HydraCore v1.13.16-extended-hydracore.9 - verified client and VPS runtimes

HydraCore v1.13.16-extended-hydracore.9

This release fixes reusable VLESS/VMess/Trojan XHTTP transport handover and
RuntimeEvents traffic rates, retains authenticated Hydra VK Tunnel user
attribution from .8, and uses the exact sing-box-extended 2.6.2 baseline
(545424b86bc4513f90580ebeab2e2d1514089718).

XHTTP network handover

• An interface update now resets XHTTP's active streams and physical Xmux
  clients without permanently closing the reusable transport object.
• Dials racing with a network reset are rejected by generation, while the next
  dial lazily creates a transport bound to the new interface.
• Terminal service shutdown still closes XHTTP permanently. Other V2Ray
  transports keep their existing interface-update behavior.

Runtime traffic telemetry

• RuntimeEvents now derives upload and download bytes per second from both
  cumulative counters and the actual observation interval instead of emitting
  permanent zero rates.

Per-user traffic attribution

• Clash /connections metadata now includes the authenticated inbound user.
• HYDRA Ultimate can therefore attribute Hydra VK Tunnel upload and download
  counters to each managed user instead of leaving this protocol unassigned.

Subscription feature contract

• A JWE or plaintext Hydra Subscription v2 document may require both call
  and call_vk_multi_user when the release advertises those capabilities.
• Builds without a Calls role continue to reject both requirements. Unknown
  feature names remain fail-closed.
• Regression coverage follows the same encrypted JWE validation path used by
  HydraBox subscription import.

Managed URLTest

• A targeted group probes the concrete leaf selected by Now() while emitting
  the managed result under the originally requested group tag.
• Direct targets keep their existing result tag. Concrete URLTest history stays
  attached to the probed leaf so group health and selection remain accurate.

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Release artifacts do not expose legacy P2P mode.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.
• Wire v2 gives every reconnecting worker a monotonic epoch. Network changes
  immediately replace stale TURN/DTLS transports while keeping the logical KCP
  session and RelayBridge alive. The VPS accepts wire v1 and v2 for one
  transition release; the client emits v2.
• Obfuscation reads reuse a bounded buffer instead of allocating the maximum
  packet size for every UDP datagram.

The exact runtime probe is:

sing-box hydra capabilities --json

The client reports role client, the client feature, wire v2, and only
multi_user; the VPS reports role vps, the server feature, wire v1..2, and
only multi_user. The legacy combined build is not a release artifact.

Role-specific artifacts

• hydracore-client-libbox.aar
• hydracore-client-libbox-sources.jar
• hydracore-vps-linux-amd64.tar.gz
• hydracore-vps-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
client Android bindings, a release manifest, the attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Stable publication is explicit: ordinary pushes build and verify artifacts,
while a maintainer must dispatch the workflow with publish=true to update
the stable release.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.8 - verified client and VPS runtimes

HydraCore v1.13.16-extended-hydracore.8

This release exposes the authenticated Hydra VK Tunnel user to HYDRA Ultimate's
traffic collector, retains the role-separated Android client and Linux VPS
runtimes plus wire-v2 network handover from .7, and uses the exact
sing-box-extended 2.6.2 baseline
(545424b86bc4513f90580ebeab2e2d1514089718).

Per-user traffic attribution

• Clash /connections metadata now includes the authenticated inbound user.
• HYDRA Ultimate can therefore attribute Hydra VK Tunnel upload and download
  counters to each managed user instead of leaving this protocol unassigned.

Subscription feature contract

• A JWE or plaintext Hydra Subscription v2 document may require both call
  and call_vk_multi_user when the release advertises those capabilities.
• Builds without a Calls role continue to reject both requirements. Unknown
  feature names remain fail-closed.
• Regression coverage follows the same encrypted JWE validation path used by
  HydraBox subscription import.

Managed URLTest

• A targeted group probes the concrete leaf selected by Now() while emitting
  the managed result under the originally requested group tag.
• Direct targets keep their existing result tag. Concrete URLTest history stays
  attached to the probed leaf so group health and selection remain accurate.

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Release artifacts do not expose legacy P2P mode.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.
• Wire v2 gives every reconnecting worker a monotonic epoch. Network changes
  immediately replace stale TURN/DTLS transports while keeping the logical KCP
  session and RelayBridge alive. The VPS accepts wire v1 and v2 for one
  transition release; the client emits v2.
• Obfuscation reads reuse a bounded buffer instead of allocating the maximum
  packet size for every UDP datagram.

The exact runtime probe is:

sing-box hydra capabilities --json

The client reports role client, the client feature, wire v2, and only
multi_user; the VPS reports role vps, the server feature, wire v1..2, and
only multi_user. The legacy combined build is not a release artifact.

Role-specific artifacts

• hydracore-client-libbox.aar
• hydracore-client-libbox-sources.jar
• hydracore-vps-linux-amd64.tar.gz
• hydracore-vps-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
client Android bindings, a release manifest, the attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Stable publication is explicit: ordinary pushes build and verify artifacts,
while a maintainer must dispatch the workflow with publish=true to update
the stable release.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.7 - verified client and VPS runtimes

HydraCore v1.13.16-extended-hydracore.7

This release separates the Android client and Linux VPS runtime roles, adds
wire-v2 network handover for native VK Calls multi-user, retains the managed
URLTest and subscription validation fixes from .5/.6, and uses the exact
sing-box-extended 2.6.2 baseline
(545424b86bc4513f90580ebeab2e2d1514089718).

Subscription feature contract

• A JWE or plaintext Hydra Subscription v2 document may require both call
  and call_vk_multi_user when the release advertises those capabilities.
• Builds without a Calls role continue to reject both requirements. Unknown
  feature names remain fail-closed.
• Regression coverage follows the same encrypted JWE validation path used by
  HydraBox subscription import.

Managed URLTest

• A targeted group probes the concrete leaf selected by Now() while emitting
  the managed result under the originally requested group tag.
• Direct targets keep their existing result tag. Concrete URLTest history stays
  attached to the probed leaf so group health and selection remain accurate.

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Release artifacts do not expose legacy P2P mode.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.
• Wire v2 gives every reconnecting worker a monotonic epoch. Network changes
  immediately replace stale TURN/DTLS transports while keeping the logical KCP
  session and RelayBridge alive. The VPS accepts wire v1 and v2 for one
  transition release; the client emits v2.
• Obfuscation reads reuse a bounded buffer instead of allocating the maximum
  packet size for every UDP datagram.

The exact runtime probe is:

sing-box hydra capabilities --json

The client reports role client, the client feature, wire v2, and only
multi_user; the VPS reports role vps, the server feature, wire v1..2, and
only multi_user. The legacy combined build is not a release artifact.

Role-specific artifacts

• hydracore-client-libbox.aar
• hydracore-client-libbox-sources.jar
• hydracore-vps-linux-amd64.tar.gz
• hydracore-vps-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
client Android bindings, a release manifest, the attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Stable publication is explicit: ordinary pushes build and verify artifacts,
while a maintainer must dispatch the workflow with publish=true to update
the stable release.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.6 - verified Android and Linux runtime

HydraCore v1.13.16-extended-hydracore.6

This stable patch release aligns Hydra Subscription validation with the
advertised native VK Calls multi-user capability and retains the managed
URLTest identity fix from .5, the Linux/VPS distribution, and the exact
sing-box-extended 2.6.2 baseline
(545424b86bc4513f90580ebeab2e2d1514089718).

Subscription feature contract

• A JWE or plaintext Hydra Subscription v2 document may require both call
  and call_vk_multi_user when the release advertises those capabilities.
• Builds without with_call continue to reject both requirements. Unknown
  feature names remain fail-closed.
• Regression coverage follows the same encrypted JWE validation path used by
  HydraBox subscription import.

Managed URLTest

• A targeted group probes the concrete leaf selected by Now() while emitting
  the managed result under the originally requested group tag.
• Direct targets keep their existing result tag. Concrete URLTest history stays
  attached to the probed leaf so group health and selection remain accurate.

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Legacy missing/p2p mode remains unchanged.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.

The exact runtime probe is:

sing-box hydra capabilities --json

It reports features.call_vk_multi_user=true and
protocols.call_modes=["p2p","multi_user"] in release builds.

VPS artifacts

• hydracore-linux-amd64.tar.gz
• hydracore-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
Android libbox.aar, generated bindings, attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.5 - verified Android and Linux runtime

HydraCore v1.13.16-extended-hydracore.5

This stable patch release fixes managed URLTest result identity and retains the
Linux/VPS distribution plus native VK Calls multi-user support from .4 on the
exact sing-box-extended 2.6.2 baseline
(545424b86bc4513f90580ebeab2e2d1514089718).

Managed URLTest

• A targeted group probes the concrete leaf selected by Now() while emitting
  the managed result under the originally requested group tag.
• Direct targets keep their existing result tag. Concrete URLTest history stays
  attached to the probed leaf so group health and selection remain accurate.

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Legacy missing/p2p mode remains unchanged.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.

The exact runtime probe is:

sing-box hydra capabilities --json

It reports features.call_vk_multi_user=true and
protocols.call_modes=["p2p","multi_user"] in release builds.

VPS artifacts

• hydracore-linux-amd64.tar.gz
• hydracore-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
Android libbox.aar, generated bindings, attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.4 - verified Android and Linux runtime

HydraCore v1.13.16-extended-hydracore.4

This stable release adds the Linux/VPS HydraCore distribution and completes
native VK Calls multi-user support on the exact sing-box-extended 2.6.2
baseline (545424b86bc4513f90580ebeab2e2d1514089718).

Native VK Calls

• mode: "multi_user" hosts many independent authenticated users on one
  native UDP Calls inbound. Legacy missing/p2p mode remains unchanged.
• A shared RTP-shaped ChaCha20-Poly1305 layer makes packet unwrap O(1). User
  lookup is O(1), the password hash comparison is constant-time, and attach
  credentials are sent once inside DTLS instead of in every data packet.
• Clients can use one through four distinct VK join links and a total bounded
  worker pool distributed round-robin across them. VK TURN credentials are
  cached/singleflighted and all usable UDP relay URLs are rotated.
• One KCP conversation is striped across live workers. Authenticated heartbeat
  records evict dead TURN/DTLS paths without consuming user quota forever;
  worker loss/reconnect preserves the session. If server KCP state was reset,
  generation checks rebuild the native session behind the persistent relay.
• Users, sessions, per-user sessions, workers, pending handshakes, frame
  lengths, duplicate active workers, handshakes, reconnects, and idle state
  all have explicit hard bounds.

The exact runtime probe is:

sing-box hydra capabilities --json

It reports features.call_vk_multi_user=true and
protocols.call_modes=["p2p","multi_user"] in release builds.

VPS artifacts

• hydracore-linux-amd64.tar.gz
• hydracore-linux-arm64.tar.gz

Each archive contains a root executable named sing-box and ships with a
SHA-256 sidecar plus per-architecture provenance. The release also retains the
Android libbox.aar, generated bindings, attributed source archive,
subscription contracts, checksums, and schema-v3 Android provenance.

Security and capacity boundary

The VPS never joins VK and receives no VK cookies or room-creator credentials.
obfs_password is a trusted group secret protecting the self-signed DTLS
identity and should be rotated when group membership changes. With four rooms
and four workers per user, a 27-allocation-per-room VK limit corresponds to an
estimated 27 concurrent sessions; actual limits and throughput depend on VK,
RTT, loss, and the VPS.

HydraCore v1.13.16-extended-hydracore.3 - verified Android runtime

HydraCore v1.13.16-extended-hydracore.3

This prerelease fixes VK Call connectivity on Android VPN mode. The VK SFU
WebTransport socket is now created through the configured sing-box outbound
dialer, so Android can protect it from HydraBox's own TUN. The protected UDP
socket is also closed with its QUIC connection.

The release retains the HydraCore API v2 and Subscription v2 contracts from
.2 and the same sing-box-extended baseline.

Artifacts

The release contains the AAR, generated Java sources, attributed source,
subscription contract files, SHA-256 files, and schema-v3 provenance.

HydraCore v1.13.16-extended-hydracore.2

This prerelease updates the Android runtime to the exact
sing-box-extended commit
da4c532efb1f86a38a324909fc9b8867f811551c from the 2.6.1 line.

Contract changes

• Introduces HydraCore API v2 and removes the former active capability alias
  and product-specific provenance fields while preserving historical credits.
• Ships Hydra Subscription v2 plaintext and flattened JWE schemas as embedded,
  checksummed release artifacts.
• Adds strict remote-policy v2 validation, independent resource graphs,
  permissions, profiles, versioned requirements, redacted inspection, and
  authenticated dir/A256GCM JWE opening.
• Replaces fire-and-forget group URL tests with start/get/cancel sessions and a
  bounded event stream. Adds coherent runtime snapshots and coalesced typed
  runtime events.

Protocol and safety changes

• VK Call joiners now prefer the anonymous VK Calls API flow used by current
  clients, with the former calls.getAnonymousToken path retained as a
  Smart Captcha-capable fallback.
• Release builds include Call inbound and outbound for dion, telemost,
  vk, and wbstream, together with Rmux and AmneziaWG v3.
• Adds Amnezia key, padding, timing, handshake-attempt, and range guards.
• Carries forward upstream AnyTLS, XHTTP, QUIC, VLESS, and other 2.6.1 changes
  while preserving HydraCore-specific synchronization and safety fixes.

Artifacts

The release contains the AAR, generated Java sources, attributed source,
subscription contract files, SHA-256 files, and schema-v3 provenance. HydraBox
is intentionally not modified by this core release; existing client releases
must not be assumed to understand Subscription v2 or the API-v2 binding break.

HydraCore v1.13.16-extended-hydracore.2 - verified Android runtime

HydraCore v1.13.16-extended-hydracore.2

This prerelease updates the Android runtime to the exact
sing-box-extended commit
da4c532efb1f86a38a324909fc9b8867f811551c from the 2.6.1 line.

Contract changes

• Introduces HydraCore API v2 and removes the former active capability alias
  and product-specific provenance fields while preserving historical credits.
• Ships Hydra Subscription v2 plaintext and flattened JWE schemas as embedded,
  checksummed release artifacts.
• Adds strict remote-policy v2 validation, independent resource graphs,
  permissions, profiles, versioned requirements, redacted inspection, and
  authenticated dir/A256GCM JWE opening.
• Replaces fire-and-forget group URL tests with start/get/cancel sessions and a
  bounded event stream. Adds coherent runtime snapshots and coalesced typed
  runtime events.

Protocol and safety changes

• VK Call joiners now prefer the anonymous VK Calls API flow used by current
  clients, with the former calls.getAnonymousToken path retained as a
  Smart Captcha-capable fallback.
• Release builds include Call inbound and outbound for dion, telemost,
  vk, and wbstream, together with Rmux and AmneziaWG v3.
• Adds Amnezia key, padding, timing, handshake-attempt, and range guards.
• Carries forward upstream AnyTLS, XHTTP, QUIC, VLESS, and other 2.6.1 changes
  while preserving HydraCore-specific synchronization and safety fixes.

Artifacts

The release contains the AAR, generated Java sources, attributed source,
subscription contract files, SHA-256 files, and schema-v3 provenance. HydraBox
is intentionally not modified by this core release; existing client releases
must not be assumed to understand Subscription v2 or the API-v2 binding break.

HydraCore v1.13.16-extended-hydracore.1 - verified Android runtime

HydraCore v1.13.16-extended-hydracore.1

This prerelease updates the Android runtime to the exact
sing-box-extended commit
da4c532efb1f86a38a324909fc9b8867f811551c from the 2.6.1 line.

Contract changes

• Introduces HydraCore API v2 and removes the former active capability alias
  and product-specific provenance fields while preserving historical credits.
• Ships Hydra Subscription v2 plaintext and flattened JWE schemas as embedded,
  checksummed release artifacts.
• Adds strict remote-policy v2 validation, independent resource graphs,
  permissions, profiles, versioned requirements, redacted inspection, and
  authenticated dir/A256GCM JWE opening.
• Replaces fire-and-forget group URL tests with start/get/cancel sessions and a
  bounded event stream. Adds coherent runtime snapshots and coalesced typed
  runtime events.

Protocol and safety changes

• Release builds include Call inbound and outbound for dion, telemost,
  vk, and wbstream, together with Rmux and AmneziaWG v3.
• Adds Amnezia key, padding, timing, handshake-attempt, and range guards.
• Carries forward upstream AnyTLS, XHTTP, QUIC, VLESS, and other 2.6.1 changes
  while preserving HydraCore-specific synchronization and safety fixes.

Artifacts

The release contains the AAR, generated Java sources, attributed source,
subscription contract files, SHA-256 files, and schema-v3 provenance. HydraBox
is intentionally not modified by this core release; existing client releases
must not be assumed to understand Subscription v2 or the API-v2 binding break.

HydraCore v1.13.14-extended-hydracore.6 — verified Android runtime

HydraCore verified Android runtime

This release contains the provenance-bound Android runtime used by HydraBox.

Artifact contract

• libbox.aar and generated Java sources;
• SHA-256 checksum and machine-readable build provenance;
• attributed source archive bound to the published commit and pinned toolchain;
• HydraCoreCapabilities() with core_id: io.hydrabox.hydracore.

Compatibility identifiers required by existing bindings remain unchanged and
are documented in CREDITS.md. They do not alter the public HydraCore product
identity.

HydraCore revision 6

• Adds cancellable one-shot URLTest sessions for a concrete outbound without
  TUN, local inbounds, or background group probes.
• Publishes structured latency, status, timing, and error results through the
  mobile binding and advertises supports_preconnect_url_test.
• Guarantees session cleanup across success, failure, timeout, cancellation,
  network changes, and application lifecycle transitions.