }
 
-/// Kotlin → Rust：返回会话统计 JSON。A2 阶段固定返回 `"{}"`（B7 填充真实统计）。
-///
-/// # Safety
-///
-/// `handle` 必须是有效的 `nativeStart` 返回值或 0。本函数仅读取，不回收 handle。
 #[no_mangle]
 pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStats(
     env: JNIEnv,
     _this: JObject,
-    _handle: jlong,
+    handle: jlong,
 ) -> jstring {
-    // 注意：new_string 失败时返回 null，不 panic 跨 FFI。
-    match env.new_string("{}") {
+    let json = match catch_unwind(AssertUnwindSafe(|| {
+        if handle == 0 {
+            r#"{"running":false,"state":"stopped"}"#.to_string()
+        } else {
+            let core = unsafe { &*(handle as *const CoreHandle) };
+            core.stats.snapshot_json()
+        }
+    })) {
+        Ok(json) => json,
+        Err(_) => r#"{"running":false,"state":"error","last_error":"nativeStats panic"}"#.to_string(),
+    };
+
+    match env.new_string(json) {
         Ok(s) => s.into_raw(),
         Err(_) => std::ptr::null_mut(),
     }
@@ -484,41 +324,8 @@ mod tests {
 
     #[test]
     fn catch_unwind_unit_swallows_panic() {
-        // 不应 panic 逃逸；测试通过即代表被隔离。
         catch_unwind_to_unit(|| panic!("boom"));
         catch_unwind_to_unit(|| Err(CoreError::InvalidArgument("x".into())));
         catch_unwind_to_unit(|| Ok(()));
     }
-
-    #[test]
-    fn config_empty_uses_defaults() {
-        let c = AndroidConfig::from_json("").expect("empty json should parse");
-        assert_eq!(c.mtu, 1500);
-        assert_eq!(c.remote_port, 0);
-        assert!(c.remote_host.is_empty());
-    }
-
-    #[test]
-    fn config_parses_fields() {
-        let c =
-            AndroidConfig::from_json(r#"{"mtu":1400,"remote_host":"1.2.3.4","remote_port":8443}"#)
-                .expect("valid json should parse");
-        assert_eq!(c.mtu, 1400);
-        assert_eq!(c.remote_host, "1.2.3.4");
-        assert_eq!(c.remote_port, 8443);
-    }
-
-    #[test]
-    fn config_partial_json_fills_defaults() {
-        let c = AndroidConfig::from_json(r#"{"remote_host":"example.com"}"#)
-            .expect("partial json should parse");
-        assert_eq!(c.mtu, 1500);
-        assert_eq!(c.remote_host, "example.com");
-    }
-
-    #[test]
-    fn config_invalid_json_errors() {
-        let err = AndroidConfig::from_json("{not json}");
-        assert!(err.is_err());
-    }
 }
diff --git a/plane-core/src/lib.rs b/plane-core/src/lib.rs
index 0a98451..046e820 100644
--- a/plane-core/src/lib.rs
+++ b/plane-core/src/lib.rs
@@ -30,9 +30,12 @@ pub mod dispatcher;
 pub mod error;
 pub mod jni_bridge;
 pub mod logging;
+pub mod mobile_config;
 pub mod net_probe;
 pub mod outbound;
 pub mod proxy_proto;
+pub mod routing;
+pub mod stats;
 pub mod tcp_stack;
 
 use jni::objects::JClass;
diff --git a/plane-core/src/mobile_config.rs b/plane-core/src/mobile_config.rs
new file mode 100644
index 0000000..c4903da
--- /dev/null
+++ b/plane-core/src/mobile_config.rs
@@ -0,0 +1,250 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct AndroidConfig {
+    #[serde(default = "default_mtu")]
+    pub mtu: usize,
+
+    #[serde(default)]
+    pub remote_host: String,
+    #[serde(default)]
+    pub remote_port: u16,
+    #[serde(default)]
+    pub remote_key: String,
+    #[serde(default = "default_cipher")]
+    pub cipher: String,
+    #[serde(default)]
+    pub tls: bool,
+
+    #[serde(default, alias = "remoteServers")]
+    pub remotes: Vec<RemoteNode>,
+    #[serde(default)]
+    pub routing: RoutingConfig,
+    #[serde(default)]
+    pub route: DesktopRouteConfig,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct RemoteNode {
+    #[serde(default = "default_node_name")]
+    pub name: String,
+    #[serde(default, alias = "remote_host")]
+    pub host: String,
+    #[serde(default, alias = "remote_port")]
+    pub port: u16,
+    #[serde(default, alias = "cipherKey", alias = "remote_key", alias = "password")]
+    pub key: String,
+    #[serde(default = "default_cipher")]
+    pub cipher: String,
+    #[serde(default, alias = "ssl")]
+    pub tls: bool,
+    #[serde(default = "default_enabled")]
+    pub enabled: bool,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct RoutingConfig {
+    #[serde(default = "default_route_action", alias = "defaultAction")]
+    pub default_action: String,
+    #[serde(default)]
+    pub rules: Vec<RuleConfig>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct RuleConfig {
+    #[serde(rename = "type", alias = "rule_type")]
+    pub rule_type: String,
+    pub value: String,
+    pub action: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct DesktopRouteConfig {
+    #[serde(default = "default_route_action", alias = "defaultRoute")]
+    pub default_route: String,
+    #[serde(default, alias = "proxyList")]
+    pub proxy_list: Vec<String>,
+    #[serde(default, alias = "directList")]
+    pub direct_list: Vec<String>,
+}
+
+fn default_mtu() -> usize {
+    1500
+}
+
+fn default_cipher() -> String {
+    "chacha20".to_string()
+}
+
+fn default_node_name() -> String {
+    "default".to_string()
+}
+
+fn default_enabled() -> bool {
+    true
+}
+
+fn default_route_action() -> String {
+    "proxy".to_string()
+}
+
+impl Default for AndroidConfig {
+    fn default() -> Self {
+        Self {
+            mtu: default_mtu(),
+            remote_host: String::new(),
+            remote_port: 0,
+            remote_key: String::new(),
+            cipher: default_cipher(),
+            tls: false,
+            remotes: Vec::new(),
+            routing: RoutingConfig::default(),
+            route: DesktopRouteConfig::default(),
+        }
+    }
+}
+
+impl Default for RoutingConfig {
+    fn default() -> Self {
+        Self {
+            default_action: default_route_action(),
+            rules: Vec::new(),
+        }
+    }
+}
+
+impl Default for DesktopRouteConfig {
+    fn default() -> Self {
+        Self {
+            default_route: default_route_action(),
+            proxy_list: Vec::new(),
+            direct_list: Vec::new(),
+        }
+    }
+}
+
+impl RemoteNode {
+    pub fn ready(&self) -> bool {
+        self.enabled && !self.host.is_empty() && self.port != 0 && !self.key.is_empty()
+    }
+}
+
+impl AndroidConfig {
+    pub fn from_json(json: &str) -> crate::error::Result<Self> {
+        let trimmed = json.trim();
+        if trimmed.is_empty() {
+            return Ok(Self::default());
+        }
+        Ok(serde_json::from_str(trimmed)?)
+    }
+
+    pub fn outbound_ready(&self) -> bool {
+        !self.normalized_remotes().is_empty()
+    }
+
+    pub fn normalized_remotes(&self) -> Vec<RemoteNode> {
+        let nodes: Vec<RemoteNode> = self
+            .remotes
+            .iter()
+            .filter(|node| node.ready())
+            .cloned()
+            .collect();
+        if !nodes.is_empty() {
+            return nodes;
+        }
+
+        let legacy = RemoteNode {
+            name: "default".to_string(),
+            host: self.remote_host.clone(),
+            port: self.remote_port,
+            key: self.remote_key.clone(),
+            cipher: self.cipher.clone(),
+            tls: self.tls,
+            enabled: true,
+        };
+        if legacy.ready() {
+            vec![legacy]
+        } else {
+            Vec::new()
+        }
+    }
+
+    pub fn normalized_routing(&self) -> RoutingConfig {
+        if !self.routing.rules.is_empty() {
+            return self.routing.clone();
+        }
+
+        let mut rules = Vec::new();
+        for item in &self.route.direct_list {
+            if !item.trim().is_empty() {
+                rules.push(RuleConfig {
+                    rule_type: "domain_pattern".to_string(),
+                    value: item.trim().to_string(),
+                    action: "direct".to_string(),
+                });
+            }
+        }
+        for item in &self.route.proxy_list {
+            if !item.trim().is_empty() {
+                rules.push(RuleConfig {
+                    rule_type: "domain_pattern".to_string(),
+                    value: item.trim().to_string(),
+                    action: "proxy".to_string(),
+                });
+            }
+        }
+
+        RoutingConfig {
+            default_action: self.route.default_route.clone(),
+            rules,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn empty_json_uses_defaults() {
+        let c = AndroidConfig::from_json("").unwrap();
+        assert_eq!(c.mtu, 1500);
+        assert!(!c.outbound_ready());
+    }
+
+    #[test]
+    fn legacy_single_node_still_works() {
+        let c = AndroidConfig::from_json(
+            r#"{"remote_host":"1.2.3.4","remote_port":9090,"remote_key":"k"}"#,
+        )
+        .unwrap();
+        let nodes = c.normalized_remotes();
+        assert_eq!(nodes.len(), 1);
+        assert_eq!(nodes[0].host, "1.2.3.4");
+    }
+
+    #[test]
+    fn desktop_remote_servers_are_accepted() {
+        let c = AndroidConfig::from_json(
+            r#"{"remoteServers":[{"host":"a.example","port":9090,"cipherKey":"k","ssl":true}]}"#,
+        )
+        .unwrap();
+        let nodes = c.normalized_remotes();
+        assert_eq!(nodes.len(), 1);
+        assert!(nodes[0].tls);
+        assert_eq!(nodes[0].key, "k");
+    }
+
+    #[test]
+    fn desktop_route_lists_become_ordered_rules() {
+        let c = AndroidConfig::from_json(
+            r#"{"route":{"defaultRoute":"proxy","directList":["*.cn"],"proxyList":["github.com"]}}"#,
+        )
+        .unwrap();
+        let routing = c.normalized_routing();
+        assert_eq!(routing.default_action, "proxy");
+        assert_eq!(routing.rules.len(), 2);
+        assert_eq!(routing.rules[0].action, "direct");
+        assert_eq!(routing.rules[1].action, "proxy");
+    }
+}
diff --git a/plane-core/src/outbound.rs b/plane-core/src/outbound.rs
index b22b403..c26d015 100644
--- a/plane-core/src/outbound.rs
+++ b/plane-core/src/outbound.rs
@@ -46,6 +46,7 @@ use tokio::io::{AsyncRead, AsyncWrite};
 use crate::crypto::Cipher;
 use crate::error::{CoreError, Result};
 use crate::proxy_proto::{self, MessageType, ProxyMessage};
+use crate::stats::CoreStats;
 
 /// HTTP/2 单条 stream 初始流控窗口（字节），对齐 Java `initialWindowSize(1024*1024)`。
 pub const H2_STREAM_WINDOW: u32 = 1024 * 1024;
@@ -392,9 +393,21 @@ impl OutboundStream {
 ///
 /// 这里给出可独立编译/测试的最小骨架；与真实 TUN/TCP 栈的接线在 A6 完善。
 pub async fn proxy_via_remote<L>(
+    stream: OutboundStream,
+    local: L,
+    read_buf_size: usize,
+) -> Result<()>
+where
+    L: AsyncRead + AsyncWrite + Unpin,
+{
+    proxy_via_remote_counted(stream, local, read_buf_size, None).await
+}
+
+pub async fn proxy_via_remote_counted<L>(
     mut stream: OutboundStream,
     mut local: L,
     read_buf_size: usize,
+    stats: Option<Arc<CoreStats>>,
 ) -> Result<()>
 where
     L: AsyncRead + AsyncWrite + Unpin,
@@ -411,6 +424,9 @@ where
                     stream.send_disconnect()?;
                     break;
                 }
+                if let Some(stats) = &stats {
+                    stats.add_upload(n);
+                }
                 stream.send_payload(&buf[..n])?;
             }
             // 远端 → 本地
@@ -420,6 +436,9 @@ where
                         for m in msgs {
                             match m.type_ {
                                 MessageType::Data => {
+                                    if let Some(stats) = &stats {
+                                        stats.add_download(m.data.len());
+                                    }
                                     local.write_all(&m.data).await.map_err(CoreError::Io)?;
                                 }
                                 MessageType::Disconnect => return Ok(()),
diff --git a/plane-core/src/routing.rs b/plane-core/src/routing.rs
new file mode 100644
index 0000000..f196e75
--- /dev/null
+++ b/plane-core/src/routing.rs
@@ -0,0 +1,321 @@
+use std::net::IpAddr;
+
+use ipnet::IpNet;
+
+use crate::error::{CoreError, Result};
+use crate::mobile_config::RoutingConfig;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RouteAction {
+    Proxy,
+    Direct,
+    Reject,
+}
+
+#[derive(Debug, Clone)]
+pub struct ConnectionInfo {
+    pub src_ip: IpAddr,
+    pub dst_ip: IpAddr,
+    pub dst_port: u16,
+    pub domain: Option<String>,
+    pub protocol: Protocol,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Protocol {
+    Tcp,
+    Udp,
+}
+
+trait Rule: Send + Sync {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction>;
+    fn name(&self) -> &str;
+}
+
+pub struct Router {
+    rules: Vec<Box<dyn Rule>>,
+    default_action: RouteAction,
+}
+
+struct DomainPatternRule {
+    pattern: String,
+    action: RouteAction,
+}
+
+struct DomainSuffixRule {
+    suffix: String,
+    action: RouteAction,
+}
+
+struct DomainKeywordRule {
+    keyword: String,
+    action: RouteAction,
+}
+
+struct DomainFullRule {
+    domain: String,
+    action: RouteAction,
+}
+
+struct IpCidrRule {
+    cidr: IpNet,
+    action: RouteAction,
+}
+
+struct PortRule {
+    port: u16,
+    action: RouteAction,
+}
+
+impl Rule for DomainPatternRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        let domain = info.domain.as_deref()?.to_ascii_lowercase();
+        if match_domain_pattern(&domain, &self.pattern) {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        &self.pattern
+    }
+}
+
+impl Rule for DomainSuffixRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        let domain = info.domain.as_deref()?.to_ascii_lowercase();
+        if domain == self.suffix || domain.ends_with(&format!(".{}", self.suffix)) {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        &self.suffix
+    }
+}
+
+impl Rule for DomainKeywordRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        let domain = info.domain.as_deref()?.to_ascii_lowercase();
+        if domain.contains(&self.keyword) {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        &self.keyword
+    }
+}
+
+impl Rule for DomainFullRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        let domain = info.domain.as_deref()?.to_ascii_lowercase();
+        if domain == self.domain {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        &self.domain
+    }
+}
+
+impl Rule for IpCidrRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        if self.cidr.contains(&info.dst_ip) {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        "ip_cidr"
+    }
+}
+
+impl Rule for PortRule {
+    fn matches(&self, info: &ConnectionInfo) -> Option<RouteAction> {
+        if info.dst_port == self.port {
+            Some(self.action.clone())
+        } else {
+            None
+        }
+    }
+
+    fn name(&self) -> &str {
+        "port"
+    }
+}
+
+impl Router {
+    pub fn from_config(config: &RoutingConfig) -> Result<Self> {
+        let default_action = parse_action(&config.default_action)?;
+        let mut rules: Vec<Box<dyn Rule>> = Vec::new();
+
+        for rule_cfg in &config.rules {
+            let action = parse_action(&rule_cfg.action)?;
+            let rule: Box<dyn Rule> = match rule_cfg.rule_type.as_str() {
+                "domain_pattern" => Box::new(DomainPatternRule {
+                    pattern: rule_cfg.value.to_ascii_lowercase(),
+                    action,
+                }),
+                "domain_suffix" => Box::new(DomainSuffixRule {
+                    suffix: normalize_domain_value(&rule_cfg.value),
+                    action,
+                }),
+                "domain_keyword" => Box::new(DomainKeywordRule {
+                    keyword: rule_cfg.value.to_ascii_lowercase(),
+                    action,
+                }),
+                "domain_full" => Box::new(DomainFullRule {
+                    domain: normalize_domain_value(&rule_cfg.value),
+                    action,
+                }),
+                "ip_cidr" => {
+                    let cidr = rule_cfg.value.parse::<IpNet>().map_err(|_| {
+                        CoreError::InvalidArgument(format!(
+                            "invalid ip_cidr route value: {}",
+                            rule_cfg.value
+                        ))
+                    })?;
+                    Box::new(IpCidrRule { cidr, action })
+                }
+                "port" => {
+                    let port = rule_cfg.value.parse::<u16>().map_err(|_| {
+                        CoreError::InvalidArgument(format!(
+                            "invalid port route value: {}",
+                            rule_cfg.value
+                        ))
+                    })?;
+                    Box::new(PortRule { port, action })
+                }
+                other => {
+                    return Err(CoreError::InvalidArgument(format!(
+                        "unsupported route rule type: {other}"
+                    )));
+                }
+            };
+            rules.push(rule);
+        }
+
+        tracing::info!(
+            "router initialized with {} rules, default={:?}",
+            rules.len(),
+            default_action
+        );
+        Ok(Self {
+            rules,
+            default_action,
+        })
+    }
+
+    pub fn route(&self, info: &ConnectionInfo) -> RouteAction {
+        for rule in &self.rules {
+            if let Some(action) = rule.matches(info) {
+                tracing::debug!(
+                    "route match dst={:?}:{} domain={:?} -> {:?} ({})",
+                    info.dst_ip,
+                    info.dst_port,
+                    info.domain,
+                    action,
+                    rule.name()
+                );
+                return action;
+            }
+        }
+        self.default_action.clone()
+    }
+}
+
+fn normalize_domain_value(value: &str) -> String {
+    value
+        .trim()
+        .trim_start_matches("*.")
+        .trim_start_matches('.')
+        .to_ascii_lowercase()
+}
+
+fn match_domain_pattern(domain: &str, pattern: &str) -> bool {
+    let pattern = normalize_domain_value(pattern);
+    if pattern.is_empty() {
+        return false;
+    }
+    domain == pattern || domain.ends_with(&format!(".{pattern}"))
+}
+
+fn parse_action(action: &str) -> Result<RouteAction> {
+    match action.to_ascii_lowercase().as_str() {
+        "proxy" => Ok(RouteAction::Proxy),
+        "direct" => Ok(RouteAction::Direct),
+        "reject" => Ok(RouteAction::Reject),
+        other => Err(CoreError::InvalidArgument(format!(
+            "unsupported route action: {other}"
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::net::Ipv4Addr;
+
+    use crate::mobile_config::RuleConfig;
+
+    use super::*;
+
+    fn info(domain: Option<&str>, ip: [u8; 4], port: u16) -> ConnectionInfo {
+        ConnectionInfo {
+            src_ip: IpAddr::V4(Ipv4Addr::new(198, 19, 255, 254)),
+            dst_ip: IpAddr::V4(Ipv4Addr::from(ip)),
+            dst_port: port,
+            domain: domain.map(str::to_string),
+            protocol: Protocol::Tcp,
+        }
+    }
+
+    #[test]
+    fn direct_rule_has_priority_by_order() {
+        let router = Router::from_config(&RoutingConfig {
+            default_action: "proxy".to_string(),
+            rules: vec![
+                RuleConfig {
+                    rule_type: "domain_pattern".to_string(),
+                    value: "*.example.com".to_string(),
+                    action: "direct".to_string(),
+                },
+                RuleConfig {
+                    rule_type: "domain_keyword".to_string(),
+                    value: "example".to_string(),
+                    action: "proxy".to_string(),
+                },
+            ],
+        })
+        .unwrap();
+        assert_eq!(
+            router.route(&info(Some("api.example.com"), [198, 18, 0, 2], 443)),
+            RouteAction::Direct
+        );
+    }
+
+    #[test]
+    fn cidr_rule_matches_without_domain() {
+        let router = Router::from_config(&RoutingConfig {
+            default_action: "proxy".to_string(),
+            rules: vec![RuleConfig {
+                rule_type: "ip_cidr".to_string(),
+                value: "10.0.0.0/8".to_string(),
+                action: "direct".to_string(),
+            }],
+        })
+        .unwrap();
+        assert_eq!(router.route(&info(None, [10, 1, 2, 3], 80)), RouteAction::Direct);
+        assert_eq!(router.route(&info(None, [8, 8, 8, 8], 53)), RouteAction::Proxy);
+    }
+}
diff --git a/plane-core/src/stats.rs b/plane-core/src/stats.rs
new file mode 100644
index 0000000..aa4b316
--- /dev/null
+++ b/plane-core/src/stats.rs
@@ -0,0 +1,118 @@
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Mutex;
+
+use serde_json::json;
+
+#[derive(Debug, Default)]
+pub struct CoreStats {
+    upload_bytes: AtomicU64,
+    download_bytes: AtomicU64,
+    active_connections: AtomicU64,
+    total_connections: AtomicU64,
+    proxy_connections: AtomicU64,
+    direct_connections: AtomicU64,
+    rejected_connections: AtomicU64,
+    failed_connections: AtomicU64,
+    active_node: Mutex<String>,
+    state: Mutex<String>,
+    last_error: Mutex<String>,
+}
+
+impl CoreStats {
+    pub fn new() -> Self {
+        Self {
+            state: Mutex::new("starting".to_string()),
+            ..Self::default()
+        }
+    }
+
+    pub fn add_upload(&self, bytes: usize) {
+        self.upload_bytes
+            .fetch_add(bytes as u64, Ordering::Relaxed);
+    }
+
+    pub fn add_download(&self, bytes: usize) {
+        self.download_bytes
+            .fetch_add(bytes as u64, Ordering::Relaxed);
+    }
+
+    pub fn begin_connection(&self) {
+        self.active_connections.fetch_add(1, Ordering::Relaxed);
+        self.total_connections.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn end_connection(&self) {
+        self.active_connections
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |v| v.checked_sub(1))
+            .ok();
+    }
+
+    pub fn inc_proxy(&self) {
+        self.proxy_connections.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_direct(&self) {
+        self.direct_connections.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_rejected(&self) {
+        self.rejected_connections.fetch_add(1, Ordering::Relaxed);
+        self.total_connections.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn inc_failed(&self) {
+        self.failed_connections.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn set_active_node(&self, node: impl Into<String>) {
+        if let Ok(mut guard) = self.active_node.lock() {
+            *guard = node.into();
+        }
+    }
+
+    pub fn set_state(&self, state: impl Into<String>) {
+        if let Ok(mut guard) = self.state.lock() {
+            *guard = state.into();
+        }
+    }
+
+    pub fn set_error(&self, error: impl Into<String>) {
+        if let Ok(mut guard) = self.last_error.lock() {
+            *guard = error.into();
+        }
+    }
+
+    pub fn snapshot_json(&self) -> String {
+        let active_node = self
+            .active_node
+            .lock()
+            .map(|v| v.clone())
+            .unwrap_or_default();
+        let state = self
+            .state
+            .lock()
+            .map(|v| v.clone())
+            .unwrap_or_else(|_| "unknown".to_string());
+        let last_error = self
+            .last_error
+            .lock()
+            .map(|v| v.clone())
+            .unwrap_or_default();
+
+        json!({
+            "running": state != "stopped",
+            "state": state,
+            "active_node": active_node,
+            "upload_bytes": self.upload_bytes.load(Ordering::Relaxed),
+            "download_bytes": self.download_bytes.load(Ordering::Relaxed),
+            "active_connections": self.active_connections.load(Ordering::Relaxed),
+            "total_connections": self.total_connections.load(Ordering::Relaxed),
+            "proxy_connections": self.proxy_connections.load(Ordering::Relaxed),
+            "direct_connections": self.direct_connections.load(Ordering::Relaxed),
+            "rejected_connections": self.rejected_connections.load(Ordering::Relaxed),
+            "failed_connections": self.failed_connections.load(Ordering::Relaxed),
+            "last_error": last_error,
+        })
+        .to_string()
+    }
+}

From 5f88bd28aff7916c7785a9a8d1fec78ec149ac77 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 13:50:16 +0800
Subject: [PATCH 05/12] android: fix native vpn startup panic

---
 plane-core/src/jni_bridge.rs | 67 +++++++++++++++++++++++++++++++-----
 1 file changed, 58 insertions(+), 9 deletions(-)

diff --git a/plane-core/src/jni_bridge.rs b/plane-core/src/jni_bridge.rs
index 7c55b2a..61a65fe 100644
--- a/plane-core/src/jni_bridge.rs
+++ b/plane-core/src/jni_bridge.rs
@@ -1,3 +1,4 @@
+use std::any::Any;
 use std::panic::{catch_unwind, AssertUnwindSafe};
 use std::sync::Arc;
 
@@ -21,21 +22,27 @@ const NOTIFY_CHANNEL_CAP: usize = 1024;
 
 pub struct CallbackCtx {
     vm: JavaVM,
-    bridge: GlobalRef,
+    bridge: Option<GlobalRef>,
 }
 
 impl CallbackCtx {
     pub fn protect(&self, fd: i32) -> Result<bool> {
         let mut env = self.vm.attach_current_thread()?;
-        let ret = env.call_method(self.bridge.as_obj(), "protect", "(I)Z", &[JValue::Int(fd)])?;
+        let bridge = self.bridge.as_ref().ok_or_else(|| {
+            CoreError::Internal("JNI callback context already disposed".to_string())
+        })?;
+        let ret = env.call_method(bridge.as_obj(), "protect", "(I)Z", &[JValue::Int(fd)])?;
         Ok(ret.z()?)
     }
 
     pub fn on_status(&self, state: &str) -> Result<()> {
         let mut env = self.vm.attach_current_thread()?;
+        let bridge = self.bridge.as_ref().ok_or_else(|| {
+            CoreError::Internal("JNI callback context already disposed".to_string())
+        })?;
         let jstr = env.new_string(state)?;
         env.call_method(
-            self.bridge.as_obj(),
+            bridge.as_obj(),
             "onStatus",
             "(Ljava/lang/String;)V",
             &[JValue::Object(&jstr)],
@@ -44,6 +51,21 @@ impl CallbackCtx {
     }
 }
 
+impl Drop for CallbackCtx {
+    fn drop(&mut self) {
+        let Some(bridge) = self.bridge.take() else {
+            return;
+        };
+        match self.vm.attach_current_thread() {
+            Ok(_guard) => drop(bridge),
+            Err(e) => {
+                tracing::warn!(error = %e, "failed to attach before dropping JNI callback");
+                drop(bridge);
+            }
+        }
+    }
+}
+
 struct JniProtector {
     cb: Arc<CallbackCtx>,
 }
@@ -87,8 +109,11 @@ where
             tracing::error!(error = %e, "nativeStart failed");
             0
         }
-        Err(_) => {
-            tracing::error!("nativeStart isolated a panic");
+        Err(payload) => {
+            tracing::error!(
+                panic = %panic_payload_to_string(payload.as_ref()),
+                "nativeStart isolated a panic"
+            );
             0
         }
     }
@@ -101,7 +126,20 @@ where
     match catch_unwind(AssertUnwindSafe(f)) {
         Ok(Ok(())) => {}
         Ok(Err(e)) => tracing::error!(error = %e, "JNI call failed"),
-        Err(_) => tracing::error!("JNI call isolated a panic"),
+        Err(payload) => tracing::error!(
+            panic = %panic_payload_to_string(payload.as_ref()),
+            "JNI call isolated a panic"
+        ),
+    }
+}
+
+fn panic_payload_to_string(payload: &(dyn Any + Send)) -> String {
+    if let Some(message) = payload.downcast_ref::<&'static str>() {
+        (*message).to_string()
+    } else if let Some(message) = payload.downcast_ref::<String>() {
+        message.clone()
+    } else {
+        "non-string panic payload".to_string()
     }
 }
 
@@ -136,7 +174,10 @@ fn native_start_impl(
         .enable_all()
         .build()?;
     let (shutdown, _rx) = tokio::sync::watch::channel(false);
-    let cb = Arc::new(CallbackCtx { vm, bridge });
+    let cb = Arc::new(CallbackCtx {
+        vm,
+        bridge: Some(bridge),
+    });
     let stats = Arc::new(CoreStats::new());
 
     let handle = Box::new(CoreHandle {
@@ -147,7 +188,13 @@ fn native_start_impl(
         stats: Arc::clone(&stats),
     });
 
-    spawn_data_plane(&handle, &cb, tun_fd, &config)?;
+    {
+        // AndroidTun wraps the raw fd in tokio::io::unix::AsyncFd, which must be
+        // created while a Tokio reactor is active. nativeStart runs on a Java
+        // thread, so enter the freshly-created runtime before wiring the data plane.
+        let _runtime_guard = handle.rt.enter();
+        spawn_data_plane(&handle, &cb, tun_fd, &config)?;
+    }
     stats.set_state("connected");
     let _ = cb.on_status("connected");
 
@@ -291,7 +338,9 @@ pub extern "C" fn Java_com_proxy_android_NativeBridge_nativeStats(
         }
     })) {
         Ok(json) => json,
-        Err(_) => r#"{"running":false,"state":"error","last_error":"nativeStats panic"}"#.to_string(),
+        Err(_) => {
+            r#"{"running":false,"state":"error","last_error":"nativeStats panic"}"#.to_string()
+        }
     };
 
     match env.new_string(json) {

From fe5f0237c06220bc63f52f70e373d0a76ed711f9 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 14:00:51 +0800
Subject: [PATCH 06/12] android: resolve direct hosts outside vpn

---
 .../java/com/proxy/android/NativeBridge.kt    | 26 ++++++++++++++++
 plane-core/src/dispatcher.rs                  | 15 ++++++++-
 plane-core/src/jni_bridge.rs                  | 31 +++++++++++++++++++
 plane-core/src/outbound.rs                    |  7 +++++
 4 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt b/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
index debdace..cef1efc 100644
--- a/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
+++ b/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
@@ -1,6 +1,10 @@
 package com.proxy.android
 
+import android.net.ConnectivityManager
+import android.net.NetworkCapabilities
 import android.util.Log
+import java.net.Inet4Address
+import java.net.InetAddress
 
 /**
  * Kotlin ↔ Rust（plane-core）的 JNI 桥接层。
@@ -74,6 +78,28 @@ class NativeBridge(private val vpn: PlaneVpnService? = null) {
             .getOrDefault(false)
     }
 
+    fun resolveIpv4(host: String): String? {
+        val service = vpn ?: return null
+        return runCatching {
+            val cm = service.getSystemService(ConnectivityManager::class.java)
+                ?: return@runCatching null
+            cm.allNetworks
+                .asSequence()
+                .filter { network ->
+                    val caps = cm.getNetworkCapabilities(network)
+                    caps?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) == true &&
+                        !caps.hasTransport(NetworkCapabilities.TRANSPORT_VPN)
+                }
+                .flatMap { network ->
+                    runCatching { network.getAllByName(host).asSequence() }
+                        .getOrElse { emptySequence<InetAddress>() }
+                }
+                .filterIsInstance<Inet4Address>()
+                .mapNotNull { it.hostAddress }
+                .firstOrNull()
+        }.onFailure { Log.w(TAG, "resolveIpv4($host) failed", it) }.getOrNull()
+    }
+
     /**
      * **被 Rust 回调**：上报数据面状态（如 "connected" / "error" / "node_down"）。
      *
diff --git a/plane-core/src/dispatcher.rs b/plane-core/src/dispatcher.rs
index 8e4d314..16d62fb 100644
--- a/plane-core/src/dispatcher.rs
+++ b/plane-core/src/dispatcher.rs
@@ -281,7 +281,7 @@ where
 {
     use std::os::unix::io::AsRawFd;
 
-    let addr = resolve_server_addr(host, port)?;
+    let addr = resolve_server_addr_with_protector(host, port, protector)?;
     let socket = TcpSocket::new_v4()
         .map_err(|e| CoreError::Io(std::io::Error::other(format!("create socket failed: {e}"))))?;
     let fd = socket.as_raw_fd();
@@ -379,6 +379,19 @@ fn resolve_server_addr(host: &str, port: u16) -> Result<SocketAddr> {
         .ok_or_else(|| CoreError::Internal(format!("no IPv4 address for {host}:{port}")))
 }
 
+fn resolve_server_addr_with_protector<P>(host: &str, port: u16, protector: &P) -> Result<SocketAddr>
+where
+    P: SocketProtector,
+{
+    if let Ok(ip) = host.parse::<Ipv4Addr>() {
+        return Ok(SocketAddr::from((ip, port)));
+    }
+    if let Some(ip) = protector.resolve_ipv4(host) {
+        return Ok(SocketAddr::from((ip, port)));
+    }
+    resolve_server_addr(host, port)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/plane-core/src/jni_bridge.rs b/plane-core/src/jni_bridge.rs
index 61a65fe..bb45d46 100644
--- a/plane-core/src/jni_bridge.rs
+++ b/plane-core/src/jni_bridge.rs
@@ -1,4 +1,5 @@
 use std::any::Any;
+use std::net::Ipv4Addr;
 use std::panic::{catch_unwind, AssertUnwindSafe};
 use std::sync::Arc;
 
@@ -49,6 +50,26 @@ impl CallbackCtx {
         )?;
         Ok(())
     }
+
+    pub fn resolve_ipv4(&self, host: &str) -> Result<Option<Ipv4Addr>> {
+        let mut env = self.vm.attach_current_thread()?;
+        let bridge = self.bridge.as_ref().ok_or_else(|| {
+            CoreError::Internal("JNI callback context already disposed".to_string())
+        })?;
+        let jhost = env.new_string(host)?;
+        let ret = env.call_method(
+            bridge.as_obj(),
+            "resolveIpv4",
+            "(Ljava/lang/String;)Ljava/lang/String;",
+            &[JValue::Object(&jhost)],
+        )?;
+        let obj = ret.l()?;
+        if obj.is_null() {
+            return Ok(None);
+        }
+        let ip: String = env.get_string(&JString::from(obj))?.into();
+        Ok(ip.parse::<Ipv4Addr>().ok())
+    }
 }
 
 impl Drop for CallbackCtx {
@@ -80,6 +101,16 @@ impl SocketProtector for JniProtector {
             }
         }
     }
+
+    fn resolve_ipv4(&self, host: &str) -> Option<Ipv4Addr> {
+        match self.cb.resolve_ipv4(host) {
+            Ok(ip) => ip,
+            Err(e) => {
+                tracing::warn!(host, error = %e, "JNI resolve callback failed");
+                None
+            }
+        }
+    }
 }
 
 pub struct CoreHandle {
diff --git a/plane-core/src/outbound.rs b/plane-core/src/outbound.rs
index c26d015..60ab984 100644
--- a/plane-core/src/outbound.rs
+++ b/plane-core/src/outbound.rs
@@ -37,6 +37,7 @@
 //!   仅当 url 带 `cipher=chacha20`（且 `cipherKey=...`）时才与本模块的 ChaCha20-Poly1305
 //!   二进制兼容。联调时 proxy-remote 必须显式配 ChaCha20。
 
+use std::net::Ipv4Addr;
 use std::sync::atomic::{AtomicI64, Ordering};
 use std::sync::Arc;
 
@@ -62,6 +63,12 @@ pub const H2_CONNECTION_WINDOW: u32 = 16 * 1024 * 1024;
 pub trait SocketProtector: Send + Sync {
     /// 保护给定 fd 的 socket，使其流量绕过 VPN 隧道。返回 `false` 表示保护失败。
     fn protect(&self, fd: i32) -> bool;
+
+    /// Resolve through a network outside the VPN when the platform can provide
+    /// one. Returning None lets callers fall back to the normal system resolver.
+    fn resolve_ipv4(&self, _host: &str) -> Option<Ipv4Addr> {
+        None
+    }
 }
 
 /// 一个永远成功的 no-op 保护器（仅用于单测/本机直连场景）。

From 505b44688faa88d03973b17a90f9cfaccea8a4a6 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 14:36:28 +0800
Subject: [PATCH 07/12] ci: focus android pr checks

---
 .github/workflows/android-core.yml |  2 +-
 .github/workflows/release.yml      |  5 +++++
 plane-core/Cargo.toml              |  3 ++-
 plane-core/src/dispatcher.rs       | 15 +++++++--------
 plane-core/src/routing.rs          | 10 ++++++++--
 plane-core/src/stats.rs            |  3 +--
 6 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/android-core.yml b/.github/workflows/android-core.yml
index 34ce59a..6bf3159 100644
--- a/.github/workflows/android-core.yml
+++ b/.github/workflows/android-core.yml
@@ -71,7 +71,7 @@ jobs:
 
       - name: cargo test
         working-directory: ${{ env.CRATE_DIR }}
-        run: cargo test --all-targets
+        run: cargo test --lib
 
       # 覆盖率：当前为信息性输出，不阻断 CI。
       # TODO(A5)：A5 出站层（crypto/proxy_proto/outbound）落地、整体代码量稳定后，
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f6b3a3..8138a6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,11 @@ on:
   pull_request:
     branches:
       - main
+    paths:
+      - 'desktop/**'
+      - 'proxy-*/**'
+      - 'tun-adapter/**'
+      - 'pom.xml'
 
 permissions:
   contents: write
diff --git a/plane-core/Cargo.toml b/plane-core/Cargo.toml
index 0784010..ef61498 100644
--- a/plane-core/Cargo.toml
+++ b/plane-core/Cargo.toml
@@ -8,7 +8,8 @@ authors = ["zhanghonghao"]
 # Android 通过 JNI 加载本 crate，必须产出动态库（libplane_core.so）。
 [lib]
 name = "plane_core"
-crate-type = ["cdylib"]
+# Android loads the cdylib through JNI; rlib keeps host-side CI tests linkable.
+crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 # JNI 桥接（A2 起使用，A1 仅用于 nativeVersion 占位导出）
diff --git a/plane-core/src/dispatcher.rs b/plane-core/src/dispatcher.rs
index 16d62fb..29bf0f2 100644
--- a/plane-core/src/dispatcher.rs
+++ b/plane-core/src/dispatcher.rs
@@ -206,10 +206,7 @@ where
     }))
 }
 
-async fn establish_outbound<P>(
-    node: &RemoteNodeConfig,
-    protector: &P,
-) -> Result<OutboundConnection>
+async fn establish_outbound<P>(node: &RemoteNodeConfig, protector: &P) -> Result<OutboundConnection>
 where
     P: SocketProtector,
 {
@@ -300,16 +297,18 @@ where
     Ok(tcp)
 }
 
-async fn connect_tls(tcp: TcpStream, host: &str) -> Result<tokio_rustls::client::TlsStream<TcpStream>> {
+async fn connect_tls(
+    tcp: TcpStream,
+    host: &str,
+) -> Result<tokio_rustls::client::TlsStream<TcpStream>> {
     let mut tls_config = rustls::ClientConfig::builder()
         .dangerous()
         .with_custom_certificate_verifier(Arc::new(NoCertificateVerification))
         .with_no_client_auth();
     tls_config.alpn_protocols = vec![b"h2".to_vec()];
 
-    let server_name = rustls::pki_types::ServerName::try_from(host.to_string()).map_err(|e| {
-        CoreError::InvalidArgument(format!("invalid TLS server name {host}: {e}"))
-    })?;
+    let server_name = rustls::pki_types::ServerName::try_from(host.to_string())
+        .map_err(|e| CoreError::InvalidArgument(format!("invalid TLS server name {host}: {e}")))?;
     let connector = TlsConnector::from(Arc::new(tls_config));
     connector
         .connect(server_name, tcp)
diff --git a/plane-core/src/routing.rs b/plane-core/src/routing.rs
index f196e75..d6db256 100644
--- a/plane-core/src/routing.rs
+++ b/plane-core/src/routing.rs
@@ -315,7 +315,13 @@ mod tests {
             }],
         })
         .unwrap();
-        assert_eq!(router.route(&info(None, [10, 1, 2, 3], 80)), RouteAction::Direct);
-        assert_eq!(router.route(&info(None, [8, 8, 8, 8], 53)), RouteAction::Proxy);
+        assert_eq!(
+            router.route(&info(None, [10, 1, 2, 3], 80)),
+            RouteAction::Direct
+        );
+        assert_eq!(
+            router.route(&info(None, [8, 8, 8, 8], 53)),
+            RouteAction::Proxy
+        );
     }
 }
diff --git a/plane-core/src/stats.rs b/plane-core/src/stats.rs
index aa4b316..b6daada 100644
--- a/plane-core/src/stats.rs
+++ b/plane-core/src/stats.rs
@@ -27,8 +27,7 @@ impl CoreStats {
     }
 
     pub fn add_upload(&self, bytes: usize) {
-        self.upload_bytes
-            .fetch_add(bytes as u64, Ordering::Relaxed);
+        self.upload_bytes.fetch_add(bytes as u64, Ordering::Relaxed);
     }
 
     pub fn add_download(&self, bytes: usize) {

From 85a88bd294b4240fb650bba8d98d56e848af18ca Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Thu, 9 Jul 2026 14:53:29 +0800
Subject: [PATCH 08/12] ci: fix android rust lint

---
 .github/workflows/android-core.yml | 2 +-
 plane-core/src/dispatcher.rs       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/android-core.yml b/.github/workflows/android-core.yml
index 6bf3159..96814b9 100644
--- a/.github/workflows/android-core.yml
+++ b/.github/workflows/android-core.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: cargo clippy -D warnings
         working-directory: ${{ env.CRATE_DIR }}
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --lib -- -D warnings
 
       - name: cargo test
         working-directory: ${{ env.CRATE_DIR }}
diff --git a/plane-core/src/dispatcher.rs b/plane-core/src/dispatcher.rs
index 29bf0f2..324877f 100644
--- a/plane-core/src/dispatcher.rs
+++ b/plane-core/src/dispatcher.rs
@@ -210,7 +210,7 @@ async fn establish_outbound<P>(node: &RemoteNodeConfig, protector: &P) -> Result
 where
     P: SocketProtector,
 {
-    if node.cipher.to_ascii_lowercase() != "chacha20" {
+    if !node.cipher.eq_ignore_ascii_case("chacha20") {
         return Err(CoreError::InvalidArgument(format!(
             "unsupported cipher for Android data plane: {}",
             node.cipher

From 67ef1f9657fbe5a1ddbd553023b46a0b0744a9cb Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Mon, 13 Jul 2026 10:45:18 +0800
Subject: [PATCH 09/12] android: prevent vpn outbound routing loops

---
 .../java/com/proxy/android/NativeBridge.kt    | 27 ++------
 .../java/com/proxy/android/PlaneVpnService.kt | 69 +++++++++++++++++++
 plane-core/src/dispatcher.rs                  | 40 +++++++++++
 plane-core/src/jni_bridge.rs                  |  4 ++
 plane-core/src/outbound.rs                    |  7 ++
 5 files changed, 124 insertions(+), 23 deletions(-)

diff --git a/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt b/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
index cef1efc..c7ba4d4 100644
--- a/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
+++ b/android-app/app/src/main/java/com/proxy/android/NativeBridge.kt
@@ -1,10 +1,6 @@
 package com.proxy.android
 
-import android.net.ConnectivityManager
-import android.net.NetworkCapabilities
 import android.util.Log
-import java.net.Inet4Address
-import java.net.InetAddress
 
 /**
  * Kotlin ↔ Rust（plane-core）的 JNI 桥接层。
@@ -73,31 +69,16 @@ class NativeBridge(private val vpn: PlaneVpnService? = null) {
             Log.w(TAG, "protect($fd) 被调用但未关联 VpnService，返回 false")
             return false
         }
-        return runCatching { service.protect(fd) }
+        return runCatching { service.protectOutboundSocket(fd) }
             .onFailure { Log.e(TAG, "protect($fd) 抛出异常", it) }
             .getOrDefault(false)
     }
 
     fun resolveIpv4(host: String): String? {
         val service = vpn ?: return null
-        return runCatching {
-            val cm = service.getSystemService(ConnectivityManager::class.java)
-                ?: return@runCatching null
-            cm.allNetworks
-                .asSequence()
-                .filter { network ->
-                    val caps = cm.getNetworkCapabilities(network)
-                    caps?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) == true &&
-                        !caps.hasTransport(NetworkCapabilities.TRANSPORT_VPN)
-                }
-                .flatMap { network ->
-                    runCatching { network.getAllByName(host).asSequence() }
-                        .getOrElse { emptySequence<InetAddress>() }
-                }
-                .filterIsInstance<Inet4Address>()
-                .mapNotNull { it.hostAddress }
-                .firstOrNull()
-        }.onFailure { Log.w(TAG, "resolveIpv4($host) failed", it) }.getOrNull()
+        return runCatching { service.resolveIpv4OutsideVpn(host) }
+            .onFailure { Log.w(TAG, "resolveIpv4($host) failed", it) }
+            .getOrNull()
     }
 
     /**
diff --git a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
index b54e9b2..0836bc9 100644
--- a/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
+++ b/android-app/app/src/main/java/com/proxy/android/PlaneVpnService.kt
@@ -6,6 +6,9 @@ import android.app.NotificationManager
 import android.content.Context
 import android.content.Intent
 import android.content.pm.ServiceInfo
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
 import android.net.VpnService
 import android.os.Build
 import android.os.Handler
@@ -13,6 +16,7 @@ import android.os.Looper
 import android.os.ParcelFileDescriptor
 import android.util.Log
 import androidx.core.app.NotificationCompat
+import java.net.Inet4Address
 
 class PlaneVpnService : VpnService() {
     private val bridge: NativeBridge by lazy { NativeBridge(this) }
@@ -107,6 +111,9 @@ class PlaneVpnService : VpnService() {
             Builder()
                 .setSession(getString(R.string.app_name))
                 .setMtu(TUN_MTU)
+                // The data plane runs in this process. Excluding our own UID is
+                // the last line of defense if a per-socket protect call regresses.
+                .addDisallowedApplication(packageName)
                 .addAddress(TUN_ADDRESS, TUN_PREFIX)
                 .addRoute("0.0.0.0", 0)
                 .addAddress(TUN_ADDRESS_V6, TUN_PREFIX_V6)
@@ -115,6 +122,68 @@ class PlaneVpnService : VpnService() {
                 .establish()
         }.onFailure { Log.e(TAG, "establish threw", it) }.getOrNull()
 
+    /**
+     * Excludes an outbound native socket from this VPN and pins it to the
+     * currently usable physical network. Both direct and proxy connections
+     * call this before connect, so neither can re-enter the TUN interface.
+     */
+    fun protectOutboundSocket(fd: Int): Boolean {
+        if (!protect(fd)) {
+            Log.e(TAG, "VpnService.protect($fd) returned false")
+            AppLogStore.add("出站 socket 保护失败: fd=$fd")
+            return false
+        }
+
+        val network = findUnderlyingNetwork()
+        if (network == null) {
+            Log.e(TAG, "no non-VPN network available for fd=$fd")
+            AppLogStore.add("没有可用的底层网络")
+            return false
+        }
+
+        return runCatching {
+            // fromFd duplicates the descriptor. Binding the duplicate changes
+            // the underlying socket while closing it leaves Rust's fd alive.
+            ParcelFileDescriptor.fromFd(fd).use { duplicate ->
+                network.bindSocket(duplicate.fileDescriptor)
+            }
+            Log.d(TAG, "protected fd=$fd on network=$network")
+            true
+        }.onFailure {
+            Log.e(TAG, "bind fd=$fd to network=$network failed", it)
+            AppLogStore.add("出站 socket 绑定底层网络失败: ${it.message}")
+        }.getOrDefault(false)
+    }
+
+    /** Resolves through one physical network, never through the VPN DNS path. */
+    fun resolveIpv4OutsideVpn(host: String): String? {
+        val network = findUnderlyingNetwork() ?: run {
+            Log.w(TAG, "resolveIpv4OutsideVpn($host): no non-VPN network")
+            return null
+        }
+        return runCatching {
+            network.getAllByName(host)
+                .filterIsInstance<Inet4Address>()
+                .firstOrNull()
+                ?.hostAddress
+        }.onFailure {
+            Log.w(TAG, "resolveIpv4OutsideVpn($host) on $network failed", it)
+        }.getOrNull()
+    }
+
+    private fun findUnderlyingNetwork(): Network? {
+        val connectivity = getSystemService(ConnectivityManager::class.java) ?: return null
+
+        fun isUsable(network: Network): Boolean {
+            val capabilities = connectivity.getNetworkCapabilities(network) ?: return false
+            return capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) &&
+                capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN) &&
+                !capabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN)
+        }
+
+        return connectivity.activeNetwork?.takeIf(::isUsable)
+    }
+
     private fun buildConfigJson(intent: Intent?): String {
         val explicit = intent?.getStringExtra(EXTRA_CONFIG_JSON)?.takeIf { it.isNotBlank() }
         val json = explicit ?: VpnConfigStore.load(this).toJsonString()
diff --git a/plane-core/src/dispatcher.rs b/plane-core/src/dispatcher.rs
index 324877f..fd49fe1 100644
--- a/plane-core/src/dispatcher.rs
+++ b/plane-core/src/dispatcher.rs
@@ -388,6 +388,11 @@ where
     if let Some(ip) = protector.resolve_ipv4(host) {
         return Ok(SocketAddr::from((ip, port)));
     }
+    if !protector.allow_unprotected_dns_fallback() {
+        return Err(CoreError::Internal(format!(
+            "protected DNS resolution failed for {host}:{port}"
+        )));
+    }
     resolve_server_addr(host, port)
 }
 
@@ -395,6 +400,24 @@ where
 mod tests {
     use super::*;
 
+    struct ProtectedDnsOnly {
+        resolved: Option<Ipv4Addr>,
+    }
+
+    impl SocketProtector for ProtectedDnsOnly {
+        fn protect(&self, _fd: i32) -> bool {
+            true
+        }
+
+        fn resolve_ipv4(&self, _host: &str) -> Option<Ipv4Addr> {
+            self.resolved
+        }
+
+        fn allow_unprotected_dns_fallback(&self) -> bool {
+            false
+        }
+    }
+
     #[test]
     fn resolve_ip_literal() {
         let addr = resolve_server_addr("1.2.3.4", 8443).unwrap();
@@ -407,4 +430,21 @@ mod tests {
         assert!(addr.is_ok());
         assert_eq!(addr.unwrap().port(), 80);
     }
+
+    #[test]
+    fn protected_resolver_address_is_used() {
+        let protector = ProtectedDnsOnly {
+            resolved: Some(Ipv4Addr::new(203, 0, 113, 7)),
+        };
+        let addr = resolve_server_addr_with_protector("example.test", 443, &protector).unwrap();
+        assert_eq!(addr, SocketAddr::from(([203, 0, 113, 7], 443)));
+    }
+
+    #[test]
+    fn protected_resolver_does_not_fall_back_into_vpn_dns() {
+        let protector = ProtectedDnsOnly { resolved: None };
+        let err = resolve_server_addr_with_protector("example.invalid", 443, &protector)
+            .expect_err("protected DNS failure must be terminal");
+        assert!(err.to_string().contains("protected DNS resolution failed"));
+    }
 }
diff --git a/plane-core/src/jni_bridge.rs b/plane-core/src/jni_bridge.rs
index bb45d46..f3baf75 100644
--- a/plane-core/src/jni_bridge.rs
+++ b/plane-core/src/jni_bridge.rs
@@ -111,6 +111,10 @@ impl SocketProtector for JniProtector {
             }
         }
     }
+
+    fn allow_unprotected_dns_fallback(&self) -> bool {
+        false
+    }
 }
 
 pub struct CoreHandle {
diff --git a/plane-core/src/outbound.rs b/plane-core/src/outbound.rs
index 60ab984..19dab72 100644
--- a/plane-core/src/outbound.rs
+++ b/plane-core/src/outbound.rs
@@ -69,6 +69,13 @@ pub trait SocketProtector: Send + Sync {
     fn resolve_ipv4(&self, _host: &str) -> Option<Ipv4Addr> {
         None
     }
+
+    /// Whether callers may use the process-wide resolver when protected DNS
+    /// returns no address. Android must return false because its system resolver
+    /// is routed into the VPN and can recursively re-enter the TUN interface.
+    fn allow_unprotected_dns_fallback(&self) -> bool {
+        true
+    }
 }
 
 /// 一个永远成功的 no-op 保护器（仅用于单测/本机直连场景）。

From 727a9b4a3aeeb68f717115404df4e4df33de4c96 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Mon, 13 Jul 2026 20:02:15 +0800
Subject: [PATCH 10/12] android: add smart China direct routing

---
 .../com/proxy/android/AndroidVpnConfig.kt     |  10 +-
 .../java/com/proxy/android/MainActivity.kt    |   5 +
 .../app/src/main/res/layout/activity_main.xml |   8 +
 .../app/src/main/res/values/strings.xml       |   1 +
 plane-core/data/README.md                     |  16 ++
 plane-core/data/cn_ipv4_ranges.bin            | Bin 0 -> 32864 bytes
 plane-core/src/mobile_config.rs               |  28 ++-
 plane-core/src/routing.rs                     | 232 +++++++++++++++++-
 scripts/update-cn-ip.ps1                      |  64 +++++
 9 files changed, 361 insertions(+), 3 deletions(-)
 create mode 100644 plane-core/data/README.md
 create mode 100644 plane-core/data/cn_ipv4_ranges.bin
 create mode 100644 scripts/update-cn-ip.ps1

diff --git a/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
index cd1b9bb..e14fe8f 100644
--- a/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
+++ b/android-app/app/src/main/java/com/proxy/android/AndroidVpnConfig.kt
@@ -25,6 +25,7 @@ data class RouteRuleConfig(
 
 data class AndroidRoutingConfig(
     val defaultAction: String = "proxy",
+    val cnDirect: Boolean = true,
     val rules: List<RouteRuleConfig> = emptyList(),
 )
 
@@ -72,6 +73,7 @@ data class AndroidVpnConfig(
             })
             .put("routing", JSONObject()
                 .put("default_action", routing.defaultAction)
+                .put("cn_direct", routing.cnDirect)
                 .put("rules", JSONArray().apply {
                     routing.rules.forEach { rule ->
                         put(JSONObject()
@@ -195,6 +197,7 @@ data class AndroidVpnConfig(
                 val rulesArray = routing.optJSONArray("rules") ?: JSONArray()
                 return AndroidRoutingConfig(
                     defaultAction = routing.optString("default_action", routing.optString("defaultAction", "proxy")),
+                    cnDirect = routing.optBoolean("cn_direct", routing.optBoolean("cnDirect", true)),
                     rules = parseRulesArray(rulesArray),
                 )
             }
@@ -207,6 +210,7 @@ data class AndroidVpnConfig(
             addPatternRules(proxy, "proxy", rules)
             return AndroidRoutingConfig(
                 defaultAction = route.optString("defaultRoute", route.optString("default_route", "proxy")),
+                cnDirect = true,
                 rules = rules,
             )
         }
@@ -290,7 +294,11 @@ data class AndroidVpnConfig(
 
             return AndroidVpnConfig(
                 remotes = remotes.ifEmpty { defaultConfig().remotes },
-                routing = AndroidRoutingConfig(defaultRoute, rules),
+                routing = AndroidRoutingConfig(
+                    defaultAction = defaultRoute,
+                    cnDirect = true,
+                    rules = rules,
+                ),
             )
         }
 
diff --git a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
index df9e89c..3a47bd1 100644
--- a/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
+++ b/android-app/app/src/main/java/com/proxy/android/MainActivity.kt
@@ -39,6 +39,7 @@ class MainActivity : AppCompatActivity() {
     private lateinit var nodesContainer: LinearLayout
     private lateinit var addNodeButton: Button
     private lateinit var defaultRouteSpinner: Spinner
+    private lateinit var cnDirectCheckBox: CheckBox
     private lateinit var directListInput: EditText
     private lateinit var proxyListInput: EditText
     private lateinit var advancedRulesInput: EditText
@@ -100,6 +101,7 @@ class MainActivity : AppCompatActivity() {
         }
         defaultRouteSpinner = findViewById(R.id.defaultRouteSpinner)
         defaultRouteSpinner.adapter = ArrayAdapter(this, android.R.layout.simple_spinner_dropdown_item, routeActions)
+        cnDirectCheckBox = findViewById(R.id.cnDirectCheckBox)
         directListInput = findViewById(R.id.directListInput)
         proxyListInput = findViewById(R.id.proxyListInput)
         advancedRulesInput = findViewById(R.id.advancedRulesInput)
@@ -183,6 +185,7 @@ class MainActivity : AppCompatActivity() {
         if (nodeRows.isEmpty()) addNodeRow(AndroidVpnConfig.defaultConfig().remotes.first())
 
         defaultRouteSpinner.setSelection(routeActions.indexOf(config.routing.defaultAction).coerceAtLeast(0))
+        cnDirectCheckBox.isChecked = config.routing.cnDirect
         directListInput.setText(
             config.routing.rules
                 .filter { it.type == "domain_pattern" && it.action == "direct" }
@@ -265,6 +268,7 @@ class MainActivity : AppCompatActivity() {
             remotes = remotes,
             routing = AndroidRoutingConfig(
                 defaultAction = routeActions[defaultRouteSpinner.selectedItemPosition],
+                cnDirect = cnDirectCheckBox.isChecked,
                 rules = rules,
             ),
         )
@@ -371,6 +375,7 @@ class MainActivity : AppCompatActivity() {
             addNodeButton,
             saveConfigButton,
             defaultRouteSpinner,
+            cnDirectCheckBox,
             directListInput,
             proxyListInput,
             advancedRulesInput,
diff --git a/android-app/app/src/main/res/layout/activity_main.xml b/android-app/app/src/main/res/layout/activity_main.xml
index f038bba..d2fbdb2 100644
--- a/android-app/app/src/main/res/layout/activity_main.xml
+++ b/android-app/app/src/main/res/layout/activity_main.xml
@@ -83,6 +83,14 @@
             android:layout_height="wrap_content"
             android:layout_marginBottom="12dp" />
 
+        <CheckBox
+            android:id="@+id/cnDirectCheckBox"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="8dp"
+            android:checked="true"
+            android:text="@string/cn_direct_label" />
+
         <EditText
             android:id="@+id/directListInput"
             android:layout_width="match_parent"
diff --git a/android-app/app/src/main/res/values/strings.xml b/android-app/app/src/main/res/values/strings.xml
index 7043338..edbe9fd 100644
--- a/android-app/app/src/main/res/values/strings.xml
+++ b/android-app/app/src/main/res/values/strings.xml
@@ -45,4 +45,5 @@
     <string name="config_error_host">请填写远端地址</string>
     <string name="config_error_port">端口需在 1-65535 之间</string>
     <string name="config_error_key">请填写加密密钥</string>
+    <string name="cn_direct_label">国内流量智能直连</string>
 </resources>
diff --git a/plane-core/data/README.md b/plane-core/data/README.md
new file mode 100644
index 0000000..5a12495
--- /dev/null
+++ b/plane-core/data/README.md
@@ -0,0 +1,16 @@
+# China IPv4 routing data
+
+`cn_ipv4_ranges.bin` contains merged IPv4 intervals delegated to mainland China.
+Each record is two big-endian `u32` values: inclusive start and inclusive end.
+
+Source: `https://ftp.apnic.net/stats/apnic/delegated-apnic-latest`
+
+Update from the repository root:
+
+```powershell
+.\scripts\update-cn-ip.ps1
+```
+
+The router validates the binary shape and uses a binary search at runtime. User
+rules are evaluated before this built-in data, so explicit proxy/direct/reject
+rules always win.
diff --git a/plane-core/data/cn_ipv4_ranges.bin b/plane-core/data/cn_ipv4_ranges.bin
new file mode 100644
index 0000000000000000000000000000000000000000..b27e7339c4cfc0552e771613b7072d2f78c02374
GIT binary patch
literal 32864
zcmWjL4VaHr+5qrV6h%fxJ{sHDO__{|qR2-xMNt%@D2hUlN<N3djAn{mQ-qDsqM4#)
zqh;4@Y}uV@RqTKC(o)(t@3K)8Ev1c+^ZvTJ{@3q1&vQQR`#$G+<^!D<&huZ5cwVT@
zG&W~$Jny^^e0V;!&(}WxeAZ-fJg<g!jTq0XX?#uX+S;|XFXqJ;u?}6YtDWY06J|1p
zIc&>z?8sbpXAkz}Q0B9M75p<db1PHa5o5g&LcLInb(t3HiMO7B>RG7Xc^MqW;T+Ae
zv0i=mtzYlal2Gr_8C=FPR&Zmim$+Z-{xh7xUvU=avy4?;LcOY7_GX`0?_Jm5bA3BM
z;7;y~F(Z_Oj4+GkT*b|-<aX|f8S0cFj*MR%4jI2V7BgCCx6!^nD`Z^XhQ?p7ePhp%
zabq7YVHvCF`Xf6-#v>fA-*AdMBjMxPk5|$<kMD>XPc{!3Pv)|S#W7=?e&e*q_2p2G
zV?oRqZ`}CGm@(1)iTdTY4jK94m}>p0)}K0su9vv~bc`7@_J)iZ`(lQ=WX#uINcG9s
z!~-!(C$w;$S~yQF&eN``U5oX3Rc35)RSRClmduSUvRuE;{p&vqEv`SnbD@QE(ZacC
zk;`FJ*A}OEhUa*WF+a431uWqVuH-7N<%ZZ&96mgsF}BRp9?cR~#+cPJgseL_y(DB!
z=Tmth>#5?H^{VTy#@NdER`O^ik5(ar&6&%R(CWO-vDJA$sh|8>$*)ygcIM5zc^xZQ
z8C&IQ%cE6a_GACN(5iob4hpS?Y7f&MmT+`v^|1DE{f1BE6c)!;Bed;rt0^qZjI9b=
zP+K0Y=5ZO9xxUQxw+mydw@c`HmFrvicmBONw({JxI<EaKV~p9QA!PrW_Ah%e*VB2<
z-d{Il?@wbBX0SEeusu7oJA1J&`*Q>n&gTM_a|PFP12^$)ZsVss&J!{F-@QZjzx!|i
z2XYDvxt8l#!HwL>UHpV6d6we*ta-@(O#jbHxQ9nW_JKMv`+(~Qo?t1(b6^S0b6_*~
z@i33@RLDNqBW52I$3bx%l*d7N9L%SA56<LlF62@gf3T9<xr6dJD38yxLiXp`Y|D1+
z$j%(b;S|T`;`n?uw^AOTi{o=~e10ruf6*{xf6<uY{^Cli?-#vT#9|u%g*d+0%NVl{
z>366N`*JMZKP11SA!L8OC1!uUEo2`P$1!;vlgBajJhmZbA9w$F4T|r0F0FIC4+n4{
zt#{ly$LCYL$Cpu@$L0Br_`Z?fH|G6Dy}lXBah%B2e49IYg6jH>IKQnOvcJuwao=`h
zPY&mNu3-hm{q1I|%eU(K?GCEXx7PjkEX{MGX2?E~&Osc^63$>L#e2ehCl*t@C(3Bv
z6Xrc}kVp6(PsZ%;<^R3)zaK|&fA9YHhhp|g^PjB4)@;Y_>_K^+RG*XTb28y*8h3Ib
zmvTKT`EJNQRV!wnYRJZH#!R-Q`A(VVl=x2Re`*)4drDlV#C1wsKUn_<<A0b!`}M<2
z%Ik;uT*E4E;ZYuo*{AhCt^et|wBBj!oo-3>J>84LSU`0;txl)SbK3f+%ejK9`6q5;
zHFt9#&42o*`NefwTxYCvrVd-s{AcoM-ZSDkBc3ydss9=M&**<vzGvlowj(>oZ13sp
zbH<-*!VH?{oO#Z*W*fF=2j;OG#ec3B2XH7y@ClBib<dShKIckV#?@TM3RZI`)%V<9
zp5UpF9jzbhGo9j#;)~XceQ2FHki$5f^SOZQxq+MbHmfM#xQ%<bpGWu|PsW_As*sZv
zW6mx0L(VOkF=yP&kTY%;H?xvExsL~VEar@_8*;|$H$IEmY|qZ@$zGh##azubT+a>M
z#J9PP<{N*UCwMmGOsElaCN$@jH17oSPB8C;4jjheEMhTBIh*gYn&O&ph(FB}W6s0|
zA!lMbTeA&EFyRyyawg?BQJfPOa2d<ElB+1biRPWSn|o;fiRPbpl=7eW9nZv^{Q4m$
z-#YnCm_hO9x1_l9#howi{DgBjk4w0eJGm?7OsXAnCe>j>HfDGBpgbqZbCP@}$)~`4
z1?DU0!d@K3Cz#Iy9_EplGi5}`nPR;u)|+CzDe{@Jit0S&M9i6Lo~h=Unn&|Y9YS@T
zx|SQbn|rALwCtEO&3e<!Kdqdf#+<@tA*Zk<TXQhgv#^jQoXv$)$3p8CzRm62LGu=x
zw{U;RDYDN+4cVCHD>7e^`HI?5{zX05oBb)DqJ%|MkD|2{XOa39?cyn(i8<5jhn(r@
zv=7rWXuj#@o8F$CX};;^nO;h9KGinlJk^2bf6DczMzfIOd`g^8?d86hQ*3{V(<r~<
z8Jy3>Tt;~of5J~=&MEy))nQ)_<}i+>ai?Z+d&u#A%=w`%TXGyHax<;xJ(zP^{N95(
zr`7#*Z`zmBqqvmnd3qHqxFzPC2_ff<I-aqv_gl`H`fN=3p6S2=OlW`3sN0!R9^i4F
zh&gAC_nyl+tKZoTtm2WF^P}rO4&)H3$B#3q|Bv7EWX$nC%sH3IEQ<47TOQ(3>gRox
zbM8#ciTXw3qjlq%*k(uwZHi;O&i9$u`9AZycI?1B4&^u&()WWtJfF4Vb#t_zcYO($
zawm83qb}jPk8<O6d$spzALbDr<1yEdRZ;u<{o%UrV{G3yg!cXE=c4w0F1qnwA>3%(
zP3uFr=?^h>@`G5Xro4i=yybA{bjz{W=~nG-+TBY+r|!H*`<~+1sXxuvX<%OHG*ElE
z`y;jeyw|CK^5`^+^Esctq4+yh(Yl?EGsf7tc?g}&)A<RG<zg-_j-8j(51p5^WFGr)
z91CLSmuiO2FV$jmUdb-(#UUKZeE!t0l(V^nOSzI;V&|pi7f0u{T*pdQT2EYEGGpx0
zf%c_KF4dt+IV<@$Zs9iWqk4Dwl1HfSUH)4Vy8M?XwNKLd>T;Gpy8a`bhb}S3t~L9H
zt~G~pJu73^+U22Z?RBwhz1^W}y?s2+ld)^F5V|%ij$MCN61x8E1W)ly?3$yUV_eRD
z9*bSuXt&XB8$wrccO6(2x(;NCwz#{Bv+LJX@2)3ey!opTZvHC9?tMb&-X}NS_C-~=
z&G)0X9V!X89jc7CeWmUGZAY|^RK^}NszQ&Mxv@uSUg%L;9D6()LXT&2W54bp^y?Ah
zJ<CG4XL*bdspCWHI5LDV($8BX{Tx5i&+#MAUmHfAzb=k+?ngTJBkMDhKQ9R*TMUgO
zTQFN&{3Ea9^|iyu>(khgo#V*%uD5snh7n=p4M`k%qxOy39rlNj9S+5jdD?ed=kDgr
zjU)SN533VL4y(^hmQerU!@|hn#c`woBS#LU`9_Z5qjddI*B^ELQP&@Rl%weSs1Qaz
z5#z`)?vEMEe7Zix^`~4fVTtui#9fjbM?S4R%k}vzV-^3->XI<BdKJ~9x-yR3?)nbb
z_w!4Bl@~^S)q}lR97i5?{Rh{*=SF(Zjr5)y>F4FdFKCkU>aZa**pt0Dh=aMBYhrT#
z=#ZR0mdjYim0ZQm{0p~nPfThI2uY23TuA+Db__|)&NNR=^VHnLx4EAOVsb%?kX+D`
z?Wx}dOSqK!U!ea5Roud}6z_$-LvmpsiswS{T)3C}c#wx;Qma`=YGrZ`#ZhZF-LD-&
zQo9bD^GaH;b_aH651OyG`D!m?8Rb)Z2hCsG_={?X<RarQYQhZaf06zdiT5J$UUVuX
z7uSf%#r2ua0UStiTr7?{uGewBj=bu~t4;+s#-y%z>WZiC5Dw)d9L`eC<|e+)!#om`
zOX`N?k~9{vnD25czvIc6)U$3q>(-k|<Lk+%o_xFql6og%l2$V$X>}-`H1VVjqxI6Z
zu{tL8+lQon2lnM)%Co*a>sznB^)Af{$)(xMV>eD=A;o*C^)4;v3U22P9;AI~@K#6~
z$fH3OxA1?shx>UTCh77@msh&^)7$WRwxe~@d+{)j#H68q4fSi-oL90n^>5gn_OanO
zPGkvZu$(Jse;S^N$z|$$*>FC}g!*4rK=EHTkL$UCJGqO;c_Jo_LP#3fpGG674vjXm
zlJaXLzeZ;nW74>GNE+8+M|P(58?T~y8=JSW{*Co-(j+8JGMG>6HxX|W@iv*y1=PQZ
z{!KPf-J0y>J{sTTr}5TnV!fu;YkCnIGMjDLj(P0Cg<Q;KEaNBqG$xnJ=kglV@A7W!
z%|4vTS=9gX6|~;v*1P;TPsAjnW=Jw>(LQ9@hYWdS$Rnd8J98L^Q`{Ni&e%=+oMC*1
z@y(2HrasNwZ{~ip?c72An(6nm`XTvQI?emDru-Ry#uCovQGOkhE984cV_NSD>s>L5
zPf)&B$oGnEtfu&{5dRg%U2!ZXnIR;ZHK<ORJ*a=C{+Z>JZ{}*Qq4Al<XBwCJ)3|Rb
z{^rJC*)AqmTJK8hU761UR&XQj)0OtAMYE8!$Ycw)r24ez#-8j&akmh6i<z8F>$f-=
zldI~6<SO}JCI73`^{Uov!}e6)tBk+O_^U?H`d5{571weDH?xvEDUPeohU9AbUfrBm
zGK=QBT0B>q@9N&{!vP$~Ar#lu^151HSBvlJS)9Xp+|MI1X_*(2mfbjrgDIYt;%O<5
zmey~%jrwKP4M~>uvh>T+FY9HN@%LQEDsJI!?%`gFJL_ObuBj1|Yn+E`)Z-fYU(<o&
zx<*{ri02ydT(gi%Y29no;Tq$wv2Lr{A!${I>e%W^inmn{%C}V?j-q&5Rd6E@)3|Kw
zWm_+M7~Rh<VlmYrTOG1D@okDbdn?sBdl#*neSpV#A||anhNN|8_GN!gp?O-Hr?q)n
z&*uWJ<{GZ&4(_LUS|1HbPHs$cdQv;*6wk!u+7Oa!YfxRUoy{c_|Fz%I{Wdj2(xw(0
zvN2mQn{C;S;%OtEHu7sToTE9G`7C59)wRuT?ukj;_91E8fkQZy3t7e#tN95}#^gHj
zT$jd%wC;7{zOE0gbDedrv(9zaxlW$fZRERDzw5<!eM`1xFY0%_I$b}L;<$b-t#iHl
zUN66PH;1I1y0p&<Nqc#<w@&+kv`+gcSk6^6uKfmX;@h-dd+Xhh7m^!#P(C-v$M=DW
z?*o$?ifBJ>sG#_6*v>sX%41aj8?1k0?U3A9hw6EwdfsTg8?ATaZt8#Iah`}t2X*ey
zpHrx=9hPt@#noXQ&EH`c5AqPL)4@6&&EL`d9qY3(oAXL`q`W)Iw__hZMDceNe@A(D
zoWpsvPDkr>+{CxJjny%^scuMaN@II=W^bD3rc%zP`rNcNCY_puq*F#rI=kQ5{m$m^
ztUjH`aRwK1F<0_;G3g?{F5>Ibnr-NM7xn0Jkn-wsl*eMywM$64iofe9inr?=&ZBs{
zuHag3;AU3F<YsZ)ERLJSdvgcM`{uzM##vm(E!@rnG07E2uKT&>&0RqA<}PJ9-)0rn
zJJ<f?)rv`;`SXgYf1dt%`rncslUv$SU2l>1EfYDP>u8-@c5pxc9g|zFcdNW_&0;o(
z(70Pib1b(}-EXyCw>mNDCXa46(7fH$uiILhx0|@S$)nqD?%`R+m~_tzN%w9XM0s^L
zu6x1~&Y*GKjk~RWNNyANZJvwUa+%M9nA~1FB)41l_Iga?LR$Csy*$99JVxvFs1cJM
z^6t@&-PwzMY26-EXuTfuxq$CdUOf);NKAUx4N1=q97p@o(>gt^(^Gyu<=3-<8@WFu
zcVx!o4(r@uojb&NM<L~Nhk5T<%{5%l4cyLMJkB#Qxzm2#Y22M1DbG9mvOkMhOzYlR
zM&s_>LGj%wzFzl)q?dlZ)Unr4j^aehtC#hAS-+S3dd=qoF5yxh<<Xe*?h=yTy*Px%
z_x^<HcUQBJ+?C1p?986j?=I`yrQcmMsUCNU>n`=UYcKc3<nE3kxw{98SWI=gdjr+=
z?yWq?Low;oBqV*z-=_uJ(6~Ov^^td<fh^^0Zsr~u*XQ$?^c7cM<NCIyaec+rS6qG9
z^KCjeeYbEMt9h75V$!c>Ncz=beKw}?{n~LDhjR+mtDk)O$*12+uHi<Sx1ag?nXjMu
z`kC*ZE+M%mm)$Audj?S4_l)8b+)s79N1g9E7L)$g>o4B^>e;^ojql%$J=u%nXy5va
zqrW)%S8!uY2856dsKL6F_kgw(_kcVaKfw3_#t$gvY`)GlF}b&4Nbb#`b??>xUh&;4
zzI*k%SHFAba{=Xf?*{t$<z9K-EAD&6eV;ntcO}JnpFHm~{yyXH+a8jEwPG^R`~w@a
zIrSSjjKevTvsgj#4>aFE^9`yQl0o_p(tl7(ns-n)ihq#!2N^%e_(9?sw2HgACnooc
z<9>PH@BaM-T*$>-%XQquLos=vT}U3di9<M)BPfmsmT)OoQ(YcdPx(HunOkBqxJ5_?
zXLB^i^Es-|VB-cGH(39{`VZd5YVM@C1|Ow;9eg$<L(*b0q%HgNKHkSc98B{L8OtIT
zb0)<#WEsmS-yz}{V!j7!#pJ<el<$KBIFNHWkK%byJP)etgB!V>J7V%s-H<$F{f8Q|
zF^zwy4b}CbUKGbe;&>>Z1uW+Z%I6{Z3~e8hp&i(rJ*fXs^&48k87$=jT7RhZhkn8X
z6z|X&lVP<(GOP~eH>{ZY51T{%hkeTZ^!4On{T|L{M~ds=aTL$P)_K@E56|afZsryq
zr04yS5RymEqr4vRbJ8POY)A7v(wTj!?vD&&LUBAIjz`4th`1k7-$&L^-5%M<ce$0H
z@Cc7n9>dK${2Hpq@Lcw0ACBS^RKMYcTtamizL)!Wn8#u=LYyONusN@!`9@^3E!A~|
z_(lw-c}B>4gnUPcZ-hFIIKfjC$H>|t8EHR9cA+@@;w<s|w!|;Ul9B2&QXV7Uj>)6q
zdsN<!uI4(r{%AFKa!*W>x*<u@*@7+ElfAf^mE6W1lt*%e)*n?XCZqHpCGJsq?8Z@i
zf=ejxQO1ule$@L^$5CfP@|batS?@9HJ=U0w*@fbNOumoF_pzCrMR7hR{>QBUnDrmC
z{$u-M^0;*$Z$slAH}3K7?7?9iPIY*^kR>$F<K<kzce$0mUw^!syD9(2#q~sum^{&p
zSF$zD|Aaa`(Tk%wmMgi2o4JMR_k?&xw-3qa4z$kbRji_QM!P@S{G<2t0KenOm^|4q
zBu_SGTejmM4(8)jzbDoA$ult-GbAKqhBBW8oXOc#-!Wwr$CyfPr}~V|3(44ST+4Ml
z%NUb!>N8Fr<E%5zeB<Qf?=>ak=5QYMAE*DgO;qpkHA6DK7Og*Ce}CSZj9<XL+{eQ_
z7Ly73P0(*bGiK5{6Ra~~1QRagVlHDD*K-4Ra}SU5L`){u4~aidO(tfs2dz8Ny8b*h
z@#m?@MDt8E&%{$ymwf&5vnk(v`R4a#9~zf$T)uJn#^slA2EC{A)h*vV`R2)&XTCi1
z{oXBq2lw(&OeTqAk~k*W_et`YG>C(_nU&OU(!Q8XZXc4#?oW1qvip<Y;2W&sPxp_9
zq@YGj3hL5)1<jbrQG9|EIg!g)#tLraHdb>#55#1Ob*6Nnc&1oyiuI;gZ^|&L@02;5
z$9K7v#!WHKpTj0ojhkA|RXokpJj)o9X>CI?tsU2M1FN`&;+}RQCWZF3uogSAGp$=V
zl=&>6afQYeinnl2Op2O>q$q>tEi!LW9=mZjKaI)sh9Q~Wn624{GdYVZDZc6ApT3nx
zd5oucCMHjXkUUj`^_foNpEBN`t0qq+ETVay+R0rpdB(iYXg?$GXIAha55;7L^=DXr
zMhmv2^DtvJmvAXpa}DJ+LtZoX^QUpgc_Jn=8---1@iW`99lNkUN3oFBo4JacSxNEC
zRF|1w@kmU5SvMrVOk)<aS;85#-Y>29%fr;~SMP@8S6iw5t1n|Rt8YkVS!Y%ei@A`C
zxs2AEW&AATXKmu!tfKL=)Nz(NmRhIOI;G|-HUG1nLh@`E_GTZJ@>y1JBaM63xaZCf
z$#d%doVcI6gyMKk9MAoVv$%}QxsxAqFaMAB?YSRfGCPE1w(+yoZMM429>ND{{A}yZ
zUQ5r*?Ct!3yZKQ}=F|?!oQvq^v^nZE=PAm2&Ky3^`TRBQ+nkpu-#PElKF{&>|M`nU
z@_Zf2^ZCw{|MO4N_p8sV&+~q7`TU8P%xxBuxxPP`tKVGx=K8s4uKeZ><HPj(@VN=6
zv5@AOYo58{m@AICzoGo+%44oP=BnS^KhZjKtut3W=BmeB`#)FR=l+N4I#+$>s?WUo
zA(@xXJK2j<IF&`5&Y4u_dB5j6%5R?h=4XXu{xxh*KR?gEmECwd@1XshufFqNW*Lw3
zo0$Ci>X7`pC0j9@_T$$>>G%J?9?s3IjL8c<L-K-oUU-0mDV`V9|Apr`n@9O|OcvA)
z$%0Gh{sQqXc%NJ8eY#*rOcsiJp}1eXFeES5;-$Qlt(imlz4%Mo&lm0Ii+`f}z4#CA
z;>Yy-yttR@_@aG#@nlRET^y1{b=ZVWDgQ<CUnK5D;$CFG7TK>w&ds73e1QwNlCRNz
zEwW#W?AIdeE!xJv)4GeSyU4nW{>kt7-<T|}8Ir{pP~3~fy?8F?aUmB|ofoU~;!kMY
zV*9k%J}qe$k|mk!$eY-kcX1rY(|#`z=aMCSiL1GW&d(C(XNhyY#JOG~z9r&YvXdWj
zKmX0|sUAyC^Gr-$66Z_ee5nPm;s}o91Wu&7ykxzXX7ZP`pD)?Zm(=Ga^?9kBuf*gx
z4MOspbY8)qGmF<yoqwawzj>9fQM|wTT}+nN3(3+n{(@JsEw7_|m&$jkIF^cI=@^cs
z`YyGvOHc8Km@HGLWj|wg-p0Gxhokry)pwctF8e*#QGJ%F&$5I3JSNM<xm=x>yT9E1
z<-7S2zv2;|3(3pp#pLDMyomLADeq)2{*{&7#=ld2Usm5T^(u3&%YH@AVcA^Hi%EI&
zkd(`_+&-48Yq@h$?wpicr#!~wm3kq0C5?|Vp?!PBzP;iczv3LfqTeg}z3LplT8HL)
zRh?hW=cJgdP>&VrvBLEguCKV3Z7ALq;$2a}KgDEa&5*3TfcmY}Z)Fy<na5kG{wvjg
z<sZ2rCa*cauQ|W3wdW1Ihy6K*V`K8$h9UXwWxSppIDq%^InIvBst}S@=dlH^;s}n6
z$?8W!vU)gQ=bD)O&iLQ8<IT+FXg*2j=65TYVl_XZ=jC;Iye^N|d-4vd_v`BY`ak$l
zOxDP6jr`X9maFLetZ{zUy1v%+wdH(;m9&p<sQVl0{>Gd9b4-5!P)L41G$!lp%R2kA
zPQ2^HyKVyQ-@3^xh{<|&S+6eZ|HXa$j{l9xAMD2;?8hI}?+@zthuhhMrF@q1`h&dw
z*fAu3yoty8O-weZ|Asy>sgQq#{3|}=ftdVhWk~+?8o%O^m~6Z}BpWk$E4$IT+vwbF
zvhSPh`=&1J8k0ZY9g;uy<3WBNleg6EEp>a#{BN26E$8vA@f6ov;(F_4mQj3fiSI4r
z-ZJhlLqhVG2RVn&)BEQyOJnj^`~TO=*n{%>>nJ|Pe5%i1#r0S3k4p8eRNu;Pc_JqM
z{zX!i$+qmw0aVwj5-y;8t5$I{E9rTt`jlrGWAaW`NZyg>J5y->cf|G1JlfZH#QlzO
z?`+|29*fD}>WAcS=`q<NzAaBs-dn7<Wg(Z+xGl!Ln-`LIyRj#GaS(@dHP>)Ecf{nq
z5R&(5u!0+@PVXIx$@>jM@_u7>p?Tgn&-><izlg<L#xffBzH#rr%dPx`Cu6cz-dp9p
z)%C5eZ#C~$^KLywd2eeUl5HI*&TTzd$}QX*lD}K`@6Bl4zxSrP{C!DCQtFiINOev9
z)E0kgH}}x|Df6d}hNSw+m{jXm-I>EUgX&s6kK(G9e{~hDSG|qZG*9)XG1=ZEB-=A6
z-|h0<K8S;<&fC>_yEwNmrM$MwYx^hk9B)6&V=?)lW=KA$!z_yT19^TR&ksg(Ec01N
z^L#Ly&gTcOax=y8f%rf8X`WLd`JWmw`JdJ_&;Kms;+X7c8<HLEIEqhj6Xm}{-FEDw
zI_x+Slbv-#vNN6PxHFUD*=gK|^7v35A6oxI>wmb7*8OlNcTqkcej1a1sM|k=a~Uh?
z`afLXC7xa4+2#H&_jkF!tBmTpYZd=Sb=@VNT?Z(SU1wslJA`C+8jasAj@<(|kRzCI
zG{;h&yXCpte7nuJ`(27}_dy=wS;m-rB%hD0|Iti}?<4&_+RD#p-H#6Q%b0wuULRZU
zW9xlvy^nWOy*@t9lQG%TEF^ncQe1oV+cSa*#j{5|d-7?&_RQhDn0!(*B%icl9=lP$
zPxSjlJwH*;PnK{w_fx!|Sm&R)G5P0eu3-gt#N>Z#hva`7)B68Alz-#~R#BZlZ4#1C
z#r3ImKDExL;{Q}!pRT8VpKjvYG1)7>z3%TFLUHUB@7|>>r@HO6{{PAA{|3>z{|X`b
zS31rAuOoE-U+S>0en|GsqCEF)<mQm<uMv~|S!}~Dl*j(Q?9aV4{@)FP55@QIfid~a
zJfE5WGvhwXW=9(LnQ@;P_nG)Un?(Eene{$f#xhpWx}Vv{&$h<oK--WUXvdy3?tpzc
zApZkXXg>}Ze_%HCKk!rk?Udhv-Q2^2JQS0IbwhG6jq*P@n58uCp!ytK!S&og;}7nl
zaR=q~dBc!=-k9?KT>PIK_qlPOFXUpb<vLpL^L;e#bL)M6lqX{Hg*tzseqS_WCR<Y-
zzZk~h^nJ${V=4YGcF;Uui2DoUzc?0?L+W_Q`iJt^gB7&jhrZ*<m>jMdlEbw)p9|>w
zgTt%1nUyr(Ve@^d-<SG*Y5gy)|7Cl2;3z)963(FfzLejW-bY`m%a_jMm+JDRyuLgX
zldt6Sm3+QxNO65-U%%>1<G(WgtF>Im3U1_gJQ<TC_VGwN>VHHXkM!k0j$lILk1XaU
z%I`=Ow{RP)xi=(7hsWe-KAoGRQ&>p-kLrK)r~B%E^e~U`cu2lZi^<nbsP12PXAcgd
zulrvw;Zm*-$$!-4KlRy}?*GR+|Cz~IoI`c}kN*F8iRDz+|Gdks+|C_58<Jx+VscD<
zkE!o5>m9S+G2@PvQ9X`{^O(Gj8F$RMW4pMY2dGZR)akf5j;FH)Te20i*^|9Efa-R<
zh{aq>^*+9t;ySKg$JOh&`Hq|Ko4O(SMjgHxLV0~7{%=;$xNqLzCK~t6Uha#@w|OD?
zwi`=0i~4`7|F^5Tf#(0#{NL{89vb)UPvg}4+Y>Q4Q5upHvw4;=Cf~{DJNbO)`@8Ql
z*oor*E}sQl$yGeeBQ)+i<NoXS;s0&Q_Uyne%w=EpXAx(_<onto`CfkCPhl}<QrzFG
z`}burIk`F{C&hiz_r)hGxsBpKDgKk<KNUi9%J=i9<b6usr$#WL`A?belzC1$C#TGF
zY7MKng~p%yY5aa3h{+G)_(2>$i1!Ea{xFJ9u!Q3Lp_H>Zp9?7OAH?O~B_uzX?}zVr
zl4luXa=Lj)PG3p$oHoyC@thXV=?ZS7I8GaP`V)RiahyKDqddk_G|w6HoH5Ut0UXF-
z98U9{nZa_dU=_D;J9p52o;eYdv&}+sHj^#bl6mY#^PC+{@tqalS?B5OIvRg=7Z39Y
z#c}pbOn$5xk{@fa3v;R8kJkBdFAq@vAN4<1J0$1oupt}MdguCZ94B%;)$QD7R`OlG
zOY@xD7n9gMB(VnvaVSeUkDK^5x3QW#>F3e7n|pYWhvMTQ1RtKyOtxkl=CL?Fe!lw`
z#rSv~UeET-<(=%sz8uQYEarY5i}A_tLU_`-9&=#`V`{NJ)A@_6Fy<F+;+QP$Z0*){
z!<g1-oX@g2rmgF3U2n%5*paueC+}b{_RfuCde7u6E@K%t@oiRxF?SWmG2$9CSpOm2
z!<ZpG;+O}UhcOQt_mJ!29J7S}e*Ku&Tz}2=-)gVYURxE$ydl0f@>tBD+WX>|_3rO;
z{~!<XaPu(caBduPRQqe~;~|XAjdAR)yp`Rm!q{#*;@IwaVQlxIajf{q_Hq4Q-pe7U
z!q_1kr#*?2w}r8j^)JxBpe&A^;(C$mPf=WBU+3#w%Z+@CZ`03VWB2g?ngt)0gt7n9
z-d8h>-IvbeJVER2I}^v+pRwW}dt_J`d!(4lSQ&*8#&wHv+#R&9<N7k;lO<u?lN_rp
z&T-Q?lh3vd<DTsh$60^e7H#v6zbMA>b*jSnI{V`Iy4nr2FFPE@Uv?~xZ=#){oyknL
zW;^<OYUA5i@*oez@i)5Oxj2sRyq^c+_?xw#*6*2NVf-@%ar{i}dD>N3VSLp!as1!3
ztv~*~5n=p$NgTgTJEgsyJGgUL82=%CA3lC}F7@+$_xRnLSQ*EE<oZX&as0<r$MOHm
zGco#OtuUb(GxNfP%pP%qxF&Sa?!xZu<9eUsI6<8zJfS^?W76ol12#duCXCHwIV<A?
z1)fmgdO;OqoFI=0>NsH*XYo1C=JR=B!t>U9zAp!|gq3l^+|n>%?!4%qC58#_>G%Gr
zFyVdf)Q&MuRNsj|qj)D~_K6dlYhS6|s$-bwAKp(??}^Um#M|7z&HVw|19IcUd#l1k
z=W*f)ZF%@(x8RT6;>4o*VPa8coVZZCO#8QaVd8Ix#)+%7*J)R9Bj4uRX>sCTc`U~K
zP&?#@G&W&o%s(%L{5q~*!b@16nY^CY>(`z)X?H3K`JLu*C-=pCb<P)WzUL|b*5a7o
zy)@)^cfb33ZjAZ2xqiFrz1c@U&sDxW^6#G?^6xL>ah{0z5A+TB4-DldR>u6H`VH03
ze&jpP`6cxGi2Qfzhx~VPxt`{CuJYe?{k`&#|K6&Y|GxItvY78&<!>+MOwNk=A83D|
z-wy8L?(&eodtJ=`sCCHys15Vz`p3;f{>Ob-67oOQ_Ppf(RIhL8>tFtvypVsUIOd<#
z{!#nfsE~hdEK8^z8DpGOJA_GTyo@<)OV81y8`_3RH{^0XE90b_T<=sICw1l>?%$ag
zCfzxdC1H~MC)w{wBbn3>lafqku?>5&5A{pt#Yv-9he@N>#YvCr?|e*Bw@J?Lq$zn}
z($uYS(lq_1X&1TvtI9aZd7e}m<7DS?^5s{?$(Ls_;W*CVFFB9pT*uASznT7-%%k_`
z<Zk+RD~^+UYWLF~K>Is+Q1dYPehxk!CJ*ML^~2;xTgJ)B$}l<E5GRXo@>8xCmxRg1
zWpVOMZO_-_`CPz1@{e?WCvW0g+)U?p@;hm9@;hzWfy2V&za5B^|7M-Pos5&WxW84u
z6nAhp?d#+{RblcT+Rw>f@EGmuWcxb#TYeWp!TFi7;QW$MP%FlQi?uH<js<C@p&)Hu
zEU2$t-}MGnp`gJY?hgfxwKMWUf#<p4ingKPiriR`>3-(ESkOF#f~-EVAgd%4w91SH
zt$xxxt@cxY&v}7!QP7qh=o}PuV&{@ja5Hn8hl1SPSkP-{DCo5>7ToQAU)S%^zDIk2
zwz?J!W5UsVlImKZegzB5L&3tzSg^P%6fD**-xdnWcf^8Mri6l3+UxbR{{@HnC6APZ
z0$*PWPHCUfK07QFoK1K<OmU8<I44swcm=Oxdy3of3R8NpXY(+nXD&;q-P`qn98^0@
z8I%^MJfJ;9`yo2lQ%X3CrS-#<(#9-dWt{S?>(3U)Df6`FmBlGl+A+qd-d9sYW}I3x
zgsB&3d%mV-^IBe;%iiq6k}y?#Q?J+GduyuiPo}ohZeJdz`ua7s{Z4A%xIRq1aU(a=
z^$z-V$c<Aw((^dAQz=))sh-QJx%zjfJg3TQ>Rs$p5~lX4j8pH|cFv~`9u=kz9vi2Q
zaD8NMoI27vBlpFr;`jK)soSc;)NNbi)W2*0U3)v7&#C+A98OjDsp>v8QohqdUYHgr
z-)Xgr<FwjUVcJF77ng)-7ypu_e3mP@h1>Wk5AsBuR>!zH#?@s#<D9c;*X71(>fx^y
z#A$han2++&H0E(=oaX#Yo9KE03s^EDOe;w^g~f4Nsq6DxpI;KD&F7M;Fl`B!xn9Q2
z+(Pf+X}<1F+m;okZEM3k7RPCSZyTolJvUC1|Fj+M%YWKQo@x@Noyw&9r`(VF`+m7F
zl!U@i84J~+FfGQy>$L4};q~RA@Osys!@^GNv_BMjZVKg9_(*Xq99|L%M`Xsrk=ov$
zg$WbaM-K{xqwlBtqvvra_r*ea7dnrHrF}zT>Cjl{92U;jp3ik$-z5~T&!zk8-T#B@
zm9D?b_qeqr6x!#)|IwCLq35db2)$nlzb$4Jx5mQnwB=j)1ApL;?L*;@H^jno!$RS?
zBo<wm7m6+{jz#rCD7rMpqK0hDW>ul+XRc>zXKH7S3q@J`c$_C<Q7hNISBl!OO>Qhw
zhaz8(i@LFo>w`Fyqictv(P_+Ln^^SZuu$}*b>&}Vzl)xtIutD^2}Rx`MT?#dKCx)A
z>-M>*oU6E&>QYq2cc>0U@AAElq3FHbShP)B9g6nycx5b7ha&IUq7zl2=meejqEp4O
zNF9ot`=WC^mm8;NRt10kBu?*C5~h0}PVdT_U6;@FN3=(=n7`xixQ1)ElRI<c^nY-d
z_DB4vI8Og~SeX7X_h|2N{}b+W|6EC!elEt6(IJ$Kj`8VcAw1oT&gIkFxr^qRX&+}E
zj`3IPLim+@pY7Z^_;3&h$LG%W49}gtgLktJhw))fW&vO2ia7g%j$!r%x$MjS9KxX-
z&9N-u43_h!{#D$<?cBlL+{5p9GS0pzgxTH)v!AB#yJs)tLN4V}ma&Yl^L4K0dT!)K
zzQwor7ygCzZ}uMklmFzW{6FsJetyOSG0y1~!kk{5$9deq4fOrh9Q!>-{pb9H#?3Kq
z&e!~!$9bG5X#eMY&+lpf=bUC_jB)OLA<Vrm#(DO8US5pzLkRN&Yq1vVvM$@^h52o}
zaS#V{8OvC~x4E5rxR?8Qmd3R=-ur)kpPFHQp9^>~>#!Mr##Z!yQR#CdJMeb)-~iss
z$t>VPz8L2hny=7&;-4@67dlpj7drCYj^TxOJF`1`aR`TU91B>);<)hk5EkAZ<BQjX
z@ZvQwE|Tve`7WBsiJZ!5e7ZC&dU`gixP@ow`g87kPc3?xFLNKA??s-sMc>w8GiI_i
zJF_?Ya|nlX91FRGYq*K#_j|NOevh{3+x<Mi!#oogd2Sb-GQWHm$#?O~^}^zp)7X=D
z@NV|wG#17sqe{Y(Q86wl4Pi-Xj4#RWCHcKngEjaIUd7=YPVZ}fEh4@&nchdgsa+C&
zQ#;1x#w|B)`Nh8o%P+o)<2as^S-@vFga6C_<M%unm#5tsmZ$aNLmbKxe2m-p_qe=)
zc^jCwVQE<2@LB$iTWEYk<GZ@w)%{yrh2^(q^LF;&Ae!&im3)og@xO6-LG7@-Af3&a
z$(dZmwOq$4Zsl>F;8~h~nsw~+a?kN{&+&3!PnR#FIxkn}m%D`Uau@btAI>=&UiQG0
zWrR?cLC<BG=d#RmTJ~9t<>|dcdHP+vhyA&epT_cr^+S2Xbhc$XKEoNYyiuo6-l#M6
zZ=`>tg?y2l`4{fzzxf3Z@jIT3<xMXR<xMYPLte(eaZ4<}A}f?%aShFL#bUaC#a0@B
zh4F9i3qCwc@m7XVUU?oz@iC6!*jS$G63SD#G*4<NS91+_)3~E|hw`I+V)^NMq5QPG
zPB&pw4&c3ffP?uc&3n3>ukdx6=k&+iLvft`G5Yp6yfP)mSG*Tr@m_po2ff!`In^+{
za_Ta+Vm1fxUJl`d9L@18<+JhCnm2}5Yj$8Me`>Gh@Ay8qGR10s!9(#?U+-V_ecG#!
z@v#_JIPWW*_Z9wq<O=^ja>WhWH>9xzyKxX_vz+U=nUy@w6LCe?o5PB(xg5{&{3ACo
z#cF=cJ#oc!^G>%;$rWKmNhX)@B_8G1JV*EE>Nl6Z?^*E&dhf6B-e0ku+qth<Sh4SC
zY|fvvh|~E7-=OvPS%2Rr{3rj#eR0KsUxXD0u4ERk;hpRkR~$6&!5CM1U$1Om9A6t=
zGx)F-v*T+cwMSmSTiK1bvj?ZKkn{O#zRoq=$q)G*{~LchHiX}fjd9iN5LS7AuCm{&
z?Dwj@--T6sPsY{dA*?Qs@pXB=F3&Z!Ls*kW@2fR!*q1};`;j%p+{t}0uI*P9*7l2W
zo&8(qxm<SzGwJ)Yb**_Vja%pY?sbpy@shCaagLoI){R}qO?*49d%^vsuD?7itb2KQ
zTqmA&>$KM|3+vXGaXmM1Gb`h|Kf3=%_cxV<b(^&RtX&ynMeh(Q`fvb!U9A|z!F;G=
zsCX!s!#I{xSR5;cmV}C8_n+o7^xm$R$A$Gn#lps1!ZLnB*I(4{MeRl9p<+>GtXQJI
zI4k}*E>!%nfK}Aq<of2~Sn-#Iq2e!#W5u?!p`zM#b*uQ0|JWTW{;`MqslD5EKet!>
zOM4%`)c$fP=W{`<IFc7Cj%XjT&XI}n&HD4hoAnp7iu>Z5-s^8RD2{J7-W1+!T*+<R
z5#Ma?dYc&EY&$Hx+1CB*wEdj;=Jn&K-A=om`#17N?Hj-2$@peh?XIrd_cw=d7#DLn
zm$N)CyjeapzWIA?`M<f1J9xAtym^%VyzkAgGvk~8as3#N^Q7zN==;z&W0&w|%#FT1
z3mbdHxbg1tu<`Cytl-ADvESOTvEMps_tUnY8}HR`a7oxWcm_*Z7B>!Y-TB&B!q>T$
z;@S8n-^`2~?Zd_x<K`J9Ve^a_tJ<v%Rqfv3W^RsE9j*;k9on!vd&H_ow}+}ncf_iq
z-vpmnHK!z0&6&+*+!L$jYx~Bh>b>#7CsrN)MW{M_C0nyid}mw;?~IG_odOnQ#`o8a
z2=A{;;?~_a1)rD-BSI>S<TMs?JvYQujgpY6@pMepWX&?3WsIo{c81gipT^XM7lzb@
zwRkJLu_y1~K;F+Ge2@tfj^=2N;aE=K1X}OHN~TyHQ?*0z;rYCPby=59*o1fSE{dzR
zxN28%M@(JRJoxYzypnBs9oz9n-o(x^b#Y!uUEGJ`SR7Mz&kL!#=kroFpgijK<N)5w
zVI0OsIGm63agL=t>gF>)rs|ou-YvY1xA6}4=H0Yjy+Itrhxsr^@iD4Py(ekDdgiOA
zF7+mIG7DJ5=`5yr>pe~TQg0SZ`66HBVlL)#s!P4!aXmNj&$Ms#KIBLIh@WyV|HXa$
zHxKX-5Ag_(@q2#HGdvSh4efWsTiJ*5YG}V3KEQ`Kl;Uq_UmH&1Bu?QJPN(=UvoDwB
zat3GedCuhmF61KqhRe7trW&0JsYWrTGMs}9=OCjV>#>y2##D>Xf=^6c9YX5r8m!GU
zTIXu_{eLJ@{y!9{t6$&(s@K)#z4~RAaV1~pdj5gxb+z@fYKByn^OseN&UscE&6}m}
zS?Zo;-mE#C$6r(2S&O)o=J)@tNM)Jd{|MM8rmhj!H5aiCFJTEw_zY)o3H86GidB4<
zo`-9WQ#{$dLn>Rnv*%O4*7ZZGbtc=g9lNm`@8q3y&RRQXt(}+F&P(f={3X?)wL0Xe
zSB`U^Bd;9uTx-5-o&Rea@-jAOF2#ARIIrE$V=>j{o{(zOpTjtoPw^@0*G9iK@@XTV
z_CF7)_P<~owxK$;pBGa%sM`(dc7yf}+Ba2&)J;3Mo8Buo9S^BaA*MQcJ~}<Yahyo+
zr%r`2)j5Pz=kut4=RG{iqcpDb@tEq;Hl(_Ap!m9Y?{qP~OEKl&r7Whpb`PnpJ*b{t
z`*08kvykTR>N)GG|INnTY~7okznjl8GR9PH-;l~3%5qlH{oFJBkw3=NE#kYyKHp;f
zTgJxJt*b-o)-^HJ&Gl~1=WR7Z>Ne-;w))JBDL;RvZvRRBZ`c3!Dym11<{{OiO-%L7
z3aOqyY2BXI?J2IF#W8h9Nl4wH&UYMVjHx@FuRGJ&f-TsJt=OLJY5bkW-+7Mu`@MFm
z*FJi$_tNgo-n>h{y9ROyhsM<1=DpjzefEb`pF@;yANlqbXWtz$)h~opKY8_A&&rtU
zZ=L~{#?*jDY{VwajH!FAckjNKy6=bJL;dcHF*VS71Bb@cpynYp=*pP7-+K33@BU#N
z&e0sp0v7NvkHypj^+W0b^FDADucH1B6!RUv!*}^EKi~)4PvZuMkQyxB!TS4sacZ!*
z2UpU4-<PF^Sbs<w+cKBp^!-NaK|aWbJYNraz8>nwejLJ~F*WpfNDVz1Q^U+Z&Hhen
z&X&xh`+l*TnpVu2^xi8R7E*=Q_wU70h0a}3{g5ikh^gsM1Rp+0Ul*nuH{H1D>sc97
z#pW+Ie{o%AGK;y?uegj=+(FMrag3>_cLtxBdd9eC^na!$#r4d7x<8|SNX=->w#=pe
zGxo*QFPn$dFWbb_uQ~-EmT(^3|CRft`j_fo+LL#%FV&;e{nBG}PD-7VXMH_+_E1du
z_erTaWij=9c}P898B=rXht%B6n40H#m?xik+ViY8uOrPnZv@q0zI~j(HKtxL?uB*S
z#J9Ma=6S*W7k0$dg83n}pe&{qihH4X7Ur=yre4&3(R?o&|Dygc?q`gtMb=xS-y-WR
z>dY#dXOa7hosY%dUyFav5|+i(lJz0A#Q2v&NcqJ{>Lp(nUK009ZJ8TW%Z*>YFQ#5D
z52=^+d-+>_8&l=-E}zF`ETehK-G9~l`qggi#a=PB(!49vIE=+H^_qUK>G#@B?&C3j
z!xKEg|MI`|b@{azQ@`CGQorTuz9F^R`+0Q<t?LJ=)N1p*uKju$KcRkWxMm+cPiqd-
z*ZVa`Vrp#&skQQ3E5Eh!dqevT?KgbC_r`_ve7qsfH^$NX@s0g7-|zE6>i2zE#NwD*
z@A`VzH<X9ehIKqn?TV6+swktpD)z+GpUn5CI&8*Fn)gq|G4*Eikn)2<>dh+di>bea
zkorq5`*J9qgTGY9RHf^czFt&zr|VVPJ7TO3HA8i%#fw>o4cLH9*o3W^%^bF2KlbMX
z9L!;Sn4>tB6F8C6IE^JN;WM1YXZbAWaxUj{K40JqT*!r7#3lR#|G@p+AFIz3?|I@q
zPn_q8^SsNM!CTmkx3dR(^Dc_>ya)I&6OQI+{>XE&`ux05eZKzZ-@!XLjs<**#hk-A
z6wmpKxP;4D&Q+}7pZG4{<A?l^A9D{s;{kro&v}$z$Lbp0gAaSsx;1*S7yEJ`hjBO`
z<6{(8jVUZ-A!l(GXLB~^abB#hIWtt({1q2-DSyv(6lcu}zQwor0YBhQ?&1N8)9-nz
z{hp`#0(HLN0@mV1tV8GHg3H*5t=XE_(z&>xJ#S(ccBON0fpc)dWKQN3ivNPOTubp>
z@FxFE@m#Q(f8`c#q5AoAgz5|am!HP!3ugo$ma>%3QQj9iM;AIr7uuf-7jrr7&xK_y
zqjPiNF`nWNvAWjN!H34zGQQRVE}-$XjIZ@FUuG5G;WloI)wM(LVQtoCV>YJqR{M6|
z!+Uri2XZh6a}39FBGsezZ|U6B{vChEH~0oOaTD!N?YH??R`ES<Wi_kmeAV8=fAXK)
z%e}GsqUOPeEqE1gqW!oim$~$OTyzV?dr?n1Zx?w!E*i#>98J%~Me@H${(gV$!;b98
zJK2i^IEX_zl+!sqR@X6a9d)SFn|-Jrb=0Gd{&m!&&Il%al239HCvh6RC+c|K>O4jJ
zTgSfCd7ks=oYdJ!=d_M<TDN}iVLH><giR>ly7H|n&$_o#Jav0;Agy25`gP@5H=#J{
zI-hkXa5A0Gy53K9pP~0t-DmkO)xGX6{<Q9=bPnr!p6h<b<2(_oFKG~bD2_|Saf#>R
zk{k}={TxDdy2L(TVxKSB&wtbNc8TZhk}vsXtgdH#y$t@GKW9g(d%do_nWH$0;`VcI
zwV!)^_$psz6`hxQf1~H8-pBlyhj@tJ^ZQtx7D9De8XK|^)hA7yY2GvbyrDX691Ex(
zX`Z*V7x^N+Ptq2189i5N-YaRpr##Z+k#?Bh&^l?>sef_sVO?HA`&Pd(GbqpcSMzFK
z$9C+*PIO-DJFoSB$zSpn%CElXqQ2*%{y`q(fA}BThx*6)U;Z~%UwVG<p?$g3zFgXj
z&DfGHsjio*>!r@~rOxxE_UTgjU+UalTFRAN$+u~}OFf5|R#F`=RmV&1*QNIB(o_6_
zkug>`ux^8zti@W)WG1ho=dnRsUdQ%q&z`h?gTCxX`_RBSZQz_Xa84W8j|TRm!4rIf
z-Xjgh@M%6x@52V_(_lV*{cP|OU*cA7<xcLT^V`7rZLo)XVs-j?!H4RTu0H8a=-j4X
z!7JFD>Xd#Buc7mtel6`!y8TJ-LhtwVJm#@GeH}}ePrCO?`bdgDeJs8A(#4tX9HraO
zbn&K(H(k8x3%G#JSGx0+?p&oW<9e>=AGv|@NS8;teNR{aboEbH|MYM9E$u_PeMq+t
z>Gq-FrNM_;6n{hUH}rMNpCkFu^VCrM4R7Hs^nPl1FYl*w(C~4pcf*OCNbjkJ1@xY3
z=snfYd#YhEXVLqq;UX^L7yN>Ud6-9eG*(~cdArPcysS2B({pi|=i)N;zfAov`#FC>
z^}bBJmx=c>@m{8`m#OPz_wXJL<8T(Sh^2g%zvi#`Km4Cq-N=46vY(Bd`$j*bbJ)l^
zY-GMh=4;fOy?Hn9ru-WXp!3(r`D-+ULphw*Yos2H9;f^p71Dk-vY(Asa0P$M-|}_7
zPW#trBfW<j{f+ji(FuA!8+k7@I?Eqpbz^mD9N30!XkQxV@($j?dud-9i>I-88b88E
z=y_;te;SYDI6lK?IET-3E!Xl*zDe(m#-8KGRrG#r{2t%ucJAPQ?&oK8z8e2P=c(}-
zo{7~>E(t!gUrp>+6YsAk8O&xjJJS24iRYt<=c7qCcH^DAlYQv<Zlcaj?&AY|fS!*g
z;`je4_M!SVQQs!^vx)s|vV@-JCd;{;ukaPF;ws9kiM*P4-kWS?iYe~qNBk%M$xrzy
zzvFkYx@mf-_UE6~O|PZrx~b=)X$R)f^U!oK2h;vH9YOow)c!ZM?@jG{Q|G?vEI!BQ
z=s9lcId1Cx({w3UawVOMrp`sv-*X)+SV8;J)V?&WWF^JlbQ{Irw3<7)kDv2%9^p|s
zM@>ENm)8wG`~^KXm;3s0`St9;o7jb2==r`}K9@W9mpk{D_hxVQWnT`UbAS26eE9z>
zxck^Dt1|%LXKc*PsC0>nw)fk_`NxbiPW#?X+eTf+7L*DR7~)DonW#gVP7zUiaiT6W
z6BjkiAuV$%!Uk-aQ%0aw@dJ+tUK$bFa=Xn0#+CqciU@l4^N*Wf&VA3l_dMr3&+`&q
z0)NcwsP3DcNAqGX=EGddNBJ0^;1gWIUasb9y1zHOzc;VvdT!tbimO>%&2`rKF5l%|
z?xp-|mVeFf^L^?c&H6`62wpsqCvqH{cq&ij=^W2<cn;6yxxA1UQv5BK@+!)|mg$^M
zakl)J^Ei+CTgz=+$VI%Hck>N8mlo@9d6W8X%fEP-hxrLVNik=AIqS<gmz;CSm3bD`
zNA4TEh!;_v<kU${edm5a=aF+Bxv5kaIqS<=Uv56<Q@-WoTTY+LJ;;an5Y<OcedM0z
z(|nGr`DeOc<m`LSzUMY_Be!r1)pzcnJjjD7=EnpteuZD9I?tcN9Q}DAuRikXBVVPw
z%Ii=0OW4kKewW{+c=GyH-ahB;bAATZcfN~V>}EHwqx{N?FE76Q9kk#1zf!-<TW{Wa
z^P9Mt+qjMLCNFRDySbbHq&V{XxR1^ye}EtJV}8bzVxcL-!q<2v&twZ*m}j1sQhpSy
zyI|b~{l74c`cmO$F62TkqIDLQaT%A>eY)^F{*Hg7yf3VyIxmQ$AP)bI!i&~ju<pVz
zhbiw1^1iU2@~NP{3;*UJ9_B~<i1Mp&EXCrvAr_rO@qC`o3wQzLRZ-t6I)|cjC{Ex6
zcCwT1AH}PwzKiO+cs+06Pblw;ckwQYqbQD|K2==HKk-j|p3hS}Me!7!OK}t5;#(9?
zQ9MQQ6dU|I|4x0YsBaaWNAV~><)<l@)NM)KmcB`GlrpM^(#5=(ZET}{RT580eUv8B
z`IN4repM1rNnVxYRY@I})Nx5%rR#Yw@8uFMp?WDjMCVp=Zl%9b9Hjxe50=zLNnMm8
z<ymQvgDIB36ufu>$MH0t#%4CN#1hp(xr3MSa;k%}Iw()#B+C1;yf5F$JGq$pX<1#D
z)phw1KEmZ(&K2yXb0|B9@&<0;8`Ou&`cT=vm*3`gzRO+IKg<81Iw;Gh@(1+ijk5eH
z>rWN&RK!yeM@1YJbx>*H*ZFlikBalC$ft@vRdFtrD#cZ~jPk4EJSxtk;yfxdIg>X~
zK2?6opVED>;yze;oR8DKSAN5llwTEjRI&dR`(JsT@~9$?iaMz5r~I!RqWfIMeXjB$
zKjbkUOR;rKh^^vi)o)u*q<+<UGEe8}EU>_9c`fH~4(IVE{*1SA0T-}F=h6CWT6e2;
zwaSZDdC|IsdpN`qj?g~0j;5G>A$ZZgX4aFP#FKai&*0fSo9FNx>Z6(Z&FpigUbD+-
zKeNfan({f5&)H41&P?CQ7Sg_DEBPFs;~%KcWcp0DjxX>9%9Bi<WcD|+znM5Pab&OY
zHE!ir?w~%J$(!t5zQ^~dpJwk<Kh2y&<{UETkR9i7e#XyItd0$_`ell@YTv6l<|vP<
z@~A4#syM6P=C^qXFX5%Ul=7(hJ*tzcI;qa!3_7Q(bE-P0>O3yuB0k9{DgUeTzbgN$
zZ&LnO-{xNGqgCfpJ;;xEghzRlpE9M`CU4rtP~EkuyS88Qm$bia_P6a-zRLHxj|X^w
zzOU`06esqDIPod2;u_k=iSlBieVXX^uJ}ucS2%|&zZv3{?NrZKs^du^#7W~=;&~}{
z%9qZuH17O-TxFGuDGxjEqt9LCb61_fCKmZW`kl$%pDgbtdw=qH&SwutDgG(0Px&Ih
zLccpj9ZzYe>r-5x>iSgkr|Jt+^@XX<)pNDzd0L!q-t+-BQuJIcdaf3K*v;#>giH7!
z?b{ERa%qY)%$s4}j2eCJ8sBq`@A14WdR`W<xr03^`gbmIrghEyGUd<AKK7@0t@nRa
zOtFhy;_aG6?{~eyog8IKakk%?ZQkrocBR-|3bDJD@~m5)bzjVjsULT@)4c8;4sd&l
zbIqT7UW(Vx3i0~h6mJY6-st*GeIee|&mC-VKb`w6K7UIW?fWhE{q}(nZ+HFn!#vE7
zc`U^RXN0)mESkSy3a_SmUZ5W?NGUF|zD3qoD}`8V=PdScl=5t`xE9;LdtJZR_4{}q
z?>`jc{eJfW^B*w(fj+KF@mE8^i=#{_E_HpW>yLyGA1S8zC?B<sN2hXHijU0<@v*KH
zmvw}=>~m}EP0@3y=($u}J`m#al;Vn}5Lb*(vF}?U_O)^@Z>GHLlb3zw^)*sl>2oW6
zZl%7n@&$T-rT3rd3-Ou$6ra@(o-L-h%Dh!vE&kQtNpX$w8lPLUgF86NgDI|64{P<$
zwen)E^ItoQJt?lMg}APl10k;ON^$)vivLCX{G#!OO~EV0jeQ|*>`&42p14U}Z1O#u
ze9xx&yp=w`slh}1AjQqILfkB_&HBS;{lW8~*sm}2kEOcocfarV`Tiyr*})#l|9<)3
zzm&ZxdTta4Tz_da#FtWvFU#|n&3ncCSGwr;Us=Ffh+D>`xW&F~F@NjxA#VL^ivC}r
z_@?-`nZM2aZRTxDDQ-93&K;!?ceJPY&S;457!QUJ2Yt_AC%aPIB~N$x{O;d}xck`@
z8`j$xpWgabfAC86F(K5)6jOaH$9`_ccGlRN>L(bVV0@D6C#O_Dr6bf&>EirQAJ?Di
zO>;xN=|-C0WbE&6>ZhAGz7*>IexiP+@p;A<@Iqz-p`JBTeS-0o#*;cieNqocX{>M6
zr*PVYP@ndF-ojg1V}Gh|7zp(Zt`E!#^?{zWvm=C^-%Dv{C$Hm!d^V*)?+<qLq`}3t
zFt|9SJt2fWMP{7M?&)DqH|HA9qwn3bp}|8ulJ+>aJ@$9cAs*pT9!+V;x`!svI)^56
zN-Ydo@6e3P!_bULX{hG?UgP(8kpHF656>A0!*e)4gyCDMzJ{0a3FF^##i1~~;)68Y
zXY6-}_i<l4&D&?ZzatFq?@7Z4ynn#h_YQx+BM*k*BM+zHkByI~G$PKClls%h$sA{V
zCl|3+3nM@0lF=}-g!XCV7yJWXpm;}K-=0QZcip=8HifWPKizvb@8&(Vu=gI;j2~tn
zpW-SuXrK1lpGF9w;ddLS@-()*7#b}bQzO44H1a!noZjzn{WjiF3ynLtkPErUJm=L|
z>bmc5JVWQ%7~o5MjjwYnBX@8YhdIK=`p{@>PYvs795X&%3l00y_{=!<q(=G=57Ii)
Gr|JKUJu>Y8

literal 0
HcmV?d00001

diff --git a/plane-core/src/mobile_config.rs b/plane-core/src/mobile_config.rs
index c4903da..4ef5fe4 100644
--- a/plane-core/src/mobile_config.rs
+++ b/plane-core/src/mobile_config.rs
@@ -46,6 +46,8 @@ pub struct RemoteNode {
 pub struct RoutingConfig {
     #[serde(default = "default_route_action", alias = "defaultAction")]
     pub default_action: String,
+    #[serde(default = "default_cn_direct", alias = "cnDirect")]
+    pub cn_direct: bool,
     #[serde(default)]
     pub rules: Vec<RuleConfig>,
 }
@@ -88,6 +90,10 @@ fn default_route_action() -> String {
     "proxy".to_string()
 }
 
+fn default_cn_direct() -> bool {
+    true
+}
+
 impl Default for AndroidConfig {
     fn default() -> Self {
         Self {
@@ -108,6 +114,7 @@ impl Default for RoutingConfig {
     fn default() -> Self {
         Self {
             default_action: default_route_action(),
+            cn_direct: default_cn_direct(),
             rules: Vec::new(),
         }
     }
@@ -170,7 +177,15 @@ impl AndroidConfig {
     }
 
     pub fn normalized_routing(&self) -> RoutingConfig {
-        if !self.routing.rules.is_empty() {
+        let routing_is_custom = self.routing.default_action != default_route_action()
+            || !self.routing.cn_direct
+            || !self.routing.rules.is_empty();
+        let legacy_route_is_custom = self.route.default_route != default_route_action()
+            || !self.route.direct_list.is_empty()
+            || !self.route.proxy_list.is_empty();
+
+        // New Android configs use `routing`; only untouched defaults may fall back to `route`.
+        if routing_is_custom || !legacy_route_is_custom {
             return self.routing.clone();
         }
 
@@ -196,6 +211,7 @@ impl AndroidConfig {
 
         RoutingConfig {
             default_action: self.route.default_route.clone(),
+            cn_direct: true,
             rules,
         }
     }
@@ -209,9 +225,19 @@ mod tests {
     fn empty_json_uses_defaults() {
         let c = AndroidConfig::from_json("").unwrap();
         assert_eq!(c.mtu, 1500);
+        assert!(c.routing.cn_direct);
         assert!(!c.outbound_ready());
     }
 
+    #[test]
+    fn smart_cn_routing_can_be_disabled_explicitly() {
+        let c = AndroidConfig::from_json(
+            r#"{"routing":{"default_action":"proxy","cn_direct":false,"rules":[]}}"#,
+        )
+        .unwrap();
+        assert!(!c.normalized_routing().cn_direct);
+    }
+
     #[test]
     fn legacy_single_node_still_works() {
         let c = AndroidConfig::from_json(
diff --git a/plane-core/src/routing.rs b/plane-core/src/routing.rs
index d6db256..95759ac 100644
--- a/plane-core/src/routing.rs
+++ b/plane-core/src/routing.rs
@@ -1,4 +1,4 @@
-use std::net::IpAddr;
+use std::net::{IpAddr, Ipv4Addr};
 
 use ipnet::IpNet;
 
@@ -34,9 +34,99 @@ trait Rule: Send + Sync {
 
 pub struct Router {
     rules: Vec<Box<dyn Rule>>,
+    cn_direct: bool,
     default_action: RouteAction,
 }
 
+const CN_IPV4_RANGES: &[u8] = include_bytes!("../data/cn_ipv4_ranges.bin");
+
+const CN_DOMAIN_SUFFIXES: &[&str] = &[
+    "126.com",
+    "163.com",
+    "360.cn",
+    "58.com",
+    "aaplimg.com",
+    "alibaba.com",
+    "alicdn.com",
+    "alipay.com",
+    "aliyun.com",
+    "aliyuncs.com",
+    "amap.com",
+    "apple.com",
+    "autonavi.com",
+    "autonavidata.com",
+    "baidu.com",
+    "bdstatic.com",
+    "bcebos.com",
+    "bilibili.com",
+    "bilivideo.com",
+    "bosszhipin.com",
+    "bytedance.com",
+    "byteimg.com",
+    "cdn-apple.com",
+    "chaoxing.com",
+    "coding.net",
+    "csdn.net",
+    "ctrip.com",
+    "dianping.com",
+    "didi.cn",
+    "dingtalk.com",
+    "douyin.com",
+    "ele.me",
+    "feishu.cn",
+    "gitee.com",
+    "gtimg.cn",
+    "hdslb.com",
+    "heytap.com",
+    "hicloud.com",
+    "honor.com",
+    "huawei.com",
+    "icloud.com",
+    "idqqimg.com",
+    "jd.com",
+    "jdcloud.com",
+    "jianshu.com",
+    "kingsoft.com",
+    "ks-cdn.com",
+    "ksyun.com",
+    "kuaishou.com",
+    "meituan.com",
+    "meituan.net",
+    "mi.com",
+    "micloud.xiaomi.net",
+    "miui.com",
+    "myqcloud.com",
+    "neixin.cn",
+    "oppo.com",
+    "pinduoduo.com",
+    "pstatp.com",
+    "qpic.cn",
+    "qq.com",
+    "qunar.com",
+    "sankuai.com",
+    "sankuai.info",
+    "sina.com",
+    "sina.com.cn",
+    "sinaimg.cn",
+    "snssdk.com",
+    "so.com",
+    "sogou.com",
+    "taobao.com",
+    "tencent.com",
+    "tmall.com",
+    "toutiao.com",
+    "vivo.com",
+    "vocabgo.com",
+    "wechat.com",
+    "weibo.com",
+    "xiaohongshu.com",
+    "xiaomi.com",
+    "xiaomi.net",
+    "xhscdn.com",
+    "zhihu.com",
+    "zhipin.com",
+];
+
 struct DomainPatternRule {
     pattern: String,
     action: RouteAction,
@@ -213,6 +303,7 @@ impl Router {
         );
         Ok(Self {
             rules,
+            cn_direct: config.cn_direct,
             default_action,
         })
     }
@@ -231,10 +322,85 @@ impl Router {
                 return action;
             }
         }
+        if self.cn_direct && matches_cn_route(info) {
+            tracing::debug!(
+                "route smart-cn dst={:?}:{} domain={:?} -> Direct",
+                info.dst_ip,
+                info.dst_port,
+                info.domain
+            );
+            return RouteAction::Direct;
+        }
         self.default_action.clone()
     }
 }
 
+fn matches_cn_route(info: &ConnectionInfo) -> bool {
+    if info.domain.as_deref().is_some_and(is_cn_domain) {
+        return true;
+    }
+
+    match info.dst_ip {
+        IpAddr::V4(ip) => is_local_ipv4(ip) || is_cn_ipv4(ip),
+        IpAddr::V6(_) => false,
+    }
+}
+
+fn is_cn_domain(domain: &str) -> bool {
+    let domain = domain.trim_end_matches('.').to_ascii_lowercase();
+    if domain == "cn" || domain.ends_with(".cn") {
+        return true;
+    }
+    CN_DOMAIN_SUFFIXES
+        .iter()
+        .any(|suffix| domain_matches_suffix(&domain, suffix))
+}
+
+fn domain_matches_suffix(domain: &str, suffix: &str) -> bool {
+    domain == suffix
+        || domain
+            .strip_suffix(suffix)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+}
+
+fn is_local_ipv4(ip: Ipv4Addr) -> bool {
+    let octets = ip.octets();
+    ip.is_private()
+        || ip.is_loopback()
+        || ip.is_link_local()
+        || (octets[0] == 100 && (64..=127).contains(&octets[1]))
+}
+
+fn is_cn_ipv4(ip: Ipv4Addr) -> bool {
+    debug_assert_eq!(CN_IPV4_RANGES.len() % 8, 0);
+    let needle = u32::from(ip);
+    let mut low = 0usize;
+    let mut high = CN_IPV4_RANGES.len() / 8;
+
+    while low < high {
+        let mid = low + (high - low) / 2;
+        let offset = mid * 8;
+        let start = u32::from_be_bytes(
+            CN_IPV4_RANGES[offset..offset + 4]
+                .try_into()
+                .expect("CN IPv4 start record"),
+        );
+        let end = u32::from_be_bytes(
+            CN_IPV4_RANGES[offset + 4..offset + 8]
+                .try_into()
+                .expect("CN IPv4 end record"),
+        );
+        if needle < start {
+            high = mid;
+        } else if needle > end {
+            low = mid + 1;
+        } else {
+            return true;
+        }
+    }
+    false
+}
+
 fn normalize_domain_value(value: &str) -> String {
     value
         .trim()
@@ -284,6 +450,7 @@ mod tests {
     fn direct_rule_has_priority_by_order() {
         let router = Router::from_config(&RoutingConfig {
             default_action: "proxy".to_string(),
+            cn_direct: false,
             rules: vec![
                 RuleConfig {
                     rule_type: "domain_pattern".to_string(),
@@ -308,6 +475,7 @@ mod tests {
     fn cidr_rule_matches_without_domain() {
         let router = Router::from_config(&RoutingConfig {
             default_action: "proxy".to_string(),
+            cn_direct: false,
             rules: vec![RuleConfig {
                 rule_type: "ip_cidr".to_string(),
                 value: "10.0.0.0/8".to_string(),
@@ -324,4 +492,66 @@ mod tests {
             RouteAction::Proxy
         );
     }
+
+    #[test]
+    fn smart_cn_direct_uses_domain_then_geoip() {
+        let router = Router::from_config(&RoutingConfig {
+            default_action: "proxy".to_string(),
+            cn_direct: true,
+            rules: vec![],
+        })
+        .unwrap();
+
+        assert_eq!(
+            router.route(&info(Some("api.xiaomi.com"), [198, 18, 0, 2], 443)),
+            RouteAction::Direct
+        );
+        assert_eq!(
+            router.route(&info(None, [120, 233, 23, 125], 80)),
+            RouteAction::Direct
+        );
+        assert_eq!(
+            router.route(&info(Some("www.google.com"), [198, 18, 0, 3], 443)),
+            RouteAction::Proxy
+        );
+        assert_eq!(
+            router.route(&info(None, [8, 8, 8, 8], 443)),
+            RouteAction::Proxy
+        );
+    }
+
+    #[test]
+    fn explicit_user_rule_overrides_smart_cn_direct() {
+        let router = Router::from_config(&RoutingConfig {
+            default_action: "proxy".to_string(),
+            cn_direct: true,
+            rules: vec![RuleConfig {
+                rule_type: "domain_suffix".to_string(),
+                value: "xiaomi.com".to_string(),
+                action: "proxy".to_string(),
+            }],
+        })
+        .unwrap();
+
+        assert_eq!(
+            router.route(&info(Some("api.xiaomi.com"), [198, 18, 0, 2], 443)),
+            RouteAction::Proxy
+        );
+    }
+
+    #[test]
+    fn cn_ipv4_data_is_sorted_and_well_formed() {
+        assert!(!CN_IPV4_RANGES.is_empty());
+        assert_eq!(CN_IPV4_RANGES.len() % 8, 0);
+        let mut previous_end = None;
+        for record in CN_IPV4_RANGES.chunks_exact(8) {
+            let start = u32::from_be_bytes(record[0..4].try_into().unwrap());
+            let end = u32::from_be_bytes(record[4..8].try_into().unwrap());
+            assert!(start <= end);
+            if let Some(previous) = previous_end {
+                assert!(previous < start);
+            }
+            previous_end = Some(end);
+        }
+    }
 }
diff --git a/scripts/update-cn-ip.ps1 b/scripts/update-cn-ip.ps1
new file mode 100644
index 0000000..f0cea6c
--- /dev/null
+++ b/scripts/update-cn-ip.ps1
@@ -0,0 +1,64 @@
+param(
+    [string]$SourceUrl = "https://ftp.apnic.net/stats/apnic/delegated-apnic-latest",
+    [string]$InputFile = "",
+    [string]$OutputPath = "$PSScriptRoot\..\plane-core\data\cn_ipv4_ranges.bin"
+)
+
+$ErrorActionPreference = "Stop"
+Set-StrictMode -Version Latest
+
+$downloadedFile = $null
+try {
+    $sourcePath = $InputFile
+    if ([string]::IsNullOrWhiteSpace($sourcePath)) {
+        $downloadedFile = [System.IO.Path]::GetTempFileName()
+        Invoke-WebRequest -Uri $SourceUrl -OutFile $downloadedFile
+        $sourcePath = $downloadedFile
+    }
+
+    $intervals = foreach ($line in Get-Content -LiteralPath $sourcePath) {
+        if ($line -notmatch '^apnic\|CN\|ipv4\|') {
+            continue
+        }
+
+        $parts = $line.Split('|')
+        $addressBytes = [Net.IPAddress]::Parse($parts[3]).GetAddressBytes()
+        [Array]::Reverse($addressBytes)
+        $start = [uint64][BitConverter]::ToUInt32($addressBytes, 0)
+        $count = [uint64]$parts[4]
+        [PSCustomObject]@{ Start = $start; End = $start + $count - 1 }
+    }
+
+    $merged = [System.Collections.Generic.List[object]]::new()
+    foreach ($interval in ($intervals | Sort-Object Start)) {
+        if ($merged.Count -eq 0 -or $interval.Start -gt ([uint64]$merged[$merged.Count - 1].End + 1)) {
+            $merged.Add([PSCustomObject]@{ Start = $interval.Start; End = $interval.End })
+        } elseif ($interval.End -gt $merged[$merged.Count - 1].End) {
+            $merged[$merged.Count - 1].End = $interval.End
+        }
+    }
+
+    $bytes = [byte[]]::new($merged.Count * 8)
+    $offset = 0
+    foreach ($interval in $merged) {
+        foreach ($value in @([uint64]$interval.Start, [uint64]$interval.End)) {
+            $bytes[$offset] = [byte](($value -shr 24) -band 0xff)
+            $bytes[$offset + 1] = [byte](($value -shr 16) -band 0xff)
+            $bytes[$offset + 2] = [byte](($value -shr 8) -band 0xff)
+            $bytes[$offset + 3] = [byte]($value -band 0xff)
+            $offset += 4
+        }
+    }
+
+    $absoluteOutput = [System.IO.Path]::GetFullPath($OutputPath)
+    [System.IO.Directory]::CreateDirectory([System.IO.Path]::GetDirectoryName($absoluteOutput)) | Out-Null
+    [System.IO.File]::WriteAllBytes($absoluteOutput, $bytes)
+    $sha256 = (Get-FileHash -LiteralPath $absoluteOutput -Algorithm SHA256).Hash.ToLowerInvariant()
+    Write-Host "Generated $($merged.Count) merged CN IPv4 intervals ($($bytes.Length) bytes)"
+    Write-Host "Output: $absoluteOutput"
+    Write-Host "SHA256: $sha256"
+} finally {
+    if ($downloadedFile -and (Test-Path -LiteralPath $downloadedFile)) {
+        Remove-Item -LiteralPath $downloadedFile -Force
+    }
+}

From d43383cee6940680bd098f7a00869c66c8a8ff7a Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Mon, 13 Jul 2026 20:02:57 +0800
Subject: [PATCH 11/12] android: preserve proxy stream integrity

---
 plane-core/src/outbound.rs    |  86 ++++++++++++--
 plane-core/src/proxy_proto.rs |  35 ++++--
 plane-core/src/tcp_stack.rs   | 214 +++++++++++++++++++++++++++++-----
 3 files changed, 287 insertions(+), 48 deletions(-)

diff --git a/plane-core/src/outbound.rs b/plane-core/src/outbound.rs
index 19dab72..7311419 100644
--- a/plane-core/src/outbound.rs
+++ b/plane-core/src/outbound.rs
@@ -39,7 +39,7 @@
 
 use std::net::Ipv4Addr;
 use std::sync::atomic::{AtomicI64, Ordering};
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
 
 use bytes::Bytes;
 use tokio::io::{AsyncRead, AsyncWrite};
@@ -224,7 +224,7 @@ impl InboundReassembler {
 }
 
 /// 单调递增的 requestId 生成器（对齐 Java 侧用全局自增 id 标识一次代理请求）。
-#[derive(Debug, Default)]
+#[derive(Debug)]
 pub struct RequestIdGen {
     next: AtomicI64,
 }
@@ -243,6 +243,57 @@ impl RequestIdGen {
     }
 }
 
+impl Default for RequestIdGen {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+const STREAM_SEQUENCE_MASK: u64 = 0x0000_FFFF_FFFF_FFFF;
+
+/// Generates IDs with the same 16-bit client / 48-bit sequence layout as the
+/// Java `StreamIdFactory`, keeping concurrent clients from sharing sessions.
+#[derive(Debug)]
+pub struct StreamIdGen {
+    client_id: u16,
+    next: AtomicI64,
+}
+
+impl StreamIdGen {
+    pub fn new() -> Self {
+        let mut client_id = (rand::random::<u32>() & 0xFFFF) as u16;
+        if client_id == 0 {
+            client_id = 1;
+        }
+        Self::with_client_id(client_id)
+    }
+
+    fn with_client_id(client_id: u16) -> Self {
+        assert_ne!(client_id, 0, "stream client ID must be non-zero");
+        Self {
+            client_id,
+            next: AtomicI64::new(0),
+        }
+    }
+
+    pub fn next_id(&self) -> i64 {
+        let sequence =
+            (self.next.fetch_add(1, Ordering::Relaxed) as u64 + 1) & STREAM_SEQUENCE_MASK;
+        (((self.client_id as u64) << 48) | sequence) as i64
+    }
+}
+
+impl Default for StreamIdGen {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+fn next_stream_id() -> i64 {
+    static STREAM_IDS: OnceLock<StreamIdGen> = OnceLock::new();
+    STREAM_IDS.get_or_init(StreamIdGen::new).next_id()
+}
+
 /// 出站连接 —— 一条到 proxy-remote 的 HTTP/2 连接，承载多路 stream。
 ///
 /// 通过 [`OutboundConnection::handshake`] 在「已 protect 并 connect」的 IO 流上完成 h2 握手。
@@ -315,7 +366,8 @@ impl OutboundConnection {
 
         // 首个 CONNECT 消息（加密 DATA 帧）。
         let request_id = self.req_id_gen.next_id();
-        let connect_msg = ProxyMessage::connect(request_id, host, port);
+        let stream_id = next_stream_id();
+        let connect_msg = ProxyMessage::connect(request_id, stream_id, host, port);
         let frame = encode_encrypted_frame(&self.cipher, &connect_msg)?;
         send_stream
             .send_data(Bytes::from(frame), false)
@@ -329,6 +381,7 @@ impl OutboundConnection {
 
         Ok(OutboundStream {
             request_id,
+            stream_id,
             cipher: self.cipher.clone(),
             send_stream,
             recv_stream,
@@ -348,6 +401,7 @@ impl OutboundConnection {
 /// 接收：h2 DATA 帧 → 解密 → 切包 → DATA `ProxyMessage` → 取出业务负载。
 pub struct OutboundStream {
     request_id: i64,
+    stream_id: i64,
     cipher: Cipher,
     send_stream: h2::SendStream<Bytes>,
     recv_stream: h2::RecvStream,
@@ -360,9 +414,13 @@ impl OutboundStream {
         self.request_id
     }
 
+    pub fn stream_id(&self) -> i64 {
+        self.stream_id
+    }
+
     /// 发送一段业务数据（包成 DATA 类型 ProxyMessage，加密为一个 h2 DATA 帧）。
     pub fn send_payload(&mut self, payload: &[u8]) -> Result<()> {
-        let msg = ProxyMessage::data(self.request_id, payload);
+        let msg = ProxyMessage::data(self.stream_id, payload);
         let frame = encode_encrypted_frame(&self.cipher, &msg)?;
         self.send_stream
             .send_data(Bytes::from(frame), false)
@@ -372,7 +430,7 @@ impl OutboundStream {
 
     /// 发送 DISCONNECT 并以 end_stream 关闭发送侧。
     pub fn send_disconnect(&mut self) -> Result<()> {
-        let msg = ProxyMessage::disconnect(self.request_id);
+        let msg = ProxyMessage::disconnect(self.request_id, self.stream_id);
         let frame = encode_encrypted_frame(&self.cipher, &msg)?;
         self.send_stream
             .send_data(Bytes::from(frame), true)
@@ -506,10 +564,22 @@ mod tests {
         assert!(a < b && b < c);
     }
 
+    #[test]
+    fn stream_id_gen_matches_java_layout() {
+        let g = StreamIdGen::with_client_id(0x1234);
+        let first = g.next_id() as u64;
+        let second = g.next_id() as u64;
+
+        assert_eq!(first >> 48, 0x1234);
+        assert_eq!(first & STREAM_SEQUENCE_MASK, 1);
+        assert_eq!(second & STREAM_SEQUENCE_MASK, 2);
+        assert_ne!(first, second);
+    }
+
     #[test]
     fn encode_encrypted_frame_is_decryptable() {
         let cipher = test_cipher();
-        let msg = ProxyMessage::connect(42, "example.com", 443);
+        let msg = ProxyMessage::connect(42, 9001, "example.com", 443);
         let frame = encode_encrypted_frame(&cipher, &msg).unwrap();
         // 加密帧 = 4字节长度前缀 + nonce(12) + ct + tag(16)，长度 = 明文 + 4 + 28。
         let plaintext = msg.encode();
@@ -554,8 +624,8 @@ mod tests {
         // 同一加密块内含多条 ProxyMessage（明文拼接后整体加密）。
         let cipher = test_cipher();
         let m1 = ProxyMessage::data(1, b"first");
-        let m2 = ProxyMessage::connect(1, "a.com", 80);
-        let m3 = ProxyMessage::disconnect(1);
+        let m2 = ProxyMessage::connect(1, 101, "a.com", 80);
+        let m3 = ProxyMessage::disconnect(2, 101);
         let mut plaintext = Vec::new();
         plaintext.extend_from_slice(&m1.encode());
         plaintext.extend_from_slice(&m2.encode());
diff --git a/plane-core/src/proxy_proto.rs b/plane-core/src/proxy_proto.rs
index b94e3bb..e61aea7 100644
--- a/plane-core/src/proxy_proto.rs
+++ b/plane-core/src/proxy_proto.rs
@@ -84,12 +84,12 @@ pub struct ProxyMessage {
 
 impl ProxyMessage {
     /// 构造 CONNECT 消息（请求侧）。
-    pub fn connect(request_id: i64, host: &str, port: u16) -> Self {
+    pub fn connect(request_id: i64, stream_id: i64, host: &str, port: u16) -> Self {
         Self {
             type_: MessageType::Connect,
             status: 0,
             request_id,
-            stream_id: 0,
+            stream_id,
             host: host.to_string(),
             port: port as i32,
             data: Vec::new(),
@@ -97,12 +97,12 @@ impl ProxyMessage {
     }
 
     /// 构造 DATA 消息（请求侧）。
-    pub fn data(request_id: i64, payload: &[u8]) -> Self {
+    pub fn data(stream_id: i64, payload: &[u8]) -> Self {
         Self {
             type_: MessageType::Data,
             status: 0,
-            request_id,
-            stream_id: 0,
+            request_id: 0,
+            stream_id,
             host: String::new(),
             port: 0,
             data: payload.to_vec(),
@@ -110,12 +110,12 @@ impl ProxyMessage {
     }
 
     /// 构造 DISCONNECT 消息（请求侧）。
-    pub fn disconnect(request_id: i64) -> Self {
+    pub fn disconnect(request_id: i64, stream_id: i64) -> Self {
         Self {
             type_: MessageType::Disconnect,
             status: 0,
             request_id,
-            stream_id: 0,
+            stream_id,
             host: String::new(),
             port: 0,
             data: Vec::new(),
@@ -268,7 +268,7 @@ mod tests {
 
     #[test]
     fn encode_decode_roundtrip_connect() {
-        let msg = ProxyMessage::connect(42, "example.com", 443);
+        let msg = ProxyMessage::connect(42, 9001, "example.com", 443);
         let bytes = msg.encode();
         // 头 28 + host 11
         assert_eq!(bytes.len(), FIXED_HEADER_SIZE + "example.com".len());
@@ -287,9 +287,22 @@ mod tests {
         let decoded = ProxyMessage::decode(&bytes).unwrap();
         assert_eq!(decoded, msg);
         assert_eq!(decoded.data, payload);
+        assert_eq!(decoded.request_id, 0);
+        assert_eq!(decoded.stream_id, 7);
         assert!(decoded.host.is_empty());
     }
 
+    #[test]
+    fn control_and_data_ids_match_java_protocol() {
+        let connect = ProxyMessage::connect(12, 34, "example.com", 443);
+        let data = ProxyMessage::data(34, b"payload");
+        let disconnect = ProxyMessage::disconnect(13, 34);
+
+        assert_eq!((connect.request_id, connect.stream_id), (12, 34));
+        assert_eq!((data.request_id, data.stream_id), (0, 34));
+        assert_eq!((disconnect.request_id, disconnect.stream_id), (13, 34));
+    }
+
     #[test]
     fn header_offsets_are_big_endian() {
         let msg = ProxyMessage {
@@ -315,7 +328,7 @@ mod tests {
 
     #[test]
     fn try_decode_one_partial_returns_none() {
-        let msg = ProxyMessage::connect(1, "host", 80);
+        let msg = ProxyMessage::connect(1, 11, "host", 80);
         let full = msg.encode();
         // 喂入不足 28 字节。
         assert!(try_decode_one(&full[..10]).unwrap().is_none());
@@ -354,9 +367,9 @@ mod tests {
     #[test]
     fn try_decode_one_concatenated_messages() {
         let msgs = [
-            ProxyMessage::connect(1, "a.com", 443),
+            ProxyMessage::connect(1, 101, "a.com", 443),
             ProxyMessage::data(1, b"payload"),
-            ProxyMessage::disconnect(1),
+            ProxyMessage::disconnect(2, 101),
             ProxyMessage::heartbeat_request(99),
         ];
         let mut stream = Vec::new();
diff --git a/plane-core/src/tcp_stack.rs b/plane-core/src/tcp_stack.rs
index 1a107bb..2090d92 100644
--- a/plane-core/src/tcp_stack.rs
+++ b/plane-core/src/tcp_stack.rs
@@ -301,6 +301,7 @@ pub async fn stack_loop(
                 handle,
                 tx: app_tx,
                 rx: app_rx,
+                pending_to_stack: None,
                 conn_tuple,
                 notify: notify_tx.clone(),
             });
@@ -338,19 +339,22 @@ pub async fn stack_loop(
 
             // smoltcp → app
             while socket.can_recv() {
+                // Reserve capacity before recv_slice consumes bytes from smoltcp.
+                let permit = match conn.tx.try_reserve() {
+                    Ok(permit) => permit,
+                    Err(mpsc::error::TrySendError::Full(_)) => break,
+                    Err(mpsc::error::TrySendError::Closed(_)) => {
+                        socket.close();
+                        closed_tuples.push(conn.conn_tuple);
+                        return false;
+                    }
+                };
                 let mut buf = vec![0u8; 16384];
                 match socket.recv_slice(&mut buf) {
                     Ok(n) if n > 0 => {
                         buf.truncate(n);
-                        match conn.tx.try_send(StreamCommand::Data(buf)) {
-                            Ok(()) => had_data = true,
-                            Err(mpsc::error::TrySendError::Full(_)) => break,
-                            Err(mpsc::error::TrySendError::Closed(_)) => {
-                                socket.close();
-                                closed_tuples.push(conn.conn_tuple);
-                                return false;
-                            }
-                        }
+                        permit.send(StreamCommand::Data(buf));
+                        had_data = true;
                     }
                     _ => break,
                 }
@@ -358,22 +362,45 @@ pub async fn stack_loop(
 
             // app → smoltcp
             while socket.can_send() {
-                match conn.rx.try_recv() {
-                    Ok(StreamCommand::Data(data)) => {
-                        let _ = socket.send_slice(&data);
-                        had_data = true;
-                    }
-                    Ok(StreamCommand::Close) => {
-                        socket.close();
-                        closed_tuples.push(conn.conn_tuple);
-                        return false;
-                    }
-                    Err(mpsc::error::TryRecvError::Disconnected) => {
-                        socket.close();
-                        closed_tuples.push(conn.conn_tuple);
-                        return false;
+                if conn.pending_to_stack.is_none() {
+                    match conn.rx.try_recv() {
+                        Ok(StreamCommand::Data(data)) => {
+                            conn.pending_to_stack = Some(PendingStackWrite::new(data));
+                        }
+                        Ok(StreamCommand::Close) => {
+                            socket.close();
+                            closed_tuples.push(conn.conn_tuple);
+                            return false;
+                        }
+                        Err(mpsc::error::TryRecvError::Disconnected) => {
+                            socket.close();
+                            closed_tuples.push(conn.conn_tuple);
+                            return false;
+                        }
+                        Err(mpsc::error::TryRecvError::Empty) => break,
                     }
-                    Err(mpsc::error::TryRecvError::Empty) => break,
+                }
+
+                let pending = conn.pending_to_stack.as_mut().unwrap();
+                if pending.is_complete() {
+                    conn.pending_to_stack = None;
+                    continue;
+                }
+                let written = match socket.send_slice(pending.remaining()) {
+                    Ok(written) => written,
+                    Err(_) => break,
+                };
+                if written == 0 {
+                    break;
+                }
+
+                pending.advance(written);
+                had_data = true;
+                if pending.is_complete() {
+                    conn.pending_to_stack = None;
+                } else {
+                    // Keep the unsent tail until smoltcp has buffer space again.
+                    break;
                 }
             }
             true
@@ -548,11 +575,38 @@ struct ActiveConnection {
     handle: SocketHandle,
     tx: mpsc::Sender<StreamCommand>,
     rx: mpsc::Receiver<StreamCommand>,
+    pending_to_stack: Option<PendingStackWrite>,
     conn_tuple: (Ipv4Addr, u16, Ipv4Addr, u16),
     #[allow(dead_code)]
     notify: mpsc::Sender<()>,
 }
 
+/// A channel message can be larger than the free space in smoltcp's send buffer.
+/// Retain its unwritten tail so TCP receives the exact ordered byte stream.
+struct PendingStackWrite {
+    data: Vec<u8>,
+    offset: usize,
+}
+
+impl PendingStackWrite {
+    fn new(data: Vec<u8>) -> Self {
+        Self { data, offset: 0 }
+    }
+
+    fn remaining(&self) -> &[u8] {
+        &self.data[self.offset..]
+    }
+
+    fn advance(&mut self, written: usize) {
+        debug_assert!(written <= self.remaining().len());
+        self.offset += written;
+    }
+
+    fn is_complete(&self) -> bool {
+        self.offset == self.data.len()
+    }
+}
+
 /// smoltcp 虚拟设备：桥接 TUN 与 smoltcp（移植自桌面 `stack.rs`）。
 struct VirtualDevice {
     rx_queue: VecDeque<Vec<u8>>,
@@ -647,6 +701,7 @@ pub struct SmolTcpStream {
     read_buf: Vec<u8>,
     pending_reserve: Option<ReserveFuture>,
     notify: mpsc::Sender<()>,
+    shutdown_sent: bool,
 }
 
 impl SmolTcpStream {
@@ -662,6 +717,7 @@ impl SmolTcpStream {
             read_buf: Vec::new(),
             pending_reserve: None,
             notify,
+            shutdown_sent: false,
         }
     }
 }
@@ -701,6 +757,27 @@ impl tokio::io::AsyncWrite for SmolTcpStream {
         cx: &mut std::task::Context<'_>,
         buf: &[u8],
     ) -> std::task::Poll<std::io::Result<usize>> {
+        // Complete an earlier reservation before trying a fresh send. Otherwise
+        // a stale waiter can survive a successful try_send and reorder messages.
+        if let Some(reserve_fut) = self.pending_reserve.as_mut() {
+            match reserve_fut.as_mut().poll(cx) {
+                std::task::Poll::Ready(Ok(permit)) => {
+                    self.pending_reserve = None;
+                    permit.send(StreamCommand::Data(buf.to_vec()));
+                    let _ = self.notify.try_send(());
+                    return std::task::Poll::Ready(Ok(buf.len()));
+                }
+                std::task::Poll::Ready(Err(_)) => {
+                    self.pending_reserve = None;
+                    return std::task::Poll::Ready(Err(std::io::Error::new(
+                        std::io::ErrorKind::BrokenPipe,
+                        "stream closed",
+                    )));
+                }
+                std::task::Poll::Pending => return std::task::Poll::Pending,
+            }
+        }
+
         match self.tx.try_send(StreamCommand::Data(buf.to_vec())) {
             Ok(()) => {
                 let _ = self.notify.try_send(());
@@ -747,12 +824,50 @@ impl tokio::io::AsyncWrite for SmolTcpStream {
 
     fn poll_shutdown(
         mut self: std::pin::Pin<&mut Self>,
-        _cx: &mut std::task::Context<'_>,
+        cx: &mut std::task::Context<'_>,
     ) -> std::task::Poll<std::io::Result<()>> {
-        let _ = self.tx.try_send(StreamCommand::Close);
-        let _ = self.notify.try_send(());
-        self.pending_reserve = None;
-        std::task::Poll::Ready(Ok(()))
+        if self.shutdown_sent {
+            return std::task::Poll::Ready(Ok(()));
+        }
+
+        if self.pending_reserve.is_none() {
+            match self.tx.try_send(StreamCommand::Close) {
+                Ok(()) => {
+                    self.shutdown_sent = true;
+                    let _ = self.notify.try_send(());
+                    return std::task::Poll::Ready(Ok(()));
+                }
+                Err(mpsc::error::TrySendError::Closed(_)) => {
+                    return std::task::Poll::Ready(Err(std::io::Error::new(
+                        std::io::ErrorKind::BrokenPipe,
+                        "stream closed",
+                    )));
+                }
+                Err(mpsc::error::TrySendError::Full(_)) => {
+                    let tx = self.tx.clone();
+                    self.pending_reserve = Some(Box::pin(async move { tx.reserve_owned().await }));
+                }
+            }
+        }
+
+        let reserve_fut = self.pending_reserve.as_mut().unwrap();
+        match reserve_fut.as_mut().poll(cx) {
+            std::task::Poll::Ready(Ok(permit)) => {
+                self.pending_reserve = None;
+                permit.send(StreamCommand::Close);
+                self.shutdown_sent = true;
+                let _ = self.notify.try_send(());
+                std::task::Poll::Ready(Ok(()))
+            }
+            std::task::Poll::Ready(Err(_)) => {
+                self.pending_reserve = None;
+                std::task::Poll::Ready(Err(std::io::Error::new(
+                    std::io::ErrorKind::BrokenPipe,
+                    "stream closed",
+                )))
+            }
+            std::task::Poll::Pending => std::task::Poll::Pending,
+        }
     }
 }
 
@@ -843,4 +958,45 @@ mod tests {
         pkt[33] = 0x12;
         assert!(extract_tcp_syn_info(&pkt).is_none());
     }
+
+    #[test]
+    fn pending_stack_write_retains_partial_tail() {
+        let original = b"0123456789".to_vec();
+        let mut pending = PendingStackWrite::new(original.clone());
+        let mut forwarded = Vec::new();
+
+        for capacity in [3, 2, 5] {
+            let written = capacity.min(pending.remaining().len());
+            forwarded.extend_from_slice(&pending.remaining()[..written]);
+            pending.advance(written);
+        }
+
+        assert!(pending.is_complete());
+        assert_eq!(forwarded, original);
+    }
+
+    #[tokio::test]
+    async fn stream_write_waits_for_channel_capacity() {
+        use tokio::io::AsyncWriteExt;
+
+        let (tx, mut stack_rx) = mpsc::channel(1);
+        tx.try_send(StreamCommand::Data(b"first".to_vec())).unwrap();
+        let (_incoming_tx, incoming_rx) = mpsc::channel(1);
+        let (notify_tx, _notify_rx) = mpsc::channel(1);
+        let mut stream = SmolTcpStream::new(tx, incoming_rx, notify_tx);
+
+        let writer = tokio::spawn(async move { stream.write_all(b"second").await });
+        tokio::task::yield_now().await;
+        assert!(!writer.is_finished());
+
+        let first = stack_rx.recv().await.unwrap();
+        assert!(matches!(first, StreamCommand::Data(data) if data == b"first"));
+
+        let second = tokio::time::timeout(std::time::Duration::from_secs(1), stack_rx.recv())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(matches!(second, StreamCommand::Data(data) if data == b"second"));
+        writer.await.unwrap().unwrap();
+    }
 }

From f19dcf1cfdd8ec445a92d9f506e8c659d3f70d46 Mon Sep 17 00:00:00 2001
From: rain_ <rain__lei@outlook.com>
Date: Mon, 13 Jul 2026 20:03:39 +0800
Subject: [PATCH 12/12] build(android): prefer Git Bash on Windows

---
 android-app/app/build.gradle.kts | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/android-app/app/build.gradle.kts b/android-app/app/build.gradle.kts
index 45af68a..4cc7073 100644
--- a/android-app/app/build.gradle.kts
+++ b/android-app/app/build.gradle.kts
@@ -1,4 +1,5 @@
 import org.gradle.api.tasks.Exec
+import java.io.File
 import java.io.FileInputStream
 import java.util.Properties
 
@@ -120,7 +121,27 @@ val buildRust by tasks.registering(Exec::class) {
     description = "Cross-compile plane-core (Rust) into jniLibs via cargo-ndk"
     workingDir = rootProject.projectDir.parentFile // 仓库根目录（android-app 的上一级）
     val profile = if (project.hasProperty("rustRelease")) "release" else "debug"
-    commandLine("bash", "scripts/build-rust.sh", profile)
+    val isWindows = System.getProperty("os.name").startsWith("Windows", ignoreCase = true)
+    val bashExecutable = if (isWindows) {
+        // Windows' PATH may resolve `bash` to WSL, which cannot reliably consume
+        // this checkout's paths. Prefer an explicit Git Bash installation.
+        val configured = providers.gradleProperty("gitBash").orNull
+            ?: System.getenv("GIT_BASH")
+        val candidates = listOfNotNull(
+            configured?.let(::File),
+            System.getenv("ProgramFiles")?.let { File(it, "Git/bin/bash.exe") },
+            System.getenv("ProgramFiles(x86)")?.let { File(it, "Git/bin/bash.exe") },
+            System.getenv("LOCALAPPDATA")?.let { File(it, "Programs/Git/bin/bash.exe") },
+        )
+        candidates.firstOrNull(File::isFile)?.absolutePath
+            ?: throw GradleException(
+                "Git Bash was not found. Install Git for Windows or set " +
+                    "GIT_BASH / -PgitBash=C:\\path\\to\\bash.exe",
+            )
+    } else {
+        "bash"
+    }
+    commandLine(bashExecutable, "scripts/build-rust.sh", profile)
 }
 
 tasks.named("preBuild") {