fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

* fix(mtproto): split the mtg fingerprint into structural and secrets parts

A reordered clients array in the stored settings used to read as a config
change because the fingerprint concatenated secrets in array order, and one
opaque fingerprint could not tell a restart-worthy change (bind address,
fronting, throttle) from a secret-set change a reload-capable mtg can absorb
in place. Sort the secret pairs so order stops mattering, and split the value
so the upcoming hot-reload path can decide between keeping, reloading, and
restarting the process.

* fix(mtproto): stop restarting mtg on every inbound edit

Saving an mtproto inbound tore down and respawned its mtg sidecar even when
nothing material changed, dropping every live Telegram connection: the update
path pushed DelInbound+AddInbound, and Remove deletes the manager's map entry,
so Ensure's fingerprint no-op gate could never fire. Route mtproto updates
through a single Ensure call so an edit that leaves the generated TOML alone
keeps the process, and only real config changes restart it.

Capturing the pre-edit protocol also fixes a latent leak: changing an
inbound's protocol away from mtproto never stopped the sidecar, because the
snapshot handed to the runtime already carried the new protocol and the
removal took the xray branch, leaving an orphaned mtg holding the port.

An mtproto push failure no longer requests an xray restart - xray cannot fix
the sidecar, and the 10s reconcile job self-heals it.

The regression test fakes mtg by re-executing the test binary, counting
spawns through a pid file: an unchanged save and a remark-only edit must keep
the process, a re-keyed secret must restart it.

* fix(mtproto): exclude depleted clients from the reconcile job to match the sync push

The 10s reconcile job derived mtg secret sets from raw inbound settings while
the interactive push filtered clients through buildRuntimeInboundForAPI, which
drops client_traffics-disabled (depleted or expired) clients. The two paths
therefore disagreed on the fingerprint - each disagreement one needless mtg
restart dropping live connections - and worse, the job kept serving depleted
clients' secrets indefinitely, so running out of traffic never actually cut an
mtproto client's access.

DesiredMtprotoInstances now builds the job's desired state with the same
depletion overlay the push uses (one bulk client_traffics query), drops
inbounds whose every secret is filtered away so their sidecar stops, and
AddInbound pushes the filtered payload too so an imported inbound carrying
disabled stats does not seed a fingerprint the next reconcile disagrees with.

* feat(mtproto): hot-reload mtg secrets in place instead of restarting

A client add, removal, re-key, or enable-toggle changes only the [secrets]
section of the generated config, yet the panel could apply it only by killing
and respawning the mtg sidecar, dropping every Telegram connection on that
inbound. Split the ensure decision three ways: an identical config is a no-op,
a secrets-only change rewrites the TOML on the same api port and asks mtg to
hot-swap it via POST /reload, and a structural change (or a failed reload)
falls back to the full stop-and-start.

The reload endpoint is served by the mhsanaei/mtg-multi fork; against an older
binary the POST 404s and the manager restarts exactly as before, so panel and
binary upgrades stay order-independent.

* feat(mtproto): apply single-client edits to the sidecar immediately

Client CRUD on an mtproto inbound was a runtime no-op, so an add, delete,
re-key, or enable-toggle only reached mtg on the next 10s reconcile. With the
sidecar now able to hot-reload, push the change straight after the edit commits:
applyLocalMtproto rebuilds the inbound's filtered client set and re-applies it,
so a new client works within a moment (and, on a reload-capable binary, without
disturbing the others) and deleting the last client stops the process.

The three interactive single-client paths (add, update, delete) call it; bulk
operations still ride the reconcile job, which converges to the same state.

* chore(mtproto): pin mtg-multi to the mhsanaei fork v1.13.3

The reload endpoint the panel now uses lives in the mhsanaei/mtg-multi fork, so
point the source-build pin (DockerInit.sh + both release.yml matrices) at it and
bump to v1.13.3. The install still produces the same mtg-multi binary name, so
the mtg-<os>-<arch> rename and everything downstream are unchanged. Docs and the
package comment note the hot-reload path and its restart fallback.

* feat(mtproto): apply live secret updates via the management API and add ad-tag

Two capabilities the mhsanaei/mtg-multi v1.13.3 fork exposes are now surfaced by
the sidecar manager.

Live updates go through PUT /secrets on the fork's management API instead of
POST /reload: the panel already holds the whole desired set per inbound, so it
sends secrets and the advertising tag as one JSON call that mtg applies
atomically, keeping every unchanged connection and closing only removed or
re-keyed ones. The config file is still written first so a restart or crash
recovery reproduces the state, and any non-200 (an older binary, a refused
connection) still falls back to a full restart.

Per-inbound ad-tag adds an optional 32-hex Telegram advertising tag plus
public-ipv4/public-ipv6 overrides. The ad-tag rides the reloadable secrets
fingerprint, so changing it hot-applies without dropping connections; the public
IPs are proxy-construction parameters and sit in the structural fingerprint, so a
change there restarts the process. Empty public IPs are omitted so mtg
auto-detects the reachable address.

* feat(inbounds): expose the mtproto ad-tag and public IP in the inbound form

Adds an Ad-tag field (validated as 32 hex characters) plus optional Public IPv4
and Public IPv6 overrides to the MTProto inbound form, backed by the same-named
settings the sidecar writes into the mtg config. The public IPs are optional —
left blank, mtg auto-detects the reachable address the ad-tag middle proxy needs.
English strings are added to every locale; the non-English ones carry the
English text until translated and fall back to it meanwhile.

* ci(mtproto): install mtg-multi from prebuilt release binaries

The fork now publishes release archives for every platform we package, so
download and unpack the matching mtg-multi-<ver>-<os>-<arch> binary instead of
compiling it from source with go install. Faster builds and no toolchain step,
and the archive's platform labels line up with our matrix; the produced
mtg-<os>-<arch> filenames are unchanged.

* i18n(mtproto): localize the ad-tag and public IP strings

The six mtgAdTag*/mtgPublicIp* keys shipped with English text in every locale as
a placeholder. Translate them into the twelve non-English locales (Arabic,
Spanish, Persian, Indonesian, Japanese, Portuguese-BR, Russian, Turkish,
Ukrainian, Vietnamese, and Simplified/Traditional Chinese); en-US is unchanged.

* retired goreportcard.com

internal/mtproto/manager.go

@@ -1,12 +1,14 @@
 package mtproto
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"net"
 	"net/http"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -47,6 +49,16 @@ type Instance struct {
 	// fair-share algorithm; zero disables throttling.
 	ThrottleMaxConnections int
 
+	// AdTag is a 32-hex Telegram advertising tag; when set, mtg routes clients
+	// through Telegram middle proxies so a sponsored channel shows in their chat
+	// list. It is part of the reloadable secret config, so a change is applied
+	// via /reload without dropping connections. PublicIPv4/PublicIPv6 pin the
+	// proxy's reachable address the middle proxy needs; they are omitted when
+	// empty so mtg auto-detects, and a change forces a restart.
+	AdTag      string
+	PublicIPv4 string
+	PublicIPv6 string
+
 	// When RouteThroughXray is set, mtg dials Telegram through the loopback
 	// SOCKS bridge the panel injects into the Xray config at XrayRoutePort, so
 	// the egress obeys the core's routing rules instead of going out directly.
@@ -62,10 +74,11 @@ func (inst Instance) bindTo() string {
 	return fmt.Sprintf("%s:%d", listen, inst.Port)
 }
 
-// fingerprint changes whenever any value that ends up in the generated TOML
-// changes, so ensureLocked restarts mtg when the operator edits a setting or a
-// client is added, removed, disabled, or re-keyed.
-func (inst Instance) fingerprint() string {
+// structuralFingerprint changes whenever a value outside the [secrets] section
+// of the generated TOML changes. Such a change can only be applied by
+// restarting mtg, unlike a secrets-only change, which a reload-capable mtg can
+// absorb in place.
+func (inst Instance) structuralFingerprint() string {
 	parts := []string{
 		inst.bindTo(),
 		strconv.FormatBool(inst.Debug),
@@ -77,13 +90,26 @@ func (inst Instance) fingerprint() string {
 		strconv.Itoa(inst.ThrottleMaxConnections),
 		strconv.FormatBool(inst.RouteThroughXray),
 		strconv.Itoa(inst.XrayRoutePort),
-	}
-	for _, e := range inst.Secrets {
-		parts = append(parts, e.Name+"="+e.Secret)
+		inst.PublicIPv4,
+		inst.PublicIPv6,
 	}
 	return strings.Join(parts, "|")
 }
 
+// secretsFingerprint identifies the reloadable secret config regardless of
+// client order, so a reordered clients array in the stored settings does not
+// read as a change. It moves whenever a client is added, removed, disabled, or
+// re-keyed, or the advertising tag changes — all of which mtg applies through
+// /reload without dropping connections.
+func (inst Instance) secretsFingerprint() string {
+	pairs := make([]string, 0, len(inst.Secrets))
+	for _, e := range inst.Secrets {
+		pairs = append(pairs, e.Name+"="+e.Secret)
+	}
+	slices.Sort(pairs)
+	return "adtag=" + inst.AdTag + "|" + strings.Join(pairs, "|")
+}
+
 // Traffic is a per-client traffic delta scraped from an mtg /stats endpoint. Tag
 // is the owning inbound's tag and Email is the client the bytes belong to.
 type Traffic struct {
@@ -99,11 +125,12 @@ type clientCounters struct {
 }
 
 type managed struct {
-	proc        *Process
-	tag         string
-	fingerprint string
-	apiPort     int
-	last        map[string]clientCounters
+	proc         *Process
+	tag          string
+	structuralFP string
+	secretsFP    string
+	apiPort      int
+	last         map[string]clientCounters
 }
 
 // Manager owns the set of running mtg processes keyed by inbound id.
@@ -150,6 +177,9 @@ func InstanceFromInbound(ib *model.Inbound) (Instance, bool) {
 		ThrottleMaxConnections int    `json:"throttleMaxConnections"`
 		RouteThroughXray       bool   `json:"routeThroughXray"`
 		RouteXrayPort          int    `json:"routeXrayPort"`
+		AdTag                  string `json:"adTag"`
+		PublicIPv4             string `json:"publicIpv4"`
+		PublicIPv6             string `json:"publicIpv6"`
 		Clients                []struct {
 			Email  string `json:"email"`
 			Secret string `json:"secret"`
@@ -184,6 +214,9 @@ func InstanceFromInbound(ib *model.Inbound) (Instance, bool) {
 		ThrottleMaxConnections: parsed.ThrottleMaxConnections,
 		RouteThroughXray:       parsed.RouteThroughXray,
 		XrayRoutePort:          parsed.RouteXrayPort,
+		AdTag:                  strings.TrimSpace(parsed.AdTag),
+		PublicIPv4:             strings.TrimSpace(parsed.PublicIPv4),
+		PublicIPv6:             strings.TrimSpace(parsed.PublicIPv6),
 	}, true
 }
 
@@ -210,15 +243,55 @@ func (m *Manager) sweepOrphansLocked() {
 	}
 }
 
+// ensureAction is what ensureLocked must do to move a running mtg process to a
+// desired instance: leave it alone, hot-reload only its secrets, or fully
+// restart it.
+type ensureAction int
+
+const (
+	ensureNoop ensureAction = iota
+	ensureReload
+	ensureRestart
+)
+
+// ensureActionFor decides how to apply a desired instance to the currently
+// managed process. A structural change (or a dead process) forces a restart; a
+// secrets-only change is a candidate for an in-place reload; identical
+// fingerprints on a live process need nothing.
+func ensureActionFor(running bool, curStructFP, curSecretsFP, newStructFP, newSecretsFP string) ensureAction {
+	if !running || curStructFP != newStructFP {
+		return ensureRestart
+	}
+	if curSecretsFP != newSecretsFP {
+		return ensureReload
+	}
+	return ensureNoop
+}
+
 func (m *Manager) ensureLocked(inst Instance) error {
-	fp := inst.fingerprint()
+	structFP := inst.structuralFingerprint()
+	secFP := inst.secretsFingerprint()
 	if cur, ok := m.procs[inst.Id]; ok {
-		if cur.fingerprint == fp && cur.proc.IsRunning() {
+		switch ensureActionFor(cur.proc.IsRunning(), cur.structuralFP, cur.secretsFP, structFP, secFP) {
+		case ensureNoop:
 			cur.tag = inst.Tag
 			return nil
+		case ensureReload:
+			if err := writeConfig(configPathForID(inst.Id), inst, cur.apiPort); err != nil {
+				return err
+			}
+			if applySecrets(cur.apiPort, inst) {
+				cur.tag = inst.Tag
+				cur.secretsFP = secFP
+				logger.Infof("mtproto: applied secret update to inbound %d in place", inst.Id)
+				return nil
+			}
+			logger.Warningf("mtproto: live secret update unavailable for inbound %d, restarting", inst.Id)
+			fallthrough
+		case ensureRestart:
+			_ = cur.proc.Stop()
+			delete(m.procs, inst.Id)
 		}
-		_ = cur.proc.Stop()
-		delete(m.procs, inst.Id)
 	}
 	apiPort, err := FreeLocalPort()
 	if err != nil {
@@ -233,11 +306,12 @@ func (m *Manager) ensureLocked(inst Instance) error {
 		return err
 	}
 	m.procs[inst.Id] = &managed{
-		proc:        proc,
-		tag:         inst.Tag,
-		fingerprint: fp,
-		apiPort:     apiPort,
-		last:        map[string]clientCounters{},
+		proc:         proc,
+		tag:          inst.Tag,
+		structuralFP: structFP,
+		secretsFP:    secFP,
+		apiPort:      apiPort,
+		last:         map[string]clientCounters{},
 	}
 	logger.Infof("mtproto: started mtg for inbound %d on %s", inst.Id, inst.bindTo())
 	return nil
@@ -386,6 +460,15 @@ func renderConfig(inst Instance, apiPort int) string {
 		fmt.Fprintf(&b, "prefer-ip = %q\n", inst.PreferIP)
 	}
 	fmt.Fprintf(&b, "api-bind-to = \"127.0.0.1:%d\"\n", apiPort)
+	if inst.AdTag != "" {
+		fmt.Fprintf(&b, "ad-tag = %q\n", inst.AdTag)
+	}
+	if inst.PublicIPv4 != "" {
+		fmt.Fprintf(&b, "public-ipv4 = %q\n", inst.PublicIPv4)
+	}
+	if inst.PublicIPv6 != "" {
+		fmt.Fprintf(&b, "public-ipv6 = %q\n", inst.PublicIPv6)
+	}
 	if inst.FrontingIP != "" || inst.FrontingPort > 0 || inst.FrontingProxyProtocol {
 		b.WriteString("\n[domain-fronting]\n")
 		if inst.FrontingIP != "" {
@@ -430,6 +513,49 @@ type statsUser struct {
 	BytesOut    int64 `json:"bytes_out"`
 }
 
+type secretPutEntry struct {
+	Secret string `json:"secret"`
+}
+
+type secretsPutBody struct {
+	Secrets map[string]secretPutEntry `json:"secrets"`
+	AdTag   string                    `json:"ad_tag,omitempty"`
+}
+
+func secretsPayload(inst Instance) secretsPutBody {
+	secrets := make(map[string]secretPutEntry, len(inst.Secrets))
+	for _, e := range inst.Secrets {
+		secrets[e.Name] = secretPutEntry{Secret: e.Secret}
+	}
+	return secretsPutBody{Secrets: secrets, AdTag: inst.AdTag}
+}
+
+// applySecrets pushes the desired secret set and advertising tag to a running
+// mtg-multi through its management API (PUT /secrets on the same loopback port
+// that serves /stats), so a client add, removal, re-key, or ad-tag change is
+// applied in place. mtg keeps every connection whose secret is unchanged and
+// closes only the removed or re-keyed ones. It returns true only on a 200: an
+// older binary without the endpoint (404), a refused connection, or any other
+// status yields false, so the caller falls back to a full restart.
+func applySecrets(port int, inst Instance) bool {
+	body, err := json.Marshal(secretsPayload(inst))
+	if err != nil {
+		return false
+	}
+	client := http.Client{Timeout: 3 * time.Second}
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodPut, fmt.Sprintf("http://127.0.0.1:%d/secrets", port), bytes.NewReader(body))
+	if err != nil {
+		return false
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := client.Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode == http.StatusOK
+}
+
 // scrapeStats reads the mtg-multi /stats JSON API and returns the per-user
 // cumulative counters. Best-effort: an unreachable endpoint or unparseable body
 // yields ok=false.

internal/mtproto/manager_reload_test.go

@@ -0,0 +1,252 @@
+package mtproto
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestMain lets the test binary re-exec itself as a stand-in for the mtg
+// child process: with MTG_FAKE_CHILD=1 it records its pid and blocks, so the
+// manager can start and stop it without a real mtg-multi binary.
+func TestMain(m *testing.M) {
+	if os.Getenv("MTG_FAKE_CHILD") == "1" {
+		if f, err := os.OpenFile(os.Getenv("MTG_FAKE_PIDFILE"), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644); err == nil {
+			fmt.Fprintf(f, "%d\n", os.Getpid())
+			f.Close()
+		}
+		select {}
+	}
+	os.Exit(m.Run())
+}
+
+func installFakeMtg(t *testing.T) string {
+	t.Helper()
+	binDir := t.TempDir()
+	self, err := os.Executable()
+	if err != nil {
+		t.Fatalf("locate test binary: %v", err)
+	}
+	payload, err := os.ReadFile(self)
+	if err != nil {
+		t.Fatalf("read test binary: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(binDir, GetBinaryName()), payload, 0o755); err != nil {
+		t.Fatalf("install fake mtg: %v", err)
+	}
+	pidFile := filepath.Join(binDir, "mtg-pids.txt")
+	t.Setenv("XUI_BIN_FOLDER", binDir)
+	t.Setenv("MTG_FAKE_CHILD", "1")
+	t.Setenv("MTG_FAKE_PIDFILE", pidFile)
+	return pidFile
+}
+
+func spawnCount(t *testing.T, pidFile string) int {
+	t.Helper()
+	data, err := os.ReadFile(pidFile)
+	if os.IsNotExist(err) {
+		return 0
+	}
+	if err != nil {
+		t.Fatalf("read pid file: %v", err)
+	}
+	return len(strings.Fields(string(data)))
+}
+
+func waitSpawnCount(t *testing.T, pidFile string, want int) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		got := spawnCount(t, pidFile)
+		if got == want {
+			return
+		}
+		if got > want {
+			t.Fatalf("expected %d spawn(s), got %d", want, got)
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("expected %d spawn(s), still %d after timeout", want, got)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
+
+func mtgInst(id int, secrets ...SecretEntry) Instance {
+	return Instance{Id: id, Tag: fmt.Sprintf("inbound-%d", id), Listen: "127.0.0.1", Port: 24000 + id, Secrets: secrets}
+}
+
+func TestEnsureActionFor(t *testing.T) {
+	cases := []struct {
+		name                                         string
+		running                                      bool
+		curStruct, curSecrets, newStruct, newSecrets string
+		want                                         ensureAction
+	}{
+		{"dead process restarts", false, "s", "a", "s", "a", ensureRestart},
+		{"structural change restarts", true, "s1", "a", "s2", "a", ensureRestart},
+		{"secrets change reloads", true, "s", "a", "s", "b", ensureReload},
+		{"identical is a noop", true, "s", "a", "s", "a", ensureNoop},
+		{"dead beats a secrets-only change", false, "s", "a", "s", "b", ensureRestart},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := ensureActionFor(tc.running, tc.curStruct, tc.curSecrets, tc.newStruct, tc.newSecrets); got != tc.want {
+				t.Fatalf("ensureActionFor = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestApplySecrets(t *testing.T) {
+	cases := []struct {
+		name   string
+		status int
+		want   bool
+	}{
+		{"ok", http.StatusOK, true},
+		{"not found on old binary", http.StatusNotFound, false},
+		{"bad request", http.StatusBadRequest, false},
+		{"unavailable", http.StatusServiceUnavailable, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var gotMethod, gotPath string
+			var gotBody secretsPutBody
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				gotMethod, gotPath = r.Method, r.URL.Path
+				_ = json.NewDecoder(r.Body).Decode(&gotBody)
+				w.WriteHeader(tc.status)
+			}))
+			defer srv.Close()
+
+			inst := mtgInst(1, SecretEntry{Name: "alice", Secret: "ee01"})
+			inst.AdTag = "0123456789abcdef0123456789abcdef"
+			if got := applySecrets(serverPort(t, srv), inst); got != tc.want {
+				t.Fatalf("applySecrets = %v, want %v", got, tc.want)
+			}
+			if gotMethod != http.MethodPut || gotPath != "/secrets" {
+				t.Fatalf("expected PUT /secrets, got %s %s", gotMethod, gotPath)
+			}
+			if gotBody.Secrets["alice"].Secret != "ee01" || gotBody.AdTag != "0123456789abcdef0123456789abcdef" {
+				t.Fatalf("payload must carry the secret and ad-tag: %+v", gotBody)
+			}
+		})
+	}
+
+	t.Run("refused connection", func(t *testing.T) {
+		srv := httptest.NewServer(http.NotFoundHandler())
+		port := serverPort(t, srv)
+		srv.Close()
+		if applySecrets(port, mtgInst(1, SecretEntry{Name: "a", Secret: "ee"})) {
+			t.Fatal("a refused connection must yield false")
+		}
+	})
+}
+
+func TestEnsureHotReloadKeepsProcess(t *testing.T) {
+	pidFile := installFakeMtg(t)
+	mgr := &Manager{procs: map[int]*managed{}, swept: true}
+
+	inst := mtgInst(1, SecretEntry{Name: "alice", Secret: "ee01"})
+	if err := mgr.Ensure(inst); err != nil {
+		t.Fatalf("initial ensure: %v", err)
+	}
+	waitSpawnCount(t, pidFile, 1)
+	orig := mgr.procs[1].proc
+
+	reloaded := make(chan struct{}, 1)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPut && r.URL.Path == "/secrets" {
+			reloaded <- struct{}{}
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		http.NotFound(w, r)
+	}))
+	defer srv.Close()
+	mgr.procs[1].apiPort = serverPort(t, srv)
+
+	rekeyed := mtgInst(1, SecretEntry{Name: "alice", Secret: "ee01"}, SecretEntry{Name: "bob", Secret: "ee02"})
+	if err := mgr.Ensure(rekeyed); err != nil {
+		t.Fatalf("reload ensure: %v", err)
+	}
+
+	select {
+	case <-reloaded:
+	case <-time.After(3 * time.Second):
+		t.Fatal("expected a PUT /secrets request")
+	}
+	if got := spawnCount(t, pidFile); got != 1 {
+		t.Fatalf("hot reload must not spawn a new process, got %d", got)
+	}
+	if mgr.procs[1].proc != orig {
+		t.Fatal("hot reload must keep the same process")
+	}
+	if mgr.procs[1].secretsFP != rekeyed.secretsFingerprint() {
+		t.Fatal("stored secrets fingerprint must advance after a reload")
+	}
+	cfg, err := os.ReadFile(configPathForID(1))
+	if err != nil {
+		t.Fatalf("read config: %v", err)
+	}
+	if !strings.Contains(string(cfg), `"bob" = "ee02"`) {
+		t.Fatalf("reloaded config must carry the new secret:\n%s", cfg)
+	}
+	if !strings.Contains(string(cfg), fmt.Sprintf("api-bind-to = \"127.0.0.1:%d\"", serverPort(t, srv))) {
+		t.Fatalf("reload must reuse the same api port:\n%s", cfg)
+	}
+	mgr.StopAll()
+}
+
+func TestEnsureReloadFallbackRestarts(t *testing.T) {
+	pidFile := installFakeMtg(t)
+	mgr := &Manager{procs: map[int]*managed{}, swept: true}
+
+	if err := mgr.Ensure(mtgInst(2, SecretEntry{Name: "alice", Secret: "ee01"})); err != nil {
+		t.Fatalf("initial ensure: %v", err)
+	}
+	waitSpawnCount(t, pidFile, 1)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+	mgr.procs[2].apiPort = serverPort(t, srv)
+
+	if err := mgr.Ensure(mtgInst(2, SecretEntry{Name: "carol", Secret: "ee03"})); err != nil {
+		t.Fatalf("fallback ensure: %v", err)
+	}
+	waitSpawnCount(t, pidFile, 2)
+	mgr.StopAll()
+}
+
+func TestEnsureNoopKeepsProcess(t *testing.T) {
+	pidFile := installFakeMtg(t)
+	mgr := &Manager{procs: map[int]*managed{}, swept: true}
+
+	inst := mtgInst(3, SecretEntry{Name: "alice", Secret: "ee01"}, SecretEntry{Name: "bob", Secret: "ee02"})
+	if err := mgr.Ensure(inst); err != nil {
+		t.Fatalf("initial ensure: %v", err)
+	}
+	waitSpawnCount(t, pidFile, 1)
+
+	if err := mgr.Ensure(inst); err != nil {
+		t.Fatalf("repeat ensure: %v", err)
+	}
+	reordered := mtgInst(3, SecretEntry{Name: "bob", Secret: "ee02"}, SecretEntry{Name: "alice", Secret: "ee01"})
+	if err := mgr.Ensure(reordered); err != nil {
+		t.Fatalf("reordered ensure: %v", err)
+	}
+
+	time.Sleep(300 * time.Millisecond)
+	if got := spawnCount(t, pidFile); got != 1 {
+		t.Fatalf("an unchanged instance must keep the one process, got %d spawns", got)
+	}
+	mgr.StopAll()
+}

internal/mtproto/manager_test.go

@@ -94,11 +94,17 @@ func TestRenderConfig(t *testing.T) {
 		Debug: true, ProxyProtocolListener: true, PreferIP: "only-ipv6",
 		FrontingIP: "127.0.0.1", FrontingPort: 9443, FrontingProxyProtocol: true,
 		ThrottleMaxConnections: 5000,
+		AdTag:                  "0123456789abcdef0123456789abcdef",
+		PublicIPv4:             "1.2.3.4",
+		PublicIPv6:             "2001:db8::1",
 	}, 6000)
 	for _, want := range []string{
 		"debug = true\n",
 		"proxy-protocol-listener = true\n",
 		`prefer-ip = "only-ipv6"`,
+		`ad-tag = "0123456789abcdef0123456789abcdef"`,
+		`public-ipv4 = "1.2.3.4"`,
+		`public-ipv6 = "2001:db8::1"`,
 		"[domain-fronting]",
 		`host = "127.0.0.1"`,
 		"port = 9443",
@@ -153,8 +159,9 @@ func TestRenderConfigXrayEgress(t *testing.T) {
 	}
 }
 
-func TestFingerprintReactsToOptions(t *testing.T) {
+func TestFingerprintSplit(t *testing.T) {
 	base := Instance{Secrets: []SecretEntry{{Name: "a", Secret: "ee"}}, Listen: "0.0.0.0", Port: 443}
+
 	for name, mutate := range map[string]func(*Instance){
 		"debug":         func(i *Instance) { i.Debug = true },
 		"listener":      func(i *Instance) { i.ProxyProtocolListener = true },
@@ -165,16 +172,51 @@ func TestFingerprintReactsToOptions(t *testing.T) {
 		"throttle":      func(i *Instance) { i.ThrottleMaxConnections = 5000 },
 		"routeXray":     func(i *Instance) { i.RouteThroughXray = true },
 		"routeXrayPort": func(i *Instance) { i.XrayRoutePort = 50000 },
-		"addSecret":     func(i *Instance) { i.Secrets = append(i.Secrets, SecretEntry{Name: "b", Secret: "ff"}) },
-		"changeSecret":  func(i *Instance) { i.Secrets = []SecretEntry{{Name: "a", Secret: "ee99"}} },
+		"port":          func(i *Instance) { i.Port = 8443 },
+		"listen":        func(i *Instance) { i.Listen = "127.0.0.1" },
+		"publicIpv4":    func(i *Instance) { i.PublicIPv4 = "1.2.3.4" },
+		"publicIpv6":    func(i *Instance) { i.PublicIPv6 = "2001:db8::1" },
 	} {
-		changed := base
-		if strings.HasPrefix(name, "addSecret") || strings.HasPrefix(name, "changeSecret") {
-			changed.Secrets = append([]SecretEntry(nil), base.Secrets...)
-		}
-		mutate(&changed)
-		if base.fingerprint() == changed.fingerprint() {
-			t.Fatalf("fingerprint must change when %s changes", name)
-		}
+		t.Run("structural/"+name, func(t *testing.T) {
+			changed := base
+			mutate(&changed)
+			if base.structuralFingerprint() == changed.structuralFingerprint() {
+				t.Fatalf("structural fingerprint must change when %s changes", name)
+			}
+			if base.secretsFingerprint() != changed.secretsFingerprint() {
+				t.Fatalf("secrets fingerprint must stay put when %s changes", name)
+			}
+		})
 	}
+
+	for name, mutate := range map[string]func(*Instance){
+		"add":    func(i *Instance) { i.Secrets = append(i.Secrets, SecretEntry{Name: "b", Secret: "ff"}) },
+		"rekey":  func(i *Instance) { i.Secrets = []SecretEntry{{Name: "a", Secret: "ee99"}} },
+		"remove": func(i *Instance) { i.Secrets = nil },
+		"rename": func(i *Instance) { i.Secrets = []SecretEntry{{Name: "a2", Secret: "ee"}} },
+		"adTag":  func(i *Instance) { i.AdTag = "0123456789abcdef0123456789abcdef" },
+	} {
+		t.Run("secrets/"+name, func(t *testing.T) {
+			changed := base
+			changed.Secrets = append([]SecretEntry(nil), base.Secrets...)
+			mutate(&changed)
+			if base.secretsFingerprint() == changed.secretsFingerprint() {
+				t.Fatalf("secrets fingerprint must change on a %s", name)
+			}
+			if base.structuralFingerprint() != changed.structuralFingerprint() {
+				t.Fatalf("structural fingerprint must stay put on a %s", name)
+			}
+		})
+	}
+
+	t.Run("orderInsensitive", func(t *testing.T) {
+		forward := Instance{Secrets: []SecretEntry{{Name: "alice", Secret: "ee11"}, {Name: "bob", Secret: "ee22"}}}
+		reversed := Instance{Secrets: []SecretEntry{{Name: "bob", Secret: "ee22"}, {Name: "alice", Secret: "ee11"}}}
+		if got, want := forward.secretsFingerprint(), "adtag=|alice=ee11|bob=ee22"; got != want {
+			t.Fatalf("secrets fingerprint must join sorted pairs: got %q, want %q", got, want)
+		}
+		if forward.secretsFingerprint() != reversed.secretsFingerprint() {
+			t.Fatal("secrets fingerprint must not depend on client order")
+		}
+	})
 }

internal/mtproto/process.go

@@ -1,8 +1,10 @@
-// Package mtproto manages mtg-multi (github.com/dolonet/mtg-multi) sidecar
+// Package mtproto manages mtg-multi (github.com/mhsanaei/mtg-multi) sidecar
 // processes that serve MTProto FakeTLS proxies. Xray-core has no mtproto
 // protocol, so mtproto inbounds are run as standalone mtg processes — one
 // process per inbound, each serving every active client's secret through the
 // mtg-multi [secrets] section — entirely outside the Xray config and lifecycle.
+// A client edit is hot-applied via the fork's POST /reload endpoint so live
+// connections survive; the manager falls back to a restart on older binaries.
 package mtproto
 
 import (