v0.1.0-beta.12

Pre-release. This release attaches the eight honk-core builds of the honk debug pre-release (x86_64 and aarch64, glibc and musl, mimalloc or the system allocator), built from commit 25377686eabe66005dccb4dd1b8ad795c5609072 (debug.2026.9.30.native-api.5). The honk native API branch is now rebased on daeuniverse/honk main, so these builds add main's VLESS Vision uplink padding and splice handover (honk#304) and compare DNS upstream names without their quotes (honk#305). honk-source-25377686eabe66005dccb4dd1b8ad795c5609072.tar.gz holds that commit's source and HONK-SOURCE.txt names it. Verify downloads against SHA256SUMS, which lists every release asset except itself. Install honk explains which build fits a gateway. Try the demo with sample data: https://demo.daeuniverse.org/ The setup guide is at https://zakkaus.github.io/doona-docs/en/.

預發布版本。本版本附帶 honk debug 預發布版本的八個 honk-core 建置（x86_64 與 aarch64、glibc 與 musl、mimalloc 或系統配置器），來源提交為 25377686eabe66005dccb4dd1b8ad795c5609072（debug.2026.9.30.native-api.5）。honk 原生 API 分支已 rebase 至 daeuniverse/honk main，因此這些建置納入 main 的 VLESS Vision 上行 padding 與 splice 交接（honk#304），並在比對 DNS upstream 名稱時去除引號（honk#305）。honk-source-25377686eabe66005dccb4dd1b8ad795c5609072.tar.gz 為該提交的原始碼，HONK-SOURCE.txt 註明該提交。請以 SHA256SUMS 驗證下載的檔案，其中列出除自身以外的全部發布附件。安裝 honk 說明如何依閘道選擇建置。可使用範例資料體驗示範版：https://demo.daeuniverse.org/ 安裝指南位於 https://zakkaus.github.io/doona-docs/zh-TW/。

Embedded doona

The attached honk-core builds embed doona 0.1.0-beta.12, so a gateway needs no separate doona package. Set ui: embedded in native_api and restart honk:

experimental {
    native_api {
        enabled: true
        listen: '192.168.1.1:9527'   # the gateway's LAN address
        password_auth: true
        config_write: true
        ui: embedded
    }
}

Then open http://192.168.1.1:9527/ui/. The embedded copy follows the honk build, so a newer doona release reaches it only with a newer honk build. It leaves out the Noto Sans TC and SC fonts, and the browser uses system fonts instead. To keep those fonts, or to run a newer doona than the one embedded, install the doona and doona-fonts packages and set ui: '/usr/share/doona'.

內嵌 doona

本版附帶的 honk-core 建置已內嵌 doona 0.1.0-beta.12，閘道不必另外安裝 doona 套件。在 native_api 設定 ui: embedded 後重新啟動 honk：

experimental {
    native_api {
        enabled: true
        listen: '192.168.1.1:9527'   # 閘道的區域網路位址
        password_auth: true
        config_write: true
        ui: embedded
    }
}

接著開啟 http://192.168.1.1:9527/ui/。內嵌的 doona 版本隨 honk 建置固定，較新的 doona 須等較新的 honk 建置才會內嵌。內嵌版不含 Noto Sans TC 與 SC 字型，瀏覽器會改用系統字型。若要使用這些字型，或要執行比內嵌版更新的 doona，請安裝 doona 與 doona-fonts 套件，並設定 ui: '/usr/share/doona'。

Highlights

• Latencies are coloured by speed again: green below 100 ms, yellow below 300 ms, and red from 300 ms or when the node did not answer. (#231)
• On a phone, the About dialog shows the doona version. (#228)
• The attached honk builds are rebased on daeuniverse/honk main and embed this doona release. (honk#304, honk#305)

重點

• 延遲再次依速度著色：低於 100 毫秒為綠色，低於 300 毫秒為黃色，300 毫秒以上或節點未回應時為紅色。（#231）
• 在手機上，「關於」對話框會顯示 doona 版本。（#228）
• 附帶的 honk 建置已 rebase 至 daeuniverse/honk main，並內嵌本版 doona。（honk#304、honk#305）

Changed

• Latencies are coloured by speed again: green below 100 ms, yellow below 300 ms, and red from 300 ms or when the node did not answer. This applies to the nodes table and chart, the node menu, the Activity latency tile and the Policies member grid. (#231)
• The release attaches honk-core debug builds rebased on daeuniverse/honk main. They add main's VLESS Vision uplink padding and splice handover (honk#304), compare DNS upstream names without their quotes (honk#305), and embed doona 0.1.0-beta.12.

Fixed

• On a phone, the About dialog shows the doona version; only the top bar leaves it out for lack of room. (#228)

v0.1.0-beta.11

Pre-release. This release attaches the eight honk-core builds of the honk debug pre-release (x86_64 and aarch64, glibc and musl, mimalloc or the system allocator), built from commit 757ec962b9865e646edc26b57cbbb4fd0a3b4b29 (debug.2026.9.30.native-api.4). They open the state database written by the builds attached to 0.1.0-beta.9, which the builds attached to 0.1.0-beta.10 refused with state database has a foreign application id or a newer schema (Glassyiris/honk#85). honk-source-757ec962b9865e646edc26b57cbbb4fd0a3b4b29.tar.gz holds that commit's source and HONK-SOURCE.txt names it. Verify downloads against SHA256SUMS, which lists every release asset except itself. Install honk explains which build fits a gateway. Try the demo with sample data: https://demo.daeuniverse.org/ The setup guide is at https://zakkaus.github.io/doona-docs/en/.

預發布版本。本版本附帶 honk debug 預發布版本的八個 honk-core 建置（x86_64 與 aarch64、glibc 與 musl、mimalloc 或系統配置器），來源提交為 757ec962b9865e646edc26b57cbbb4fd0a3b4b29（debug.2026.9.30.native-api.4）。0.1.0-beta.10 附帶的建置會以 state database has a foreign application id or a newer schema 拒絕開啟 0.1.0-beta.9 附帶建置所寫入的狀態資料庫，這些建置已修正此問題（Glassyiris/honk#85）。honk-source-757ec962b9865e646edc26b57cbbb4fd0a3b4b29.tar.gz 為該提交的原始碼，HONK-SOURCE.txt 註明該提交。請以 SHA256SUMS 驗證下載的檔案，其中列出除自身以外的全部發布附件。安裝 honk 說明如何依閘道選擇建置。可使用範例資料體驗示範版：https://demo.daeuniverse.org/ 安裝指南位於 https://zakkaus.github.io/doona-docs/zh-TW/。

Embedded doona

The attached honk-core builds embed doona 0.1.0-beta.11, so a gateway needs no separate doona package. Set ui: embedded in native_api and restart honk:

experimental {
    native_api {
        enabled: true
        listen: '192.168.1.1:9527'   # the gateway's LAN address
        password_auth: true
        config_write: true
        ui: embedded
    }
}

Then open http://192.168.1.1:9527/ui/. The embedded copy follows the honk build, so a newer doona release reaches it only with a newer honk build. It leaves out the Noto Sans TC and SC fonts, and the browser uses system fonts instead. To keep those fonts, or to run a newer doona than the one embedded, install the doona and doona-fonts packages and set ui: '/usr/share/doona' as before.

內嵌 doona

本版附帶的 honk-core 建置已內嵌 doona 0.1.0-beta.11，閘道不必另外安裝 doona 套件。在 native_api 設定 ui: embedded 後重新啟動 honk：

experimental {
    native_api {
        enabled: true
        listen: '192.168.1.1:9527'   # 閘道的區域網路位址
        password_auth: true
        config_write: true
        ui: embedded
    }
}

接著開啟 http://192.168.1.1:9527/ui/。內嵌的 doona 版本隨 honk 建置固定，較新的 doona 須等較新的 honk 建置才會內嵌。內嵌版不含 Noto Sans TC 與 SC 字型，瀏覽器會改用系統字型。若要使用這些字型，或要執行比內嵌版更新的 doona，請照舊安裝 doona 與 doona-fonts 套件，並設定 ui: '/usr/share/doona'。

Highlights

• honk now starts with a state database written by the builds attached to 0.1.0-beta.9. (Glassyiris/honk#85)
• The attached honk-core builds embed doona; ui: embedded serves it without a separate doona package. (Glassyiris/honk#84)
• Name lists sort by the interface language. (#226)
• The release packages install the licence files NOTICE cites and third-party notices for the production dependencies. (#224)

重點

• honk 可開啟 0.1.0-beta.9 附帶建置所寫入的狀態資料庫。（Glassyiris/honk#85）
• 附帶的 honk-core 建置內嵌 doona；設定 ui: embedded 即可使用，不必另外安裝 doona 套件。（Glassyiris/honk#84）
• 名稱清單依介面語言排序。（#226）
• 發布套件會安裝 NOTICE 引用的授權檔案，以及正式環境相依套件的第三方聲明。（#224）

Changed

• Name lists sort by the interface language: pinyin in Simplified Chinese, stroke order in Traditional Chinese, and Latin names before Chinese ones in English. (#226)
• Events of a kind this version does not know appear on the Events page with their raw kind and the resource they name. (#225)

Fixed

• The release attaches honk-core debug builds that start with a state database written by the builds attached to 0.1.0-beta.9, which the builds attached to 0.1.0-beta.10 refused (Glassyiris/honk#85).
• The new-version notice appears only when the service worker holds a different build from the open page, and a notice left by an earlier build is dropped. (#223)
• The open-at label names the configuration source it opens. (#223)
• The release packages install every licence file that NOTICE cites and a THIRD-PARTY-NOTICES.txt for the production dependencies, and the package metadata declares the image licences. (#224)

v0.1.0-beta.10

Pre-release. This release attaches the eight honk-core builds of the honk debug pre-release (x86_64 and aarch64, glibc and musl, mimalloc or the system allocator), built from commit e2dc7c0b1fbbb09f914987ab546ed76e1c6be168 (debug.2026.9.30.native-api.3). They implement the final native API contract from honk#77, which this doona release requires; older honk builds are not compatible. honk-source-e2dc7c0b1fbbb09f914987ab546ed76e1c6be168.tar.gz holds that commit's source and HONK-SOURCE.txt names it. Verify downloads against SHA256SUMS, which lists every release asset except itself. Install honk explains which build fits a gateway. Try the demo with sample data: https://demo.daeuniverse.org/ The setup guide is at https://zakkaus.github.io/doona-docs/en/.

預發布版本。本版本附帶 honk debug 預發布版本的八個 honk-core 建置（x86_64 與 aarch64、glibc 與 musl、mimalloc 或系統配置器），來源提交為 e2dc7c0b1fbbb09f914987ab546ed76e1c6be168（debug.2026.9.30.native-api.3）。這些建置實作 honk#77 合併的最終原生 API 契約；本版 doona 需要此契約，不相容於舊版 honk 建置。honk-source-e2dc7c0b1fbbb09f914987ab546ed76e1c6be168.tar.gz 為該提交的原始碼，HONK-SOURCE.txt 註明該提交。請以 SHA256SUMS 驗證下載的檔案，其中列出除自身以外的全部發布附件。安裝 honk 說明如何依閘道選擇建置。可使用範例資料體驗示範版：https://demo.daeuniverse.org/ 安裝指南位於 https://zakkaus.github.io/doona-docs/zh-TW/。

Highlights

• This release requires honk's final native API contract. Sign-in to an older honk build shows an update message. (#178)
• The navigation separates monitoring, rule editing and configuration. Summaries and records link to the pages, filters and settings they name. (#166, #171, #173, #176)
• Connections, flows, trace results and DNS records can open an add-rule dialog for their target. DNS request and response rules can be added from the same dialog. (#172, #175)
• An added subscription's name and URL can be edited in its declaring source. A rename can update exact subtag(...) filters in the same file; references elsewhere or in filter expressions block it. (#179)
• Node latency tests use an HTTP request through the node to honk's configured check URL, so UDP-based nodes such as Hysteria2 and TUIC can be measured. Healthy results use normal text, results of at least 600 ms are yellow, and unavailable nodes are red. (#208)
• Search finds nodes across sources, DNS rules, and page tabs. The editor exposes Find, Go to line and editing commands without requiring a shortcut. (#169, #176, #195)
• Held rules have their own Apply action, separate from Reload honk. The China palette uses Day shift and Night shift, and the keyboard shortcut dialog shows navigation sequences as separate keys. (#189, #202, #203, #207)

重點

• 本版需要 honk 的最終原生 API 契約。登入舊版 honk 建置時會顯示更新提示。（#178）
• 導覽將觀測、規則編輯與組態分開。摘要和記錄可連至對應頁面、篩選條件與設定。（#166、#171、#173、#176）
• 連線、流程、追蹤結果及 DNS 記錄可依目標開啟新增規則對話框；同一對話框也能新增 DNS 請求規則與回答規則。（#172、#175）
• 可在宣告訂閱的來源檔案中修改新增訂閱的名稱與網址；重新命名時可一併更新同檔案中直接使用 subtag(...) 的篩選條件；其他檔案或篩選運算式仍參照舊名稱時會禁止重新命名。（#179）
• 節點延遲測試會透過節點向 honk 設定的檢測網址發出 HTTP 請求，因此可測量 Hysteria2、TUIC 等使用 UDP 的節點。正常延遲使用一般文字顏色，達 600 毫秒顯示黃色，節點不可用才顯示紅色。（#208）
• 搜尋可跨來源尋找節點，也能找到 DNS 規則與頁面分頁。編輯器提供可直接點選的尋找、前往行與編輯指令。（#169、#176、#195）
• 暫存規則有獨立的套用操作，不再與「重載 honk」合併。中國配色改稱白班與夜班；鍵盤快捷鍵對話框將導覽鍵序列分開顯示。（#189、#202、#203、#207）

Added

• A connection, flow record or trace result opens the shared add-rule dialog with its domain, destination or source address. The dialog offers exact domains before subdomains, names a duplicate rule without blocking it, and offers Copy rule after a target is chosen when no writable configuration can take it. After a rule takes effect, View rule opens it in the list. (#172, #210)
• The DNS resolution log, query results and cache can start a DNS request or response rule. The dialog offers the relevant name, answer address, client and record type, and can create a missing request or response rule block. Held DNS rules can be reviewed and applied from their lists. After a DNS rule is written from Query, Query again repeats the query for its original name when the backend offers DNS queries. (#165, #175, #209)
• The Nodes table searches every source while a search is entered and shows a Source column for the matches. Clearing the search returns to the selected source. (#176)
• Search includes the Connections, Nodes and Policies tabs, DNS rules by condition and target, and page tabs in its empty-result guidance. (#195)
• When a subscription has one identifiable declaration, its More actions menu offers an edit action if that source is writable, including an include file under a read-only main source; otherwise it offers Open source. Editing changes its name or URL while keeping the other options and comments. A duplicate subscription name opens the source instead. A name clash, a subtag(...) reference in another file, or a filter expression naming the old tag blocks a rename; exact subtag(...) filters in the same file can be updated with it. After a conflicting save, the next attempt uses the current source revision. (#179)
• A connection detail can start a routing trace with its source port and process. Trace results link to the rules, groups, nodes and names they show; a rule link opens the list only when the result and list belong to the same routing generation. (#174, #210)
• The editor toolbar offers Find, Go to line and an Editing commands menu for undo, redo and comment toggling. Find and Go to line also work in a read-only source. (#169)
• Policies offers the Score policy when choosing a group's selection policy. (#201)
• Activity shows process CPU usage in place of the memory stat card; its value opens System status. Rate tiles open Connections on the traffic tab, and the active-connections tile opens the list. (#173, #186, #194)
• Activity rankings, outbound usage and node latency link to filtered Connections or the corresponding node. DNS statistics, resolution records and rule lists link to the related DNS view or configuration section. Events, logs and flow records link to the flow, configuration or recording settings they name. (#171, #173)
• Settings > About opens the keyboard shortcut dialog and the guide. Routing rule rows can open their outbound settings, Nodes can refresh all subscriptions, and the DNS resolution log offers Load older records below its list on a phone. The Nodes table names the selected source, and Activity's latency menu explains that choosing a node changes only the displayed latency, not routing. (#170)
• A saved quick setup offers links to Nodes, Policies, Routing rules and the file it wrote. A group change offers View group, and a new subscription offers View nodes with that subscription selected. (#173, #187)

Changed

• The release attaches honk-core builds of honk e2dc7c0b (debug.2026.9.30.native-api.3), which implement the final native API contract and include honk's fix for a domain() condition that mixes geosite: with ordinary entries (honk#303). (#178)
• Monitor contains Activity, System status and the new Routing log page for the routing map and flow records. Rules keeps routing rules, DNS rules and trace simulation; Configuration opens first in its hub. Old links to the map and flow records lead to their new page. Connections opens on Traffic. On phones, the hub strip keeps the current page visible, and Back returns through visited pages. (#166, #176, #180)
• The top bar shows Apply only while rules are held; it writes those rules. Reload honk is a separate confirmed action and leaves held rules in place. Rule writes and configuration edits use Apply, and success messages say when a rule is in effect. Held rules remain when an activation reports that nothing was written. (#178, #187, #189)
• The add-rule dialog shows the current outbound or DNS upstream beneath an initially empty target field instead of choosing that target for the new rule. It warns when a routing rule would keep the current outbound and explains where the rule will be inserted. (#199)
• Connection detail actions, subscription removal and policy group commands move into More actions menus, leaving one primary action on each panel. (#198)
• A tile with a linked value can be opened from anywhere on the card. (#192)
• The China palette's light and dark modes are named Day shift and Night shift. The keyboard shortcut dialog groups commands into sections and shows page shortcuts as G followed by a letter in separate keycaps. (#202, #203, #207)
• The interface calls the configuration revision Config version, the global mode's target Global mode outbound, and the documentation link Guide. generation remains a technical field. (#190)
• Overview is named System status, the Policies page's Arrange tab is named Group membership, and configuration module shortcuts say Open source file. (#176)
• A trace run in query mode shows the DNS query answer separately from the simulations for its returned addresses, with query time and simulation time shown apart. (#165)
• The final API contract governs sign-in, paging, group edits, DNS queries, operation results and errors; an older honk build shows an update message at sign-in. An expired page restarts at the contracted limit. Node and subscription writes wait for asynchronous operations to finish, and a node write conflict keeps the backend's own message when it identifies the cause. Activation notices distinguish a failed, degraded or unconfirmed outcome. (#178)
• Policies waits for initially visible group cards to load their details and nodes before showing them; a card scrolled out of view does not hold the page open. An unset tolerance is labelled as the engine default in the check settings dial...

v0.1.0-beta.9

Pre-release. This release attaches the eight honk-core builds of the honk debug pre-release (x86_64 and aarch64, glibc and musl, mimalloc or the system allocator), built from commit 3ff52762dd1a1612790a1aa170c3c17696c7b739 (debug.2026.9.28.native-api.4). They provide the native API doona needs, including the DNS rules, runtime degradations and the geodata checksum switch used by this release, so honk does not have to be compiled. honk-source-3ff52762dd1a1612790a1aa170c3c17696c7b739.tar.gz holds that commit's source and HONK-SOURCE.txt names it. Verify downloads against SHA256SUMS, which lists every release asset except itself. Install honk explains which build fits a gateway. Try the demo with sample data: https://demo.daeuniverse.org/ The setup guide is at https://zakkaus.github.io/doona-docs/en/.

預發布版本。本版本附帶 honk debug 預發布版本的八個 honk-core 建置（x86_64 與 aarch64、glibc 與 musl、mimalloc 或系統配置器），來源提交為 3ff52762dd1a1612790a1aa170c3c17696c7b739（debug.2026.9.28.native-api.4）。這些建置提供 doona 所需的原生 API，包括本版本使用的 DNS 規則、執行期降級與地理資料 SHA-256 驗證開關，不需自行編譯 honk。honk-source-3ff52762dd1a1612790a1aa170c3c17696c7b739.tar.gz 為該提交的原始碼，HONK-SOURCE.txt 註明該提交。請以 SHA256SUMS 驗證下載的檔案，其中列出除自身以外的全部發布附件。安裝 honk 說明如何依閘道選擇建置。可使用範例資料體驗示範版：https://demo.daeuniverse.org/ 安裝指南位於 https://zakkaus.github.io/doona-docs/zh-TW/。

Highlights

• Rules has a DNS rules tab that edits the request and response rules in place. A DNS log record opens a new rule for its domain, and a connection can change the outbound of the rule it matched.
• Policies edits a group's tolerance and idle timeout, and a conflicting save keeps the user's edits.
• Overview shows the features honk keeps running reduced after a recovered failure.
• Geodata updates can turn SHA-256 verification off for a trusted mirror whose checksum URL returns an error page or a status other than 404, and known download failures say what went wrong.
• Connections and Rules show flows on a stock honk without turning flow recording on.
• A new China palette, and the palette menu on the sign-in page.

重點

• 規則頁新增 DNS 規則分頁，可直接編輯請求規則與回答規則。DNS 解析記錄可為其網域新增規則，連線可修改其命中規則的出站。
• 策略頁可編輯群組的容忍差值與閒置逾時；儲存發生衝突時保留使用者的修改。
• 概覽頁顯示 honk 在故障恢復後以降級方式繼續執行的功能。
• 可信鏡像站的 .sha256sum 網址回傳錯誤頁面或非 404 錯誤時，可關閉地理資料的 SHA-256 驗證；已辨識的下載失敗會說明原因。
• 在未修改設定的 honk 上，連線頁與規則頁不需開啟流程記錄即可顯示流程。
• 新增中國配色，登入頁提供配色選單。

Added

• Rules has a DNS rules tab beside the routing rules. It lists the request and response rules the backend returns from GET /dns/rules and adds, edits and removes them in the source that declares them, as the routing rules do. A DNS upstream is written with its quotes exactly as declared. The tab appears when the backend lists DNS rules. (#148, #151)
• The connection detail can edit the matched rule's outbound: the rule's dialog opens on Rules and changes only the target, keeping the condition and any comment. The action appears only when the rule is found in a writable source. (#150, #158)
• A DNS resolution record opens a new DNS request rule for its domain, prefilled with a suffix condition that also matches subdomains. The link appears when the backend lists DNS rules and the configuration is writable. (#150, #158)
• The China palette. Clock-in (light) is rice paper with a flag-red banner and All-nighter (dark) a red and gold poster. A red sky with the five stars and Tiananmen Square runs across the top of the page, and cards take turns with faint drawings of the Great Wall, Mount Tai's South Gate of Heaven, Kuimen and Sun Moon Lake. In this palette a healthy or running state reads Improving and an unavailable or degraded one Severe test. NOTICE and REUSE.toml credit the Openclipart and Wikimedia Commons sources. (#143, #155, #156, #158)
• The sign-in page offers the palette menu between the language menu and the theme toggle. (#139)
• The geodata card has a Verify checksum switch when the backend reports one, for mirrors that answer a missing .sha256sum file with an error page. The two checksum failures point to it; a mismatch says the file may be damaged or altered and that verification should be turned off only when a trusted mirror's .sha256sum file is known to be wrong. (#144, #158)
• The check settings dialog on Policies edits a group's tolerance and idle timeout when the group lists them as changeable. (#147)
• The connection detail shows where the chain came from: recorded during routing or reconstructed from retained records. (#147)
• Overview shows runtime degradations, the features honk keeps running reduced after a recovered failure, as warnings on the Datapath card. They show even when the datapath cannot be read. (#152, #158)

Changed

• The first navigation hub is named Activity and lists Activity before Overview, so it opens on its first tab. (#140)
• Rules lists its tabs as Routing rules, DNS rules, Routing map, Flow records and Trace simulation, and opens on Routing rules; a link to the map still opens the map. DNS lists Statistics, Resolution log, Cache and Query, and Settings shows Appearance before Backend actions. (#148, #149)
• Automatic flow recording is labelled On flow demand, and a note says that any client's flow requests start it and that it continues for 60 seconds after they end. (#136, #158)
• Without the state database, the backend actions card says that honk takes the geodata URLs from geosite_download_url and geoip_download_url in experimental.native_api and does not update on a schedule, and links the documentation and Configuration. Known geodata download failure stages have their own message; an unknown stage shows its code. (#142)
• Overview shows No limit when the cgroup sets no memory limit, leaves out the cgroup scope when it is unknown and eBPF kernel memory when it is not reported, and hides partial eBPF hook visibility. A map whose occupancy is not read shows only its capacity. (#153)

Fixed

• On a stock honk, Connections and Rules showed no flows unless flow recording was set to On. They now request flows while open. (#136)
• Pages no longer miss a change made while they open, such as another client's configuration or rule edit: they read their data once the event stream is ready. Behind a proxy that holds the stream back, pages still load after five seconds, and the configuration and rules refresh every 30 seconds while the stream stays silent. (#160)
• Connections and Rules request flows on the shared event stream instead of opening a second one, so they no longer count twice against the backend's client limit and also work on backends that send flow updates without flow gaps. (#160)
• Pages with tabs no longer move by a tab's height after the first frame, and the Connections table no longer resizes itself after opening. (#141)
• When another client changed a group's check settings, every save from the open dialog was refused as a conflict. The dialog now reads the group again, keeps the fields the user edited, shows the values the group took, and the next save checks for conflicts against them. (#145, #158)
• Policies no longer offers group switching or check settings when the backend turns them off for all groups, where every save failed. (#157)
• After a rate-limited sign-in, the button stays disabled and counts down the wait instead of meeting another refusal, and the note above the form clears when the wait ends. (#157, #162)
• The rule lists link each rule to its line on a read-only backend too. The DNS rules tab no longer breaks Rules on an older backend, and a DNS list without a written fallback takes new rules inside its block. upstream() in DNS rules is highlighted as a call. (#148, #158)
• In the Glass palette, quiet negative buttons such as Close all are filled with Apple's increased-contrast red, and red text uses that red, so both meet contrast on the translucent surfaces. A quiet button pressed by keyboard or touch shows its pressed fill. (#154)
• The demo answers as the API contract describes: required fields are present, elapsed times are whole milliseconds, lists page 100 rows by default and at most 1000, discovery serves its public view before sign-in, and features a profile turns off are refused. (#159)

For contributors

• Each language's strings are in one JSON catalogue, src/i18n/locales/<id>.json, and src/i18n/languages.ts lists the languages once. A language can be partial and fall back to English. check:i18n checks every catalogue against en.json, including each plural form's placeholders and repeated keys, and --missing <id> lists what a language lacks. CONTRIBUTING describes how to add a language. (#137, #158)
• Each palette family has its own stylesheet, a palette can reword a few statuses, and CONTRIBUTING describes how to add a palette. (#138, #143)
• pnpm check validates the demo backend in each profile against the bundled OpenAPI contract, and check:gen fails when the vendored contract no longer matches the SHA-256 pinned in SOURCE.md. (#159)
• The API contract is pinned at api-standardize aa7103a. (#144, #152)

新增

• 規則頁在路由規則旁新增 DNS 規則分頁。分頁列出後端由 GET /dns/rules 回傳的請求規則與回答規則，並與路由規則相同，在宣告規則的來源檔案中新增、編輯與刪除規則。DNS 上游名稱依宣告時的引號原樣寫入。後端列出 DNS 規則時才顯示此分頁。（#148、#151）
• 連線詳情可修改命中規則的出站：規則頁開啟該規則的對話框，只修改目標，保留條件與註解。只有在可寫入的來源檔案中找到該規則時，才提供此操作。（#150、#158）
• DNS 解析記錄可為其網域新增 DNS 請求規則，並預先填入同時比對子網域的後綴條件。後端列出 DNS 規則且組態可寫入時才顯示此連結。（#150、#158）
• 新增中國配色。淺色的打卡版以米白紙張為底並配國旗紅橫幅，深色的通宵版為紅金海報。頁面頂端橫貫一道紅色天空，起首為五星，末端為天安門廣場；卡片輪流襯以長城、泰山南天門、三峽夔門與日月潭的淡色線稿。此配色將正常與執行中狀態稱為「穩中向好」，將不可用與降級狀態稱為「嚴峻挑戰」。NOTICE 與 REUSE.toml 註明 Openclipart 與 Wikimedia Commons 的來源。（#143、#155、#156、#158）
• 登入頁在語言選單與主題切換之間提供配色選單。（...

v0.1.0-beta.8

Pre-release. This release attaches the eight honk-core builds of the honk debug pre-release (x86_64 and aarch64, glibc and musl, mimalloc or the system allocator), built from commit 7449f4e289ef024bf18d79d9c4d1bedb70f5bb2a. They provide the native API doona needs, so honk does not have to be compiled. honk-source-7449f4e289ef024bf18d79d9c4d1bedb70f5bb2a.tar.gz holds that commit's source and HONK-SOURCE.txt names it. Verify downloads against SHA256SUMS, which lists every release asset except itself. Install honk explains which build fits a gateway. Try the demo with sample data: https://demo.daeuniverse.org/ The setup guide is at https://zakkaus.github.io/doona-docs/en/.

预发布版本。本版本附带 honk debug 预发布版本的八个 honk-core 构建（x86_64 与 aarch64、glibc 与 musl、mimalloc 或系统分配器），源码提交为 7449f4e289ef024bf18d79d9c4d1bedb70f5bb2a。这些构建提供 doona 所需的原生 API，无需自行编译 honk。honk-source-7449f4e289ef024bf18d79d9c4d1bedb70f5bb2a.tar.gz 为该提交的源码，HONK-SOURCE.txt 注明该提交。请用 SHA256SUMS 校验下载文件，其中列出除自身以外的全部发布附件。安装 honk 说明如何按网关选择构建。使用示例数据体验演示版：https://demo.daeuniverse.org/ 安装指南位于 https://zakkaus.github.io/doona-docs/zh-CN/。

Highlights

• Sign-in is a full page with its own language menu and theme toggle. The public demo opens on it with the demo account filled in.
• The setup guide moves out of the app into a separate documentation site, maintained in Zakkaus/doona-docs.
• Help buttons explain unclear states and terms. Overview groups the features that are off by cause and, where it can, says how to turn them on.
• Configuration edits writable sources in place and names the reason a source is read-only.
• Requests time out instead of loading forever, and reused error codes keep the backend's own message.
• Disabled actions show their reason beside the buttons. Below 600 pixels wide, tables keep every column and scroll sideways.
• The demo behaves as a healthy honk; ?scenario=faults shows the error states.

重点

• 登录改为独立页面，页内提供语言与主题切换。公开演示版打开即为登录页，并已填好 demo 账号。
• 安装指南移出应用，改为独立的文档站点，由 Zakkaus/doona-docs 仓库维护。
• 帮助按钮解释不易理解的状态与术语。概览页按原因归类未开启的功能，并在可行时说明开启方法。
• 配置页可直接编辑可写的来源文件，并注明来源文件只读的原因。
• 请求超时后报错，不再无限加载；共用的错误码保留后端返回的原始信息。
• 禁用的操作在按钮旁显示原因。宽度小于 600 像素时，表格保留全部列并可横向滚动。
• 演示版默认呈现正常运行的 honk；使用 ?scenario=faults 可查看错误状态。

Added

• Each release attaches the eight honk-core builds of honk's debug pre-release, so honk does not have to be compiled: x86_64 and aarch64, glibc and musl, each with mimalloc or the system allocator. honk-source-<commit>.tar.gz holds the source of the honk commit they were built from and HONK-SOURCE.txt names that commit; SHA256SUMS lists every release asset except itself. The builds are attached until honk publishes a release with the native API. (#109, #117)
• Sign-in is a full page instead of a dialog over an empty window, with its own language menu and theme toggle. From 1024 pixels wide, a panel beside the form shows a construction scene that becomes a small Flappy Duck game when pressed. The form keeps working if the scene fails to load, and the scene is a still picture when reduced motion is requested. (#107, #114, #115)
• The public demo opens on the sign-in page with its account filled in: user name demo, password demo. (#107)
• The setup guide is a separate documentation site in English, Simplified Chinese and Traditional Chinese, maintained in Zakkaus/doona-docs. Sign-in and Settings > About link to it; the sign-in hint for a backend without the native API and the read-only outbound mode help open its troubleshooting sections. (#100)
• The documentation site has step-by-step installation pages for Debian or Ubuntu, Fedora or RHEL, Arch Linux, Gentoo, OpenWrt and other systems, and follows the layout of the React Spectrum docs. Its search ranks titles first and works from the keyboard, the 404 page is in the reader's language, and Chinese pages use the Spectrum CJK type scale. Colours are correct in Safari 17.0 to 17.4, and links into doona's source work when the pages are read on GitHub. The pages are shared under CC BY 4.0, and the header links to the demo. (Zakkaus/doona-docs#1, #2, #3, #6, #11, #13, #14)
• Help buttons explain unclear states and terms on Overview, Connections, Configuration, Rules, Policies, DNS, Events, Logs and Settings. (#98)
• Overview lists the features that are off in a full-width card, one row per cause. Where one applies, a row explains the cause, gives the configuration lines that turn the feature on, or links to the documentation or Settings. The rule list, validation and closing connections are listed when the backend lacks them. The count on Activity links to the card. (#102)
• A disabled action says why in a line beside its buttons, visible at every width, where before the reason was only in a tooltip that touch does not open, or missing. This covers Configuration, Activity, Policies, Rules, DNS, Nodes and Settings, and the dialogs for new rules, subscriptions and nodes. Screen readers read the line as the button's description. (#97, #127, #130, #133)
• Connections can collapse and expand each group, or all groups at once, while the list is grouped. (#93)
• On Events and Logs, pressing a row, or Enter or Space on it, shows its full text below the table, so text cut on a phone can be read; pressing the row again hides it. (#105)
• The demo shows its error states when opened with ?scenario=faults; ?scenario= returns to the healthy demo. (#103)

Changed

• The demo behaves as a healthy honk: it seeds no failures, and switching the outbound mode works. (#103)
• The Overview header and the Activity status add a degraded or failed datapath to the engine state, in the matching tone. The Overview header links to the Datapath card. (#102)
• Backend features on Overview lists only the features that are on. (#102)
• Configuration shows each source's path once. A read-only source has one badge naming the reason (generated, subscription, read-only, contains secrets, redacted or text not returned) and no Validate button; when configuration writes are off, help beside the badge says how to turn them on. Every source with text has one line saying what it is and what can be done with it, and all source editors start at the same height. (#101)
• A writable source is edited in place, without an Edit button. Typing, pasting or tapping in a read-only source shows one notice with the reason. (#101)
• When a save finds that the file changed on disk, the source card, the modules and the quick setup show an alert and wait until the draft is kept over the change or discarded; previously, the draft was applied to the changed file without warning. A module draft carries over on its own when the change is outside its section. (#118)
• Read-only code editors show no caret or current-line highlight; the line a source was opened at keeps a marker. (#97)
• The must switch in the new-rule dialog reads Lock this outbound, with a line explaining what a locked outbound skips. (#91)
• The outbound mode card and the Arrange review label their button Apply and reload, as Configuration does, since all three write the configuration and reload it. (#126)
• Below 600 pixels wide, tables keep every column at its minimum width and scroll sideways, instead of dropping columns until the rest fit. Wider screens drop columns as before. (#128)
• On Policies, a large node group lays out its tiles like a small group: the same columns, tile width and edges, with room left for the scrollbar. (#125)
• The busiest-host tile on Connections takes two shares of its row. A host that still does not fit keeps its end visible and shows the full name on hover, focus or tap. (#99)
• When a subscription refresh leaves the datapath degraded, the notice says that new connections proxied through userspace are refused and points to Overview. (#98)
• The Chinese token sign-in heading and missing-token message use formal wording. (#107)
• README screenshots are rendered by the documentation site on each deploy and are no longer stored in the repository. (Zakkaus/doona-docs#6)
• NOTICE, REUSE.toml, the READMEs and the OFL.txt shipped with the fonts name Adobe as the copyright holder of Noto Sans TC and SC. The documentation site credits Adobe for the Spectrum icons, fonts and design. (#122, Zakkaus/doona-docs#12)

Fixed

• Errors with the reused codes invalid_request, unsupported_value and state_conflict keep the backend's own message beside the summary. (#94)
• A backend that never answers no longer leaves a page loading. API reads fail when the headers, or the next part of the body, take more than 15 seconds to arrive, and writes when they take more than 30; the event and log streams keep their own limit. Sign-in and sign-out time out the same way. After a read timeout, Retry fetches the data again. A write timeout says the change may have been applied and asks for a reload before trying again. (#104, #118)
• Apply and reload is disabled when a refetch makes the open source read-only. Undo after Cancel no longer restores the discarded edits. (#101, #106)
• The must switch in the new-rule dialog aligns with the outbound picker. (#90)
• A connection opened by its link unfolds its collapsed group, and so does a selected connection that moves into another folded group. Outbound groups no longer unfold when the language changes, and an outbound named like a built-in label keeps its own group. (#93, #118)
• When an ordinary rule precedes the must rules in the routing block, doona's refusal to switch the outbound mode says to move the must rules to the top and names the rule. (#103)
• Trace field errors wait until a field is f...

v0.1.0-beta.7

Pre-release. doona needs a honk build with the native API, which today is the feat/native-api branch of Glassyiris/honk; see the README. Verify downloads against SHA256SUMS. Try the demo with sample data: https://demo.daeuniverse.org/

预发布版本。doona 需要提供原生 API 的 honk 构建；目前可使用 Glassyiris/honk 的 feat/native-api 分支，详见 README。请用 SHA256SUMS 校验下载文件。使用示例数据体验演示版：https://demo.daeuniverse.org/

Highlights

• Notifications separate summaries from error details, offer Retry or Reload when available, and support four positions.
• Overview shows process CPU usage; Connections shows per-connection transfer rates.
• Policies can edit a group's health-check URL, and Configuration can create source files.
• Configuration completion and quick setup preserve quoted group names.
• Source conflict recovery, event stream retries and login state handling are fixed.
• README screenshots are refreshed in all three languages.

重点

• 通知区分摘要与错误详情，在适用时提供“重试”或“重新加载”，并支持四种显示位置。
• 概览页显示进程 CPU 使用率；连接页显示每条连接的传输速率。
• 策略页可编辑群组的健康检查网址，配置页可新建来源文件。
• 配置编辑器的补全和快速设置保留群组名称原有的引号。
• 修复来源文件的冲突恢复、事件流重试和登录状态处理。
• 更新三种语言 README 中的截图。

Added

• Overview shows the backend process's CPU usage.
• Connections shows each connection's upload and download rates, calculated from successive samples.
• Policies lets you edit a group's health-check URL.
• Configuration can create a new source file when the backend supports it.
• A failed first fetch of a new subscription offers Retry in its toast; a new build offers Reload. Toasts with actions remain until dismissed or used.
• Settings lets you place notifications at the top or bottom, centred or aligned to the end.

Changed

• Toasts keep their status colours and separate the summary from backend details. Show all and action buttons share a footer on desktop and phones; request IDs stay in the console instead of the toast.
• Desktop tabs are 34 pixels tall, name lists use consistent sorting, and equally sized connection filter groups keep a stable order.
• Configuration shows module sections from read-only includes and groups repeated diagnostics.
• README screenshots reflect the current desktop and phone layouts in all three languages.

Fixed

• Configuration completion reads groups from every source and preserves each group header's original quotes. Quick setup preserves the same names in generated routing rules.
• After a conflicting source save, the editor keeps the draft and uses the refreshed source as its next save's base. Reloading clears validation results from the previous generation.
• Activity finds the outbound mode line by its marker rather than its position in the file.
• DNS rejects an invalid device address without dropping the last valid filter. Closing one connection no longer clears another connection opened while the request was pending.
• The routing map waits for its nodes before settling. Connection rates discard baselines from lists no longer held by the store.
• Retrying a refused event stream reconnects it, recovered capability errors clear, and a refused first-page request is not repeated without a cursor.
• Settings can sign in again after signing out, distinguishes a rejected token from a connection failure, and reports unavailable session storage as a storage error.
• Geodata preset changes ask for confirmation when they lack categories used by the configuration. Operation errors identify the failed stage when the backend provides it.
• Paused logs show the held record count. Gap summaries omit a zero dropped count, and Activity notice summaries align in one column.
• Long backend versions end with an ellipsis; available backend capabilities use a status dot.
• A pending keyboard navigation prefix clears when the filter shortcut has no field to focus, and near-viewport content keeps its observer across callback changes.

新增

• 概览页显示后端进程的 CPU 使用率。
• 连接页根据连续采样计算每条连接的上传和下载速率。
• 策略页可编辑群组的健康检查网址。
• 后端支持时，配置页可新建来源文件。
• 新增订阅首次拉取失败时，通知提供“重试”；检测到新构建时提供“重新加载”。带操作按钮的通知会保留，直到关闭或执行操作。
• 设置页可将通知放在顶部或底部，并选择居中或末端对齐。

变更

• 通知保留状态色，将摘要与后端详情分开显示。桌面和手机均将“显示全部”与操作按钮放在底部一行；请求 ID 保留在控制台，不再显示于通知正文。
• 桌面标签页高度改为 34 像素，名称列表采用一致的排序规则，连接筛选菜单中计数相同的分组保持稳定顺序。
• 配置页显示只读 include 文件中的模块，并合并重复诊断。
• README 截图展示三种语言下当前的桌面和手机布局。

修复

• 配置补全读取所有来源中的群组，并保留群组标题原有的引号；快速设置生成路由规则时也保留相同名称。
• 来源文件保存冲突后，编辑器保留草稿，并用重新获取的来源作为下一次保存的基准。重载后清除上一代配置的校验结果。
• 活动页按标记查找出站模式行，不再依赖其在文件中的位置。
• DNS 拒绝无效的设备地址并保留上一个有效筛选条件。关闭连接的请求完成时，不再清除等待期间打开的另一条连接。
• 路由图等待节点数据后再完成加载；连接列表移出存储后，其速率采样基准也随之清除。
• 被拒绝的事件流可通过重试重新连接；能力读取恢复后清除对应错误；无游标的首页请求被拒绝后不再重复请求。
• 设置页退出登录后可再次登录，区分 token 被拒绝与连接失败，并将会话无法存储报告为存储错误。
• 地理数据预设缺少配置使用的分类时，切换前要求确认。后端提供失败阶段时，操作错误会显示该阶段。
• 暂停日志时显示暂存记录数；缺口摘要省略为零的丢弃数量；活动页通知摘要按同一列对齐。
• 后端版本过长时以省略号结尾；可用的后端能力使用状态圆点表示。
• 筛选快捷键没有可聚焦的输入框时，清除等待中的导航前缀；接近视口时加载的内容不再因回调变化而重建观察器。

v0.1.0-beta.6

Pre-release. doona needs a honk build with the native API, which today is the feat/native-api branch of Glassyiris/honk; see the README. Verify downloads against SHA256SUMS. Try the demo with sample data: https://demo.daeuniverse.org/

预发布版本。doona 需要提供原生 API 的 honk 构建；目前可使用 Glassyiris/honk 的 feat/native-api 分支，详见 README。请用 SHA256SUMS 校验下载文件。使用示例数据体验演示版：https://demo.daeuniverse.org/

Highlights

• The side navigation shows the connected backend, with a card that opens About and the backend settings.
• Settings adds a mirrored layout for left-handed use, and right-to-left languages are laid out right to left.
• Node latencies carry a green, yellow or red dot.
• Activity sparklines show the value and time under the pointer or a tap.
• Phone layouts are fixed across Connections, tables and detail drawers.
• Routing traces simulate the first IPv4 and first IPv6 answer of a name with several addresses.

重点

• 侧边导航显示已连接的后端，其卡片可打开关于页面和后端设置。
• 设置页新增镜像布局，方便左手操作；从右到左书写的语言按从右到左排版。
• 节点延迟旁显示绿色、黄色或红色圆点。
• 悬停或点按活动页的趋势图时，会显示对应的数值和时间。
• 修正手机上连接页、表格和详情抽屉的布局。
• 对有多个地址的域名，路由追踪模拟第一个 IPv4 和第一个 IPv6 应答。

Added

• The side navigation shows the connected backend's name and version with a connection light. It opens a card with the connection state, API, build and backend URL, and buttons for About doona and for editing the backend in Settings. On phones the same card opens from the overflow menu.
• About states that doona talks only to the backend it is connected to and sends nothing elsewhere.
• Settings offers a mirrored layout for left-handed use.
• A right-to-left language lays the page out right to left; adding one needs only its catalogue.
• Node latencies carry a green, yellow or red dot, which keeps the tone visible in palettes that show latency text in the body colour.
• Hovering or tapping an Activity sparkline shows the sample's value and time.
• On touch screens, a tap reveals the full text of a truncated table cell.

Changed

• On phones, the Connections filter field takes the toolbar row and the other filters fold into one menu.
• On phones, the busiest connection takes a row of its own, and a host too long for it keeps its end visible.
• On small phones, key-value facts use two columns, truncated drawer values wrap, table row actions stay reachable, and the column resizer is wider.
• On phones, the Activity node picker stays inside its tile, custom geodata URL fields use the full width, and the subscription remove button stays on its row.
• On short landscape phones, the top bar scrolls away instead of covering the page.
• A tab bar that overflows scrolls the selected tab into view and fades its cut edge.
• The Arrange hint no longer says the tray is on the right when it is below the groups.
• Heatmap time marks are larger.
• Translations use one term per concept, the English copy is tidier, several mistranslations are corrected, and Simplified Chinese distinguishes blocking from DNS interception.
• CONTRIBUTING describes how to correct a translation and how to propose a new language.

Fixed

• A routing trace simulates the first IPv4 and first IPv6 answer and shows the full resolution, instead of refusing a name with several addresses.
• Buffer overflow gaps no longer appear on the Activity home card; Events still lists them.
• A configuration write the backend accepted is reported as unknown, not failed, when the following status poll fails.
• The add-rule dialog preselects no outbound until the groups are read, instead of showing a wrong one.
• Donut charts with more than sixty slices no longer draw a slice with a negative angle.
• Chart tooltips are announced politely, so moving through a chart does not interrupt the screen reader.
• A gap summary that names no record starts at its reason instead of a dash.
• Chart tooltips stay inside their card on narrow phones.

新增

• 侧边导航显示已连接后端的名称和版本，并附连接指示灯。点击后打开的卡片列出连接状态、API、构建和后端网址，并提供“关于 doona”和“在设置中编辑后端”两个按钮。手机布局中可从菜单打开同一张卡片。
• 关于页面说明 doona 只与所连接的后端通信，不向其他地方发送数据。
• 设置页新增镜像布局，方便左手操作。
• 从右到左书写的语言会按从右到左排版；新增此类语言只需提供对应的翻译文件。
• 节点延迟旁显示绿色、黄色或红色圆点。在延迟文字使用正文颜色的配色中，仍可分辨延迟高低。
• 悬停或点按活动页的趋势图时，会显示该采样点的数值和时间。
• 在触摸屏上，点按被截断的表格单元格可查看完整内容。

变更

• 手机布局中，连接页的筛选输入框独占工具栏一行，其余筛选条件收进一个菜单。
• 手机布局中，流量最大的连接单独占一行；主机名过长时保留其末尾部分。
• 在小屏手机上，键值信息改为两栏显示，详情抽屉中被截断的值会换行，表格行操作保持可点按，列宽调整手柄也更宽。
• 手机布局中，活动页的节点选择器不再超出卡片，自定义地理数据 URL 输入框使用全部宽度，订阅的移除按钮保持在同一行。
• 在高度较小的横屏手机上，顶栏会随页面滚出，不再遮挡内容。
• 标签栏放不下时，会将选中的标签滚动到可见位置，并淡化被截断的边缘。
• “节点与订阅”区位于分组下方时，编排页的提示不再说它在右侧。
• 热力图的时间刻度加大。
• 译文中同一概念统一使用一个术语，英文文案更简洁，并修正多处误译；简体中文区分了“屏蔽”和“DNS 拦截”。
• CONTRIBUTING 说明了如何修正译文，以及如何提议新增语言。

修复

• 对有多个地址的域名，路由追踪会模拟第一个 IPv4 和第一个 IPv6 应答并显示完整解析结果，不再直接拒绝。
• 活动页卡片不再显示缓冲区溢出造成的记录缺口；事件页仍会列出。
• 后端已接受配置写入、但随后的状态轮询失败时，结果显示为未知，而非失败。
• 分组读取完成前，添加规则对话框不预选出站，避免显示错误的出站。
• 扇区超过六十个的环形图不再绘制负角度的扇区。
• 图表提示框改为不打断式播报，在图表中移动时不会打断屏幕阅读器正在朗读的内容。
• 未指明记录的缺口摘要直接以原因开头，不再以短横线开头。
• 在窄屏手机上，图表提示框保持在卡片内。

v0.1.0-beta.5

Pre-release. doona needs a honk build with the native API, which today is the feat/native-api branch of Glassyiris/honk; see the README. Verify downloads against SHA256SUMS. Try the demo with sample data: https://demo.daeuniverse.org/

预发布版本。doona 需要提供原生 API 的 honk 构建；目前可使用 Glassyiris/honk 的 feat/native-api 分支，详见 README。请用 SHA256SUMS 校验下载文件。使用示例数据体验演示版：https://demo.daeuniverse.org/

Highlights

• Pages are grouped into four hubs, with a bottom bar on phones.
• Settings adds geodata sources, automatic updates, download routing and status when supported.
• When rules are writable, a connection can create a rule to apply now or hold for later.
• New subscriptions can set the refresh interval, User-Agent and cache when supported.
• Activity charts and the first-load shell download less JavaScript.
• Safari users see manual app-install steps in Settings when applicable.

重点

• 页面分为四组，手机布局使用底部导航栏。
• 后端支持时，可在设置页配置地理数据来源、自动更新和下载路由，并查看状态。
• 规则可写时，可从连接创建规则，立即应用或暂存。
• 后端支持时，新增订阅可设置更新间隔、User-Agent 和缓存。
• 活动页图表和首次加载的界面代码下载量减少。
• 适用时，Safari 用户可在设置页查看手动安装步骤。

Added

• Settings shows geodata presets, custom source URLs, automatic updates, a download route and update status when the backend supports them.
• The Connections Traffic tab shows node latency, including P50 and P90 across nodes and which nodes carry current connections, when health data is available.
• When rules are writable, connection details can create a routing rule from the destination and apply it immediately or hold it for later. A matched-rule link opens the rule list.
• The add-subscription dialog offers the refresh interval, User-Agent and cache option when the backend advertises them.
• Navigation groups pages into Overview, Traffic, Routing and Settings hubs, with a bottom bar on phones.
• The top bar has a separate reload action and shows the number of held rules to apply.
• Settings shows manual installation steps for Safari on iPhone and iPad, and Safari 26 or later on macOS, when no install prompt is available.

Changed

• Until a language is chosen, doona follows the browser's first language preference; a saved choice still takes precedence.
• The Connections and flow records tables show the final node or outbound instead of the full chain. Details and CSV export retain the chain, a tooltip shows the path when a group precedes the node, and a saved hidden column stays hidden.
• Geodata settings save as they change. Custom URLs remain editable when their initial values came from the configuration file; restarting honk can restore URLs named in that file.
• Segmented controls that do not fit become a picker instead of scrolling or clipping.
• On narrow Activity tiles, sparklines sit below the value and use the tile width.
• On phones, top-bar options use submenus, and longer page action groups move extra actions into a menu.
• Initial page loads download less shell code, and visitors using a real backend no longer download demo code for offline use.
• Activity charts download less JavaScript. In measured large-list scenarios, node searches and probes, connection sorting and selection, and log bursts use less scripting time.
• The README includes a page tour and phone guidance, and demo links point to https://demo.daeuniverse.org/.
• Internal restructuring of charts, shared components, routes and styles leaves the UI and behavior unchanged.

Fixed

• Restart-only configuration refusals name the affected settings, and a file written without a successful reload is reported as unapplied.
• Repeated configuration conflicts explain when the file on disk differs from the running configuration.
• Runtime settings refresh after activation, and retries no longer replay writes without an idempotency key. Configuration validation and routing traces, which write nothing, still retry after a temporary refusal.
• DNS statistics stay usable when a log page is refused for size. Failed reads show one retryable error, and early-ended pages show how many records loaded without assuming why they ended.
• Close all handles connection sets above the backend's bulk limit in batches and reports connections left open when a batch stops.
• Configuration validation and writes report the advertised size limit before sending an oversized request.
• Relative times and traffic and memory chart windows use the backend host's observed time when it is available.
• Event and log streams reconnect after missed heartbeats. Gaps from expired cursors are marked, including in exported logs.
• Unknown operation and probe results are shown as unknown instead of failed or unreachable; new backend enum values are shown instead of blank labels.
• Policies, fallback groups, recorded log levels, delayed retries and degraded subscription refreshes are described according to the backend's actual behavior. Known backend error codes have translations.
• Module diagnostics stay in place while typing and when switching sections, and code scrolled sideways no longer shows through the line-number gutter.
• Password sign-in works with the backend's public discovery response.
• The demo's traffic history advances with time, so Activity charts retain a full recent window after a tab has been in the background.
• The demo keeps refused settings patches atomic, updates required geodata categories after configuration changes and redacts secret-bearing parts of geodata URLs.
• Connection rules can be placed before the earliest writable rule. Rule creation waits for groups to load, and the matched-rule link remains available on read-only configurations.
• A rule value containing parentheses or && is refused, because honk would read it as rule syntax.
• Held rules cannot be discarded or applied concurrently while an apply is running. Written rules leave the pending list even if reload fails or its result is unknown, and partial results count every written rule.
• Geodata controls follow backend capabilities, including older backends without download-route settings. Custom URLs cannot be edited while saving, so later input is not lost.
• DNS cache usage is read again after a flush or deletion; an older cache walk cannot restore stale usage afterward.
• Chart arrow keys keep working after the data shrinks. The Outbound downloads chart has one named keyboard stop, and its tooltip no longer sits under the centre total.
• Keyboard focus stays on a segmented control when resizing switches it between buttons and a picker.
• On phones, the bottom bar and the hub page switcher replace the history entry, so Back no longer retraces every tap.
• An arrow key pressed right after a phone submenu opens is no longer undone.
• A popover opened near the right edge keeps its width instead of shifting while it is placed.
• Screen readers announce a retry wait once instead of every second.
• A failed node read shows an error in the Connections latency card instead of silently removing it.
• Table columns and page width stay steady while rows load, tables change layout or pages change height.
• Table lines, row hover and other quiet fills stay visible on cards in the Rosé Pine dark, Nord and Kary palettes, and touching a chart point no longer leaves a hover state stuck.

新增

• 后端支持时，设置页会显示地理数据预设来源、自定义来源 URL、自动更新、下载路由和更新状态。
• 有节点健康数据时，连接页的流量标签会显示节点延迟、跨节点的 P50 和 P90，以及哪些节点承载当前连接。
• 规则可写时，连接详情可根据目的地址创建路由规则，并立即应用或暂存。命中规则的链接会打开规则列表。
• 后端提供相应选项时，新增订阅对话框可设置更新间隔、User-Agent 和缓存。
• 页面归入概览、流量、路由和设置四组；手机布局使用底部导航栏。
• 顶栏提供独立的重载操作，并显示待应用的暂存规则数量。
• 没有安装提示时，设置页会显示 iPhone 和 iPad 上的 Safari，以及 macOS 上 Safari 26 或更高版本的手动安装步骤。

变更

• 用户选择语言之前，doona 使用浏览器的首选语言；已保存的选择仍优先。
• 连接表和流程记录表以最终节点或出站代替完整链路。详情和 CSV 导出仍保留链路；节点前有组时，悬停提示也会显示路径。先前隐藏的列继续隐藏。
• 地理数据设置在修改后保存。即使自定义 URL 最初来自配置文件，仍可在设置页编辑；重启 honk 时，配置文件中指定的 URL 可能恢复。
• 分段控件空间不足时改为选择器，不再滚动或截断选项。
• 活动页的卡片较窄时，趋势图移到数值下方并使用卡片宽度。
• 手机布局中的顶栏选项改用子菜单；页面操作较多时，其余操作收进菜单。
• 首次打开页面时下载的界面代码减少；连接真实后端的用户也不再为离线使用下载演示代码。
• 活动页图表下载的 JavaScript 减少。测试中的大型列表场景下，节点搜索和测试、连接排序和选择，以及日志集中到达时的脚本耗时也减少。
• README 新增页面导览和手机使用说明，演示版链接指向 https://demo.daeuniverse.org/。
• 图表、共用组件、路由和样式的内部结构已调整，界面和行为保持不变。

修复

• 仅在重启后生效的配置项被拒绝时，会列出受影响的设置；文件已写入但重载失败时，会明确提示尚未应用。
• 配置冲突反复出现时，会说明磁盘上的文件与正在运行的配置不一致。
• 配置生效后会刷新运行时设置；重试也不再重复发送没有幂等键的写入请求。配置校验和路由追踪不写入数据，遇到临时拒绝时仍会重试。
• DNS 日志页面因大小限制被拒绝时，统计信息仍可使用。读取失败只显示一处可重试的错误；页面提前结束时会显示已加载的记录数，不推断结束原因。
• 全部关闭操作会分批处理超过后端批量上限的连接，并在批次中断时报告仍未关闭的连接。
• 配置校验和写入会在发送超限请求前，提示后端公布的大小上限。
• 后端提供观测时间时，相对时间以及流量和内存图表的时间窗口会按后端主机时间计算。
• 事件流和日志流在错过心跳后会重新连接。游标过期造成的记录缺口会标记出来，导出的日志也会保留标记。
• 无法确认的操作和节点测试结果会显示为未知，而非失败或不可达；后端新增的枚举值也不会显示为空白。
• 策略、按顺序备用组、日志记录级别、延迟重试和降级后的订阅刷新会按后端实际行为说明；已知后端错误代码也有对应译文。
• 输入内容或切换配置段时，模块诊断信息会保持在正确位置；代码横向滚动时也不会透过行号栏显示。
• 后端只返回公开的发现信息时，密码登录仍可使用。
• 演示版的流量历史会随时间推进，因此标签页在后台停留后，活动页图表仍有完整的近期时间窗口。
• 演示版在设置修改被拒绝时不会留下部分更改；配置变化后会更新所需地理数据类别，并遮盖地理数据 URL 中可能包含密钥的部分。
• 从连接创建规则时，可将规则放在最早可写规则之前。组加载完成前不会创建规则；配置只读时仍可打开命中的规则。
• 规则值包含括号或 && 时会被拒绝，因为 honk 会将其解析为规则语法。
• 应用暂存规则期间，无法同时舍弃或重复应用。即使重载失败或结果未知，已写入的规则也会移出待处理列表；部分成功的结果会计入所有已写入规则。
• 地理数据控件会依据后端能力显示，包括不支持下载路由设置的旧后端。保存期间不能编辑自定义 URL，避免随后输入的内容丢失。
• 清空或删除 DNS 缓存后会重新读取用量；先前发起的缓存遍历也不会将旧用量写回。
• 图表数据减少后，方向键仍可切换数据点。出站下载量图表只有一个具备名称的键盘焦点，提示框也不再被中央总数遮挡。
• 调整窗口大小使分段控件在按钮和选择器之间切换时，键盘焦点会保留。
• 手机布局中，通过底部导航栏和分组页面切换器跳转时会替换当前历史记录，返回操作不再逐一回溯每次点按。
• 手机子菜单打开后立即按下的方向键不再被撤销。
• 靠近右边缘打开的弹出层宽度保持不变，不再在定位过程中来回变化。
• 屏幕阅读器只播报一次重试等待时间，不再每秒播报。
• 读取节点失败时，连接页的延迟卡片会显示错误，而非直接消失。
• 表格加载行、切换布局或页面高度变化时，表格列和页面宽度保持稳定。
• 在 Rosé Pine 深色、Nord 和 Kary 配色中，卡片上的表格分隔线、行悬停底色等浅色填充仍可辨认；触摸图表数据点也不会留下悬停状态。

v0.1.0-beta.4

Pre-release. doona needs a honk build with the native API, which today is the feat/native-api branch of Glassyiris/honk; see the README. Verify downloads against SHA256SUMS. Try the demo with sample data: https://demo.daeuniverse.org/

Added

• dae text outside the editor is highlighted with the editor's colours, in policy arrangement, rules, the configuration wizard, configuration issues and flow details.

Changed

• Release assets carry the upstream version without v, and each package keeps its own format's version inside: 0.1.0~beta.4-1 for deb, rpm and ipk, 0.1.0beta4 for Arch.
• The API contract is pinned to the upstream api-standardize honk branch, which now includes rule sources named by id, recorder modes, password sign-in and DNS cache usage.
• Package recipes list every architecture and declare the licences of the bundled npm packages; the Gentoo ebuild maps alpha, beta and rc versions to their tags.

Fixed

• The outbound mode card shows the current mode, read-only with the reason, when the main configuration cannot be written.
• The dae highlighter no longer colours digits inside names as numbers and keeps an address or CIDR as one number.

v0.1.0-beta.3

Pre-release. doona needs a honk build with the native API, which today is the feat/native-api branch of Glassyiris/honk; see the README. Verify downloads against SHA256SUMS. Try the demo with sample data: https://demo.daeuniverse.org/

Added

• A public demo on GitHub Pages with sample data from the built-in mock backend.
• A clear message when an engine has no native API, instead of a token prompt.

Changed

• Releases no longer include a node_modules archive; package recipes install the prebuilt tarballs.
• The READMEs and guides state which honk builds serve the native API and lead with password sign-in.
• Card values keep secondary facts on a caption line, cards in a row stay equal in height, and the capabilities list uses columns.

Fixed

• An updated build could miss the page language for offline start.
• The Events page left out events received before it opened.
• Layout on tablets and phones for Overview, DNS, the routing map and other pages.
• Sticky table headers and overlays showed content through them in the glass palette.
• Untranslated datapath errors and the rule editor's must switch.