[abcjhby2871]

Related to #1433 and clash-verge-rev/clash-verge-rev#8518.

A DIRECT rule can select a destination that fails to establish while a chosen parent can reach it. Fixed-URL fallback health does not express this per-target decision. This draft adds an explicit target-fallback group; existing rule/group behavior remains unchanged unless traffic is deliberately routed to it.

The group bounds each connection to one DIRECT route attempt and one selected parent attempt, shares concurrent route decisions, caches successful preferences, and cools down dual failures. Caller cancellation is not cached. Network/parent changes invalidate decisions without reloading rules or closing streams. A terminal error prevents outer tunnel retries from multiplying the budget. The controller exposes aggregate cache statistics and a flush operation.

This is a limited TCP prototype: HTTP/SOCKS5 parents must acknowledge the actual target CONNECT, use literal endpoint IPs, and avoid nested dialers/multiplexing. SOCKS5 confirmed dialing validates reply status through a separate entry point while retaining legacy behavior and lifecycle references. Implicit loopback gateways are rejected. Shadowsocks parents, UDP/QUIC fallback, and replay after TLS/application failure are not implemented. The group does not equate reaching a proxy node with reaching the destination.

Validation:

• Rebased onto Alpha at 69c16319b12d10ec1ed05eefca3a482357f5ffbb.
• On that baseline, Linux amd64 / Go 1.26.8: SKIP_INTEROP_TEST=1 go test ./... -count=1 and the same command with -tags with_gvisor both passed.
• Targeted Go tests with -race, repeated five times on the Alpha baseline, including 128 concurrent dual failures and 64 cached-parent recovery calls.
• Earlier isolated validation on v1.19.33, using system and gVisor TUN stacks: DIRECT success, refusal/timeout, cache/cooldown, TLS verification, and no POST replay.
• 22 comparisons over 11 out-of-scope rule cases against an unmodified build of the same version; outcomes unchanged.

Only synthetic test destinations are included. Operational logs, packet captures, local configuration, credentials, and real-site test details are excluded. This draft requests review of the API/protocol boundaries and is not presented as production-qualified for arbitrary parent protocols.

Assisted by OpenAI Codex.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.