fix(vpn): set NoDrop on reject rule action (#627)

* fix(vpn): set NoDrop on reject rule action

Also add comment-guidance line to AGENTS.md on keeping invariant
comments minimal.

* fix(vpn): scope NoDrop to the IPv6 reject rule

NoDrop is only needed on the ::/0 reject so Happy Eyeballs fails over
to IPv4 instead of dropping. Move it off the general reject rule and
assert it in TestRejectIPv6Rule.

Author: garmr-ulfr

AGENTS.md

@@ -6,6 +6,7 @@
 
 - Prefer clearer names and smaller functions over explanatory comments.
 - Delete or shorten verbose comments in code you touch.
+- A comment that documents a real invariant, race, or rationale still fails if it includes more detail than needed to preserve that contract.
 - Do not narrate code, repeat the identifier, list visible branches, mention tickets/people, or praise the implementation.
 - Documentation should only document the declaration's own contract: side effects, blocking/zero-value behavior, errors, ownership, cancellation, concurrency, or surprising pre/postconditions.
 - Document the caller-relevant semantics of a sentinel error, enum, status, or constant — retryability, permanence, lifecycle — as the value's own contract, phrased as what it means rather than advice: prefer "retryable only after …" over "callers should …". The consumer behavior to avoid is a separate component's policy, not the meaning of a value callers inspect.

vpn/boxoptions.go

@@ -633,7 +633,9 @@ func highMemoryRejectRule() O.Rule {
 // RST) makes Happy Eyeballs fail over at once; "drop" would blackhole and stall.
 // Must be appended after the direct-routing rules so intentionally-direct v6 is kept.
 func rejectIPv6Rule() O.Rule {
-	return rejectRule(O.RawDefaultRule{IPCIDR: []string{"::/0"}})
+	rule := rejectRule(O.RawDefaultRule{IPCIDR: []string{"::/0"}})
+	rule.DefaultOptions.RuleAction.RejectOptions.NoDrop = true
+	return rule
 }
 
 func newDNSServerOptions(typ, tag, server, domainResolver string) O.DNSServerOptions {

vpn/boxoptions_test.go

@@ -526,6 +526,8 @@ func TestRejectIPv6Rule(t *testing.T) {
 	assert.Equal(t, []string{"::/0"}, []string(r.DefaultOptions.RawDefaultRule.IPCIDR))
 	assert.NotEqual(t, C.RuleActionRejectMethodDrop, r.DefaultOptions.RuleAction.RejectOptions.Method,
 		"must not use the drop method — a silent blackhole stalls instead of failing over to IPv4")
+	assert.True(t, r.DefaultOptions.RuleAction.RejectOptions.NoDrop,
+		"NoDrop must be set so the reject returns unreachable instead of dropping")
 }
 
 func TestTunHasIPv6(t *testing.T) {