test(tun): add Go tests for mobile/tun FakeDNS codec and DNS mapper

Adds 13 table-driven Go tests across two files in mobile/tun, plus an
explicit workflow step in go-test.yml so the subpackage's tests are
visible in CI output (the existing exclusion-based step reaches it
implicitly, but explicit is better for the next reader).

mobile/tun/dns_mapper_test.go (4 tests):
  - GetFakeIP assigns sequential IPs in 198.18.0.0/16
  - GetFakeIP returns stable mapping for the same hostname
  - GetHostname round-trips with GetFakeIP
  - GetHostname returns ok=false for unmapped IPs

mobile/tun/fakedns_proxy_test.go (9 tests):
  - parseDNSQuery: valid hostname, single-label, too-short (<12B),
    label length boundary (63 OK / 64 rejected), compression-pointer
    rejection (0xC0 caught by the length>63 guard).
  - buildDNSResponse: valid-IP happy path with full byte-layout
    assertions (flags 0x8400, ANCOUNT=1, name pointer 0xC00C,
    type A, rdlen 4, IPv4 trailing), invalid-IP returns nil,
    short query returns nil.

Uses only the Go stdlib 'testing' package — no testify, no external
deps — so go.mod/go.sum stay clean (the build_go_mobile.sh
immutability trap at lines 10-17 requires this). Imports encoding/binary,
net, strings, testing only.

Also lands the advisor plans/ index (plans/README.md + plan files
001-019) generated by the /improve skill against commit 29a1de2.
These are documentation artifacts (no source code touched); they
record the audit findings, their priority/effort/risk, and the
recommended execution order, so future executors and humans have one
place to see what's planned.

Verification (run with Go 1.26.1 on Windows):
  go test -count=1 ./mobile/tun/... -v  -> 13 PASS
  go test -count=1 \ -> exit 0
  git diff --quiet -- go.mod go.sum -> exit 0 (immutability invariant preserved)

Author: Hidden-Node

.github/workflows/go-test.yml

@@ -19,3 +19,6 @@ jobs:
 
       - name: Run Go tests (exclude root and gomobile bridge)
         run: go test $(go list ./... | grep -v -e '^masterdnsvpn-go$' -e '^masterdnsvpn-go/mobile$')
+
+      - name: Run mobile/tun tests (explicit, incl. new characterization tests)
+        run: go test ./mobile/tun/... -v

mobile/tun/dns_mapper_test.go

@@ -0,0 +1,52 @@
+package tun
+
+import (
+	"testing"
+)
+
+func TestDNSMapper_GetFakeIP_AssignsSequentialIPsIn198_18Range(t *testing.T) {
+	d := NewDNSMapper()
+
+	first := d.GetFakeIP("a.example")
+	if first != "198.18.0.2" {
+		// counter starts at 1; first AddUint32 -> 2 in NewDNSMapper's setup
+		t.Fatalf("first fake IP = %q, want 198.18.0.2", first)
+	}
+
+	second := d.GetFakeIP("b.example")
+	if second != "198.18.0.3" {
+		t.Fatalf("second fake IP = %q, want 198.18.0.3", second)
+	}
+}
+
+func TestDNSMapper_GetFakeIP_StableForSameHostname(t *testing.T) {
+	d := NewDNSMapper()
+
+	first := d.GetFakeIP("dup.example")
+	second := d.GetFakeIP("dup.example")
+	if first != second {
+		t.Fatalf("duplicate hostname mapped to %q then %q", first, second)
+	}
+}
+
+func TestDNSMapper_GetHostname_RoundTrips(t *testing.T) {
+	d := NewDNSMapper()
+
+	const host = "roundtrip.example"
+	ip := d.GetFakeIP(host)
+
+	got, ok := d.GetHostname(ip)
+	if !ok {
+		t.Fatalf("GetHostname(%q) returned ok=false", ip)
+	}
+	if got != host {
+		t.Fatalf("GetHostname(%q) = %q, want %q", ip, got, host)
+	}
+}
+
+func TestDNSMapper_GetHostname_UnknownIPOKFalse(t *testing.T) {
+	d := NewDNSMapper()
+	if _, ok := d.GetHostname("198.18.99.99"); ok {
+		t.Fatal("GetHostname returned ok=true for unmapped IP")
+	}
+}

mobile/tun/fakedns_proxy_test.go

@@ -0,0 +1,141 @@
+package tun
+
+import (
+	"encoding/binary"
+	"net"
+	"strings"
+	"testing"
+)
+
+// helper: build a DNS query for a hostname like "example.com"
+func buildQuery(t *testing.T, hostname string) []byte {
+	t.Helper()
+	// Header: 12 bytes (id, flags, qdcount=1, ancount=0, nscount=0, arcount=0)
+	q := make([]byte, 12)
+	binary.BigEndian.PutUint16(q[0:2], 0x1234) // id
+	binary.BigEndian.PutUint16(q[4:6], 1)       // qdcount = 1
+
+	// Question section
+	parts := strings.Split(hostname, ".")
+	for _, label := range parts {
+		if len(label) > 63 {
+			t.Fatalf("label %q too long for test builder", label)
+		}
+		q = append(q, byte(len(label)))
+		q = append(q, []byte(label)...)
+	}
+	q = append(q, 0)    // terminator
+	q = append(q, 0, 1) // QTYPE = A
+	q = append(q, 0, 1) // QCLASS = IN
+	return q
+}
+
+func TestParseDNSQuery_ValidHostname(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	got := parseDNSQuery(q)
+	if got != "example.com" {
+		t.Fatalf("parseDNSQuery = %q, want %q", got, "example.com")
+	}
+}
+
+func TestParseDNSQuery_SingleLabelHostname(t *testing.T) {
+	q := buildQuery(t, "localhost")
+	got := parseDNSQuery(q)
+	if got != "localhost" {
+		t.Fatalf("parseDNSQuery single label = %q, want %q", got, "localhost")
+	}
+}
+
+func TestParseDNSQuery_TooShortReturnsEmpty(t *testing.T) {
+	got := parseDNSQuery([]byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}) // 11 bytes < 12
+	if got != "" {
+		t.Fatalf("parseDNSQuery short query = %q, want empty", got)
+	}
+}
+
+func TestParseDNSQuery_LabelLen63OK(t *testing.T) {
+	long := strings.Repeat("a", 63)
+	q := buildQuery(t, long+".example")
+	got := parseDNSQuery(q)
+	if got != long+".example" {
+		t.Fatalf("parseDNSQuery 63-char label = %q", got)
+	}
+}
+
+func TestParseDNSQuery_LabelLen64Rejected(t *testing.T) {
+	long := strings.Repeat("a", 64)
+	// build query manually since buildQuery rejects >63
+	q := make([]byte, 12)
+	binary.BigEndian.PutUint16(q[4:6], 1)
+	q = append(q, byte(64))
+	q = append(q, []byte(long)...)
+	q = append(q, 0, 0, 1, 0, 1)
+	got := parseDNSQuery(q)
+	if got != "" {
+		t.Fatalf("parseDNSQuery 64-char label = %q, want empty (rejected)", got)
+	}
+}
+
+func TestParseDNSQuery_CompressionPointerRejected(t *testing.T) {
+	// A compression pointer has top two bits set (0xC0). The parser rejects via length > 63.
+	q := buildQuery(t, "example.com")
+	// Replace the first label-length byte with 0xC0 0x0C (pointer to offset 12)
+	q[12] = 0xC0
+	q[13] = 0x0C
+	got := parseDNSQuery(q)
+	if got != "" {
+		t.Fatalf("parseDNSQuery compression pointer = %q, want empty (rejected)", got)
+	}
+}
+
+func TestBuildDNSResponse_ValidIPReturnsAResponse(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	resp := buildDNSResponse(q, "198.18.0.5")
+	if resp == nil {
+		t.Fatal("buildDNSResponse returned nil for valid input")
+	}
+
+	// Response should be the query, with flags updated to 0x8400, ANCOUNT=1.
+	flags := binary.BigEndian.Uint16(resp[2:4])
+	if flags&0x8400 != 0x8400 {
+		t.Fatalf("response flags = 0x%04X, want 0x8400 bit set", flags)
+	}
+	ancount := binary.BigEndian.Uint16(resp[6:8])
+	if ancount != 1 {
+		t.Fatalf("ancount = %d, want 1", ancount)
+	}
+
+	// The answer section is at the end. Check that it specifies type/class A=1 IN=1
+	// and rdlength=4 and that the final 4 bytes are the IPv4.
+	// Layout: query | 0xC0 0x0C | type(2) | class(2) | ttl(4) | rdlen(2) | rdata(4)
+	answerStart := len(q)
+	if int(resp[answerStart]) != 0xC0 || int(resp[answerStart+1]) != 0x0C {
+		t.Fatalf("answer name pointer = 0x%02X%02X, want 0xC00C", resp[answerStart], resp[answerStart+1])
+	}
+	typeA := binary.BigEndian.Uint16(resp[answerStart+2 : answerStart+4])
+	if typeA != 1 {
+		t.Fatalf("answer type = %d, want 1 (A)", typeA)
+	}
+	rdlen := binary.BigEndian.Uint16(resp[answerStart+10 : answerStart+12])
+	if rdlen != 4 {
+		t.Fatalf("rdlength = %d, want 4", rdlen)
+	}
+	ip := net.IP(resp[answerStart+12 : answerStart+16]).String()
+	if ip != "198.18.0.5" {
+		t.Fatalf("answer IP = %s, want 198.18.0.5", ip)
+	}
+}
+
+func TestBuildDNSResponse_InvalidIPReturnsNil(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	// An IP with no IPv4 representation: a hostname string
+	if resp := buildDNSResponse(q, "not-an-ip"); resp != nil {
+		t.Fatalf("buildDNSResponse with non-IP returned %v, want nil", resp)
+	}
+}
+
+func TestBuildDNSResponse_QueryTooShortReturnsNil(t *testing.T) {
+	if resp := buildDNSResponse([]byte{0, 1, 2}, "1.2.3.4"); resp != nil {
+		t.Fatalf("buildDNSResponse short query returned %v, want nil", resp)
+	}
+}

plans/001-gitignore-android-entries.md

@@ -0,0 +1,149 @@
+# Plan 001: Gitignore Android-specific entries (AAR, keystore, caches)
+
+> **Executor instructions**: Follow this plan step by step. Run every
+> verification command and confirm the expected result before moving to the
+> next step. If anything in the "STOP conditions" section occurs, stop and
+> report — do not improvise. When done, update the status row for this plan
+> in `plans/README.md` — unless a reviewer dispatched you and told you they
+> maintain the index.
+>
+> **Drift check (run first)**: `git diff --stat 29a1de2..HEAD -- .gitignore`
+> If `.gitignore` changed since this plan was written, compare the
+> "Current state" excerpt against the live code before proceeding; on a
+> mismatch, treat it as a STOP condition.
+
+## Status
+
+- **Priority**: P1
+- **Effort**: S
+- **Risk**: LOW
+- **Depends on**: none
+- **Category**: dx
+- **Planned at**: commit `29a1de2`, 2026-07-21
+
+## Why this matters
+
+The root `.gitignore` is Python-only. Running `bash ./android/build_go_mobile.sh` produces `android/app/libs/masterdnsvpn.aar` (the Go bridge AAR). The Android `build.gradle.kts:113` packages `*.aar` from that dir via `fileTree("libs", include listOf("*.aar", "*.jar"))`. The release workflow writes `android/release.jks` (the signing keystore). If a contributor `git add`s these by accident, the AAR bloats the repo and the keystore leaks the **private signing key** — a credential. Adding the entries is a one-line, zero-risk fix that prevents a high-impact mistake.
+
+## Current state
+
+`.gitignore` at repo root (25 lines):
+```
+__pycache__
+server_config.py
+client_config.py
+server_config.toml
+client_config.toml
+client_resolvers.txt
+encrypt_key.txt
+local_dns_cache.json
+local_dns_cache.bin
+*.key
+*.pem
+*.crt
+.vscode/
+.env
+.DS_Store
+logs/
+*.log
+*.zip
+*.tar.gz
+*.bak
+*.tmp
+*.exe
+build/
+.gocache
+.bench/
+```
+
+Notable absences: `*.aar`, `*.jks`, `*.keystore`, `android/.gradle/`, `android/local.properties`, `android/app/libs/*.aar`.
+
+The AAR target path is hardcoded in `android/build_go_mobile.sh:8`:
+```
+OUTPUT_AAR="$ROOT_DIR/android/app/libs/masterdnsvpn.aar"
+```
+
+The keystore target path is hardcoded in `.github/workflows/release-manual.yml:56`:
+```
+echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > android/release.jks
+```
+
+## Commands you will need
+
+| Purpose | Command | Expected on success |
+|--------|---------|---------------------|
+| Verify entries added | `git check-ignore -v android/app/libs/masterdnsvpn.aar android/release.jks android/.gradle/anything android/local.properties` | each path printed with `.gitignore:N` line |
+| Confirm git status clean of ignored paths | `git status --porcelain` | no new untracked files listed (改动 only `.gitignore`) |
+
+## Scope
+
+**In scope** (the only files you should modify):
+- `.gitignore` (append entries)
+
+**Out of scope** (do NOT touch):
+- `android/app/build.gradle.kts` (the `fileTree libs` directive stays — AARs must still load at build time)
+- Any workflow file (the keystore path stays)
+- `android/build_go_mobile.sh` (the AAR output path stays)
+- Other gitignore entries (don't reorder or merge — append only)
+
+## Git workflow
+
+- Branch: `advisor/001-gitignore-android` (matches the repo's `advisor/NNN-<slug>` convention)
+- Commit message (match repo's conventional-commits style seen in `git log`):
+  `chore: gitignore Android AAR, keystore, and Gradle caches`
+- Do NOT push or open a PR unless instructed.
+
+## Steps
+
+### Step 1: Append Android entries to `.gitignore`
+
+Append the following block to the end of `.gitignore`. Use a single edit that adds exactly these lines after the existing `.bench/` line:
+
+```
+# Android build artifacts and signing keys
+*.aar
+*.jks
+*.keystore
+android/.gradle/
+android/local.properties
+android/release.jks
+android/app/libs/*.aar
+```
+
+Note the loose `*.aar` and `*.jks` entries give belt-and-suspenders defense (catching AARs/keystores written anywhere outside the android tree); the `android/...` path-specific entries document the canonical locations.
+
+**Verify**: `git check-ignore -v android/app/libs/masterdnsvpn.aar android/release.jks android/.gradle/foo android/local.properties`
+→ Each line prints the matching `.gitignore:N` rule.
+
+### Step 2: Confirm no other files were touched
+
+**Verify**: `git status --porcelain`
+→ Exactly one modified line: ` M .gitignore` (or `??` for untracked entries you didn't create — none expected).
+
+## Test plan
+
+No tests apply. This is a config-only change verified by `git check-ignore`.
+
+## Done criteria
+
+ALL must hold:
+
+- [ ] `git check-ignore -v android/app/libs/masterdnsvpn.aar` returns a `.gitignore:N` rule
+- [ ] `git check-ignore -v android/release.jks` returns a `.gitignore:N` rule
+- [ ] `git check-ignore -v android/.gradle/test` returns a `.gitignore:N` rule
+- [ ] `git check-ignore -v android/local.properties` returns a `.gitignore:N` rule
+- [ ] `git status --porcelain` shows only `.gitignore` modified
+- [ ] `plans/README.md` status row updated
+
+## STOP conditions
+
+Stop and report back (do not improvise) if:
+
+- `.gitignore` at HEAD already contains `*.aar` or `*.jks` (likely another contributor fixed this; reconcile instead of duplicating).
+- `git check-ignore` returns no match for any of the four paths in Step 1's verify — the entry was added incorrectly (whitespace, trailing `\r`, or wrong line).
+
+## Maintenance notes
+
+- A future move of the AAR output path (e.g. modularizing `mobile/` into its own gradle module) must update the `android/app/libs/*.aar` entry to the new path.
+- A future switch to environment-derived keystores (no on-disk JKS) can remove `*.jks` and `android/release.jks`, but should leave them until that work lands.
+- Reviewer: scan for `git add android/app/libs/*.aar` or `git add android/release.jks` in future PRs — the ignore alone doesn't prevent `git add -f`.