SOCKS5 works server-side but DPI on user's path blocks it -> stood up mtg v2.2.8 as systemd service (DynamicUser, Restart=always), FakeTLS domain www.cloudflare.com. Verified: openssl probe -> valid TLS1.3 CN=www.cloudflare.com (indistinguishable from real HTTPS). Secret + tg link in pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>