sources/review.yaml
Rama main · réplica de lectura del repositorio original.
schema_version: 1
reviewed_on: 2026-11-04
purpose: Non-generating review queue for historical, uncertain, legacy, brand-defense, personal/community, or relocation evidence. Entries never change generated routing by themselves; phase_2_candidate records are historical labels, not current products.
allowed_statuses:
- observe
- legacy
- brand-defense
- personal-community
- candidate-remove
- candidate-move
- accepted
items:
- id: onlineer-mainland-service
status: accepted
scope: china-web
summary: OnlineER's dedicated fybgame.top service suffix follows the existing default-DIRECT mainland website policy in both products.
evidence:
- https://github.com/ZaunEkko/ekko-rules/issues/163
- docs/evidence/onlineer-mainland-service-2026-11-04.json
- sources/rules/china-web.list
- tests/test_profile.py
first_observed: '2026-11-04'
last_verified: '2026-11-04'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: ER-090 adds only DOMAIN-SUFFIX,fybgame.top after the owner accepted Issue 163. The apex and www both serve the OnlineER ER-diagram platform. DNS canonical names and response headers corroborate the delivery chain but do not establish mainland-only hosting; shared dnsv1.com and tdnsv8.com infrastructure stays outside the rule.
- id: tcdnos-root-download-policy
status: accepted
scope: game-download
summary: The owner expands the download policy to the whole tcdnos.com suffix after another Delta Force delivery line was missed.
evidence:
- docs/evidence/tcdnos-root-download-policy-2026-10-17.json
- docs/evidence/tcdnos-bytes-download-policy-2026-10-17.json
- sources/rules/game-download.list
- tests/test_profile.py
first_observed: '2026-10-17'
last_verified: '2026-10-17'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user reported df-repo.yz.tcdnos.com after the bytes-only release and explicitly approved routing the whole tcdnos.com suffix through game-download, accepting that non-game software downloads also follow the group. DOMAIN-SUFFIX,tcdnos.com replaces the narrower bytes rule rather than adding overlapping entries. Live AliDNS DoH resolves the observed yz host through Unicom CDN, while the earlier bytes host uses Volcengine. An audit found no other existing canonical rules under tcdnos.com; corpus size and first-match overlap metrics are unchanged. Both products retain the existing DIRECT default and manual selection. This is an owner-selected routing policy, not a claim of exclusive gaming use or an exhaustive host inventory.
- id: tcdnos-bytes-download-policy
status: legacy
scope: game-download
summary: The owner assigns the bytes.tcdnos.com distribution namespace to the game-download policy after observing a Delta Force download.
evidence:
- docs/evidence/tcdnos-bytes-download-policy-2026-10-17.json
- sources/rules/game-download.list
- tests/test_profile.py
first_observed: '2026-10-17'
last_verified: '2026-10-17'
phase_2_candidate: none
recommended_action: superseded-by-tcdnos-root-download-policy
current_product: standard
resolution: ER-085 originally admitted bytes.tcdnos.com after the user's Delta Force download observation, leaving the parent and other provider namespaces excluded. ER-086 supersedes that boundary with the explicitly approved tcdnos.com root policy after df-repo.yz.tcdnos.com was reported. The original evidence file remains a historical record; the narrower rule is removed to avoid redundant coverage.
- id: cn-suffix-fallback-and-steampy
status: accepted
scope: routing-policy
summary: Otherwise-unmatched .cn names and the mainland-facing SteamPY marketplace default to the domestic website policy.
evidence:
- https://github.com/ZaunEkko/ekko-rules/issues/148
- https://steampy.com/
- docs/evidence/cn-suffix-fallback-2026-10-16.json
- tests/test_profile.py
first_observed: '2026-10-16'
last_verified: '2026-10-16'
phase_2_candidate: none
recommended_action: keep-after-specialized-rules
current_product: standard
resolution: The repository owner approved a .cn routing fallback after all specialized business rules and before GEOIP, rather than claiming every .cn site is mainland-hosted. DOMAIN-SUFFIX,cn is the last china-direct-curated rule and targets the default-DIRECT domestic website group in both products. A frozen first-match audit preserves 49 existing proxy-selector and 23 advertising rules. Putting the fallback in earlier china-web would capture 35 of those proxy rules. The official SteamPY homepage supports a separate anchored steampy.com service rule in china-web; ccopyright.com.cn and its registration subdomains are covered by the late .cn fallback. No other public suffix is admitted.
- id: overseas-ai-generators
status: accepted
scope: routing-policy
summary: Reviewed first-party roots for overseas music, voice, video, avatar, image, design, and 3D generation use the existing overseas AI group.
evidence:
- https://suno.com/
- https://www.udio.com/
- https://www.aiva.ai/
- https://stableaudio.com/
- https://soundraw.io/
- https://www.beatoven.ai/
- https://elevenlabs.io/music
- https://runway.com/
- https://runwayml.com/
- https://pika.art/
- https://lumalabs.ai/dream-machine
- https://www.heygen.com/
- https://www.synthesia.io/
- https://www.midjourney.com/
- https://ideogram.ai/
- https://leonardo.ai/
- https://www.recraft.ai/
- https://www.krea.ai/
- https://www.meshy.ai/
- sources/rules/google-ai.list
- tests/test_profile.py
first_observed: 2026-09-23
last_verified: '2026-09-23'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user requested Suno and other categories of overseas AI generation in the existing overseas AI policy. Nineteen anchored official product roots join google-ai, which precedes general media, cloud and domestic fallbacks and targets the same manually selectable overseas AI group in core and lite. No new segment or policy group is needed. Exclude shared infrastructure, generic .ai matching, lookalikes and mainland-hosted generation platforms; first-match tests cover the new roots and unrelated media/domestic examples.
- id: douyin-live-bytefcdnrd
status: accepted
scope: routing-policy
summary: A user-observed domestic Douyin livestream domain belongs to mainland media routing.
evidence:
- sources/rules/china-media.list
- sources/manifest.yaml
- tests/test_profile.py
first_observed: 2026-09-23
last_verified: '2026-09-23'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user identified bytefcdnrd.com as used for domestic Douyin livestreaming, not as an individual DIRECT preference. Only its anchored suffix joins china-media alongside Douyin playback domains; that policy defaults to DIRECT and the lite policy retains the same action. The observation does not establish domain ownership, server geography, or a wider ByteDance CDN family, so no broader rule is added.
- id: domestic-voice-chat-roots
status: accepted
scope: routing-policy
summary: KOOK voice relays and other mainland gaming voice apps reached the fallback proxy.
evidence:
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
- sources/rules/china-web.list
- tests/test_profile.py
first_observed: 2026-10-01
last_verified: '2026-10-01'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user's gateway showed the KOOK voice relay bj-sig07-turn-1697275940.kaihei.co on MATCH through a Hong Kong exit. kaihei.co and kook.top redirect to KOOK's own site, and a sweep of the other mainland gaming voice apps found Oopz, Fanbook and TT Voice unlisted as well. YY and NetEase CC were already direct through china-media and china-direct-curated. The admitted roots are oopz.cn, fanbook.cn, fanbook.mobi, 52tt.com, ttyuyin.com, kaihei.co, kook.top, kookapp.cn and kaiheila.cn, each resolved from mainland client subnets and joining china-web as anchored suffixes. kookapp.cn and kaiheila.cn answer from Alibaba Cloud cn-beijing load balancers that include addresses in 8.128.0.0/10, which the APNIC delegation file lists under SG; APNIC RDAP registers 8.128.0.0-8.191.255.255 to ALICLOUD in CN, so the mainland probe now accepts an address whose most specific RDAP network is in CN and records it under rdap_cn.
- id: steam-chunk-redirect-hosts
status: accepted
scope: routing-policy
summary: Steam China CDN chunk redirects reached the fallback proxy.
evidence:
- docs/evidence/steam-chunk-redirect-runtime-observation-2026-09-29.json
- sources/rules/game-download.list
- tests/test_profile.py
first_observed: 2026-09-29
last_verified: '2026-09-29'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user's gateway showed eight gstore.val.smogfly.com connections on MATCH carrying a Steam update while st.dl.eccdnx.com ran DIRECT. The user's Steam content logs show the admitted Steam China CDNs st.dl.eccdnx.com and dl.steam.clngaa.com redirecting depot chunk requests to gstore.val.smogfly.com, yif.gdtstream.com, dl1.steam.clngaa.com and dl.steam.cyngaa.com throughout 2026, beside the already admitted gstore.val.manlaxy.com and xz.sycontroller.com. All four resolve to APNIC CN China Mobile and China Telecom edges and join game-download as exact hosts, which defaults to DIRECT in both products. The two wanwang.space redirect targets were last seen in 2025 and are not admitted. The registrable roots serve unrelated origins, so no suffix is admitted.
- id: uu-game-download-host
status: accepted
scope: routing-policy
summary: The UU accelerator's in-app game download host reached the fallback proxy.
evidence:
- docs/evidence/uu-game-download-runtime-observation-2026-09-28.json
- sources/rules/game-download.list
- tests/test_profile.py
first_observed: 2026-09-28
last_verified: '2026-09-28'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user's gateway showed uu.gdl.queniukx.cn on MATCH during a UU game download. It resolves through Alibaba Cloud CDN to APNIC CN addresses, the same edge set as the existing lv.queniujq.cn download rule. The exact host joins game-download, which defaults to DIRECT in both products. The queniukx.cn certificate is Alibaba's and spans several tenant namespaces, so no suffix is admitted.
- id: domestic-media-cdn-sweep
status: accepted
scope: routing-policy
summary: Douyu live CDNs reached the fallback proxy; a sweep of domestic streaming sites found the same gap for Bilibili PCDN, Kuaishou images, Yangshipin and Xigua static.
evidence:
- docs/evidence/domestic-media-cdn-runtime-observation-2026-09-27.json
- sources/rules/china-media.list
- tests/test_profile.py
first_observed: 2026-09-27
last_verified: '2026-09-27'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The user's gateway showed hw3a.douyucdn2.cn and abvolcapi.douyucdn.cn on MATCH. Douyu's own play response names edgesrv.com (self-built SCDN) and douyucdn2.cn (Huawei line) as stream hosts, with douyucdn.cn for assets and P2P. Browser runtime capture across eighteen domestic streaming sites, run through first match, added mountaintoys.cn (Bilibili PCDN video segments), kwimgs.com (Kuaishou live images), yangshipin.cn (no rule at all) and bdxiguastatic.com. Every admitted root resolves to APNIC CN space from a mainland vantage. douyu.com moves from china-web to china-media beside Huya. Telemetry, trackers, a shared NetEase game CDN and a captcha host that also fell through are excluded as not media. Youku, Kuaishou short video, Weibo and Zhihu video were not observed and gain nothing.
- id: adobe-and-lanzou-routing
status: accepted
scope: routing-policy
summary: Adobe needed a stable non-Hong-Kong exit while LanZou downloads were incorrectly reaching the fallback.
evidence:
- sources/rules/adobe.list
- sources/rules/china-web.list
- sources/proxy-groups.yaml
- docs/evidence/lanzou-runtime-observation-2026-09-23.json
- tests/test_profile.py
first_observed: 2026-09-23
last_verified: '2026-09-23'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Thirty-five anchored Adobe service roots now enter an independent manual-first Adobe policy so the user can pin a compatible non-Hong-Kong node without moving unrelated developer or fallback traffic; the lite product folds the same segment into its existing overseas-services group. Thirty-two anchored LanZou and Woozooo roots enter the default-DIRECT mainland policy before FINAL. Shared third-party infrastructure and unclear lookalike roots remain excluded, and adobedtm.com stays with the earlier DisneyPlus segment. Every adjacent chain that already shared the same full and lite policy is physically consolidated without reordering, reducing the product from 64 to 57 segments and leaving seven free positions under Subconverter's ceiling. Retired Raw ruleset and provider names remain available as generated-only compatibility slices behind frozen hashes.
- id: apple-brand-defense
status: brand-defense
scope: apple
summary: Apple defensive registrations and non-core domains need category-level review.
evidence:
- https://github.com/blackmatrix7/ios_rule_script/tree/011471410d3fcc3301c168ee91eb92bc74ebded6/rule/Clash/Apple
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: apple-brand-defense
recommended_action: split-deferred
current_product: compatibility-recovery
resolution: The standard product keeps evidenced Apple core rules. Historical brand-defense entries that reappear in apple-late-recovery restore Phase 2 DIRECT-default routing only; current Apple ownership is not reverified.
- id: apple-legacy-products
status: legacy
scope: apple
summary: Historical Apple products and compatibility domains require usage evidence before removal.
evidence:
- https://www.apple.com/newsroom/2022/05/the-music-lives-on/
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: apple-legacy
recommended_action: split-deferred
current_product: compatibility-recovery
resolution: Historical product and compatibility entries in apple-late-recovery preserve Phase 2 DIRECT-default behavior only; they remain review candidates rather than newly validated ownership.
- id: google-brand-defense
status: brand-defense
scope: google
summary: Google and Alphabet defensive registrations must be separated from confirmed service domains.
evidence:
- https://github.com/blackmatrix7/ios_rule_script/tree/011471410d3fcc3301c168ee91eb92bc74ebded6/rule/Clash/Google
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: google-brand-defense
recommended_action: removed-from-current
current_product: review-only
resolution: The current standard product keeps evidenced service roots and does not publish a separate optional brand-defense layer.
- id: google-legacy-products
status: legacy
scope: google
summary: Discontinued Google product domains require compatibility review before restoration.
evidence:
- https://github.com/v2fly/domain-list-community/commit/8dc538dce9bcdd5650c2dcbce077c44ac44f5a28
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: google-legacy
recommended_action: removed-from-current
current_product: review-only
resolution: The current standard product has no optional layer; legacy products require new evidence before any future restoration.
- id: alphabet-and-community
status: candidate-move
scope: google
summary: Alphabet sibling companies and open-source/community properties may not belong to Google routing.
evidence:
- https://github.com/blackmatrix7/ios_rule_script/tree/011471410d3fcc3301c168ee91eb92bc74ebded6/rule/Clash/Google
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: developer-and-community
recommended_action: split-deferred
current_product: standard-or-removed-by-evidence
resolution: Alphabet siblings, independent Verily, Google OSS, neutral standards, and Google infrastructure still require a complete owner ledger.
- id: emby-community-servers
status: personal-community
scope: emby
summary: Personal and community Emby endpoints are preference-specific and are not part of the standard product.
evidence:
- tests/fixtures/phase-2-after.json
first_observed: 2026-07-30
last_verified: '2026-08-03'
phase_2_candidate: emby-community
recommended_action: removed
current_product: none
resolution: The former Extended-only emby-community ruleset and EMBY group are retired; historical evidence remains frozen in fixtures.
- id: global-web-personal-community
status: candidate-move
scope: global-web
summary: bit.no.com, btlibrary.me, cccat.io, vikacg.com, and picjs.xyz are personal/community preferences rather than universal infrastructure.
evidence:
- https://github.com/ACL4SSR/ACL4SSR/blob/cc5226ec097907cb6d679bc95cebf798aea008f2/Clash/ProxyGFWlist.list
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: optional-community-layer
recommended_action: removed
current_product: none
resolution: Phase 3 removed community-overrides; ordinary traffic reaches FINAL.
- id: historical-streaming-hosts
status: legacy
scope: global-web
summary: neulion.com, icntv.xyz, and flzbcdn.xyz require service-specific evidence; acquisition, 403, or one failed connection is not sufficient for restoration.
evidence:
- https://www.globenewswire.com/news-release/2018/05/07/1497585/0/en/NeuLion-Announces-Closing-of-Acquisition-by-Endeavor.html
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: streaming-legacy
recommended_action: removed
current_product: none
resolution: Phase 3 removed streaming-legacy as a product-scope decision; no reachability failure is claimed as evidence.
- id: spotify-legacy-cdn
status: legacy
scope: music-2
summary: pscdn.co has historical Spotify CDN evidence but no confirmed current sample.
evidence:
- https://www.netify.ai/resources/domains/pscdn.co
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: spotify-core
recommended_action: removed
current_product: none
resolution: The former Extended-only spotify-legacy segment is retired; the standard product keeps no optional legacy layer.
- id: qobuz-brand-defense
status: brand-defense
scope: music-2
summary: Qobuz typo domains may be defensive registrations rather than playback routing.
evidence:
- https://www.qobuz.com/
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: qobuz-brand-defense
recommended_action: removed
current_product: none
resolution: Both former Extended-only Qobuz brand-defense segments are retired; correctly spelled service domains remain in the standard product.
- id: late-recovery-domain-keywords
status: candidate-remove
scope: direct-recovery
summary: Historical brand substring matchers can route unrelated lookalike domains to DIRECT-default policies.
evidence:
- https://en.help.roblox.com/hc/en-us/articles/115005744663-Troubleshooting-Education-Networks
first_observed: 2026-08-01
last_verified: '2026-08-03'
phase_2_candidate: direct-default-recovery
recommended_action: removed
current_product: standard-anchored-only
resolution: All seven recovery DOMAIN-KEYWORD candidates remain excluded. Roblox uses anchored roblox.com and rbxcdn.com suffixes; all DIRECT-default policies now reject DOMAIN-KEYWORD at load time.
- id: direct-default-broad-keywords
status: candidate-remove
scope: routing-security
summary: Broad Microsoft, Apple, TestFlight, and aria2 substring rules could route attacker-controlled lookalike domains to DIRECT-default policies.
evidence:
- sources/rules/microsoft.list
- sources/rules/apple.list
- sources/rules/china-web.list
first_observed: 2026-08-02
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: removed-or-anchored
current_product: standard-anchored-only
resolution: Microsoft and aria2 keywords were removed; Apple CDN entries use anchored suffixes; TestFlight remains covered by apple.com. The canonical loader rejects future DIRECT-default DOMAIN-KEYWORD entries.
- id: china-domain-direct-import
status: accepted
scope: routing-compatibility
summary: Anchored mainland service domains restore DIRECT classification without relying on implicit DNS resolution before GEOIP.
evidence:
- https://github.com/v2fly/domain-list-community/tree/660198a50bac2ab10c567d95a472a7b33915d1b0
- tests/fixtures/china-domain-import-ledger.json
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A pinned MIT-licensed import emits only DOMAIN and DOMAIN-SUFFIX rules from 31 named mainland service categories. It excludes includes, !cn entries, keywords, regexes, single-label suffixes, local broad coverage, and matchers already covered by earlier specialized rules. The segment stays after late recovery and before terminal China GEOIP and FINAL.
- id: advertising-import
status: accepted
scope: routing-policy
summary: A pinned anchored advertising list restores opt-out blocking without importing broad provider or analytics categories.
evidence:
- https://github.com/v2fly/domain-list-community/tree/660198a50bac2ab10c567d95a472a7b33915d1b0
- tests/fixtures/advertising-import-ledger.json
- tests/fixtures/advertising-routing-ledger.json
- sources/rules/advertising.list
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The category-ads import resolves pinned include and @ads filtering semantics, emits 849 DOMAIN/DOMAIN-SUFFIX rules, excludes the sole regexp, and stays after private routing but before specialized services. The independent advertising group defaults to REJECT and remains manually switchable. category-ads-all is deliberately not imported.
- id: private-provider-override-removal
status: accepted
scope: product-boundary
summary: A provider-specific website override is not part of a reusable public routing product.
evidence:
- tests/fixtures/phase-3-after.json
- tests/fixtures/public-rule-exclusions.json
- sources/manifest.yaml
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: remove
current_product: removed
resolution: DOMAIN,huaikhwang.central-world.org and its one-entry direct-override ruleset were removed. The immutable historical fixture retains evidence that the private override existed, but current canonical and generated products do not publish it.
- id: developer-experience-expansion
status: accepted
scope: routing-policy
summary: Mainstream developer sites, registries, and downloads share one manually selected policy so users can prioritize official-source reliability and speed.
evidence:
- https://docs.docker.com/desktop/setup/allow-list/
- https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
- https://docs.npmjs.com/cli/v11/using-npm/registry/
- https://docs.pypi.org/api/index-api/
- https://go.dev/ref/mod
- sources/rules/developer-platforms.list
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The developer group keeps the standard manual selector first and DIRECT available as an immediate traffic-saving override. Anchored official roots cover common development control planes, registries, and downloads; mainland mirrors such as npmmirror.com still match the earlier-intended mainland DIRECT layer, while generic cloud, object-storage, and CDN roots remain excluded.
- id: remote-streaming-direct
status: accepted
scope: routing-policy
summary: High-volume virtual-LAN and remote-streaming traffic should avoid the proxy by default.
evidence:
- https://tailscale.com/docs/reference/tailscale-cli
- https://tailscale.com/docs/features/magicdns
- sources/rules/remote-streaming.list
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A dedicated DIRECT-first remote-streaming group is placed immediately after private routing. The canonical set covers verified outer data-path processes and anchored control, signal, relay, or update domains for Tailscale, ZeroTier, Moonlight, Sunshine, Parsec, RustDesk, AnyDesk, TeamViewer, NetBird, Chrome Remote Desktop, Steam Link, and Microsoft RDP. The user-required ts.net suffix deliberately covers tailnet user namespaces, and the TeamViewer suffix deliberately covers dynamic master/router relay hosts. Generic CGNAT ranges, public STUN/TURN namespaces, browser-wide or Steam-wide processes, user-defined server domains, and shared cloud/CDN roots remain excluded.
- id: mainland-global-ai-split
status: accepted
scope: routing-policy
summary: Chinese AI mainland sites remain DIRECT while distinct international product domains use Overseas AI.
evidence:
- https://github.com/v2fly/domain-list-community/tree/660198a50bac2ab10c567d95a472a7b33915d1b0/data
- sources/rules/author-domain.list
- sources/rules/china-web.list
- sources/rules/ai-platforms.list
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The author-domain ruleset is the user-requested global first segment so zaunekko.com appears first while still using the default-direct mainland group. DeepSeek, Xiaohongshu, and verified Chinese AI mainland roots remain in china-web after advertising. Distinct international roots including kimi.com, z.ai, qwen.ai, qwenlm.ai, minimax.io, ByteDance global AI domains, and the anchored Figma roots use Overseas AI. When a legacy mainland URL redirects to the same final international hostname, first-match routing follows that final hostname because domain rules cannot distinguish URL paths or branding regions on one host.
- id: mainland-ai-video-and-third-party-playback
status: accepted
scope: routing-compatibility
summary: Mainland AI video creation and commonly used third-party video playback services need precise default-DIRECT coverage instead of the proxy fallback.
evidence:
- https://seko.sensetime.com/
- https://kling.ai/cn
- https://platform.vidu.cn/docs/introduction
- https://www.jimeng.com/
- https://www.liblib.art/document/about
- https://www.runninghub.cn/runninghub-api-doc-cn/
- https://tusi.cn/updates
- https://www.moki.cn/policy/agreement.html
- https://doc.chanjing.cc/
- https://www.wujieai.com/
- https://dev.shanjian.tv/
- https://guiji.cn/compliance.html
- https://aic.oceanengine.com/
- https://github.com/loopool/fan/blob/96037b8ab08d96c05b07af68cb70b3428bb6c701/fan.py
- https://github.com/fangkuia/XPTV/blob/fa82ceb50d5c1d8f197d970f9855f702560602/X/loon%26surge%26shadowrocket.list
- sources/rules/china-web.list
- sources/rules/china-media.list
- tests/test_profile.py
first_observed: 2026-08-12
last_verified: '2026-08-12'
phase_2_candidate: none
recommended_action: keep-precise
current_product: standard
resolution: Seko, Kling, Vidu, LiblibAI and LibTV, RunningHub, Tusi, MOKI, Chanjing, Wujie, Shanjian, Guiji, and Ocean Engine use anchored company, product, API, or dedicated asset roots in the default-DIRECT mainland website group, while existing Jimeng, Hailuo, Doubao, Qwen, Zhipu, Tencent Zhiying, Baidu AIGC, and WHEE coverage remains reused. Current service-owned API, image, share, m3u8 playback, and Liangzi direct-MP4 download roots use the default-DIRECT mainland media group so data-heavy playback or download paths do not fall through to FINAL. The current integrations cover Liangzi, Feifan, Baofeng, Suoni, Baidou, Kuaiche, Shandian, Yinghua, Huya, Piaoling, Modu, Xinlang, Huohu, Subo, Wujin, Hongniu, Zuida, and iKun. Shared cloud, object-storage, analytics, kwai.com, sanity.io, doubanio.com, geocities.jp, vibex.cn, and TensorArt roots remain excluded; provider domain churn requires evidence refresh rather than keyword or public-suffix matching.
- id: mainland-foundation-service-coverage
status: accepted
scope: routing-compatibility
summary: Common mainland authentication, push, real-time communication, remote access, developer, collaboration, education, and device-service roots should avoid the proxy fallback without becoming an exhaustive SDK allowlist.
evidence:
- https://cloud.tencent.com/document/product/1110/36334
- https://doc.shengwang.cn/doc/rtc/javascript/basic-features/firewall
- https://doc-zh.zego.im/real-time-video-web/introduction/overview
- https://docs.rongcloud.cn/miniprogram-imlib/user/overview
- https://www.easemob.com/
- https://www.jpush.cn/push
- https://docs.getui.com/getui/start/accessGuide/
- https://www.todesk.com/
- https://sunlogin.oray.com/product/feat
- https://modelscope.cn/
- https://openxlab.org.cn/
- https://www.paddlepaddle.org.cn/
- https://www.mindspore.cn/
- https://www.tsinghua.edu.cn/jyjx/zxjy/ptjs.htm
- https://www.aqara.cn/prodCenter
- https://www.nio.cn/
- tests/test_profile.py
first_observed: 2026-08-12
last_verified: '2026-08-12'
phase_2_candidate: none
recommended_action: keep-anchored
current_product: standard
resolution: The existing default-DIRECT remote-streaming policy gains official roots for ToDesk, Sunlogin/Oray, RayLink, Shengwang/Agora transport, ZEGO, RongCloud, and Easemob without dynamic IPs, generic STUN/TURN roots, or guessed process names. The existing default-DIRECT mainland website policy gains one-root coverage for mainstream CAPTCHA and push providers, domestic code and model communities, collaboration, electronic certification, teaching platforms, and selected mainland device or connected-car entry points. Tencent CAPTCHA, China Mobile number verification, and NetEase Yunxin remain owned by existing domestic-cloud or classic-mainland rules. Globally shared tuya.com, roborock.com, ecovacs.com, and dreame.tech roots remain excluded; only the clearly mainland tuya.cn and aqara.cn entries are added. Advertising remains earlier, and no new policy group, ruleset segment, keyword, public-suffix, IP, or shared-CDN matcher is introduced.
- id: steam-mainland-download-hosts
status: accepted
scope: game-download
summary: Two observed mainland Steam content hosts require exact routing without promoting shared CDN parent domains.
evidence:
- https://github.com/v2fly/domain-list-community/blob/master/data/steam
- sources/rules/game-download.list
- User-confirmed live Steam download session on 2026-08-03; no subscription, node, or endpoint credentials retained
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep-exact-only
current_product: standard
resolution: DOMAIN,gstore.val.manlaxy.com is corroborated as a mainland Steam content host, and DOMAIN,xz.sycontroller.com repeatedly matched the user's live Steam download after a temporary manual rule was applied. Only those exact hosts enter game-download. The manlaxy.com, sycontroller.com, and gdtstream.com parent suffixes remain excluded as shared or weakly evidenced infrastructure; yif.gdtstream.com remains unaccepted; dl.steam.cygnaa.com remains excluded as an unresolving likely confusion with the already-published dl.steam.clngaa.com; and ZeroTier address 103.195.103.66 and its surrounding ranges remain dynamic remote-streaming infrastructure rather than Steam rules.
- id: mainland-consumer-service-gaps
status: accepted
scope: routing-compatibility
summary: Official Ele.me service roots and Alibaba mainland platform roots need anchored DIRECT routing without duplicating existing imports.
evidence:
- https://www.ele.me/
- https://www.1688.com/
- https://github.com/v2fly/domain-list-community/blob/master/data/eleme
- sources/rules/china-web.list
first_observed: 2026-08-03
last_verified: '2026-08-03'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Anchored ele.me, eleme.cn, elemecdn.com, alibaba.cn, and alibaba.com.cn suffixes close observed mainland service gaps in china-web. Advertising stays earlier and continues to capture the three adashx.ut.ele.me variants. Taobao, mainland Tmall, 1688, JD, Meituan, and Dianping remain owned by the existing classic mainland import, while international storefronts and shared alicdn.com infrastructure remain excluded.
- id: mainland-high-frequency-app-coverage
status: accepted
scope: routing-compatibility
summary: High-frequency mainland apps use existing DIRECT-first groups through anchored official service domains rather than new policy groups.
evidence:
- https://github.com/v2fly/domain-list-community/tree/master/data
- https://developer.amap.com/api/
- https://www.12306.cn/
- sources/rules/china-web.list
- sources/rules/china-media.list
- sources/rules/game-platform.list
- sources/rules/game-download.list
first_observed: 2026-08-03
last_verified: '2026-08-09'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Anchored official roots add mainland coverage for Amap, Railway 12306, DingTalk, Feishu, WPS and KDocs, Aliyun Drive, major logistics, recruitment, housing, UnionPay and representative mainland banks, education, healthcare, and automotive services through the existing default-DIRECT mainland website group. Douyin mainland, Huya, and YY use the existing mainland media group. Xiaoheihe, 5EPlay, Perfect World esports, TapTap mainland, MiHoYo mainland, major gaming communities, WeGame, mainland League of Legends and Valorant, and evidenced Tencent GVoice/GME endpoints now use the same default-DIRECT mainland website group. Dedicated game download endpoints use the default-DIRECT game download group, while the game platform group is reserved for overseas services and defaults to manual selection. No policy group is added.
- id: mainland-game-voice-and-international-boundaries
status: accepted
scope: routing-security
summary: Mainland game voice and content routing require precise first-match separation from international TikTok and shared cloud infrastructure.
evidence:
- https://intl.cloud.tencent.com/document/product/607/35232
- https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/tencent-games
- https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/category-game-platforms-download
- https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/tiktok
- tests/test_profile.py
first_observed: 2026-08-04
last_verified: '2026-08-09'
phase_2_candidate: none
recommended_action: keep-precise
current_product: standard
resolution: The official Douyin-only aweme.snssdk.com host enters mainland media, which is ordered before TikTok, while the shared snssdk.com suffix remains in TikTok so unclassified international traffic keeps the user's selector. Tencent Native GVoice/GME service roots and documented exact qcloud configuration, RTC, and speech hosts are routed through china-web so domestic game voice stays DIRECT; generic qcloud.com, myqcloud.com, cloud/CDN roots, dynamic service IPs, and a WeGame process-wide rule remain excluded. The observed down.val.qq.com download host and reviewed dedicated download endpoints enter game-download before the broader domestic val.qq.com rule. Advertising stays first and continues to capture Amap, MiHoYo, and Zuoyebang telemetry. Overseas game storefronts use game-platform, while TapTap international taptap.io remains outside mainland rules.
- id: transient-resolution-failures
status: observe
scope: all
summary: NXDOMAIN with a live parent zone, NODATA, SERVFAIL, 403, timeout, or TLS errors are insufficient removal evidence alone.
evidence: []
first_observed: 2026-07-30
last_verified: '2026-07-31'
phase_2_candidate: evidence-refresh
recommended_action: policy-split
current_product: non-generating
resolution: Technical failures and negative DNS/HTTP observations remain evidence policy only and map to no automatic deletion.
- id: domestic-and-overseas-cloud-routing
status: accepted
scope: routing-policy
summary: Domestic and overseas cloud infrastructure needs independent manually switchable policies with region-aware first-match separation.
evidence:
- https://www.alibabacloud.com/help/en/oss/user-guide/regions-and-endpoints
- https://cloud.tencent.com/document/product/436/6224
- https://developer.huaweicloud.com/endpoint
- https://docs.aws.amazon.com/general/latest/gr/rande.html
- https://docs.aws.amazon.com/general/latest/gr/mgmt-console.html
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_sign-in.html
- https://docs.aws.amazon.com/general/latest/gr/rande.html#dual-stack-endpoints
- https://docs.aws.amazon.com/
- https://learn.microsoft.com/azure/reliability/regions-list
- https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
- https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-endpoints
- https://learn.microsoft.com/en-us/azure/databricks/workspace/workspace-details
- https://learn.microsoft.com/en-us/azure/container-instances/container-instances-quickstart-portal
- https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-troubleshoot-connectivity
- https://docs.ucloud.cn/ufile/introduction/region
- https://docs.ksyun.com/documents/6761
- https://www.ctyun.cn/document/10066310/10716876
- https://developer.qiniu.com/fusion/kb/1319/test-domain-access-restriction-rules
- https://developer.qiniu.com/kodo/12285/docking-rclone
- https://cloud.google.com/apis/design/dns_dhcp
- https://docs.cloud.google.com/docs/security/compliance/endpoints
- https://docs.cloud.google.com/docs/security/compliance/restrict-endpoint-usage
- https://docs.cloud.google.com/storage/docs/request-endpoints
- https://firebase.google.com/docs/reference/rest/storage/rest
- https://firebase.google.com/docs/database/rest/start
- https://firebase.google.com/docs/reference/rest/database/database-management/rest
- https://docs.aws.amazon.com/lambda/latest/dg/urls-invocation.html
- https://docs.byteplus.com/api/docs/byteplus-platform/reference-request-structure
- https://cloud.baidu.com/
- https://console.bce.baidu.com/
- https://support.huaweicloud.com/intl/en-us/devg-oce/en-us_topic_0078452994.html
- https://www.alibabacloud.com/help/en/oss/user-guide/transfer-acceleration
- https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-endpoint
- https://www.alibabacloud.com/help/en/ecs/user-guide/regions-and-zones
- https://developers.cloudflare.com/fundamentals/reference/network-ports/
- https://developers.cloudflare.com/china-network/concepts/china-dns/
- https://docs.vultr.com/platform/security-best-practices/vultr-object-storage
- https://techdocs.akamai.com/cloud-computing/docs/endpoint-types
- https://docs.oracle.com/en-us/iaas/Content/GSG/Reference/faq.htm
- https://docs.oracle.com/en-us/iaas/api/
- tests/fixtures/cloud-routing-ledger.json
first_observed: 2026-08-04
last_verified: '2026-08-04'
phase_2_candidate: none
recommended_action: keep-region-aware
current_product: standard
resolution: Two new groups separate default-DIRECT mainland cloud operations from manually selected overseas cloud infrastructure. Advertising and concrete AI, development, gaming, media, cloud-storage, Apple, and late-recovery service rules remain earlier. Overseas Alibaba OSS, Tencent COS, Huawei Cloud, UCloud US3, Kingsoft KS3, and China Telecom OOS region endpoints precede their broad mainland vendor roots; AWS China, Azure China, and Cloudflare China use domestic cloud, while global AWS—including aws.amazon.com, canonical and regional console hosts, sign-in, api.aws, and Lambda Function URLs—Azure, Google Cloud, Cloudflare, DigitalOcean, Vultr, Linode/Akamai, Oracle Cloud, and BytePlus international cloud use overseas cloud. Azure's current public infrastructure-domain inventory—including API Management, Container Registry, IoT, containers, data and analytics, Kubernetes, machine learning, Storage, SQL, Service Bus, Redis, Search, SignalR, and Static Web Apps—uses documented suffixes; retired services and Microsoft business-product roots remain excluded; Vultr Object Storage uses vultrobjects.com. JD Cloud DNS, edge, load-balancing, and WAF, Qiniu test delivery, and reviewed Cloudflare China infrastructure roots use domestic cloud. Qiniu Kodo's documented Southeast Asia and North America S3 endpoint forms precede a domestic qiniucs.com fallback so mainland buckets become DIRECT without capturing overseas buckets. Ordinary overseas infrastructure endpoints that would use the same default proxy selector through FINAL are not added only for classification completeness; region-sensitive AI, streaming, and similar services remain explicit because selected proxy geography changes behavior. Huawei's international console is separated from its domestic root, Baidu AI Cloud's primary portal and console use domestic cloud, and virtual-hosted Google Cloud Storage buckets stay with explicit GCP infrastructure. The exact unified OCI Console host cloud.oracle.com is included while the broad oracle.com root remains excluded. Shared googleapis.com remains under the Google policy; audited exact endpoints from Google's current global Cloud API inventory plus Firebase Storage and Realtime Database management APIs, documented Firebase data endpoints, virtual-hosted Storage, and rep.googleapis.com regional endpoints use overseas cloud. The duplicate china-web recaptcha.net entry is removed so reCAPTCHA retains the Google policy. Reviewed non-mainland Alibaba region suffixes cover both SERVICE.REGION.aliyuncs.com and SERVICE-vpc.REGION.aliyuncs.com APIs before the domestic aliyuncs.com catch-all; the explicit OSS overseas acceleration suffix remains ahead as well. No cloud CIDR, ASN, GEOSITE, regexp, generic consumer-company root, or broad Akamai tenant suffix is published. The two cloud segments intentionally precede Microsoft, Google, and the classic mainland aggregate; their 71 reviewed later-rule captures are frozen in the cloud routing ledger.
- id: cloud-segment-budget-consolidation
status: accepted
scope: product-boundary
summary: Two same-policy physical merges preserve the Subconverter 64-segment ceiling while adding two cloud rulesets.
evidence:
- sources/manifest.yaml
- sources/rules/cloud-storage.list
- sources/rules/spotify.list
- tests/test_profile.py
first_observed: 2026-08-04
last_verified: '2026-08-04'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The two Spotify source segments are concatenated without reordering under their existing Music policy, and OneDrive plus iCloud are concatenated under the existing Cloud Storage policy. These are physical ruleset consolidations only; matcher order and policy targets remain unchanged. Generated-only onedrive, icloud, and spotify-2 compatibility copies preserve the retired Raw URLs and their original pre-merge matcher subsets through frozen list/provider hashes, without re-entering the canonical source manifest, Subconverter config, Mihomo template, rule count, or coverage model. HBO GO and Max remain separate rulesets, all groups remain manually switchable, and the public product stays at 63 rulesets plus one FINAL segment.
- id: hoyoverse-international-game-routing
status: accepted
scope: routing-policy
summary: HoYoverse international game hosts had no anchored placement and fell through to the fallback group while mainland HoYoverse roots were already DIRECT.
evidence:
- sources/rules/game-platform.list
- sources/rules/game-download.list
- sources/rules/china-web.list
- sources/rules/advertising.list
- https://www.hoyoverse.com/
- https://hsr.hoyoverse.com/
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Three anchored suffix rules place the HoYoverse international surface under the existing manually switchable game platform policy - hoyoverse.com for account, SDK, and game API hosts, hoyoplay.com for the launcher, and hoyolab.com for the embedded community surface - together with six exact hosts that the broad mainland mihoyo.com root would otherwise capture into a DIRECT policy. Three further -os candidates under mihoyo.com resolved NXDOMAIN at review time and are excluded. starrails.com goes to game-download rather than game-platform because every host under it except autopatchos.starrails.com resolved NXDOMAIN, making it a patch-delivery domain only; game-download precedes game-platform and leads with DIRECT, so client updates stay off the selected proxy. The mainland mihoyo.com, bhsr.com, and yuanshen.com roots keep their earlier china-web placement. Advertising continues to precede both segments and its anchored log-upload telemetry rules still win first match; no later ruleset repeats them, so the frozen advertising routing ledger is unchanged. No keyword, destination-IP, generic CDN suffix, proxy group, or ruleset segment is added.
- id: iqiyi-international-group-naming
status: accepted
scope: routing-policy
summary: The iQIYI group did not state why it exists separately from mainland streaming, so it read as redundant while both groups defaulted to DIRECT.
evidence:
- sources/proxy-groups.yaml
- sources/manifest.yaml
- sources/rules/iqiyi.list
- sources/rules/china-media.list
- tests/fixtures/phase-3-recovery-ledger.json
- https://www.iq.com/
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The group is renamed to state its purpose - iQIYI publishes an international catalogue at iq.com that needs an overseas exit while the rest of mainland streaming stays direct. Members and order are unchanged and the group still leads with DIRECT because the ruleset also carries the mainland iQIYI roots. The international catalogue was observed to depend on iqiyi.com, qy.net, and iqiyipic.com through intl-rcd.iqiyi.com, intl-subscription.iqiyi.com, intl.iqiyi.com, and msg-intl.qy.net, so those shared roots are deliberately not split out to china-media; splitting them would send one international session through two exits. The sealed phase 3 recovery ledger is not edited - the recovery test maps its historical group name to the current one - and reverse_profile.py keeps the historical name in its importer vocabulary.
- id: retired-exact-host-removal
status: accepted
scope: all
summary: Ten exact DOMAIN matchers in repository-maintained rulesets no longer resolve anywhere.
evidence:
- sources/rules/game-download.list
- sources/rules/bilibili-sea.list
- sources/rules/hbo-go.list
- sources/rules/kktv.list
- sources/rules/private.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Every removed host was confirmed NXDOMAIN against Google, AliDNS, and Cloudflare before deletion, so no first-match behavior changes. The four LAN administration hosts in private - router.asus.com, www.asusrouter.com, instant.arubanetworks.com, and setmeup.arubanetworks.com - also return NXDOMAIN publicly and are deliberately kept, because they resolve only on the local network and that is precisely why they carry a DIRECT rule. Non-resolving hosts inside the pinned advertising import and the frozen late-recovery rulesets are left untouched; both are sealed by immutable ledgers and their contents are evidence rather than maintained curation.
- id: reconstruction-scaffolding-retirement
status: accepted
scope: product-boundary
summary: The legacy importer and the Phase 2 migration fixtures no longer constrain the current product and had no remaining input.
evidence:
- docs/CHANGES.md
- docs/PROVENANCE.md
- tests/test_profile.py
- sources/quality-baseline.yaml
- NOTICE.md
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: reverse_profile.py and the three Phase 2 fixtures are removed together with LegacyImporterTests and PhaseTwoMigrationBaselineTests, taking the suite from 61 to 53 tests. The first-match coverage test keeps its equality check against the quality baseline and its explicit 146/13/133 assertions; only the historical Phase 2 comparisons are dropped. Phase 3 is deliberately retained because phase-3-recovery-ledger.json is a required next_gate key in the quality-baseline contract, PhaseThreeDirectRecoveryTests validates 2,684 late-recovery rules against a frozen selection replayed from a pinned commit, and PROVENANCE cites phase-3-after.json and that ledger as the corpus evidence boundary. The two pinned MIT imports and their ledgers are untouched; while that v2fly data ships, NOTICE.md and the import ledgers discharge a mandatory attribution.
- id: observation-derived-advertising-curation
status: accepted
scope: routing-policy
summary: The pinned advertising import blocks 7.3 percent of what observed pages actually load and carries 9.9 percent non-resolving entries.
evidence:
- docs/evidence/observation-2026-09-19.json
- docs/evidence/admission-review-2026-09-19.json
- docs/SELF-OWNED-REBUILD.md
- sources/rules/advertising-curated.list
- sources/rules/hbo-go.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A new advertising-curated segment carries 68 rules derived solely from this repository's own observation of 21 origins, with all 260 observed third-party hosts reviewed per host against the admission criteria and the verdicts committed as evidence. It sits immediately after the pinned import under the same advertising policy and introduces no new first-match coverage - curated suffixes that would shadow an existing rule are narrowed to observed hosts, entries the import already covers are dropped, and logx.optimizely.com is dropped because dazn routes it to its own policy. The Subconverter segment ceiling is funded by concatenating hbo-max into hbo-go under their shared policy, with the retired hbo-max Raw URL preserved as a generated-only compatibility copy behind frozen hashes. The pinned import, its ledger and its emitted hash are untouched, so the v2fly attribution still stands; retiring it requires replacing the import outright, which this segment begins rather than completes.
- id: adstxt-declared-advertising-systems
status: accepted
scope: routing-policy
summary: Traffic observation alone reaches breadth slowly, and publisher ads.txt files declare the advertising ecosystem behind the pages directly.
evidence:
- docs/evidence/ads-txt-2026-09-19.json
- docs/evidence/publishers-2026-09-19.txt
- docs/evidence/adstxt-candidates-2026-09-19.txt
- scripts/ads_txt_evidence.py
- scripts/ad_serving_probe.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: 49 of 57 publishers served an ads.txt, declaring 826 advertising systems and 545 by two or more publishers. A declaration names the company selling inventory rather than the domain delivering advertising at runtime, so each candidate root is admitted only after a probe resolves conventional delivery hostnames beneath it and finds live infrastructure - 267 of 453 did. Removed before and after the probe were publishers declaring themselves, mixed-business roots whose non-advertising functions a REJECT would break, agency holding companies, roots with a corporate website only, and video and audio player platforms where blocking removes content rather than advertising. The segment reaches 327 rules and raises coverage of hosts reviewed as advertising from 16.4 to 99.1 percent without changing first-match coverage. The pinned import and its ledger are untouched.
- id: widened-publisher-sample
status: accepted
scope: routing-policy
summary: Publisher choice is not derived from any rule list, so the ads.txt sample can widen freely to reach breadth the first sample missed.
evidence:
- docs/evidence/publishers-2026-09-19.txt
- docs/evidence/ads-txt-2026-09-19.json
- sources/rules/advertising-curated.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The sample now spans 235 publishers across ten regions and eight categories; 198 served an ads.txt declaring 1,194 advertising systems, 910 by two or more. Of 638 uncovered candidates the delivery probe found 239 serving, and review removed mixed-business roots, publishers and media groups, agency holding companies, and video and audio player platforms, leaving 131 and bringing the segment to 452 rules. Coverage of hosts reviewed as advertising reaches 100 percent and of declared advertising systems 44.9 percent, against 16.5 and 1.3 percent for the import alone, with first-match coverage unchanged. An audit shows 761 of the import's 849 entries still carry coverage this segment does not reproduce, only 5.9 percent of which the declarations reach, because the import's remaining strength is mobile SDK and platform-native endpoints plus Russian and mainland Chinese ecosystems. A third evidence source is needed before the import can be retired.
- id: observation-derived-mainland-direct
status: accepted
scope: routing-policy
summary: Major mainland services including zol, ifeng, eastmoney, csdn, ithome, cnblogs, suning and dangdang matched no rule and reached the proxy fallback.
evidence:
- docs/evidence/cn-origins-2026-09-19.txt
- docs/evidence/cn-candidates-2026-09-19.txt
- scripts/page_host_scan.py
- scripts/mainland_hosting_probe.py
- https://ftp.apnic.net/stats/apnic/delegated-apnic-latest
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A markup scan of 182 mainland origins yielded 1,269 registrable roots, 922 matching no existing rule. Observation supplies candidates only, so the verdict comes from APNIC delegation records - a primary registry source - and a root is admitted only when every A record falls inside the ranges allocated to CN. 600 qualified. Review removed 11 mainland advertising and analytics roots belonging to the advertising policy, 4 malformed roots, and pplive.com which would have shadowed afp.pplive.com in china-media-late-recovery. The remaining 584 take china-web from 370 to 954 rules with first-match coverage unchanged. The pinned mainland import is untouched; this curation covers what it missed rather than reproducing what it holds.
- id: certificate-transparency-vendor-discovery
status: accepted
scope: routing-policy
summary: Homepage scanning cannot reach the backend and sub-brand domains large vendors operate, which is where the pinned mainland import's remaining strength lies.
evidence:
- docs/evidence/cn-vendors-2026-09-19.txt
- scripts/vendor_domain_discovery.py
- scripts/mainland_hosting_probe.py
- https://crt.sh/
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Certificate Transparency logs every publicly trusted certificate with the organisation it was issued to, so a query by organisation returns domains the vendor itself proved control of to a certificate authority - a primary source rather than a third party's compilation. 46 mainland vendors attest 1,711 roots, 1,333 uncovered, 480 of them mainland-hosted by the APNIC probe. A third crawl round contributes 526 roots referenced by two or more independent origins, a threshold that keeps long-tail bloat out. Six mainland measurement roots were removed as belonging to the advertising policy. The remaining 997 take china-web to 3,196 rules with first-match coverage unchanged. Of the import's 1,448 live entries 408 are now independently attested, 28.2 percent; the rest are vendor-affiliated domains under obscure names that the same method reaches with a wider organisation list.
- id: shared-saas-overbreadth
status: accepted
scope: routing-policy
summary: Service-specific rulesets pinned shared multi-tenant infrastructure into their own policy, pulling unrelated sites along.
evidence:
- sources/rules/media-korea.list
- sources/rules/disney-plus.list
- tests/fixtures/advertising-routing-ledger.json
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A regression check found static.zdassets.com routed to the Korean media policy because Watcha runs its help centre on Zendesk, while zdassets.com is Zendesk's global asset CDN. An audit of all service-specific rulesets found 50 references to shared infrastructure, of which 44 correctly name a single tenant. The six that did not - zdassets.com, launches.appsflyer.com, sdk.iad-05.braze.com, the two Conviva collectors, braze.com, conviva.com and js-agent.newrelic.com - are telemetry or marketing services no streaming product needs in order to play, and are removed. Three AWS regional endpoints are kept deliberately because the tenant is identified by credentials rather than hostname and viuTV's sign-in depends on Cognito. js-agent.newrelic.com was already unreachable behind the advertising import, so the intentional capture count falls from 40 to 39 and the routing ledger is re-sealed. First-match coverage falls from 146 to 145, which the gate permits.
- id: wider-vendor-certificate-sample
status: accepted
scope: routing-policy
summary: crt.sh answers a throttled client with an empty body, which the first vendor sample read as an organisation having no certificates.
evidence:
- docs/evidence/cn-vendors-2026-09-19.txt
- scripts/vendor_domain_discovery.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The organisation list grows from 46 to 118 across carriers, handset makers, game studios, AI companies, cloud providers and platform sub-brands, and the tool retries with a growing pause so throttling is no longer mistaken for absence - 72 organisations that appeared empty returned results. The wider sample attests 2,338 roots, 1,394 uncovered, 74 mainland-hosted beyond what is already shipped; one measurement root is removed as belonging to the advertising policy and the remaining 73 take china-web to 3,269 rules with first-match coverage unchanged. Measured against the full independent pool, 31.8 percent of the mainland import's live entries and 28.1 percent of the advertising import's are independently attested, so neither can be retired and the attribution stands.
- id: russian-publisher-declarations
status: accepted
scope: routing-policy
summary: A fifth of the advertising import serves a Russian audience, which the first publisher sample did not reach.
evidence:
- docs/evidence/ru-publishers-2026-09-19.txt
- scripts/ads_txt_evidence.py
- scripts/ad_serving_probe.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: 48 of 75 Russian publishers served an ads.txt declaring 439 advertising systems, 273 by two or more. Of 126 uncovered candidates the delivery probe found 37 serving; review removed eight mixed-business roots, one publisher, one agency and ten video player platforms, leaving 17 that take the segment to 469 rules. 28.4 percent of the import's live Russian entries are now independently attested. The round also anchors page_host_scan.py against minified JavaScript trailing comments, which its bare double-slash pattern had been reading as hostnames; no rule was affected because every candidate passes the APNIC probe first and the noise never resolved.
- id: certificate-san-sibling-discovery
status: accepted
scope: routing-policy
summary: Organisation search depends on guessing how a vendor registers its certificates, and large vendors register under many names.
evidence:
- scripts/vendor_domain_discovery.py
- https://crt.sh/
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A certificate covers every name it was issued for, so querying by domain rather than organisation returns the siblings a vendor runs under unrelated-looking names - bytedance.com yields bytedance.net, feishu.cn, larksuite.com and tiktok.com. 797 seeds attest 5,456 roots against 2,338 from the organisation search; 3,424 are uncovered and the APNIC probe finds 628 mainland-hosted. One measurement root is removed and the remaining 627 take china-web to 3,896 rules with first-match coverage unchanged. The harvest moved the mainland import's independent attestation only from 31.8 to 33.1 percent because it finds a different set of mainland domains rather than the import's.
- id: script-following-and-crawl-saturation
status: accepted
scope: routing-policy
summary: Markup names a page's CDN hosts but not the endpoints its scripts call, and past a point further crawling returns long-tail noise.
evidence:
- scripts/page_host_scan.py
- docs/evidence/cn-origins-2026-09-19.txt
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The scanner now follows the first few scripts each page declares, which takes a re-run of 2,017 mainland origins from roughly 18,000 hostnames to 30,974 across 9,726 roots; the APNIC probe finds 3,096 of 6,317 uncovered candidates mainland-hosted. Only 92 are referenced by two or more independent origins, the rest being single-reference long-tail local sites a friendly-links section happens to name, so the threshold holds and 82 are admitted after removing nine measurement roots and one shadowing root. That ratio is the finding - the crawl has saturated on valuable discovery. Independent attestation reaches 34.1 percent of the mainland import's live entries and 55.8 percent of the advertising import's.
- id: pinned-import-retirement
status: accepted
scope: product-boundary
summary: Full independent reproduction of the two pinned imports does not converge, while the curated replacement measures better on every axis this repository can measure.
evidence:
- NOTICE.md
- docs/PROVENANCE.md
- docs/SELF-OWNED-REBUILD.md
- sources/upstreams.yaml
- sources/rules/china-direct-curated.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Both imports, their ledgers and the advertising routing ledger are deleted, and NOTICE.md no longer carries the V2Ray attribution because nothing in the product requires it. Six evidence sources took independent attestation to 34.1 and 55.8 percent and then saturated, so the choice was between keeping data the product no longer depends on and replacing it with a corpus that measures better - 7.3 to 42.3 percent of observed third-party hosts, 16.5 to 100 percent of hosts reviewed as advertising, 7.7 to 60.9 percent of hostnames observed across mainland origins. The measurable gap was closed first - 239 roots that only the import covered were recovered from this repository's own observation, 163 confirmed by APNIC and 61 by per-host review, plus 41 added explicitly, taking measured loss to zero. newrelic.com is deliberately not re-added because this repository's review classifies browser monitoring as neither advertising nor tracking. A new china-direct-curated segment restores the ordering the import provided, holding nine broad vendor and CDN roots immediately before the GEOIP fallback so they do not run ahead of the cloud, media and AI segments.
- id: admission-review-contract
status: accepted
scope: routing-policy
summary: Eight hosts the committed admission review marks admit stopped reaching the advertising policy once the import was removed, two of them because ad vendor roots had been carried as mainland direct.
evidence:
- docs/evidence/admission-review-2026-09-19.json
- docs/evidence/ad-vendors-2026-09-19.txt
- sources/rules/advertising-curated.list
- sources/rules/china-web.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The curated advertising set was built additively while the import still shipped, so it skipped hosts the import already covered and those hosts had nothing behind them once it left - a sequencing error in ER-047, not a judgement change. googletagmanager.com and googletagservices.com are the worse case, because this repository's own ad-vendors evidence names them as advertising infrastructure while china-web carried them as mainland direct; both roots move to advertising-curated in full. The six mainland hosts are added as exact DOMAIN rules because their roots carry login, payment, platform APIs and general assets that must stay direct. All 109 admit hosts now reach advertising-curated and none of the 151 hold or reject hosts reach REJECT. The committed origin list, stale at 245 origins from the first round while later rounds used a larger uncommitted list, is regenerated deterministically from the china-web roots so the scan is reproducible.
- id: mainland-advertising-curation
status: accepted
scope: routing-policy
summary: The curated advertising set was built from Western publisher declarations, so mainland advertising was its thinnest part; the mainland scan already held the candidates.
evidence:
- docs/evidence/cn-ad-review-2026-09-19.json
- docs/evidence/cn-origins-2026-09-19.txt
- sources/rules/advertising-curated.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Three passes over the 30,974 hostnames this repository scanned from 2,017 mainland origins - advertising-delivery labels, tracking and analytics labels, and hostnames under roots the product still routes direct - yield 396 candidates of which 85 are admitted, taking advertising-curated from 494 to 587 rules with first-match coverage unchanged. The rejection counts are the finding - a leading ad, bid, ssp, gdt, union or ta label is wrong more often than right on mainland origins, where it matches China UnionPay, a Guangdong broadcaster, Tamil Wikipedia, government statistics bureaus, the reporting centre every mainland site links in its footer, and 53 public procurement portals. Third-party status removes 51 tracking candidates but keeps every government and Wikipedia case, so per-host review remains the only separator. retcode.taobao.com is held as browser monitoring for the same reason as newrelic.com, and first-party endpoints on financial hosts are not admitted because a REJECT could stall a checkout. 305 import advertising domains still reach a mainland direct policy and 270 of them appear in no observed hostname, being mobile application and SDK endpoints a web scan cannot see. beacon.qq.com was withdrawn for provenance after the scan proved it never observed that hostname, and the two endpoints it did observe ship instead.
- id: admission-criterion-scope
status: accepted
scope: routing-policy
summary: Criterion 2 as written could not admit a publisher's own advertising subdomain, and the round's evidence file was generated from a hand-kept list rather than from the rules.
evidence:
- docs/SELF-OWNED-REBUILD.md
- docs/evidence/cn-ad-review-2026-09-19.json
- tests/test_profile.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Two inconsistencies were raised in review and both were real. The evidence file recorded reject for hosts the product blocks, because it was generated from a hand-kept list of that round's admissions and anything admitted earlier fell through to the catch-all; every verdict is now derived from the shipped corpus, so the file cannot disagree with the product. The second point was that three hosts were admitted with a cross-site rationale while the scan only saw them on their operator's own site - true, and withdrawing them exposed that 29 already-shipped rules had the same shape, among them ad.sohu.com, ad.cnki.net and cpro.zol.com.cn. Criterion 2 read third-party to at least one observing origin, wording that came from Western third-party ad tech where every candidate was third-party by construction, and read literally it forbids blocking a publisher's own ad subdomain, which is most of what ad blocking is. It now admits either route and each record states which applies, 76 third-party and 32 own-endpoint. Nothing protective was lost because criterion 2 never stopped the dangerous cases - the government statistics bureaus, the mandatory footer reporting link and Tamil Wikipedia are all third-party and are rejected by criterion 3, and the financial endpoints by criterion 4. Four invariants are now asserted in AdvertisingAdmissionContractTests.
- id: published-rule-evidence-mapping
status: accepted
scope: routing-policy
summary: The bidirectional test walked only the review records, so a deleted record left its rule shipping unexamined, and 28 rules had no committed per-host record at all.
evidence:
- docs/evidence/legacy-ad-review-2026-09-19.json
- docs/SELF-OWNED-REBUILD.md
- tests/test_profile.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Walking the review records only proves the records that still exist are honoured; walking the published rules is what proves no rule ships without a committed reason. Enumerating them found 28 advertising rules with no record in any review file, among them clarity.ms, sensorsdata.cn, zhugeio.com, 51.la, wwads.cn and the Alibaba adashx tracking endpoints, all introduced by commit 78c939c and audited at the time but never recorded per host. A legacy review file now carries all 28 with what each endpoint is and why a REJECT is safe, and a new test maps every published rule to an admitted record or a publisher declaration. adash.man.aliyuncs.com was briefly removed as dead because it has no A record, which broke the cloud ordering test - the rule holds an ordering contract against the aliyuncs.com cloud policy, so resolvability is evidence about a host and not about what a rule is for. Criterion 1 named only the traffic-observation route although 421 shipped rules arrive through ads.txt and the delivery probe and most of china-web through Certificate Transparency and APNIC, so it now names every route the Method section describes. The three records restored in ER-050 had carried a withdrawal-era reason contradicting their own verdict; reasons are regenerated from the admission route and the test asserts route, reason and rationale agree.
- id: evidence-grade-and-import-masking
status: accepted
scope: routing-policy
summary: Two advertising roots reached mainland direct once the import stopped masking them, a reviewed host was accepted as justification for blocking its whole root, and query seeds were being counted as verdicts.
evidence:
- docs/evidence/ad-root-review-2026-09-19.json
- docs/evidence/ad-serving-probe-2026-09-19.json
- sources/rules/china-web.list
- tests/test_profile.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: 2mdn.net and app-measurement.com have been in china-web since the repository's first commit and never mattered because the retired import's advertising segment ran at position 4 and captured them before china-web at 49; retiring the import left Google Ad Manager delivery and Firebase Analytics routed as ordinary mainland websites, so both move to advertising-curated. The search is bounded and was run over the whole product - exactly four rules were covered by the retired advertising list, and the other two are correct as they stand because the specific advertising hosts beneath them are blocked while the roots stay direct. The mapping test accepted a suffix rule when any reviewed host sat beneath it, which would have accepted DOMAIN-SUFFIX,qq.com on the strength of mi.gdt.qq.com; it now requires the rule's own value to be evidenced, 24 roots gain an explicit record saying no other service lives under them, and app-us1.com is narrowed to its two reviewed hosts because ActiveCampaign infrastructure could not be shown to be advertising-only. The test also counted the Certificate Transparency seed list and the ads.txt candidate list as evidence although the first names bytedance.com and the second is what the delivery probe adjudicates; both are removed and the probe's verdicts are committed for the first time, 1,995 roots with 791 serving. The 19 rules left unmapped are the case the probe exists for - publishers declare google.com and creatives arrive from doubleclick.net - and each now records its declared seller beside the delivery root.
- id: mainland-evidence-contract
status: accepted
scope: routing-policy
summary: The mainland segments had no published-rule-to-evidence mapping and no committed artifacts to map to, and two groups of grandfathered rules were claiming evidence routes they could not support.
evidence:
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
- docs/evidence/cn-observation-2026-09-19.json
- docs/evidence/cn-legacy-direct-2026-09-19.json
- docs/PROVENANCE.md
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Advertising got a rule-to-evidence mapping first because a wrong rule there blocks something; a wrong mainland rule sends traffic direct that should be proxied, the same defect with a quieter failure, and 4,224 rules had neither a mapping nor a committed artifact to map to - the scan output, Certificate Transparency results and APNIC verdicts existed only in a working directory, so the corpus was unauditable and re-running a probe later returns different data. Three files now carry it, 3,778 rules by APNIC verdict, 177 seen by the scan without an APNIC verdict, and 269 grandfathered, with MainlandEvidenceContractTests requiring every rule in both segments to map. The legacy advertising file had claimed admission_route third-party for hosts whose observing origin was never recorded, which was an assertion dressed as evidence; it now records criteria_satisfied 3 and 4 with criterion 1 and 2 evidence marked not preserved, and the 269 mainland rules are treated identically. Both grandfathered sets are closed, asserted to shrink but never grow, because grandfathering rules already shipping and re-reviewed for safety is defensible while leaving a door open for new ones is not. 16 admitted records still carried the catch-all rejection reason beside an admit verdict, including ad.doubleclick.net and six mediav.com hosts admitted through a root rule; reasons are regenerated from the matching rule and the test now rejects any rejection language rather than one phrase. docs/PROVENANCE.md still described the pinned import as shipping with its ledger and attribution intact, and cited a deleted ledger and the pre-retirement cloud capture count.
- id: cloudflare-china-own-domain
status: accepted
scope: routing-policy
summary: The Cloudflare China infrastructure family was carried in china-cloud without cloudflare.cn, the domain the service is named after.
evidence:
- sources/rules/china-cloud.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: A mainland user reached cloudflare.cn through the proxy while cloudflare-cn.com, cloudflarechina.cn, cloudflarecn.net, cloudflareinsights-cn.com and cf-ns.com all went direct. It joins its family in china-cloud, which is both where it belongs and what the evidence permits - the APNIC probe cannot adjudicate it, because resolving cloudflare.cn from outside the mainland returns a Hong Kong address while the China network answers differently depending on where the question is asked. That is a limit of the probe rather than a finding about the domain, and it is why ER-023's reviewed Cloudflare China roots sit in china-cloud on review rather than on a probe verdict.
- id: overseas-shopping-policy
status: accepted
scope: routing-policy
summary: A retailer that needs its own exit had nowhere to go but the fallback, so overseas shopping becomes its own segment and group.
evidence:
- sources/rules/overseas-shopping.list
- sources/proxy-groups.yaml
- sources/manifest.yaml
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Takealot answers a proxy exit with a Cloudflare interstitial that other sites accept, which is IP reputation rather than a country block, and reaching it meant changing the fallback for everything. The new group holds 76 roots - regional Amazon storefronts, eBay, Etsy, Japanese shops including DLsite, Rakuten, ZOZO, Suruga-ya, Mandarake and AmiAmi, the forwarding services a cross-border order passes through, and regional retailers such as Gmarket, SSG and Takealot - admitted because what these sites display, sell and challenge depends on the exit, not because the category was untidy. The segment runs after every other service segment so amazon.com cannot take aws.amazon.com, console.aws.amazon.com or media-amazon.com, all verified. lazada.com, lazada.sg, shopee.com and shopee.sg were dropped - the Lazada family is already direct in china-web, the duplicate registered as a dead rule that the coverage gate caught, and splitting a brand whose mainland entry is deliberately direct across two policies is worse than leaving it whole. cloudflareperf.com joins china-cloud with the Cloudflare China family on an APNIC-confirmed mainland apex.
- id: mainland-probe-client-subnet
status: accepted
scope: routing-policy
summary: The mainland hosting probe resolved without naming a client subnet, so geo-DNS services answered for the probe's own location and were recorded as foreign.
evidence:
- scripts/mainland_hosting_probe.py
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: xinhuanet.com returns 156.238.128.x to this repository and 117.177.70.x to a mainland client, so the probe read the first and called a China Mobile-hosted site foreign - the normal case for exactly the CDN-fronted services a mainland direct rule is about. The probe now names a mainland client subnet with EDNS Client Subnet, and four roots previously classified as foreign are mainland-hosted under the corrected question - xinhuanet.com, chinanews.com.cn, honor.cn and cloudflareperf.com. The fix is not total and the residue is informative - Cloudflare answers from anycast and ignores the named subnet, so cloudflare.cn still has no verdict, which is a finding about the method rather than the domain. The ByteDance probe endpoints split under the corrected probe - perfops.byte-test.com resolves into mainland space while perfops1 through perfops3 of byteperf.com stay foreign because they are deliberately spread across regions - so byte-test.com is admitted on the APNIC route and byteperf.com on a routing rationale, that a client measuring which CDN node to use must measure the path its media traffic takes. That rationale lives in a fourth evidence route which carries more proof than the others rather than less - every record states its reason, vendor attribution and the limitation that put it there, and the category is capped at eight. lenovo.com.cn was examined and not added because it answers from Akamai's global edge even for a mainland client.
- id: byteperf-overseas-correction
status: accepted
scope: routing-policy
summary: A routing rationale was allowed to override this repository's own measurement, and the field reported the result as domestic traffic that should have been overseas.
evidence:
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
- sources/rules/china-web.list
- tests/test_profile.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: ER-056 admitted byteperf.com after its own probe said the endpoints answer from outside the mainland, on the argument that a client measuring which CDN node to use must measure the path its media takes. The split-tunnel test that surfaced them labels those rows 海外 and 国际, and with the rule shipping they reported a Hangzhou address - the product was forcing overseas measurement endpoints down the domestic path. perfops1 through perfops3 resolve to 35.219.10.74, 95.40.53.40 and 47.84.187.31 for a mainland client because ByteDance spreads them across regions deliberately; that is the finding, and reasoning past it was the error. The rule is removed while byte-test.com stays on the APNIC route. cn-review-admitted-2026-09-19.json is deleted with it, because a blind-spot patch holding nothing is scaffolding rather than a route, and MainlandEvidenceContractTests returns to three evidence routes.
- id: remote-streaming-two-jobs
status: accepted
scope: routing-policy
summary: One vendor suffix covered both the admin console and the streaming payload, so no single policy could be right for it.
evidence:
- sources/rules/remote-streaming-admin.list
- sources/rules/remote-streaming.list
- sources/proxy-groups.yaml
- scripts/profile_model.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: The group was DIRECT-first and held DOMAIN-SUFFIX,tailscale.com, so a browser opening the admin console took the direct path and never arrived; moving the suffix to a proxy policy is equally wrong because the DERP relays under it carry the streaming payload and the field reported proxy traffic climbing when that was tried. The policy is now two - 远程串流后台 leading with the manual selector and holding 19 console and website hosts across Tailscale, ZeroTier, NetBird, Parsec, RustDesk, AnyDesk, TeamViewer and Moonlight, and 远程串流流量 leading with DIRECT and holding the 65 data-plane rules. The admin segment runs immediately before the data segment so an exact console host wins while the vendor suffix beneath it keeps carrying the payload direct, verified per host for derp1a, controlplane, ts.net, root.zerotier.com, kessel-ws.parsec.app, rs-ny.rustdesk.com, net.anydesk.com, master1.teamviewer.com, signal.netbird.io and remotedesktop.google.com. The product sits at the Subconverter 64-segment ceiling, so the new segment is funded the way ER-023 established - xai is concatenated into ai-platforms without reordering, routing cannot change because every segment in that family targets the same policy, and the retired Raw URL survives as a generated-only compatibility copy behind frozen hashes.
- id: session-split-across-policies
status: accepted
scope: routing-policy
summary: A page or a game session reaching through two policies at once is the defect behind three separate reports.
evidence:
- sources/rules/game-download.list
- sources/rules/game-platform.list
- sources/rules/china-web.list
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: psnine.com rendered with every cover image broken because DOMAIN-SUFFIX,dl.playstation.net sat in the DIRECT-first download policy while psnobj and psn-rsc under it are the object CDN a web page loads cover art from, and direct access to them times out. The suffix is replaced by the endpoints that carry game content - ww.prod.dl.playstation.net for the gs2 family plus zeus and ares named exactly - so everything else falls through to the platform policy with the rest of PSN's web surface, and gs2.ww.prod answers from a China Telecom address so the mainland download path is preserved. psnine.com itself is APNIC-confirmed mainland and joins china-web. Honkai Star Rail reported proxy use because its dispatch and login domains reached the platform policy while the game server, which dispatch hands out as a bare address, fell to the fallback - two exits for one session. starrails.com was the larger half of that split, sitting wholly in the download policy, so autopatchos stays and the rest joins the platform; the IP-CIDR 8.209.192.0 slash 18 block with no-resolve covers the gateway pool that RDAP places in Alibaba Cloud Japan. A single-address rule would go stale the first time the pool moved and that failure is the detection firing again, while under fake-ip the breadth costs little because no-resolve means the rule only sees connections made to a bare address.
- id: lite-product-same-routing
status: accepted
scope: product-shape
summary: A second build folds 42 policy groups into 10 without changing what any segment does.
evidence:
- sources/manifest.yaml
- sources/proxy-groups.yaml
- scripts/profile_model.py
- tests/test_profile.py
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: Forty-two groups exist so each kind of traffic can be pointed at its own node, which for anyone who does not want that is a screen of dropdowns before the profile is usable. The lite build keeps the same 64 segments and the same rule files and only changes the target a segment names, expressed as Segment.lite_target with target_for(product) so the fold is a per-segment retarget rather than an edit. Forty-seven segments are retargeted - the ones that each had a group of their own and all defaulted to a proxy go to 国外服务 or 流媒体, the mainland groups that defaulted to direct go to 国内网站 - leaving ten groups chosen by whether someone plausibly wants to point them somewhere different, not by count. The safety claim covers every segment rather than the inspected ones, so LiteProductTests compares the effective action of all 64 across both products by following a target to its group's leading member, and both give 17 DIRECT, 45 PROXY and 2 REJECT. That test was checked against an injected fault - retargeting 游戏下载 to 国外服务, a fold that reads reasonable and is wrong because a metered download would start spending proxy bandwidth - and it fails. The cost is granularity alone - Netflix and YouTube share 流媒体 and move together - and it is stated in both READMEs beside the group count.
- id: hoyoverse-gateway-pool-is-alibaba-international
status: accepted
scope: routing-policy
summary: A Japanese sub-block was mistaken for the whole gateway pool, so Singapore gateways fell to the fallback.
evidence:
- sources/rules/game-platform.list
- sources/rules/remote-streaming-admin.list
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: ER-059 admitted the Japanese allocation after observing one gateway at 8.209.197.93, and Honkai Star Rail kept refusing login with 1001_1. A router log caught the connection at the moment of failure - UDP to 8.216.16.211 port 23301, the HoYoverse gateway port, matching only MATCH and using the fallback while the login session used another exit, which is what the risk check rejects. RDAP places 8.209.197.93 in ALICLOUD-JP 8.209.192.0 slash 18 and 8.216.16.211 in ASEPL-SG 8.208.0.0 slash 12, and the Japanese range is a sub-block carved out of the Singapore one - so the earlier rule took a sub-block for the whole pool. The rule is now the exact boundary of the ASEPL-SG allocation rather than a range invented to be wide enough, with edges verified at 8.208.0.1 and 8.223.255.254 matching while 8.207.255.255 and 8.224.0.1 fall through. Under fake-ip the breadth costs little because no-resolve means the rule only sees connections made to a bare address, and both the fallback and the game policy lead with the manual selector so the default action is unchanged. console.tailscale.com joins the remote-streaming admin segment on the same round - it answers from CloudFront while login and controlplane sit in Tailscale's own 192.200.0.0 space, relays are not served from a CDN, and direct access from the mainland times out; as an exact DOMAIN it cannot touch a relay, re-verified for derp1a, controlplane, ts.net and log.tailscale.io in both builds. ZeroTier's data plane was seen on the fallback in the same log and is deliberately left alone - its registered block belongs to Datacamp, a CDN, and direct reachability of a Zurich root from the mainland is not established while the proxy path works, so moving it needs a measurement first.
- id: version-check-must-not-assert-stale-currency
status: accepted
scope: selfhost-web
summary: A thirty-minute cache made the page state that a deployment was current when a newer tag existed.
evidence:
- selfhost/app/src/lib/latest-version.ts
- selfhost/app/src/lib/latest-version.test.ts
- selfhost/app/src/app/api/health/route.ts
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: After selfhost-v0.2.1 was published the deployed page still read 最新 0.2.0 with update_available false, because the check cached for thirty minutes while the update timer pulls every five. A stale cache here does not withhold the answer, it states the opposite with the same confidence as a correct one, which is the failure the check was added to prevent; and once the image moved first the page would print a running version newer than the latest beside it. The cache existed only to protect the anonymous api.github.com budget of 60 requests an hour per address, which this server spends on every visitor's behalf, so a lookup per load would have broken for everyone at sixty visits in an hour. Tags now come from git's ref advertisement at info/refs service=git-upload-pack, roughly 6 KB and not metered that way, so the quota no longer dictates freshness and the check runs on every load. A failure is held for a minute so a failing lookup does not make each visitor wait out the timeout, concurrent callers still share one request, and the health endpoint reports the running version as latest whenever the check lags behind the image, because the running image was built from a published tag and a smaller number would be both wrong and alarming. The star count keeps its own thirty-minute clock on the REST API since it does not need to be fresh.
- id: finance-needs-its-own-exit
status: accepted
scope: routing-policy
summary: Financial accounts are checked against where they are used, so they cannot share an exit with every unclassified request.
evidence:
- sources/rules/finance.list
- sources/rules/china-web.list
- sources/proxy-groups.yaml
- docs/evidence/cn-apnic-verdicts-2026-09-19.json
first_observed: 2026-09-19
last_verified: '2026-09-19'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: wise.com reached the fallback and worked, which is why it went unnoticed - the fallback is a proxy so the page loaded, but it had no exit of its own, and a financial account is checked against where it is used. Sharing an exit with every unclassified request means that exit moves whenever anything else does, which is the same defect as the game session. The finance policy leads with the manual selector and holds 44 rules across payments and remittance, virtual cards, SMS receipt and virtual numbers, and overseas banks and brokers. Virtual cards and SMS receipt belong with the rest because they are the step where an account is created and the registering address is the one the account is thereafter expected to arrive from. Every domain was resolved before admission and the ones that did not answer were left out; futunn.com and moomoo.com were checked rather than assumed because a broker on Tencent Cloud reads like a mainland service, and both resolve into Hong Kong rather than mainland ranges. The segment is funded the way ER-023 established - kakao-talk concatenated into line, the two adjacent with nothing between them and both targeting the same chat policy, so nothing can reorder and nothing can change policy, verified per host afterwards, with the retired Raw URL kept as a generated-only compatibility slice behind frozen hashes. Checking that mainland banks stayed direct turned up twelve on the fallback, which is worse than a foreign bank there because the proxy exit is what their risk check objects to; the mainland probe admitted the eight that resolve wholly into APNIC CN ranges and left four out - cloudpay.com.cn and yunshanfu.cn resolve outside them, gdb.com.cn and hsbank.cc do not resolve - because a bank being obviously Chinese is a reason to look rather than a verdict.
- id: steam-cm-follows-download-exit
status: accepted
scope: game-download
summary: Steam connection managers must leave through the download exit, because Steam picks content servers from the address it sees on the CM connection.
evidence:
- docs/evidence/steam-cm-runtime-observation-2026-09-25.json
- sources/rules/game-download.list
- sources/rules/game-platform-late-recovery.list
- User's own Steam client content_log and connection_log on 2026-09-25; no subscription, node, account, or endpoint credentials retained
first_observed: 2026-09-25
last_verified: '2026-09-26'
phase_2_candidate: none
recommended_action: keep
current_product: standard
resolution: With game-download on DIRECT, Steam still waited a long time before downloading and then crawled, while switching game-download to a proxy ran at full speed. The logs show why. steamserver.net sat in game-platform-late-recovery, so the CM connection used the game-platform proxy, and Steam handed out 14 sources led by Tokyo SteamCache hosts plus overseas Akamai, Fastly and Google CDNs. The DIRECT download policy then went straight to those overseas hosts; every Tokyo cache failed after about five seconds, one update was cancelled on a manifest timeout, and the running rate stayed between 0.05 and 39 Mbps. When the user disabled the gateway, the CM connected directly (to the same tyo3 data centre) and within half a minute Steam switched to three or four mainland CDNs at 148-366 Mbps, with CellID 198 unchanged throughout. The deciding input is therefore the CM connection's public address, not the CM location or the configured region. The steamserver.net suffix moves from game-platform-late-recovery into game-download, which runs earlier and defaults to DIRECT, so the CM and the downloads share one exit. That exit is still the user's choice, so selecting a proxy for game-download keeps both consistent the other way too. The late-recovery set shrinks by one entry and gains none. api.steampowered.com stays with the platform because the logs do not show it deciding the content list, and the chunk redirect hosts gstore.val.smogfly.com and yif.gdtstream.com stay unaccepted because a single redirect each is not enough evidence.