TheUnboundDeveloper/AM-Reaper v2.8.4-RT-BE86U

Reaper v2.8.4 — RT-BE86U

on GitHub

v2.8.4 — The Warden page can save again

A single fault, reported from the field within hours of v2.8.3: on the Warden page, changing a
block list or pressing Update now answered "invalid request token", and it kept answering
that after logging out and back in. It was reported from Firefox, but the browser was never
involved and neither was the login — every browser behaved the same way.

• Saving on the Warden page works again. When the block and allow lists moved out of nvram
  into flash storage, the page began sending them to the router in a packaging format its web
  server does not read. The request therefore arrived carrying nothing at all — including the
  token that proves it came from you — so it was refused as untrusted. The page now sends them
  the same way every other settings page does. Worth knowing if you hit this: the refusal
  stopped the whole save, not just the lists, so the master switch, country selection, feed
  selection and logging could not be changed either, on both buttons. The live statistics on
  that page kept updating the entire time, which is why it looked healthy while nothing you
  changed would stick. Nothing was lost — the settings were never written, so they are exactly
  as you left them.
• A refused request now says which kind of refusal it was. One message covered three
  different problems: a request that never arrived intact, a genuinely stale security token, and
  a request sent from another website. That is why this fault read as an expired session and sent
  people through pointless logouts. The three now read differently, so the next report of this
  kind identifies itself. What the router allows has not changed at all — every request that
  was accepted before is still accepted, and every one that was refused is still refused.

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v2.8.4.txt.

Corresponding source & reproducibility

The RT-BE86U image for v2.8.4 is built from this repository at tag v2.8.4-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0554)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): bf5dcd3b0306cc5963ca663581613ada8346c5bf -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.8.4-RT-BE86U (patches + docs).