TheUnboundDeveloper/AM-Reaper v3.1.9-beta-RT-BE86U

Reaper v3.1.9-beta — RT-BE86U

on GitHub

v3.1.9 — Policy Routing follows the order you wrote it in, and a firewall rebuild stops fighting itself

• Policy Routing rules now follow the order you put them in. A rule naming a destination, an
  address list or a domain could be silently overruled by a broader source rule further down the list.
  Every rule wrote its decision over the one before it, so the last rule to match won rather than the
  first. What made this hard to spot is that it only showed up one way round: a device sent to a tunnel
  by a Policy Routing source rule stopped following its own destination rules, while the same device
  sent to the same tunnel by VPN Director kept following them, which made it look like a VPN fault. It
  was not. The first rule that matches now decides, and nothing later can overturn it. Put specific
  rules above broad ones. If you built a list that worked around the old behaviour, check it after
  updating, because it will now be read top-down.
• Rule Status stops showing its test addresses as if they were devices. The tab has no traffic of
  its own: it walks each feature's promise through the live tables using stand-in addresses it makes
  up, including one that looks like an ordinary LAN client. Nothing is ever sent to them. They are now
  named as stand-ins at the top of the tab, instead of appearing bare in every row that uses one.
• A firewall rebuild no longer takes DNS away from restricted devices — three times over.
  One QoS apply on the primary router rebuilt the firewall, and for the next fifty seconds three
  Reaper layers, the shared front hook, the watchdog and a hand-written DNS carve-out watcher took
  turns re-inserting rules at the head of the FORWARD chain, each undoing the last. Every round
  cost the access-restricted devices their DNS. Four things changed so that cannot recur:
  Gatekeeper now lets an internet-only device's DNS through when the router itself redirected it
  (a Service Intercept to a resolver on another network), so no carve-out has to sit ahead of the
  Reaper hook at all; the front hook keeps its place behind a narrow carve-out or a declared
  exemption instead of re-pinning to position 1 on every layer apply (the watchdog already
  tolerated those; the hook did not); Warden's apply builds and refills its sets before it touches
  the chain and replays the cached feeds in one pass, so the chain is absent for milliseconds
  instead of the 17 seconds a large cache took; and the watchdog now confirms a missing Warden
  chain on two ticks, re-checks under the firewall lock and only then re-applies — a rebuild in
  progress is no longer reported as an outage or "healed" with a third apply.
• A firewall rule can no longer vanish silently. This platform's iptables has no lock, so when
  two things edit the tables in the same instant one of the changes can fail, and the Gatekeeper and
  Warden apply scripts made a few hundred rule additions each without checking any of them. On the
  primary router two rules out of 126 went missing at boot; one was an internet-only device's pass
  rule, so that device had no internet until the chains were rebuilt. Every addition is now retried
  once, anything that still fails is counted and named in the log, and the Gatekeeper daemon
  re-applies when the count is not zero. The Rule Status walker also stops using a fixed test
  address for "reaches the internet" rows: if the operator has blocked that address, it moves to the
  next public candidate and says so, instead of painting every WAN-bound row red.
• Two field reports closed. The Dashboard's own left rail never marked the Dashboard entry as
  the current page while every other page did; it does now. And "DoS protection not enabled when
  toggled on" was the page showing the setting rather than the state: the engine only hooks the
  guard while the firewall master switch is on and the router is routing, so a DoS toggle under a
  switched-off firewall saved fine and armed nothing. The toggle is now dimmed with the reason when
  the master switch is off, the status strip reports the armed state, and the Rule Status tab has a
  row that asks the live table whether the WAN actually jumps to the guard, naming the master switch
  when it does not.
• A DNS intercept fails open. A Service Intercept aimed at the resolver the DNS Health Check
  watches is closed while that resolver is down and reopened when it answers, with the port's
  connection entries flushed at each switch, so clients fall through to the router's own DNS
  instead of being redirected into a dead host. This replaces the hand-written watcher some installs
  ran for the same purpose.
• Two QoS options are gone: L4S marking and Wi-Fi downstream priority (WMM). L4S was never
  accepted by the traffic manager on the validated port ("dualq isn't supported"), and until now its
  rejection silently abandoned the whole priority correction, leaving the class queues at the stock
  inverted layout for as long as the toggle stayed on. The WMM lift was measured to halve wireless
  throughput in both directions, because lifting the top class to the voice access category defeats
  frame aggregation. Neither had a setup where it helped, so both are removed from the page, the
  engine and the defaults. The download policer stays, opt-in, and its help now says plainly that a
  policer drops rather than delays and should stay off on a network that carries calls.

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v3.1.9.txt.

Corresponding source & reproducibility

The RT-BE86U image for v3.1.9-beta is built from this repository at tag v3.1.9-beta-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.1.9-beta-RT-BE86U (patches + docs).