The lib/ tree had two complete orphan modules (config-reader.sh and
  service-control.sh) that install.sh has never called and tests only
  touched as "does it source cleanly" smoke. Keeping them around while
  install.sh maintained private handleXray/handleSingBox/handleNginx
  created a permanent gray zone where two implementations drifted apart
  silently. The alternative - a real "P2-14 lib integration" - would
  touch service start/stop and firewall paths that can't be verified
  without a Linux test container; the audit in REVIEW.md appendix C
  found at least five user-visible behavior differences including
  Reality-only Nginx start and SELinux port fixups that only existed
  in the install.sh version.