The system TUN is not the whole map
The established macOS TUN path remains responsible for Mac-local and downstream IPv4 transparent routing. Darwin does not deliver downstream IPv6 ingress to that utun path in the way OpenSurge needs, so v0.2 adds a bounded userspace packet channel instead of reviving unsupported redirection mechanisms.
Preserve the device identity at ingress
The BPF broker observes the selected physical interface and sends the packet plus its source MAC over a permission-restricted Unix datagram. The patched mihomo listener maps that identity into the same device-policy namespace used by the control plane.
Experimental is an engineering boundary
The label is not decorative. Shared-L2 RA competition, upstream capability, packet protocols, QUIC, device identity, and clean withdrawal all require topology-specific host-network evidence. The public documentation describes only the paths that have matching validation gates.
FAQ
Questions people ask before changing the network
Why is the release called Wind Rose?
The name reflects several ingress directions converging on one auditable policy and egress system, while keeping each data path explicit.
Did v0.2 replace mihomo TUN?
No. TUN remains the supported transparent path for Mac-local and downstream IPv4 traffic. The packet listener is a separate experimental ingress for downstream IPv6.