0.2.4

• New: recover-vpn - a one-shot Task Scheduler script for the case where the shield looks fully green (VPN up, RPC push succeeding) but the forwarded port still tests closed. Some VPN providers (AirVPN confirmed) bind a forwarded port to the current tunnel session; if that binding didn't happen cleanly, only reconnecting the VPN itself fixes it. For DSM VPN Center connections, recover-vpn automates that: it stops Transmission, calls synovpnc reconnect for the profile in the new DSM_VPN_NAME guard.conf key (DSM_VPN_PROTOCOL defaults to openvpn), waits for VPN_IF to come back up, forces a reconcile, and only restarts Transmission once the shield's reconcile daemon is confirmed actually running - see Port still closed even though everything else is green?. Third-party OpenVPN/WireGuard clients reconnect from their own app instead; the shield reconciles automatically once VPN_IF comes back up.
• Fix: ENFORCE_KILLSWITCH_WHEN_VPN_DOWN="0" didn't actually disable the kill switch. reconcile always installs it while the VPN is up regardless of this setting, and nothing removed it again once the VPN dropped with the setting at 0 - so "0 = blackhole only" wasn't true in practice. reconcile now removes a stale kill-switch rule in that case, but only once the blackhole route and the UID policy rule that actually routes Transmission's traffic into it are both confirmed in place for this pass - otherwise the kill switch is left alone rather than risk a leak window.
• Docs: new consolidated "Task Scheduler scripts" table (README and the web site) listing every script you run manually via Control Panel → Task Scheduler - activate, set-port, recover-heartbeat, recover-vpn - with the command and when to run each, in one place instead of scattered across sections.
• UI: the web status page (index.cgi) is redesigned - theme-aware (follows the browser's light/dark preference), the old six-card grid plus separate Kuma mini-grid is replaced by a compact clickable status-chip row that jumps to and opens the matching detail section, and detailed data (routing breakdown, kill switch, Kuma, raw status, log) now lives in collapsible sections instead of always-open cards. The page header shows the installed version and links to this documentation and GitHub, and a new Task Scheduler scripts section lists activate/set-port/recover-heartbeat/recover-vpn in-page. The long in-page configuration guide is trimmed to essentials, linking to the full docs instead of duplicating them.