fix: audit round 3 - fail-closed leak, shared asyncio loop, GOST bundling, close-X UX, persona key lookup, +29 tests

proxy_chain_manager/service.py

@@ -352,13 +352,28 @@ class ChainService:
             ),
         })
 
-        real_ip = await get_direct_ip(self._settings.ip_check_url)
+        # Warm-up: retry the direct-IP lookup a few times so a transient
+        # network blip during startup doesn't put us in permanent fail-closed.
+        real_ip = None
+        for attempt in range(3):
+            real_ip = await get_direct_ip(self._settings.ip_check_url)
+            if real_ip:
+                break
+            if attempt < 2:
+                await asyncio.sleep(2.0)
         if real_ip:
             self._notify({"type": "real_ip", "ip": real_ip})
             label = "direct/VPN IP" if self._vpn.active else "your real IP"
             self._notify({"type": "log", "text": f"{label.capitalize()}: {real_ip}"})
         else:
-            self._notify({"type": "log", "text": "Could not determine direct IP — leak detection disabled."})
+            # Leak detection now FAILS CLOSED on unknown real_ip — any chain
+            # whose exit IP can't be compared against a baseline will be
+            # treated as a leak and rotated.  Make the operator aware up front.
+            self._notify({"type": "log", "text": (
+                "Could not determine direct IP after 3 attempts — leak detection "
+                "will FAIL CLOSED (rotate on any chain whose exit IP cannot be "
+                "verified). Fix internet / ip_check_url to restore."
+            )})
 
         self._apply_privacy()