docs: first MEASURED Arch data, and a correction — CachyOS ships resolved active

A real CachyOS box (kernel 6.18.42-1-cachyos-lts, glibc 2.44) ran the tarball
installer end to end. Measured there, not inferred: host+pacman detection,
ip/nft/modprobe all present, cgroup v2 unified, /dev/net/tun present, SELinux
branch correctly SKIPPED rather than errored, unit resolved to
/usr/lib/systemd/system through the /lib symlink, GeoClue absent and degraded
gracefully.

The headline: --selftest-egress PASSED on that custom kernel. All four socket
kinds came back carrying 0x55524e57 and the control socket outside the cgroup
did not. The cgroup-BPF marker is no longer a Bazzite-only measurement, which
was the single highest-value unknown for any new distro.

AND A CORRECTION TO THIS PROJECT'S OWN PREMISE: CachyOS enables
systemd-resolved by DEFAULT, with /etc/resolv.conf pointing at it. Every
document here predicted Arch would land on the direct-/etc/resolv.conf tier and
that this is where the DNS leak would bite. True of vanilla Arch, FALSE of
CachyOS. So that box takes tier 1, exactly like Bazzite -- the leak does not
occur there, and tier 3 STILL has not executed on any machine on earth. The
host we expected to exercise it does not. Reaching it now needs
URNETWORK_DNS_BACKEND=file deliberately, which is a separate test pass.

Also retired two findings in DISTRO-SUPPORT.md that the code has since fixed
(C3: no resolved => no kill switch; C4: preflight tests the binary, not
liveness), rather than leaving them to read as open.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MAXFxG1EK4jTxQ1iW73BUr

Author: Ryanmello07

docs/DISTRO-SUPPORT.md

@@ -325,6 +325,23 @@ the kill switch is available), the `.deb` exists, and the daemon's floor is exac
 
 ### B.4 Arch
 
+> **CachyOS is now a MEASURED column — 2026-08-16.** A real CachyOS box (kernel
+> `6.18.42-1-cachyos-lts`, glibc 2.44) ran the tarball installer end to end.
+> Measured there: host+pacman detection correct; `ip`/`nft`/`modprobe` all
+> present; cgroup v2 unified; `/dev/net/tun` present; SELinux branch correctly
+> **skipped** (not errored); unit resolved to `/usr/lib/systemd/system` through
+> the `/lib` symlink; GeoClue absent and degraded gracefully; and
+> **`--selftest-egress` PASSED on that custom kernel** — all four socket kinds
+> marked `0x55524e57`, control socket unmarked. The cgroup-BPF marker is no
+> longer a Bazzite-only measurement.
+>
+> **AND ONE PREDICTION BELOW IS WRONG FOR CachyOS: it ships
+> `systemd-resolved` ACTIVE**, with `/etc/resolv.conf` pointing at it. The row
+> below is correct for *vanilla* Arch and wrong for this derivative — so
+> CachyOS takes **tier 1**, exactly like Bazzite, and does NOT exercise the
+> direct-`/etc/resolv.conf` tier. Everything from sign-in onward is still
+> unmeasured anywhere on Arch.
+
 | | Arch (rolling) |
 |---|---|
 | Channel today | **T** (tarball) + **A** |
@@ -412,8 +429,8 @@ which distro you test next.
 |---|---|---|
 | C1 | **The `.deb` does not depend on `nftables`, but `nft` is a hard requirement.** A perfectly successful `apt install` can be followed by a connect that refuses. Independently corroborated: the in-flight rpm template declares `nftables` and leaves a note calling the Debian side "a genuine gap" **[M]**. | `packaging/deb/nfpm.yaml` `depends:` vs `TunnelHost::RunStart` **[M-src]** |
 | C2 | **The `.deb` does not depend on glib** although `urnetworkd` `NEEDED`s `libgio-2.0.so.0` + `libglib-2.0.so.0`. | `readelf -d` **[M-bin]** |
-| C3 | **No systemd-resolved ⇒ no kill switch, anywhere.** Debian, Arch and openSUSE defaults all land here. | `TunnelHost.cpp` step 5 + `Tunnel::ApplyDns` **[M-src]** |
-| C4 | **`resolvectl` presence is tested; resolved *liveness* is not.** Arch prints a green preflight line for a service that is not running. | `ReportPreflight` **[M-src]** |
+| C3 | ~~No systemd-resolved ⇒ no kill switch, anywhere.~~ **FIXED** — `ApplyDns` now falls back to resolvconf and then to a direct `/etc/resolv.conf` takeover, so a host without resolved can still put DNS on the tunnel. Bring-up is fail-closed if no tier takes. **Tiers 2 and 3 have still never executed on any machine.** | `Tunnel::ApplyDns` **[M-src]** |
+| C4 | ~~`resolvectl` presence is tested; resolved *liveness* is not.~~ **FIXED** — `ReportPreflight` now runs `ProbeDnsHost` and prints the DNS tier the tunnel will actually take, probing `/run/systemd/resolve` for liveness rather than `$PATH` for the binary. | `ReportPreflight`, `ProbeDnsHost` **[M-src]** |
 | C5 | **The declared glibc floor (2.35) is one release above what today's binaries need (2.34).** Our own preflight and the in-flight rpm's `Requires:` are what exclude RHEL/Rocky/Alma 9 — the artifacts themselves would load there. The SDK's build target is `gnu.2.35`, so this is a *policy* to be set deliberately, not a free win. | `meson_options.txt`, `nfpm.yaml`, `install.sh` vs `readelf` **[M-src] + [M-bin]** |
 | C6 | **Daemon floor 2.34/2.35, GUI AppImage floor 2.39.** Ubuntu 22.04 and Debian 12 can run the service but not the shipped GUI. | `.github/workflows/beta-build.yml` **[M-src]** |
 | C7 | **`/lib/systemd/system` is fine for the `.deb` and wrong for an RPM.** | `nfpm.yaml` vs Fedora usrmerge rules **[M-src] + [I]** |

docs/TESTING-CACHYOS.md

@@ -11,6 +11,10 @@ daemon's only channel, so if the tarball is broken there is no fallback.
 
 ### 0.1 Nothing in this document has been run on Arch
 
+> **UPDATE 2026-08-16:** the installer half now HAS been — see §0.2b for measured
+> results from a real CachyOS box, including `--selftest-egress` passing on a
+> custom CachyOS-LTS kernel. Everything from sign-in onward is still unrun.
+
 Every command and every expected line below was derived by **reading this repository's
 source**, and every claim that something *works* was measured **on the owner's Bazzite
 (Fedora/ostree) machine**, not here. The three states are labelled throughout:
@@ -60,6 +64,43 @@ binary either way. It now runs the same probe the tunnel runs:
 [preflight]             <the reason, naming what it found>
 ```
 
+### 0.2b MEASURED ON A REAL CachyOS BOX — 2026-08-16, and it corrects §0.2
+
+First run on the tester's machine (CachyOS, kernel `6.18.42-1-cachyos-lts`,
+glibc 2.44, KDE). **Everything below is MEASURED, not inferred** — the first
+non-Bazzite column in this project with real data behind it.
+
+| Check | Result |
+|---|---|
+| Host detection | CachyOS, `pacman` family — correct |
+| glibc | 2.44 (floor is 2.35) |
+| `ip`, `nft`, `modprobe` | all present; **no missing packages** |
+| cgroup v2 | unified hierarchy present |
+| `/dev/net/tun` | present |
+| SELinux | not active → policy module correctly **skipped**, not errored |
+| Unit path | `/usr/lib/systemd/system/urnetworkd.service` — the `/lib`→`/usr/lib` symlink canonicalisation **works** |
+| GeoClue | absent → degrades to "location override unavailable", install continues |
+| **`--selftest-egress`** | **PASS on a custom CachyOS-LTS kernel.** All four socket kinds (`AF_INET`/`AF_INET6` × `SOCK_DGRAM`/`SOCK_STREAM`) came back carrying `0x55524e57`; the control socket outside the cgroup did not |
+
+**THE CORRECTION: CachyOS ships `systemd-resolved` ACTIVE, with
+`/etc/resolv.conf` pointing at it.** §0.2 was written on the premise that Arch
+does not enable it and that **tier 3 would be the expected path here**. That is
+true of vanilla Arch and **false of CachyOS**, which enables it as part of its
+default network setup.
+
+Consequences, and they cut both ways:
+
+* The DNS leak this whole workstream was built around **does not occur on a
+  stock CachyOS box.** It takes **tier 1**, the same path Bazzite takes.
+* So **tier 3 remains unexecuted on any machine on earth.** The one host we
+  expected to exercise it does not. Reaching it now requires deliberately
+  forcing it — see §0.3 — and that is a *separate* test run, not something that
+  falls out of ordinary use.
+* The fail-closed refusal is likewise not exercised by a normal connect here.
+
+Do the ordinary connect first and get a clean baseline. Forcing tier 3 is a
+second pass, and it is the more interesting one.
+
 ### 0.3 What we have NOT tested — and why your box is the only way to find out
 
 **Tiers 2 and 3 have never executed on any machine.** Every host we have selects tier 1. Their