feat(M4/M5): URLTest 自动选线 + Kill-switch + 弹性重连 [tsk_xAQhC1xuCd8x]

M4 URLTest 自动选线：
- ClashApiClient.getGroupDelay() — GET /group/<name>/delay 触发按需测速
- ClashApiClient.extractUrltestResults() — 从 /proxies 响应解析 URLTest
  组成员最新延迟，填充 stats 帧的 urltestResults 字段
- DesktopKernelProcess._startStatsPoll() — 每秒并行拉取连接统计 + URLTest
  延迟（_clashApi.getProxies()），URLTest 失败不影响主统计
- DesktopVpnBridge.selectOutbound(tag) — Clash API PUT /proxies/proxy，
  tag 可传节点 tag 或 urltest 组 tag（如 "auto-select"）恢复自动
- DesktopVpnBridge.getActiveOutbound() — GET /proxies 读 proxy.now
- app/kernel/poc/reality_client.config.json.tmpl — 增加 urltest("auto-select")
  + selector("proxy") 出口组，route.final 改为 "proxy"

M5 Kill-switch + 弹性重连：
- DesktopVpnBridge.setKillSwitch({required bool on}) — 将 _killSwitchEnabled
  写入 TUN inbound strict_route 字段（applyKillSwitchToConfig）；内核运行中
  触发静默重载（kill → start(lastConfig)）
- DesktopVpnBridge.applyKillSwitchToConfig() — static，killSwitch=true ↔
  TUN strict_route=true，killSwitch=false ↔ strict_route=false
- 自动退避重连：kernel 崩溃推 error → _scheduleReconnect() 退避序列
  1s/2s/4s/8s/16s/30s（上限），stop() 取消，重连成功后重置计数器
- DesktopKernelProcess 意外退出清理 _clashApi（避免下次 spawn 残留）
- app/pangolin/test/killswitch_checklist.md — 三端故障注入验收清单
  （Desktop ✅，iOS/Android 欠账说明）

新增测试（client/test/bridge/desktop_vpn_bridge_m4m5_test.dart）：
- M4: extractUrltestResults 解析/空/无 history 边界
- M4: getGroupDelay HTTP 请求格式验证
- M4: selectOutbound / getActiveOutbound Clash API 调用断言
- M5: applyKillSwitchToConfig 字段覆盖 + 无 TUN 边界
- M5: setKillSwitch 状态注入 + 同值幂等
- M5: 崩溃→error 不崩 / 首次重连在退避延迟内触发 / stop 后不再重连

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/kernel/poc/reality_client.config.json.tmpl

@@ -1,6 +1,7 @@
 {
-  "_comment": "sing-box 客户端配置模板 — VLESS+REALITY+TUN（PoC tsk_SLCsjNgtmng3）",
+  "_comment": "sing-box 客户端配置模板 — VLESS+REALITY+TUN（PoC tsk_SLCsjNgtmng3 / M4/M5 tsk_xAQhC1xuCd8x）",
   "_usage": "渲染脚本: app/kernel/poc/gen-poc-config.sh；占位符一律 __UPPER_SNAKE__",
+  "_m4_note": "URLTest 自动选线：auto-select(urltest) → 成员节点延迟最低者。手动切换经 Clash API PUT /proxies/proxy",
 
   "log": {
     "level": "info",
@@ -13,7 +14,7 @@
         "tag": "dns-remote",
         "address": "tls://1.1.1.1",
         "address_resolver": "dns-local",
-        "detour": "reality-out"
+        "detour": "proxy"
       },
       {
         "tag": "dns-local",
@@ -50,6 +51,22 @@
   ],
 
   "outbounds": [
+    {
+      "_comment": "M4: URLTest 自动选优出口组（成员：所有实际代理节点 tag）",
+      "type": "urltest",
+      "tag": "auto-select",
+      "outbounds": ["reality-out"],
+      "url": "http://www.gstatic.com/generate_204",
+      "interval": "3m",
+      "tolerance": 50
+    },
+    {
+      "_comment": "M4: Selector 出口组（Clash API 操作此组来手动覆盖 / 切回自动）",
+      "type": "selector",
+      "tag": "proxy",
+      "outbounds": ["auto-select", "reality-out"],
+      "default": "auto-select"
+    },
     {
       "type": "vless",
       "tag": "reality-out",
@@ -93,7 +110,7 @@
       { "geoip": "cn", "outbound": "direct" },
       { "geoip": "private", "outbound": "direct" }
     ],
-    "final": "reality-out",
+    "final": "proxy",
     "auto_detect_interface": true
   },
 

app/pangolin/test/killswitch_checklist.md

@@ -0,0 +1,209 @@
+# Kill-switch 故障注入清单 — M5 验收
+
+任务 ID：tsk_xAQhC1xuCd8x  
+执行原则：**每项注入期间持续循环 `curl --max-time 2 ifconfig.me`，断言要么超时要么走节点 IP，绝无真实 IP 泄露。**
+
+---
+
+## 通用准备
+
+```bash
+# 注入测试辅助脚本（三端通用，在 shell 里循环执行）
+while true; do
+  result=$(curl --max-time 2 -s ifconfig.me 2>&1)
+  echo "[$(date +%T)] $result"
+  sleep 1
+done
+```
+
+预期：
+- 正常连接时：输出节点出口 IP（非本机真实 IP）
+- Kill-switch 生效时：`curl: (28) Operation timed out` 或连接拒绝
+- **绝不允许输出本机真实 IP**
+
+WebRTC 泄露复验（浏览器内手动执行）：
+- 访问 https://browserleaks.com/webrtc 观察"Local IP"和"Public IP"字段
+- Kill-switch 激活时，Public IP 应为空或节点 IP
+
+DNS 泄露复验：
+- 访问 https://dnsleaktest.com → Run Extended Test
+- Kill-switch 激活时，所有 DNS 服务器应为节点侧 IP（非国内 ISP DNS）
+
+---
+
+## 平台一：桌面端 macOS（11D 已完成）
+
+实现：sing-box TUN `strict_route: true` + `DesktopVpnBridge.setKillSwitch()`
+
+### 1. 内核进程被 kill -9
+
+```bash
+# 找到 sing-box 进程 PID
+pgrep -f sing-box
+# 强制终止
+kill -9 <PID>
+```
+
+- [ ] curl 循环输出变为超时（不泄露真实 IP）
+- [ ] Flutter UI 显示 `error` 状态（不崩溃）
+- [ ] 约 1s 后触发自动重连（状态切换为 `connecting`）
+- [ ] 退避序列正确：第1次1s，第2次2s，第3次4s…上限30s
+- [ ] 重连成功后 UI 恢复 `on` 状态
+- [ ] 重连后 curl 再次输出节点 IP
+
+### 2. 物理断网（关闭 Wi-Fi / 拔以太网）
+
+- [ ] curl 循环输出变为超时
+- [ ] UI 状态切换为 `error` 或保持 `on`（取决于 sing-box keepalive 行为）
+- [ ] 恢复网络后，自动重连成功
+- [ ] 恢复后 curl 再次输出节点 IP，无真实 IP 泄露
+
+### 3. Kill-switch 关闭态下断网
+
+```bash
+# 先关闭 Kill-switch（strict_route=false）
+# 再断网
+```
+
+- [ ] curl 超时（无网络时正常超时，但不应泄露路由绕过节点的 IP）
+- [ ] 注意区分：关闭 Kill-switch = 断网后流量不被隧道保护，可能走直连
+- [ ] 关闭 Kill-switch 时，断网后 curl 应超时或走直连（记录观察结果，不强制要求节点 IP）
+
+### 4. Kill-switch ON ↔ OFF 切换验证
+
+```bash
+# 连接后调用 setKillSwitch(on: true)
+# 查看 config 的 strict_route 字段
+```
+
+- [ ] `setKillSwitch(on: true)` 触发内核重载，重载期间 curl 短暂超时
+- [ ] 重载完成后 curl 再次输出节点 IP
+- [ ] `setKillSwitch(on: false)` 同样触发重载，重载完成后 curl 输出节点 IP
+- [ ] `getActiveOutbound()` 在切换前后返回正确 tag
+
+### 5. 节点端主动断连（服务器侧 reset 连接）
+
+```bash
+# 在服务端执行（模拟节点故障）：
+# iptables -I INPUT -p tcp --dport 443 -j REJECT
+```
+
+- [ ] sing-box 内核检测到连接断开后推送 `error`
+- [ ] 自动重连定时器触发，尝试重连
+- [ ] 恢复后（服务端恢复策略），curl 再次输出节点 IP
+
+### 已完成打勾记录
+
+执行日期：___________  
+执行人：___________
+
+- [x] 测试环境：macOS Ventura 13.x，Apple Silicon M2
+- [ ] 1. kill -9 内核进程
+- [ ] 2. 物理断网
+- [ ] 3. Kill-switch OFF + 断网
+- [ ] 4. Kill-switch ON/OFF 切换
+- [ ] 5. 节点端主动断连
+- [ ] WebRTC 复验（browserleaks.com）
+- [ ] DNS 泄露复验（dnsleaktest.com）
+
+---
+
+## 平台二：iOS（11E M3 已完成；M4/M5 欠账）
+
+**当前状态：`selectOutbound` / `getActiveOutbound` / `setKillSwitch` 仍为 stub（TODO 11F），以下清单为下阶段完成后验收。**
+
+实现路径（欠账）：
+- `AppDelegate.swift` `selectOutbound` → `sendProviderMessage` → `PacketTunnelProvider.handleAppMessage`
+- `setKillSwitch` → 通过 `NEPacketTunnelNetworkSettings.includedRoutes` / `excludedRoutes` 控制泄露路由
+
+### 1. PacketTunnel Extension 被系统终止
+
+- [ ] iOS 杀后台，或 Xcode Debug > Simulate Memory Warning
+- [ ] curl 循环（在终端 SSH 到 iOS 或通过 TestFlight 辅助 App 执行）结果为超时
+- [ ] 主 App UI 显示 `error` 状态
+- [ ] 自动重连（NETunnelProviderSession 重启）触发
+- [ ] 恢复后 curl 输出节点 IP
+
+### 2. Wi-Fi ↔ 蜂窝切换
+
+- [ ] 切换期间 curl 超时（不泄露真实 IP）
+- [ ] NEPathMonitor 触发重连
+- [ ] 切换完成后 curl 输出节点 IP
+
+### 3. Kill-switch ON（includedRoutes 覆盖所有流量）
+
+- [ ] `setKillSwitch(on: true)` 触发 NetworkExtension 重配置
+- [ ] 断网后 curl 超时（不走直连）
+- [ ] 恢复后 curl 输出节点 IP
+
+### 4. WebRTC / DNS 泄露复验
+
+- [ ] Safari 访问 browserleaks.com/webrtc — Public IP 为节点 IP 或空
+- [ ] dnsleaktest.com — 无国内 ISP DNS
+
+### 已完成打勾记录
+
+执行日期：___________  
+执行人：___________  
+**欠账说明：M4/M5 iOS stub 尚未实现（需先完成 11F），本清单留待后续补全。**
+
+---
+
+## 平台三：Android（11F M2 已完成；M4/M5 欠账）
+
+**当前状态：`selectOutbound` / `getActiveOutbound` / `setKillSwitch` 仍为 stub（TODO 11G），以下清单为下阶段完成后验收。**
+
+实现路径（欠账）：
+- `MainActivity.kt` `selectOutbound` → libbox CommandClient selector 命令
+- `setKillSwitch` → `VpnService.Builder.addDisallowedApplication` 或 `BlockVpnRoute` 路由覆盖
+
+### 1. PangolinVpnService 被 kill -9
+
+```bash
+# adb shell
+adb shell am kill com.pangolin.pangolin_vpn
+```
+
+- [ ] curl 超时（Android 侧通过 adb shell curl 执行）
+- [ ] Flutter UI 收到 VpnEventBus `error` 推送，UI 不崩
+- [ ] 自动重连触发（PangolinVpnService 重启）
+- [ ] 恢复后 curl 输出节点 IP
+
+### 2. Wi-Fi ↔ 蜂窝切换
+
+- [ ] 切换期间 curl 超时
+- [ ] ConnectivityManager 触发重连
+- [ ] 恢复后输出节点 IP
+
+### 3. Kill-switch ON（DISALLOW_APPLICATION 覆盖）
+
+- [ ] `setKillSwitch(on: true)` 触发 VpnService 重配置
+- [ ] 断开 Wi-Fi 后 curl 超时（不走直连）
+- [ ] 恢复 Wi-Fi 后 curl 输出节点 IP
+
+### 4. 电池优化 / Doze 下后台存活
+
+- [ ] 强制进入 Doze 模式：`adb shell dumpsys deviceidle force-idle`
+- [ ] 10 分钟内确认 VPN 服务仍在运行（`adb shell dumpsys vpn`）
+- [ ] 退出 Doze：`adb shell dumpsys deviceidle unforce`
+
+### 5. WebRTC / DNS 泄露复验
+
+- [ ] Chrome 访问 browserleaks.com/webrtc
+- [ ] dnsleaktest.com
+
+### 已完成打勾记录
+
+执行日期：___________  
+执行人：___________  
+**欠账说明：M4/M5 Android stub 尚未实现（需先完成 11G），本清单留待后续补全。**
+
+---
+
+## 欠账汇总（供后续任务参考）
+
+| 平台 | Kill-switch 实现 | URLTest/selectOutbound | 说明 |
+|------|-----------------|----------------------|------|
+| 桌面 macOS | ✅ 已实现（strict_route + 重载） | ✅ Clash API | 本任务完成 |
+| iOS | ❌ 欠账 | ❌ 欠账 | TODO(11F): sendProviderMessage + includedRoutes |
+| Android | ❌ 欠账 | ❌ 欠账 | TODO(11G): libbox CommandClient + VpnService 路由 |

client/lib/bridge/desktop_vpn_bridge.dart

@@ -7,9 +7,11 @@
 //        - 注入 experimental.clash_api（随机高位端口 + 随机 secret）
 //        - 写 config 到 <AppSupport>/pangolin/kernel/config_<ts>.json（权限 0600）
 //        - 调 kernel.spawn(configPath)
-//   2. stop(): kernel.kill()
+//   2. stop(): kernel.kill() + 取消自动重连
 //   3. statusStream / statsStream: 代理 KernelProcess 事件流
-//   4. selectOutbound: 通过 Clash API PUT /proxies/{group} 切换出口
+//   4. selectOutbound: 通过 Clash API PUT /proxies/{group} 切换出口（M4）
+//   5. setKillSwitch: 修改 TUN strict_route 并重载内核（M5）
+//   6. 自动退避重连: 内核崩溃后 1s/2s/4s/8s/16s/30s 上限自动重试（M5）
 //
 // macOS PoC 依赖:
 //   · sing-box 需能建立 TUN 接口（sudo 或 sudoers 免密白名单）
@@ -18,6 +20,7 @@
 //
 // ignore_for_file: avoid_print
 
+import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 
@@ -56,26 +59,68 @@ class DesktopVpnBridge implements VpnBridge {
   final KernelProcess _kernel;
   final String? _configDirOverride;
 
+  // ── M5: Kill-switch 状态 ──────────────────────────────────────
+  bool _killSwitchEnabled = false;
+
+  // ── M5: 自动退避重连状态 ─────────────────────────────────────
+  // 记录用户最初传入的 config（未注入 Clash API 之前的原始字符串），
+  // 重连时重用，保持每次重连都有新 port+secret。
+  String? _lastUserConfigJson;
+  bool _shouldAutoReconnect = false;
+  int _reconnectAttempt = 0;
+  Timer? _reconnectTimer;
+  StreamSubscription<VpnStatus>? _kernelStatusSub;
+
+  // ── 退避延迟序列（秒）：1/2/4/8/16/30/30/…
+  static const _kRetryDelaysSec = [1, 2, 4, 8, 16, 30];
+
   // ── VpnBridge: start ─────────────────────────────────────────
 
   @override
   Future<void> start(String configJson) async {
-    // 1. 注入 Clash API 配置（随机端口 + secret）
+    // 保存原始 config（未注入 Clash API），用于重连
-    final (enrichedJson, port, secret) = injectClashApi(configJson);
+    _lastUserConfigJson = configJson;
+    _shouldAutoReconnect = true;
+    // 注意：不在此重置 _reconnectAttempt，由 stop() 和重连成功回调负责重置，
+    // 确保连续 start 失败时退避延迟单调递增。
 
-    // 2. 写 config 到应用支持目录（0600 权限）
+    // 订阅内核状态流：内核崩溃时自动触发退避重连
+    _kernelStatusSub?.cancel();
+    _kernelStatusSub = _kernel.statusStream.listen((status) {
+      if (status == VpnStatus.error && _shouldAutoReconnect) {
+        _scheduleReconnect();
+      }
+    });
+
+    // 1. 将 kill-switch 偏好写入 config（strict_route 字段）
+    final configWithKs = applyKillSwitchToConfig(configJson, _killSwitchEnabled);
+
+    // 2. 注入 Clash API 配置（随机端口 + secret）
+    final (enrichedJson, port, secret) = injectClashApi(configWithKs);
+
+    // 3. 写 config 到应用支持目录（0600 权限）
     final configPath = await writeConfig(enrichedJson);
     print('[DesktopVpnBridge] config written: $configPath');
     print('[DesktopVpnBridge] clash_api port=$port secret_len=${secret.length}');
+    print('[DesktopVpnBridge] killSwitch=$_killSwitchEnabled');
 
-    // 3. 启动内核子进程（blocking until Clash API ready or error）
+    // 4. 启动内核子进程（blocking until Clash API ready or error）
     await _kernel.spawn(configPath);
   }
 
   // ── VpnBridge: stop ──────────────────────────────────────────
 
   @override
-  Future<void> stop() => _kernel.kill(gracePeriod: const Duration(seconds: 5));
+  Future<void> stop() async {
+    // 取消自动重连，防止 kill 后再次被重连定时器触发
+    _shouldAutoReconnect = false;
+    _reconnectTimer?.cancel();
+    _reconnectTimer = null;
+    _kernelStatusSub?.cancel();
+    _kernelStatusSub = null;
+    _reconnectAttempt = 0;
+    await _kernel.kill(gracePeriod: const Duration(seconds: 5));
+  }
 
   // ── VpnBridge: getStatus ─────────────────────────────────────
 
@@ -91,7 +136,8 @@ class DesktopVpnBridge implements VpnBridge {
     if (!_kernel.isRunning) {
       throw StateError('kernel not running; cannot selectOutbound');
     }
-    // sing-box Selector 出口组名默认为 "proxy"；调用方可在 config 中自定义组名。
+    // sing-box Selector 出口组名固定为 "proxy"（见 config 模板 outbounds[].tag）。
+    // tag 可以是单节点 tag（如 "reality-out"）或 urltest 组 tag（如 "auto-select"）。
     try {
       await _kernel.clashApiClient.selectProxy('proxy', tag);
     } catch (e) {
@@ -120,11 +166,33 @@ class DesktopVpnBridge implements VpnBridge {
 
   // ── VpnBridge: setKillSwitch ─────────────────────────────────
 
+  /// 设置 Kill-switch 开关。
+  ///
+  /// Kill-switch 通过修改 TUN inbound 的 `strict_route` 字段实现：
+  ///   - `on=true`:  `strict_route: true`  → 内核停止时流量被系统丢弃
+  ///   - `on=false`: `strict_route: false` → 内核停止时流量走正常路由
+  ///
+  /// 若内核当前正在运行，会触发一次静默重载（先 kill，再以新 config 重启）。
   @override
   Future<void> setKillSwitch({required bool on}) async {
-    // macOS PoC: TUN 的 strict_route=true 提供基础的 kill-switch 语义。
+    if (_killSwitchEnabled == on) return;
-    // 细粒度 kill-switch 归 11G。
+    _killSwitchEnabled = on;
-    print('[DesktopVpnBridge] setKillSwitch=$on (strict_route in TUN config)');
+    print('[DesktopVpnBridge] setKillSwitch=$on');
+
+    // 若内核正在运行，用新设置重载（会有约 1~2s 重连）
+    if (_kernel.isRunning && _lastUserConfigJson != null) {
+      print('[DesktopVpnBridge] reloading kernel for killSwitch change');
+      // 暂停自动重连，避免 kill 触发重连定时器
+      final wasAutoReconnect = _shouldAutoReconnect;
+      _shouldAutoReconnect = false;
+      _reconnectTimer?.cancel();
+      _kernelStatusSub?.cancel();
+      _kernelStatusSub = null;
+      await _kernel.kill(gracePeriod: const Duration(seconds: 3));
+      _shouldAutoReconnect = wasAutoReconnect;
+      // start() 会重新订阅 _kernelStatusSub
+      await start(_lastUserConfigJson!);
+    }
   }
 
   // ── VpnBridge: 事件流 ────────────────────────────────────────
@@ -139,11 +207,46 @@ class DesktopVpnBridge implements VpnBridge {
 
   @override
   void dispose() {
+    _shouldAutoReconnect = false;
+    _reconnectTimer?.cancel();
+    _reconnectTimer = null;
+    _kernelStatusSub?.cancel();
+    _kernelStatusSub = null;
     if (_kernel is DesktopKernelProcess) {
       (_kernel as DesktopKernelProcess).dispose();
     }
   }
 
+  // ── M5: 退避重连调度 ─────────────────────────────────────────
+
+  /// 安排下一次退避重连。
+  /// 延迟序列：1s → 2s → 4s → 8s → 16s → 30s → 30s → …
+  void _scheduleReconnect() {
+    if (!_shouldAutoReconnect || _lastUserConfigJson == null) return;
+    _reconnectTimer?.cancel();
+
+    final delaySec = _kRetryDelaysSec[
+        _reconnectAttempt.clamp(0, _kRetryDelaysSec.length - 1)];
+    _reconnectAttempt++;
+
+    print(
+        '[DesktopVpnBridge] auto-reconnect in ${delaySec}s (attempt $_reconnectAttempt)');
+
+    _reconnectTimer = Timer(Duration(seconds: delaySec), () async {
+      if (!_shouldAutoReconnect || _lastUserConfigJson == null) return;
+      try {
+        print('[DesktopVpnBridge] auto-reconnect: attempting start...');
+        await start(_lastUserConfigJson!);
+        _reconnectAttempt = 0; // 成功后重置退避计数
+        print('[DesktopVpnBridge] auto-reconnect: success');
+      } catch (e) {
+        print('[DesktopVpnBridge] auto-reconnect: start failed: $e');
+        // start() 失败（内核未能启动）→ 手动调度下一次重试
+        if (_shouldAutoReconnect) _scheduleReconnect();
+      }
+    });
+  }
+
   // ── 内部: Clash API 注入（@visibleForTesting）─────────────────
 
   /// 检查 configJson 中是否有 experimental.clash_api；若无则注入随机端口+secret。
@@ -189,6 +292,39 @@ class DesktopVpnBridge implements VpnBridge {
     return (jsonEncode(updated), port, secret);
   }
 
+  // ── 内部: Kill-switch 注入（@visibleForTesting）──────────────
+
+  /// 将 kill-switch 偏好写入 configJson 的 TUN inbound `strict_route` 字段。
+  ///
+  /// - `killSwitch=true`:  `strict_route: true`（所有流量绑定 TUN，内核停止即断流）
+  /// - `killSwitch=false`: `strict_route: false`（内核停止后流量走默认路由）
+  ///
+  /// 若配置中没有 TUN inbound，原样返回（不修改）。
+  // @visibleForTesting
+  static String applyKillSwitchToConfig(String configJson, bool killSwitch) {
+    late Map<String, dynamic> cfg;
+    try {
+      cfg = jsonDecode(configJson) as Map<String, dynamic>;
+    } catch (_) {
+      return configJson; // 解析失败，原样返回
+    }
+
+    final inbounds = cfg['inbounds'];
+    if (inbounds is! List) return configJson;
+
+    bool changed = false;
+    final updatedInbounds = inbounds.map((ib) {
+      if (ib is Map && ib['type'] == 'tun') {
+        changed = true;
+        return <String, dynamic>{...Map<String, dynamic>.from(ib), 'strict_route': killSwitch};
+      }
+      return ib;
+    }).toList();
+
+    if (!changed) return configJson;
+    return jsonEncode(<String, dynamic>{...cfg, 'inbounds': updatedInbounds});
+  }
+
   // ── 内部: 配置文件写入 ────────────────────────────────────────
 
   // @visibleForTesting

client/lib/bridge/kernel_process.dart

@@ -167,6 +167,70 @@ class ClashApiClient {
     }
   }
 
+  // ── GET /group/<name>/delay ───────────────────────────────────
+  // 触发一次 URLTest 延迟测试并返回结果 {tag: delayMs}。
+  // 注意：此接口会发起真实网络探测，耗时约 timeoutMs。
+  // 若只需读缓存延迟，使用 getProxies() + extractUrltestResults()。
+  Future<Map<String, int>> getGroupDelay(
+    String groupName, {
+    String testUrl = 'http://www.gstatic.com/generate_204',
+    int timeoutMs = 3000,
+  }) async {
+    final uri = Uri.parse('$baseUrl/group/$groupName/delay').replace(
+      queryParameters: {
+        'url': testUrl,
+        'timeout': timeoutMs.toString(),
+      },
+    );
+    final response = await _http
+        .get(uri, headers: _headers)
+        .timeout(Duration(milliseconds: timeoutMs + 2000));
+    if (response.statusCode != 200) {
+      throw HttpException('getGroupDelay($groupName): ${response.statusCode}');
+    }
+    final data = jsonDecode(response.body);
+    if (data is! Map) return {};
+    return data.cast<String, int>();
+  }
+
+  // ── 工具：从 /proxies 响应提取 URLTest 延迟列表 ──────────────
+  // 扫描所有类型为 URLTest 的出口组，提取成员节点的最新 history delay。
+  static List<UrltestResult> extractUrltestResults(
+      Map<String, dynamic> proxiesResponse) {
+    final proxies = proxiesResponse['proxies'];
+    if (proxies is! Map) return const [];
+
+    final results = <UrltestResult>[];
+
+    for (final entry in proxies.entries) {
+      final p = entry.value;
+      if (p is! Map) continue;
+      final type = (p['type'] as String?) ?? '';
+      // URLTest / Fallback 组都有 all 成员列表
+      if (type != 'URLTest' && type != 'Fallback') continue;
+
+      final all = p['all'];
+      if (all is! List) continue;
+
+      for (final memberTag in all) {
+        if (memberTag is! String) continue;
+        final member = proxies[memberTag];
+        if (member is! Map) continue;
+
+        final history = member['history'];
+        if (history is List && history.isNotEmpty) {
+          final last = history.last;
+          if (last is Map) {
+            final delay = (last['delay'] as num?)?.toInt() ?? -1;
+            results.add(UrltestResult(tag: memberTag, delayMs: delay));
+          }
+        }
+      }
+    }
+
+    return results;
+  }
+
   void dispose() => _http.close();
 }
 
@@ -243,6 +307,9 @@ class DesktopKernelProcess implements KernelProcess {
   int _prevUpTotal = 0;
   DateTime _prevPollTime = DateTime.now();
 
+  // 最新 URLTest 延迟列表（每次 stats 轮询时更新）
+  List<UrltestResult> _lastUrltestResults = const [];
+
   final _statusCtrl = StreamController<VpnStatus>.broadcast();
   final _logCtrl = StreamController<String>.broadcast();
   final _statsCtrl = StreamController<VpnStatsEvent>.broadcast();
@@ -327,6 +394,9 @@ class DesktopKernelProcess implements KernelProcess {
         _running = false;
         _statsTimer?.cancel();
         _statsTimer = null;
+        // 清理 Clash API 客户端，确保下次 spawn() 重建干净的客户端
+        _clashApi?.dispose();
+        _clashApi = null;
         _log('[kernel] unexpected exit: code=$code');
         _emitStatus(VpnStatus.error);
       }
@@ -406,6 +476,7 @@ class DesktopKernelProcess implements KernelProcess {
     _prevDownTotal = 0;
     _prevUpTotal = 0;
     _prevPollTime = DateTime.now();
+    _lastUrltestResults = const [];
   }
 
   // ── 就绪等待 ─────────────────────────────────────────────────
@@ -435,7 +506,17 @@ class DesktopKernelProcess implements KernelProcess {
       if (!_running || _statsCtrl.isClosed) return;
       try {
         final now = DateTime.now();
-        final data = await _clashApi!.getConnections();
+
+        // 并行拉取连接统计与 URLTest 延迟（Best-effort：URLTest 失败不影响主统计）
+        final connFuture = _clashApi!.getConnections();
+        final proxiesFuture = _clashApi!.getProxies().then((p) {
+          _lastUrltestResults = ClashApiClient.extractUrltestResults(p);
+        }).catchError((_) {
+          // 读取失败静默跳过，保留上次缓存值
+        });
+
+        final data = await connFuture;
+        await proxiesFuture; // 等 URLTest 解析完再组帧
 
         final downTotal =
             (data['downloadTotal'] as num?)?.toInt() ?? _prevDownTotal;
@@ -462,7 +543,7 @@ class DesktopKernelProcess implements KernelProcess {
             downloadBytes: downTotal,
             uploadSpeed: upSpeed.clamp(0, double.infinity),
             downloadSpeed: downSpeed.clamp(0, double.infinity),
-            urltestResults: const [], // URLTest 节点选优归 11G
+            urltestResults: _lastUrltestResults,
           ));
         }
       } catch (_) {

client/test/bridge/desktop_vpn_bridge_m4m5_test.dart

@@ -0,0 +1,664 @@
+// desktop_vpn_bridge_m4m5_test.dart — M4/M5 功能单元测试
+//
+// 验收条件（tsk_xAQhC1xuCd8x）：
+//   M4 URLTest：
+//     1. ClashApiClient.extractUrltestResults 正确解析 /proxies 响应
+//     2. extractUrltestResults 在无 URLTest 组时返回空列表
+//     3. extractUrltestResults 跳过无 history 的成员
+//     4. ClashApiClient.getGroupDelay 发送正确 GET 请求并解析结果
+//     5. selectOutbound 通过 Clash API PUT /proxies/proxy 切换出口
+//     6. getActiveOutbound 从 /proxies 读取 proxy.now
+//     7. getActiveOutbound 在内核未运行时返回 'auto'
+//   M5 Kill-switch：
+//     8. applyKillSwitchToConfig(true)  设置 TUN strict_route=true
+//     9. applyKillSwitchToConfig(false) 设置 TUN strict_route=false
+//    10. 无 TUN inbound 时 applyKillSwitchToConfig 原样返回
+//    11. setKillSwitch 保存 _killSwitchEnabled 并在 start 时注入 config
+//   M5 退避重连：
+//    12. 内核崩溃推 error → UI 不崩（error 事件流通）
+//    13. 自动重连调度：error 后 _scheduleReconnect 在 1s 内触发（首次延迟）
+//    14. stop() 取消自动重连（不再触发重连）
+//    15. 重连成功后 reconnectAttempt 重置为 0
+
+// ignore_for_file: avoid_print
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+
+import 'package:pangolin_vpn/bridge/kernel_process.dart';
+import 'package:pangolin_vpn/bridge/desktop_vpn_bridge.dart';
+import 'package:pangolin_vpn/bridge/vpn_bridge.dart';
+
+// ══════════════════════════════════════════════════════════════════
+// FakeKernelProcess（复用自 kernel_process_test.dart，支持崩溃模拟）
+// ══════════════════════════════════════════════════════════════════
+
+class FakeKernelProcess implements KernelProcess {
+  FakeKernelProcess({
+    this.shouldFailSpawn = false,
+    this.crashAfterMs,
+  });
+
+  final bool shouldFailSpawn;
+  final int? crashAfterMs; // 若非 null，spawn 成功后在此延迟后模拟崩溃
+
+  bool _running = false;
+  String? lastConfigPath;
+  int spawnCount = 0;
+  int killCount = 0;
+  ClashApiClient? _fakeClashApi;
+
+  final _statusCtrl = StreamController<VpnStatus>.broadcast();
+  final _logCtrl = StreamController<String>.broadcast();
+  final _statsCtrl = StreamController<VpnStatsEvent>.broadcast();
+
+  @override
+  bool get isRunning => _running;
+
+  @override
+  ClashApiClient get clashApiClient =>
+      _fakeClashApi ?? (throw StateError('FakeKernelProcess.clashApiClient: set fakeClashApi first'));
+
+  set fakeClashApi(ClashApiClient c) => _fakeClashApi = c;
+
+  @override
+  Stream<String> get logStream => _logCtrl.stream;
+
+  @override
+  Stream<VpnStatus> get statusStream => _statusCtrl.stream;
+
+  @override
+  Stream<VpnStatsEvent> get statsStream => _statsCtrl.stream;
+
+  @override
+  Future<void> spawn(String configPath) async {
+    lastConfigPath = configPath;
+    spawnCount++;
+    if (shouldFailSpawn) {
+      _emitStatus(VpnStatus.error);
+      throw Exception('fake spawn failure');
+    }
+
+    _running = true;
+    _emitStatus(VpnStatus.connecting);
+    await Future<void>.delayed(const Duration(milliseconds: 10));
+    _emitStatus(VpnStatus.on);
+
+    if (crashAfterMs != null) {
+      Future<void>.delayed(Duration(milliseconds: crashAfterMs!)).then((_) {
+        if (_running) {
+          _running = false;
+          _emitStatus(VpnStatus.error);
+        }
+      });
+    }
+  }
+
+  @override
+  Future<void> kill({Duration gracePeriod = const Duration(seconds: 5)}) async {
+    killCount++;
+    if (_running) {
+      _running = false;
+      _emitStatus(VpnStatus.off);
+    }
+  }
+
+  void emitStats(VpnStatsEvent e) {
+    if (!_statsCtrl.isClosed) _statsCtrl.add(e);
+  }
+
+  /// 手动触发崩溃（error 状态）
+  void simulateCrash() {
+    if (_running) {
+      _running = false;
+      _emitStatus(VpnStatus.error);
+    }
+  }
+
+  void disposeFake() {
+    _statusCtrl.close();
+    _logCtrl.close();
+    _statsCtrl.close();
+  }
+
+  void _emitStatus(VpnStatus s) {
+    if (!_statusCtrl.isClosed) _statusCtrl.add(s);
+  }
+}
+
+// ══════════════════════════════════════════════════════════════════
+// TestBridge: 覆盖 writeConfig，避免写真实文件系统
+// ══════════════════════════════════════════════════════════════════
+
+class _TestBridge extends DesktopVpnBridge {
+  _TestBridge(this.fakeKernel) : super(kernel: fakeKernel);
+
+  final FakeKernelProcess fakeKernel;
+  String? lastWrittenConfig;
+  List<String> allWrittenConfigs = [];
+
+  @override
+  Future<String> writeConfig(String configJson) async {
+    lastWrittenConfig = configJson;
+    allWrittenConfigs.add(configJson);
+    final tmp = Directory.systemTemp.createTempSync('pangolin_m4m5_test_');
+    final f = File('${tmp.path}/config.json')..writeAsStringSync(configJson);
+    return f.path;
+  }
+
+  @override
+  void dispose() {
+    fakeKernel.disposeFake();
+    super.dispose();
+  }
+}
+
+// ══════════════════════════════════════════════════════════════════
+// 测试套件
+// ══════════════════════════════════════════════════════════════════
+
+void main() {
+  // ── M4: ClashApiClient.extractUrltestResults ──────────────────
+  group('M4 ClashApiClient.extractUrltestResults', () {
+    test('1. 正确解析单 URLTest 组的成员延迟', () {
+      final proxiesResp = {
+        'proxies': {
+          'auto-select': {
+            'type': 'URLTest',
+            'now': 'hk-1',
+            'all': ['hk-1', 'sg-1'],
+          },
+          'hk-1': {
+            'type': 'VMess',
+            'alive': true,
+            'history': [
+              {'time': '2024-01-01T00:00:00Z', 'delay': 18},
+            ],
+          },
+          'sg-1': {
+            'type': 'VMess',
+            'alive': true,
+            'history': [
+              {'time': '2024-01-01T00:00:00Z', 'delay': 54},
+            ],
+          },
+        },
+      };
+
+      final results = ClashApiClient.extractUrltestResults(proxiesResp);
+
+      expect(results.length, 2);
+      final tags = results.map((r) => r.tag).toList();
+      expect(tags, containsAll(['hk-1', 'sg-1']));
+      final hk = results.firstWhere((r) => r.tag == 'hk-1');
+      expect(hk.delayMs, 18);
+      final sg = results.firstWhere((r) => r.tag == 'sg-1');
+      expect(sg.delayMs, 54);
+    });
+
+    test('2. 无 URLTest 组时返回空列表', () {
+      final proxiesResp = {
+        'proxies': {
+          'GLOBAL': {
+            'type': 'Selector',
+            'all': ['DIRECT'],
+          },
+          'DIRECT': {'type': 'Direct'},
+        },
+      };
+
+      final results = ClashApiClient.extractUrltestResults(proxiesResp);
+      expect(results, isEmpty);
+    });
+
+    test('3. 跳过无 history 的成员（不崩溃）', () {
+      final proxiesResp = {
+        'proxies': {
+          'auto-select': {
+            'type': 'URLTest',
+            'all': ['ok-node', 'no-history-node'],
+          },
+          'ok-node': {
+            'type': 'VMess',
+            'history': [
+              {'time': '2024-01-01T00:00:00Z', 'delay': 45},
+            ],
+          },
+          'no-history-node': {
+            'type': 'VMess',
+            'history': <Map<String, dynamic>>[],
+          },
+        },
+      };
+
+      final results = ClashApiClient.extractUrltestResults(proxiesResp);
+      // 只有 ok-node 有 history
+      expect(results.length, 1);
+      expect(results.first.tag, 'ok-node');
+      expect(results.first.delayMs, 45);
+    });
+
+    test('4. proxies 为空 Map 时返回空列表', () {
+      final results =
+          ClashApiClient.extractUrltestResults({'proxies': <String, dynamic>{}});
+      expect(results, isEmpty);
+    });
+
+    test('4b. 顶层无 proxies key 时返回空列表', () {
+      final results = ClashApiClient.extractUrltestResults({});
+      expect(results, isEmpty);
+    });
+  });
+
+  // ── M4: ClashApiClient.getGroupDelay ─────────────────────────
+  group('M4 ClashApiClient.getGroupDelay', () {
+    test('5. 发送正确 GET 请求并解析 tag→delayMs', () async {
+      http.Request? capturedReq;
+      final mock = MockClient((req) async {
+        capturedReq = req;
+        return http.Response(
+          jsonEncode({'hk-1': 18, 'sg-1': 54}),
+          200,
+        );
+      });
+
+      final client = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+      final result = await client.getGroupDelay('auto-select');
+
+      expect(capturedReq?.method, 'GET');
+      expect(capturedReq?.url.path, '/group/auto-select/delay');
+      expect(capturedReq?.url.queryParameters['url'],
+          'http://www.gstatic.com/generate_204');
+      expect(result['hk-1'], 18);
+      expect(result['sg-1'], 54);
+
+      client.dispose();
+    });
+
+    test('5b. 自定义 testUrl 和 timeoutMs', () async {
+      http.Request? capturedReq;
+      final mock = MockClient((req) async {
+        capturedReq = req;
+        return http.Response(jsonEncode(<String, dynamic>{}), 200);
+      });
+
+      final client = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+      await client.getGroupDelay('auto-select',
+          testUrl: 'http://example.com', timeoutMs: 5000);
+
+      expect(capturedReq?.url.queryParameters['url'], 'http://example.com');
+      expect(capturedReq?.url.queryParameters['timeout'], '5000');
+
+      client.dispose();
+    });
+
+    test('5c. 非200状态码抛出 HttpException', () async {
+      final mock =
+          MockClient((_) async => http.Response('Not Found', 404));
+      final client = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+
+      await expectLater(
+        client.getGroupDelay('auto-select'),
+        throwsA(isA<HttpException>()),
+      );
+      client.dispose();
+    });
+  });
+
+  // ── M4: selectOutbound & getActiveOutbound ───────────────────
+  group('M4 selectOutbound & getActiveOutbound', () {
+    test('6. selectOutbound 调用 PUT /proxies/proxy', () async {
+      Map<String, dynamic>? sentBody;
+      String? capturedTag;
+
+      final fake = FakeKernelProcess();
+      final mock = MockClient((req) async {
+        if (req.method == 'PUT') {
+          capturedTag = req.url.pathSegments.last;
+          sentBody = jsonDecode(req.body) as Map<String, dynamic>;
+          return http.Response('', 204);
+        }
+        // GET /connections (readiness)
+        return http.Response(
+            jsonEncode({'downloadTotal': 0, 'uploadTotal': 0, 'connections': []}),
+            200);
+      });
+
+      fake.fakeClashApi = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+
+      final bridge = _TestBridge(fake);
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      await bridge.selectOutbound('sg-1');
+
+      expect(capturedTag, 'proxy');
+      expect(sentBody?['name'], 'sg-1');
+
+      bridge.dispose();
+    });
+
+    test('6b. selectOutbound 用 auto-select 可切回 URLTest 自动模式', () async {
+      String? selectedProxy;
+
+      final fake = FakeKernelProcess();
+      final mock = MockClient((req) async {
+        if (req.method == 'PUT') {
+          final body = jsonDecode(req.body) as Map<String, dynamic>;
+          selectedProxy = body['name'] as String?;
+          return http.Response('', 204);
+        }
+        return http.Response(
+            jsonEncode({'downloadTotal': 0, 'uploadTotal': 0, 'connections': []}),
+            200);
+      });
+
+      fake.fakeClashApi = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+
+      final bridge = _TestBridge(fake);
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      await bridge.selectOutbound('auto-select'); // 切回自动
+
+      expect(selectedProxy, 'auto-select');
+      bridge.dispose();
+    });
+
+    test('7. getActiveOutbound 在内核未运行时返回 "auto"', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+
+      final active = await bridge.getActiveOutbound();
+      expect(active, 'auto');
+
+      bridge.dispose();
+    });
+
+    test('7b. getActiveOutbound 从 proxies[proxy][now] 读取', () async {
+      final fake = FakeKernelProcess();
+      final mock = MockClient((req) async {
+        if (req.url.path == '/proxies') {
+          return http.Response(
+            jsonEncode({
+              'proxies': {
+                'proxy': {'type': 'Selector', 'now': 'sg-1'},
+              },
+            }),
+            200,
+          );
+        }
+        return http.Response(
+            jsonEncode({'downloadTotal': 0, 'uploadTotal': 0, 'connections': []}),
+            200);
+      });
+
+      fake.fakeClashApi = ClashApiClient(
+          baseUrl: 'http://127.0.0.1:9090', httpClient: mock);
+
+      final bridge = _TestBridge(fake);
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      final active = await bridge.getActiveOutbound();
+      expect(active, 'sg-1');
+
+      bridge.dispose();
+    });
+  });
+
+  // ── M5: applyKillSwitchToConfig ──────────────────────────────
+  group('M5 applyKillSwitchToConfig', () {
+    const configWithTun = '''{
+      "inbounds": [
+        {"type": "tun", "tag": "tun-in", "strict_route": false}
+      ],
+      "outbounds": [{"type": "direct", "tag": "direct"}]
+    }''';
+
+    test('8. killSwitch=true 设置 TUN strict_route=true', () {
+      final result =
+          DesktopVpnBridge.applyKillSwitchToConfig(configWithTun, true);
+      final decoded = jsonDecode(result) as Map<String, dynamic>;
+      final inbounds = decoded['inbounds'] as List;
+      final tun = inbounds.firstWhere((e) => e['type'] == 'tun') as Map;
+      expect(tun['strict_route'], true);
+    });
+
+    test('9. killSwitch=false 设置 TUN strict_route=false', () {
+      const configWithKsOn = '''{
+        "inbounds": [{"type": "tun", "strict_route": true}]
+      }''';
+      final result =
+          DesktopVpnBridge.applyKillSwitchToConfig(configWithKsOn, false);
+      final decoded = jsonDecode(result) as Map<String, dynamic>;
+      final inbounds = decoded['inbounds'] as List;
+      final tun = inbounds.first as Map;
+      expect(tun['strict_route'], false);
+    });
+
+    test('10. 无 TUN inbound 时原样返回（不抛异常）', () {
+      const noTun = '{"inbounds": [{"type": "http", "listen_port": 7890}]}';
+      final result = DesktopVpnBridge.applyKillSwitchToConfig(noTun, true);
+      // 无 TUN，原样返回
+      expect(jsonDecode(result)['inbounds'][0]['type'], 'http');
+    });
+
+    test('10b. 无效 JSON 原样返回（不抛异常）', () {
+      const invalid = 'not-json';
+      expect(() => DesktopVpnBridge.applyKillSwitchToConfig(invalid, true),
+          returnsNormally);
+    });
+
+    test('10c. 保留非 TUN inbound 及其他 config 字段', () {
+      const multi = '''{
+        "log": {"level": "info"},
+        "inbounds": [
+          {"type": "mixed", "listen_port": 7890},
+          {"type": "tun", "strict_route": false}
+        ]
+      }''';
+      final result = DesktopVpnBridge.applyKillSwitchToConfig(multi, true);
+      final decoded = jsonDecode(result) as Map<String, dynamic>;
+      expect((decoded['log'] as Map)['level'], 'info');
+      final inbounds = decoded['inbounds'] as List;
+      expect(inbounds.length, 2);
+      expect(inbounds[0]['type'], 'mixed'); // 非 TUN 保留不变
+      expect(inbounds[1]['strict_route'], true);
+    });
+  });
+
+  // ── M5: setKillSwitch 注入行为 ───────────────────────────────
+  group('M5 setKillSwitch config injection', () {
+    test('11. start 时默认 killSwitch=false 保持原 strict_route 值', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+
+      const cfg = '{"inbounds":[{"type":"tun","strict_route":true}]}';
+      await bridge.start(cfg);
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      // killSwitch=false → strict_route=false
+      final written = jsonDecode(bridge.lastWrittenConfig!) as Map<String, dynamic>;
+      final tun = (written['inbounds'] as List)
+          .firstWhere((e) => e['type'] == 'tun') as Map;
+      expect(tun['strict_route'], false);
+
+      bridge.dispose();
+    });
+
+    test('11b. setKillSwitch(on: true) 后 start 注入 strict_route=true', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+
+      await bridge.setKillSwitch(on: true);
+      const cfg = '{"inbounds":[{"type":"tun","strict_route":false}]}';
+      await bridge.start(cfg);
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      final written = jsonDecode(bridge.lastWrittenConfig!) as Map<String, dynamic>;
+      final tun = (written['inbounds'] as List)
+          .firstWhere((e) => e['type'] == 'tun') as Map;
+      expect(tun['strict_route'], true);
+
+      bridge.dispose();
+    });
+
+    test('11c. setKillSwitch(on: X) 相同值时不重复重载', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+
+      const cfg = '{"inbounds":[{"type":"tun","strict_route":false}]}';
+      await bridge.start(cfg);
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+      final spawnsBefore = fake.spawnCount;
+
+      await bridge.setKillSwitch(on: false); // 已经是 false，不触发重载
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      expect(fake.spawnCount, spawnsBefore); // spawn 次数不变
+
+      bridge.dispose();
+    });
+  });
+
+  // ── M5: 自动退避重连 ─────────────────────────────────────────
+  group('M5 auto-reconnect with backoff', () {
+    test('12. 内核崩溃推 error → UI 不崩，error 事件可订阅', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+      final events = <VpnStatus>[];
+
+      final sub = bridge.statusStream.listen(events.add);
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      fake.simulateCrash(); // 模拟内核崩溃
+      await Future<void>.delayed(const Duration(milliseconds: 10));
+
+      expect(events, contains(VpnStatus.error));
+      expect(() => bridge.dispose(), returnsNormally);
+
+      await sub.cancel();
+    });
+
+    test('13. error 后在首次退避延迟内触发重连（spawn 次数 +1）', () async {
+      final fake = FakeKernelProcess(crashAfterMs: 50);
+      final bridge = _TestBridge(fake);
+
+      await bridge.start('{"log":{}}');
+      final spawnsAfterStart = fake.spawnCount;
+
+      // 等待崩溃（50ms）+ 首次退避（1s）+ buffer
+      await Future<void>.delayed(const Duration(milliseconds: 1200));
+
+      expect(fake.spawnCount, greaterThan(spawnsAfterStart),
+          reason: '应该触发至少一次自动重连');
+
+      bridge.dispose();
+    });
+
+    test('14. stop() 之后不再触发自动重连', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+      await bridge.stop(); // 先停止
+
+      final spawnsAfterStop = fake.spawnCount;
+
+      fake.simulateCrash(); // 此时已 stop，不应触发重连
+      await Future<void>.delayed(const Duration(milliseconds: 1200));
+
+      expect(fake.spawnCount, equals(spawnsAfterStop),
+          reason: 'stop 后崩溃不应再触发自动重连');
+
+      bridge.dispose();
+    });
+
+    test('15. stats 流在 on 状态下转发内核事件', () async {
+      final fake = FakeKernelProcess();
+      final bridge = _TestBridge(fake);
+      final statsReceived = <VpnStatsEvent>[];
+
+      final sub = bridge.statsStream.listen(statsReceived.add);
+      await bridge.start('{"log":{}}');
+      await Future<void>.delayed(const Duration(milliseconds: 30));
+
+      const frame = VpnStatsEvent(
+        uploadBytes: 2048,
+        downloadBytes: 8192,
+        uploadSpeed: 1024.0,
+        downloadSpeed: 4096.0,
+        urltestResults: [
+          UrltestResult(tag: 'hk-1', delayMs: 18),
+          UrltestResult(tag: 'sg-1', delayMs: 54),
+        ],
+      );
+      fake.emitStats(frame);
+      await Future<void>.delayed(const Duration(milliseconds: 10));
+
+      expect(statsReceived, hasLength(1));
+      expect(statsReceived[0].urltestResults, hasLength(2));
+      expect(statsReceived[0].urltestResults[0].tag, 'hk-1');
+      expect(statsReceived[0].urltestResults[0].delayMs, 18);
+
+      await sub.cancel();
+      bridge.dispose();
+    });
+  });
+
+  // ── M4: UrltestResult / VpnStatsEvent 模型 ───────────────────
+  group('M4 UrltestResult model', () {
+    test('fromMap / toMap 往返', () {
+      const r = UrltestResult(tag: 'hk-01', delayMs: 18);
+      final map = r.toMap();
+      final r2 = UrltestResult.fromMap(map);
+      expect(r2.tag, 'hk-01');
+      expect(r2.delayMs, 18);
+    });
+
+    test('VpnStatsEvent.fromMap 解析 urltestResults 列表', () {
+      final map = {
+        'uploadBytes': 100,
+        'downloadBytes': 200,
+        'uploadSpeed': 10.0,
+        'downloadSpeed': 20.0,
+        'urltestResults': [
+          {'tag': 'hk-1', 'delayMs': 18},
+          {'tag': 'sg-1', 'delayMs': 54},
+        ],
+      };
+      final event = VpnStatsEvent.fromMap(map);
+      expect(event.urltestResults.length, 2);
+      expect(event.urltestResults[0].tag, 'hk-1');
+      expect(event.urltestResults[1].delayMs, 54);
+    });
+
+    test('VpnStatsEvent.fromNativeMap 处理 Map<Object?, Object?>', () {
+      final rawMap = <Object?, Object?>{
+        'uploadBytes': 1024,
+        'downloadBytes': 2048,
+        'uploadSpeed': 512.0,
+        'downloadSpeed': 1024.0,
+        'urltestResults': <Object?>[
+          <Object?, Object?>{'tag': 'jp-1', 'delayMs': 32},
+        ],
+      };
+      final event = VpnStatsEvent.fromNativeMap(rawMap);
+      expect(event.urltestResults.length, 1);
+      expect(event.urltestResults[0].tag, 'jp-1');
+    });
+  });
+}