[MddIdd]

Summary

A previously healthy country exit can become unreachable while retaining listener-ready status. The freeze policy deliberately keeps an exit that carried IMS for a long time, but subsequent egress_unavailable startup failures only scheduled another rebuild. The line could therefore retry the same dead node indefinitely.

After an automatic recovery start fails, validate the current container SOCKS exit with the existing DNS/STUN UDP probes. Three attributed failures use the existing bounded node-selection policy, irrespective of historical uptime; a successful probe clears that node's strikes. Exhausting the pool keeps hourly backoff. Carrier DNS problems alone, configuration errors and engine failures are not evidence against a node.

Probe evidence is tied to a fresh configuration fingerprint, selected node/tag and listener endpoint, and rechecked before attribution. Manual pins, direct/host routes, pools without alternatives, registered same-country peers and user cancellation prevent this recovery path from changing the exit. Probes run off the event loop and only after failed starts. Normal freeze attribution remains conservative.

CI also identified the existing Vite 6.4.3 audit failure. The lockfile now selects the compatible 6.4.5 patch; npm audit reports zero vulnerabilities and the rebuilt static asset names are unchanged.

Validation

• 278 focused regression tests passed, including 16 new recovery cases.
• Python compilation, subscriber-identifier scan and WebUI build passed.
• Standard Linux CI passed all 2,047 Python tests on control-code commit b3f2b01 (198.4 seconds). The subsequent commit only updates the Vite lockfile and changelog; its CI is running.
• Additional isolated NAS validation ran 2,041 tests without production data or device mounts. One unchanged timestamp-dependent idle-backoff test fails on this NAS kernel; the six Git-hook tests unavailable in that image pass locally. No recovery regression failed.

NAS rollout

Applied local Control overlay mdd-sim-gateway/control:v1.14.0-exit-failover-20261022 on the existing v1.14.0 image after checking that both lines had no active calls. Both engine containers retained their running generations and both US/UK IMS registrations remain registered. A live independent UDP probe of the selected US exit succeeds.

Rollback Compose backup: /volume1/docker/mdd-sim-gateway/backups/compose-before-exit-failover-20261022.yaml. Rollout metadata: /volume1/docker/mdd-sim-gateway/backups/exit-failover-20261022.json. Restoring that Compose backup and recreating only control returns to the original v1.14.0 Control image. An official upgrade can replace this local overlay; this PR targets develop for inclusion in a release.

Safety and privacy impact

• No real SIM identity, phone number, PIN, token, subscription URL, message or call data is included.
• Device-changing operations fail closed and report actual state.
• User-visible changes are documented.
• Python tests and WebUI build pass. (Standard Linux CI and additional environment-specific validation are detailed above.)