fix(flatpak): pin libdir=lib; deb depends on nftables; require the rpm again

flatpak: the gtkmm stack built into /app/lib64 while flatpak-builder's default
PKG_CONFIG_PATH covers /app/lib/pkgconfig only. libsigc++ compiled and
installed perfectly, then glibmm reported "Run-time dependency sigc++-3.0
found: NO", fell back to its meson wrap, and tried to `git clone`
libsigcplusplus inside a build sandbox with no network. The reported error
names git and glibmm and says nothing about libdir or about the module that
misplaced its .pc file. Pinned --libdir=lib on the six meson modules
individually rather than globally, because nlohmann-json is cmake and would
choke on it, and pinned rather than widening PKG_CONFIG_PATH because the
runtime loader searches /app/lib too.

deb: declare nftables. main.cpp's preflight marks `nft` required=true and the
tunnel needs it for the egress self-exclusion, the IPv6 and DNS floors and the
kill switch -- but only the rpm declared it. On a minimal Debian/Ubuntu the
package installed cleanly, the service started cleanly, and the first Connect
failed on a missing tool instead of apt saying what was needed. Declaring
dependencies is the entire reason to ship a native package.

UR_REQUIRE_RPM back to "true": v2026.8.16-1020748320-beta is the first release
that published an rpm, SELinux policy module built on the jammy container
included -- which is what the flag was held open for. 5 assets now.

Also: --revert now warns that it restores /etc/resolv.conf, so nobody runs it
as a "cleanup" against a live session on a host where tier 3 holds DNS; --help
and the recovery text say the same; and ControlProtocol's dns_detail comment no
longer claims the field is empty on success (it always carries a line now).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MAXFxG1EK4jTxQ1iW73BUr

Author: Ryanmello07

.github/workflows/beta-build.yml

@@ -173,17 +173,16 @@ env:
   # and the release publishes the other assets. It must go back to "true" --
   # a silent-missing-rpm mode is exactly how the .deb would have quietly
   # stopped shipping.
-  # CURRENTLY "false" FOR EXACTLY ONE REASON, AND IT IS TEMPORARY: the .rpm has
-  # never been built by CI. It builds on a Fedora host (verified end to end:
-  # exit 0, ~15 MB, 123 payload entries), but jammy's SELinux tooling split is
-  # different and the build-host .pp has never been produced there. Until one
-  # green run proves it, an rpm problem must not be able to take the four
-  # already-contracted assets (tarball, .deb, AppImage, .zsync) off the
-  # release -- turning a missing fifth asset into a release of nothing is a
-  # strictly worse outcome than shipping four.
-  # FLIP BACK TO "true" the moment a run publishes an .rpm. A silent-missing-rpm
-  # mode left on permanently is exactly how the .deb would quietly stop shipping.
-  UR_REQUIRE_RPM: "false"
+  # Back to "true" as of v2026.8.16-1020748320-beta, which is the first release
+  # that actually PUBLISHED an rpm (5 assets: tarball, .deb, .rpm, AppImage,
+  # .zsync) with the SELinux policy module compiled on the jammy container --
+  # the thing this was held open for. A silent-missing-rpm mode left on
+  # permanently is exactly how the .deb would quietly stop shipping.
+  #
+  # It was briefly "false" while the rpm was landing, and that is the right
+  # move again if the rpm ever breaks: a new package that cannot build must not
+  # take the four already-contracted assets off the release with it.
+  UR_REQUIRE_RPM: "true"
   # The Flatpak has NO equivalent knob here on purpose: a job-level `if:`
   # cannot read the `env` context (only github/needs/vars/inputs), so its kill
   # switch is the repository VARIABLE `UR_BUILD_FLATPAK` -- set it to "false"

app/src/ControlProtocol.hpp

@@ -572,7 +572,7 @@ struct StatusReply {
   // starving and the session cannot carry traffic.
   bool egress_protected = false;
   bool dns_applied = false;
-  std::string dns_detail;    // why DNS is not in force ("" when it is)
+  std::string dns_detail;    // always set: which tier holds DNS, or why none could
   KillSwitchState kill_switch = KillSwitchState::Off;
   std::string kill_switch_detail;  // why it is Failed ("" otherwise)
   bool ipv6_blocked = false;       // v6 has no tunnel: blocked rather than leaked

app/src/daemon/main.cpp

@@ -143,9 +143,9 @@ void PrintRecovery(const char* argv0) {
       "    sudo systemctl stop urnetworkd\n"
       "    sudo %s --revert\n"
       "\n"
-      "  --revert removes the firewall table, the policy rules, the capture routes and the\n"
-      "  armed marker, so the next start comes up open. With no systemd and no working\n"
-      "  daemon binary, the firewall half alone is:\n"
+      "  --revert removes the firewall table, the policy rules, the capture routes, any\n"
+      "  /etc/resolv.conf takeover and the armed marker, so the next start comes up open.\n"
+      "  With no systemd and no working daemon binary, the firewall half alone is:\n"
       "\n"
       "    %s\n"
       "\n"
@@ -902,7 +902,11 @@ int main(int argc, char** argv) {
         std::fprintf(stderr,
                      "urnetworkd --revert: WARNING — %s still exists, so urnetworkd may still be "
                      "running. It re-installs its own ruleset within seconds of anything removing "
-                     "it; stop it first (systemctl stop urnetworkd) or this will not stick.\n",
+                     "it; stop it first (systemctl stop urnetworkd) or this will not stick.\n"
+                     "  This sweep ALSO restores /etc/resolv.conf if a tunnel took it over. On a "
+                     "host with no systemd-resolved that is how DNS reaches the tunnel, so running "
+                     "this against a LIVE session pulls the tunnel's resolver out from under it "
+                     "and names stop resolving until you reconnect.\n",
                      urnw::ControlServer::SocketPath().c_str());
       }
       // Whether the sweep is SUPPOSED to leave a table behind, decided before
@@ -949,7 +953,7 @@ int main(int argc, char** argv) {
           "                         touches no routes, no nftables and no DNS; sends no packet.\n"
           "                         Needs root (bpf() does). Exit 0 = works, 1 = does not,\n"
           "                         2 = could not be measured\n"
-          "  --revert               lift the URnetwork firewall table, policy rules and capture\n"
+          "  --revert               lift the URnetwork firewall table, policy rules, capture\n"
           "                         routes, and clear the armed marker; then exit. Run this when\n"
           "                         a machine is stuck blocked. Requires root.\n"
           "  --revert-unless-armed  the same sweep, but a machine that was armed when the daemon\n"

packaging/deb/nfpm.yaml

@@ -51,6 +51,17 @@ depends:
   # Tunnel.cpp configures the TUN link and its capture routes with /sbin/ip.
   # Minimal Ubuntu/Debian installations do not necessarily include it.
   - "iproute2"
+  # nftables is NOT optional and was missing here while the rpm declared it.
+  # app/src/daemon/main.cpp's preflight marks `nft` required=true, and the
+  # tunnel uses it for the egress self-exclusion (without which the daemon's
+  # OWN sockets fall into its own tunnel -- a measured 3.38 Tb amplification
+  # loop, not a theoretical one), the IPv6 and DNS leak floors, and the kill
+  # switch. Debian and Ubuntu do not install it on a minimal system, so the
+  # package installed cleanly, the service started cleanly, and the first
+  # Connect failed with a message about a missing tool rather than apt saying
+  # what was needed. Declared as a dependency, which is the whole reason to
+  # ship a native package instead of a tarball.
+  - "nftables"
   # The one genuine win of the deb shape (APPIMAGE.md 11d): the GUI AppImage
   # needs libfuse2 at runtime and Ubuntu 22.04+ does not ship it by default,
   # so every AppImage-only vendor walks users through installing it by hand.

packaging/flatpak/network.ur.urnetwork.yml

@@ -88,6 +88,16 @@ cleanup:
   - '*.a'
   - '*.la'
 
+# EVERY MESON MODULE BELOW MUST INSTALL INTO /app/lib, NOT /app/lib64.
+# meson's default libdir on this SDK resolves to lib64, and flatpak-builder's
+# default PKG_CONFIG_PATH covers /app/lib/pkgconfig only. The failure that
+# causes is deeply unhelpful: libsigc++ builds and installs perfectly, then
+# glibmm reports "Run-time dependency sigc++-3.0 found: NO", falls back to its
+# wrap, and tries to `git clone` libsigcplusplus -- inside a build sandbox with
+# no network. The error you see names git and glibmm, and says nothing about
+# libdir or about the module that actually misplaced its .pc file. The runtime
+# loader has the same blind spot (/app/lib is what it searches), so pinning
+# libdir is the fix rather than widening PKG_CONFIG_PATH.
 modules:
   # ---- the gtkmm stack --------------------------------------------------
   # org.gnome.Sdk 49 carries GTK 4.20 and libadwaita 1.8 but NO C++ bindings,
@@ -97,6 +107,7 @@ modules:
   - name: libsigc++
     buildsystem: meson
     config-opts:
+      - --libdir=lib
       - -Dbuild-documentation=false
       - -Dbuild-examples=false
     sources:
@@ -107,6 +118,7 @@ modules:
   - name: glibmm
     buildsystem: meson
     config-opts:
+      - --libdir=lib
       - -Dbuild-documentation=false
       - -Dbuild-examples=false
     sources:
@@ -119,6 +131,7 @@ modules:
   - name: cairomm
     buildsystem: meson
     config-opts:
+      - --libdir=lib
       - -Dbuild-documentation=false
       - -Dbuild-examples=false
       - -Dbuild-tests=false
@@ -130,6 +143,7 @@ modules:
   - name: pangomm
     buildsystem: meson
     config-opts:
+      - --libdir=lib
       - -Dbuild-documentation=false
     sources:
       - type: archive
@@ -139,6 +153,7 @@ modules:
   - name: gtkmm
     buildsystem: meson
     config-opts:
+      - --libdir=lib
       - -Dbuild-documentation=false
       - -Dbuild-demos=false
       - -Dbuild-tests=false
@@ -162,6 +177,7 @@ modules:
     buildsystem: meson
     subdir: app
     config-opts:
+      - --libdir=lib
       - -Dgui=enabled
       # Drops urnetworkd and the four host-integration files that install to
       # ABSOLUTE paths (/lib/systemd/system, /etc/urnetwork, /etc/NetworkManager,