xray-rust v0.5.0-rc.1

• Added blocking v0.5 host-hardening release gates: eight one-minute ASan fuzz
  campaigns now include SOCKS/HTTP inbound parsing, QUIC Initial sniffing,
  XHTTP framing, and TUN queues; selected library/FFI tests run under ASan and
  Miri; and Loom exhaustively models atomic routing-policy publication.
• Added a pinned-Xray Linux tc netem RC gate covering full-duplex WebSocket,
  HTTPUpgrade, gRPC, and XHTTP H1/H2/H3 plus two-minute held-open H2/H3
  stream-one sessions under controlled delay, jitter, and packet loss.
• Completed the focused v0.5 credential-boundary review. Config and wire debug
  output now redact VLESS UUIDs and REALITY short IDs, FFI error allocations
  are cleared before release, and QUIC Initial derived secrets and keys have
  bounded zeroizing lifetimes. The documented residual lifetime of credentials
  required by active VLESS/JSON state is not presented as an independent
  security audit.
• Added capability-gated routing-policy hot replacement in C ABI 1.4 and the
  Swift/Kotlin adapters. Hosts can compile a scoped routing JSON document,
  including geosite/geoip matchers from the handle's configured geodata
  generation, and atomically publish it for new flows while existing flows,
  outbound topology, and shared transport pools remain untouched. Invalid
  outbound/balancer references or topology changes retain the previous
  revision; a redacted schema-versioned snapshot reports the active revision,
  rule count, and domain strategy.
• Added a clean five-run v0.5 pre-device performance gate. A new
  phase2-probe measures production selector/chaining, atomic switching,
  health/selection snapshots, DNS caching, live connection inventory,
  accounting/close, structured TUN diagnostics, and TUN statistics. The macOS
  runner also replays v0.4.0 routing, DNS-selector, process-RSS, TCP, and
  inherited-fd TUN anchors under explicit budgets and rejects dirty or
  mixed-revision evidence before the physical Apple/Android campaign. The
  first clean candidate gate passed and records the remaining 1,000-flow RSS
  headroom as an explicit device-profiling risk.
• Restored small-rule routing performance lost before v0.5 when the shared
  domain and IP indexes replaced linear matchers. Domain sets of at most eight
  entries now retain a linear fast path while geosite-sized sets keep their
  compiled hash/automaton indexes; single IP ranges and empty inverse sets also
  avoid the generic range search. On the same release probe, 4096-rule DNS
  selector last-hit latency fell from 91.5 to 26.4 microseconds without
  regressing the 4096-matcher indexed path, and the 64-rule IP route probe fell
  from 472 to 367 nanoseconds.
• Started the v0.5 development line with additive C ABI minor-version and
  capability discovery. The canonical Swift and Kotlin adapters expose the
  loaded ABI version and capability mask and reject incompatible major or
  insufficient minor revisions before allocating a core handle.
• Split outbound topology, lazy handler construction, and routing policy into
  an immutable OutboundGraph, a shared OutboundFactory, and
  OutboundRouter. Each Core now owns one graph/factory before start, so
  future selector and health state can reuse transport pools without rebuilding
  the core.
• Added Xray-compatible selector groups: routing.balancers expands tag
  prefixes into sorted graph nodes, balancerTag rules support random,
  round-robin, and fallback selection, and a shared atomic override/snapshot
  API switches new flows without rebuilding handlers or their transport pools.
• Added the bounded Xray-compatible observatory subset and health-backed
  selection. Lifecycle-owned HTTP(S) URL probes publish typed, redacted health
  snapshots; random and round-robin skip known-dead candidates, while
  leastPing deterministically selects the lowest healthy delay and falls back
  when no healthy candidate remains. Explicit overrides remain authoritative.
  leastLoad uses a 16-result rolling health window, Xray-compatible
  deviation/average/failure ordering, bounded top-N distribution, RTT and
  failure-rate filters, duration baselines, and literal tag costs. Regex costs
  fail closed; non-TCP chaining shapes remain.
• Extended C ABI 1.2 with capability-gated atomic selector override/clear and
  two-pass, schema-versioned JSON snapshots for selection and redacted health
  state. The Swift and Kotlin adapters expose equivalent typed APIs; SwiftPM
  tests and the four-ABI Android JNI/AAR build cover the shared wire contract.
• Added validated transport-layer TCP outbound chaining through Xray
  proxySettings. The immutable graph resolves tag edges and rejects missing
  targets or cycles before core start; Freedom/VLESS carriers retain shared
  handler pools and apply TLS/WebSocket/HTTPUpgrade/gRPC/TCP-backed XHTTP over
  the nested protected stream. Protocol-layer/UDP/DNS, REALITY, and XHTTP
  HTTP/3 chain shapes fail closed while those lifecycle boundaries remain
  unsupported.
• Added core-owned connection management for routed SOCKS TCP/UDP, HTTP TCP,
  and TUN TCP/UDP flows. ABI 1.3 plus equivalent Swift/Kotlin models expose
  revisioned opening/active inventory, addressable close, and cumulative
  per-outbound accounting. Swift and Kotlin also expose the seven typed TUN
  diagnostic queues under the existing diagnostic capability bit.
• Added managed encrypted DNS transports for strict routed tls:// DoT,
  routed/provider-local HTTP/2 DoH (https:// / https+local://), and
  provider-local quic+local:// DoQ. All use
  non-recursive bootstrap resolution, certificate/name verification, bounded
  operations, and mobile preflight pinning; the TUN anchor supports both UDP
  and length-prefixed TCP clients. DoH and DoQ currently open one connection
  per exchange; DoQ uses exact ALPN doq and one bidirectional stream.
• Added a typed 30-second NXDOMAIN/NODATA cache and optional bounded
  stale-while-revalidate for positive destination answers. Global Xray
  disableCache, serveStale, and serveExpiredTTL fields are supported;
  transport failures are never cached, refreshes remain single-flight, and an
  explicit 1-through-86400-second stale window is required.
• Added managed platform-resolver injection for Rust embeddings. The new
  constructors retain dns.hosts, configured servers, routed query transport,
  and cache ownership; System uses the dependency only for no-server
  destination fallback and non-recursive endpoint bootstrap, while
  StaticOnly ignores it and remains fail-closed. Runtime startup preserves
  the same dependency instead of silently restoring getaddrinfo.
• Expanded the blocking pinned-Xray oracle matrix for v0.5. The live suite now
  proves round-robin traffic reaches both Xray VLESS members and a two-hop
  transport-layer chain reaches its final echo target without local domain
  resolution. The RC gate also submits one shared Phase 2 balancer/chaining/
  observatory/encrypted-DNS/cache config to xray run -test, then explicitly
  runs DoT/DoH/DoQ framing and failover, configured-DNS policy/bootstrap, and
  cache/singleflight/stale-refresh oracle filters.
• Added Android VLESS share-link import parity for the portable Apple subset:
  raw/TCP REALITY and XHTTP/SplitHTTP with none, TLS, or REALITY security. The
  Kotlin API emits the same mobile TUN topology, rejects duplicate or
  unsupported security-critical fields, bounds XHTTP extra to 64 KiB and one
  compatibility decode, and keeps unsupported secret values out of errors.
• Extended the test-only Android physical-device harness with owner-controlled
  canonical JSON import through an overwrite-and-delete private pending file
  and per-protocol bounded stress counts. A physical Android 15 rehearsal
  passed a pinned-certificate VLESS XHTTP stream-one endpoint over exact H3,
  including a Mac preflight oracle, 660/660 device HTTP attempts, stable
  repeated-cycle recovery memory, and disconnect/reconnect recovery. The
  short dirty-revision run remains diagnostic and does not replace the clean
  six-hour Android release report.