Glossary

Term	Meaning
ALPN	Application-Layer Protocol Negotiation: the list of protocols (h2, http/1.1) a TLS client offers and the one the server picks. tls's alpn sets it; apranik check refuses a list the transport above cannot speak.
Base transport	A transport that creates connections from nothing: tcp and udp. Implements spec.BaseStreamTransportModule or spec.BaseDatagramTransportModule. Also called an underlay.
Block	The routing action that refuses a request: a TCP connection is closed, UDP datagrams are dropped.
Blueprint	A blueprint.Blueprint: every inbound and outbound with its modules looked up, decoded and validated, but nothing opened.
Builder	core/builder: turns a blueprint into running inbounds and outbounds. It builds each module's components and joins a proxy outbound's base dialer and overlay clients into one dialer.
Carrier	A spec.Stream or spec.Datagram handed from one layer to the next. When the kind is known, Apranik says "stream" or "datagram", and "underlying stream" for the layer below.
CDN fronting	Reaching a server through a CDN, so a censor sees the CDN's address and TLS name. ws and httpupgrade exist for it. See Run Trojan over WebSocket behind a CDN.
Component	core/component: the roles core's own parts play for each other (Inbound, Outbound, Router, TrafficHandler). Not module contract, so not in spec.
Core	Everything under core/: the code that composes modules. Modules never import it.
Dataset	A named list of domains or IP ranges, read from a file such as geosite.dat, that routing and DNS rules look up. Values only; what to do with them is in the rules. Declared at the top level of the config.
Datagram	The message-oriented carrier. Apranik says "datagram", never "packet", in code.
DNS server	One configured upstream the resolver sends queries to (dns.servers[]): a module of type udp, tcp, dot or doh carrying wire-format messages over its outbound, or the special type system, the operating system. Implements spec.StreamDNSServerModule or spec.DatagramDNSServerModule.
Destination	spec.Destination: exactly one of a domain or an IP, plus a port. Resolved only by a base transport.
Diagnostics	The list of errors and warnings config reports, each with its location in the config file.
Early data	Payload sent inside a handshake to save a round trip: ws puts the start of the first write in a header (early_data, Xray's ed).
Endpoint	spec.Endpoint: an IP and a port, already resolved.
Fallback	Where an inbound sends a request its protocol refuses with spec.ErrFallbackRequested: every byte, from the first, is replayed to that address over plain TCP, so a probe sees an ordinary service.
Fingerprint	What a TLS ClientHello reveals about the program that sent it: cipher suites, extensions, their order. tls's fingerprint picks a browser's to imitate through uTLS.
Fragment	The overlay transport that cuts the TLS ClientHello into records, packets or both, so DPI that does not reassemble never sees the server name whole. Outbound only.
Freedom	The special outbound protocol that sends straight to each destination, over TCP (its transport: tcp, then only transports that need no server side) and UDP.
Group	An outbound that connects nowhere itself and picks one of its members, other outbounds, for each connection: urltest (the fastest) and fallback (the first that works). See Outbound groups.
Handler	core/route/handler: the component.TrafficHandler every inbound calls. It asks the router, dials, relays, and owns UDP sessions.
Inbound	How traffic enters: a listener stack plus a proxy server (component.Inbound).
Lookup	What the resolver does: a name in, addresses out. A DNS server module does not look up; its Query carries one wire-format message out and one back.
User	One person who may use an inbound: a name and the credentials its protocol needs. Users belong to an inbound, are written in its protocol's users, and can change while it runs. Statistics are kept by name across inbounds.
Main connection	In Mux.Cool, the one established stream that carries many sub-connections. It is closed when idle (IdleTimeout) or on a protocol violation, and ends every sub-connection with it.
Metadata	spec.Metadata: network, destination, source, inbound tag, user and sniff result. Crosses the proxy layer, and only there.
Mixed	The special inbound protocol that serves SOCKS5 and HTTP on one port, choosing per connection from the first byte. Built by core in core/inbound/mixed from the socks5 and http modules.
Module	A folder under module/ that implements one or more spec kinds and exports a New*Module constructor (a proxy protocol exports NewProxyModule, once, whatever kinds it fills). The value the constructor returns is the module's settings; its New... methods build the running parts.
Module kind	One of the spec interfaces a module fills, each named ...Module: BaseStreamTransportModule, OverlayStreamTransportModule, StreamProxyModule, SnifferModule and so on.
Mux.Cool	V2Ray's and Xray's multiplexing format: sub-connections with an ID, a state and options, in frames both ends send and read alike. shared/muxcool; VLESS enters it with command 3. Wire layout: Mux.Cool on the wire.
NAT	core/net/udp/nat: how freedom maps a UDP session onto real sockets and filters replies, in RFC 4787 terms.
Outbound	How traffic leaves: a proxy client plus a dialer stack, freedom, or a group that picks among other outbounds (component.Outbound).
Overlay transport	A transport that wraps a layer below it, one connection at a time (WrapClientStream, WrapServerStream), such as TLS or WebSocket. tls, ws and httpupgrade are built.
Payload	What a layer returns upward: the proxied traffic with the protocol's framing removed.
Peekable stream	spec.PeekableStream: a stream whose next bytes can be looked at without consuming them. Peek may read ahead; PeekExactly never reads past what was asked. Core implements it in core/net/peekable.
Pipelining	httpupgrade's pipeline: the client sends its payload right after the upgrade request, without waiting for the 101.
Probe	The small HTTP request a group sends through each member to learn whether it works and how long it takes.
Protocol	The protocol of an inbound or outbound in the config file: a proxy protocol, freedom or a group type (urltest, fallback) on an outbound, or mixed on an inbound.
PROXY protocol	HAProxy's header a load balancer writes before the client's bytes, naming the client it accepted (versions 1 and 2). Read by the proxy_protocol overlay. Not a proxy protocol in this project's sense.
Proxy protocol	A module that speaks proxy semantics over a supplied carrier, such as SOCKS5, HTTP CONNECT or Trojan. It never opens a connection itself. Its server Accept*s requests; its client Request*s a payload.
Source endpoint	Metadata.Transport.SourceEndpoint: who the client is. The accepted socket's remote end, unless an overlay below the proxy layer replaced it with the address a proxy in front reported. The socket's own end stays in InboundRemoteEndpoint.
Resolver	core/dns: answers a lookup (a name in, addresses out) by choosing a DNS server with the DNS rules, asking for the IP versions configured, and caching the answer for its TTL. Every base transport resolves through it, as spec.Resolver.
Registry	core/registry: maps the names used in config files to module constructors, per kind. registry.Default() is the only place that names modules.
Relay	core/relay: the copy loops. relay.Stream for TCP, relay.Datagrams for a UDP session.
Request	What a proxy client sends to ask the server for a payload. Request* methods connect nothing and may send nothing until the first write.
Router	core/route/router: runs the routing rules and decides where a request goes: an outbound, or block. Shared by every inbound, it holds no per-request state and asks the traffic informant for what it lacks.
Router traffic informant	component.RouterTrafficInformant: what the router asks about the traffic it is deciding on: its Metadata, and a sniff done only when a rule asks. The handler makes one per connection, so the router never touches the stream.
Shared package	A package under shared/ that modules may import: one concept, no state, spec and the standard library only.
SNI	Server Name Indication: the host name a TLS client sends in the clear. The tls sniffer reads it; the tls transport sends it.
Sniffer	A module that recognises a protocol in the start of a payload and reports its domain, such as the TLS SNI or the HTTP Host. SnifferModule holds its settings and builds the Sniffer.
Stack	A list of transports, base first and overlays outward from the wire, composed as a fold.
Sub-connection	In Mux.Cool, one conversation on a main connection: an ID, a network (TCP or UDP) and a destination. It is a spec.Stream or a spec.Datagram and has no buffer of its own; a sub-connection nobody reads holds up the others.
Transport info	spec.TransportInfo: facts about a configured transport that only the config check reads, today the application protocols it offers or can speak.
UDP session	One client's UDP flow, such as one SOCKS5 association: core/net/udp/session.
Underlying stream	The stream a layer is handed by the layer below it, as in WrapServerStream(ctx, underlyingStream, transport) or AcceptStream(ctx, underlyingStream).
uTLS	The library (github.com/refraction-networking/utls) that sends a copy of a real browser's ClientHello; Apranik's one dependency.
Global ID	Eight bytes in the first frame of an XUDP sub-connection that name a client's UDP session across the streams that carry it, so a server can give a client that reconnects its session back. Core derives it from the session's source and a secret key; spec.Metadata.XUDPGlobalID.
XUDP	Mux.Cool's UDP form in which every datagram names its address, so one sub-connection carries UDP for many destinations and replies name their source. Xray's and sing-box's clients send most UDP this way. muxcool.DatagramOptions{XUDP: true}.