Divaaaan · Divaaaan · Sep 13, 2026 · Sep 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,13 +4,48 @@ All notable changes to Tenebra are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows
 [Semantic Versioning](https://semver.org/).
 
-> **Early days.** Tenebra is at 0.x: the desktop clients (Windows and macOS) are
+> **Early days.** Tenebra is at 0.x: the desktop clients are
 > the current focus — see the
-> [project status](README.md#project-status). Expect breaking changes between
+> [project status](README.md#project-status-and-known-limits). Expect breaking changes between
 > 0.x releases.
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-13
+
+### Changed
+
+- Redesigned the simple and full desktop interfaces, with clearer subscription
+  setup, server selection, connection feedback, settings and diagnostics.
+- Improved keyboard navigation, compact layouts, themes and Russian/English text.
+- Added persistent Windows protection through WFP, with the saved preference,
+  confirmed enforcement and cleanup errors shown separately. Explicit
+  Disconnect releases Tenebra's policy.
+
+### Fixed
+
+- Failed TCP probes no longer prevent manual server selection or claim that
+  the server's VPN protocol cannot connect.
+- Windows service communication verifies the installed service identity and
+  supports ordinary users and administrators, with bounded request waits.
+- System proxy handling tracks the owning user and retains restoration data.
+- Windows installation no longer falsely fails while waiting for service stop
+  in a fresh PowerShell process.
+- Split settings survive routing changes; unusable multihop chains are rejected
+  and repeated engine-crash recovery attempts are bounded.
+
+### Verification scope
+
+This release was published with an explicitly limited acceptance scope.
+Windows installation/upgrade/repair/removal, ordinary-user UI, IPv4 traffic,
+system-proxy restoration and selected engine/service failure cases were checked.
+The complete IPv6, BFE, reboot and other protection matrix remains open.
+The original unavailable-server report and real-world DPI effectiveness have
+not been causally verified. macOS/Linux build checks are not native tunnel
+acceptance. Android and iOS are outside this release.
+
+See the [published release and its verification notice](https://github.com/Divaaaan/tenebra/releases/tag/v0.6.0).
+
 ## [0.5.11] - 2026-08-31
 
 ### Fixed
@@ -1481,7 +1516,9 @@ Initial tagged release.
   first run. Updates delivered in-app are minisign-verified against the bundled
   key; only the initial download is unsigned.
 
-[Unreleased]: https://github.com/Divaaaan/tenebra/compare/v0.5.10...HEAD
+[Unreleased]: https://github.com/Divaaaan/tenebra/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/Divaaaan/tenebra/compare/v0.5.11...v0.6.0
+[0.5.11]: https://github.com/Divaaaan/tenebra/compare/v0.5.10...v0.5.11
 [0.5.10]: https://github.com/Divaaaan/tenebra/compare/v0.5.5...v0.5.10
 [0.5.5]: https://github.com/Divaaaan/tenebra/compare/v0.5.4...v0.5.5
 [0.5.4]: https://github.com/Divaaaan/tenebra/compare/v0.5.3...v0.5.4

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -18,7 +18,7 @@ By contributing you agree your work is licensed under the project's license,
 - **Triage** — reproducing issues and narrowing them down.
 
 Highest-leverage areas right now (see
-[the status table](README.md#project-status)):
+[the project status](README.md#project-status-and-known-limits)):
 
 1. **Live tunnel bring-up** on Windows (wintun + sing-box, elevated).
 2. **New platform adapters** — macOS/Linux (utun), Android (`VpnService`),

diff --git a/README.md b/README.md
diff --git a/README.ru.md b/README.ru.md
@@ -0,0 +1,77 @@
+<div align="center">
+
+<img src="docs/assets/hero.png" alt="Tenebra" width="100%">
+
+**VPN-клиент для компьютера на базе [sing-box](https://github.com/SagerNet/sing-box).**
+
+Подключите свою подписку или совместимую ссылку на сервер. В Tenebra нет встроенных VPN-серверов, и аккаунт Tenebra не нужен.
+
+[English](README.md) · **Русский**
+
+[![Скачать для Windows 0.6.0](https://img.shields.io/badge/Скачать_для_Windows-v0.6.0-ff3d00?style=for-the-badge)](https://github.com/Divaaaan/tenebra/releases/download/v0.6.0/Tenebra_0.6.0_x64-setup.exe)
+
+Windows x64 · [Все сборки](https://github.com/Divaaaan/tenebra/releases/latest) · [Что нового в 0.6.0](CHANGELOG.md#060---2026-09-13)
+
+[![CI](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml/badge.svg)](https://github.com/Divaaaan/tenebra/actions/workflows/ci.yml)
+[![Лицензия: GPL v3](https://img.shields.io/badge/license-GPLv3-ff3d00.svg)](LICENSE)
+
+</div>
+
+| Платформа | Перед установкой |
+| --- | --- |
+| **Windows** | Установщик настраивает фоновую службу. Подписи Authenticode нет; SmartScreen может показать предупреждение. |
+| **macOS / Linux** | Для опытных пользователей: нужна привилегированная служба; способ настройки зависит от пакета. Работа реального туннеля 0.6.0 на этих платформах не подтверждена. [Инструкция](docs/installation.md). |
+| **Android / iOS** | Не входят в релиз 0.6.0. Android — экспериментальный клиент; iOS — заготовка. |
+
+<img src="docs/assets/eclipse.svg" alt="Анимированное затмение: in tenebris lux." width="100%">
+
+## Два режима интерфейса
+
+**Полный режим** — подключение, серверы, маршрутизация и диагностика под рукой.
+
+<img src="docs/assets/desktop-advanced.png" alt="Полный интерфейс Tenebra 0.6.0 с демонстрационными данными" width="100%">
+
+*Интерфейс 0.6.0 с демонстрационными данными; это не результат измерения реального подключения.*
+
+<details>
+<summary><strong>Простой режим</strong> — подписка, сервер и подключение в одном сценарии</summary>
+
+<img src="docs/assets/desktop-simple.png" alt="Простой интерфейс Tenebra 0.6.0 с демонстрационными данными" width="100%">
+
+*Интерфейс 0.6.0 с демонстрационными данными; это не результат измерения реального подключения.*
+
+</details>
+
+## Подключение за три шага
+
+1. **Установите и откройте Tenebra.** На macOS и Linux сначала [настройте службу](docs/installation.md).
+2. **Импортируйте подписку или ссылку на сервер.** Вставьте URL или ссылку подключения, откройте текстовый файл либо изображение QR-кода. Данные подключения выдаёт ваш провайдер; также можно использовать собственный сервер.
+3. **Выберите сервер и подключитесь.** Режим **Smart** оставляет российские и локальные адреса напрямую, а остальной трафик отправляет в туннель. Для маршрутизации через туннель выберите **Global**.
+
+## Возможности
+
+- **Разные форматы импорта.** Ссылки VLESS/REALITY, Hysteria2, Shadowsocks, Trojan и VMess; списки подписок, base64 и конфигурации Clash/Mihomo YAML.
+- **Настройка маршрутов.** Режимы Smart, Global и Direct, списки приложений для включения в туннель или исключения из него.
+- **Перебор подключений.** Сначала проверяется последний рабочий узел, затем доступные альтернативы по протоколам.
+- **Обход DPI в Windows.** Интеграция с zapret, встроенная сборка и управление обновлениями. Результат зависит от сети. [Как это устроено](docs/dpi-bypass.md).
+- **Диагностика.** Проверка наблюдаемого публичного IP, ограниченная проверка DNS, журналы и отдельные сообщения об ошибках службы, движка и подключения.
+- **Управление с рабочего стола.** Меню в трее, профили, графики трафика, светлая и тёмная темы, русский и английский интерфейсы.
+
+## Состояние проекта и ограничения
+
+**0.6.0 — ранний релиз для компьютеров.** Зафиксированные проверки Windows охватывают девять шагов установки, оба интерфейса под обычным пользователем при масштабе 100% и 150%, IPv4-туннель, работу системного прокси и отдельные сценарии сбоя и восстановления. Это ограниченный объём приёмки: он не подтверждает совместимость с любой подпиской или сетью.
+
+- **Защита Windows:** полная матрица проверок IPv6, BFE и перезагрузки ещё не закрыта. Сохранённая настройка защиты отделена от подтверждённого состояния её применения; она не означает универсальную гарантию отсутствия утечек. [Подробности приёмки](docs/host-protection-acceptance.md).
+- **macOS и Linux:** сборки доступны, но проверка реального туннеля на этих платформах не завершена. macOS не имеет подписи и нотарификации; режим системного прокси в Linux не поддерживается.
+- **AmneziaWG:** ссылки импортируются, но стандартный движок в комплекте не применяет параметры маскировки AWG — соединение работает как обычный WireGuard.
+- **Диагностика:** проверка IP/DNS показывает доступные наблюдения и не подтверждает безопасность всех путей трафика.
+
+## Документация и помощь
+
+[Установка](docs/installation.md) · [Обход DPI](docs/dpi-bypass.md) · [Документация](docs/README.md) · [История изменений](CHANGELOG.md) · [Планы](ROADMAP.md)
+
+Вопросы можно задать в [Discussions](https://github.com/Divaaaan/tenebra/discussions). Об ошибках сообщайте через [форму issue](https://github.com/Divaaaan/tenebra/issues/new/choose): укажите версию, операционную систему и нужный фрагмент журнала. Перед отправкой удалите ссылки подписок, учётные данные и другую приватную информацию. Для сообщений об уязвимостях есть [SECURITY.md](SECURITY.md).
+
+Для сборки и участия в разработке: [руководство разработчика](docs/development.md), [архитектура](docs/architecture.md) и [CONTRIBUTING.md](CONTRIBUTING.md). Подробные технические документы пока на английском.
+
+Проект развивается в свободное время; сроки ответа могут различаться. Лицензия — [GPLv3](LICENSE). Сторонние компоненты перечислены в [Third-party notices](THIRD-PARTY-NOTICES.md).
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -37,7 +37,7 @@ Working today on the Windows, macOS and Linux desktop clients:
   release replaces it once upstream publishes one this build pins, re-checked
   every twelve hours, and the strategy that carries traffic is chosen by
   measuring the bundle against real destinations. Windows only — see
-  [DPI bypass](README.md#dpi-bypass).
+  [DPI bypass](docs/dpi-bypass.md).
 - **Connection diagnostics** — an on-demand UDP / STUN check (reachability, NAT
   type, external address) and a speed test through the active tunnel.
 - **A support report in one action** — state, versions, routing, the last
@@ -54,7 +54,7 @@ Working today on the Windows, macOS and Linux desktop clients:
   the unprivileged app attaches to it, installed by an Arch package (built from
   source in the release workflow) or a `sudo` script, with `.deb` and AppImage
   bundles beside them. Read the
-  [Linux note](README.md#linux-note--the-tunnel-needs-a-root-service) first.
+  [Linux installation guide](docs/installation.md#linux) first.
 
 ## In progress
 
@@ -113,5 +113,5 @@ Bigger ideas, not committed:
 ---
 
 Done items move up to **Shipped**; see the [changelog](CHANGELOG.md) for what
-landed in each release and [project status](README.md#project-status) for the
+landed in each release and [project status](README.md#project-status-and-known-limits) for the
 honest state of each layer.
diff --git a/docs/README.md b/docs/README.md
@@ -1,7 +1,14 @@
 # Tenebra documentation
 
 Project overview and quick-start live in the top-level
-[README](../README.md). This folder holds the deeper references.
+[README](../README.md) / [Русский](../README.ru.md). This folder holds the deeper references.
+
+- **[Installation](installation.md)** — downloads, Windows setup and the
+  required macOS/Linux helpers, with platform limitations.
+- **[DPI bypass](dpi-bypass.md)** — the optional Windows integration,
+  bundled components, update controls and network-dependent results.
+
+For developers:
 
 - **[architecture.md](architecture.md)** — the layers (Go core, platform
   adapters, the desktop UI) and how they connect, plus the project's hard rules.

diff --git a/docs/assets/README.md b/docs/assets/README.md
@@ -0,0 +1,15 @@
+# README artwork and interface previews
+
+`hero.png` and `eclipse.svg` are the existing Tenebra identity artwork. The
+eclipse keeps its animation and reduced-motion fallback unchanged.
+
+`desktop-advanced.png` and `desktop-simple.png` show the desktop renderer from
+the v0.6.0 source commit `15a4dec70c4105bad02462d0e69e29ade3ac59be`, captured
+on 2026-09-13 at 1280 × 720. They are unedited browser captures of the actual
+React interface, using a synthetic native adapter and demo subscription.
+The app is disconnected; displayed node latencies and usage are demo values.
+These images are interface previews, not measurements or native tunnel tests.
+No production subscriptions, credentials or server addresses are included.
+
+For future screenshots, use the corresponding release's renderer, retain
+the demo-data caption and never reuse a real user's subscription or logs.
diff --git a/docs/assets/desktop-advanced.png b/docs/assets/desktop-advanced.png
diff --git a/docs/assets/desktop-simple.png b/docs/assets/desktop-simple.png
diff --git a/docs/dpi-bypass.md b/docs/dpi-bypass.md
@@ -0,0 +1,39 @@
+# DPI bypass on Windows
+
+[Overview](../README.md) · [Installation](installation.md)
+
+Tenebra integrates [zapret](https://github.com/bol-van/zapret) on Windows. It changes packet presentation, including TLS handshake fragmentation and decoys, to try to avoid traffic-inspection rules. It runs alongside the tunnel; destinations routed directly can use it without going through the VPN exit.
+
+A running bypass process does not prove that a blocked service is reachable. Results depend on the network, destination and selected strategy. macOS and Linux do not include this Windows packet filter; their traffic follows the configured tunnel and direct-routing rules.
+
+## What is bundled
+
+Tenebra uses the [Flowseal/zapret-discord-youtube](https://github.com/Flowseal/zapret-discord-youtube) bundle: `winws.exe`, the [WinDivert](https://github.com/basil00/WinDivert) driver, the Cygwin runtime, strategies and host lists.
+
+One upstream archive is compiled into the Windows core. Its bytes are checked against the checksum pinned by the build. A missing bundle can therefore be installed without downloading it during a connection attempt. macOS and Linux binaries do not carry the archive.
+
+Under the Windows service, the installed bundle lives in:
+
+```text
+%ProgramData%\Tenebra\data\zapret
+```
+
+## Installation and updates
+
+- **Service startup:** installs the embedded copy if no usable bundle is present, then restores the previously requested bypass state.
+- **Connect:** can install the embedded copy if needed, without fetching an archive from the network. Bypass startup has a bounded budget; a failure is logged and the connection can proceed without it.
+- **Background updates:** when enabled, the service checks upstream after its startup delay (45 seconds) and then every twelve hours. Downloads must match a checksum trusted by this Tenebra build. A release newer than the trusted pins is left uninstalled, with a message to update Tenebra.
+
+An existing usable bundle is not replaced by the embedded copy. A failed or rejected update keeps the existing bundle; connection attempts do not wait for a fresh download.
+
+The update check contacts GitHub. These are ordinary network requests, so GitHub can observe request metadata such as the source IP. Tenebra does not attach your VPN subscription to the bundle request.
+
+## Control downloads and bypass separately
+
+**Settings → Censorship bypass → Update the bundle automatically** controls scheduled checks and downloads. Turn it off to stop those requests; press **Update** to request a manual update. A bundle can also be installed manually into the directory above.
+
+The automatic-update preference does not disable the embedded copy: its installation uses bytes already shipped with Tenebra. Deleting the bundle directory is therefore not a lasting way to switch bypass off; startup or a later connect can install it again.
+
+Use the **bypass switch** to turn the packet filter off. The requested setting is saved even when stopping the filter reports an error; check the displayed outcome and logs to confirm that the stop completed. When bypass is off or unavailable, traffic follows the applicable routing configuration, and directly routed destinations may remain blocked by the network.
+
+All bundled components, license terms and copyright holders are listed in [Third-party notices](../THIRD-PARTY-NOTICES.md#2-components-downloaded-at-runtime).