Warn before pinning unreachable manual servers (#8833)

* manual server updates

* Clarify manual server reachability warnings

* refactor(servers): use SelectionHistory instead of URLTestResults (#8840)

Map the radiance server JSON field renamed from urlTestResult to
selection_history, replacing the UrlTestResult model with a
SelectionHistory model mirroring lantern-box's TagHistory shape.
Probe delay reads now key off lastSuccessDelayMs.

* Group unavailable manual servers

* Refresh server list when opening selection screen

* Refresh reachability before listing manual servers

* Avoid duplicate URL tests in server selection

* code review updates

* build: bump radiance for URL test timeout

* ui: refine manual server reachability warnings

* Treat untested servers as unknown

* Revert "Treat untested servers as unknown"

This reverts commit 00b6258.

* server selection: distinguish "testing" from "unreachable" (#8873)

* server selection: distinguish "testing" from "unreachable"

During Smart Location convergence the url-test probe cycle takes several
minutes to visit every server. Until a server is probed it has no
selection history, so `Server.hasSuccessfulProbe` is false — and the UI
treated "no successful probe" as a single state, bucketing every
not-yet-probed server into the "Currently Unavailable" section with a
"may be unreachable" warning. A mid-convergence snapshot therefore read
as "many servers unreachable" when the probes were simply still running
(Freshdesk #178551).

Split the collapsed `!hasSuccessfulProbe` state into four, using the
backend's `consecutive_failures` (a uint, unambiguous under omitempty,
unlike the time.Time `last_outcome_at` zero value):

  - reachable           lastSuccessDelayMs > 0                -> normal row
  - awaiting probe      no verdict yet                        -> "testing"
  - flapping            1..2 failures, no success             -> normal row
  - probed & failing    >= 3 failures, no success             -> warn

The >= 3 threshold (consteq _manualSelectionFailureWarningThreshold)
follows atavism's reverted "Treat untested servers as unknown" approach:
a single transient probe failure shouldn't brand a server unreachable.

`shouldWarnBeforeManualSelection` now means probed-and-sustained-failing
only, so the section split, per-row warning icon, and pre-selection
dialog all stop firing for untested servers automatically. Untested rows
show a neutral "testing" spinner (new ServerTestingIndicator). The
per-location representative prefers a still-testing server, then any
not-yet-unreachable server, over a failed one — so a location reads as
unavailable only once all of its servers have sustained failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Treat sustained probe failures as unreachable (#8874)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: atavism <atavism@users.noreply.github.com>

---------

Co-authored-by: garmr-ulfr <104022054+garmr-ulfr@users.noreply.github.com>
Co-authored-by: Jigar-f <jigar@getlantern.org>
Co-authored-by: Myles Horton <afisk@getlantern.org>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 5 people

assets/locales/en.po

@@ -150,6 +150,9 @@ msgstr "Automatically chooses fastest location"
 msgid "pro_locations"
 msgstr "Pro locations:"
 
+msgid "currently_unavailable"
+msgstr "Currently Unavailable:"
+
 msgid "choose_your_location_with_lantern_pro"
 msgstr "Choose your location with Lantern Pro:"
 
@@ -934,6 +937,24 @@ msgstr "Private Servers"
 msgid "fastest_server"
 msgstr "Fastest Server"
 
+msgid "server_testing"
+msgstr "Testing…"
+
+msgid "server_may_be_unreachable"
+msgstr "May be unreachable"
+
+msgid "server_may_be_unreachable_title"
+msgstr "This Server may be unreachable"
+
+msgid "server_may_be_unreachable_message"
+msgstr "This Server may not work from your current network. Use Smart Location to pick a working server automatically."
+
+msgid "use_smart_location"
+msgstr "Use Smart Location"
+
+msgid "try_anyway"
+msgstr "Try Anyway"
+
 msgid "join_my_private_server"
 msgstr "Join My Lantern Private Server"
 

lib/core/common/common.dart

@@ -68,6 +68,8 @@ export 'package:lantern/core/widgets/lantern_logo.dart';
 export 'package:lantern/core/widgets/platform_card.dart';
 export 'package:lantern/core/widgets/pro_banner.dart';
 export 'package:lantern/core/widgets/pro_button.dart';
+export 'package:lantern/core/widgets/server_reachability_warning_icon.dart';
+export 'package:lantern/core/widgets/server_testing_indicator.dart';
 export 'package:lantern/features/home/data_usage.dart';
 
 export '../../core/widgets/divider_space.dart';

lib/core/models/available_servers.dart

@@ -11,22 +11,97 @@ class AvailableServers {
 
   List<Server> get userServers => servers.where((s) => !s.isLantern).toList();
 
+  /// One representative Lantern server per country/city. If any server for the
+  /// location has a successful probe, use the fastest one; otherwise prefer a
+  /// server still awaiting its first probe (so the location reads as "testing")
+  /// over one already probed-and-failing, falling back to a deterministic
+  /// representative.
+  List<Server> get lanternServerLocations {
+    final grouped = <String, List<Server>>{};
+    for (final server in lanternServers) {
+      grouped.putIfAbsent(_locationKey(server), () => <Server>[]).add(server);
+    }
+
+    return grouped.values.map(_bestServerForLocation).toList()
+      ..sort(_compareServersByLocation);
+  }
+
   bool get hasUserServers => servers.any((s) => !s.isLantern);
 
-  /// Lantern server with the lowest URL-test delay. Null when no server has
-  /// a usable probe result — sing-box reports delay 0 for unreachable probes,
-  /// so those are excluded.
+  Server? serverByTag(String tag) {
+    for (final server in servers) {
+      if (server.tag == tag) return server;
+    }
+    return null;
+  }
+
+  /// Lantern server with the lowest usable successful probe delay. Null when no
+  /// Lantern server has a successful probe that is not currently hard-failing.
   Server? get fastestLanternServer {
-    final ranked = lanternServers
-        .where((s) => s.urlTestResult != null && s.urlTestResult!.delay > 0)
-        .toList()
-      ..sort(
-        (a, b) => a.urlTestResult!.delay.compareTo(b.urlTestResult!.delay),
-      );
+    final ranked =
+        lanternServers
+            .where((s) => s.hasSuccessfulProbe && !s.isProbedUnreachable)
+            .toList()
+          ..sort(
+            (a, b) => a.selectionHistory!.lastSuccessDelayMs.compareTo(
+              b.selectionHistory!.lastSuccessDelayMs,
+            ),
+          );
     return ranked.isEmpty ? null : ranked.first;
   }
 }
 
+/// Consecutive failed probes before a server is treated as unreachable rather
+/// than merely uncertain. A single transient probe failure shouldn't brand a
+/// server "unavailable", so require sustained failures.
+const _manualSelectionFailureWarningThreshold = 3;
+
+String _locationKey(Server server) {
+  final location = server.location;
+  return [
+    location.countryCode.trim().toUpperCase(),
+    location.country.trim().toLowerCase(),
+    location.city.trim().toLowerCase(),
+  ].join('|');
+}
+
+Server _bestServerForLocation(List<Server> servers) {
+  final successful = servers
+      .where((s) => s.hasSuccessfulProbe && !s.isProbedUnreachable)
+      .toList();
+  if (successful.isNotEmpty) {
+    successful.sort((a, b) {
+      final delay = a.selectionHistory!.lastSuccessDelayMs.compareTo(
+        b.selectionHistory!.lastSuccessDelayMs,
+      );
+      if (delay != 0) return delay;
+      return a.tag.compareTo(b.tag);
+    });
+    return successful.first;
+  }
+
+  // No successful probe for this location. Prefer a server still awaiting its
+  // first probe (so the location reads as "testing"), then any server not yet
+  // ruled unreachable, falling back to the failed pool only when every server
+  // has sustained enough failures — so a location is "unavailable" only once
+  // all of its servers are.
+  final awaiting = servers.where((s) => s.isAwaitingProbe).toList();
+  final notUnreachable = servers.where((s) => !s.isProbedUnreachable).toList();
+  final pool = awaiting.isNotEmpty
+      ? awaiting
+      : (notUnreachable.isNotEmpty ? notUnreachable : servers);
+  final sorted = [...pool]..sort(_compareServersByLocation);
+  return sorted.first;
+}
+
+int _compareServersByLocation(Server a, Server b) {
+  final country = a.location.country.compareTo(b.location.country);
+  if (country != 0) return country;
+  final city = a.location.city.compareTo(b.location.city);
+  if (city != 0) return city;
+  return a.tag.compareTo(b.tag);
+}
+
 class Server {
   final String tag;
   final String type;
@@ -35,7 +110,7 @@ class Server {
   final Map<String, dynamic>? endpoint;
   final GeoLocation location;
   final ServerCredential? credentials;
-  final UrlTestResult? urlTestResult;
+  final SelectionHistory? selectionHistory;
 
   Server({
     required this.tag,
@@ -45,7 +120,7 @@ class Server {
     this.endpoint,
     required this.location,
     this.credentials,
-    this.urlTestResult,
+    this.selectionHistory,
   });
 
   factory Server.fromJson(Map<String, dynamic> json) => Server(
@@ -60,14 +135,48 @@ class Server {
     credentials: json['credentials'] != null
         ? ServerCredential.fromJson(json['credentials'] as Map<String, dynamic>)
         : null,
-    urlTestResult: json["urlTestResult"] == null
+    selectionHistory: json["selection_history"] == null
         ? null
-        : UrlTestResult.fromJson(json["urlTestResult"]),
+        : SelectionHistory.fromJson(json["selection_history"]),
   );
 
   /// IP address extracted from outbound or endpoint options.
   String get serverIP =>
       outbound?['server'] as String? ?? endpoint?['server'] as String? ?? '';
+
+  bool get hasSuccessfulProbe =>
+      (selectionHistory?.lastSuccessDelayMs ?? 0) > 0;
+
+  /// True once a probe has returned a verdict for this server — either a
+  /// success, or at least one recorded failure
+  /// ([SelectionHistory.consecutiveFailures]). Until then the server is still
+  /// awaiting its first probe and must not be presented as unreachable.
+  bool get hasProbeVerdict =>
+      hasSuccessfulProbe || (selectionHistory?.consecutiveFailures ?? 0) > 0;
+
+  /// Sustained probe failures past [_manualSelectionFailureWarningThreshold] —
+  /// enough current evidence to treat the server as unreachable rather than
+  /// merely uncertain. One or two failures are still "unknown", not
+  /// "unavailable". A prior success can still provide historical latency, but
+  /// it does not override repeated current failures.
+  bool get hasFailedProbeEvidence =>
+      (selectionHistory?.consecutiveFailures ?? 0) >=
+      _manualSelectionFailureWarningThreshold;
+
+  /// Still waiting for the first probe result. During the multi-minute Smart
+  /// Location convergence most Lantern servers sit here briefly — shown as
+  /// "testing", never as unavailable.
+  bool get isAwaitingProbe => isLantern && !hasProbeVerdict;
+
+  /// Probed and sustained-failing: failures have passed the warning threshold.
+  /// This is the only state that surfaces the unreachable warning; a server
+  /// failing only once or twice is shown normally (uncertain, not unavailable).
+  bool get isProbedUnreachable => isLantern && hasFailedProbeEvidence;
+
+  /// Manual mode pins traffic to exactly this server. Warn before pinning only
+  /// once the server has sustained enough failed probes — never while it is
+  /// still being tested ([isAwaitingProbe]) or after only a transient failure.
+  bool get shouldWarnBeforeManualSelection => isProbedUnreachable;
 }
 
 class GeoLocation {
@@ -113,17 +222,59 @@ class ServerCredential {
       );
 }
 
-class UrlTestResult {
-  int delay;
-  DateTime time;
+/// SelectionHistory mirrors radiance's per-server selection history. Probe
+/// outcomes feed [lastSuccessDelayMs]/[consecutiveFailures]; real user-traffic
+/// failures feed [userFailures], kept separate so a censor that passes the
+/// probe URL while dropping user traffic is still visible.
+class SelectionHistory {
+  /// Most recent successful probe RTT in milliseconds. 0 means no successful
+  /// probe yet, used as the sentinel by [Server.hasSuccessfulProbe].
+  final int lastSuccessDelayMs;
+
+  /// Timestamp of the most recent probe outcome, success or failure.
+  final DateTime? lastOutcomeAt;
+
+  /// Probe failures since the last probe success; resets on success.
+  final int consecutiveFailures;
+
+  /// Sliding window of user-traffic failure timestamps. Probe successes never
+  /// enter this window.
+  final List<DateTime> userFailures;
 
-  UrlTestResult({required this.delay, required this.time});
+  final DateTime? updatedAt;
 
-  factory UrlTestResult.fromJson(Map<String, dynamic> json) =>
-      UrlTestResult(delay: json["delay"], time: DateTime.parse(json["time"]));
+  SelectionHistory({
+    this.lastSuccessDelayMs = 0,
+    this.lastOutcomeAt,
+    this.consecutiveFailures = 0,
+    this.userFailures = const [],
+    this.updatedAt,
+  });
+
+  factory SelectionHistory.fromJson(Map<String, dynamic> json) =>
+      SelectionHistory(
+        lastSuccessDelayMs: json["last_success_delay_ms"] ?? 0,
+        lastOutcomeAt: json["last_outcome_at"] == null
+            ? null
+            : DateTime.parse(json["last_outcome_at"]),
+        consecutiveFailures: json["consecutive_failures"] ?? 0,
+        userFailures:
+            (json["user_failures"] as List<dynamic>?)
+                ?.map((e) => DateTime.parse(e as String))
+                .toList() ??
+            const [],
+        updatedAt: json["updated_at"] == null
+            ? null
+            : DateTime.parse(json["updated_at"]),
+      );
 
   Map<String, dynamic> toJson() => {
-    "delay": delay,
-    "time": time.toIso8601String(),
+    "last_success_delay_ms": lastSuccessDelayMs,
+    if (lastOutcomeAt != null)
+      "last_outcome_at": lastOutcomeAt!.toIso8601String(),
+    "consecutive_failures": consecutiveFailures,
+    if (userFailures.isNotEmpty)
+      "user_failures": userFailures.map((e) => e.toIso8601String()).toList(),
+    if (updatedAt != null) "updated_at": updatedAt!.toIso8601String(),
   };
 }

lib/core/widgets/server_reachability_warning_icon.dart

@@ -0,0 +1,29 @@
+import 'package:flutter/material.dart';
+import 'package:lantern/core/common/app_asset.dart';
+import 'package:lantern/core/common/app_image_paths.dart';
+import 'package:lantern/core/common/app_semantic_colors.dart';
+import 'package:lantern/core/localization/i18n.dart';
+
+/// Warning icon shown when a server may be unreachable.
+class ServerReachabilityWarningIcon extends StatelessWidget {
+  const ServerReachabilityWarningIcon({super.key, this.size});
+
+  final double? size;
+
+  @override
+  Widget build(BuildContext context) {
+    final label = 'server_may_be_unreachable'.i18n;
+    return Tooltip(
+      message: label,
+      child: Semantics(
+        label: label,
+        child: AppImage(
+          path: AppImagePaths.info,
+          height: size,
+          width: size,
+          color: context.statusWarningBgDot,
+        ),
+      ),
+    );
+  }
+}

lib/core/widgets/server_testing_indicator.dart

@@ -0,0 +1,32 @@
+import 'package:flutter/material.dart';
+import 'package:lantern/core/common/app_semantic_colors.dart';
+import 'package:lantern/core/localization/i18n.dart';
+
+/// Spinner shown while a server is still awaiting its first url-test result.
+/// Distinct from the unreachable warning: a server is "testing" until a probe
+/// returns a verdict, and only "unreachable" once a probe has failed.
+class ServerTestingIndicator extends StatelessWidget {
+  const ServerTestingIndicator({super.key, this.size});
+
+  final double? size;
+
+  @override
+  Widget build(BuildContext context) {
+    final label = 'server_testing'.i18n;
+    final dimension = size ?? 16.0;
+    return Tooltip(
+      message: label,
+      child: Semantics(
+        label: label,
+        child: SizedBox(
+          width: dimension,
+          height: dimension,
+          child: CircularProgressIndicator(
+            strokeWidth: 2,
+            color: context.textTertiary,
+          ),
+        ),
+      ),
+    );
+  }
+}

lib/features/home/provider/app_event_notifier.dart

@@ -52,6 +52,13 @@ class AppEventNotifier extends _$AppEventNotifier {
 
           break;
         case 'server-location':
+          // The selected server event is also our current Lantern-only signal
+          // that Smart Location probe data may have changed.
+          unawaited(
+            ref
+                .read(availableServersProvider.notifier)
+                .forceFetchAvailableServers(),
+          );
           // Only consume this event when the user is actually in auto mode.
           // Otherwise (custom server selected) ignore it — applying it would
           // silently flip the user's selection back to Smart Location on