feat(app): keep the tunnel alive via the OS, drop the workarounds

3.3.1 could display "connected" against a tunnel that was no longer
running, with a frozen countdown and no traffic. Three causes, and the
fix for each removes more code than it adds.

Liveness was read from getConnectedServerDelay(), which measures through
AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807. AppConfigs lives in
the :RunSoLibXrayDaemon process, so from the UI process it is always null
and the port always fell back to 10807 -- accidentally correct while the
SOCKS port was fixed, permanently wrong once 3.3.1 made it ephemeral.
Liveness now comes from the OS: is our service process running, and is a
VPN transport actually present.

The foreground notification (id 1) is owned by XrayVPNService via
startForeground, but MainActivity was posting to the same id from the UI
process. When that process died its notification stayed on screen with
nothing left to update it. MainActivity now refuses to post for a dead
runtime and clears the stale notification instead.

Nothing ever asked Android for permission to stay alive. Adds the
battery-optimisation exemption prompt and a deep link to Always-on VPN --
the two sanctioned mechanisms for background survival, each needing one
user tap.

Removes Standard/Extreme resilience and the runtime-restart machinery:
recovery ran off a disconnect broadcast delivered to the app process, so
it could never fire when Android killed that process. Removes startup
restoration and the config-snapshot rebuild along with it; with the OS
keeping the tunnel up there is nothing to restore.

Version 3.3.2+28.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitignore

@@ -18,9 +18,6 @@ android/admob.properties
 lib/logic/app_config.dart
 
 # ── File types the shipped app does not contain ────────────────────────────
-#  Server code, infrastructure configs, captures, archives, dumps and logs.
-#  None of these extensions are tracked, so a blanket rule is safe and stays
-#  safe — it covers files that do not exist yet.
 *.py
 *.pyc
 *.json
@@ -53,6 +50,7 @@ scraped/
 backup/
 backups/
 lib/logic/backup/
+server_files/
 
 # ── Flutter / Dart build output ────────────────────────────────────────────
 .dart_tool/

CHANGELOG.md

@@ -5,6 +5,151 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
 
 ---
 
+## [3.3.2] — 2026-09-01
+
+Background reliability. 3.3.1 could show "connected" against a tunnel that was no
+longer running; this release fixes the cause rather than the symptom, and removes the
+machinery that existed to work around it.
+
+### Added
+- **Background reliability settings.** Android stops background services of apps that
+  are not exempt from Doze, and tears down the process group when a task is swiped
+  away. Two OS mechanisms prevent that, and the app now surfaces both: a one-tap
+  **battery optimisation exemption**, and a deep link to Android's **Always-on VPN**
+  settings (with a note about "Block connections without VPN"). Neither can be enabled
+  programmatically — each needs a single user tap, once.
+
+### Fixed
+- **The app could report "connected" with no traffic flowing.** Startup state came from
+  `getConnectedServerDelay()`, which measures through
+  `AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807`. `AppConfigs` lives in the VPN's
+  own process, so from the UI process it is always null and the port always fell back to
+  10807. That was accidentally correct while the SOCKS port was fixed; 3.3.1's
+  per-session ephemeral ports made it permanently wrong. Liveness is now determined from
+  the OS — whether our VPN service process is running, and whether a VPN transport is
+  actually present.
+- **A frozen countdown could outlive the tunnel.** The foreground notification (id 1) is
+  owned by the VPN service via `startForeground`, but the UI process was posting to the
+  same id. When that process died, its notification stayed on screen with nothing left to
+  update it. The app no longer posts for a runtime that is not alive, and clears a stale
+  notification instead.
+
+### Removed
+- **Standard/Extreme resilience modes** and the runtime-restart machinery behind them.
+  Recovery ran off a disconnect broadcast delivered to the app process, so it could never
+  fire in the case that actually matters — Android killing that process. It was
+  complexity substituting for background persistence.
+- **Startup restoration**, including the config-snapshot rebuild. With the tunnel kept
+  alive by the OS, there is nothing to restore; the app simply reports what is running.
+- The `resilience_mode` preference and its settings tile.
+
+## [3.3.1] — 2026-08-31
+
+### Added
+- **Explicit TUN and SOCKS5 connection modes.** The previous Auto mode is gone, so
+  routing is chosen deliberately instead of inferred at runtime. TUN is the default.
+  SOCKS5 runs a local authenticated proxy with no VPN interface, and therefore never
+  requests the Android VPN permission.
+- **Authenticated per-session Local SOCKS5.** Every connection binds an ephemeral
+  loopback port and mints fresh 16-byte username / 32-byte password credentials.
+  Android loopback is reachable by every app on the device, so this authentication is
+  load-bearing rather than decorative. Credentials stay in memory. Imported
+  `socks`/`http` inbounds are dropped so no unauthenticated listener can survive
+  alongside the session one.
+- **Network resilience profiles** — Standard and Extreme. Extreme restarts a failed
+  Xray/tun2socks runtime up to twice before giving up.
+- **Android physical-network monitoring**, filtered on `NET_CAPABILITY_NOT_VPN` so the
+  VPN's own network cannot feed back a reconnect loop. Informational only; the active
+  transport (Wi-Fi / cellular / ethernet) now appears in the status bar.
+- **Local SOCKS5 diagnostics.** "Test Local SOCKS" authenticates against the exact
+  active session over loopback — a readiness handshake plus a full CONNECT — instead
+  of checking whether a fixed port accepts connections.
+- Native Android bridges for network state, haptic feedback and install-source
+  detection.
+
+### Fixed
+- **Extreme recovery now survives an app-process restart.** Android can kill the Dart
+  process while the VPN foreground service keeps running, leaving the app attached to
+  a live tunnel it holds no configuration for — so recovery had nothing to restart
+  from. In TUN mode the app rebuilds that snapshot from the still-active session,
+  without opening a new session, showing an ad, or interrupting traffic.
+- **The proxy settings tile no longer misreports state after a process restart.** Its
+  credentials genuinely cannot be recovered — they are random, generated on device and
+  never transmitted — so instead of telling an already-connected user to "Connect", it
+  now says the credentials were lost and offers a Reconnect action.
+- **The first tap on the connect button was ignored.** The debounce timestamp was
+  initialized to the current time instead of the epoch, so the first press was always
+  swallowed.
+- **The health probe polled `/health` every 30 s even while connected.** Restored to
+  idle-only — a live tunnel already proves reachability, and the extra direct requests
+  were unwanted.
+- **A user reconnect could race an in-flight Extreme recovery.** A connection
+  generation counter now aborts stale recovery attempts.
+- Recoverable Xray/tun2socks startup and readiness failures no longer follow the
+  unstable self-stop path used during development.
+- Returning from Android background state reconciles the session countdown against
+  elapsed wall-clock time and re-syncs immediately, reducing stale countdowns and false
+  `Syncing…` presentation after Dart throttling.
+- Sidebar update checks retain valid navigator/messenger handles after the drawer
+  closes.
+
+### Changed
+- **The pinned `flutter_vless_android` 1.1.5 runtime is patched at build time** instead
+  of vendored. Three idempotent patchers are chained into `preBuild`, so a plain
+  `flutter build apk` behaves like CI rather than depending on a manual step against
+  the pub cache. They are fail-closed: an upstream change breaks the build loudly
+  instead of silently producing an unpatched runtime.
+- Legacy `auto` preferences migrate to TUN; legacy `ass` preferences migrate to SOCKS5.
+- Haptic feedback is a single confirmation on connect/disconnect, routed through the
+  native Android vibration channel, and **defaults to off**.
+- The VPN notification uses a dedicated 24 dp status icon and stays ongoing/no-clear
+  while the foreground service is alive.
+- Hivemind session parsing is split into typed validation steps; a malformed port now
+  fails instead of silently falling back.
+- The update checker parses semver with prerelease ordering and validates release URLs
+  against an HTTPS host allowlist.
+- The support button shows a claimed/disabled state once the session bonus is used.
+- The status bar distinguishes `Ready` from `Syncing…` and folds in server
+  reachability.
+- Gradle release heap raised to 4 GiB with `MaxMetaspaceSize=1g` and `workers.max=2`,
+  so Flutter/Jetifier transforms do not fail on the release classpath under constrained
+  runners.
+- App version is now `3.3.1+27`.
+
+### Removed
+- **Per-app routing**, including the app picker, the installed-apps native bridge and
+  the blocked-apps mechanism. It only ever functioned in TUN — the underlying
+  `addDisallowedApplication` call lives inside the VPN-interface setup that SOCKS5 mode
+  skips entirely — and its allowlist half was never wired to any caller. Removed rather
+  than finished.
+- The legacy `auto` connection mode.
+- `flutter_local_notifications`, and the unused notification manager it backed.
+- A global touch listener that fired a haptic on every tap.
+- Unused runtime telemetry fields.
+
+### Security & privacy
+- **Session metadata is hidden from public lock-screen previews.** The live foreground
+  notification is built with `VISIBILITY_PRIVATE` plus a generic public version, so the
+  countdown and speed are visible only after unlock. *(An earlier attempt at this
+  landed in an unreferenced class and never took effect.)*
+- Local SOCKS5 listens only on `127.0.0.1`, requires per-session authentication, and
+  its credentials are neither persisted nor logged.
+- The app requests no package visibility at all. `QUERY_ALL_PACKAGES` was never used,
+  and the launcher-enumeration query was removed along with the app picker.
+- Session nonces use `Random.secure()` and are never logged.
+- Device UUIDs are validated as v4 and regenerated if corrupt, so tampered identifiers
+  cannot reach the API.
+- `FOREGROUND_SERVICE_SPECIAL_USE` is declared for Android 14+; the merged service
+  declaration carries the `vpn` special-use subtype.
+- Existing AdMob bypass/callback behavior is intentionally unchanged by this release.
+- Server, nginx and Reality configuration are not modified by this client-side release.
+
+### Validation
+- `flutter analyze` — 0 errors, 0 warnings, 7 style infos (6 of them pre-existing).
+- All three build-time patchers verified against a clean pub cache, including that each
+  applies independently of the others.
+- **Not yet verified:** Android release Kotlin compilation and APK build.
+
 ## [3.3.0] — 2026-08-30
 
 ### Added

android/app/build.gradle.kts

@@ -1,4 +1,5 @@
 import java.util.Properties
+import java.io.File
 import java.io.FileInputStream
 
 plugins {
@@ -6,6 +7,128 @@ plugins {
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+val projectRootDir = rootProject.projectDir.parentFile
+val localPropertiesFile = rootProject.file("local.properties")
+val localProperties = Properties().apply {
+    if (localPropertiesFile.exists()) {
+        localPropertiesFile.inputStream().use { load(it) }
+    }
+}
+val flutterSdkPath = localProperties.getProperty("flutter.sdk")
+    ?: throw GradleException("flutter.sdk not set in android/local.properties")
+val dartExecutable = File(
+    flutterSdkPath,
+    if (System.getProperty("os.name").lowercase().contains("windows")) {
+        "bin/cache/dart-sdk/bin/dart.exe"
+    } else {
+        "bin/cache/dart-sdk/bin/dart"
+    },
+)
+val flutterVlessPatchScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_allowed_apps.dart",
+)
+val flutterVlessSecureSocksPatchScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_secure_socks_v2.dart",
+)
+val flutterVlessSecureSocksScopeFixScript = File(
+    projectRootDir,
+    "tool/patch_flutter_vless_secure_socks_scope_fix.dart",
+)
+
+val patchFlutterVlessAllowedApps = tasks.register<Exec>("patchFlutterVlessAllowedApps") {
+    group = "build setup"
+    description = "Patch pinned flutter_vless_android 1.1.5 with ReVolt routing/runtime hardening"
+    workingDir(projectRootDir)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessPatchScript.isFile) {
+            throw GradleException("flutter_vless patch script missing: ${flutterVlessPatchScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessPatchScript.absolutePath,
+    )
+}
+
+val patchFlutterVlessSecureSocks = tasks.register<Exec>("patchFlutterVlessSecureSocks") {
+    group = "build setup"
+    description = "Add authenticated ephemeral SOCKS5 and fail-closed process recovery to pinned flutter_vless_android 1.1.5"
+    workingDir(projectRootDir)
+    dependsOn(patchFlutterVlessAllowedApps)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessSecureSocksPatchScript.isFile) {
+            throw GradleException("secure SOCKS patch script missing: ${flutterVlessSecureSocksPatchScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessSecureSocksPatchScript.absolutePath,
+    )
+}
+
+val patchFlutterVlessSecureSocksScopeFix = tasks.register<Exec>("patchFlutterVlessSecureSocksScopeFix") {
+    group = "build setup"
+    description = "Repair the secure Xray process monitor capture without changing stock 1.1.5 runtime sequencing"
+    workingDir(projectRootDir)
+    dependsOn(patchFlutterVlessSecureSocks)
+
+    doFirst {
+        if (!dartExecutable.isFile) {
+            throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}")
+        }
+        if (!flutterVlessSecureSocksScopeFixScript.isFile) {
+            throw GradleException("secure SOCKS scope fix script missing: ${flutterVlessSecureSocksScopeFixScript.absolutePath}")
+        }
+        if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) {
+            throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.")
+        }
+    }
+
+    commandLine(
+        dartExecutable.absolutePath,
+        "run",
+        flutterVlessSecureSocksScopeFixScript.absolutePath,
+    )
+}
+
+// App compilation and the transitive Android plugin compilation must both wait
+// for the pinned runtime patches. Plain `flutter build apk` must behave like CI
+// instead of relying on a hidden manual pre-build step.
+tasks.configureEach {
+    if (name == "preBuild") {
+        dependsOn(patchFlutterVlessSecureSocksScopeFix)
+    }
+}
+
+gradle.projectsEvaluated {
+    rootProject.findProject(":flutter_vless_android")
+        ?.tasks
+        ?.matching { it.name == "preBuild" }
+        ?.configureEach {
+            dependsOn(patchFlutterVlessSecureSocksScopeFix)
+        }
+}
+
 android {
     namespace = "com.paladinvpn.app"
     compileSdk = flutter.compileSdkVersion

android/app/src/main/AndroidManifest.xml

@@ -5,7 +5,11 @@
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"/>
     <uses-permission android:name="android.permission.VIBRATE"/>
+    <!-- Doze/App Standby stop background services of non-exempt apps. A VPN
+         cannot stay up without this; Play allows it for VPN functionality. -->
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
 
     <!-- flutter_vless 1.1.5 declares this legacy permission. ReVolt never needs it. -->
     <uses-permission

android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt

@@ -1,30 +1,43 @@
 package com.paladinvpn.app
 
+import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
+import android.app.ActivityManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import android.net.Uri
 import android.os.Build
+import android.os.PowerManager
+import android.os.VibrationEffect
+import android.os.Vibrator
+import android.os.VibratorManager
+import android.provider.Settings
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
 import com.github.tfox.flutter_vless.xray.service.XrayVPNService
 import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
+import io.flutter.plugin.common.EventChannel
 import io.flutter.plugin.common.MethodChannel
 
 class MainActivity : FlutterActivity() {
-
-    // Channel id only — not the application id, which is com.paladinvpn.app.
-    // Must match the string in lib/logic/updater.dart.
     private val installerChannel = "com.revoltvpn.app/installer"
-
-    // Must match lib/logic/notification_service.dart.
     private val notificationChannel = "com.revoltvpn.app/notification"
+    private val hapticsChannel = "com.revoltvpn.app/haptics"
+    private val networkChannel = "com.revoltvpn.app/network"
+    private val powerChannel = "com.revoltvpn.app/power"
 
     private var notificationChannelReady = false
+    private var networkCallback: ConnectivityManager.NetworkCallback? = null
+    private var networkEvents: EventChannel.EventSink? = null
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
@@ -38,6 +51,28 @@ class MainActivity : FlutterActivity() {
                 }
             }
 
+        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, powerChannel)
+            .setMethodCallHandler { call, result ->
+                when (call.method) {
+                    // Doze and App Standby stop background services of apps that
+                    // are not exempt. A VPN has to be exempt to survive the screen
+                    // going off, so surface the real state rather than guessing.
+                    "isIgnoringBatteryOptimizations" ->
+                        result.success(isIgnoringBatteryOptimizations())
+                    "requestIgnoreBatteryOptimizations" ->
+                        result.success(requestIgnoreBatteryOptimizations())
+                    // Android's own Always-on VPN is the only thing that keeps a
+                    // tunnel up across swipe-from-recents and reboot. It cannot be
+                    // toggled programmatically, so deep-link the user to it.
+                    "openVpnSettings" -> result.success(openVpnSettings())
+                    // Is our VPN runtime actually alive? The service lives in
+                    // :RunSoLibXrayDaemon, a separate process, so its statics are
+                    // NOT visible here -- this is the only honest check.
+                    "isVpnRuntimeAlive" -> result.success(isVpnRuntimeAlive())
+                    else -> result.notImplemented()
+                }
+            }
+
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, notificationChannel)
             .setMethodCallHandler { call, result ->
                 if (call.method == "updateNotificationText") {
@@ -50,16 +85,128 @@ class MainActivity : FlutterActivity() {
                     result.notImplemented()
                 }
             }
+
+        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, hapticsChannel)
+            .setMethodCallHandler { call, result ->
+                if (call.method == "impact") {
+                    val kind = call.argument<String>("kind") ?: "tap"
+                    result.success(performHaptic(kind))
+                } else {
+                    result.notImplemented()
+                }
+            }
+
+        EventChannel(flutterEngine.dartExecutor.binaryMessenger, networkChannel)
+            .setStreamHandler(object : EventChannel.StreamHandler {
+                override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
+                    networkEvents = events
+                    startNetworkMonitor()
+                }
+
+                override fun onCancel(arguments: Any?) {
+                    networkEvents = null
+                    stopNetworkMonitor()
+                }
+            })
+    }
+
+    override fun onDestroy() {
+        stopNetworkMonitor()
+        super.onDestroy()
+    }
+
+    /** True when the OS has exempted us from Doze / App Standby. */
+    private fun isIgnoringBatteryOptimizations(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
+        return try {
+            val pm = getSystemService(Context.POWER_SERVICE) as PowerManager
+            pm.isIgnoringBatteryOptimizations(packageName)
+        } catch (_: Exception) {
+            false
+        }
     }
 
     /**
-     * Sets the session countdown as the VPN notification's content text.
-     *
-     * notify() is per-package, so re-posting flutter_vless's notification id
-     * replaces it wholesale — every field the plugin set has to be rebuilt
-     * here or it is dropped, the Disconnect action most of all. Keep in sync
-     * with XrayCoreManager.showNotification().
+     * Opens the system exemption prompt. Android shows this as a single dialog;
+     * it cannot be granted silently, so the caller must treat a false return as
+     * "ask again later" rather than a denial.
      */
+    private fun requestIgnoreBatteryOptimizations(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
+        if (isIgnoringBatteryOptimizations()) return true
+        return try {
+            startActivity(
+                Intent(
+                    Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
+                    Uri.parse("package:$packageName"),
+                ),
+            )
+            true
+        } catch (_: Exception) {
+            // Some OEM builds hide the direct intent; fall back to the list.
+            try {
+                startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS))
+                true
+            } catch (_: Exception) {
+                false
+            }
+        }
+    }
+
+    /** Deep-links to the OS VPN settings, where Always-on VPN lives. */
+    private fun openVpnSettings(): Boolean {
+        return try {
+            startActivity(
+                Intent(Settings.ACTION_VPN_SETTINGS)
+                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK),
+            )
+            true
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    /**
+     * Whether the VPN runtime is genuinely alive.
+     *
+     * The Xray service runs in :RunSoLibXrayDaemon, a separate process, so its
+     * statics (AppConfigs.V2RAY_CONFIG, V2RAY_STATE) are NOT visible from here --
+     * reading them yields a fresh, empty copy. getRunningAppProcesses still
+     * returns our *own* processes, which makes it the one reliable signal.
+     */
+    private fun isVpnRuntimeAlive(): Map<String, Any> {
+        var processAlive = false
+        try {
+            val am = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager
+            processAlive = am.runningAppProcesses
+                ?.any { it.processName.endsWith(VPN_PROCESS_SUFFIX) } == true
+        } catch (_: Exception) {
+        }
+
+        var vpnTransport = false
+        try {
+            val cm = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+            vpnTransport = cm.allNetworks.any { network ->
+                cm.getNetworkCapabilities(network)
+                    ?.hasTransport(NetworkCapabilities.TRANSPORT_VPN) == true
+            }
+        } catch (_: Exception) {
+        }
+
+        return mapOf(
+            "processAlive" to processAlive,
+            "vpnTransport" to vpnTransport,
+        )
+    }
+
+    /** Removes a notification left behind by a runtime that is no longer alive. */
+    private fun cancelVpnNotification() {
+        try {
+            NotificationManagerCompat.from(this).cancel(NOTIFICATION_ID)
+        } catch (_: Exception) {
+        }
+    }
+
     private fun updateVpnNotification(title: String, text: String, actionLabel: String) {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
             checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) !=
@@ -68,6 +215,15 @@ class MainActivity : FlutterActivity() {
             return
         }
 
+        // The foreground notification (id 1) is owned by XrayVPNService via
+        // startForeground. Posting to it from this process while the service is
+        // gone leaves a frozen countdown nothing will ever update again.
+        val alive = isVpnRuntimeAlive()["processAlive"] == true
+        if (!alive) {
+            cancelVpnNotification()
+            return
+        }
+
         ensureNotificationChannel()
 
         val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
@@ -76,58 +232,62 @@ class MainActivity : FlutterActivity() {
             PendingIntent.FLAG_UPDATE_CURRENT
         }
 
-        // Same intent shape as the plugin, so a tap brings the running task
-        // forward instead of starting a second one.
         val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
         launchIntent?.action = "FROM_DISCONNECT_BTN"
         launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
             Intent.FLAG_ACTIVITY_CLEAR_TOP or
             Intent.FLAG_ACTIVITY_NEW_TASK
 
-        // Tapping "Disconnect" stops the tunnel without opening the app.
         val stopIntent = Intent(this, XrayVPNService::class.java)
-        stopIntent.putExtra(
-            "COMMAND",
-            AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE
-        )
+        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
         val stopPendingIntent = PendingIntent.getService(this, 0, stopIntent, flags)
 
+        // Public lock-screen preview: keep the VPN status visible but hide the
+        // session countdown/speed so usage metadata never reaches the lock screen.
+        val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
+            .setSmallIcon(R.drawable.notification_status_icon)
+            .setContentTitle("Revolt VPN")
+            .setContentText("VPN is active")
+            .build()
+
         val builder = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
-            .setSmallIcon(R.drawable.notification_icon)
+            .setSmallIcon(R.drawable.notification_status_icon)
             .setContentTitle(title)
             .setContentText(text)
             .addAction(0, actionLabel, stopPendingIntent)
             .setColorized(true)
             .setColor(0xFF0D1117.toInt())
             .setOngoing(true)
+            .setAutoCancel(false)
             .setOnlyAlertOnce(true)
             .setSilent(true)
             .setShowWhen(false)
             .setPriority(NotificationCompat.PRIORITY_LOW)
+            .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
+            .setPublicVersion(publicVersion)
 
         if (launchIntent != null) {
-            builder.setContentIntent(
-                PendingIntent.getActivity(this, 0, launchIntent, flags)
-            )
+            builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags))
         }
 
         try {
-            NotificationManagerCompat.from(this).notify(NOTIFICATION_ID, builder.build())
+            val notification = builder.build()
+            notification.flags = notification.flags or
+                Notification.FLAG_ONGOING_EVENT or Notification.FLAG_NO_CLEAR
+            NotificationManagerCompat.from(this).notify(NOTIFICATION_ID, notification)
         } catch (_: Exception) {
-            // The foreground notification may not be up yet — the update is cosmetic.
+            // The native foreground notification may not be ready yet.
         }
     }
 
-    /** A binder round-trip, and the caller runs once a second — so, once per process. */
     private fun ensureNotificationChannel() {
         if (notificationChannelReady) return
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            val manager =
-                getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+            val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
             val channel = NotificationChannel(
                 NOTIFICATION_CHANNEL_ID,
                 "Revolt VPN Background Service",
-                NotificationManager.IMPORTANCE_LOW
+                NotificationManager.IMPORTANCE_LOW,
             )
             channel.setShowBadge(false)
             manager.createNotificationChannel(channel)
@@ -135,11 +295,134 @@ class MainActivity : FlutterActivity() {
         notificationChannelReady = true
     }
 
-    /**
-     * Package name of whatever installed us ("com.android.vending" for Play
-     * Store), or null when unknown. Without this the Dart side always falls
-     * back to sideload and points every user at GitHub releases.
-     */
+    private fun startNetworkMonitor() {
+        if (networkCallback != null) return
+
+        val manager = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+        val callback = object : ConnectivityManager.NetworkCallback() {
+            override fun onAvailable(network: Network) {
+                emitBestPhysicalNetwork(manager, "available")
+            }
+
+            override fun onLost(network: Network) {
+                emitBestPhysicalNetwork(manager, "lost")
+            }
+
+            override fun onCapabilitiesChanged(
+                network: Network,
+                capabilities: NetworkCapabilities,
+            ) {
+                emitBestPhysicalNetwork(manager, "changed")
+            }
+        }
+
+        try {
+            val request = NetworkRequest.Builder()
+                .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+                .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
+                .build()
+            manager.registerNetworkCallback(request, callback)
+            networkCallback = callback
+            emitBestPhysicalNetwork(manager, "initial")
+        } catch (e: Exception) {
+            networkEvents?.error("NETWORK_MONITOR", e.message, null)
+        }
+    }
+
+    private fun stopNetworkMonitor() {
+        val callback = networkCallback ?: return
+        val manager = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+        try {
+            manager.unregisterNetworkCallback(callback)
+        } catch (_: Exception) {
+        }
+        networkCallback = null
+    }
+
+    private fun emitBestPhysicalNetwork(
+        manager: ConnectivityManager,
+        reason: String,
+    ) {
+        val best = manager.allNetworks
+            .mapNotNull { network ->
+                val capabilities = manager.getNetworkCapabilities(network)
+                    ?: return@mapNotNull null
+                if (!capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)) {
+                    return@mapNotNull null
+                }
+                if (!capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN) ||
+                    capabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN)
+                ) {
+                    return@mapNotNull null
+                }
+                Triple(network, capabilities, physicalNetworkScore(capabilities))
+            }
+            .maxByOrNull { it.third }
+
+        if (best == null) {
+            emitNetworkPayload(
+                mapOf<String, Any>(
+                    "reason" to reason,
+                    "transport" to "none",
+                    "connected" to false,
+                    "validated" to false,
+                    "metered" to false,
+                    "timestamp" to System.currentTimeMillis(),
+                ),
+            )
+            return
+        }
+
+        emitNetworkState(best.first, best.second, reason)
+    }
+
+    private fun physicalNetworkScore(capabilities: NetworkCapabilities): Int {
+        var score = 0
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
+            capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
+        ) {
+            score += 100
+        }
+        score += when {
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> 40
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> 30
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> 20
+            else -> 10
+        }
+        return score
+    }
+
+    private fun emitNetworkState(
+        network: Network,
+        capabilities: NetworkCapabilities,
+        reason: String,
+    ) {
+        val transport = when {
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> "ethernet"
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> "wifi"
+            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> "cellular"
+            else -> "other"
+        }
+        val validated = Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
+            capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
+        val metered = !capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
+
+        emitNetworkPayload(
+            mapOf<String, Any>(
+                "reason" to reason,
+                "transport" to transport,
+                "connected" to true,
+                "validated" to validated,
+                "metered" to metered,
+                "timestamp" to System.currentTimeMillis(),
+            ),
+        )
+    }
+
+    private fun emitNetworkPayload(payload: Map<String, Any>) {
+        runOnUiThread { networkEvents?.success(payload) }
+    }
+
     private fun installerPackage(): String? = try {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
             packageManager.getInstallSourceInfo(packageName).installingPackageName
@@ -147,13 +430,49 @@ class MainActivity : FlutterActivity() {
             @Suppress("DEPRECATION")
             packageManager.getInstallerPackageName(packageName)
         }
-    } catch (e: Exception) {
+    } catch (_: Exception) {
         null
     }
 
+    private fun performHaptic(kind: String): Boolean {
+        return try {
+            val vibrator: Vibrator = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+                val manager =
+                    getSystemService(Context.VIBRATOR_MANAGER_SERVICE) as VibratorManager
+                manager.defaultVibrator
+            } else {
+                @Suppress("DEPRECATION")
+                getSystemService(Context.VIBRATOR_SERVICE) as Vibrator
+            }
+
+            if (!vibrator.hasVibrator()) {
+                false
+            } else {
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                    val effect = when (kind) {
+                        "selection" -> VibrationEffect.EFFECT_TICK
+                        "success" -> VibrationEffect.EFFECT_HEAVY_CLICK
+                        else -> VibrationEffect.EFFECT_CLICK
+                    }
+                    vibrator.vibrate(VibrationEffect.createPredefined(effect))
+                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                    val durationMs = if (kind == "success") 24L else 14L
+                    val amplitude = if (kind == "success") 110 else 70
+                    vibrator.vibrate(VibrationEffect.createOneShot(durationMs, amplitude))
+                } else {
+                    @Suppress("DEPRECATION")
+                    vibrator.vibrate(if (kind == "success") 24L else 14L)
+                }
+                true
+            }
+        } catch (_: Exception) {
+            false
+        }
+    }
+
     companion object {
-        // Must match flutter_vless's XrayCoreManager.
         private const val NOTIFICATION_ID = 1
+        private const val VPN_PROCESS_SUFFIX = ":RunSoLibXrayDaemon"
         private const val NOTIFICATION_CHANNEL_ID = "XRAY_SERVICE_CHANNEL"
     }
 }

android/app/src/main/res/drawable/notification_status_icon.xml

@@ -0,0 +1,9 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="24"
+    android:viewportHeight="24">
+    <path
+        android:fillColor="#FFFFFFFF"
+        android:pathData="M12,1.5L21,5.2V11.1C21,16.7 17.4,21 12,22.5C6.6,21 3,16.7 3,11.1V5.2L12,1.5ZM12,5L6.5,7.2V11C6.5,14.8 8.7,17.8 12,19C15.3,17.8 17.5,14.8 17.5,11V7.2L12,5ZM10.8,9H13.2V13.8H10.8V9ZM10.8,15H13.2V17.4H10.8V15Z" />
+</vector>

android/gradle.properties

@@ -1,5 +1,7 @@
-org.gradle.jvmargs=-Xmx1536M
+org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=1g -Dfile.encoding=UTF-8
+org.gradle.workers.max=2
 android.useAndroidX=true
 android.enableJetifier=true
+# These compatibility flags are managed by Flutter's Android toolchain.
 android.builtInKotlin=false
 android.newDsl=false

lib/components/connect_button.dart

@@ -1,11 +1,10 @@
-import 'dart:async';
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/ad_manager.dart';
-import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
+import 'package:revoltvpn/logic/haptic_settings.dart';
 
 class ConnectButton extends StatefulWidget {
   const ConnectButton({super.key});
@@ -17,7 +16,7 @@ class ConnectButton extends StatefulWidget {
 class _ConnectButtonState extends State<ConnectButton>
     with SingleTickerProviderStateMixin, WidgetsBindingObserver {
   bool _busy = false;
-  DateTime _lastTap = DateTime.now();
+  DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0);
   AnimationController? _pulse;
   Animation<double>? _pulseAnim;
 
@@ -26,12 +25,17 @@ class _ConnectButtonState extends State<ConnectButton>
   @override
   void initState() {
     super.initState();
-    final pulse = AnimationController(vsync: this, duration: const Duration(milliseconds: 2000));
+    final pulse = AnimationController(
+      vsync: this,
+      duration: const Duration(milliseconds: 2000),
+    );
     _pulse = pulse;
-    _pulseAnim = Tween(begin: 0.0, end: 1.0).animate(CurvedAnimation(parent: pulse, curve: Curves.easeInOut));
+    _pulseAnim = Tween(begin: 0.0, end: 1.0).animate(
+      CurvedAnimation(parent: pulse, curve: Curves.easeInOut),
+    );
     WidgetsBinding.instance.addObserver(this);
     WidgetsBinding.instance.addPostFrameCallback((_) {
-      context.read<VpnConnection>().addListener(_onVpnChanged);
+      if (mounted) context.read<VpnConnection>().addListener(_onVpnChanged);
     });
   }
 
@@ -68,7 +72,6 @@ class _ConnectButtonState extends State<ConnectButton>
   }
 
   Future<void> _handleTap() async {
-
     final now = DateTime.now();
     if (now.difference(_lastTap).inMilliseconds < 1000) return;
     _lastTap = now;
@@ -77,31 +80,24 @@ class _ConnectButtonState extends State<ConnectButton>
     final timer = context.read<SessionTimer>();
     final ad = context.read<AdManager>();
 
-
     if (vpn.status == VpnStatus.connected || vpn.status == VpnStatus.connecting) {
       _busy = false;
       await timer.disconnect();
-      unawaited(Haptics.connectionChanged());
+      HapticSettings.success();
       return;
     }
 
-
-    if (vpn.status == VpnStatus.disconnecting) return;
-
-
-    if (_busy) return;
+    if (vpn.status == VpnStatus.disconnecting || _busy) return;
 
     setState(() => _busy = true);
     try {
       final adWatched = await ad.showAd('main');
-      if (!adWatched && AdManager.adsEnabled) {
-        setState(() => _busy = false);
-        return;
-      }
+      if (!adWatched && AdManager.adsEnabled) return;
+
       final ok = await vpn.connect();
       if (ok) {
-        timer.start();
-        unawaited(Haptics.connectionChanged());
+        await timer.start();
+        HapticSettings.success();
       }
     } finally {
       if (mounted) setState(() => _busy = false);
@@ -170,7 +166,7 @@ class _ConnectButtonState extends State<ConnectButton>
                   color: Color.fromARGB(glowAlpha, 255, 214, 0),
                   blurRadius: glowRadius,
                   spreadRadius: glowRadius * 0.3,
-                )
+                ),
               ]
             : [],
       ),

lib/components/notification.dart

@@ -1,93 +0,0 @@
-import 'dart:io';
-import 'dart:ui' as ui;
-import 'package:flutter_local_notifications/flutter_local_notifications.dart';
-
-class VpnNotificationManager {
-  static final FlutterLocalNotificationsPlugin _plugin =
-      FlutterLocalNotificationsPlugin();
-  static bool _initialized = false;
-  static String? _lastTimeLeft;
-  static String? _lastSpeedKbps;
-
-  // Android channels are immutable — bump this if settings change.
-  static const _channelId = 'revolt_vpn_v4';
-  static const _channelName = 'Revolt VPN';
-  static const _notifId = 888;
-
-  static Future<void> init() async {
-    if (_initialized) return;
-
-    const androidSettings =
-        AndroidInitializationSettings('@drawable/notification_icon');
-    const initSettings = InitializationSettings(android: androidSettings);
-
-    await _plugin.initialize(initSettings);
-
-    if (Platform.isAndroid) {
-      final androidPlugin = _plugin
-          .resolvePlatformSpecificImplementation<
-              AndroidFlutterLocalNotificationsPlugin>();
-      await androidPlugin?.requestNotificationsPermission();
-    }
-
-    _initialized = true;
-  }
-
-  static Future<void> showOrUpdateStatus({
-    required String timeLeft,
-    required String speedKbps,
-  }) async {
-    if (timeLeft == _lastTimeLeft && speedKbps == _lastSpeedKbps) return;
-    _lastTimeLeft = timeLeft;
-    _lastSpeedKbps = speedKbps;
-
-    if (!_initialized) await init();
-
-    final bodyText = 'Time: $timeLeft  •  $speedKbps';
-
-    final bigPictureStyle = BigPictureStyleInformation(
-      const DrawableResourceAndroidBitmap('notification_banner'),
-      largeIcon: const DrawableResourceAndroidBitmap('notification_icon'),
-      contentTitle: 'Revolt VPN',
-      summaryText: bodyText,
-      htmlFormatContentTitle: false,
-      htmlFormatSummaryText: false,
-    );
-
-    final androidDetails = AndroidNotificationDetails(
-      _channelId,
-      _channelName,
-      channelDescription: 'Session timer and speed',
-      importance: Importance.low,
-      priority: Priority.low,
-      ongoing: true,
-      autoCancel: false,
-      playSound: false,
-      enableVibration: false,
-      showWhen: false,
-      visibility: NotificationVisibility.public,
-      usesChronometer: false,
-      category: AndroidNotificationCategory.service,
-      colorized: true,
-      color: const ui.Color(0xFF0D1117),
-      styleInformation: bigPictureStyle,
-    );
-
-    final details = NotificationDetails(android: androidDetails);
-
-    try {
-      await _plugin.show(_notifId, _channelName, bodyText, details);
-    } catch (e) {
-      _initialized = false;
-      try {
-        await init();
-        await _plugin.show(_notifId, _channelName, bodyText, details);
-      } catch (_) {}
-    }
-  }
-
-  static Future<void> cancel() async {
-    if (!_initialized) return;
-    await _plugin.cancel(_notifId);
-  }
-}

lib/components/sidebar_drawer.dart

@@ -141,7 +141,10 @@ class _SidebarDrawerState extends State<SidebarDrawer> {
                 final messenger = ScaffoldMessenger.of(context);
                 Navigator.of(context).pop();
                 unawaited(
-                  Updater.check(navigator: navigator, messenger: messenger),
+                  Updater.checkWithHandles(
+                    navigator: navigator,
+                    messenger: messenger,
+                  ),
                 );
               },
             ),

lib/components/status_bar.dart

@@ -7,16 +7,6 @@ import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/components/online_dot.dart';
 import 'package:revoltvpn/screens/server_selector/selection_screen.dart';
 
-// ── lib/components/status_bar.dart ──────────────────────────────────────────
-// Two-card layout at the bottom of the main screen.
-//
-// Top card:   server location from ServerList provider (flag + city).
-//             Tappable → opens server selector. Always visible.
-// Bottom card: connection status (health dot + label + lock icon).
-//
-// Separated into two rows — no more RenderFlex overflow and ready for
-// multi-server picker.
-
 class StatusBar extends StatelessWidget {
   const StatusBar({super.key});
 
@@ -28,15 +18,14 @@ class StatusBar extends StatelessWidget {
         final isConnecting = vpn.status == VpnStatus.connecting;
         final serverHealthy =
             vpn.serverReachable || (isConnected && timer.hasSyncedOnce);
+        final sessionOrTunnelHealthy = timer.hasSyncedOnce || vpn.serverReachable;
 
         final statusLabel = isConnected
-            ? (timer.hasSyncedOnce ? 'Online' : 'Syncing…')
+            ? (sessionOrTunnelHealthy ? 'Online' : 'Syncing…')
             : (isConnecting
                 ? 'Connecting…'
                 : (vpn.serverReachable ? 'Ready' : 'Offline'));
 
-        // Read from the ServerList provider — the source of truth for
-        // which server is selected and what it looks like.
         final server = context.watch<ServerList>().selected;
 
         return Padding(
@@ -44,7 +33,6 @@ class StatusBar extends StatelessWidget {
           child: Column(
             mainAxisSize: MainAxisSize.min,
             children: [
-              // ── Server location ──────────────────────────────────────────
               GestureDetector(
                 onTap: () {
                   Navigator.of(context).push(
@@ -56,10 +44,12 @@ class StatusBar extends StatelessWidget {
                           position: Tween<Offset>(
                             begin: const Offset(1.0, 0.0),
                             end: Offset.zero,
-                          ).animate(CurvedAnimation(
+                          ).animate(
+                            CurvedAnimation(
                               parent: animation,
                               curve: Curves.easeOut,
-                          )),
+                            ),
+                          ),
                           child: child,
                         );
                       },
@@ -79,24 +69,26 @@ class StatusBar extends StatelessWidget {
                       Image.asset(server.flagAsset, width: 20, height: 20),
                       const SizedBox(width: 8),
                       Expanded(
-                        child: Text(server.name,
+                        child: Text(
+                          server.name,
                           style: const TextStyle(
                             color: AppColors.accent,
                             fontWeight: FontWeight.w600,
                             fontSize: 13,
                             letterSpacing: 0.5,
-                            )),
                           ),
-                      const Icon(Icons.chevron_right,
-                          color: AppColors.textDim, size: 20),
+                        ),
+                      ),
+                      const Icon(
+                        Icons.chevron_right,
+                        color: AppColors.textDim,
+                        size: 20,
+                      ),
                     ],
                   ),
                 ),
               ),
-
               const SizedBox(height: 8),
-
-              // ── Connection status ────────────────────────────────────────
               Container(
                 padding:
                     const EdgeInsets.symmetric(horizontal: 20, vertical: 10),
@@ -112,9 +104,24 @@ class StatusBar extends StatelessWidget {
                       label: statusLabel,
                     ),
                     const Spacer(),
+                    if (vpn.networkTransport != 'unknown' &&
+                        vpn.networkTransport != 'none')
+                      Padding(
+                        padding: const EdgeInsets.only(right: 8),
+                        child: Text(
+                          vpn.networkTransport,
+                          style: const TextStyle(
+                            color: AppColors.textDim,
+                            fontSize: 11,
+                          ),
+                        ),
+                      ),
                     if (isConnected)
-                      const Icon(Icons.lock,
-                          color: AppColors.green50, size: 14),
+                      const Icon(
+                        Icons.lock,
+                        color: AppColors.green50,
+                        size: 14,
+                      ),
                   ],
                 ),
               ),

lib/components/support_button.dart

@@ -20,13 +20,21 @@ class _SupportButtonState extends State<SupportButton> {
     final ad = context.read<AdManager>();
     final timer = context.read<SessionTimer>();
 
-    // Only available when there's an active session.
-    if (!timer.isRunning && !timer.hasSyncedOnce) return;
+    // Only available when there's an active session, once the persisted
+    // support state is known, and only once per client-side VPN session.
+    if ((!timer.isRunning && !timer.hasSyncedOnce) ||
+        !timer.supportRewardStateLoaded ||
+        timer.supportRewardClaimed) {
+      return;
+    }
 
     setState(() => _busy = true);
 
     try {
-      await ad.showAd('support');
+      final rewarded = await ad.showAd('support');
+      if (rewarded) {
+        await timer.markSupportRewardClaimed();
+      }
     } finally {
       if (mounted) setState(() => _busy = false);
     }
@@ -34,15 +42,20 @@ class _SupportButtonState extends State<SupportButton> {
 
   @override
   Widget build(BuildContext context) {
-    return Selector<SessionTimer, bool>(
-      selector: (_, timer) => timer.isRunning || timer.hasSyncedOnce,
-      builder: (context, visible, _) {
-        if (!visible) {
+    return Consumer<SessionTimer>(
+      builder: (context, timer, _) {
+        if (!timer.isRunning && !timer.hasSyncedOnce) {
           return const SizedBox.shrink();
         }
 
+        final stateLoaded = timer.supportRewardStateLoaded;
+        final claimed = timer.supportRewardClaimed;
+        final disabled = !stateLoaded || claimed;
+
         return GestureDetector(
-          onTap: _handleTap,
+          onTap: disabled ? null : _handleTap,
+          child: Opacity(
+            opacity: disabled ? 0.55 : 1.0,
             child: Container(
               padding: const EdgeInsets.symmetric(horizontal: 20, vertical: 10),
               decoration: BoxDecoration(
@@ -56,7 +69,11 @@ class _SupportButtonState extends State<SupportButton> {
               child: Row(
                 mainAxisSize: MainAxisSize.min,
                 children: [
-                const Icon(Icons.favorite_border, color: AppColors.accent, size: 20),
+                  Icon(
+                    claimed ? Icons.check_circle_outline : Icons.favorite_border,
+                    color: AppColors.accent,
+                    size: 20,
+                  ),
                   const SizedBox(width: 8),
                   _busy
                       ? const SizedBox(
@@ -67,9 +84,13 @@ class _SupportButtonState extends State<SupportButton> {
                             color: AppColors.accent,
                           ),
                         )
-                    : const Text(
-                        'Support us \u2014 30 min!',
-                        style: TextStyle(
+                      : Text(
+                          !stateLoaded
+                              ? 'Checking support bonus…'
+                              : claimed
+                                  ? 'Support bonus used'
+                                  : 'Support us — 30 min!',
+                          style: const TextStyle(
                             color: AppColors.textWhite,
                             fontSize: 14,
                             fontWeight: FontWeight.w600,
@@ -78,6 +99,7 @@ class _SupportButtonState extends State<SupportButton> {
                 ],
               ),
             ),
+          ),
         );
       },
     );

lib/logic/app_config.example.dart

@@ -29,8 +29,8 @@ abstract final class AppConfig {
   // ── Updates ────────────────────────────────────────────────────────────
   /// Used by the updater.
   static const String applicationId = 'com.paladinvpn.app';   // ◄── REPLACE
-  static const String githubOwner   = 'YOUR_USERNAME';        // ◄── REPLACE
-  static const String githubRepo    = 'revoltvpn';            // ◄── REPLACE
+  static const String githubOwner   = 'YOUR_GITHUB_USERNAME'; // ◄── REPLACE (current: 'esefxdz')
+  static const String githubRepo    = 'YOUR_REPO_NAME';       // ◄── REPLACE (current: 'ReVoltVPN')
 
   /// Fallback URL if the GitHub API call fails.
   static const String githubReleasesUrl = 'https://github.com/$githubOwner/$githubRepo/releases/latest';

lib/logic/connection_settings.dart

@@ -0,0 +1,40 @@
+import 'package:shared_preferences/shared_preferences.dart';
+
+enum ConnectionMode { tun, proxy }
+
+abstract final class ConnectionSettings {
+  ConnectionSettings._();
+
+  static const String _modeKey = 'connection_mode';
+
+  static ConnectionMode _mode = ConnectionMode.tun;
+  static bool _initialized = false;
+
+  static ConnectionMode get mode => _mode;
+
+  static Future<void> initialize() async {
+    if (_initialized) return;
+
+    final prefs = await SharedPreferences.getInstance();
+    final storedMode = prefs.getString(_modeKey);
+
+    // Legacy 'ass' was the pre-V3 SOCKS5 label; map it to proxy. Everything
+    // else (including the old 'auto') is TUN — there is no runtime auto mode.
+    _mode = storedMode == ConnectionMode.proxy.name || storedMode == 'ass'
+        ? ConnectionMode.proxy
+        : ConnectionMode.tun;
+
+    if (storedMode != _mode.name) {
+      await prefs.setString(_modeKey, _mode.name);
+    }
+
+    _initialized = true;
+  }
+
+  static Future<void> setMode(ConnectionMode mode) async {
+    _mode = mode;
+    _initialized = true;
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setString(_modeKey, mode.name);
+  }
+}

lib/logic/crypto_service.dart

@@ -4,11 +4,17 @@ import 'package:uuid/uuid.dart';
 class CryptoService {
   static const String _deviceIdPref = 'device_uuid';
   static const _storage = FlutterSecureStorage();
+  static final RegExp _uuidV4 = RegExp(
+    r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$',
+    caseSensitive: false,
+  );
 
   /// Get or create a persistent device UUID for server-side session tracking.
+  /// Corrupted or tampered storage values are replaced instead of being sent
+  /// to the public API as arbitrary query data.
   static Future<String> getDeviceId() async {
     final existing = await _storage.read(key: _deviceIdPref);
-    if (existing != null) return existing;
+    if (existing != null && _uuidV4.hasMatch(existing)) return existing;
 
     final newId = const Uuid().v4();
     await _storage.write(key: _deviceIdPref, value: newId);

lib/logic/haptic_settings.dart

@@ -0,0 +1,72 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+abstract final class HapticSettings {
+  HapticSettings._();
+
+  static const String _prefKey = 'haptic_feedback_enabled';
+  static const MethodChannel _channel =
+      MethodChannel('com.revoltvpn.app/haptics');
+
+  static bool _enabled = false;
+  static bool _initialized = false;
+
+  static bool get enabled => _enabled;
+
+  static Future<void> initialize() async {
+    if (_initialized) return;
+
+    try {
+      final prefs = await SharedPreferences.getInstance();
+      _enabled = prefs.getBool(_prefKey) ?? false;
+    } catch (e) {
+      debugPrint('[Haptics] Failed to load preference: $e');
+      _enabled = false;
+    } finally {
+      _initialized = true;
+    }
+  }
+
+  static Future<void> setEnabled(bool value) async {
+    final previous = _enabled;
+    _enabled = value;
+    _initialized = true;
+
+    try {
+      final prefs = await SharedPreferences.getInstance();
+      final saved = await prefs.setBool(_prefKey, value);
+      if (!saved) throw StateError('Could not save haptic setting');
+    } catch (e) {
+      _enabled = previous;
+      debugPrint('[Haptics] Failed to save preference: $e');
+      rethrow;
+    }
+  }
+
+  /// Confirmation haptic for a successful connect/disconnect. Best-effort: a
+  /// vibration failure must never block or fail the VPN action.
+  static void success() => unawaited(_impact());
+
+  static Future<void> _impact() async {
+    if (!_initialized) await initialize();
+    if (!_enabled || kIsWeb) return;
+
+    if (defaultTargetPlatform == TargetPlatform.android) {
+      try {
+        final handled = await _channel.invokeMethod<bool>(
+              'impact',
+              <String, Object>{'kind': 'success'},
+            ) ??
+            false;
+        if (handled) return;
+      } catch (e) {
+        debugPrint('[Haptics] Native vibration unavailable: $e');
+      }
+    }
+
+    await HapticFeedback.mediumImpact();
+  }
+}

lib/logic/hivemind_service.dart

@@ -1,6 +1,7 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:math';
+
 import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:revoltvpn/logic/app_config.dart';
@@ -12,14 +13,21 @@ class HivemindService {
 
   static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 '
       '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36';
+  static const _pollBackoff = <Duration>[
+    Duration(seconds: 1),
+    Duration(seconds: 2),
+    Duration(seconds: 3),
+    Duration(seconds: 5),
+  ];
 
-  static Future<http.Response> directGet(Uri uri, {Duration timeout = const Duration(seconds: 5)}) {
+  static Future<http.Response> directGet(
+    Uri uri, {
+    Duration timeout = const Duration(seconds: 5),
+  }) {
     return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout);
   }
 
-  static void cancel() {
-    _currentCallId++;
-  }
+  static void cancel() => _currentCallId++;
 
   static void setExpectedNonce(String nonce) {
     _expectedNonce = nonce;
@@ -30,66 +38,34 @@ class HivemindService {
     bool skipAdBypass = false,
   }) async {
     final deviceId = await CryptoService.getDeviceId();
-
     final callId = ++_currentCallId;
-    final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+    final nonce = _newNonce();
     _expectedNonce = nonce;
-    debugPrint('[HivemindService] Call #$callId — nonce: $nonce');
-
-    final url = _publicUrl('/session/status?device_id=$deviceId');
 
     if (!skipAdBypass) {
-      try {
-        final customData = jsonEncode({'device_id': deviceId, 'nonce': nonce});
-        final fakeUrl = _publicUrl(
-            '/admob/callback?signature=test&key_id=test&custom_data=${Uri.encodeComponent(customData)}');
-        await directGet(fakeUrl, timeout: const Duration(seconds: 8));
-      } catch (_) {}
+      await _runConfiguredBypass(deviceId, nonce);
     }
 
     const maxAttempts = 5;
-    for (int i = 1; i <= maxAttempts; i++) {
-      if (_currentCallId != callId) throw Exception('Cancelled');
+    for (var attempt = 1; attempt <= maxAttempts; attempt++) {
+      _throwIfCancelled(callId);
+      onAttempt?.call(attempt, maxAttempts);
 
-      onAttempt?.call(i, maxAttempts);
       try {
-        final response = await directGet(url);
-        if (response.statusCode == 200) {
-          final data = jsonDecode(response.body);
-
-          final serverNonce = data['nonce'] as String?;
-          if (_expectedNonce != null && serverNonce != null && serverNonce != _expectedNonce) {
-            debugPrint('[HivemindService] Nonce mismatch — retrying…');
-          } else if (data['active'] == true && data['vless_uuid'] != null) {
-            final vlessUuid = data['vless_uuid'];
-            final vlessIp   = data['vless_ip'] ?? AppConfig.serverIp;
-            final vlessPort = data['vless_port'] ?? 443;
-            final pbk       = data['reality_pbk'] ?? '';
-            final sid       = data['reality_sid'] ?? '';
-            final sni       = data['reality_sni'];
-            if (sni == null) throw Exception('Server did not provide reality_sni');
-            final fp        = data['reality_fp']  ?? AppConfig.realityFp;
-            final xhttpPath = data['xhttp_path']  ?? AppConfig.vlessPath;
-
-            final vlessUrl = 'vless://$vlessUuid@$vlessIp:$vlessPort'
-                '?security=${AppConfig.vlessSecurity}'
-                '&type=${AppConfig.vlessType}'
-                '&path=$xhttpPath'
-                '&pbk=${Uri.encodeComponent(pbk)}'
-                '&sni=${Uri.encodeComponent(sni)}'
-                '&sid=${Uri.encodeComponent(sid)}'
-                '&fp=${Uri.encodeComponent(fp)}'
-                '#Revolt VPN';
+        final session = await _fetchActiveSession(deviceId, nonce);
+        if (session != null) {
           _expectedNonce = null;
-            return vlessUrl;
-          }
+          return session.toVlessUrl();
         }
       } catch (e) {
-        if (e.toString().contains('Cancelled')) rethrow;
-        debugPrint('[HivemindService] Attempt $i failed: $e');
+        if (_isCancelledError(e)) rethrow;
+        debugPrint('[Hivemind] session attempt $attempt failed');
       }
 
-      if (i < maxAttempts) await Future.delayed(const Duration(seconds: 1));
+      if (attempt < maxAttempts) {
+        await Future.delayed(_pollBackoff[attempt - 1]);
+        _throwIfCancelled(callId);
+      }
     }
 
     throw Exception('Session not activated. Server callback may have timed out.');
@@ -97,16 +73,139 @@ class HivemindService {
 
   static Future<bool> checkHealth() async {
     try {
-      final url = Uri.parse('${AppConfig.hivemindApiPublic}/health');
-      final response = await directGet(url, timeout: const Duration(seconds: 3));
+      final response = await directGet(
+        _publicUrl('/health'),
+        timeout: const Duration(seconds: 3),
+      );
       return response.statusCode == 200;
     } catch (_) {
       return false;
     }
   }
 
-  // ── URL builders ──────────────────────────────────────────────────
+  static String _newNonce() {
+    final random = Random.secure();
+    final high = random.nextInt(0x7FFFFFFF);
+    final low = random.nextInt(0x7FFFFFFF);
+    return '$high-$low-${DateTime.now().microsecondsSinceEpoch}';
+  }
+
+  static Future<void> _runConfiguredBypass(String deviceId, String nonce) async {
+    try {
+      final customData = jsonEncode({'device_id': deviceId, 'nonce': nonce});
+      final callback = _publicUrl(
+        '/admob/callback?signature=test&key_id=test&custom_data=${Uri.encodeComponent(customData)}',
+      );
+      await directGet(callback, timeout: const Duration(seconds: 8));
+    } catch (_) {
+      // Validation bypass behavior is intentionally best-effort in this build.
+    }
+  }
+
+  static Future<_HivemindSessionConfig?> _fetchActiveSession(
+    String deviceId,
+    String nonce,
+  ) async {
+    final statusUri = _publicUrl('/session/status').replace(
+      queryParameters: {'device_id': deviceId},
+    );
+    final response = await directGet(statusUri);
+    if (response.statusCode != 200) return null;
+
+    final decoded = jsonDecode(response.body);
+    if (decoded is! Map<String, dynamic>) return null;
+
+    final serverNonce = decoded['nonce'];
+    if (_expectedNonce != null &&
+        serverNonce is String &&
+        serverNonce != nonce) {
+      return null;
+    }
+
+    if (decoded['active'] != true || decoded['vless_uuid'] == null) {
+      return null;
+    }
+
+    return _HivemindSessionConfig.fromJson(decoded);
+  }
+
+  static void _throwIfCancelled(int callId) {
+    if (_currentCallId != callId) throw Exception('Cancelled');
+  }
+
+  static bool _isCancelledError(Object error) =>
+      error.toString().contains('Cancelled');
 
   static Uri _publicUrl(String path) =>
       Uri.parse('${AppConfig.hivemindApiPublic}$path');
 }
+
+class _HivemindSessionConfig {
+  final String uuid;
+  final String host;
+  final int port;
+  final String publicKey;
+  final String shortId;
+  final String sni;
+  final String fingerprint;
+  final String path;
+
+  const _HivemindSessionConfig({
+    required this.uuid,
+    required this.host,
+    required this.port,
+    required this.publicKey,
+    required this.shortId,
+    required this.sni,
+    required this.fingerprint,
+    required this.path,
+  });
+
+  factory _HivemindSessionConfig.fromJson(Map<String, dynamic> json) {
+    final uuid = _requiredString(json, 'vless_uuid');
+    final host = _stringOr(json['vless_ip'], AppConfig.serverIp);
+    final port = _portOr(json['vless_port'], 443);
+    final sni = _requiredString(json, 'reality_sni');
+
+    return _HivemindSessionConfig(
+      uuid: uuid,
+      host: host,
+      port: port,
+      publicKey: _stringOr(json['reality_pbk'], ''),
+      shortId: _stringOr(json['reality_sid'], ''),
+      sni: sni,
+      fingerprint: _stringOr(json['reality_fp'], AppConfig.realityFp),
+      path: _stringOr(json['xhttp_path'], AppConfig.vlessPath),
+    );
+  }
+
+  String toVlessUrl() {
+    return 'vless://$uuid@$host:$port'
+        '?security=${AppConfig.vlessSecurity}'
+        '&type=${AppConfig.vlessType}'
+        '&path=$path'
+        '&pbk=${Uri.encodeComponent(publicKey)}'
+        '&sni=${Uri.encodeComponent(sni)}'
+        '&sid=${Uri.encodeComponent(shortId)}'
+        '&fp=${Uri.encodeComponent(fingerprint)}'
+        '#Revolt VPN';
+  }
+
+  static String _requiredString(Map<String, dynamic> json, String key) {
+    final value = json[key];
+    if (value is String && value.trim().isNotEmpty) return value.trim();
+    throw FormatException('Missing required session field: $key');
+  }
+
+  static String _stringOr(Object? value, String fallback) {
+    return value is String && value.isNotEmpty ? value : fallback;
+  }
+
+  static int _portOr(Object? value, int fallback) {
+    final parsed = value is num ? value.toInt() : fallback;
+    if (parsed <= 0 || parsed > 65535) {
+      throw const FormatException('Invalid VLESS port');
+    }
+    return parsed;
+  }
+}

lib/logic/local_socks_tester.dart

@@ -0,0 +1,274 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+class LocalSocksTestResult {
+  final bool ok;
+  final int? latencyMs;
+  final String message;
+
+  const LocalSocksTestResult({
+    required this.ok,
+    required this.latencyMs,
+    required this.message,
+  });
+}
+
+abstract final class LocalSocksTester {
+  LocalSocksTester._();
+
+  /// Fast local readiness probe used while starting the VPN.
+  ///
+  /// This stops after SOCKS5 authentication. Startup must not depend on an
+  /// unrelated external host being reachable.
+  static Future<LocalSocksTestResult> testListener({
+    String host = '127.0.0.1',
+    int port = 10807,
+    String? username,
+    String? password,
+  }) async {
+    final stopwatch = Stopwatch()..start();
+    Socket? socket;
+    _SocketReader? reader;
+
+    try {
+      socket = await Socket.connect(
+        host,
+        port,
+        timeout: const Duration(seconds: 1),
+      );
+      socket.setOption(SocketOption.tcpNoDelay, true);
+      reader = _SocketReader(socket);
+
+      final authenticated = await _authenticate(
+        reader,
+        socket,
+        username: username,
+        password: password,
+        timeout: const Duration(seconds: 1),
+      );
+      if (!authenticated) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'Local SOCKS5 listener rejected authentication.',
+        );
+      }
+
+      stopwatch.stop();
+      return LocalSocksTestResult(
+        ok: true,
+        latencyMs: stopwatch.elapsedMilliseconds,
+        message: 'Local SOCKS5 listener is ready.',
+      );
+    } on TimeoutException {
+      return const LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 listener timed out.',
+      );
+    } on SocketException {
+      return LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 is not listening on $host:$port.',
+      );
+    } catch (_) {
+      return const LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 listener check failed.',
+      );
+    } finally {
+      await reader?.close();
+      await socket?.close();
+    }
+  }
+
+  /// Full user-facing test: authenticated local SOCKS handshake plus outbound
+  /// CONNECT. Credentials are optional so the helper remains usable for legacy
+  /// no-auth diagnostic builds.
+  static Future<LocalSocksTestResult> test({
+    String host = '127.0.0.1',
+    int port = 10807,
+    String? username,
+    String? password,
+    String targetHost = 'paladinvpn.duckdns.org',
+    int targetPort = 443,
+  }) async {
+    final stopwatch = Stopwatch()..start();
+    Socket? socket;
+    _SocketReader? reader;
+
+    try {
+      socket = await Socket.connect(
+        host,
+        port,
+        timeout: const Duration(seconds: 3),
+      );
+      socket.setOption(SocketOption.tcpNoDelay, true);
+      reader = _SocketReader(socket);
+
+      final authenticated = await _authenticate(
+        reader,
+        socket,
+        username: username,
+        password: password,
+      );
+      if (!authenticated) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'Local SOCKS5 listener rejected authentication.',
+        );
+      }
+
+      final hostBytes = utf8.encode(targetHost);
+      if (hostBytes.isEmpty || hostBytes.length > 255) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message: 'SOCKS5 test target is invalid.',
+        );
+      }
+
+      socket.add(<int>[
+        0x05,
+        0x01,
+        0x00,
+        0x03,
+        hostBytes.length,
+        ...hostBytes,
+        (targetPort >> 8) & 0xff,
+        targetPort & 0xff,
+      ]);
+      await socket.flush();
+
+      final replyHead = await reader.readExactly(4);
+      if (replyHead[0] != 0x05 || replyHead[1] != 0x00) {
+        return const LocalSocksTestResult(
+          ok: false,
+          latencyMs: null,
+          message:
+              'SOCKS5 is listening, but the ReVolt route could not reach the test target.',
+        );
+      }
+
+      await _consumeAddress(reader, replyHead[3]);
+      stopwatch.stop();
+      return LocalSocksTestResult(
+        ok: true,
+        latencyMs: stopwatch.elapsedMilliseconds,
+        message: 'Local SOCKS5 and the ReVolt outbound are reachable.',
+      );
+    } on TimeoutException {
+      return const LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 test timed out.',
+      );
+    } on SocketException {
+      return LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 is not listening on $host:$port.',
+      );
+    } catch (_) {
+      return const LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'Local SOCKS5 test failed.',
+      );
+    } finally {
+      await reader?.close();
+      await socket?.close();
+    }
+  }
+
+  static Future<bool> _authenticate(
+    _SocketReader reader,
+    Socket socket, {
+    required String? username,
+    required String? password,
+    Duration timeout = const Duration(seconds: 4),
+  }) async {
+    final passwordAuth = username != null && password != null;
+    if ((username == null) != (password == null)) return false;
+
+    socket.add(passwordAuth
+        ? const <int>[0x05, 0x01, 0x02]
+        : const <int>[0x05, 0x01, 0x00]);
+    await socket.flush();
+
+    final greeting = await reader.readExactly(2, timeout: timeout);
+    if (greeting[0] != 0x05) return false;
+    if (!passwordAuth) return greeting[1] == 0x00;
+    if (greeting[1] != 0x02) return false;
+
+    final userBytes = utf8.encode(username);
+    final passBytes = utf8.encode(password);
+    if (userBytes.isEmpty ||
+        passBytes.isEmpty ||
+        userBytes.length > 255 ||
+        passBytes.length > 255) {
+      return false;
+    }
+
+    socket.add(<int>[
+      0x01,
+      userBytes.length,
+      ...userBytes,
+      passBytes.length,
+      ...passBytes,
+    ]);
+    await socket.flush();
+
+    final authReply = await reader.readExactly(2, timeout: timeout);
+    return authReply[0] == 0x01 && authReply[1] == 0x00;
+  }
+
+  static Future<void> _consumeAddress(
+      _SocketReader reader, int addressType) async {
+    if (addressType == 0x01) {
+      await reader.readExactly(4 + 2);
+      return;
+    }
+    if (addressType == 0x04) {
+      await reader.readExactly(16 + 2);
+      return;
+    }
+    if (addressType == 0x03) {
+      final length = (await reader.readExactly(1)).first;
+      await reader.readExactly(length + 2);
+      return;
+    }
+    throw const FormatException('Unsupported SOCKS5 address type');
+  }
+}
+
+class _SocketReader {
+  final StreamIterator<Uint8List> _iterator;
+  final List<int> _buffer = <int>[];
+
+  _SocketReader(Socket socket) : _iterator = StreamIterator<Uint8List>(socket);
+
+  Future<List<int>> readExactly(
+    int count, {
+    Duration timeout = const Duration(seconds: 4),
+  }) async {
+    while (_buffer.length < count) {
+      final hasNext = await _iterator.moveNext().timeout(timeout);
+      if (!hasNext) {
+        throw const SocketException('Socket closed early');
+      }
+      _buffer.addAll(_iterator.current);
+    }
+
+    final result = _buffer.sublist(0, count);
+    _buffer.removeRange(0, count);
+    return result;
+  }
+
+  Future<void> close() => _iterator.cancel();
+}

lib/logic/network_monitor.dart

@@ -0,0 +1,42 @@
+import 'package:flutter/services.dart';
+
+class NetworkSnapshot {
+  final String reason;
+  final String transport;
+  final bool connected;
+  final bool validated;
+  final bool metered;
+  final int timestamp;
+
+  const NetworkSnapshot({
+    required this.reason,
+    required this.transport,
+    required this.connected,
+    required this.validated,
+    required this.metered,
+    required this.timestamp,
+  });
+
+  factory NetworkSnapshot.fromMap(Map<dynamic, dynamic> map) {
+    return NetworkSnapshot(
+      reason: map['reason'] as String? ?? 'changed',
+      transport: map['transport'] as String? ?? 'unknown',
+      connected: map['connected'] == true,
+      validated: map['validated'] == true,
+      metered: map['metered'] == true,
+      timestamp: (map['timestamp'] as num?)?.toInt() ?? 0,
+    );
+  }
+}
+
+abstract final class NetworkMonitor {
+  NetworkMonitor._();
+
+  static const EventChannel _channel = EventChannel('com.revoltvpn.app/network');
+
+  static Stream<NetworkSnapshot> get changes {
+    return _channel.receiveBroadcastStream().where((event) => event is Map).map(
+          (event) => NetworkSnapshot.fromMap(event as Map<dynamic, dynamic>),
+        );
+  }
+}

lib/logic/power_settings.dart

@@ -0,0 +1,90 @@
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+
+/// Background-survival controls.
+///
+/// Android stops background services of apps that are not exempt from Doze and
+/// App Standby, and it tears down the whole process group when a task is swiped
+/// away. Those are OS behaviours, not app bugs, and the OS provides exactly two
+/// sanctioned ways around them: a battery-optimisation exemption, and the
+/// system's own Always-on VPN. Both need one user tap; neither can be forced.
+abstract final class PowerSettings {
+  PowerSettings._();
+
+  static const MethodChannel _channel = MethodChannel(
+    'com.revoltvpn.app/power',
+  );
+
+  /// Whether the OS has exempted this app from Doze / App Standby.
+  static Future<bool> isBatteryOptimisationDisabled() async {
+    if (kIsWeb) return true;
+    try {
+      return await _channel.invokeMethod<bool>(
+            'isIgnoringBatteryOptimizations',
+          ) ??
+          false;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Shows the system exemption dialog. Returns false only when no system UI
+  /// could be opened at all — a user declining still returns true.
+  static Future<bool> requestDisableBatteryOptimisation() async {
+    if (kIsWeb) return true;
+    try {
+      return await _channel.invokeMethod<bool>(
+            'requestIgnoreBatteryOptimizations',
+          ) ??
+          false;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Opens the OS VPN settings screen, where Always-on VPN is configured.
+  static Future<bool> openVpnSettings() async {
+    if (kIsWeb) return false;
+    try {
+      return await _channel.invokeMethod<bool>('openVpnSettings') ?? false;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Whether the VPN runtime is genuinely alive.
+  ///
+  /// The Xray service runs in a separate process, so nothing it stores in
+  /// statics is visible to us. This asks the OS instead: is our service process
+  /// running, and (for TUN) is there an active VPN transport?
+  static Future<VpnRuntimeState> runtimeState() async {
+    if (kIsWeb) return const VpnRuntimeState(processAlive: false, vpnTransport: false);
+    try {
+      final result = await _channel.invokeMapMethod<String, dynamic>(
+        'isVpnRuntimeAlive',
+      );
+      return VpnRuntimeState(
+        processAlive: result?['processAlive'] == true,
+        vpnTransport: result?['vpnTransport'] == true,
+      );
+    } catch (_) {
+      return const VpnRuntimeState(processAlive: false, vpnTransport: false);
+    }
+  }
+}
+
+@immutable
+class VpnRuntimeState {
+  final bool processAlive;
+  final bool vpnTransport;
+
+  const VpnRuntimeState({
+    required this.processAlive,
+    required this.vpnTransport,
+  });
+
+  /// TUN needs both a live service and a real VPN interface. Proxy mode has no
+  /// VPN interface at all, so the service process is the whole signal.
+  bool aliveFor({required bool tunMode}) =>
+      processAlive && (!tunMode || vpnTransport);
+}

lib/logic/secure_socks_session.dart

@@ -0,0 +1,89 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:math';
+
+class SecureSocksSession {
+  static const String inboundTag = 'revolt-secure-socks';
+  static final Random _random = Random.secure();
+
+  final int port;
+  final String username;
+  final String password;
+  final String configJson;
+
+  const SecureSocksSession._({
+    required this.port,
+    required this.username,
+    required this.password,
+    required this.configJson,
+  });
+
+  static Future<SecureSocksSession> create(String baseConfig) async {
+    final decoded = jsonDecode(baseConfig);
+    if (decoded is! Map<String, dynamic>) {
+      throw const FormatException('VLESS configuration must be a JSON object.');
+    }
+
+    final reservation = await ServerSocket.bind(
+      InternetAddress.loopbackIPv4,
+      0,
+      shared: false,
+    );
+    final port = reservation.port;
+    await reservation.close();
+
+    if (port <= 1024 || port > 65535) {
+      throw StateError('Could not allocate a safe local SOCKS5 port.');
+    }
+
+    final username = _token(16);
+    final password = _token(32);
+
+    final sourceInbounds = decoded['inbounds'];
+    final inbounds = <dynamic>[];
+    if (sourceInbounds is List) {
+      for (final value in sourceInbounds) {
+        if (value is Map) {
+          final protocol = value['protocol']?.toString().toLowerCase();
+          // ReVolt owns local proxy ingress on Android. Drop imported SOCKS/HTTP
+          // listeners so a stale no-auth proxy cannot remain reachable beside
+          // the authenticated session listener.
+          if (protocol == 'socks' || protocol == 'http') continue;
+        }
+        inbounds.add(value);
+      }
+    }
+
+    inbounds.add(<String, dynamic>{
+      'tag': inboundTag,
+      'port': port,
+      'listen': '127.0.0.1',
+      'protocol': 'socks',
+      'settings': <String, dynamic>{
+        'auth': 'password',
+        'udp': true,
+        'ip': '127.0.0.1',
+        'users': <Map<String, String>>[
+          <String, String>{'user': username, 'pass': password},
+        ],
+      },
+      'sniffing': <String, dynamic>{
+        'enabled': true,
+        'destOverride': <String>['http', 'tls'],
+      },
+    });
+    decoded['inbounds'] = inbounds;
+
+    return SecureSocksSession._(
+      port: port,
+      username: username,
+      password: password,
+      configJson: jsonEncode(decoded),
+    );
+  }
+
+  static String _token(int byteCount) {
+    final bytes = List<int>.generate(byteCount, (_) => _random.nextInt(256));
+    return bytes.map((value) => value.toRadixString(16).padLeft(2, '0')).join();
+  }
+}

lib/logic/session_timer.dart

@@ -1,11 +1,13 @@
 import 'dart:async';
 import 'dart:convert';
+
 import 'package:flutter/widgets.dart';
-import 'package:revoltvpn/logic/hivemind_service.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:revoltvpn/logic/app_config.dart';
-import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
+import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/notification_service.dart';
+import 'package:revoltvpn/logic/vpn_connection.dart';
 
 class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   Timer? _timer;
@@ -15,12 +17,20 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   final VpnConnection vpnConnection;
 
   int _remainingSeconds = 0;
+  int _remainingAtLastSync = 0;
   int _usedBytes = 0;
 
   bool _hasSyncedOnce = false;
   int _consecutiveFailures = 0;
   bool _isDisconnecting = false;
   bool _syncInProgress = false;
+  bool _supportRewardClaimed = false;
+  bool _supportRewardStateLoaded = false;
+  int _supportStateEpoch = 0;
+
+  static const String _supportRewardClaimKey =
+      'support_reward_claimed_active_session';
+  static const FlutterSecureStorage _supportStorage = FlutterSecureStorage();
 
   static const int _maxConsecutiveFailures = 3;
   static const int _maxOfflineSeconds = 120;
@@ -30,18 +40,21 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   static const int _backgroundPollIntervalSeconds = 30;
 
   int _lastUsedBytes = 0;
+  DateTime? _lastSuccessfulSyncAt;
   double _currentSpeedKBps = 0.0;
-  DateTime? _lastSyncAt;
 
   SessionTimer({required this.vpnConnection}) {
     WidgetsBinding.instance.addObserver(this);
     vpnConnection.addListener(_onVpnConnectionChanged);
+    unawaited(_loadSupportRewardState());
   }
 
   int get remaining => _remainingSeconds;
   bool get isRunning => _timer != null && _timer!.isActive;
   bool get isExpired => _remainingSeconds <= 0 && !isRunning;
   bool get hasSyncedOnce => _hasSyncedOnce;
+  bool get supportRewardClaimed => _supportRewardClaimed;
+  bool get supportRewardStateLoaded => _supportRewardStateLoaded;
 
   int get usedBytes => _usedBytes;
   double get currentSpeedKBps => _currentSpeedKBps;
@@ -53,68 +66,133 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     return '$h:$m:$s';
   }
 
+  Future<void> _loadSupportRewardState() async {
+    final epoch = _supportStateEpoch;
+    var claimed = false;
+    try {
+      claimed =
+          (await _supportStorage.read(key: _supportRewardClaimKey)) == '1';
+    } catch (e) {
+      debugPrint('[Timer] Failed to load support reward state: $e');
+    }
+
+    if (epoch != _supportStateEpoch) return;
+    _supportRewardClaimed = claimed;
+    _supportRewardStateLoaded = true;
+    notifyListeners();
+  }
+
+  Future<void> _persistSupportRewardState(bool value) async {
+    try {
+      await _supportStorage.write(
+        key: _supportRewardClaimKey,
+        value: value ? '1' : '0',
+      );
+    } catch (e) {
+      debugPrint('[Timer] Failed to persist support reward state: $e');
+    }
+  }
+
+  Future<void> markSupportRewardClaimed() async {
+    if (_supportRewardClaimed) return;
+    _supportRewardClaimed = true;
+    _supportRewardStateLoaded = true;
+    notifyListeners();
+    await _persistSupportRewardState(true);
+  }
+
   void _onVpnConnectionChanged() {
-    // Restore timer if VPN was already running at app launch.
     if (vpnConnection.status == VpnStatus.connected &&
         !isRunning &&
-        vpnConnection.isStartupRestoration) {
+        vpnConnection.adoptedRunningRuntime) {
       _resumeTicking();
       return;
     }
 
-    // Resume after brief tunnel disconnection.
     if (vpnConnection.status == VpnStatus.connected &&
         !isRunning &&
         !_isDisconnecting &&
         _hasSyncedOnce) {
-      debugPrint('[Timer] VPN reconnected after blip — resuming.');
+      debugPrint('[Timer] VPN reconnected after blip - resuming.');
       _resumeTicking();
       return;
     }
 
-    if (vpnConnection.status == VpnStatus.disconnected && !_isDisconnecting) {
-      _doDisconnect('VPN tunnel dropped');
+    final hadActiveSession = isRunning || _hasSyncedOnce;
+    if (!hadActiveSession || _isDisconnecting) return;
+
+    if (vpnConnection.status == VpnStatus.error) {
+      _stopForVpnFailure('VPN entered error state');
+      return;
     }
+
+    if (vpnConnection.status == VpnStatus.disconnected) {
+      unawaited(_doDisconnect('VPN tunnel dropped'));
+    }
+  }
+
+  void _stopForVpnFailure(String reason) {
+    if (_isDisconnecting) return;
+    _isDisconnecting = true;
+    debugPrint('[Timer] Stopping after VPN failure: $reason');
+
+    _timer?.cancel();
+    _timer = null;
+    _currentSpeedKBps = 0.0;
+    _remainingSeconds = 0;
+    _remainingAtLastSync = 0;
+    _hasSyncedOnce = false;
+    _lastSuccessfulSyncAt = null;
+    _consecutiveFailures = 0;
+    _offlineSeconds = 0;
+    NotificationService.reset();
+    notifyListeners();
   }
 
   Future<void> start() async {
     _remainingSeconds = 0;
+    _remainingAtLastSync = 0;
     _usedBytes = 0;
     _lastUsedBytes = 0;
+    _lastSuccessfulSyncAt = null;
     _currentSpeedKBps = 0.0;
-    _lastSyncAt          = null;
-    NotificationService.reset();
     _tickCount = 0;
     _hasSyncedOnce = false;
     _consecutiveFailures = 0;
     _offlineSeconds = 0;
     _isDisconnecting = false;
     _appBackgrounded = false;
+    NotificationService.reset();
+
+    _supportStateEpoch++;
+    _supportRewardClaimed = false;
+    _supportRewardStateLoaded = true;
+    unawaited(_persistSupportRewardState(false));
 
     _timer?.cancel();
     _timer = Timer.periodic(const Duration(seconds: 1), _tick);
 
     notifyListeners();
-    _syncWithHivemind();
+    unawaited(_syncWithHivemind());
   }
 
   void _tick(Timer t) {
     if (_isDisconnecting) return;
-    // A local clock: poll failures are about the network, not the clock.
-    if (_hasSyncedOnce && _remainingSeconds > 0) {
-      _remainingSeconds--;
+
+    if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) {
+      _reconcileElapsedTime();
     }
 
     if (_consecutiveFailures >= _maxConsecutiveFailures) {
       _offlineSeconds++;
       if (_offlineSeconds >= _maxOfflineSeconds) {
-        _doDisconnect('Server unreachable');
+        unawaited(_doDisconnect('Server unreachable'));
         return;
       }
     }
 
     if (_hasSyncedOnce && _remainingSeconds <= 0) {
-      _doDisconnect('Session expired');
+      unawaited(_doDisconnect('Session expired'));
       return;
     }
 
@@ -123,16 +201,12 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
         ? _backgroundPollIntervalSeconds
         : _pollIntervalSeconds;
     if (_tickCount % pollInterval == 0) {
-      _syncWithHivemind();
+      unawaited(_syncWithHivemind());
     }
 
     notifyListeners();
 
-    // Gated on a live tunnel. The plugin cancels the notification when the
-    // service stops, and re-posting after that leaves an ongoing notification
-    // the user cannot swipe away below Android 14.
-    if (_hasSyncedOnce &&
-        vpnConnection.status == VpnStatus.connected) {
+    if (_hasSyncedOnce && vpnConnection.status == VpnStatus.connected) {
       NotificationService.updateTimer(formatted);
     }
   }
@@ -150,8 +224,9 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     _timer = null;
     _currentSpeedKBps = 0.0;
     _remainingSeconds = 0;
+    _remainingAtLastSync = 0;
     _hasSyncedOnce = false;
-    _lastSyncAt = null;
+    _lastSuccessfulSyncAt = null;
     NotificationService.reset();
     notifyListeners();
 
@@ -162,45 +237,72 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     notifyListeners();
   }
 
+  int _readNonNegativeInt(dynamic value, int fallback) {
+    if (value is int) return value >= 0 ? value : fallback;
+    if (value is num && value >= 0) return value.toInt();
+    return fallback;
+  }
+
   Future<void> _syncWithHivemind() async {
     if (_isDisconnecting || _syncInProgress) return;
     _syncInProgress = true;
     try {
       final deviceId = await CryptoService.getDeviceId();
-      final url = Uri.parse(
-          '${AppConfig.hivemindApiPublic}/session/status?device_id=$deviceId');
+      final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status');
+      final url = base.replace(queryParameters: {'device_id': deviceId});
       final response = await HivemindService.directGet(url);
+      if (_isDisconnecting) return;
 
       if (response.statusCode == 200) {
-        final data = jsonDecode(response.body);
+        final decoded = jsonDecode(response.body);
+        if (decoded is! Map<String, dynamic>) {
+          debugPrint('[Timer] Invalid session payload type.');
+          _markSyncFailure();
+          return;
+        }
+        final data = decoded;
 
-        final bool active = data['active'] ?? false;
-        if (!active) {
+        final activeValue = data['active'];
+        if (activeValue is! bool) {
+          debugPrint('[Timer] Session payload missing boolean active state.');
+          _markSyncFailure();
+          return;
+        }
+        if (!activeValue) {
           await _doDisconnect('Server ended session');
           return;
         }
 
-        _remainingSeconds = data['expires_in_seconds'] ?? _remainingSeconds;
-        _usedBytes        = data['used_bytes']        ?? _usedBytes;
+        final expiresValue = data['expires_in_seconds'];
+        if (expiresValue is! num ||
+            !expiresValue.isFinite ||
+            expiresValue < 0) {
+          debugPrint('[Timer] Session payload has invalid expiry.');
+          _markSyncFailure();
+          return;
+        }
+
+        _remainingAtLastSync = expiresValue.toInt();
+        _remainingSeconds = _remainingAtLastSync;
+        _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes);
 
-        // Measure the real gap between polls: the interval is 5 s in the
-        // foreground, 30 s in the background, and arbitrary on a resume sync.
         final now = DateTime.now();
-        final lastSync = _lastSyncAt;
-        _lastSyncAt    = now;
-
-        final int deltaBytes = _usedBytes - _lastUsedBytes;
-        if (_hasSyncedOnce && deltaBytes > 0 && lastSync != null) {
-          final elapsed = now.difference(lastSync).inMilliseconds / 1000.0;
-          _currentSpeedKBps =
-              elapsed > 0 ? (deltaBytes / elapsed) / 1000 : _currentSpeedKBps;
-        } else if (!_hasSyncedOnce) {
+        final previousSyncAt = _lastSuccessfulSyncAt;
+        final deltaBytes = _usedBytes - _lastUsedBytes;
+        if (_hasSyncedOnce && previousSyncAt != null) {
+          final elapsedMs = now.difference(previousSyncAt).inMilliseconds;
+          if (deltaBytes > 0 && elapsedMs > 0) {
+            _currentSpeedKBps = (deltaBytes / (elapsedMs / 1000.0)) / 1000.0;
+          } else {
+            _currentSpeedKBps = 0.0;
+          }
+        } else {
           _currentSpeedKBps = 0.0;
         }
         _lastUsedBytes = _usedBytes;
+        _lastSuccessfulSyncAt = now;
 
-        final capExhausted = data['cap_exhausted'] ?? false;
-        if (capExhausted) {
+        if (data['cap_exhausted'] == true) {
           await _doDisconnect('Data cap reached');
           return;
         }
@@ -213,8 +315,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
         _markSyncFailure();
       }
     } catch (e) {
+      if (!_isDisconnecting) {
         debugPrint('Hivemind sync error: $e');
         _markSyncFailure();
+      }
     } finally {
       _syncInProgress = false;
     }
@@ -227,27 +331,46 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
     }
   }
 
-  void _resumeTicking() {
-    _lastSyncAt = null;
-    _timer?.cancel();
-    _timer = Timer.periodic(const Duration(seconds: 1), _tick);
-    _isDisconnecting = false;
-    _syncWithHivemind();
-    notifyListeners();
+  void _reconcileElapsedTime() {
+    final syncedAt = _lastSuccessfulSyncAt;
+    if (!_hasSyncedOnce || syncedAt == null) return;
+
+    final elapsed = DateTime.now().difference(syncedAt).inSeconds;
+    _remainingSeconds =
+        (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt();
   }
 
   @override
   void didChangeAppLifecycleState(AppLifecycleState state) {
     if (state == AppLifecycleState.paused ||
-        state == AppLifecycleState.detached) {
-      // Keep ticking, but slow the poll — the 5 s one wakes the radio.
+        state == AppLifecycleState.detached ||
+        state == AppLifecycleState.inactive ||
+        state == AppLifecycleState.hidden) {
       _appBackgrounded = true;
-    } else if (state == AppLifecycleState.resumed) {
+      return;
+    }
+
+    if (state != AppLifecycleState.resumed || _isDisconnecting) return;
     _appBackgrounded = false;
-      if (_timer != null && _timer!.isActive) {
-        _syncWithHivemind();
+    if (vpnConnection.status != VpnStatus.connected) return;
+
+    _reconcileElapsedTime();
+    if (!isRunning) {
+      _resumeTicking();
+      return;
     }
+
+    unawaited(_syncWithHivemind());
+    notifyListeners();
   }
+
+  void _resumeTicking() {
+    _reconcileElapsedTime();
+    _timer?.cancel();
+    _timer = Timer.periodic(const Duration(seconds: 1), _tick);
+    _isDisconnecting = false;
+    unawaited(_syncWithHivemind());
+    notifyListeners();
   }
 
   @override

lib/logic/updater.dart

@@ -13,6 +13,78 @@ enum UpdateStatus { upToDate, updateAvailable, checkFailed }
 
 enum InstallSource { playStore, sideload }
 
+Uri? _trustedHttpsUri(String raw, Set<String> allowedHosts) {
+  final uri = Uri.tryParse(raw);
+  if (uri == null || uri.scheme != 'https' || !allowedHosts.contains(uri.host)) {
+    return null;
+  }
+  return uri;
+}
+
+class _ParsedVersion {
+  final List<int> core;
+  final List<String> preRelease;
+
+  const _ParsedVersion(this.core, this.preRelease);
+
+  static _ParsedVersion? tryParse(String input) {
+    var value = input.trim();
+    if (value.startsWith('v') || value.startsWith('V')) {
+      value = value.substring(1);
+    }
+    value = value.split('+').first;
+    final dash = value.indexOf('-');
+    final corePart = dash < 0 ? value : value.substring(0, dash);
+    final prePart = dash < 0 ? '' : value.substring(dash + 1);
+    final rawCore = corePart.split('.');
+    if (rawCore.isEmpty || rawCore.any((p) => int.tryParse(p) == null)) {
+      return null;
+    }
+    final core = rawCore.map(int.parse).toList(growable: false);
+    while (core.length < 3) {
+      core.add(0);
+    }
+    final pre = prePart.isEmpty
+        ? const <String>[]
+        : prePart.split('.').where((e) => e.isNotEmpty).toList(growable: false);
+    return _ParsedVersion(core, pre);
+  }
+
+  int compareTo(_ParsedVersion other) {
+    final length = core.length > other.core.length ? core.length : other.core.length;
+    for (var i = 0; i < length; i++) {
+      final left = i < core.length ? core[i] : 0;
+      final right = i < other.core.length ? other.core[i] : 0;
+      if (left != right) return left.compareTo(right);
+    }
+
+    if (preRelease.isEmpty && other.preRelease.isEmpty) return 0;
+    if (preRelease.isEmpty) return 1;
+    if (other.preRelease.isEmpty) return -1;
+
+    final preLength = preRelease.length > other.preRelease.length
+        ? preRelease.length
+        : other.preRelease.length;
+    for (var i = 0; i < preLength; i++) {
+      if (i >= preRelease.length) return -1;
+      if (i >= other.preRelease.length) return 1;
+      final left = preRelease[i];
+      final right = other.preRelease[i];
+      final leftNum = int.tryParse(left);
+      final rightNum = int.tryParse(right);
+      if (leftNum != null && rightNum != null) {
+        if (leftNum != rightNum) return leftNum.compareTo(rightNum);
+        continue;
+      }
+      if (leftNum != null) return -1;
+      if (rightNum != null) return 1;
+      final lexical = left.compareTo(right);
+      if (lexical != 0) return lexical;
+    }
+    return 0;
+  }
+}
+
 class PlayStoreUpdater {
   PlayStoreUpdater._();
 
@@ -20,9 +92,13 @@ class PlayStoreUpdater {
       'https://play.google.com/store/apps/details?id=${AppConfig.applicationId}';
 
   static Future<bool> open() async {
+    final uri = _trustedHttpsUri(_url, const {'play.google.com'});
+    if (uri == null) {
+      debugPrint('[Updater] Refusing invalid Play Store URL.');
+      return false;
+    }
     try {
-      return await launchUrl(Uri.parse(_url),
-          mode: LaunchMode.externalApplication);
+      return await launchUrl(uri, mode: LaunchMode.externalApplication);
     } catch (e) {
       debugPrint('[Updater] Failed to open Play Store: $e');
       return false;
@@ -36,13 +112,14 @@ class GitHubUpdater {
   static String? _cachedDownloadUrl;
 
   static Future<String?> fetchLatestVersion() async {
-    final url =
-        'https://api.github.com/repos/${AppConfig.githubOwner}/${AppConfig.githubRepo}/releases/latest';
+    final apiUri = Uri.https(
+      'api.github.com',
+      '/repos/${AppConfig.githubOwner}/${AppConfig.githubRepo}/releases/latest',
+    );
 
     try {
       final response = await http
-          .get(Uri.parse(url),
-              headers: {'Accept': 'application/vnd.github+json'})
+          .get(apiUri, headers: {'Accept': 'application/vnd.github+json'})
           .timeout(const Duration(seconds: 8));
 
       if (response.statusCode != 200) {
@@ -50,38 +127,48 @@ class GitHubUpdater {
         return null;
       }
 
-      final data = jsonDecode(response.body) as Map<String, dynamic>;
-      _cachedDownloadUrl = data['html_url'] as String?;
+      final decoded = jsonDecode(response.body);
+      if (decoded is! Map<String, dynamic>) {
+        debugPrint('[Updater] Invalid GitHub release payload.');
+        return null;
+      }
 
-      final tag = data['tag_name'] as String? ?? '0.0.0';
-      return tag.startsWith('v') ? tag.substring(1) : tag;
+      final htmlUrl = decoded['html_url'];
+      if (htmlUrl is String &&
+          _trustedHttpsUri(htmlUrl, const {'github.com'}) != null) {
+        _cachedDownloadUrl = htmlUrl;
+      } else {
+        _cachedDownloadUrl = null;
+      }
+
+      final rawTag = decoded['tag_name'];
+      if (rawTag is! String || rawTag.isEmpty || rawTag.length > 64) {
+        debugPrint('[Updater] Invalid release tag.');
+        return null;
+      }
+
+      final normalized = rawTag.startsWith('v') ? rawTag.substring(1) : rawTag;
+      if (_ParsedVersion.tryParse(normalized) == null) {
+        debugPrint('[Updater] Release tag is not a supported version: $rawTag');
+        return null;
+      }
+      return normalized;
     } catch (e) {
       debugPrint('[Updater] GitHub API error: $e');
       return null;
     }
   }
 
-  static bool _isTrustedReleaseUrl(String url) {
-    final uri = Uri.tryParse(url);
-    if (uri == null || uri.scheme != 'https' || uri.host != 'github.com') {
+  static Future<bool> open() async {
+    final raw = _cachedDownloadUrl ?? AppConfig.githubReleasesUrl;
+    final uri = _trustedHttpsUri(raw, const {'github.com'});
+    if (uri == null) {
+      debugPrint('[Updater] Refusing untrusted GitHub update URL.');
       return false;
     }
-    // Host alone is not enough: anyone can host a release on github.com.
-    return uri.path
-        .startsWith('/${AppConfig.githubOwner}/${AppConfig.githubRepo}/');
-  }
 
-  static Future<bool> open() async {
-    final cached = _cachedDownloadUrl;
-    final url = (cached != null && _isTrustedReleaseUrl(cached))
-        ? cached
-        : AppConfig.githubReleasesUrl;
-    if (cached != null && url != cached) {
-      debugPrint('[Updater] Rejected untrusted release URL: $cached');
-    }
     try {
-      return await launchUrl(Uri.parse(url),
-          mode: LaunchMode.externalApplication);
+      return await launchUrl(uri, mode: LaunchMode.externalApplication);
     } catch (e) {
       debugPrint('[Updater] Failed to open GitHub: $e');
       return false;
@@ -116,30 +203,41 @@ class Updater {
   }
 
   static int _compareVersions(String a, String b) {
-    final aParts = a.split('.').map((p) => int.tryParse(p) ?? 0).toList();
-    final bParts = b.split('.').map((p) => int.tryParse(p) ?? 0).toList();
-    for (int i = 0; i < 3; i++) {
-      final diff = (aParts.length > i ? aParts[i] : 0) -
-          (bParts.length > i ? bParts[i] : 0);
-      if (diff != 0) return diff;
-    }
+    final left = _ParsedVersion.tryParse(a);
+    final right = _ParsedVersion.tryParse(b);
+    if (left == null || right == null) {
+      // Invalid local metadata should not invent an ordering.
       return 0;
     }
+    return left.compareTo(right);
+  }
 
   static String _versionLabel(String v, bool isLocal) {
     final prefix = v.startsWith('v') ? '' : 'v';
     return '$prefix$v${isLocal ? ' (installed)' : ''}';
   }
 
-  static Future<void> check({
+  static Future<void> check(BuildContext context) {
+    final navigator = Navigator.of(context, rootNavigator: true);
+    final messenger = ScaffoldMessenger.of(context);
+    return checkWithHandles(
+      navigator: navigator,
+      messenger: messenger,
+    );
+  }
+
+  static Future<void> checkWithHandles({
     required NavigatorState navigator,
     required ScaffoldMessengerState messenger,
   }) async {
     final info = await PackageInfo.fromPlatform();
     final localVersion = info.version;
-    if (localVersion.isEmpty) {
-      _showSnackBar(messenger, 'Could not determine app version',
-          isError: true);
+    if (localVersion.isEmpty || _ParsedVersion.tryParse(localVersion) == null) {
+      _showSnackBar(
+        messenger,
+        'Could not determine app version',
+        isError: true,
+      );
       return;
     }
 
@@ -155,15 +253,18 @@ class Updater {
     }
 
     final source = await installSource;
-    final storeName = source == InstallSource.playStore ? 'Play Store' : 'GitHub';
+    final storeName =
+        source == InstallSource.playStore ? 'Play Store' : 'GitHub';
     if (!navigator.mounted) return;
 
     showDialog(
       context: navigator.context,
       builder: (ctx) => AlertDialog(
         backgroundColor: AppColors.bgCard,
-        title: const Text('Update available',
-            style: TextStyle(color: AppColors.textWhite)),
+        title: const Text(
+          'Update available',
+          style: TextStyle(color: AppColors.textWhite),
+        ),
         content: Text(
           '${_versionLabel(latestVersion, false)} is available on $storeName.\n'
           'You have ${_versionLabel(localVersion, true)}.',
@@ -172,8 +273,10 @@ class Updater {
         actions: [
           TextButton(
             onPressed: () => Navigator.pop(ctx),
-            child: const Text('Later',
-                style: TextStyle(color: AppColors.slate70)),
+            child: const Text(
+              'Later',
+              style: TextStyle(color: AppColors.slate70),
+            ),
           ),
           TextButton(
             onPressed: () {
@@ -182,24 +285,31 @@ class Updater {
                   ? PlayStoreUpdater.open()
                   : GitHubUpdater.open();
             },
-            child: Text('Open $storeName',
-                style: const TextStyle(color: AppColors.accent)),
+            child: Text(
+              'Open $storeName',
+              style: const TextStyle(color: AppColors.accent),
+            ),
           ),
         ],
       ),
     );
   }
 
-  static void _showSnackBar(ScaffoldMessengerState messenger, String message,
-      {bool isError = false}) {
+  static void _showSnackBar(
+    ScaffoldMessengerState messenger,
+    String message, {
+    bool isError = false,
+  }) {
     if (!messenger.mounted) return;
     messenger.showSnackBar(
       SnackBar(
         content: Row(
           children: [
-            Icon(isError ? Icons.error_outline : Icons.check_circle,
+            Icon(
+              isError ? Icons.error_outline : Icons.check_circle,
               color: isError ? AppColors.red : AppColors.green,
-                size: 18),
+              size: 18,
+            ),
             const SizedBox(width: 8),
             Text(message),
           ],

lib/logic/vpn_connection.dart

@@ -1,8 +1,13 @@
 import 'dart:async';
+
 import 'package:flutter/foundation.dart';
-import 'package:flutter/widgets.dart';
 import 'package:flutter_vless/flutter_vless.dart';
+import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
+import 'package:revoltvpn/logic/local_socks_tester.dart';
+import 'package:revoltvpn/logic/network_monitor.dart';
+import 'package:revoltvpn/logic/power_settings.dart';
+import 'package:revoltvpn/logic/secure_socks_session.dart';
 
 enum VpnStatus {
   disconnected,
@@ -12,7 +17,7 @@ enum VpnStatus {
   error,
 }
 
-class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
+class VpnConnection extends ChangeNotifier {
   bool _cancelled = false;
   VpnStatus _status = VpnStatus.disconnected;
   VpnStatus get status => _status;
@@ -23,13 +28,50 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
   String? _errorMessage;
   String? get errorMessage => _errorMessage;
 
-  bool _isStartupRestoration = false;
-  bool get isStartupRestoration => _isStartupRestoration;
+  /// True when the UI attached to a tunnel that was already running, rather
+  /// than starting one itself. The session timer uses this to resume ticking.
+  bool _adoptedRunningRuntime = false;
+  bool get adoptedRunningRuntime => _adoptedRunningRuntime;
 
   bool _serverReachable = false;
   bool get serverReachable => _serverReachable;
 
+  ConnectionMode _activeMode = ConnectionMode.tun;
+  ConnectionMode get activeMode => _activeMode;
+
+  String _networkTransport = 'unknown';
+  String get networkTransport => _networkTransport;
+
+  SecureSocksSession? get activeSocksSession => _lastSecureSocks;
+
+  bool get canTestActiveLocalSocks =>
+      _status == VpnStatus.connected &&
+      _activeMode == ConnectionMode.proxy &&
+      _lastSecureSocks != null;
+
+  Future<LocalSocksTestResult> testActiveLocalSocks() async {
+    final active = _lastSecureSocks;
+    if (!canTestActiveLocalSocks || active == null) {
+      return const LocalSocksTestResult(
+        ok: false,
+        latencyMs: null,
+        message: 'No active authenticated SOCKS5 session.',
+      );
+    }
+
+    return LocalSocksTester.test(
+      host: '127.0.0.1',
+      port: active.port,
+      username: active.username,
+      password: active.password,
+    );
+  }
+
   Timer? _healthTimer;
+  StreamSubscription<NetworkSnapshot>? _networkSubscription;
+
+  SecureSocksSession? _lastSecureSocks;
+  bool _userDisconnecting = false;
 
   late final FlutterVless _vless;
   bool _initialized = false;
@@ -37,7 +79,7 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
   Future<void> get ready => _readyCompleter.future;
 
   VpnConnection() {
-    WidgetsBinding.instance.addObserver(this);
+    _activeMode = ConnectionSettings.mode;
     _init();
   }
 
@@ -54,10 +96,15 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
   Future<void> _startEngine() async {
     if (kIsWeb) return;
 
+    await ConnectionSettings.initialize();
+    _activeMode = ConnectionSettings.mode;
+
     _vless = FlutterVless(
       onStatusChanged: (status) {
-        debugPrint('[VPN] Status: state=${status.state} '
-            'connection=${status.connectionState.name}');
+        debugPrint(
+          '[VPN] Status: state=${status.state} '
+          'connection=${status.connectionState.name}',
+        );
         _mapStatus(status);
       },
     );
@@ -66,43 +113,88 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
       await _vless.initializeVless(
         providerBundleIdentifier: 'com.paladinvpn.app',
         notificationIconResourceType: 'drawable',
-        notificationIconResourceName: 'notification_icon',
+        notificationIconResourceName: 'notification_status_icon',
       );
       _initialized = true;
     } catch (e) {
       debugPrint('[VPN] VLESS init error (expected on emulator): $e');
     }
 
-    _startHealthPolling();
+    _networkSubscription = NetworkMonitor.changes.listen(
+      (snapshot) {
+        // ConnectivityManager is informational only. Restarting from every
+        // callback caused the old VPN-created-network reconnect loop.
+        _networkTransport = snapshot.transport;
+        notifyListeners();
+      },
+      onError: (Object error) {
+        debugPrint('[VPN] Network monitor error: $error');
+      },
+    );
+
+    unawaited(_checkHealth());
+    _healthTimer = Timer.periodic(const Duration(seconds: 30), (_) {
+      unawaited(_checkHealth());
+    });
 
     try {
       final coreVersion = await _vless.getCoreVersion();
       debugPrint('[VPN] Xray core version: $coreVersion');
-
-      final delay = await _vless.getConnectedServerDelay();
-      if (delay > 0) {
-        _isStartupRestoration = true;
-        _setStatus(VpnStatus.connected, 'Secured');
-      }
     } catch (_) {}
+
+    await _adoptRunningRuntime();
+  }
+
+  /// Reflect a tunnel that is already up when the UI starts.
+  ///
+  /// This asks the OS whether our VPN service process is alive, rather than
+  /// probing a local SOCKS port. The old probe called getConnectedServerDelay(),
+  /// which reads AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807 — but
+  /// AppConfigs lives in the VPN's own process, so from here it is always null
+  /// and the port always fell back to 10807. That was correct only while the
+  /// SOCKS port was fixed; per-session ephemeral ports made it permanently
+  /// wrong, so the app reported "connected" against a dead tunnel.
+  Future<void> _adoptRunningRuntime() async {
+    if (kIsWeb) return;
+    try {
+      final state = await PowerSettings.runtimeState();
+      if (state.aliveFor(tunMode: _activeMode == ConnectionMode.tun)) {
+        _adoptedRunningRuntime = true;
+        _setStatus(VpnStatus.connected, _connectedLabel);
+      }
+    } catch (e) {
+      debugPrint('[VPN] Runtime liveness check failed: $e');
+    }
+  }
+
+  String get _connectedLabel {
+    switch (_activeMode) {
+      case ConnectionMode.proxy:
+        return 'SOCKS5 gateway active';
+      case ConnectionMode.tun:
+        return 'Secured';
+    }
   }
 
   void _mapStatus(VlessStatus status) {
     switch (status.connectionState) {
       case VlessConnectionState.connected:
-        _setStatus(VpnStatus.connected, 'Secured');
+        _setStatus(VpnStatus.connected, _connectedLabel);
         break;
+
       case VlessConnectionState.disconnected:
-        _isStartupRestoration = false;
+        _clearRuntimeSnapshot();
         _setStatus(VpnStatus.disconnected, 'Tap to connect');
         break;
+
       case VlessConnectionState.connecting:
         _setStatus(VpnStatus.connecting, 'Establishing tunnel…');
         break;
+
       case VlessConnectionState.disconnecting:
-        _isStartupRestoration = false;
         _setStatus(VpnStatus.disconnecting, 'Tearing down…');
         break;
+
       case VlessConnectionState.unknown:
         if (_status != VpnStatus.connected &&
             _status != VpnStatus.disconnected) {
@@ -112,22 +204,16 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
     }
   }
 
-  // ── Connect ────────────────────────────────────────────────────────
-  //
-  // 1. Direct HTTPS to the public API → get per-user VLESS URL
-  // 2. Start tunnel directly with that URL (no bootstrap, no switch)
-  //
-  // The only hardcoded data in the APK is the Reality public key and
-  // shortId (needed for every Reality handshake — unavoidable).
-  // The tunnel UUID is per-user, assigned by Hivemind via AdMob SSV.
-
-  Future<bool> connect({
-    bool skipAdBypass = false,
-  }) async {
+  Future<bool> connect({bool skipAdBypass = false}) async {
     if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
       return false;
     }
+
     _cancelled = false;
+    _userDisconnecting = false;
+
+    await ConnectionSettings.initialize();
+    _activeMode = ConnectionSettings.mode;
 
     if (!kIsWeb && !_initialized) {
       _errorMessage = 'VPN service unavailable.';
@@ -135,7 +221,9 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
       return false;
     }
 
-    if (!kIsWeb) {
+    // TUN needs the Android VPN permission; SOCKS5 proxy mode runs a local
+    // authenticated proxy without a VpnService, so no VPN permission is needed.
+    if (!kIsWeb && _activeMode == ConnectionMode.tun) {
       final ok = await _vless.requestPermission();
       if (!ok) {
         _errorMessage = 'VPN permission denied.';
@@ -144,7 +232,11 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
       }
     }
 
-    _setStatus(VpnStatus.connecting, 'Establishing secure channel…');
+    final startingMessage = switch (_activeMode) {
+      ConnectionMode.tun => 'Establishing secure channel…',
+      ConnectionMode.proxy => 'Starting local SOCKS5 proxy…',
+    };
+    _setStatus(VpnStatus.connecting, startingMessage);
     _errorMessage = null;
 
     if (kIsWeb) {
@@ -161,7 +253,9 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
         skipAdBypass: skipAdBypass,
         onAttempt: (attempt, total) {
           _setStatus(
-              VpnStatus.connecting, 'Contacting server ($attempt/$total)…');
+            VpnStatus.connecting,
+            'Contacting server ($attempt/$total)…',
+          );
         },
       );
     } catch (e) {
@@ -173,7 +267,7 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
             'The server did not respond in time.\nCheck your connection and try again.';
         _setStatus(VpnStatus.error, 'Server unreachable');
       } else {
-        _errorMessage = e.toString().replaceAll('Exception: ', '');
+        _errorMessage = raw;
         _setStatus(VpnStatus.error, 'Config fetch error');
       }
       return false;
@@ -184,31 +278,115 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
       return false;
     }
 
-    _setStatus(VpnStatus.connecting, 'Securing connection…');
+    _setStatus(VpnStatus.connecting, 'Starting secure route…');
 
     try {
       final parsed = FlutterVless.parse(realUrl);
+      final baseConfig = parsed.getFullConfiguration();
+      final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
+      final secureSocks = await SecureSocksSession.create(baseConfig);
+      final verifyLocalSocks = _activeMode == ConnectionMode.proxy;
 
-      await _vless.startVless(
-        remark: parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN',
-        config: parsed.getFullConfiguration(),
+      await _startRuntime(
+        config: secureSocks.configJson,
+        remark: remark,
+        proxyOnly: verifyLocalSocks,
       );
+
+      _setStatus(
+        VpnStatus.connecting,
+        verifyLocalSocks ? 'Waiting for local SOCKS5…' : 'Waiting for VPN interface…',
+      );
+      if (!await _waitForNativeConnected()) {
+        throw StateError('VPN runtime did not report CONNECTED');
+      }
+
+      if (verifyLocalSocks) {
+        _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…');
+        if (!await _waitForLocalSocksListener(secureSocks)) {
+          throw StateError('Local SOCKS5 listener did not become ready');
+        }
+      }
+
+      _lastSecureSocks = secureSocks;
     } catch (e) {
       debugPrint('[VPN] Tunnel start error: $e');
-      _errorMessage = 'Tunnel failed to start.\nTry reconnecting.';
+      await _stopRuntime();
+      _clearRuntimeSnapshot();
+      _errorMessage = _activeMode == ConnectionMode.proxy
+          ? 'SOCKS5 gateway failed to start.\nTry reconnecting.'
+          : 'Connection failed to start.\nTry reconnecting.';
       _setStatus(VpnStatus.error, 'Connection failed');
       return false;
     }
 
-    _setStatus(VpnStatus.connected, 'Secured');
+    _setStatus(VpnStatus.connected, _connectedLabel);
     return true;
   }
 
+  Future<void> _startRuntime({
+    required String config,
+    required String remark,
+    required bool proxyOnly,
+  }) async {
+    await _vless.startVless(
+      remark: remark,
+      config: config,
+      proxyOnly: proxyOnly,
+    );
+  }
+
+  Future<bool> _waitForLocalSocksListener([
+    SecureSocksSession? session,
+  ]) async {
+    final active = session ?? _lastSecureSocks;
+    if (active == null) return false;
+
+    for (var attempt = 0; attempt < 4; attempt++) {
+      final result = await LocalSocksTester.testListener(
+        host: '127.0.0.1',
+        port: active.port,
+        username: active.username,
+        password: active.password,
+      );
+      if (result.ok) {
+        return true;
+      }
+      if (attempt < 3) {
+        await Future.delayed(const Duration(milliseconds: 250));
+      }
+    }
+    return false;
+  }
+
+  Future<bool> _waitForNativeConnected() async {
+    // startVless() queues the Android foreground service. Wait for the native
+    // service/core broadcast rather than treating MethodChannel completion as
+    // proof that a TUN interface was established.
+    for (var attempt = 0; attempt < 24; attempt++) {
+      if (_status == VpnStatus.connected) return true;
+      if (_status == VpnStatus.error) return false;
+      if (_cancelled || _userDisconnecting) return false;
+      await Future.delayed(const Duration(milliseconds: 250));
+    }
+    return _status == VpnStatus.connected;
+  }
+
+  Future<void> _stopRuntime() async {
+    try {
+      await _vless.stopVless().timeout(const Duration(seconds: 5));
+    } catch (_) {}
+  }
+
   Future<void> disconnect() async {
     _cancelled = true;
+    _userDisconnecting = true;
     HivemindService.cancel();
+
     if (_status == VpnStatus.disconnected ||
         _status == VpnStatus.disconnecting) {
+      _clearRuntimeSnapshot();
+      _userDisconnecting = false;
       return;
     }
 
@@ -216,7 +394,9 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
 
     if (kIsWeb) {
       await Future.delayed(const Duration(milliseconds: 500));
+      _clearRuntimeSnapshot();
       _setStatus(VpnStatus.disconnected, 'Tap to connect');
+      _userDisconnecting = false;
       return;
     }
 
@@ -229,65 +409,52 @@ class VpnConnection extends ChangeNotifier with WidgetsBindingObserver {
     } catch (e) {
       debugPrint('[VPN] VLESS stop error: $e');
       _errorMessage = 'VPN shutdown error.\nPlease restart the app.';
+      _clearRuntimeSnapshot();
       _setStatus(VpnStatus.error, 'Shutdown failed');
+      _userDisconnecting = false;
       return;
     }
 
     if (timedOut) {
-      debugPrint('[VPN] stopVless() timed out after 5 s — '
-          'tunnel may still be active.');
-      _errorMessage = 'VPN did not shut down cleanly.\n'
-          'Please restart the app.';
+      debugPrint('[VPN] stopVless() timed out after 5 s.');
+      _errorMessage = 'VPN did not shut down cleanly.\nPlease restart the app.';
+      _clearRuntimeSnapshot();
       _setStatus(VpnStatus.error, 'Shutdown failed');
+      _userDisconnecting = false;
       return;
     }
 
+    _errorMessage = null;
+    _clearRuntimeSnapshot();
     _setStatus(VpnStatus.disconnected, 'Tap to connect');
+    _userDisconnecting = false;
   }
 
-  void _setStatus(VpnStatus s, String msg) {
-    _status = s;
-    _statusMessage = msg;
+  void _clearRuntimeSnapshot() {
+    _lastSecureSocks = null;
+    _adoptedRunningRuntime = false;
+  }
+
+  void _setStatus(VpnStatus status, String message) {
+    _status = status;
+    _statusMessage = message;
     notifyListeners();
   }
 
-  void _startHealthPolling() {
-    _healthTimer?.cancel();
-    _checkHealthIfIdle();
-    _healthTimer = Timer.periodic(
-        const Duration(seconds: 30), (_) => _checkHealthIfIdle());
-  }
-
-  Future<void> _checkHealthIfIdle() async {
-    // A live tunnel already proves reachability.
-    if (_status == VpnStatus.connected) return;
-    await _checkHealth();
-  }
-
   Future<void> _checkHealth() async {
+    // A live tunnel already proves reachability; only probe while disconnected
+    // so we don't add direct /health traffic while the VPN is active.
+    if (_status == VpnStatus.connected) return;
     _serverReachable = await HivemindService.checkHealth();
     notifyListeners();
   }
 
-  @override
-  void didChangeAppLifecycleState(AppLifecycleState state) {
-    if (state == AppLifecycleState.paused ||
-        state == AppLifecycleState.detached) {
-      _healthTimer?.cancel();
-    } else if (state == AppLifecycleState.resumed) {
-      _startHealthPolling();
-    }
-  }
-
   @override
   void dispose() {
-    WidgetsBinding.instance.removeObserver(this);
     _healthTimer?.cancel();
-    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
-      try {
-        _vless.stopVless();
-      } catch (_) {}
-    }
+    _networkSubscription?.cancel();
+    // Provider/UI disposal is not a user disconnect command. Keeping teardown
+    // in disconnect() prevents lifecycle churn from silently dropping the VPN.
     super.dispose();
   }
 }

lib/main.dart

@@ -1,18 +1,23 @@
-import 'package:flutter/material.dart';
 import 'dart:ui';
+
+import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:provider/provider.dart';
-
-import 'package:revoltvpn/logic/vpn_connection.dart';
-import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/ad_manager.dart';
-import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/connection_settings.dart';
+import 'package:revoltvpn/logic/haptic_settings.dart';
+import 'package:revoltvpn/logic/server_list.dart';
+import 'package:revoltvpn/logic/session_timer.dart';
+import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/intro.dart';
-void main() {
+
+Future<void> main() async {
   WidgetsFlutterBinding.ensureInitialized();
 
-  SystemChrome.setPreferredOrientations([DeviceOrientation.portraitUp]);
+  await HapticSettings.initialize();
+  await ConnectionSettings.initialize();
+  await SystemChrome.setPreferredOrientations([DeviceOrientation.portraitUp]);
 
   SystemChrome.setSystemUIOverlayStyle(const SystemUiOverlayStyle(
     statusBarColor: Colors.transparent,
@@ -40,18 +45,18 @@ class ReVoltApp extends StatelessWidget {
   Widget build(BuildContext context) {
     return MultiProvider(
       providers: [
-        // lazy: false — the native VLESS engine takes real time to start, and
-        // providers are lazy by default, so it used to begin initialising only
-        // once MainScreen first read it, i.e. *after* the loading screen was
-        // gone. Constructing it eagerly moves that work under the intro, which
-        // now awaits VpnConnection.ready before navigating.
         ChangeNotifierProvider(create: (_) => VpnConnection(), lazy: false),
         ChangeNotifierProxyProvider<VpnConnection, SessionTimer>(
-          create: (ctx) => SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
-          update: (_, vpn, prev) => prev ?? SessionTimer(vpnConnection: vpn),
+          create: (ctx) =>
+              SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
+          update: (_, vpn, prev) =>
+              prev ?? SessionTimer(vpnConnection: vpn),
         ),
         ChangeNotifierProvider(create: (_) => AdManager()),
-        ChangeNotifierProvider(create: (_) => ServerList()..init(), lazy: false),
+        ChangeNotifierProvider(
+          create: (_) => ServerList()..init(),
+          lazy: false,
+        ),
       ],
       child: MaterialApp(
         title: 'ReVolt VPN',

lib/screens/intro.dart

@@ -2,11 +2,11 @@ import 'dart:async';
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/haptic_settings.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/main_screen.dart';
 import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 import 'package:revoltvpn/screens/settings/in_settings/lightning.dart';
-import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
 
 class IntroScreen extends StatefulWidget {
   const IntroScreen({super.key});
@@ -45,10 +45,12 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
     final elapsed = Stopwatch()..start();
     final vpn = context.read<VpnConnection>();
 
-    // The overlays read these in initState, so they must land before
-    // MainScreen mounts.
-    final settingsPrefs = Future.wait(
-        [loadRainPref(), loadLightningPref(), loadHapticPref()]);
+    // The overlays and haptic layer read these before MainScreen mounts.
+    final settingsPrefs = Future.wait([
+      loadRainPref(),
+      loadLightningPref(),
+      HapticSettings.initialize(),
+    ]);
 
     try {
       await vpn.ready.timeout(_bootTimeout);
@@ -79,7 +81,7 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
   void _navigateIfReady() {
     if (!mounted || _navigated || !_bootComplete) return;
     if (WidgetsBinding.instance.lifecycleState == AppLifecycleState.paused) {
-      return; // resume will call back in
+      return;
     }
     _navigated = true;
 
@@ -101,7 +103,6 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
       body: Column(
         children: [
           const Spacer(flex: 7),
-          // Image slightly below center
           Center(
             child: Image.asset(
               'assets/brand.png',
@@ -116,7 +117,6 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
               },
             ),
           ),
-          // Spinner + text paired together below the image
           const SizedBox(height: 8),
           const SizedBox(
             width: 40,
@@ -137,7 +137,6 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
             ),
           ),
           const SizedBox(height: 10),
-          // Says what the spinner is actually waiting on.
           AnimatedSwitcher(
             duration: const Duration(milliseconds: 250),
             child: Text(

lib/screens/settings/in_settings/background_reliability.dart

@@ -0,0 +1,129 @@
+import 'package:flutter/material.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/power_settings.dart';
+
+/// Keeping the tunnel alive is an OS concern, not an app one.
+///
+/// Android stops background services of apps that are not exempt from Doze, and
+/// removes the whole process group when its task is swiped away. There are
+/// exactly two sanctioned ways around that, both requiring one user tap, and
+/// neither can be enabled programmatically. This tile surfaces both.
+class BackgroundReliabilityTile extends StatefulWidget {
+  const BackgroundReliabilityTile({super.key});
+
+  @override
+  State<BackgroundReliabilityTile> createState() =>
+      _BackgroundReliabilityTileState();
+}
+
+class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
+    with WidgetsBindingObserver {
+  bool? _batteryExempt;
+
+  @override
+  void initState() {
+    super.initState();
+    WidgetsBinding.instance.addObserver(this);
+    _refresh();
+  }
+
+  @override
+  void dispose() {
+    WidgetsBinding.instance.removeObserver(this);
+    super.dispose();
+  }
+
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    // The exemption is granted in a system dialog, so the only reliable moment
+    // to re-read it is when we come back to the foreground.
+    if (state == AppLifecycleState.resumed) _refresh();
+  }
+
+  Future<void> _refresh() async {
+    final exempt = await PowerSettings.isBatteryOptimisationDisabled();
+    if (mounted) setState(() => _batteryExempt = exempt);
+  }
+
+  Future<void> _requestExemption() async {
+    final opened = await PowerSettings.requestDisableBatteryOptimisation();
+    if (!mounted || opened) return;
+    ScaffoldMessenger.of(context).showSnackBar(
+      const SnackBar(
+        content: Text('Could not open battery settings on this device.'),
+      ),
+    );
+  }
+
+  Future<void> _openVpnSettings() async {
+    final opened = await PowerSettings.openVpnSettings();
+    if (!mounted || opened) return;
+    ScaffoldMessenger.of(context).showSnackBar(
+      const SnackBar(content: Text('Could not open VPN settings.')),
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final exempt = _batteryExempt;
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.stretch,
+      children: [
+        const ListTile(
+          title: Text(
+            'Background reliability',
+            style: TextStyle(color: AppColors.textWhite, fontSize: 15),
+          ),
+          subtitle: Text(
+            'Android stops background apps to save power. These two settings '
+            'are what keep the VPN running when the app is closed.',
+            style: TextStyle(color: AppColors.textDim, fontSize: 12),
+          ),
+        ),
+        Padding(
+          padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Text(
+                exempt == null
+                    ? 'Battery optimisation: checking…'
+                    : exempt
+                        ? 'Battery optimisation: disabled for Revolt VPN ✓'
+                        : 'Battery optimisation: still active — the system may '
+                            'stop the VPN in the background.',
+                style: TextStyle(
+                  color: exempt == true ? AppColors.accent : AppColors.textMuted,
+                  fontSize: 12,
+                ),
+              ),
+              if (exempt == false) ...[
+                const SizedBox(height: 8),
+                OutlinedButton.icon(
+                  onPressed: _requestExemption,
+                  icon: const Icon(Icons.battery_saver),
+                  label: const Text('Allow background activity'),
+                ),
+              ],
+              const SizedBox(height: 16),
+              const Text(
+                'Always-on VPN keeps the tunnel up even after the app is closed '
+                'or the phone restarts. Turn it on for Revolt VPN in Android\'s '
+                'VPN settings, and enable "Block connections without VPN" if you '
+                'want traffic to stop rather than leak when it drops.',
+                style: TextStyle(color: AppColors.textMuted, fontSize: 12),
+              ),
+              const SizedBox(height: 8),
+              OutlinedButton.icon(
+                onPressed: _openVpnSettings,
+                icon: const Icon(Icons.settings),
+                label: const Text('Open VPN settings'),
+              ),
+            ],
+          ),
+        ),
+      ],
+    );
+  }
+}

lib/screens/settings/in_settings/connection_mode.dart

@@ -0,0 +1,288 @@
+import 'package:flutter/material.dart';
+import 'package:provider/provider.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/logic/connection_settings.dart';
+import 'package:revoltvpn/logic/local_socks_tester.dart';
+import 'package:revoltvpn/logic/session_timer.dart';
+import 'package:revoltvpn/logic/vpn_connection.dart';
+
+class ConnectionModeTile extends StatefulWidget {
+  final ValueChanged<ConnectionMode>? onChanged;
+
+  const ConnectionModeTile({super.key, this.onChanged});
+
+  @override
+  State<ConnectionModeTile> createState() => _ConnectionModeTileState();
+}
+
+class _ConnectionModeTileState extends State<ConnectionModeTile> {
+  ConnectionMode _mode = ConnectionSettings.mode;
+  bool _testingLocalSocks = false;
+  bool _reconnecting = false;
+  LocalSocksTestResult? _lastSocksTest;
+
+  @override
+  void initState() {
+    super.initState();
+    _load();
+  }
+
+  Future<void> _load() async {
+    await ConnectionSettings.initialize();
+    if (mounted) setState(() => _mode = ConnectionSettings.mode);
+  }
+
+  bool _isTunnelBusy(VpnStatus status) {
+    return status == VpnStatus.connected ||
+        status == VpnStatus.connecting ||
+        status == VpnStatus.disconnecting;
+  }
+
+  Future<void> _changeMode(ConnectionMode? next) async {
+    if (next == null || next == _mode) return;
+
+    final vpn = context.read<VpnConnection>();
+    if (_isTunnelBusy(vpn.status)) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(
+          content: Text('Disconnect before changing connection mode.'),
+        ),
+      );
+      return;
+    }
+
+    await ConnectionSettings.setMode(next);
+    if (!mounted) return;
+
+    setState(() {
+      _mode = next;
+      _lastSocksTest = null;
+    });
+    widget.onChanged?.call(next);
+  }
+
+  /// Recovers from an orphaned proxy: tear the runtime down and start a fresh
+  /// session so a readable set of credentials exists again. No rewarded ad —
+  /// the user is repairing a connection they already paid for, not opening a
+  /// new one.
+  Future<void> _reconnect() async {
+    if (_reconnecting) return;
+    final vpn = context.read<VpnConnection>();
+    final timer = context.read<SessionTimer>();
+
+    setState(() => _reconnecting = true);
+    try {
+      await timer.disconnect();
+      if (!mounted) return;
+      if (await vpn.connect()) {
+        if (!mounted) return;
+        await timer.start();
+      }
+    } finally {
+      if (mounted) {
+        setState(() {
+          _reconnecting = false;
+          _lastSocksTest = null;
+        });
+      }
+    }
+  }
+
+  Future<void> _testLocalSocks() async {
+    if (_testingLocalSocks) return;
+    final vpn = context.read<VpnConnection>();
+
+    if (vpn.status != VpnStatus.connected || !vpn.canTestActiveLocalSocks) {
+      final orphaned =
+          vpn.status == VpnStatus.connected && vpn.adoptedRunningRuntime;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: Text(
+            orphaned
+                ? 'Credentials were lost when the app restarted. Reconnect first.'
+                : 'Connect with SOCKS5 first, then run the local test.',
+          ),
+        ),
+      );
+      return;
+    }
+
+    setState(() => _testingLocalSocks = true);
+    final result = await vpn.testActiveLocalSocks();
+    if (!mounted) return;
+
+    setState(() {
+      _testingLocalSocks = false;
+      _lastSocksTest = result;
+    });
+
+    final latency = result.latencyMs == null ? '' : ' (${result.latencyMs} ms)';
+    ScaffoldMessenger.of(context).showSnackBar(
+      SnackBar(content: Text('${result.message}$latency')),
+    );
+  }
+
+  String get _subtitle {
+    switch (_mode) {
+      case ConnectionMode.tun:
+        return 'TUN: Android VPN routing for normal device traffic.';
+      case ConnectionMode.proxy:
+        return 'SOCKS5: local authenticated proxy — point apps at 127.0.0.1:<port> with the credentials shown below.';
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.stretch,
+      children: [
+        ListTile(
+          title: const Text(
+            'Connection mode',
+            style: TextStyle(color: AppColors.textWhite, fontSize: 15),
+          ),
+          subtitle: Text(
+            _subtitle,
+            style: const TextStyle(color: AppColors.textDim, fontSize: 12),
+          ),
+          trailing: DropdownButtonHideUnderline(
+            child: DropdownButton<ConnectionMode>(
+              value: _mode,
+              dropdownColor: AppColors.bgCard,
+              onChanged: _changeMode,
+              items: const [
+                DropdownMenuItem(
+                  value: ConnectionMode.tun,
+                  child: Text('TUN'),
+                ),
+                DropdownMenuItem(
+                  value: ConnectionMode.proxy,
+                  child: Text('SOCKS5'),
+                ),
+              ],
+            ),
+          ),
+        ),
+        if (_mode == ConnectionMode.proxy) ...[
+          Consumer<VpnConnection>(
+            builder: (context, vpn, _) {
+              final session = vpn.activeSocksSession;
+              if (session == null) {
+                // The proxy can be running while this session is unknown:
+                // Android killed the app process, the foreground service kept
+                // the listener alive, and its credentials existed only in the
+                // memory that died with it. Saying "Connect" there would be a
+                // lie — the user is already connected.
+                final orphaned = vpn.status == VpnStatus.connected &&
+                    vpn.adoptedRunningRuntime;
+                if (orphaned) {
+                  return Padding(
+                    padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
+                    child: Column(
+                      crossAxisAlignment: CrossAxisAlignment.start,
+                      children: [
+                        const Text(
+                          'The proxy is still running, but its credentials were '
+                          'lost when the app restarted. Reconnect to get a new '
+                          'endpoint.',
+                          style: TextStyle(
+                            color: AppColors.textMuted,
+                            fontSize: 12,
+                          ),
+                        ),
+                        const SizedBox(height: 8),
+                        OutlinedButton.icon(
+                          onPressed: _reconnecting ? null : _reconnect,
+                          icon: _reconnecting
+                              ? const SizedBox(
+                                  width: 16,
+                                  height: 16,
+                                  child: CircularProgressIndicator(
+                                    strokeWidth: 2,
+                                  ),
+                                )
+                              : const Icon(Icons.refresh),
+                          label: Text(
+                            _reconnecting ? 'Reconnecting…' : 'Reconnect',
+                          ),
+                        ),
+                      ],
+                    ),
+                  );
+                }
+                return const Padding(
+                  padding: EdgeInsets.fromLTRB(20, 0, 20, 8),
+                  child: Text(
+                    'Connect to start a local SOCKS5 proxy. Credentials change every session.',
+                    style: TextStyle(color: AppColors.textMuted, fontSize: 12),
+                  ),
+                );
+              }
+              return Padding(
+                padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    Text(
+                      'Proxy: 127.0.0.1:${session.port}',
+                      style: const TextStyle(
+                        color: AppColors.textMuted,
+                        fontSize: 12,
+                        fontFamily: 'monospace',
+                      ),
+                    ),
+                    Text(
+                      'Username: ${session.username}',
+                      style: const TextStyle(
+                        color: AppColors.textMuted,
+                        fontSize: 12,
+                        fontFamily: 'monospace',
+                      ),
+                    ),
+                    Text(
+                      'Password: ${session.password}',
+                      style: const TextStyle(
+                        color: AppColors.textMuted,
+                        fontSize: 12,
+                        fontFamily: 'monospace',
+                      ),
+                    ),
+                  ],
+                ),
+              );
+            },
+          ),
+          Padding(
+            padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
+            child: OutlinedButton.icon(
+              onPressed: _testingLocalSocks ? null : _testLocalSocks,
+              icon: _testingLocalSocks
+                  ? const SizedBox(
+                      width: 16,
+                      height: 16,
+                      child: CircularProgressIndicator(strokeWidth: 2),
+                    )
+                  : const Icon(Icons.network_check),
+              label: Text(
+                _testingLocalSocks ? 'Testing…' : 'Test Local SOCKS',
+              ),
+            ),
+          ),
+          if (_lastSocksTest != null)
+            Padding(
+              padding: const EdgeInsets.fromLTRB(20, 0, 20, 12),
+              child: Text(
+                _lastSocksTest!.ok
+                    ? 'Last test: OK${_lastSocksTest!.latencyMs == null ? '' : ' · ${_lastSocksTest!.latencyMs} ms'}'
+                    : 'Last test: Failed · ${_lastSocksTest!.message}',
+                style: const TextStyle(
+                  color: AppColors.textMuted,
+                  fontSize: 12,
+                ),
+              ),
+            ),
+        ],
+      ],
+    );
+  }
+}

lib/screens/settings/in_settings/haptic.dart

@@ -1,43 +1,6 @@
-import 'dart:async';
 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
-import 'package:shared_preferences/shared_preferences.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
-
-// A plain bool, not a ValueNotifier: this is only read at the moment of a tap,
-// so nothing has to react to it changing. Default: false.
-bool hapticEnabled = false;
-
-/// Hydrates [hapticEnabled] from disk. Called at boot — the toggle tile below
-/// only mounts once Settings is opened.
-Future<void> loadHapticPref() async {
-  final prefs = await SharedPreferences.getInstance();
-  hapticEnabled = prefs.getBool('haptic_feedback_enabled') ?? false;
-}
-
-/// Haptic calls are deliberately best-effort: a vibration failure must never
-/// block or fail a VPN connect/disconnect. `mediumImpact` is used instead of
-/// `lightImpact` — the latter is imperceptible on many Android devices.
-class Haptics {
-  Haptics._();
-
-  static Future<void> connectionChanged() async {
-    if (!hapticEnabled) return;
-    try {
-      await HapticFeedback.mediumImpact();
-    } catch (e) {
-      debugPrint('[Haptics] Feedback unavailable: $e');
-    }
-  }
-
-  static Future<void> previewEnabled() async {
-    try {
-      await HapticFeedback.selectionClick();
-    } catch (e) {
-      debugPrint('[Haptics] Preview unavailable: $e');
-    }
-  }
-}
+import 'package:revoltvpn/logic/haptic_settings.dart';
 
 class HapticFeedbackTile extends StatefulWidget {
   const HapticFeedbackTile({super.key});
@@ -47,7 +10,8 @@ class HapticFeedbackTile extends StatefulWidget {
 }
 
 class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
-  bool _on = false;
+  bool _on = HapticSettings.enabled;
+  bool _saving = false;
 
   @override
   void initState() {
@@ -56,18 +20,24 @@ class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
   }
 
   Future<void> _load() async {
-    await loadHapticPref();
-    if (mounted) setState(() => _on = hapticEnabled);
+    await HapticSettings.initialize();
+    if (mounted) setState(() => _on = HapticSettings.enabled);
   }
 
-  // Writes to SharedPreferences AND updates the live bool so the connect
-  // button sees the change immediately — no restart needed.
   Future<void> _toggle(bool value) async {
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setBool('haptic_feedback_enabled', value);
-    hapticEnabled = value;
-    if (value) unawaited(Haptics.previewEnabled());
-    setState(() => _on = value);
+    if (_saving) return;
+    setState(() {
+      _saving = true;
+      _on = value;
+    });
+
+    try {
+      await HapticSettings.setEnabled(value);
+    } catch (_) {
+      if (mounted) setState(() => _on = HapticSettings.enabled);
+    } finally {
+      if (mounted) setState(() => _saving = false);
+    }
   }
 
   @override
@@ -78,7 +48,7 @@ class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
         style: TextStyle(color: AppColors.textWhite, fontSize: 15),
       ),
       value: _on,
-      onChanged: _toggle,
+      onChanged: _saving ? null : _toggle,
       activeTrackColor: AppColors.accent.withAlpha(80),
       activeThumbColor: AppColors.accent,
       contentPadding: const EdgeInsets.symmetric(horizontal: 20, vertical: 4),

lib/screens/settings/settings_screen.dart

@@ -1,23 +1,10 @@
 import 'package:flutter/material.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
+import 'package:revoltvpn/screens/settings/in_settings/background_reliability.dart';
+import 'package:revoltvpn/screens/settings/in_settings/connection_mode.dart';
 import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
-import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 import 'package:revoltvpn/screens/settings/in_settings/lightning.dart';
-
-// ── lib/screens/settings/settings_screen.dart ────────────────────────────────
-// Settings shell — full-screen page reached from the sidebar.
-//
-// Folder layout:
-//   lib/screens/settings/       ← this folder: settings family
-//     settings_screen.dart      ← shell: Scaffold + AppBar + ListView (this file)
-//     *_tile.dart               ← one file per setting feature (add below)
-//   lib/components/sidebar_contents/
-//     settings.dart             ← thin sidebar row that navigates here
-//
-// To add a setting:
-//   1. Create a new file in this folder, e.g. appearance_tile.dart
-//   2. Import it below
-//   3. Append it to the children list
+import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 
 class SettingsScreen extends StatelessWidget {
   const SettingsScreen({super.key});
@@ -44,11 +31,11 @@ class SettingsScreen extends StatelessWidget {
       body: ListView(
         padding: const EdgeInsets.symmetric(vertical: 8),
         children: const [
+          ConnectionModeTile(),
+          BackgroundReliabilityTile(),
           HapticFeedbackTile(),
           RainToggleTile(),
           LightningToggleTile(),
-          // ── Add setting tiles here ────────────────────────────────────────
-          // Each tile imports from its own file in this folder.
         ],
       ),
     );

pubspec.lock

@@ -73,14 +73,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.0.9"
-  dbus:
-    dependency: transitive
-    description:
-      name: dbus
-      sha256: d0c98dcd4f5169878b6cf8f6e0a52403a9dff371a3e2f019697accbf6f44a270
-      url: "https://pub.dev"
-    source: hosted
-    version: "0.7.12"
   fake_async:
     dependency: transitive
     description:
@@ -126,30 +118,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.0.2"
-  flutter_local_notifications:
-    dependency: "direct main"
-    description:
-      name: flutter_local_notifications
-      sha256: "674173fd3c9eda9d4c8528da2ce0ea69f161577495a9cc835a2a4ecd7eadeb35"
-      url: "https://pub.dev"
-    source: hosted
-    version: "17.2.4"
-  flutter_local_notifications_linux:
-    dependency: transitive
-    description:
-      name: flutter_local_notifications_linux
-      sha256: c49bd06165cad9beeb79090b18cd1eb0296f4bf4b23b84426e37dd7c027fc3af
-      url: "https://pub.dev"
-    source: hosted
-    version: "4.0.1"
-  flutter_local_notifications_platform_interface:
-    dependency: transitive
-    description:
-      name: flutter_local_notifications_platform_interface
-      sha256: "85f8d07fe708c1bdcf45037f2c0109753b26ae077e9d9e899d55971711a4ea66"
-      url: "https://pub.dev"
-    source: hosted
-    version: "7.2.0"
   flutter_secure_storage:
     dependency: "direct main"
     description:
@@ -464,14 +432,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.3.0"
-  petitparser:
-    dependency: transitive
-    description:
-      name: petitparser
-      sha256: "91bd59303e9f769f108f8df05e371341b15d59e995e6806aefab827b58336675"
-      url: "https://pub.dev"
-    source: hosted
-    version: "7.0.2"
   platform:
     dependency: transitive
     description:
@@ -621,14 +581,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "0.7.11"
-  timezone:
-    dependency: transitive
-    description:
-      name: timezone
-      sha256: "2236ec079a174ce07434e89fcd3fcda430025eb7692244139a9cf54fdcf1fc7d"
-      url: "https://pub.dev"
-    source: hosted
-    version: "0.9.4"
   typed_data:
     dependency: transitive
     description:
@@ -781,14 +733,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.1.0"
-  xml:
-    dependency: transitive
-    description:
-      name: xml
-      sha256: "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025"
-      url: "https://pub.dev"
-    source: hosted
-    version: "6.6.1"
   yaml:
     dependency: transitive
     description:

pubspec.yaml

@@ -15,7 +15,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion.
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
-version: 3.3.0+26
+version: 3.3.2+28
 
 environment:
   sdk: ">=3.0.0 <4.0.0"
@@ -36,7 +36,6 @@ dependencies:
   url_launcher: ^6.3.2
   flutter_secure_storage: ^10.3.1
   uuid: ^4.5.3
-  flutter_local_notifications: ^17.0.0
   path_provider: ^2.1.5
   package_info_plus: ^6.0.0
 

tool/patch_flutter_vless_allowed_apps.dart

@@ -0,0 +1,293 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[flutter_vless patch] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  if (!root.existsSync()) fail('package root does not exist: ${root.path}');
+  return root;
+}
+
+void replaceOnce(
+  File file,
+  String oldValue,
+  String newValue,
+  String marker,
+) {
+  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
+  final text = file.readAsStringSync();
+  if (text.contains(marker)) {
+    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
+    return;
+  }
+  if (!text.contains(oldValue)) {
+    fail('upstream source changed; expected block not found in ${file.path}');
+  }
+  file.writeAsStringSync(text.replaceFirst(oldValue, newValue));
+  stdout.writeln('[flutter_vless patch] patched: ${file.path}');
+}
+
+void replaceOneOf(
+  File file,
+  Map<String, String> replacements,
+  String marker,
+) {
+  if (!file.existsSync()) fail('missing upstream source: ${file.path}');
+  var text = file.readAsStringSync();
+  if (text.contains(marker)) {
+    stdout.writeln('[flutter_vless patch] already current: ${file.path}');
+    return;
+  }
+  for (final entry in replacements.entries) {
+    if (!text.contains(entry.key)) continue;
+    text = text.replaceFirst(entry.key, entry.value);
+    file.writeAsStringSync(text);
+    stdout.writeln('[flutter_vless patch] patched/upgraded: ${file.path}');
+    return;
+  }
+  fail('upstream/legacy patch shape not recognized in ${file.path}');
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin = Directory(
+    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
+  );
+
+  final configFile = File('${kotlin.path}/xray/dto/XrayConfig.kt');
+  replaceOnce(
+    configFile,
+    '''    /** List of app package names to exclude from VPN. */
+    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
+''',
+    '''    /** List of app package names to exclude from VPN. */
+    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
+
+    /** List of app package names that are exclusively allowed into VPN. */
+    var ALLOWED_APPS: ArrayList<String> = ArrayList(),
+''',
+    'var ALLOWED_APPS:',
+  );
+
+  final pluginFile = File('${kotlin.path}/FlutterVlessPlugin.kt');
+  replaceOnce(
+    pluginFile,
+    '''    private lateinit var context: Context
+''',
+    '''    private lateinit var context: Context
+    private var allowedApps: ArrayList<String> = ArrayList()
+''',
+    'private var allowedApps:',
+  );
+
+  const currentAllowedHandler = '''            "setAllowedApps" -> {
+                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
+                allowedApps = ArrayList(
+                    requested
+                        .map { it.trim() }
+                        .filter { it.isNotEmpty() && it != context.packageName }
+                        .distinct()
+                        .sorted()
+                )
+                result.success(null)
+            }
+''';
+  const legacyAllowedHandler = '''            "setAllowedApps" -> {
+                val requested = call.argument<ArrayList<String>>("allowed_apps") ?: ArrayList()
+                allowedApps = ArrayList(
+                    requested.map { it.trim() }.filter { it.isNotEmpty() }.distinct()
+                )
+                result.success(null)
+            }
+''';
+  replaceOneOf(
+    pluginFile,
+    <String, String>{
+      legacyAllowedHandler: currentAllowedHandler,
+      '''        when (call.method) {
+            "startVless" -> {
+''': '''        when (call.method) {
+$currentAllowedHandler            "startVless" -> {
+''',
+    },
+    'it.isNotEmpty() && it != context.packageName',
+  );
+
+  replaceOnce(
+    pluginFile,
+    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
+                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
+''',
+    '''                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
+                config.ALLOWED_APPS = ArrayList(allowedApps)
+                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
+''',
+    'config.ALLOWED_APPS = ArrayList(allowedApps)',
+  );
+
+  final serviceFile = File('${kotlin.path}/xray/service/XrayVPNService.kt');
+  replaceOnce(
+    serviceFile,
+    '''            if (config != null) {
+                // Ensure clean state before starting
+                cleanup()
+''',
+    '''            if (config != null) {
+                // A fast reconnect must not leave the previous Xray process
+                // owning the local SOCKS/HTTP ports.
+                if (XrayCoreManager.isXrayRunning()) {
+                    Log.w(TAG, "Stopping stale Xray core before restart")
+                    XrayCoreManager.stopCore(this)
+                }
+                cleanup()
+''',
+    'Stopping stale Xray core before restart',
+  );
+
+  replaceOnce(
+    serviceFile,
+    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val sockPath = File(filesDir, "sock_path").absolutePath
+''',
+    '''        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
+        val socketFile = File(filesDir, "sock_path")
+        if (socketFile.exists() && !socketFile.delete()) {
+            Log.w(TAG, "Could not delete stale tun2socks socket")
+        }
+        val sockPath = socketFile.absolutePath
+''',
+    'Could not delete stale tun2socks socket',
+  );
+
+  final upstreamPolicy = r'''          try {
+    builder.addDisallowedApplication(packageName)
+} catch (e: Exception) {
+    Log.e(TAG, \"Failed to exclude app from VPN\", e)
+}
+
+for (pkg in config.BLOCKED_APPS) {
+    try {
+        builder.addDisallowedApplication(pkg)
+        Log.d(TAG, \"Excluded from VPN: $pkg\")
+    } catch (e: Exception) {
+        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
+    }
+}
+'''.replaceAll(r'\"', '"');
+
+  final legacyPatchedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty()) {
+                for (pkg in config.ALLOWED_APPS) {
+                    try {
+                        builder.addAllowedApplication(pkg)
+                        Log.d(TAG, \"Allowed into VPN: $pkg\")
+                    } catch (e: Exception) {
+                        Log.e(TAG, \"Failed to allow $pkg into VPN\", e)
+                    }
+                }
+            } else {
+                try {
+                    builder.addDisallowedApplication(packageName)
+                } catch (e: Exception) {
+                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
+                }
+
+                for (pkg in config.BLOCKED_APPS) {
+                    try {
+                        builder.addDisallowedApplication(pkg)
+                        Log.d(TAG, \"Excluded from VPN: $pkg\")
+                    } catch (e: Exception) {
+                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
+                    }
+                }
+            }
+'''.replaceAll(r'\"', '"');
+
+  final hardenedPolicy = r'''            if (config.ALLOWED_APPS.isNotEmpty() && config.BLOCKED_APPS.isNotEmpty()) {
+                throw IllegalStateException(\"Allowed and blocked app policies cannot be mixed\")
+            }
+
+            if (config.ALLOWED_APPS.isNotEmpty()) {
+                var allowedCount = 0
+                for (pkg in config.ALLOWED_APPS) {
+                    try {
+                        builder.addAllowedApplication(pkg)
+                        allowedCount++
+                        Log.d(TAG, \"Allowed into VPN: $pkg\")
+                    } catch (e: Exception) {
+                        throw IllegalStateException(\"Failed to allow selected app $pkg\", e)
+                    }
+                }
+                if (allowedCount == 0) {
+                    throw IllegalStateException(\"Selected-only routing has no valid applications\")
+                }
+            } else {
+                try {
+                    builder.addDisallowedApplication(packageName)
+                } catch (e: Exception) {
+                    Log.e(TAG, \"Failed to exclude app from VPN\", e)
+                }
+
+                for (pkg in config.BLOCKED_APPS) {
+                    try {
+                        builder.addDisallowedApplication(pkg)
+                        Log.d(TAG, \"Excluded from VPN: $pkg\")
+                    } catch (e: Exception) {
+                        Log.e(TAG, \"Failed to exclude $pkg from VPN\", e)
+                    }
+                }
+            }
+'''.replaceAll(r'\"', '"');
+
+  // Support both pristine 1.1.5 and the earlier local allowlist patch.
+  replaceOneOf(
+    serviceFile,
+    <String, String>{
+      legacyPatchedPolicy: hardenedPolicy,
+      upstreamPolicy: hardenedPolicy,
+    },
+    'Allowed and blocked app policies cannot be mixed',
+  );
+
+  stdout.writeln('[flutter_vless patch] allowed-app routing patch is ready');
+}

tool/patch_flutter_vless_secure_socks_scope_fix.dart

@@ -0,0 +1,154 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[secure-socks scope fix] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  return root;
+}
+
+void patchCoreScope(File core) {
+  final before = core.readAsStringSync();
+
+  // The primary secure patcher used a file-wide check for
+  // `val process = pb.start()`. Stock 1.1.5 already contains that exact line
+  // in getV2rayTraffic(), so the startCore() capture could be skipped while
+  // its monitor was still rewritten to use `process`. Capture the active Xray
+  // process immediately before its monitor thread instead. This is deliberately
+  // a scope-only correction and does not alter the stable runtime sequence.
+  const directCapture =
+      '            val process = pb.start()\n            xrayProcess = process\n';
+  const scopedCapture =
+      '            val process = xrayProcess ?: return false\n            // Monitor process in a separate thread to detect crash\n';
+  const monitorMarker =
+      '            // Monitor process in a separate thread to detect crash\n';
+
+  if (before.contains(directCapture) || before.contains(scopedCapture)) {
+    stdout.writeln('[secure-socks scope fix] core already current: ${core.path}');
+    return;
+  }
+
+  if (!before.contains('process.inputStream.bufferedReader().use { reader ->') ||
+      !before.contains('val exitCode = process.waitFor()') ||
+      !before.contains('xrayProcess === process')) {
+    fail('secure Xray monitor patch is not in the expected state');
+  }
+  if (!before.contains('            xrayProcess = pb.start()\n')) {
+    fail('stock Xray start assignment is missing');
+  }
+  if (!before.contains(monitorMarker)) {
+    fail('Xray monitor insertion point is missing');
+  }
+
+  final after = before.replaceFirst(monitorMarker, scopedCapture);
+  core.writeAsStringSync(after);
+  stdout.writeln('[secure-socks scope fix] captured Xray process for monitor scope');
+}
+
+void patchOngoingNotification(File service) {
+  final before = service.readAsStringSync();
+
+  const marker = '.setOngoing(true)';
+  if (before.contains(marker) &&
+      before.contains('Notification.FLAG_NO_CLEAR') &&
+      before.contains('.setAutoCancel(false)')) {
+    stdout.writeln('[secure-socks scope fix] notification already ongoing: ${service.path}');
+    return;
+  }
+
+  const oldBlock = r'''        return builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .build()
+''';
+
+  const newBlock = r'''        val notification = builder
+            .setContentTitle("VPN Service")
+            .setContentText(content)
+            .setSmallIcon(icon)
+            .setOngoing(true)
+            .setAutoCancel(false)
+            .setOnlyAlertOnce(true)
+            .build()
+
+        // Keep the active VPN notification attached to the foreground service
+        // and resistant to bulk clearing on Android versions that honor these
+        // flags. Android 14+ may still allow an explicit user swipe while the
+        // device is unlocked; apps are not allowed to override that system UI.
+        notification.flags = notification.flags or
+            android.app.Notification.FLAG_ONGOING_EVENT or
+            android.app.Notification.FLAG_NO_CLEAR
+        return notification
+''';
+
+  if (!before.contains(oldBlock)) {
+    fail('VPN notification builder is not in the expected stock 1.1.5 state');
+  }
+
+  final after = before.replaceFirst(oldBlock, newBlock);
+  if (!after.contains(marker) ||
+      !after.contains('Notification.FLAG_NO_CLEAR') ||
+      !after.contains('.setAutoCancel(false)')) {
+    fail('ongoing VPN notification invariant failed');
+  }
+
+  service.writeAsStringSync(after);
+  stdout.writeln('[secure-socks scope fix] VPN notification marked ongoing/no-clear');
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin =
+      '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless';
+  final core = File('$kotlin/xray/core/XrayCoreManager.kt');
+  final service = File('$kotlin/xray/service/XrayVPNService.kt');
+
+  if (!core.existsSync()) fail('XrayCoreManager.kt is missing');
+  if (!service.existsSync()) fail('XrayVPNService.kt is missing');
+
+  patchCoreScope(core);
+  patchOngoingNotification(service);
+  stdout.writeln('[secure-socks scope fix] scope and notification patch ready');
+}

tool/patch_flutter_vless_secure_socks_v2.dart

@@ -0,0 +1,546 @@
+import 'dart:convert';
+import 'dart:io';
+
+const packageName = 'flutter_vless_android';
+const expectedVersionFragment = 'flutter_vless_android-1.1.5';
+
+Never fail(String message) {
+  stderr.writeln('[secure-socks patch] $message');
+  exit(1);
+}
+
+Directory packageRoot() {
+  final configFile = File('.dart_tool/package_config.json');
+  if (!configFile.existsSync()) {
+    fail('.dart_tool/package_config.json is missing; run flutter pub get first');
+  }
+  final decoded = jsonDecode(configFile.readAsStringSync());
+  if (decoded is! Map<String, dynamic> || decoded['packages'] is! List) {
+    fail('package_config.json is invalid');
+  }
+
+  Map<String, dynamic>? package;
+  for (final item in decoded['packages'] as List) {
+    if (item is Map && item['name'] == packageName) {
+      package = Map<String, dynamic>.from(item);
+      break;
+    }
+  }
+  if (package == null) fail('$packageName was not found');
+
+  final rootUriValue = package['rootUri'];
+  if (rootUriValue is! String || rootUriValue.isEmpty) {
+    fail('$packageName has no rootUri');
+  }
+  final rootUri = Uri.parse(rootUriValue);
+  final resolved = rootUri.hasScheme
+      ? rootUri
+      : configFile.parent.absolute.uri.resolveUri(rootUri);
+  if (resolved.scheme != 'file') fail('unsupported package URI: $resolved');
+
+  final root = Directory.fromUri(resolved);
+  final normalized = root.absolute.path.replaceAll('\\', '/');
+  if (!normalized.contains(expectedVersionFragment)) {
+    fail('expected flutter_vless_android 1.1.5, got ${root.path}');
+  }
+  return root;
+}
+
+String replaceOnce(
+  String text,
+  String oldValue,
+  String newValue,
+  String label,
+) {
+  if (text.contains(newValue)) return text;
+  if (!text.contains(oldValue)) fail('missing expected source block: $label');
+  return text.replaceFirst(oldValue, newValue);
+}
+
+void writeIfChanged(File file, String before, String after) {
+  if (before == after) {
+    stdout.writeln('[secure-socks patch] already current: ${file.path}');
+    return;
+  }
+  file.writeAsStringSync(after);
+  stdout.writeln('[secure-socks patch] patched: ${file.path}');
+}
+
+void patchCore(File file) {
+  final before = file.readAsStringSync();
+  var text = before;
+
+  const secureValidation = r'''        var secureSocksEnabled = false
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+
+            val settings = inbound.optJSONObject("settings")
+                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
+            val users = settings.optJSONArray("users")
+                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
+            val account = users.optJSONObject(0)
+                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
+            val port = inbound.optInt("port", -1)
+
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1" ||
+                port <= 1024 || port > 65535 ||
+                settings.optString("auth") != "password" ||
+                account.optString("user").isEmpty() ||
+                account.optString("pass").isEmpty()
+            ) {
+                throw IllegalStateException("Secure SOCKS5 session is invalid")
+            }
+
+            config.LOCAL_SOCKS5_PORT = port
+            config.LOCAL_HTTP_PORT = 0
+            secureSocksEnabled = true
+            break
+        }
+
+''';
+
+  if (!text.contains('var secureSocksEnabled = false')) {
+    text = replaceOnce(
+      text,
+      '        val usedPorts = mutableSetOf<Int>()\n',
+      '$secureValidation        val usedPorts = mutableSetOf<Int>()\n',
+      'secure SOCKS validation insertion',
+    );
+  }
+
+  text = replaceOnce(
+    text,
+    '        if (!hasHttpOnLocalPort) {\n',
+    '        if (!secureSocksEnabled && !hasHttpOnLocalPort) {\n',
+    'disable unauthenticated HTTP proxy in secure mode',
+  );
+
+  if (!text.contains('val process = pb.start()')) {
+    text = replaceOnce(
+      text,
+      '            xrayProcess = pb.start()\n',
+      '            val process = pb.start()\n            xrayProcess = process\n',
+      'capture Xray process identity',
+    );
+    text = replaceOnce(
+      text,
+      '            if (xrayProcess?.isAlive != true) {\n',
+      '            if (!process.isAlive) {\n',
+      'Xray startup liveness',
+    );
+    text = replaceOnce(
+      text,
+      '                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()\n',
+      '                val output = process.inputStream.bufferedReader().readText()\n',
+      'Xray startup output',
+    );
+  }
+
+  if (!text.contains('Could not delete ephemeral Xray config')) {
+    const connectedLine =
+        '            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED\n';
+    const deleteConfig = r'''            // config.json contains per-session SOCKS credentials. Xray has
+            // consumed it after the startup liveness check, so remove it now.
+            try {
+                val ephemeralConfig = File(configFilesDir, "config.json")
+                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
+                    Log.w(TAG, "Could not delete ephemeral Xray config")
+                }
+            } catch (e: Exception) {
+                Log.w(TAG, "Could not delete ephemeral Xray config", e)
+            }
+
+''';
+    text = replaceOnce(
+      text,
+      connectedLine,
+      '$deleteConfig$connectedLine',
+      'ephemeral config deletion',
+    );
+  }
+
+  if (!text.contains('context.handleXrayCoreExit(config)')) {
+    text = replaceOnce(
+      text,
+      '                    xrayProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
+      '                    process.inputStream.bufferedReader().use { reader ->\n',
+      'Xray monitor process stream',
+    );
+    text = replaceOnce(
+      text,
+      '                    val exitCode = xrayProcess?.waitFor()\n',
+      '                    val exitCode = process.waitFor()\n',
+      'Xray monitor process wait',
+    );
+
+    const oldExit = r'''                    if (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED) {
+                        // Unexpected exit
+                        stopCore(context)
+                    }
+''';
+    const newExit = r'''                    if (xrayProcess === process &&
+                        AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
+                    ) {
+                        // Hold the Android TUN while the core is recovered. Killing
+                        // the VPN service here would allow direct-network fallback.
+                        xrayProcess = null
+                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
+                        if (context is XrayVPNService) {
+                            context.handleXrayCoreExit(config)
+                        } else {
+                            stopCore(context)
+                        }
+                    }
+''';
+    text = replaceOnce(text, oldExit, newExit, 'Xray fail-closed recovery');
+  }
+
+  writeIfChanged(file, before, text);
+}
+
+void patchService(File file) {
+  final before = file.readAsStringSync();
+  var text = before;
+
+  if (!text.contains('private var recoveringXray = false')) {
+    text = replaceOnce(
+      text,
+      '    private var isRunning = false\n',
+      '    @Volatile private var isRunning = false\n'
+          '    @Volatile private var recoveringXray = false\n'
+          '    private var currentConfig: XrayConfig? = null\n',
+      'service recovery fields',
+    );
+  }
+
+  const oldNullIntent = r'''        if (intent == null) {
+            stopSelf()
+            return START_NOT_STICKY
+        }
+''';
+  const newNullIntent = r'''        if (intent == null) {
+            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
+            stopSelf()
+            return START_NOT_STICKY
+        }
+''';
+  text = replaceOnce(
+    text,
+    oldNullIntent,
+    newNullIntent,
+    'null intent lifecycle',
+  );
+
+  if (!text.contains('                currentConfig = config\n')) {
+    text = replaceOnce(
+      text,
+      '                cleanup()\n',
+      '                cleanup()\n                currentConfig = config\n',
+      'runtime config snapshot',
+    );
+  }
+
+  text = replaceOnce(
+    text,
+    '        return START_STICKY\n',
+    '        return START_REDELIVER_INTENT\n',
+    'redeliver START command',
+  );
+
+  if (!text.contains('private data class SecureSocksCredentials(')) {
+    const credentialsHelper = r'''    private data class SecureSocksCredentials(
+        val port: Int,
+        val username: String,
+        val password: String,
+    )
+
+    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
+        val inbounds = try {
+            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
+        } catch (_: Exception) {
+            null
+        } ?: return null
+
+        for (i in 0 until inbounds.length()) {
+            val inbound = inbounds.optJSONObject(i) ?: continue
+            if (inbound.optString("tag") != "revolt-secure-socks") continue
+            if (inbound.optString("protocol") != "socks" ||
+                inbound.optString("listen") != "127.0.0.1"
+            ) return null
+
+            val settings = inbound.optJSONObject("settings") ?: return null
+            if (settings.optString("auth") != "password") return null
+            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
+            val port = inbound.optInt("port", -1)
+            val username = user.optString("user")
+            val password = user.optString("pass")
+            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
+                return null
+            }
+            return SecureSocksCredentials(port, username, password)
+        }
+        return null
+    }
+
+''';
+    const runComment = r'''    /**
+     * Starts the tun2socks process and initiates the FD transfer.
+     */
+    private fun runTun2socks(config: XrayConfig) {
+''';
+    text = replaceOnce(
+      text,
+      runComment,
+      '$credentialsHelper$runComment',
+      'secure credentials helper',
+    );
+  }
+
+  if (!text.contains('Authenticated ReVolt SOCKS5 inbound missing')) {
+    const commandComment = r'''        // Command to start tun2socks. 
+        // Note: We pass -sock-path to tell it where to listen for the FD.
+''';
+    const securePrelude = r'''        val secure = secureSocksCredentials(config)
+            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
+        config.LOCAL_SOCKS5_PORT = secure.port
+
+''';
+    text = replaceOnce(
+      text,
+      commandComment,
+      '$securePrelude$commandComment',
+      'secure tun2socks credentials',
+    );
+    text = replaceOnce(
+      text,
+      r'''            "-proxy", "socks5://127.0.0.1:${config.LOCAL_SOCKS5_PORT}",
+''',
+      r'''            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
+''',
+      'authenticated tun2socks URL',
+    );
+    text = replaceOnce(
+      text,
+      r'''        Log.d(TAG, "tun2socks command: ${cmd.joinToString(" ")}")
+''',
+      '        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")\n',
+      'credential-safe logging',
+    );
+  }
+
+  if (!text.contains('val process = pb.start()\n            tun2socksProcess = process')) {
+    text = replaceOnce(
+      text,
+      '            tun2socksProcess = pb.start()\n',
+      '            val process = pb.start()\n            tun2socksProcess = process\n',
+      'capture tun2socks process identity',
+    );
+    text = replaceOnce(
+      text,
+      '                    tun2socksProcess?.inputStream?.bufferedReader()?.use { reader ->\n',
+      '                    process.inputStream.bufferedReader().use { reader ->\n',
+      'tun2socks monitor stream',
+    );
+    text = replaceOnce(
+      text,
+      '                    tun2socksProcess?.waitFor()\n',
+      '                    process.waitFor()\n',
+      'tun2socks monitor wait',
+    );
+
+    const oldRestart = r'''                    if (isRunning) {
+                        // Restart if crashed and still supposed to be running
+                        Log.e(TAG, "tun2socks exited unexpectedly, restarting...")
+                        runTun2socks(config)
+                    }
+''';
+    const newRestart = r'''                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
+                        Log.e(TAG, "tun2socks exited unexpectedly, recycling without dropping TUN")
+                        Thread.sleep(350)
+                        if (isRunning && currentConfig === config) runTun2socks(config)
+                    }
+''';
+    text = replaceOnce(
+      text,
+      oldRestart,
+      newRestart,
+      'tun2socks crash recovery',
+    );
+    text = replaceOnce(
+      text,
+      '            sendFd()\n',
+      '            sendFd(process)\n',
+      'FD handoff process identity',
+    );
+  }
+
+  const oldStartFailure = r'''        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks", e)
+            stopAll()
+        }
+''';
+  const newStartFailure = r'''        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start tun2socks; retrying with TUN held", e)
+            if (isRunning && currentConfig === config) {
+                Thread {
+                    try {
+                        Thread.sleep(600)
+                        if (isRunning && currentConfig === config) runTun2socks(config)
+                    } catch (_: InterruptedException) {}
+                }.start()
+            }
+        }
+''';
+  text = replaceOnce(
+    text,
+    oldStartFailure,
+    newStartFailure,
+    'tun2socks start failure recovery',
+  );
+
+  if (!text.contains('FD handoff failed; recycling tun2socks without dropping TUN')) {
+    const oldSendFd = r'''    private fun sendFd() {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10) {
+                try {
+                    Thread.sleep(500)
+                    val localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    // This magic call attaches the FD to the socket message
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32) // Send a dummy byte to trigger the transfer
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    break
+                } catch (e: Exception) {
+                    tries++
+                }
+            }
+        }.start()
+    }
+''';
+    const newSendFd = r'''    private fun sendFd(process: Process) {
+        val fd = mInterface?.fileDescriptor ?: return
+        val sockFile = File(filesDir, "sock_path").absolutePath
+
+        Thread {
+            var tries = 0
+            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
+                var localSocket: LocalSocket? = null
+                try {
+                    Thread.sleep(500)
+                    localSocket = LocalSocket()
+                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
+                    val out = localSocket.outputStream
+                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
+                    out.write(32)
+                    out.flush()
+                    localSocket.setFileDescriptorsForSend(null)
+                    localSocket.shutdownOutput()
+                    localSocket.close()
+                    return@Thread
+                } catch (_: Exception) {
+                    tries++
+                    try { localSocket?.close() } catch (_: Exception) {}
+                }
+            }
+
+            if (isRunning && tun2socksProcess === process) {
+                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
+                try { process.destroy() } catch (_: Exception) {}
+            }
+        }.start()
+    }
+''';
+    text = replaceOnce(text, oldSendFd, newSendFd, 'bounded FD recovery');
+  }
+
+  if (!text.contains('fun handleXrayCoreExit(config: XrayConfig)')) {
+    const cleanupComment = r'''    /**
+     * Cleans up resources (tun2socks process, VPN interface) without stopping the service completely.
+     * Used when restarting or switching configurations.
+     */
+''';
+    const recovery = r'''    fun handleXrayCoreExit(config: XrayConfig) {
+        if (!isRunning || currentConfig !== config || recoveringXray) return
+        recoveringXray = true
+
+        Thread {
+            var attempt = 0
+            try {
+                while (isRunning && currentConfig === config) {
+                    attempt++
+                    Thread.sleep(400L * attempt.coerceAtMost(5))
+                    if (!isRunning || currentConfig !== config) break
+
+                    Log.w(TAG, "Recovering Xray core attempt $attempt")
+                    if (XrayCoreManager.startCore(this, config)) {
+                        Log.w(TAG, "Xray core recovered without dropping TUN")
+                        return@Thread
+                    }
+
+                    if (attempt >= 3) {
+                        attempt = 0
+                        Thread.sleep(3000)
+                    }
+                }
+            } catch (_: InterruptedException) {
+            } finally {
+                recoveringXray = false
+            }
+        }.start()
+    }
+
+''';
+    text = replaceOnce(
+      text,
+      cleanupComment,
+      '$recovery$cleanupComment',
+      'Xray recovery loop',
+    );
+  }
+
+  if (!text.contains('        recoveringXray = false\n        tun2socksProcess?.destroy()')) {
+    text = replaceOnce(
+      text,
+      '        isRunning = false\n        tun2socksProcess?.destroy()\n',
+      '        isRunning = false\n        recoveringXray = false\n        tun2socksProcess?.destroy()\n',
+      'cancel recovery on cleanup',
+    );
+  }
+
+  if (!text.contains('        currentConfig = null\n        XrayCoreManager.stopCore(this)')) {
+    text = replaceOnce(
+      text,
+      '        cleanup()\n        XrayCoreManager.stopCore(this)\n',
+      '        cleanup()\n        currentConfig = null\n        XrayCoreManager.stopCore(this)\n',
+      'clear config on explicit stop',
+    );
+  }
+
+  writeIfChanged(file, before, text);
+}
+
+void main() {
+  final root = packageRoot();
+  final kotlin = Directory(
+    '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless',
+  );
+  final core = File('${kotlin.path}/xray/core/XrayCoreManager.kt');
+  final service = File('${kotlin.path}/xray/service/XrayVPNService.kt');
+  if (!core.existsSync() || !service.existsSync()) {
+    fail('pinned Android runtime sources are missing');
+  }
+
+  patchCore(core);
+  patchService(service);
+  stdout.writeln('[secure-socks patch] stable-core security patch is ready');
+}