core_fixes

ostp-client/src/bridge.rs

@@ -342,7 +342,7 @@ impl Bridge {
                                             Err(e) => {
                                                 if is_uot {
                                                     // TCP is dead — drop sender to signal bridge via channel close
-                                                    tracing::warn!("UoT session {} disconnected: {}", session_index, e);
+                                                    tracing::debug!("UoT session {} disconnected: {}", session_index, e);
                                                     break;
                                                 } else {
                                                     tracing::warn!("UDP socket recv error (session {}): {}", session_index, e);
@@ -436,7 +436,7 @@ impl Bridge {
                                             }
                                             Err(e) => {
                                                 if is_uot {
-                                                    tracing::warn!("UoT network-change session {} disconnected: {}", session_index, e);
+                                                    tracing::debug!("UoT network-change session {} disconnected: {}", session_index, e);
                                                     break;
                                                 } else {
                                                     tracing::warn!("UDP recv error (network-change session {}): {}", session_index, e);
@@ -574,7 +574,7 @@ impl Bridge {
                                     }
                                     Err(e) => {
                                         if is_uot {
-                                            tracing::warn!("UoT reconnect session {} disconnected: {}", session_index, e);
+                                            tracing::debug!("UoT reconnect session {} disconnected: {}", session_index, e);
                                             break;
                                         } else {
                                             tracing::warn!("UDP socket recv error (reconnect session {}): {}", session_index, e);

ostp-client/src/sysproxy.rs

@@ -189,7 +189,7 @@ fn refresh_wininet() {
 #[cfg(not(target_os = "windows"))]
 pub fn enable_system_proxy(proxy_addr: &str) {
     let parts: Vec<&str> = proxy_addr.split(':').collect();
-    let host = parts.get(0).unwrap_or(&"127.0.0.1");
+    let host = parts.first().unwrap_or(&"127.0.0.1");
     let port = parts.get(1).unwrap_or(&"1088");
 
     let is_gui = std::env::var("DISPLAY").is_ok() || std::env::var("WAYLAND_DISPLAY").is_ok();

ostp-client/src/tunnel/udp_nat.rs

@@ -113,7 +113,7 @@ pub async fn run_udp_nat(
 async fn start_udp_bypass_session(
     client_src: SocketAddr,
     phys_if_index: Option<u32>,
-    phys_if_name: Option<String>,
+    _phys_if_name: Option<String>,
     session_rx: &mut mpsc::Receiver<(Vec<u8>, SocketAddr)>,
     smoltcp_tx: Arc<Mutex<netstack_smoltcp::udp::WriteHalf>>,
 ) -> anyhow::Result<()> {

ostp-core/src/congestion.rs

@@ -4,6 +4,12 @@
 //! bandwidth and minimum RTT to determine the optimal sending rate.
 //! This replaces the fixed `retransmit_budget = 8` with an adaptive
 //! congestion window that responds to network conditions.
+//!
+//! RTO calculation follows RFC 6298:
+//!   SRTT = (1 - α) * SRTT + α * RTT       (α = 1/8)
+//!   RTTVAR = (1 - β) * RTTVAR + β * |SRTT - RTT|  (β = 1/4)
+//!   RTO = SRTT + 4 * RTTVAR
+//!   clamped to [RTO_MIN, RTO_MAX]
 
 use std::time::{Duration, Instant};
 
@@ -15,8 +21,14 @@ pub struct CongestionController {
     ssthresh: u64,
     /// Current phase
     phase: Phase,
-    /// Minimum RTT observed
+    /// Minimum RTT observed (for BBR-style bandwidth estimation)
     min_rtt: Duration,
+    /// Smoothed RTT (RFC 6298 SRTT)
+    srtt: Duration,
+    /// RTT variance (RFC 6298 RTTVAR)
+    rttvar: Duration,
+    /// Whether we have received a first RTT sample
+    rtt_initialized: bool,
     /// Bytes currently in flight (unacknowledged)
     bytes_in_flight: u64,
     /// Total bytes acknowledged (for bandwidth estimation)
@@ -37,31 +49,43 @@ pub struct CongestionController {
 enum Phase {
     /// Exponential growth until loss or ssthresh
     SlowStart,
-    /// Probe bandwidth: cycle through pacing gains
+    /// Probe bandwidth: additive increase
     ProbeBandwidth,
 }
 
-/// Initial congestion window: 10 packets × MTU
-const INITIAL_CWND_PACKETS: u64 = 10;
+/// Initial congestion window: 32 packets × MTU (IW10 is too conservative for modern links)
+const INITIAL_CWND_PACKETS: u64 = 32;
 /// Minimum cwnd: 2 packets
 const MIN_CWND_PACKETS: u64 = 2;
 /// Min RTT expiry window (after which we re-probe)
 const MIN_RTT_EXPIRY: Duration = Duration::from_secs(10);
+/// Minimum RTO (RFC 6298: 1s in TCP; we use 50ms since we own the protocol)
+const RTO_MIN: Duration = Duration::from_millis(50);
+/// Maximum RTO
+const RTO_MAX: Duration = Duration::from_secs(16);
+/// Initial RTT estimate — 30 ms is reasonable for a well-connected VPN server.
+/// Will be replaced by first real measurement within milliseconds.
+const INITIAL_RTT: Duration = Duration::from_millis(30);
 
 impl CongestionController {
     pub fn new(mtu: u64) -> Self {
         let now = Instant::now();
         let initial_cwnd = INITIAL_CWND_PACKETS * mtu;
+        // Initial pacing: deliver cwnd in ~2 RTTs to fill the pipe quickly
+        let initial_pacing = initial_cwnd * 1_000_000 / INITIAL_RTT.as_micros().max(1) as u64;
         Self {
             cwnd: initial_cwnd,
             ssthresh: u64::MAX,
             phase: Phase::SlowStart,
-            min_rtt: Duration::from_millis(100), // Conservative initial estimate
+            min_rtt: INITIAL_RTT,
+            srtt: INITIAL_RTT,
+            rttvar: INITIAL_RTT / 2,
+            rtt_initialized: false,
             bytes_in_flight: 0,
             total_acked: 0,
             last_ack_time: now,
             loss_count: 0,
-            pacing_rate: initial_cwnd * 10, // initial: ~10 windows/sec
+            pacing_rate: initial_pacing,
             mtu,
             min_rtt_stamp: now,
         }
@@ -82,9 +106,20 @@ impl CongestionController {
         self.pacing_rate
     }
 
-    /// Returns the smoothed RTT estimate.
+    /// Returns the smoothed RTT estimate (SRTT).
     pub fn smoothed_rtt(&self) -> Duration {
-        self.min_rtt
+        self.srtt
+    }
+
+    /// Returns the adaptive RTO computed per RFC 6298:
+    ///   RTO = SRTT + 4 * RTTVAR, clamped to [RTO_MIN, RTO_MAX].
+    ///
+    /// This replaces the static `rto_ms` field in ProtocolMachine so that
+    /// retransmit timers automatically track changing network conditions.
+    pub fn rto(&self) -> Duration {
+        let rttvar4 = self.rttvar.saturating_mul(4);
+        let rto = self.srtt.saturating_add(rttvar4);
+        rto.clamp(RTO_MIN, RTO_MAX)
     }
 
     /// Returns how many bytes can still be sent.
@@ -115,16 +150,13 @@ impl CongestionController {
         self.bytes_in_flight = self.bytes_in_flight.saturating_sub(bytes);
         self.total_acked = self.total_acked.saturating_add(bytes);
 
-        // Update RTT
+        // Update RTT measurements
         self.update_rtt(rtt, now);
 
-        // Update bandwidth estimate
-        self.update_bandwidth(bytes, now);
-
         // State machine
         match self.phase {
             Phase::SlowStart => {
-                // Exponential growth: increase cwnd by acked bytes
+                // Exponential growth: increase cwnd by acked bytes (doubles per RTT)
                 self.cwnd = self.cwnd.saturating_add(bytes);
                 if self.cwnd >= self.ssthresh {
                     self.phase = Phase::ProbeBandwidth;
@@ -164,32 +196,49 @@ impl CongestionController {
         self.update_pacing_rate();
     }
 
-    /// Called periodically to update state.
-    pub fn on_tick(&mut self) {
-        // Nothing special needed per-tick -- state updates happen on ACK/loss
-    }
-
     // ── Private ──────────────────────────────────────────────────────────────
 
     fn update_rtt(&mut self, rtt: Duration, now: Instant) {
-        // Track windowed minimum RTT
+        // Update windowed minimum RTT (for pacing)
         if rtt < self.min_rtt || now.duration_since(self.min_rtt_stamp) >= MIN_RTT_EXPIRY {
             self.min_rtt = rtt;
             self.min_rtt_stamp = now;
         }
-    }
 
-    fn update_bandwidth(&mut self, _acked_bytes: u64, now: Instant) {
-        let elapsed = now.duration_since(self.last_ack_time);
-        if elapsed.as_micros() > 0 {
-        // Removed bw_samples tracking
+        // Update SRTT and RTTVAR per RFC 6298
+        if !self.rtt_initialized {
+            // First measurement: initialize directly
+            self.srtt = rtt;
+            self.rttvar = rtt / 2;
+            self.rtt_initialized = true;
+        } else {
+            // RTTVAR = (3/4) * RTTVAR + (1/4) * |SRTT - R|
+            let diff = if rtt > self.srtt {
+                rtt - self.srtt
+            } else {
+                self.srtt - rtt
+            };
+            // Integer-safe: RTTVAR = RTTVAR - RTTVAR/4 + diff/4
+            self.rttvar = self.rttvar
+                .saturating_sub(self.rttvar / 4)
+                .saturating_add(diff / 4);
+
+            // SRTT = (7/8) * SRTT + (1/8) * R
+            self.srtt = self.srtt
+                .saturating_sub(self.srtt / 8)
+                .saturating_add(rtt / 8);
         }
+
+        tracing::trace!(
+            srtt_ms = self.srtt.as_millis(),
+            rttvar_ms = self.rttvar.as_millis(),
+            rto_ms = self.rto().as_millis(),
+            "congestion: RTT updated"
+        );
     }
 
-
-
     fn update_pacing_rate(&mut self) {
-        // Pacing rate = cwnd / min_rtt (with gain)
+        // Pacing rate = cwnd / min_rtt (delivery rate target)
         let rtt_us = self.min_rtt.as_micros().max(1) as u64;
         self.pacing_rate = self.cwnd * 1_000_000 / rtt_us;
     }
@@ -202,19 +251,18 @@ mod tests {
     #[test]
     fn test_initial_state() {
         let cc = CongestionController::new(1200);
-        assert_eq!(cc.cwnd(), 12000); // 10 * 1200
+        assert_eq!(cc.cwnd(), 32 * 1200); // 32 * 1200
         assert!(cc.can_send());
-        assert_eq!(cc.cwnd_packets(), 10);
+        assert_eq!(cc.cwnd_packets(), 32);
     }
 
     #[test]
     fn test_slow_start_growth() {
         let mut cc = CongestionController::new(1200);
-        // Simulate sending and ACKing
+        let initial = cc.cwnd();
         cc.on_send(1200);
         cc.on_ack(1200, Duration::from_millis(50));
-        // cwnd should grow
-        assert!(cc.cwnd() > 12000);
+        assert!(cc.cwnd() > initial);
     }
 
     #[test]
@@ -229,7 +277,7 @@ mod tests {
     fn test_can_send_limits() {
         let mut cc = CongestionController::new(1200);
         // Send until cwnd is exhausted
-        for _ in 0..10 {
+        for _ in 0..32 {
             cc.on_send(1200);
         }
         assert!(!cc.can_send()); // cwnd exhausted
@@ -244,10 +292,46 @@ mod tests {
     }
 
     #[test]
-    fn test_rtt_tracking() {
+    fn test_rtt_tracking_first_sample() {
         let mut cc = CongestionController::new(1200);
         cc.on_send(1200);
         cc.on_ack(1200, Duration::from_millis(25));
+        // After first sample: SRTT = 25ms, RTTVAR = 12ms
         assert_eq!(cc.smoothed_rtt(), Duration::from_millis(25));
     }
+
+    #[test]
+    fn test_rto_rfc6298() {
+        let mut cc = CongestionController::new(1200);
+        // After first sample with RTT=50ms: SRTT=50ms, RTTVAR=25ms, RTO=150ms
+        cc.on_send(1200);
+        cc.on_ack(1200, Duration::from_millis(50));
+        let rto = cc.rto();
+        // RTO = 50 + 4*25 = 150ms; clamped to [50ms, 16s]
+        assert!(rto >= RTO_MIN);
+        assert!(rto <= RTO_MAX);
+        assert_eq!(rto, Duration::from_millis(150));
+    }
+
+    #[test]
+    fn test_rto_clamp_min() {
+        let cc = CongestionController::new(1200);
+        // Even with no RTT samples, RTO should not go below RTO_MIN
+        assert!(cc.rto() >= RTO_MIN);
+    }
+
+    #[test]
+    fn test_rto_adapts_after_multiple_samples() {
+        let mut cc = CongestionController::new(1200);
+        // Feed several consistent RTT samples
+        for _ in 0..8 {
+            cc.on_send(1200);
+            cc.on_ack(1200, Duration::from_millis(20));
+        }
+        // After convergence, RTTVAR should be small → RTO close to SRTT + small margin
+        let rto = cc.rto();
+        // Should be well below 100ms (the old hardcoded default)
+        assert!(rto < Duration::from_millis(200));
+        assert!(rto >= RTO_MIN);
+    }
 }

ostp-core/src/protocol.rs

@@ -395,18 +395,20 @@ impl ProtocolMachine {
             self.last_recv_advance = Instant::now();
         } else {
             // Gap detected
-            if self.reorder_buffer.len() < self.max_reorder_buffer {
-                self.reorder_buffer.insert(nonce, action);
+            if nonce >= self.expected_recv_nonce {
+                if self.reorder_buffer.len() < self.max_reorder_buffer {
+                    self.reorder_buffer.insert(nonce, action);
+                } else {
+                    tracing::warn!("Reorder buffer still full after gap recovery, dropping frame nonce={}", nonce);
+                }
             } else {
-                tracing::warn!("Reorder buffer full ({}/{}), dropping frame nonce={}",
-                    self.reorder_buffer.len(), self.max_reorder_buffer, nonce
-                );
+                tracing::debug!("Frame nonce={} arrived too late after gap recovery, dropping", nonce);
             }
 
-            // Rate-limited NACK: send at most once per 30ms to prevent retransmit storms.
-            // Under high load with natural UDP reordering, sending a NACK per packet
-            // causes exponential retransmit explosion that saturates the channel.
-            let nack_cooldown = Duration::from_millis(30);
+            // Rate-limited NACK: send at most once per (rto/2) to prevent retransmit storms.
+            // Using rto/2 means we send a NACK before the sender's timer fires, prompting
+            // fast retransmit without flooding. Floor at 10ms to handle very low-RTT links.
+            let nack_cooldown = (self.cc.rto() / 2).max(Duration::from_millis(10));
             if self.last_nack_sent.elapsed() >= nack_cooldown {
                 self.last_nack_sent = Instant::now();
                 let nack_payload = self.expected_recv_nonce.to_be_bytes();
@@ -514,44 +516,18 @@ impl ProtocolMachine {
     fn handle_tick(&mut self) -> Result<ProtocolAction, ProtocolError> {
         let mut actions = Vec::new();
 
-        // ── Gap Recovery ──────────────────────────────────────────────
-        // If expected_recv_nonce hasn't advanced for 500ms+ and there
-        // are buffered frames waiting, the sender likely evicted the lost
-        // frame from sent_history. Skip the gap to restore data flow.
-        // This trades a small amount of data loss for connection liveness.
-        if !self.reorder_buffer.is_empty()
-            && self.last_recv_advance.elapsed() > Duration::from_millis(500)
-        {
-            if let Some(&first_buffered) = self.reorder_buffer.keys().next() {
-                let skipped = first_buffered.saturating_sub(self.expected_recv_nonce);
-                self.expected_recv_nonce = first_buffered;
-                self.last_recv_advance = Instant::now();
-
-                let mut delivered = 0u64;
-                while let Some(buffered_action) = self.reorder_buffer.remove(&self.expected_recv_nonce) {
-                    actions.push(buffered_action);
-                    self.expected_recv_nonce = self.expected_recv_nonce.saturating_add(1);
-                    delivered += 1;
-                }
-                self.ack_pending = true;
-                tracing::debug!("Gap recovery: skipped {} lost frames, delivered {} buffered frames (reorder_buf={})",
-                    skipped, delivered, self.reorder_buffer.len()
-                );
-            }
-        }
-
         // ── Pending ACK flush ─────────────────────────────────────────
         if let Some(ack_frame) = self.build_ack_if_due()? {
             actions.push(ProtocolAction::SendDatagram(ack_frame));
         }
 
         let now = Instant::now();
-        let base_rto_ms = self.rto.as_millis().max(1) as u64;
+        // Use the adaptive RTO from the congestion controller (RFC 6298 SRTT + 4*RTTVAR).
+        // Falls back to rto_initial before the first ACK is received.
+        let base_rto_ms = self.cc.rto().max(self.rto).as_millis().max(1) as u64;
 
         // ── Zombie frame eviction ────────────────────────────────────
         // Evict frames that exceeded max_retries + 2 grace retries.
-        // Shorter grace period than before (was +4) to free memory faster
-        // after high-throughput bursts.
         let grace = self.max_retries.saturating_add(2);
         let before = self.sent_history.len();
         self.sent_history.retain(|f| !f.is_retransmittable || f.retries <= grace);
@@ -562,14 +538,15 @@ impl ProtocolMachine {
 
         // ── Retransmit expired frames ────────────────────────────────
         // Limit retransmits per tick to prevent bandwidth saturation
+        // Backoff starts from retry #0 (immediately effective):
+        //   effective_rto = base_rto * 2^retries, capped at 2^6 = 64×
         let mut retransmit_budget: usize = self.cc.retransmit_budget();
         for frame in self.sent_history.iter_mut() {
             if !frame.is_retransmittable {
                 continue;
             }
 
-            let retry_over = frame.retries.saturating_sub(self.max_retries);
-            let backoff_factor = 1u64 << retry_over.min(6);
+            let backoff_factor = 1u64 << (frame.retries as u64).min(6);
             let effective_rto = Duration::from_millis(base_rto_ms.saturating_mul(backoff_factor));
 
             if now.duration_since(frame.last_sent) >= effective_rto {

ostp-gui/src-tauri/Cargo.toml

@@ -31,3 +31,4 @@ json_comments = "0.2"
 rand = "0.8"
 qrcode = { version = "0.14", default-features = false, features = ["svg"] }
 
+rlimit = "0.11.0"

ostp-gui/src-tauri/src/lib.rs

@@ -789,8 +789,13 @@ pub fn run() {
     if let Ok(listener) = std::net::TcpListener::bind("127.0.0.1:49153") {
         let _ = SINGLE_INSTANCE_LOCK.set(listener);
     } else {
-        show_error_dialog("Приложение OSTP GUI уже запущено!");
-        return;
+        #[cfg(not(debug_assertions))]
+        {
+            show_error_dialog("Приложение OSTP GUI уже запущено!");
+            return;
+        }
+        #[cfg(debug_assertions)]
+        println!("WARNING: OSTP GUI is already running, ignoring in debug mode.");
     }
 
     let state = AppState(Mutex::new(AppStateInner { tunnel: None }));

ostp-gui/src-tauri/src/main.rs

@@ -2,6 +2,7 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
 fn main() {
+    let _ = rlimit::increase_nofile_limit(1048576);
     ostp_client::logging::setup_panic_hook();
 
     // Read config BEFORE init_tracing so we can use the correct log level from config.

ostp-gui/src/index.html

@@ -6,52 +6,33 @@
   <title>OSTP</title>
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-  <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" />
+  <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" />
   <link rel="stylesheet" href="styles.css" />
 </head>
 <body>
   <div class="app-root">
 
-    <!-- Ambient light blobs -->
-    <div class="ambient" aria-hidden="true">
-      <div class="blob blob-1"></div>
-      <div class="blob blob-2"></div>
-    </div>
-
-    <!-- Eagle watermark (brand) -->
+    <!-- Eagle watermark — behind everything, every screen -->
     <div class="watermark" aria-hidden="true">
       <img src="assets/logo.svg" alt="" />
     </div>
 
-    <!-- ── HOME SCREEN ──────────────────────────────────────────── -->
+    <!-- ── HOME SCREEN ──────────────────────────────────────── -->
     <div id="home-screen" class="screen active">
 
-      <!-- Top bar -->
       <header class="topbar">
         <div class="brand">
           <div class="brand-dot" id="brand-dot"></div>
           <span class="brand-name">OSTP</span>
         </div>
         <div class="topbar-right">
-          <button id="btn-auto-connect" class="icon-btn" aria-label="Auto">
-            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-              <path d="M12 2v4M12 18v4M4.93 4.93l2.83 2.83M16.24 16.24l2.83 2.83M2 12h4M18 12h4M4.93 19.07l2.83-2.83M16.24 7.76l2.83-2.83"/>
-            </svg>
-          </button>
-          <button id="btn-theme-toggle" class="theme-toggle-btn" aria-label="Toggle theme">
-            <!-- Sun icon (shown in dark mode) -->
-            <svg class="icon-sun" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-              <circle cx="12" cy="12" r="5"/>
-              <path d="M12 1v2M12 21v2M4.22 4.22l1.42 1.42M18.36 18.36l1.42 1.42M1 12h2M21 12h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42"/>
-            </svg>
-            <!-- Moon icon (shown in light mode) -->
-            <svg class="icon-moon" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-              <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+          <button id="btn-auto-connect" class="icon-btn" aria-label="Auto" title="Auto-connect">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">
+              <polygon points="13 2 3 14 12 14 11 22 21 10 12 10 13 2"/>
             </svg>
           </button>
           <button id="btn-go-settings" class="icon-btn" aria-label="Settings">
-            <!-- Gear icon -->
-            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">
               <circle cx="12" cy="12" r="3"/>
               <path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/>
             </svg>
@@ -62,15 +43,16 @@
       <!-- Center stage -->
       <main class="stage">
 
-        <!-- Orbit rings -->
+        <!-- Orbit rings (animated when connecting/connected) -->
         <div class="orbit-wrap" id="orbit-wrap">
           <div class="orbit orbit-1"></div>
           <div class="orbit orbit-2"></div>
+          <div class="orbit orbit-3"></div>
 
           <!-- Power button -->
-          <button id="btn-connect" class="power-btn" aria-label="Connect">
+          <button id="btn-connect" class="power-btn" aria-label="Connect / Disconnect">
             <div class="power-icon">
-              <svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+              <svg width="46" height="46" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round">
                 <path d="M18.36 6.64a9 9 0 1 1-12.73 0"/>
                 <line x1="12" y1="2" x2="12" y2="12"/>
               </svg>
@@ -78,16 +60,19 @@
           </button>
         </div>
 
-        <!-- Status block -->
+        <!-- Status text -->
         <div class="status-block">
-          <div id="status-text" class="status-label" data-i18n="status_disconnected">Disconnected</div>
-          <div id="uptime-text" class="status-sub" data-i18n="hint_tap">Tap to protect your traffic</div>
+          <div id="status-text" class="status-label">Disconnected</div>
+          <div id="uptime-text" class="status-sub">Tap to protect your traffic</div>
         </div>
 
-        <!-- Connection info (shown when connected) -->
+        <!-- Error banner -->
+        <div id="error-banner" class="error-banner hidden"></div>
+
+        <!-- Connection info (visible when connected) -->
         <div id="connection-info" class="connection-info hidden">
           <div class="server-badge">
-            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
               <rect x="2" y="2" width="20" height="8" rx="2"/>
               <rect x="2" y="14" width="20" height="8" rx="2"/>
               <line x1="6" y1="6" x2="6.01" y2="6"/>
@@ -96,53 +81,56 @@
             <span id="server-badge-text">—</span>
           </div>
 
-          <div class="ping-test-box">
-            <div class="ping-test-left">
-              <span class="ping-test-title">CONNECTION TEST</span>
-              <span id="ping-text-value" class="ping-test-value">Target Ping: -- ms</span>
+          <!-- Live RTT + speeds -->
+          <div class="live-stats">
+            <div class="live-stat">
+              <span class="live-stat-label">RTT</span>
+              <span id="live-rtt" class="live-stat-value">--</span>
+            </div>
+            <div class="live-stat-sep"></div>
+            <div class="live-stat">
+              <span class="live-stat-label">↓</span>
+              <span id="live-down-speed" class="live-stat-value">0 B/s</span>
+            </div>
+            <div class="live-stat-sep"></div>
+            <div class="live-stat">
+              <span class="live-stat-label">↑</span>
+              <span id="live-up-speed" class="live-stat-value">0 B/s</span>
             </div>
-            <button id="btn-test-ping" class="ping-btn">
-              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
-                <path d="M22 12h-4l-3 9L9 3l-3 9H2"/>
-              </svg>
-              <span>Test Ping</span>
-            </button>
           </div>
         </div>
 
       </main>
 
-      <!-- Traffic metrics bar -->
+      <!-- Total traffic bar -->
       <footer class="metrics-bar">
         <div class="metric">
           <div class="metric-icon down-icon">
-            <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+            <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
               <path d="M12 5v14M19 12l-7 7-7-7"/>
             </svg>
           </div>
           <div class="metric-body">
-            <span class="metric-label" data-i18n="download">Download</span>
+            <span class="metric-label">Download</span>
             <span id="metric-down" class="metric-value">0 B</span>
           </div>
         </div>
-
         <div class="metric-sep"></div>
-
         <div class="metric">
           <div class="metric-icon up-icon">
-            <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+            <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
               <path d="M12 19V5M5 12l7-7 7 7"/>
             </svg>
           </div>
           <div class="metric-body">
-            <span class="metric-label" data-i18n="upload">Upload</span>
+            <span class="metric-label">Upload</span>
             <span id="metric-up" class="metric-value">0 B</span>
           </div>
         </div>
       </footer>
     </div>
 
-    <!-- ── SETTINGS SCREEN ──────────────────────────────────────── -->
+    <!-- ── SETTINGS SCREEN ──────────────────────────────────── -->
     <div id="settings-screen" class="screen">
 
       <header class="topbar">
@@ -151,236 +139,246 @@
             <path d="M19 12H5M12 19l-7-7 7-7"/>
           </svg>
         </button>
-        <span class="topbar-title" data-i18n="settings_title">Configuration</span>
-        <div style="width:36px"></div>
+        <span class="topbar-title">Profiles</span>
+        <button id="btn-add-profile" class="icon-btn add-btn" aria-label="Add profile">
+          <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+            <line x1="12" y1="5" x2="12" y2="19"/>
+            <line x1="5" y1="12" x2="19" y2="12"/>
+          </svg>
+        </button>
       </header>
 
       <div class="settings-body">
 
-        <!-- Quick import -->
-        <div class="import-row">
-          <input id="in-import-url"
-                 class="import-input"
-                 type="text"
-                 data-i18n-placeholder="import_placeholder"
-                 placeholder="Paste ostp:// share link..." />
-          <button id="btn-import-url" class="accent-btn" data-i18n="import_btn">Import</button>
-          <button id="btn-share-url" class="btn secondary" data-i18n="share_btn" title="Share this config as a QR code / ostp:// link">Share</button>
+        <!-- Profile list -->
+        <div id="profile-list" class="profile-list">
+          <div id="profile-empty" class="profile-empty">
+            <svg width="36" height="36" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" stroke-linejoin="round">
+              <circle cx="12" cy="12" r="10"/>
+              <line x1="12" y1="8" x2="12" y2="16"/>
+              <line x1="8" y1="12" x2="16" y2="12"/>
+            </svg>
+            <p>No profiles yet.<br/>Tap <strong>+</strong> to add one.</p>
+          </div>
         </div>
 
-        <!-- Form card -->
-        <div class="card scrollable">
+        <!-- Client settings -->
+        <div class="section-divider"><span>Client Settings</span></div>
 
-          <div class="field-group">
-            <label class="field-label" for="in-server" data-i18n="label_server">Server Address</label>
-            <input id="in-server" class="field-input" type="text" placeholder="host:port" spellcheck="false" />
-          </div>
+        <div class="client-settings-card">
 
-          <div class="field-group">
-            <label class="field-label" for="in-key" data-i18n="label_key">Access Key</label>
-            <div class="input-wrap">
-              <input id="in-key" class="field-input has-icon" type="password" data-i18n-placeholder="ph_key" placeholder="Secure access key" spellcheck="false" />
-              <button class="peek-btn" id="btn-peek-key" tabindex="-1" aria-label="Show key">
-                <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-                  <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
-                  <circle cx="12" cy="12" r="3"/>
-                </svg>
-              </button>
-            </div>
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-socks" data-i18n="label_socks">Local Proxy</label>
-            <input id="in-socks" class="field-input" type="text" placeholder="127.0.0.1:1088" />
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-dns" data-i18n="label_dns">Custom DNS Server</label>
-            <input id="in-dns" class="field-input" type="text" placeholder="1.1.1.1" />
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-transport" data-i18n="label_transport">Transport Protocol</label>
-            <select id="in-transport" class="field-input">
-              <option value="udp">UDP (Default)</option>
-              <option value="uot">TCP (UoT)</option>
-            </select>
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-stealth-sni" data-i18n="label_sni">Stealth SNI</label>
-            <input id="in-stealth-sni" class="field-input" type="text" placeholder="www.microsoft.com" spellcheck="false" />
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-mtu" data-i18n="label_mtu">MTU Size</label>
-            <input id="in-mtu" class="field-input" type="number" placeholder="1350" />
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="in-mux-sessions" data-i18n="label_mux_sessions">Mux Sessions</label>
-            <input id="in-mux-sessions" class="field-input" type="number" placeholder="1" />
-          </div>
-
-          <!-- Toggles -->
           <div class="toggle-row">
             <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_tun">TUN Mode</span>
-              <span class="toggle-hint" data-i18n="tun_hint">Route all system traffic</span>
+              <span class="toggle-name">TUN Mode</span>
+              <span class="toggle-hint">Route all system traffic</span>
             </div>
             <label class="toggle">
               <input type="checkbox" id="in-tun-mode" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
             </label>
           </div>
 
-          <div class="toggle-row" id="group-kill-switch" style="display: none;">
+          <div class="toggle-row sub-row" id="group-kill-switch" style="display:none;">
             <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_kill_switch">Kill Switch</span>
-              <span class="toggle-hint" data-i18n="kill_switch_hint">Block traffic if connection drops</span>
+              <span class="toggle-name">Kill Switch</span>
+              <span class="toggle-hint">Block traffic if VPN drops</span>
             </div>
             <label class="toggle">
               <input type="checkbox" id="in-kill-switch" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
             </label>
           </div>
 
-
           <div class="toggle-row">
             <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_mux">Multiplexing (Mux)</span>
-              <span class="toggle-hint" data-i18n="mux_hint">Run multiple streams over one connection</span>
+              <span class="toggle-name">Multiplexing</span>
+              <span class="toggle-hint">Multiple streams over one connection</span>
             </div>
             <label class="toggle">
               <input type="checkbox" id="in-mux-mode" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
             </label>
           </div>
 
-          <div class="toggle-row">
-            <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_launch_startup">Launch at Startup</span>
-              <span class="toggle-hint" data-i18n="launch_startup_hint">Start with Windows</span>
-            </div>
-            <label class="toggle">
-              <input type="checkbox" id="in-launch-startup" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
-            </label>
+          <div class="inline-field sub-row" id="group-mux-sessions" style="display:none;">
+            <span class="field-label">Sessions</span>
+            <input id="in-mux-sessions" class="field-input compact" type="number" placeholder="2" min="1" max="8" />
           </div>
 
-          <div class="toggle-row">
+          <div class="inline-field">
+            <span class="field-label">MTU</span>
+            <input id="in-mtu" class="field-input compact" type="number" placeholder="1350" />
+          </div>
+
+          <div class="inline-field">
+            <span class="field-label">DNS</span>
+            <input id="in-dns" class="field-input compact" type="text" placeholder="1.1.1.1" />
+          </div>
+
+          <div class="inline-field">
+            <span class="field-label">Local Proxy</span>
+            <input id="in-socks" class="field-input compact" type="text" placeholder="127.0.0.1:1088" />
+          </div>
+
+          <div class="section-divider-mini"><span>Exceptions / Routing</span></div>
+
+          <div class="field-group" style="padding: 10px 14px; margin-bottom: 0;">
+            <label class="field-label" for="in-ex-domains">Excluded Domains</label>
+            <textarea id="in-ex-domains" class="field-input mono" placeholder="google.com, mycompany.internal" rows="2" spellcheck="false"></textarea>
+          </div>
+
+          <div class="field-group" style="padding: 0 14px 10px; margin-bottom: 0;">
+            <label class="field-label" for="in-ex-ips">Excluded IPs / Subnets</label>
+            <textarea id="in-ex-ips" class="field-input mono" placeholder="192.168.1.0/24, 10.0.0.1" rows="2" spellcheck="false"></textarea>
+          </div>
+
+          <div class="field-group" style="padding: 0 14px 10px; margin-bottom: 0; border-bottom: 1px solid rgba(255,255,255,0.04);">
+            <label class="field-label" for="in-ex-procs">Excluded Processes</label>
+            <textarea id="in-ex-procs" class="field-input mono" placeholder="chrome.exe, spotify.exe" rows="2" spellcheck="false"></textarea>
+          </div>
+
+          <div class="section-divider-mini"><span>Application</span></div>
+
+          <div class="toggle-row" style="border-top:none;">
             <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_autoconnect">Auto-connect</span>
-              <span class="toggle-hint" data-i18n="autoconnect_hint">Connect automatically on startup</span>
+              <span class="toggle-name">Auto-connect</span>
+              <span class="toggle-hint">Connect on startup</span>
             </div>
             <label class="toggle">
               <input type="checkbox" id="in-autoconnect" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
             </label>
           </div>
 
-
-          <div class="toggle-row">
+          <div class="toggle-row" style="border-top:none;">
             <div class="toggle-text">
-              <span class="toggle-name" data-i18n="label_debug">Debug Logs</span>
-              <span class="toggle-hint" data-i18n="debug_hint">Verbose output</span>
+              <span class="toggle-name">Launch at Startup</span>
+              <span class="toggle-hint">Start with Windows</span>
+            </div>
+            <label class="toggle">
+              <input type="checkbox" id="in-launch-startup" />
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
+            </label>
+          </div>
+
+          <div class="toggle-row" style="border-top:none;">
+            <div class="toggle-text">
+              <span class="toggle-name">Debug Logs</span>
+              <span class="toggle-hint">Verbose output to .log file</span>
             </div>
             <label class="toggle">
               <input type="checkbox" id="in-debug" />
-              <span class="toggle-track">
-                <span class="toggle-thumb"></span>
-              </span>
+              <span class="toggle-track"><span class="toggle-thumb"></span></span>
             </label>
           </div>
 
-
-          <!-- Split Tunneling / Exclusions -->
-          <div class="section-head">
-            <span data-i18n="excl_title">Exclusions</span>
-            <span class="section-hint" data-i18n="excl_hint">traffic that bypasses the tunnel</span>
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="tag-input-domains" data-i18n="excl_domains">Bypass Domains</label>
-            <div class="tag-input-wrap" id="tag-wrap-domains">
-              <div class="tag-list" id="tag-list-domains"></div>
-              <input id="tag-input-domains" class="tag-input-field" type="text"
-                     placeholder="example.com" spellcheck="false" autocomplete="off" />
-            </div>
-            <span class="field-hint">Enter domain suffix and press Enter. Example: google.com, *.local</span>
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="tag-input-ips" data-i18n="excl_ips">Bypass IPs / CIDR</label>
-            <div class="tag-input-wrap" id="tag-wrap-ips">
-              <div class="tag-list" id="tag-list-ips"></div>
-              <input id="tag-input-ips" class="tag-input-field" type="text"
-                     placeholder="192.168.1.0/24" spellcheck="false" autocomplete="off" />
-            </div>
-            <span class="field-hint">Local network ranges bypass the tunnel automatically</span>
-          </div>
-
-          <div class="field-group">
-            <label class="field-label" for="tag-input-processes" data-i18n="excl_processes">Bypass Processes</label>
-            <div class="tag-input-wrap" id="tag-wrap-processes">
-              <div class="tag-list" id="tag-list-processes"></div>
-              <input id="tag-input-processes" class="tag-input-field" type="text"
-                     placeholder="chrome.exe" spellcheck="false" autocomplete="off" />
-            </div>
-            <span class="field-hint" id="proc-hint">Type process name and press Enter.</span>
-          </div>
         </div>
-
-
-
       </div>
     </div>
 
-    <!-- Toast -->
-    <div id="toast" class="toast" role="status" aria-live="polite"></div>
+    <!-- ── ADD PROFILE DROPDOWN ─────────────────────────────── -->
+    <div id="add-menu" class="add-menu hidden">
+      <button id="add-from-link" class="add-menu-item">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/></svg>
+        From link
+      </button>
+      <button id="add-from-clipboard" class="add-menu-item">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="13" height="13" rx="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg>
+        From clipboard
+      </button>
+      <button id="add-manually" class="add-menu-item">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7"/><path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z"/></svg>
+        Manually
+      </button>
+    </div>
 
-    <!-- Wintun Modal -->
-    <div id="wintun-modal" class="modal-overlay hidden">
-      <div class="modal-content">
-        <h3 class="modal-title" data-i18n="wintun_missing_title">Wintun Driver Missing</h3>
-        <p class="modal-text" data-i18n="wintun_missing_desc">TUN mode requires the Wintun network driver.</p>
-        <ol class="modal-steps">
-          <li data-i18n="wintun_step1">Download <strong>wintun.zip</strong> from the official site</li>
-          <li data-i18n="wintun_step2">Extract <code>amd64\wintun.dll</code> from the archive</li>
-          <li><span data-i18n="wintun_step3">Place it here:</span> <code id="wintun-install-path">...</code></li>
-          <li data-i18n="wintun_step4">Restart the connection</li>
-        </ol>
+    <!-- ── LINK INPUT MODAL ─────────────────────────────────── -->
+    <div id="link-modal" class="modal-overlay hidden">
+      <div class="modal-content compact">
+        <h3 class="modal-title">Paste link</h3>
+        <div class="field-group">
+          <input id="link-input" class="field-input mono" type="text" placeholder="ostp://key@host:port" spellcheck="false" />
+        </div>
         <div class="modal-actions">
-          <button id="btn-wintun-cancel" class="btn secondary" data-i18n="cancel_btn">Cancel</button>
-          <a id="btn-wintun-open" href="https://www.wintun.net" target="_blank" class="btn primary" data-i18n="wintun_open_btn">Open wintun.net ↗</a>
+          <button id="btn-link-cancel" class="btn secondary">Cancel</button>
+          <button id="btn-link-import" class="btn primary">Import</button>
         </div>
       </div>
     </div>
 
-    <!-- Share Modal -->
+    <!-- ── PROFILE EDITOR MODAL ─────────────────────────────── -->
+    <div id="profile-modal" class="modal-overlay hidden">
+      <div class="modal-content">
+        <h3 class="modal-title" id="profile-modal-title">New Profile</h3>
+
+        <div class="field-group">
+          <label class="field-label" for="pm-name">Name</label>
+          <input id="pm-name" class="field-input" type="text" placeholder="My Server" />
+        </div>
+        <div class="field-group">
+          <label class="field-label" for="pm-server">Server</label>
+          <input id="pm-server" class="field-input mono" type="text" placeholder="host:port" spellcheck="false" />
+        </div>
+        <div class="field-group">
+          <label class="field-label" for="pm-key">Access Key</label>
+          <div class="input-wrap">
+            <input id="pm-key" class="field-input mono has-icon" type="password" placeholder="Secure access key" spellcheck="false" />
+            <button class="peek-btn" id="btn-peek-pm" tabindex="-1" aria-label="Show key">
+              <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/></svg>
+            </button>
+          </div>
+        </div>
+        <div class="field-group">
+          <label class="field-label" for="pm-transport">Transport</label>
+          <select id="pm-transport" class="field-input">
+            <option value="udp">UDP (Default)</option>
+            <option value="uot">TCP (UoT)</option>
+          </select>
+        </div>
+
+        <div class="modal-actions">
+          <button id="btn-profile-cancel" class="btn secondary">Cancel</button>
+          <button id="btn-profile-delete" class="btn danger" style="display:none;">Delete</button>
+          <button id="btn-profile-save" class="btn primary">Save</button>
+        </div>
+      </div>
+    </div>
+
+    <!-- ── SHARE MODAL ──────────────────────────────────────── -->
     <div id="share-modal" class="modal-overlay hidden">
       <div class="modal-content">
-        <h3 class="modal-title" data-i18n="share_title">Share configuration</h3>
-        <p class="modal-text" data-i18n="share_desc">Scan the QR or copy the link. The QR is generated locally — the access key never leaves this device.</p>
+        <h3 class="modal-title">Share Profile</h3>
+        <p class="modal-text">QR generated locally — the key never leaves this device.</p>
         <div id="share-qr" class="share-qr"></div>
-        <input id="share-link" class="field-input" type="text" readonly />
+        <input id="share-link" class="field-input mono" type="text" readonly />
         <div class="modal-actions">
-          <button id="btn-share-close" class="btn secondary" data-i18n="close_btn">Close</button>
-          <button id="btn-share-copy" class="btn primary" data-i18n="copy_btn">Copy link</button>
+          <button id="btn-share-close" class="btn secondary">Close</button>
+          <button id="btn-share-copy" class="btn primary">Copy link</button>
         </div>
       </div>
     </div>
 
+    <!-- ── WINTUN MODAL ─────────────────────────────────────── -->
+    <div id="wintun-modal" class="modal-overlay hidden">
+      <div class="modal-content">
+        <h3 class="modal-title">Wintun Driver Missing</h3>
+        <p class="modal-text">TUN mode requires the Wintun network driver.</p>
+        <ol class="modal-steps">
+          <li>Download <strong>wintun.zip</strong> from wintun.net</li>
+          <li>Extract <code>amd64\wintun.dll</code></li>
+          <li>Place it here: <code id="wintun-install-path">...</code></li>
+          <li>Restart the connection</li>
+        </ol>
+        <div class="modal-actions">
+          <button id="btn-wintun-cancel" class="btn secondary">Cancel</button>
+          <a id="btn-wintun-open" href="https://www.wintun.net" target="_blank" class="btn primary">Open wintun.net ↗</a>
+        </div>
+      </div>
+    </div>
+
+    <!-- Toast notification -->
+    <div id="toast" class="toast" role="status" aria-live="polite"></div>
+
   </div>
   <script type="module" src="main.js"></script>
 </body>