- Replace the fixed startup grace with consecutive successful connectivity checks
- Arm fast reboot recovery only after five successful ping checks
- Reset the warmup counter when connectivity fails before arming
- Add a one-hour hard recovery reboot when the watchdog never becomes armed
- Use router uptime as a monotonic timer for the unarmed recovery timeout
- Allow the hard recovery fallback to be disabled with a zero timeout
- Propagate the new watchdog settings through runtime generation and validation
- Update documentation for the new arming and recovery behavior
- Move WiFi capability detection into a standalone ucode script
- Prefer the newest supported WiFi mode before selecting channel width
- Select the widest supported width within the radio max_width limit
- Avoid selecting 160 MHz on radios limited to 80 MHz
- Keep first-boot UCI application isolated from WiFi selection logic
- Add CIDR-squash package download and include it in required router packages
- Optimize direct IPv4 lists with configurable CIDR over-coverage
- Reuse the shared update-ipsets.sh implementation on both routers and exit servers
- Install CIDR-squash from source during exit server deployment
- Move direct-list paths, sources, and download settings into generated runtime environments
- Keep firewall ipset loadfile paths synchronized with runtime configuration
- Validate required runtime settings in router and server scripts
- Align generated file validation and documentation with the shared direct-list workflow
- Remove the Watchcat configuration and package dependency
- Add generated ping-reboot watchdog settings with boot grace, retry interval, failure threshold, and ping timeout
- Document the custom connectivity watchdog behavior and manual check mode
- Accept both CIDR prefixes and individual IPv4 addresses from IPinfo Lite
- Normalize individual IPv4 addresses to explicit /32 prefixes
- Apply direct-list normalization consistently on routers and AWG servers
- Document that generated direct lists always use explicit IPv4 CIDR notation
- Replace IPverse country feeds with filtered IPinfo Lite IPv4 CIDRs
- Reuse update-ipsets.sh during generation to keep initial and runtime direct lists consistent
- Validate downloaded IPinfo archives and clean up temporary country data
- Keep IPverse as the source for ASN-based direct routing
- Make source URLs, filenames, and download settings implementation-owned defaults
- Allow local generation to override the ipset path and suppress firewall reloads
- Increase the runtime direct-list download timeout to three minutes
- Remove Alibaba / AliExpress ASN45102 from the default direct ASN list
- Document the new country source, generation flow, and IPinfo attribution
- Add IPverse country-ip-blocks alongside geo-ip-blocks
- Merge GeoIP and RIR delegation prefixes for every direct country
- Apply the combined country lists on both routers and AWG servers
- Use both country sources when generating runtime direct lists
- Document the GeoIP and RIR union behavior
- Increase default download timeout from 5 to 15 minutes
- Apply the longer timeout to optional downloads as well
- Add Alibaba / AliExpress ASN45102 to the documented direct ASN list
- Replace IPverse country-ip-blocks with geo-ip-blocks
- Update country IPv4 list URLs to the GeoIP repository layout
- Apply the new country source to both router and AWG server runtime scripts
- Update runtime generation defaults to use the GeoIP-based country lists
- Keep ASN-based direct routing unchanged
- Remove the legacy Amnezia PPA before package installation
- Purge previously installed AmneziaWG PPA packages during migration
- Detect the latest stable kernel and tools release tags directly from upstream repositories
- Verify kernel and tools releases belong to the same compatible version family
- Build and install the AmneziaWG kernel module through DKMS
- Build and install amneziawg-tools from the matching upstream release
- Skip rebuilding components when the requested release is already installed
- Validate exact release tags, installed versions, DKMS state, and module paths
- Add required DKMS, kernel build, and ELF development dependencies
- Stop downloading libcares from the custom c-ares GitHub release
- Remove the --skip-cares-download generator option
- Drop libcares from required router packages
- Remove c-ares package URLs and constants from defaults
- Update README examples and documentation to match the simplified package flow
- Build and install a pinned xt_ndpi version during server deployment
- Skip rebuilding nDPI when the expected module version is already installed
- Validate required conntrack kernel options and iptables nDPI support
- Block BitTorrent traffic from exit subnets using nDPI
- Inspect reply traffic before the ESTABLISHED fast path to maintain nDPI flow state
- Bypass DPI for TCP ports 80/443 and UDP port 443 to avoid inspecting ordinary web traffic
- Add wifi_6g configuration and map it to radio2/default_radio2
- Use band-specific encryption: psk2 for 2.4 GHz, sae-mixed for 5 GHz, and sae for 6 GHz
- Extend managed WiFi bootstrap cleanup to radio2
- Document 6 GHz configuration and per-band encryption defaults
- Reduce Watchcat ping and reboot detection intervals
- Detect radio capabilities from /etc/board.json
- Select the widest supported HT/VHT/HE/EHT mode
- Use the radio-specific default channel when available
- Leave disabled radios unchanged
- Document automatic WiFi tuning in README
- add --undeploy with public/node/auto SSH host fallback
- disable managed systemd units and remove generated server files
- remove only project-managed entries from authorized_keys
- keep AWG network state alive until reboot to avoid breaking overlay SSH
- reboot the server after cleanup
- show curl progress while downloading OpenWrt ImageBuilder archives
- update README with undeploy workflow and generated server layout
- Generate allow rules for both Mesh and Exit ingress
- Reject allow_to_router and allow_to_lan targeting the source router
- Remove the special SSH allow rule from Exit
- Include the ingress zone in generated allow rule names
- Remove legacy allow rules during firewall regeneration
- Update firewall validation and documentation
- Enable WPA2/WPA3 mixed mode
- allow routers[].openwrt_version to override the global version
- support *-SNAPSHOT versions such as 25.12-SNAPSHOT
- download and use ImageBuilders per version + target/subtarget
- download and sync package repositories per router OpenWrt version
- correctly detect SNAPSHOT images containing revision identifiers
- make router deployment select sysupgrade images for the effective OpenWrt version
- add --version override support to build and upgrade commands
- update config.json examples and README documentation
- add AWG 3.x rekey, handshake, keepalive, trailer and cookie options
- generate deterministic directional Jc/Jmin/Jmax and I1-I5 signatures
- keep S1-S4 and H1-H4 shared between both ends of a link
- derive stable runtime parameter ranges for infra and access tunnels
- add optional HeaderProtectionKey and ContentPaddingAddition support
- disable automatic header protection until the upstream kernel issue is fixed
- diversify Babel hello/update intervals per local tunnel direction
- use a consistent tunnel MTU profile: 1400 for AWG/WG and 1380 for IPIP
- propagate AWG 3.1 options through mesh, exit, access, client and server configs
- validate AWG 3.x ranges, header protection constraints and generated tunnel configs
- update README examples and AWG 3.1 documentation
- store downloaded OpenWrt ImageBuilder archives under imagebuilders/
- save link speed reports under link-speeds/ by default
- enable link speed measurement progress by default
- make topology renderers use link-speeds/link-speeds.json
- remove obsolete and redundant temporary-file ignore rules
- update README examples for the new defaults
- let procd respawn https-dns-proxy indefinitely after crashes
- remove manual https-dns-proxy restarts from check-doh
- use sendclientid='none' instead of patching netifd dhcp.sh
- show the deploy version in the OpenWrt login banner
- generate router-*.mesh DNS records in dhcp_part
from both router-level and access-group allow_to_router rules
- expand allow_to_router=all to all other routers and merge explicit targets
- preserve manual dhcp_part entries and remove stale generated DNS records
- use anonymous UCI hostrecord sections for generated mesh DNS
- switch collect_link_speeds.py to asyncio-based parallel measurements
- add -j/--jobs to limit concurrent iperf3 measurements
- prevent simultaneous measurements that share a router/server endpoint
- make generated exit rule/route UCI sections anonymous
- migrate legacy owmb_exit_rule_* and owmb_exit_route_* sections
- update network validation for anonymous exit policy objects
- include dhcp_part in generated/unmanaged file tracking
- document mesh DNS behavior, parallel measurements and AWG access options
- replace measured 2D SVG maps with an interactive Canvas HTML view
- keep a separate static SVG containing topology-only colors
- share layout geometry between Canvas and SVG renderers
- preserve spine and exit ring order, closing-edge direction, and parallel exit lanes
- align node ordering and directed links between 2D and 3D views
- add from, to, and topology color modes
- add link-group toggles and a 0-500 Mbit/s range filter
- support dimming or hiding links outside the selected speed range
- show arrows for the currently displayed measurement direction
- distinguish down, failed, and missing measurements from the speed scale
- unify 2D and 3D control-panel layout and legends
- shorten link tooltips to directional speed and status
- generate topology-2d.html, topology-2d.svg, and topology-3d.html
- rename public topology files and templates to use hyphenated names
- send collector progress to stdout while writing reports and JSON to separate files
- update README examples, generated-file descriptions, and topology documentation
- restart `https-dns-proxy` after switching dnsmasq to provider DNS
- perform the restart on a best-effort basis without interrupting fallback
- restart DoH only when the DNS mode actually changes
- avoid repeated service restarts while provider DNS is already active
- allow the next health-check cycle to switch back to DoH after recovery
- add an optional `pppoe` section to router configuration
- support PPPoE username, password, and optional MTU
- use MTU 1480 by default when it is not explicitly configured
- generate PPPoE WAN settings in `99-firstboot-custom`
- preserve multiline formatting for encrypted `OWMB_ENC_SECRET_V1` values
- validate the configured PPPoE MTU
- remove the generated PPPoE block when the section is removed
- add a PPPoE configuration example to `config.json`
- Support per-device WAN, split, and exit routing modes
- Move exit policy marks and routing tables to IDs starting at 10000
- Generate and validate matching firewall and network rules
- Add the --details option
- Improve generation logs
- Update Watchcat defaults
