GOD13emad · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 15, 2026 · Oct 15, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
diff --git a/PROJECT_BRAIN.md b/PROJECT_BRAIN.md
diff --git a/build_linux_package.py b/build_linux_package.py
@@ -2,17 +2,23 @@
 from __future__ import annotations
 import hashlib,json,pathlib,zipfile,tempfile,os
 R=pathlib.Path(__file__).resolve().parent
-OUT=R/"delivery"/"DirectInternetMethod_1.5.4_Linux_x86_64.zip"
-ROOT="DirectInternetMethod_1.5.4_Linux_x86_64"
+OUT=R/"delivery"/"DirectInternetMethod_1.5.7_Linux_x86_64.zip"
+ROOT="DirectInternetMethod_1.5.7_Linux_x86_64"
 FILES=[
- ("docs/README_PACKAGE_154.md","README.md"),
+ ("docs/README_PACKAGE_157.md","README.md"),
  ("linux/install.sh","install.sh"),
  ("linux/uninstall.sh","uninstall.sh"),
  ("linux/system/install_system.sh","system/install_system.sh"),
  ("linux/system/control.sh","system/control.sh"),
  ("linux/system/selective_dns.py","system/selective_dns.py"),
+ ("linux/system/encrypted_selective_dns.py","system/encrypted_selective_dns.py"),
+ ("linux/system/encrypted_selective_policy.py","system/encrypted_selective_policy.py"),
+ ("linux/system/protected_upgrade_transaction.py","system/protected_upgrade_transaction.py"),
+ ("linux/system/upgrade_guard.py","system/upgrade_guard.py"),
+ ("linux/system/upgrade_system.sh","system/upgrade_system.sh"),
  ("linux/system/uninstall_system.sh","system/uninstall_system.sh"),
  ("linux/app/direct_internet_method.py","app/direct_internet_method.py"),
+ ("linux/app/socket_fallback.py","app/socket_fallback.py"),
  ("linux/app/router_gateway.py","app/router_gateway.py"),
  ("linux/app/router_gateway_core.py","app/router_gateway_core.py"),
  ("linux/app/user_update_transaction.py","app/user_update_transaction.py"),
@@ -36,15 +42,15 @@ def payload_bytes(src:str,dst:str)->bytes:
   data=data.replace(b"\r\n",b"\n").replace(b"\r",b"\n")
  return data
 # Frozen originally shipped documentation; root README may describe current publication.
-if sha_bytes(payload_bytes("docs/README_PACKAGE_154.md","README.md"))!="4E17DB910024D0D5841857928C45AD0EC2C5D65D30B3311FBE1864F1885AC84F":
- raise SystemExit("V154_PACKAGE_README_SHA_CHANGED")
+if sha_bytes(payload_bytes("docs/README_PACKAGE_157.md","README.md"))!="9F7266E65D31DE84EE62A541FF35F9621E5009BF097C256D75FD2DFC407F21FF":
+ raise SystemExit("R519_PACKAGE_README_SHA_CHANGED")
 rows=[]
 for src,dst in FILES:
  p=R/src
  if not p.is_file(): raise SystemExit("MISSING:"+src)
  data=payload_bytes(src,dst)
  rows.append({"file":dst,"bytes":len(data),"sha256":sha_bytes(data)})
-manifest={"schema":1,"product":"Direct Internet Method","version":"1.5.4","platform":"linux-x86_64","files":rows}
+manifest={"schema":1,"product":"Direct Internet Method","version":"1.5.7","platform":"linux-x86_64","files":rows}
 OUT.parent.mkdir(parents=True,exist_ok=True)
 fd,tmp_name=tempfile.mkstemp(prefix="dim-build-",suffix=".zip",dir=OUT.parent)
 os.close(fd)
@@ -53,7 +59,7 @@ def payload_bytes(src:str,dst:str)->bytes:
  with zipfile.ZipFile(tmp,"w",compression=zipfile.ZIP_STORED) as z:
   for src,dst in sorted(FILES,key=lambda x:x[1]):
    data=payload_bytes(src,dst)
-   zi=zipfile.ZipInfo(f"{ROOT}/{dst}",date_time=(2026,10,1,0,0,0))
+   zi=zipfile.ZipInfo(f"{ROOT}/{dst}",date_time=(2026,10,14,0,0,0))
    zi.create_system=3
    zi.external_attr=((0o755 if dst.endswith((".sh",".py")) or dst in ("runtime/ctrld","runtime/nfqws") else 0o644)&0xFFFF)<<16
    zi.compress_type=zipfile.ZIP_STORED
@@ -63,7 +69,7 @@ def payload_bytes(src:str,dst:str)->bytes:
    ("SHA256SUMS.txt","".join(f'{x["sha256"]}  {x["file"]}\n' for x in rows))
   ]:
    data=(json.dumps(obj,ensure_ascii=False,indent=2)+"\n").encode() if isinstance(obj,dict) else obj.encode()
-   zi=zipfile.ZipInfo(f"{ROOT}/{name}",date_time=(2026,10,1,0,0,0))
+   zi=zipfile.ZipInfo(f"{ROOT}/{name}",date_time=(2026,10,14,0,0,0))
    zi.create_system=3
    zi.external_attr=(0o644&0xFFFF)<<16;zi.compress_type=zipfile.ZIP_STORED
    z.writestr(zi,data)

diff --git a/docs/ENCRYPTED_DNS_R516.md b/docs/ENCRYPTED_DNS_R516.md
@@ -0,0 +1,95 @@
+# R516 — encrypted selective DNS candidate (NOT RELEASED)
+
+**Project:** Direct Internet Method; source authority is exact GitHub main commit
+`26ef644117ea474b487186ce5e6e61e92cd02dd4`. Existing public
+Stable remains **v1.5.4**. The last cumulative Project Brain accepted is R514
+SHA-256 `DF4D5EFD2F412D344160745491BC5F812DCD03AF8D89B3B21FC5644D9C229300`.
+
+## Reason and evidence
+
+The installed Linux `linux/system/selective_dns.py` has an explicitly
+opted-in but **unencrypted** UDP upstream `194.225.152.10` routed via
+`dnsmasq`. It does not meet the project's encrypted-DNS requirement
+under observed DNS interception.
+
+R511 and R513 used the already bundled `ctrld v1.5.7` with verified TLS
+DoH `https://76.76.10.11/p0` on bounded per-link DNS pilots. R516 added
+a narrower localhost-only source-policy test (non-root, MMZ Linux on
+2026-10-14) on `127.0.0.1:53534` with `systemd-run --user` and a 90-second
+`RuntimeMaxSec`; system DNS, Tailscale and the Direct Method app were not
+changed. Exact runtime TOML SHA-256:
+`46F63805FE53B5CEDC6B7D4DF242BBF13A6CA8229BB9072058BE8DE304697954`.
+
+Observed R516 localhost DNS:
+- `www.youtube.com`: public IP addresses `142.251.150.4` through
+  `142.251.157.4`, no RFC1918 addresses;
+- `www.googlevideo.com`: public `142.251.141.36`;
+- `github.com`: public `140.82.121.3`, same as router;
+- `example.com`: public Cloudflare IPs;
+- direct query against original `192.168.8.1` returned forged/private
+  `10.10.34.36` for YouTube.
+The temporary user unit exited or was stopped and the listener was absent,
+with DNS and default route/Tailscale unchanged.
+
+Independent repeat on Emad Linux (router `192.168.20.1`, `127.0.0.1:53535`)
+generated **byte-exact** source TOML SHA-256
+`3CC90962571AC80220B1A947C901709C64CD0DA0BD63EE5BEB6D1EC8781615DC`.
+The DoH path gave legitimate public YouTube and Googlevideo addresses,
+and `github.com` matched the physical router. **`example.com` timed out
+because this non-target request intentionally fell back to Emad's unreliable
+router DNS.** Thus the targeted model demonstrably protects listed domains;
+it does NOT repair arbitrary domains, which require an explicit broader opt-in.
+The user-bounded test service stopped, with physical DNS, Tailscale and
+Direct Method unchanged. On Emad, the separate Seman L2TP connection remained
+user-controlled and was not used to infer safe combined product mode.
+
+Both routers' rendered Policy bytes are pinned in the **46/46 offline
+negative-first tests**, and all invalid resolver addresses and unsafe ports
+fail closed. MMZ direct router YouTube answers were private during the test;
+Emad's physical router responses vary over time, so one public answer from
+that router does not establish reliable default DNS.
+
+The pure source policy generator in
+`linux/system/encrypted_selective_policy.py` emits **byte-exact** TOML
+for the validated MMZ router and temporary listener port. It has negative-first
+rootless contracts in `tests/encrypted_selective_dns_policy_contract.py`.
+No installer, root helper, UI, upgrade flow or published binary is wired
+to this policy in R516.
+
+## Acceptance and open gates
+
+**PASS:** rootless isolated policy, exact runtime sample, encrypted target
+DoH with real public A, original router fallback for non-target names and
+bounded cleanup without product/system DNS/Tailscale changes.
+
+**OPEN:** supervised integration into one protected updater and GUI;
+opt-in token migration from *unencrypted* to *encrypted* (never silently
+reinterpret consent); native per-link route-only recovery/backstop with
+systemd-resolved; tests on Ubuntu 26 under actual installed user/service;
+one-install update/rollback and hosted exact-SHA CI; selected-site HTTPS
+access (MMZ YouTube still curl35); Seman concurrent VPN policy and
+service/region HTTP403.
+
+The generator must not be silently substituted into v1.5.4's old
+`dnsmasq` controller, because the controller's assumptions (runtime
+binary, state schema, consent, rollback) differ. **SUPERSEDED—DO NOT RUN**
+includes older temporary R510/R512/R513/R514 and independently completed
+R515 scripts; preserve previous Brain and historical raw files.
+
+## Next exact action
+
+In a separate transaction, design and negative-test an opt-in encrypted
+controller that owns a disposable per-link resolver, enforces route-only
+domains and exposes an independent bounded rollback before touching DNS.
+Then modify the protected installer and GUI together in a versioned release
+candidate; require a clean in-place upgrade path, native V&V, CI and
+explicit promotion gates. Do not publish merely because the pure policy
+and DNS lookups PASS.
+
+Sources:
+- Control D ctrld v1.5.7 configuration reference, policy precedence
+  (rules before networks): https://github.com/Control-D-Inc/ctrld/blob/v1.5.7/docs/config.md
+- Ubuntu systemd-resolved D-Bus SetLinkDNSEx/SetLinkDomains/RevertLink:
+  https://manpages.ubuntu.com/manpages/resolute/man5/org.freedesktop.resolve1.5.html
+- Public v1.5.4 release:
+  https://github.com/GOD13emad/DirectInternetMethod/releases/tag/v1.5.4
diff --git a/docs/README_PACKAGE_155_RC1.md b/docs/README_PACKAGE_155_RC1.md
@@ -0,0 +1,41 @@
+# Direct Internet Method 1.5.5-rc1 — Linux candidate (NOT RELEASED)
+
+This archive is a versioned development candidate for upgrading the existing
+single-install Linux app from public **v1.5.4**. It is not a public Stable
+release and must not be offered as an automatic update.
+
+## Scope
+- Existing v1.5.4 settings, custom hosts, Router Gateway provider and
+  Tailscale split mode must remain intact.
+- Explicit NEW consent is required for encrypted selective DNS. Previous
+  unencrypted third-party UDP opt-in does **not** count as consent.
+- Pinned ctrld v1.5.7 DoH upstream routes only documented target domains
+  through an owned per-link resolver. Non-target DNS stays with the user's
+  physical DNS server, which may still time out or be intercepted.
+- The root backend upgrade from installed protected v1.5.2 is a single-slot
+  accepted-SHA transaction with an independent Rollback; it is **not**
+  authorized for promotion until installed-native QA and hosted CI.
+- Running a new root backend without an accepted user/backend pair is
+  forbidden. The candidate's installer must fail closed if either side is
+  foreign, active, or has an uncommitted conflicting transaction.
+
+## Known limitations / open acceptance gates
+The R516 targeted DNS pilot succeeded on two different LANs, and the R517
+controller passed source-only and simulated rollback tests; these do not
+demonstrate a successful upgrade, protection after reboot, a working
+per-link resolver under live root, or access to every website.
+YouTube HTTPS on the MMZ mobile ISP reset TLS even after native balanced
+DPI, with a separate Strong test's root-only receipts unavailable. Seman
+L2TP combined with Tailscale is not an accepted mode. Some services may
+still return a region/account-specific HTTP 403.
+
+Do not delete backups, auto-promote, disable Tailscale/Seman, reset system
+DNS, reboot or shutdown as part of installation.
+A native acceptance record must prove exact SHA, data preservation, service
+Start/Stop/Recovery, rollback, Tailscale and physical DNS invariants before
+release.
+
+Source authority: GOD13emad/DirectInternetMethod, main commit
+26ef644117ea474b487186ce5e6e61e92cd02dd4, versioned R519 branch.
+Public release authority remains v1.5.4 (tag
+51009372e3c2d069d7016b97773f35ee5e1e0631).
diff --git a/docs/README_PACKAGE_156.md b/docs/README_PACKAGE_156.md
@@ -0,0 +1,54 @@
+# Direct Internet Method v1.5.6 — Linux release-preparation candidate (NOT PUBLISHED)
+
+This package is a **private validation candidate**, not a second public product
+line. The current public Stable remains v1.5.4 until a separate authorized
+GitHub release establishes exact asset identities and accepted test receipts.
+
+## Supported single-install upgrade paths
+
+- Public Linux User 1.5.4 with protected Root backend 1.5.2.
+- Previously owner-accepted private Linux User 1.5.5-rc1 with protected Root
+  backend 1.5.5-rc1.
+- No mixed, unknown, modified, symlinked, or partially installed Root/User pair
+  is silently upgraded. Existing custom Router Gateway data, settings,
+  Tailscale, DNS/physical route, and one original installation must survive.
+- Windows private installations have FileVersion 1.5.5.0. Public v1.5.5 is
+  **not** a forward numeric upgrade for their existing updater; v1.5.6 is the
+  first normal three-component version that can update them directly.
+
+## Security and recovery
+
+Privileged protected-file reads accept only literal approved filenames with
+descriptor-based no-symlink traversal, pinned SHA-256 payloads, regular-file
+identity, and verified original ownership. A per-transaction random acceptance
+nonce prevents replay of previous Root acceptance receipts. The new
+version-specific trusted privileged bootstrap must be installed only through
+normal native administrator authorization after verifying its reviewed digest.
+
+The Root+User maintenance transaction has one private rollback slot; a separate
+Root-owned watchdog is armed before protected mutation and must be settled with
+real Start, Stop, Recovery, original DNS/Tailscale checks and user settings
+hashes before release. A preliminary staged/apply or hosted CI PASS alone does
+not authorize physical deployment or publication. Do not disable host security
+policies, reboot, modify default routes, reset DNS, or automatically install
+a VPN or global tunnel.
+
+## Known acceptance limits
+
+Some physical networks reset YouTube TLS depending on SNI even when
+public Google IPs are reachable. Site acceptance must be verified on the
+intended network; no universal-connectivity claim is made. The current
+physical network is not a verified universal connectivity target. Historical
+plain `curl` HTTP403 and isolated headless browser timeout do **not** prove
+ChatGPT account sign-in. Optional encrypted selective-DNS needs explicit,
+separate user consent, and its controller remains restricted to safe native
+rollback and Tailscale coexistence.
+
+Current exact source starting point: primary PR #63 commit
+`b38aa94b67fb102dd24359184abaa324cd29a3ad`, plus separately scoped
+R803 forward-upgrade migration work. The new candidate's final Git SHA,
+package digest, hosted Linux/Windows acceptance and release decision remain
+UNVERIFIED until recorded on the exact generated artifacts.
+
+Public v1.5.4 release and protected `main` remain unchanged. This document is
+a package-level statement of intended behavior, not a claim of publication.
diff --git a/docs/README_PACKAGE_157.md b/docs/README_PACKAGE_157.md
@@ -0,0 +1,56 @@
+# Direct Internet Method v1.5.7 — Linux release-preparation candidate (NOT PUBLISHED)
+
+This package is a **private validation candidate**, not a second public product
+line. The current public Stable remains v1.5.4 until a separate authorized
+GitHub release establishes exact asset identities and accepted test receipts.
+
+## Supported single-install upgrade paths
+
+- Public Linux User 1.5.4 with protected Root backend 1.5.2.
+- Previously owner-accepted private Linux User 1.5.5-rc1 with protected Root
+  backend 1.5.5-rc1.
+- No mixed, unknown, modified, symlinked, or partially installed Root/User pair
+  is silently upgraded. Existing custom Router Gateway data, settings,
+  Tailscale, DNS/physical route, and one original installation must survive.
+- Windows private installations exist with FileVersion 1.5.5.0 and 1.5.6.0.
+Publishing v1.5.6 will NOT offer an update to existing private v1.5.6.
+Strictly newer v1.5.7 is required after full security and native acceptance.
+
+## Security and recovery
+
+Privileged protected-file reads accept only literal approved filenames with
+descriptor-based no-symlink traversal, pinned SHA-256 payloads, regular-file
+identity, and verified original ownership. A per-transaction random acceptance
+nonce prevents replay of previous Root acceptance receipts. The new
+version-specific trusted privileged bootstrap must be installed only through
+normal native administrator authorization after verifying its reviewed digest.
+
+The Root+User maintenance transaction has one private rollback slot; a separate
+Root-owned watchdog is armed before protected mutation and must be settled with
+real Start, Stop, Recovery, original DNS/Tailscale checks and user settings
+hashes before release. A preliminary staged/apply or hosted CI PASS alone does
+not authorize physical deployment or publication. Do not disable host security
+policies, reboot, modify default routes, reset DNS, or automatically install
+a VPN or global tunnel.
+
+## Known acceptance limits
+
+Some physical networks reset YouTube TLS depending on SNI even when
+public Google IPs are reachable. Site acceptance must be verified on the
+intended network; no universal-connectivity claim is made. The current
+physical network is not a verified universal connectivity target. Historical
+plain `curl` HTTP403 and isolated headless browser timeout do **not** prove
+ChatGPT account sign-in. Optional encrypted selective-DNS needs explicit,
+separate user consent, and its controller remains restricted to safe native
+rollback and Tailscale coexistence.
+
+Current exact source starting point: primary PR #63 commit
+`b38aa94b67fb102dd24359184abaa324cd29a3ad`, plus separately scoped
+R803 forward-upgrade migration work. The new candidate's final Git SHA,
+package digest, hosted Linux/Windows acceptance and release decision remain
+UNVERIFIED until recorded on the exact generated artifacts.
+
+Public v1.5.4 release and protected `main` remain unchanged. This document is
+a package-level statement of intended behavior, not a claim of publication.
+
+R845 engineering draft: source preflight ONLY; native installation, CI and release are NOT ACCEPTED.