Pre-release. The app does not offer this to anyone automatically — the update check reads /releases/latest, which skips prereleases. Share the link with whoever should try it.Two fixes over 1.9.3, both reported from a device and confirmed fixed on one."DNS inside the tunnel" now does somethingA resolver typed into that field never reached the interface. The value was passed to the engine, and the engine reads it in one place: when something hands its SOCKS listener a name to look up. In whole-device mode nothing does — an app sends IP packets, and its queries go to whatever the interface advertises, which was 1.1.1.1 and 1.0.0.1 with no reference to the setting at all.So the field worked in proxy mode and was inert in the mode most people run. A leak test reported Cloudflare no matter what was typed, which is worse than not having the field, because it reads as a promise.The interface now carries what was asked for. Leaving it empty still means 1.1.1.1, 1.0.0.1, exactly as the field has always said. Entries that are not an address are dropped without being looked up — asking would be a DNS query on the thread bringing the tunnel up, on a network whose DNS is the problem.Not in chain mode. There the chain answers from its own resolver and asks upstream over encrypted DNS through the tunnel. Pointing that at a plain address would move every lookup onto ordinary UDP and undo it, so the field is deliberately not applied there.MASQUE-in-MASQUE connectsNesting never worked. The inner hop only ever tried one framing — whichever the profile implied — so an inner edge that would not complete that handshake ended the attempt, and the one that would have worked was never reached. The single hop has had both for as long as it has existed. Now the inner hop does too.Four other explanations were eliminated first, each against a real phone: the address the inner hop dials, the age of its enrolment, the obfuscation it carried, and the size of its first packet. The log now says enough to tell those apart without guessing.Everything from 1.9.xIf you are coming from 1.8.x, this also carries the in-app update, the home-screen widget, the identity store that ends the 1.8.0 failures, the bounded route search, and moving the tunnel across a network change instead of rebuilding it.Verification362 engine tests and 249 app unit tests, all green. Every new test was also run against the code without its fix, to confirm it fails there.