diff --git a/.beads/.gitignore b/.beads/.gitignore
index 4176bee9..6a68b2c9 100644
--- a/.beads/.gitignore
+++ b/.beads/.gitignore
@@ -70,6 +70,10 @@ backup/
 *.db-shm
 db.sqlite
 bd.db
+# Bead text lives in the Dolt tracker only, never in git
+# (the shared copy is the private Dolt remote named by sync.remote)
+issues.jsonl
+interactions.jsonl
 # NOTE: Do NOT add negation patterns here.
 # They would override fork protection in .git/info/exclude.
 # Config files (metadata.json, config.yaml) are tracked by git by default
diff --git a/.beads/config.yaml b/.beads/config.yaml
index e3b86602..4bace324 100644
--- a/.beads/config.yaml
+++ b/.beads/config.yaml
@@ -65,4 +65,6 @@
 # - linear.api_key  → use LINEAR_API_KEY env var instead
 # - github.token    → use GITHUB_TOKEN env var instead
 
-sync.remote: "git+https://github.com/GeiserX/VPN-Bypass.git"
\ No newline at end of file
+sync.remote: "git+ssh://git@gitea.geiser.cloud:2222/giteaer/VPN-Bypass-beads.git"
+# Every bd write is a Dolt commit, so a push always carries it.
+dolt.auto-commit: "on"
diff --git a/.beads/interactions.jsonl b/.beads/interactions.jsonl
deleted file mode 100644
index f34df4f1..00000000
--- a/.beads/interactions.jsonl
+++ /dev/null
@@ -1,29 +0,0 @@
-{"id":"int-e057e203ab3b733ed88fcd6309c28959","kind":"field_change","created_at":"2026-06-30T19:00:56.915703Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.1","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
-{"id":"int-8c6cca6766fa95a1c3e9f1080cd66561","kind":"field_change","created_at":"2026-06-30T19:07:57.657583Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.3","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
-{"id":"int-702394cfd0c1883eaf96e51878e340f7","kind":"field_change","created_at":"2026-06-30T19:11:16.893474Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.1","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"flock single-instance guard + LSMultipleInstancesProhibited; 2 unit tests pass; committed 19b71bf"}}
-{"id":"int-3293adff0aa8ac8a9d7174b431caea7b","kind":"field_change","created_at":"2026-06-30T19:11:17.923054Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"guard refuses VPN Only under GlobalProtect; full suite 556/556 green"}}
-{"id":"int-4cf02651ac72d5805d4bbdf9e9301364","kind":"field_change","created_at":"2026-06-30T19:23:39.649136Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Model + derive() migration added; 7 unit tests (Codable round-trip, partial-decode, bypass/vpnOnly/proxy derive, legacy-config migration, no-rederive); full suite green; schemaVersion=1 so no behavior change"}}
-{"id":"int-2687ca99412b5995357ce4564918c304","kind":"field_change","created_at":"2026-06-30T19:30:00.606989Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"no-op skip + shouldSkipReapply helper; 5 unit tests incl gateway-change-not-skipped; full suite 569/569 green"}}
-{"id":"int-ba7083a9e9f130b02004ebb27111dd52","kind":"field_change","created_at":"2026-06-30T19:30:02.187724Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.4","extra":{"field":"status","new_value":"deferred","old_value":"open"}}
-{"id":"int-fe24c31ff040ff281474f95b40890279","kind":"field_change","created_at":"2026-06-30T19:57:21.37268Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.5","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
-{"id":"int-5f97b779052dc534b75fff5772a674f2","kind":"field_change","created_at":"2026-06-30T20:39:07.584306Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.8","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"P1 proxy egress complete end-to-end: RuleResolver + ProxyForwarder(reviewed, mock-tunnel test) + HookGenerator(PAC via JSContext) + CredentialTemplate + ProxyListenerManager + RouteManager lifecycle integration + Routes settings tab w/ live port + copy-hook. ~30 unit tests; full suite 594 green. Live Oxylabs egress verification is Sergio's (DEFERRED-QUESTIONS)."}}
-{"id":"int-370e2039fbd41fc63e6ad75d4d595038","kind":"field_change","created_at":"2026-06-30T20:39:09.771823Z","actor":"GeiserX","issue_id":"VPN-Bypass-3sc.6","extra":{"field":"status","new_value":"deferred","old_value":"open"}}
-{"id":"int-4e18bada5be601f1c94eb3c370745670","kind":"field_change","created_at":"2026-08-07T13:25:49.768152Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.1","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-f0ba13efe28fcf78192d083c1410a64d","kind":"field_change","created_at":"2026-08-07T13:25:50.800421Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-53e92ad40cf4263819759cafe4697e65","kind":"field_change","created_at":"2026-08-07T13:25:51.830189Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.3","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-8b6cf6e7c6f5cb6885550a28e0552956","kind":"field_change","created_at":"2026-08-07T13:25:52.933611Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-01ec0cc8de2e1fa496ce43b3b50b9c08","kind":"field_change","created_at":"2026-08-07T13:25:54.35264Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.5","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-85cbfe5e43d4b1a6f9429c15382c3f97","kind":"field_change","created_at":"2026-08-07T13:25:55.367524Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.6","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #78 (merged): isShuttingDown flag + gate check, unconditional teardown/epoch bump, pending-before-add set, task cancellation, unified SIGTERM path, deadline floor. 6 regression tests (ShutdownRaceTests)."}}
-{"id":"int-3f2b060843096b67216f44c2da478138","kind":"field_change","created_at":"2026-08-07T13:25:56.568333Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #79: RouteKernel + PF_ROUTE socket helper 2.0.0 (zero /sbin/route spawns), silent NET_RT_DUMP reconcile, RTF_PROTO1 tagging, startup sweep-by-signature, VPN-gateway protection. 16 tests (RouteKernelTests + StartupSweepTests)."}}
-{"id":"int-0aecb64ba9491cdea790b9c7132a30cb","kind":"field_change","created_at":"2026-08-07T13:25:57.949206Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.8","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #79: RouteKernel + PF_ROUTE socket helper 2.0.0 (zero /sbin/route spawns), silent NET_RT_DUMP reconcile, RTF_PROTO1 tagging, startup sweep-by-signature, VPN-gateway protection. 16 tests (RouteKernelTests + StartupSweepTests)."}}
-{"id":"int-8ad810f1079077c4dac4746008ee63ed","kind":"field_change","created_at":"2026-08-07T13:25:59.000247Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.9","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #79: RouteKernel + PF_ROUTE socket helper 2.0.0 (zero /sbin/route spawns), silent NET_RT_DUMP reconcile, RTF_PROTO1 tagging, startup sweep-by-signature, VPN-gateway protection. 16 tests (RouteKernelTests + StartupSweepTests)."}}
-{"id":"int-6c0924dabe4ef9afa886d5a4973669fc","kind":"field_change","created_at":"2026-08-07T13:26:00.196534Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.10","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #79: RouteKernel + PF_ROUTE socket helper 2.0.0 (zero /sbin/route spawns), silent NET_RT_DUMP reconcile, RTF_PROTO1 tagging, startup sweep-by-signature, VPN-gateway protection. 16 tests (RouteKernelTests + StartupSweepTests)."}}
-{"id":"int-5b72afd3bf408436f4f306216aad3c55","kind":"field_change","created_at":"2026-08-07T13:26:01.461457Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.11","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #79: RouteKernel + PF_ROUTE socket helper 2.0.0 (zero /sbin/route spawns), silent NET_RT_DUMP reconcile, RTF_PROTO1 tagging, startup sweep-by-signature, VPN-gateway protection. 16 tests (RouteKernelTests + StartupSweepTests)."}}
-{"id":"int-d33d1bf3fa6bd1c0749e5c65a6c36241","kind":"field_change","created_at":"2026-08-07T13:33:20.480067Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.17","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Answered with corrected root cause (stranded-route class, not shared-hosting IP drift) + v4.0.0 structural fix + netstat discriminator for recurrence; closed as completed (comment 5217708190). User-authorized."}}
-{"id":"int-d7f9a660317104c939c668f1b4e54fd8","kind":"field_change","created_at":"2026-08-07T13:34:48.293623Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.12","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #80 (merged): 3-state honest pill (ON/NOT ENFORCING/NO ROUTES/OFF), helper-down banner + Fix button, notifyEnforcementFailed on startup bail-out, Refresh failure feedback, vpnb status runtime block. 942/0."}}
-{"id":"int-ed9414ffba78f42362e304d60e2b4840","kind":"field_change","created_at":"2026-08-07T13:34:49.307085Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.13","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #80 (merged): 3-state honest pill (ON/NOT ENFORCING/NO ROUTES/OFF), helper-down banner + Fix button, notifyEnforcementFailed on startup bail-out, Refresh failure feedback, vpnb status runtime block. 942/0."}}
-{"id":"int-6a17f5ca4e60e21fde1f54ac18c70ee8","kind":"field_change","created_at":"2026-08-07T13:34:50.310395Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.15","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #80 (merged): 3-state honest pill (ON/NOT ENFORCING/NO ROUTES/OFF), helper-down banner + Fix button, notifyEnforcementFailed on startup bail-out, Refresh failure feedback, vpnb status runtime block. 942/0."}}
-{"id":"int-6a0bf5ff83f072c27e9d1244487ec5b2","kind":"field_change","created_at":"2026-08-07T13:41:20.277119Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.14","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #81: 'nothing configured yet' dropdown hint on fresh installs (empty domains + no enabled services + no routes)."}}
-{"id":"int-a21f3a17adcb31eef5c25287f2221374","kind":"field_change","created_at":"2026-08-07T13:41:21.728915Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.16","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #81: Coexistence card in Settings→General — live tunnels with acting-on/default-route/Tailscale badges + kernel-tagged owned-route count; on-appear/on-demand refresh only."}}
-{"id":"int-add6ed7d56ff9643410d3c80f6b992ca","kind":"field_change","created_at":"2026-08-07T13:41:22.782611Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.21","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #81: COEXISTENCE.md linked from README (VPN Detection Logic + Troubleshooting)."}}
-{"id":"int-759e8878a879d4fcc3b5691f2a6ee13e","kind":"field_change","created_at":"2026-08-07T13:41:24.068525Z","actor":"GeiserX","issue_id":"VPN-Bypass-8bh.19","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Shipped in PR #82: type=vpn + interface/product pin args, strict invalid_type on unknown egress, SanitizedRoute.vpnSelector for display. 3 tests."}}