Validate real TUN forwarding and fix firewall routingmain

- Move the default-drop guard to POSTROUTING so it sees final TUN egress
- Treat a missing TUN interface as absent and add acceptance coverage
- Document successful real-subscription validation on ALT Xray 26.10.29

1 files changed, 1 insertions, 1 deletions

diff --git a/README.md b/README.md
index 829bfb1..1aa3587 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Roentgen is a Linux CLI/TUI for importing 3x-ui subscription link lists and controlling the local machine's proxy intent through a root-owned controller. The implementation follows [.scratch/linux-first-release/spec.md](.scratch/linux-first-release/spec.md).
 
-This is an implementation candidate. Full native-TUN forwarding and managed-probe lifecycle acceptance on the required current ALT Xray package is incomplete. The supplied VM passed diagnostics transport, terminal authentication, enabled/blocked reboot protection, and recovery checks. The available ALT test VM and its refreshed Sisyphus repository currently supply Xray 26.3.27. Activation rejects that release before changing enabled intent. This build currently gates activation on the researched Xray 26.10.29 configuration contract. That gate is not a claim that the full release acceptance matrix has passed.
+This is an implementation candidate. The full release acceptance matrix remains incomplete. Real-subscription native-TUN forwarding on ALT Xray 26.10.29 now passes the [VM check](docs/validation/real-subscription-vm.md); managed-probe lifecycle acceptance remains incomplete. The supplied VM passed diagnostics transport, terminal authentication, enabled/blocked reboot protection, and recovery checks. The earlier VM run supplied Xray 26.3.27, which activation rejected before changing enabled intent. The upgraded VM now supplies Xray 26.10.29. This build currently gates activation on the researched Xray 26.10.29 configuration contract. That gate is not a claim that the full release acceptance matrix has passed.
 
 ## Build