Stealth + UX: unauthenticated requests no longer leak the product name or repo (/manifest.json neutral, /version.json removed); the unmatched-path decoy is now stable per host and serves a real site inline instead of a random redirect; and config names carry a real exit-country flag for a fixed non-Cloudflare exit (globe for direct-Cloudflare/anycast), geolocated and cached off the hot path. Connections/subscriptions unchanged.