Reaper v2.7.6 — GT-BE98_PRO

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (GT-BE98_PRO)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	GT-BE98_PRO_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	4dd78eab8a112dd3f8ec4faf47a78b638fd42a70d78df7945887f2fec0c0f0a3
Standard	GT-BE98_PRO_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	aab7de4d573713f6e0142012b83a7fd360d39c8b78751031f0c4f2cea1894d03

Verify a download against the attached SHA256SUMS-GT-BE98_PRO-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The GT-BE98_PRO image for v2.7.6 is built from this repository at tag v2.7.6-GT-BE98_PRO: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-GT-BE98_PRO (patches + docs).