Fix TUN status with auto-redirect disabled

scripts/dev/check-tun-policy-routing-status.sh

@@ -25,20 +25,24 @@ assert_equal() {
   echo "ok - $name"
 }
 
-# Reproduce Issue #303: policy routing sends both direct-looking probes through
-# Tun, so comparing their public IPs alone reports traffic-same-as-host.
+# Reproduce Issues #303 and #309: policy routing sends both direct-looking
+# probes through Tun, so comparing their public IPs alone reports
+# traffic-same-as-host. The fallback must follow auto-route, including when
+# auto-redirect is disabled.
 tun_enabled() { printf 'true\n'; }
 runtime_config_tun_enabled() { printf 'true\n'; }
 status_is_running() { return 0; }
 proxy_controller_reachable() { return 0; }
 tun_public_ip_without_proxy_env() { printf '203.0.113.10\n'; }
 tun_public_ip_with_current_route() { printf '203.0.113.10\n'; }
-runtime_config_tun_auto_redirect() { printf 'true\n'; }
+test_auto_route="true"
+runtime_config_tun_auto_route() { printf '%s\n' "$test_auto_route"; }
+runtime_config_tun_auto_redirect() { printf 'false\n'; }
 tun_has_policy_routing_evidence() { return 0; }
 tun_log_tun_source_line() { printf '[TCP] 28.0.0.1:1234 --> example.com:443\n'; }
 
 assert_equal \
-  "accepts policy routing with observed Tun traffic" \
+  "accepts auto-route policy routing when auto-redirect is disabled" \
   "ok" \
   "$(tun_current_effective_result)"
 
@@ -54,6 +58,14 @@ assert_equal \
   "likely-effective" \
   "$(status_tun_effective_status)"
 
+# Do not let stale policy-routing evidence override a runtime configuration that
+# explicitly disables auto-route.
+test_auto_route="false"
+assert_equal \
+  "requires auto-route before accepting policy routing evidence" \
+  "traffic-same-as-host" \
+  "$(tun_current_effective_result)"
+
 # Reproduce the restart race: verification must happen only after waiting for
 # the controller following service_restart.
 tmp_dir="$(mktemp -d)"