diff --git a/README.md b/README.md
index 54d2035..c8ee4ca 100755
--- a/README.md
+++ b/README.md
@@ -418,6 +418,29 @@ equivalently, add the group via your own `users.users.<name>.extraGroups`. See
 the security note under [Using it under niri](#using-it-under-niri-wayland), then
 that section for binding it to a key.
 
+#### macOS (`Splitway.app`)
+
+On macOS the GUI ships as a self-installing app — **no Terminal, no Homebrew, no
+code signing**. Build it locally (it is ad-hoc/unsigned, `.app` only):
+
+```sh
+bash splitway-gui-tauri/scripts/build-macos-app.sh
+cp -R target/release/bundle/macos/Splitway.app /Applications/
+```
+
+The wrapper pulls its off-PATH toolchain (`cargo-tauri`, `node`, `esbuild`, …)
+from nixpkgs via `nix shell`, so it just runs. A locally-built `.app` carries no
+quarantine flag, so it launches from `/Applications` with no Gatekeeper prompt.
+
+Open it and click **Install & start the Splitway service**: one native password
+prompt installs the `splitway-daemon`/`splitway` helpers to `/usr/local/bin`,
+creates the `splitway` group and adds you to it, and bootstraps the root
+LaunchDaemon with a group-reachable socket — the app then shows **Connected** (no
+re-login needed if you launch it after the install; an app left open across the
+install reconnects after a relaunch). A discreet **Stop the Splitway service**
+footer link reverses it (the daemon reverts `/etc/resolver` and won't relaunch at
+boot). See [docs/design/macos-self-install.md](docs/design/macos-self-install.md).
+
 ### Using it under niri (Wayland)
 
 niri is a tiling Wayland compositor with **no system tray**, so Splitway is a
diff --git a/ROADMAP.md b/ROADMAP.md
index e1e6ade..200735e 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -184,7 +184,7 @@ reimplemented per frontend:
 - **7a — `splitway-gui-core`** (done): extract the framework-agnostic GUI logic
   (the pure view-model **and** the truth-contract orchestration) into a crate
   depending on `splitway-shared` only, so both egui and the future Tauri backend
-  drive one `GuiCore`. See [`docs/design/gui-core-extraction.md`](design/gui-core-extraction.md).
+  drive one `GuiCore`. See [`docs/design/gui-core-extraction.md`](docs/design/gui-core-extraction.md).
 - **7b — Tauri shell + read-only view** (done): the `splitway-gui-tauri` backend
   hosts `GuiCore` and pushes the full view-model to a vanilla-TS frontend that
   renders it read-only (no mutations — those are 7c). gui-core gained `Verify`
@@ -209,7 +209,7 @@ reimplemented per frontend:
   store. Frozen-on-malformed mutations are rejected with an on-disk-fix message
   and the frozen state is shown prominently. No protocol change (the verbs already
   exist at v6); egui stays a read/write reference, untouched. See
-  [`docs/design/tauri-mutations.md`](design/tauri-mutations.md).
+  [`docs/design/tauri-mutations.md`](docs/design/tauri-mutations.md).
 - **7d — visual design + window behavior** (done): the approved Variant B design as
   the real Tauri UI — full-window layout, the simplified interface-centric model
   (interface + domains; DNS auto-derived and shown read-only; no vpn-name/backend
@@ -220,7 +220,7 @@ reimplemented per frontend:
   authorized additive protocol bump (v6 → **v7**): `StatusInfo.detected_dns` exposes
   the selected interface's detected DNS independent of apply state, so the DNS
   readout is honest in the empty/disabled states too. See
-  [`docs/design/tauri-design-window.md`](design/tauri-design-window.md). (Manual-DNS
+  [`docs/design/tauri-design-window.md`](docs/design/tauri-design-window.md). (Manual-DNS
   override — for VPNs that connect but push no DNS — is deferred as a real future
   daemon feature, not built here.)
 - **7d-2 — bundling**: Nix packaging (two-stage frontend + Rust, `wrapGAppsHook3`,
@@ -229,6 +229,42 @@ reimplemented per frontend:
   `packages.<system>.splitway-gui`, bundling the IBM Plex OFL `woff2`, and the
   README GUI-install section. Split from 7d because its real proof — the *built*
   binary rendering for a fresh in-group niri user — is machine-bound.
+- **7d-3 — macOS self-install**: the macOS counterpart of 7d-2's Linux bundling.
+  An ad-hoc/unsigned `Splitway.app` (`.app` only — no signing, notarization,
+  `.dmg`/`.pkg`, or `SMAppService`) that bundles the `splitway-daemon` + `splitway`
+  helpers, a GUI LaunchDaemon plist (carrying `--socket-group splitway`), and a
+  `bootstrap.sh`. Two health-keyed Tauri commands escalate via `osascript … with
+  administrator privileges` (one native password prompt) to install/start
+  (`NotRunning` → Install button) and disable (footer link) the root daemon — no
+  terminal. The bundle path is additive (the Tauri bundler is invoked only by the
+  build wrapper; `cargo build` / `nix build` never read `bundle`), and the commands
+  keep the truth contract (do the work → refresh-now → never touch the VM). Split
+  from 7d-2 because its real proof — the built `.app` driving the live install on
+  macOS — is machine-bound. See
+  [`docs/design/macos-self-install.md`](docs/design/macos-self-install.md). (Homebrew —
+  installing the same `.app` + binaries, with no competing `service` block — is the
+  next phase.)
+- **7d-4 — macOS DNS privacy (demote + scope)**: the macOS backend reaches DNS
+  parity with Linux. The previous backend only *scoped* the corp domains via
+  `/etc/resolver`; that is insufficient against a VPN client that hijacks the
+  system **default** resolver (the corp resolver is the global default, scoped to
+  no `utun`, so non-corp DNS would also traverse the tunnel). This phase adds the
+  **demote**: snapshot the primary network service's DNS, overwrite it with an
+  off-tunnel fallback (the physical interface's own DHCP resolver, or a
+  configured `fallback_dns` override), and restore it on every revert path —
+  transactional and reversible (an on-disk snapshot survives an unclean exit).
+  Detection is rewritten to be **structural and vendor-neutral**: it reads the
+  per-service DNS model (a service whose resolver differs from the physical
+  link's is the VPN) rather than filtering `scutil --dns` by a `utun` — and reads
+  the VPN signal from the VPN's *own* service, not the global default Splitway
+  mutates, so the demote does not cause detection to oscillate. The state machine
+  is decoupled from `vpn_name` on macOS (gated via `reverts_globally()`); Linux
+  stays interface-keyed and unchanged. DNS only — no IP-route manipulation (the
+  client already splits IP; same boundary as Linux). The GUI interface-picker
+  becomes a benign no-op on macOS (removal is a later GUI phase). Implementation +
+  synthetic-fixture tests land here; the live packet-level / reconnect / revert
+  acceptance is machine-bound and verified separately. See
+  [`docs/design/macos-dns-privacy.md`](docs/design/macos-dns-privacy.md).
 
 ### Phase 8 — feature freeze + hardening
 
diff --git a/docs/design/macos-dns-privacy.md b/docs/design/macos-dns-privacy.md
new file mode 100644
index 0000000..e718803
--- /dev/null
+++ b/docs/design/macos-dns-privacy.md
@@ -0,0 +1,233 @@
+# macOS DNS privacy — demote the hijacked default + scope the corp domains
+
+The macOS backend used to do only half of split-DNS: it wrote
+`/etc/resolver/<domain>` files so the configured corp domains resolve via the
+corp DNS. That is the **scope** half. It is sufficient only when the VPN client
+*scopes* its DNS to the tunnel. The observed corporate VPN does the opposite — a
+**global DNS hijack**: it registers the corp resolver as the system **default**,
+so every query that is *not* a configured corp domain would also go to the corp
+resolver, over the tunnel. That is the privacy leak Splitway exists to prevent.
+
+This phase adds the missing half — **demote** — so macOS reaches parity with the
+Linux build: the corp resolver sees only the configured corp domains; everything
+else leaves via the normal (physical) path and never traverses the tunnel.
+
+> **Detection is structural and vendor-neutral.** Nothing in the code, tests, or
+> this document names a VPN product or its services. Detection keys on the
+> *shape* of the DNS configuration (a service whose resolver differs from the
+> physical link's), never on a vendor string — so it generalises across clients.
+
+## What the established facts were (proven on the author's Mac)
+
+- **The corp resolver is the system default, not tunnel-scoped.** There is no
+  resolver scoped to any `utun`; the active tunnel `utun` index even varies
+  between sessions. So the previous interface-keyed detector (filter
+  `scutil --dns` by a chosen `utun`) found nothing, for any interface choice.
+- **Demote holds.** Overwriting the primary network service's `ServerAddresses`
+  to a different resolver stuck (the client did not re-assert in a tight loop).
+- **Demote is real, not cosmetic.** With the default demoted, no DNS for public
+  names traversed the tunnel — the client does not transparently intercept `:53`.
+- **`/etc/resolver/<domain>` is immune.** The client never touches those files; a
+  scoped resolver there takes precedence over the default for its domain.
+- **IP is already split by the client** — non-corp IPs route off-tunnel — so
+  Splitway does **no** IP-route manipulation on macOS (unlike Linux's
+  default-route demote). Splitway governs DNS only; see the boundary below.
+
+(Synthetic stand-ins used throughout: corp DNS `192.0.2.53`, physical DHCP DNS
+`198.51.100.1`, public-resolver override `203.0.113.9`, corp domains
+`corp.example.com` / `jira.example.com`, interfaces `en0` / `utun0`.)
+
+## The mechanism: demote + scope, transactional and reversible
+
+On apply (VPN up, with corp domains configured), the macOS backend does both:
+
+1. **Scope** — write `/etc/resolver/<domain>` → corp DNS for each corp domain
+   (unchanged from before; on-tunnel, intended). Transactional: a mid-write
+   failure restores every file to its prior bytes.
+2. **Demote** — overwrite the primary network service's DNS
+   (`State:/Network/Service/<primary>/DNS` `ServerAddresses`) with an off-tunnel
+   **fallback** resolver, so non-corp DNS resolves off-tunnel. The prior value is
+   **snapshotted to disk first** so it can be restored exactly.
+
+Net effect: corp domains → corp DNS (on-tunnel); everything else → fallback DNS
+(off-tunnel, invisible to the corp resolver).
+
+The two steps are transactional **across both**: if the demote fails, the
+resolver scope just written is rolled back, so the system is never left
+half-changed (scoped but with the default still hijacked). The apply then
+surfaces the error rather than recording success.
+
+On revert (VPN down / disable / stop / shutdown) the backend removes every
+managed `/etc/resolver` file **and** restores the demoted default from the
+snapshot (then clears it). Restore runs on every exit path — the daemon already
+reverts on `SIGTERM` (what `launchctl bootout` sends).
+
+### The fallback resolver
+
+The off-tunnel fallback defaults to the **physical primary interface's own DHCP
+resolver** (the resolver that interface would use absent any override), which the
+detector discovers. A config override — `fallback_dns` in the daemon config —
+pins a specific public resolver instead (e.g. `["203.0.113.9"]`). The state
+machine folds the override (if set) over the detector's value before handing the
+effective fallback to the backend. The override is a root-config-file-only field
+(the GUI does not edit it — out of scope this phase).
+
+## Structural, vendor-neutral detection
+
+Detection reads the SystemConfiguration dynamic store (via `scutil` in script
+mode) and decides **structurally**:
+
+- the **primary interface** — `State:/Network/Global/IPv4` `PrimaryInterface`
+  (e.g. `en0`);
+- every network service's DNS entry — `State:/Network/Service/.*/DNS`
+  (`InterfaceName` + `ServerAddresses`).
+
+The **physical service** is anchored authoritatively by the **primary service
+id** (`State:/Network/Global/IPv4` `PrimaryService`), falling back to the primary
+interface name only when the id is unknown — because a VPN service can *also*
+report the primary interface name, so matching on the interface alone could pick
+the wrong service and invert corp/fallback. Its resolver is the demote-target. A
+**VPN service** is any service *other than the physical one* (compared by id)
+whose DNS differs from the physical resolver — i.e. a non-physical resolver is in
+play. VPN is **up** iff such a service exists; its resolver is the corp DNS. The
+decision is a set comparison (order-insensitive), and it never references a
+`utun` name or a vendor string.
+
+When Splitway demotes the physical service, it **re-adds that service's
+`InterfaceName`** (the demote write would otherwise drop it, since it rebuilds a
+minimal DNS dict). Keeping `InterfaceName` — and anchoring on the service id —
+means the physical service stays identifiable on the next detection round, so our
+own demote never makes detection lose the physical service (which would invert
+corp/fallback or undo the demote).
+
+### Why detection reads per-service DNS, not `State:/Network/Global/DNS`
+
+This is load-bearing for stability. Splitway's *demote* overwrites the physical
+primary service's DNS, which changes the **global default**. A detector keyed on
+`State:/Network/Global/DNS` would therefore see the global default become the
+fallback the moment our demote took effect, conclude "no VPN" (global == the
+physical resolver), revert → the VPN's default returns → re-demote → **oscillation**.
+
+Reading the VPN's corp DNS from its *own* service entry — which our demote does
+**not** touch — keeps detection stable while the demote is in effect: the verdict
+is unchanged before and after our own write. A unit test
+(`detection_survives_our_own_demote_of_the_physical_service`) pins this.
+
+## Decoupling the state machine from `vpn_name` (macOS only)
+
+The state machine used to gate apply/revert on
+`info.interface_name == config.vpn_name`. On macOS there is no stable, DNS-scoped
+VPN interface to pin (the active `utun` varies), so that gate would never pass.
+The gate is now branched on the backend's existing `reverts_globally()` seam:
+
+- **global-revert backend (macOS)** → the interface gate is skipped; apply is
+  driven by the DNS-model detection the detector already decided. The advisory
+  `interface_name` rides along in `VpnInfo` but nothing keys on it.
+- **per-interface backend (Linux)** → unchanged: the gate still requires
+  `interface_name == vpn_name`.
+
+The same branch covers the two read-only projections that used the gate
+(`status().detected_dns` and `routing_state()`), so the macOS status readout is
+honest. Linux behaviour is byte-for-byte unchanged (its `MockBackend` defaults
+`reverts_globally` to false; all existing Linux state tests pass untouched).
+
+## Reconcile on event
+
+Reconnect / Wi-Fi toggle / sleep-wake / re-auth can re-install the corp default
+or change the physical DHCP resolver. The SCDynamicStore watch fires on the
+relevant DNS keys; the detector re-reads the model and re-emits `Up` whenever the
+corp DNS **or** the demote-target changed (the watcher dedups only genuine
+no-ops). The applied snapshot now also tracks the demote-target, so a change to
+it forces a re-apply (re-demote to the new fallback) rather than being treated as
+already converged. This is purely event-driven — no busy loop, no timer; one
+re-apply per genuine change.
+
+Because the observed client did **not** re-assert in a tight loop, no
+sub-second re-apply guard is needed; a re-assert that arrives as a DNS-key change
+is handled by the normal event path. The demote is idempotent (re-setting the
+same fallback), and the snapshot is captured only on the *first* demote of a
+given service, so a re-apply never overwrites the original prior state with our
+own fallback.
+
+**Primary-service change.** If the primary network service itself changes while
+the VPN stays up (e.g. Wi-Fi → Ethernet) and a demote snapshot already exists for
+the *old* service, the demote first **restores the old service** from its
+snapshot (so it is not left pinned to Splitway's fallback), then snapshots and
+demotes the new primary. Exactly one service is ever demoted at a time, and no
+previous primary is stranded on the fallback.
+
+## Reversibility (the operational-safety contract)
+
+- The pre-demote primary-service DNS is **snapshotted to disk** before the
+  overwrite (`/var/run/splitway/dns-demote.snapshot`), so an unclean exit — the
+  daemon `SIGKILL`ed between demote and a later revert — can still be undone on
+  the next start. The snapshot uses `atomic_write` (intact on a crash mid-write).
+- Restore rewrites exactly the snapshotted servers, or removes the key entirely
+  when the service had no explicit prior DNS (so SystemConfiguration repopulates
+  it from the real source), then clears the snapshot.
+- Every system-network mutation is captured-before-write and rolled back on any
+  failure path, mirroring the `/etc/resolver` apply's existing discipline — the
+  machine is never left with a broken or half-demoted resolver.
+
+## Testability
+
+All `scutil` contact goes through two seams so the logic is unit-tested without
+touching the live system:
+
+- detection parses the dynamic-store dumps with **pure** functions over the
+  synthetic-fixture dump shapes; the structural decision is a separate pure step;
+- the demote/restore go through an injected `ScutilRunner` (the real impl shells
+  out; tests inject a fake that **captures the exact script issued** and returns
+  canned state) and a `SnapshotStore` (real = on-disk; tests = in-memory). The
+  `apply_with` / `revert_with` wiring (including the rollback-on-demote-failure)
+  is tested with both seams faked.
+
+## Scope boundary — DNS only, not IP routing
+
+Splitway governs **DNS**, not IP routing. The observed client's split-tunnel
+already keeps non-corp **IP** traffic off the tunnel, so macOS does no route
+manipulation. A full-tunnel / include-routes VPN that carried IP traffic through
+the corp tunnel is **out of scope** (the same boundary as Linux): Splitway would
+still split the DNS, but the IP path is the VPN client's concern. This is
+deliberate and documented so the boundary is not mistaken for a gap.
+
+## What is not built here
+
+- **GUI changes** (interface-picker removal, a corp-domains / fallback-DNS UI) —
+  a later phase. The macOS daemon no longer depends on the *value* of `vpn_name`
+  for correctness — the detector auto-detects and ignores whatever is picked — so
+  the picker is a value-agnostic no-op there. One residual dependency remains,
+  though: `vpn_name` is still load-bearing as the **arming switch**. `arm_watch`
+  bails out when `vpn_name` is empty (`DetectorHealth::Inactive`, no SCDynamicStore
+  watch, no initial sample), and a fresh macOS self-install boots exactly there
+  (`bootstrap.sh` starts the daemon, which self-creates its config with an empty
+  `vpn_name`), so no detection runs until the user picks *some* interface (any
+  value works). Today the GUI's platform-agnostic main stage pushes the user
+  through the picker, so the flow works in practice; a future picker-removal /
+  auto-detection phase must also branch `arm_watch`'s empty-name gate (e.g. on
+  `reverts_globally()`) or it would silently disable macOS detection. The state
+  machine is strictly daemon-side here.
+- **Homebrew packaging** — a later phase; nothing ships until the live
+  acceptance below passes.
+- **The live verification itself** — see below. This phase is implementation +
+  synthetic-fixture tests only.
+
+## Deferred — live acceptance (run on the real VPN, not in this phase)
+
+1. Packet-level, both interfaces, fresh random subdomains: public queries on the
+   physical interface, **zero on the tunnel**; a corp host still resolves (via
+   `/etc/resolver`).
+2. Event robustness: reconnect / Wi-Fi toggle / sleep-wake → the demote re-holds.
+3. Clean revert: stop / VPN-down restores the machine exactly as found.
+4. `status` / `verify` / `check <corp-host>` / `check <public-host>` report the
+   true state.
+
+## Links
+
+- [socket-group.md](socket-group.md) — the unprivileged-GUI access model.
+- [macos-self-install.md](macos-self-install.md) — how the macOS daemon is
+  installed/run (the privileged bootstrap this DNS work runs under).
+- [linux-default-route-catch-all.md](linux-default-route-catch-all.md) — the
+  Linux analogue (demote the link's DNS default-route so split-DNS holds).
+- [architecture.md](../architecture.md) — the truth contract and the DNS-only
+  boundary.
diff --git a/docs/design/macos-self-install.md b/docs/design/macos-self-install.md
new file mode 100644
index 0000000..7427239
--- /dev/null
+++ b/docs/design/macos-self-install.md
@@ -0,0 +1,220 @@
+# macOS self-install — one-click privileged daemon bootstrap from Splitway.app
+
+The macOS daemon must run as **root** (it writes `/etc/resolver/<domain>` and
+flushes the DNS cache). Before this, bringing it up meant a terminal ritual:
+`sudo launchctl load …` plus a hand-written config. This feature makes the user
+double-click `Splitway.app`, click one button, authenticate once via the native
+macOS password dialog, and have the root daemon installed + running — no terminal.
+
+## The agreement
+
+`Splitway.app` is built locally from source and ships **unsigned** (ad-hoc
+identity `-`): no Apple Developer account, no notarization, `.app` only (no
+`.dmg`/`.pkg`). A locally-built `.app` carries no `com.apple.quarantine`, so it
+launches from `/Applications` without Gatekeeper friction — which is exactly what
+makes the no-signing path viable.
+
+The app installs the daemon itself through two Tauri commands keyed to the
+existing health states:
+
+- **`install_service`** — offered when `Health == NotRunning` (no socket). It
+  escalates via `osascript`'s `do shell script … with administrator privileges`
+  (one native password prompt) to run the bundled `bootstrap.sh install` as root.
+  The script, idempotently: installs `splitway-daemon` + `splitway` from the app
+  bundle to `/usr/local/bin` (`755`, quarantine stripped); ensures a `splitway`
+  group and adds the console user; installs the GUI LaunchDaemon plist (carrying
+  `--socket-group splitway`) to `/Library/LaunchDaemons`; and
+  `launchctl bootout` → `bootstrap` → `enable`s it.
+- **`disable_service`** — a discreet footer link once connected. Runs
+  `bootstrap.sh disable`: `launchctl bootout` (SIGTERM → the daemon reverts
+  `/etc/resolver` before exit) and removes the plist so it will not relaunch.
+
+Both keep the **truth contract** ([architecture.md](../architecture.md) §2): the
+command does the privileged work, fires refresh-now, and returns a
+`Result<(), String>` — it never touches the view-model. The real health
+(`NotRunning` → `PermissionDenied`/`Connected`, or back to `NotRunning`) flows
+back only through the next `view-model-changed`, exactly as for the mutation
+commands. No optimistic flips.
+
+A third command, **`host_platform`**, lets the frontend branch the remediation
+copy: macOS gets the Install button / sign-out guidance; Linux keeps its
+`systemctl` / `usermod` copy-paste commands. This is frontend presentation only —
+no view-model field is added, so the bindings contract is untouched.
+
+## Why this shape
+
+- **`osascript` admin escalation, not `SMAppService`.** `SMAppService` needs code
+  signing + notarization + a user-approved Login Item — all rejected here.
+  `osascript … with administrator privileges` is the supported, signing-free way
+  to get one password prompt and run a fixed root command.
+- **Not the deprecated `AuthorizationExecuteWithPrivileges`**, and not a
+  `brew services` wrapper (a Finder-launched `.app` has a minimal `PATH`, and the
+  brew prefix differs Intel vs ARM — Homebrew is a later phase anyway).
+- **The escalated command is inert.** It is a fixed `/bin/bash <script> install`
+  where the only variable is the bundle-derived resource path — never GUI/user
+  input. The path is injected as an AppleScript string variable and handed to the
+  shell via `quoted form of`, so a path with spaces stays one token; an unsigned
+  app running a root command must keep that surface closed
+  (`build_admin_applescript` is pure + unit-tested for this).
+- **All steps in one bundled `bootstrap.sh`** under one privilege prompt: one
+  password dialog, `set -euo pipefail`, a pinned system `PATH`, every step
+  idempotent — a failed install never half-configures the system (the same
+  apply-or-rollback bar the daemon itself holds). The `bootout`→`bootstrap`
+  relaunch settles (polls the service record to gone) and retries the transient
+  launchd race so a re-install does not intermittently leave the daemon stopped.
+- **The root daemon binary must live in a fully root-owned path.** It is installed
+  to `/usr/local/bin` `root:wheel 0755`, and the installer **pins that directory to
+  `root:wheel 0755` and verifies every parent component up to `/` is root-owned and
+  not group/other-writable, aborting before it touches ownership if any link is
+  not** — otherwise, on the Homebrew-on-Intel layout where `/usr/local` (or
+  `/usr/local/bin`) is admin-writable, a non-root process could swap the binary —
+  or, since renaming a directory entry needs write access to its *parent*, rename
+  the pinned `bin` out from under us and drop in its own — and have the root
+  LaunchDaemon exec it at the next boot (a persistent local privilege escalation —
+  the launchd "unsafe binary location" anti-pattern). The parent-chain check is
+  **lexical**, so it also resolves symlinks before trusting the result: a symlinked
+  `/usr/local/bin` (e.g. → `/Users/alice/bin`) would pass the lexical check while
+  the real target sits in a user-writable tree, so the installer additionally
+  verifies the physical target's ancestor chain (a non-symlink layout resolves to
+  the same path, so it is a no-op there).
+- **An independent LaunchDaemon, group-reachable socket.** The GUI runs as the
+  desktop user, so it reaches the root daemon only through the opt-in socket group
+  (`--socket-group splitway` → `/var/run/splitway` `0750 root:splitway`, socket
+  `0660 root:splitway`) — the macOS analog of the NixOS `unprivilegedGui` option
+  ([socket-group.md](socket-group.md)). The bundled GUI plist carries that flag;
+  the sibling `com.splitway.daemon.plist` stays the manual/sudo (root-only socket)
+  path.
+- **Disable is conservative.** It stops the daemon and removes the plist, but
+  leaves the binaries, group, membership, and config — so a re-install needs no
+  re-prompt. Full uninstall is a separate, later step.
+
+## Trust boundary of the unsigned self-installer
+
+The `.app` is unsigned and built locally, so there is no cryptographic anchor over
+the bundle. Authenticating the `osascript` prompt delegates root to whatever
+currently sits in `Contents/Resources`: `osascript` runs
+`/bin/bash <bundle>/Contents/Resources/bootstrap.sh install` **as root**, and
+`splitway-daemon` is copied from that same directory. Codex flagged that this
+copies a bundled binary into a root-run location without verifying it; the residual
+risk is real, but it is a categorical limitation of the unsigned model, not a
+fixable gap in the script — so it is documented here rather than papered over with
+an in-bundle check.
+
+- **No in-bundle integrity check is attempted, by design — the load-bearing
+  reason is co-location.** `bootstrap.sh` is co-located with, and exactly as
+  writable as, the binaries it copies (and the GUI binary in `Contents/MacOS`).
+  Any principal who can replace `splitway-daemon` can equally rewrite
+  `bootstrap.sh`, so a compiled-in hash or an in-script source check is defeated
+  by the same write access: the attacker edits out the check, or replaces the
+  whole script with a root payload that runs before any check. This holds even for
+  a *narrower, non-breaking* source check (e.g. "refuse if the source is
+  group/other-writable, or owned by a principal other than the console user/root"):
+  in the only cross-user state where it would fire, the less-privileged writer
+  authored `bootstrap.sh` too and just deletes the check; and in the same-user
+  TOCTOU case it is a no-op (owner == console user, path not world-writable → it
+  passes). The verifier cannot sit outside the writable bundle, so it offers no
+  protection against the only attacker who can trigger the bug.
+
+- **A root-owned-source check would additionally break the feature.** A
+  drag-installed bundle's contents are owned by the *installing user*, not root, in
+  `/Applications` and `~/Applications` alike (the property that lets apps
+  self-update without admin; Finder copy preserves source perms). So a
+  root-owned / not-group-or-other-writable source check would reject every
+  supported install location while still being bypassable via the co-located
+  script — hence it is not adopted.
+
+- **Location is part of the boundary, but does not close the same-user case.**
+  `/Applications` is `drwxrwxr-x root:admin` (0775): a non-admin "other" cannot
+  create/replace entries there, and a drag-installed bundle's contents are not
+  group/other-writable, so a *different* non-admin user cannot tamper. But bundle
+  contents are owned by the installing user **regardless of `/Applications` vs
+  `~/Applications`**, so same-user TOCTOU — code running as the user who clicks
+  Install, riding their single legitimate authentication — is location-independent.
+
+- **The destination side IS hardened.** `bootstrap.sh` pins `/usr/local/bin` to
+  `root:wheel 0755` and re-verifies its ownership, and `assert_root_only_path`
+  verifies every ancestor (`/usr/local` up to `/`) is root-owned and not
+  group/other-writable before install. The asymmetry with the source is
+  fundamental: the destination is a fixed system path that root can soundly check
+  (a non-root principal cannot touch it); the source is, by the feature's premise,
+  a freshly built/copied user-writable bundle with no root-only path to verify
+  against.
+
+- **The residual risk and its only sound fix.** A genuine local privilege
+  escalation remains where a *less-privileged* principal can write the bundle and a
+  *more-privileged* one authenticates: a non-admin user's writable `~/Applications`
+  bundle (or a world-writable shared dir such as `/tmp` or `/Users/Shared`, 1777)
+  that an admin later authorizes, or non-root malware running as the admin user
+  riding the install prompt. This is closed only by an OS-enforced root of trust —
+  Developer-ID signing + notarization + `SMAppService`, where the kernel verifies a
+  signature the attacker cannot forge and binds the privileged helper to the signed
+  app — listed under [Scope / out of scope](#scope--out-of-scope). Until then,
+  operational guidance: an admin should not authenticate an install of a
+  `Splitway.app` that lives where a less-privileged principal can write it; a
+  read-only distribution medium (a signed DMG/PKG) would also close in-place source
+  tampering but is itself out of current scope.
+
+## The re-login gotcha — observed behavior
+
+macOS materializes a process's supplementary group set into its kernel credential
+at **login**. `dseditgroup -o edit -a <user> … splitway` updates the Directory
+Services record, but an already-running login session — including the GUI and
+anything it spawns — keeps its original group set until the user logs out and back
+in.
+
+**Observed on the live machine (macOS 26, Apple Silicon): the gotcha did NOT
+manifest.** A GUI launched _after_ the `dseditgroup` add connected to the
+group-owned socket immediately — `id -Gn` already listed `splitway`, the
+unprivileged CLI got a clean `status`, and the freshly-launched `.app` showed
+`Connected`, not `PermissionDenied`. So on this macOS, a process spawned after the
+membership change picks up the new group from Directory Services without a
+re-login. (The classic gotcha bites a process that was _already running_ across
+the change — e.g. a GUI left open during install. Launching or relaunching the
+app after install is enough here; a full logout was not needed.)
+
+Because the failure mode is still reachable (an app open across the change),
+`Health::PermissionDenied` on macOS is kept honest: its blocker reports that
+membership was added and points at the sign-out / relaunch remedy, and does
+**not** tell the user to run `usermod` (wrong OS, and membership is already
+granted). After a relaunch the GUI connects and shows `Connected`.
+
+### A WKWebView confirmation gotcha (found in live test)
+
+The in-app "Stop the Splitway service" link does **not** use `window.confirm()`:
+under WKWebView (the macOS webview Tauri uses), native `confirm()` is suppressed
+and returns `false`, which would silently no-op the disable. The confirmation is a
+**two-click arm** instead (first click → inline "Confirm stop / Cancel"; second
+click runs the privileged disable). This keeps the confirmation working without a
+native dialog or any new plugin/capability.
+
+## Scope / out of scope
+
+- **In:** the `.app` bundle (ad-hoc, additive to the Linux/Nix build), the
+  install/disable/platform Tauri commands, the bundled `bootstrap.sh` + GUI plist,
+  and the health-keyed GUI affordances.
+- **Out:** Homebrew tap (next phase — it installs the same `.app` + binaries and
+  must **not** add a `service` block, or two owners would fight over the socket
+  and `/etc/resolver`); code signing / notarization / Developer ID; `.dmg` /
+  `.pkg` / `SMAppService`; any macOS DNS/VPN backend change; full uninstall.
+
+## How the bundle stays additive
+
+The Tauri bundler (`cargo tauri build`) is the only thing that reads
+`tauri.conf.json`'s `bundle` section; `cargo build` and the Linux `nix build`
+(`buildRustPackage` + `wrapGAppsHook3`) never invoke it. So the macOS bundle is a
+separate path that cannot perturb the Linux build. To keep it explicit, the bundle
+settings live in a `tauri.bundle.macos.json` overlay applied **only** by the build
+wrapper via `--config` — named so Tauri does **not** auto-merge it into a plain
+`cargo build`/clippy (which would validate the staged resources before they
+exist). `scripts/build-macos-app.sh` builds the helper binaries + frontend, stages
+the resources, and runs the bundler; it pulls the off-PATH toolchain
+(`cargo-tauri`, `node`, `typescript`, `esbuild`, `librsvg`) from nixpkgs via
+`nix shell`, so a plain `bash scripts/build-macos-app.sh` just works.
+
+## Links
+
+- [socket-group.md](socket-group.md) — the `--socket-group` model this reuses.
+- [architecture.md](../architecture.md) — the truth contract the commands honor.
+- [tauri-mutations.md](tauri-mutations.md) — the daemon-first / refresh-now command
+  shape the install/disable commands follow.
+- `packaging/README.md` — the manual/sudo macOS install (the non-GUI path).
diff --git a/packaging/launchd/com.splitway.daemon.gui.plist b/packaging/launchd/com.splitway.daemon.gui.plist
new file mode 100644
index 0000000..db2c91d
--- /dev/null
+++ b/packaging/launchd/com.splitway.daemon.gui.plist
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  Splitway split-DNS daemon, as a macOS LaunchDaemon (runs as root) — the
+  GUI-installer variant.
+
+  This is the plist the Splitway.app self-installer drops into
+  /Library/LaunchDaemons (see scripts/bootstrap.sh). It differs from the sibling
+  com.splitway.daemon.plist in exactly one way: ProgramArguments passes
+  `--socket-group splitway`, so the control socket is `0660 root:splitway`
+  (runtime dir `0750 root:splitway`) instead of the default `0600 root`. That is
+  what lets the unprivileged desktop GUI — a member of the `splitway` group —
+  reach the root daemon without sudo (the macOS analog of the NixOS
+  `services.splitway.unprivilegedGui` option). The manual/sudo install path keeps
+  using com.splitway.daemon.plist, where the socket stays root-only.
+
+  Root is required: the daemon writes /etc/resolver/<domain> files and flushes
+  the DNS cache (dscacheutil / killall -HUP mDNSResponder). The privilege
+  boundary for the unprivileged GUI/CLI is the group-owned Unix control socket;
+  see packaging/README.md and docs/design/socket-group.md for the threat model.
+
+  Install: the GUI does this for you (one password prompt). To do it by hand, see
+  docs/design/macos-self-install.md.
+-->
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.splitway.daemon</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/local/bin/splitway-daemon</string>
+        <string>run</string>
+        <!-- Group-reachable socket so the unprivileged GUI can connect; the
+             daemon chgrps /var/run/splitway + the socket to this group on
+             start, and exits non-zero with an actionable message if the group
+             is missing (the installer creates it first). -->
+        <string>--socket-group</string>
+        <string>splitway</string>
+    </array>
+
+    <!-- Start at boot and restart on crash. -->
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>RUST_LOG</key>
+        <string>info</string>
+        <!-- launchd does not set HOME; pin it to root's macOS home so the
+             daemon's config resolves to /var/root/.config/splitway rather than
+             the (nonexistent on macOS) /root fallback. -->
+        <key>HOME</key>
+        <string>/var/root</string>
+    </dict>
+
+    <!-- On `launchctl bootout`/stop, launchd sends SIGTERM, which the daemon
+         traps to revert active /etc/resolver rules before exiting — the system
+         is never left half-configured. -->
+    <key>StandardOutPath</key>
+    <string>/var/log/splitway.log</string>
+    <key>StandardErrorPath</key>
+    <string>/var/log/splitway.log</string>
+</dict>
+</plist>
diff --git a/splitway-daemon/src/backend/linux/backend.rs b/splitway-daemon/src/backend/linux/backend.rs
index aa580b2..ca93170 100644
--- a/splitway-daemon/src/backend/linux/backend.rs
+++ b/splitway-daemon/src/backend/linux/backend.rs
@@ -307,6 +307,7 @@ mod tests {
         let info = VpnInfo {
             interface_name: "tun0".to_string(),
             dns_servers: Vec::new(),
+            demote_target: None,
         };
         let result = LinuxBackend.apply_rules(&info, &["corp.example.com".to_string()]);
         assert!(
diff --git a/splitway-daemon/src/backend/macos/backend.rs b/splitway-daemon/src/backend/macos/backend.rs
index 12ec67e..449574a 100644
--- a/splitway-daemon/src/backend/macos/backend.rs
+++ b/splitway-daemon/src/backend/macos/backend.rs
@@ -13,6 +13,7 @@ use splitway_shared::config::atomic_write;
 use splitway_shared::ipc::{LinkDnsState, ResolutionInfo};
 use splitway_shared::platform::{DnsBackend, PlatformError, VpnInfo};
 
+use super::demote;
 use super::resolver::{is_managed, is_valid_domain, resolver_contents, resolver_path};
 use super::MacosBackend;
 
@@ -26,21 +27,36 @@ impl DnsBackend for MacosBackend {
                 "no DNS servers in VpnInfo".to_string(),
             ));
         }
-        apply_to_dir(Path::new(RESOLVER_DIR), &vpn_info.dns_servers, domains)?;
+        let fallback = vpn_info.demote_target.as_deref().filter(|f| !f.is_empty());
+        apply_with(
+            Path::new(RESOLVER_DIR),
+            &vpn_info.dns_servers,
+            domains,
+            fallback,
+            &demote::RealScutil,
+            &demote::FileSnapshotStore::new(),
+        )?;
         flush_dns_cache();
         Ok(())
     }
 
     fn revert_rules(&self, _interface: &str) -> Result<(), PlatformError> {
-        // There is no per-interface resolver state on macOS — resolver files
-        // are keyed by domain. Reverting removes every file we own.
-        let removed = remove_managed(Path::new(RESOLVER_DIR), None).map_err(|e| {
-            PlatformError::CommandFailed(format!("failed to remove resolver files: {e}"))
-        })?;
-        if removed > 0 {
+        let outcome = revert_with(
+            Path::new(RESOLVER_DIR),
+            &demote::RealScutil,
+            &demote::FileSnapshotStore::new(),
+        )?;
+        // Flush when EITHER resolver files were removed OR a demoted default was
+        // restored — restoring the default changes resolution even when no files
+        // were removed (e.g. a retried revert after the files were already gone),
+        // so the cache must not keep serving the demoted/default answers.
+        if outcome.removed > 0 || outcome.restored_default {
             flush_dns_cache();
         }
-        log::info!("reverted {removed} splitway resolver file(s)");
+        log::info!(
+            "reverted {} splitway resolver file(s) and restored any demoted default",
+            outcome.removed
+        );
         Ok(())
     }
 
@@ -98,8 +114,82 @@ impl DnsBackend for MacosBackend {
     }
 }
 
+/// The apply pipeline, parameterized over the resolver dir and the demote seam
+/// so the scope+demote wiring is unit-testable without touching the live system.
+/// Two steps, transactional across both:
+///
+/// 1. **Scope** — `apply_to_dir` routes `domains` to `servers` via
+///    `/etc/resolver` (itself transactional; rolls back on any failure).
+/// 2. **Demote** — when `fallback` is `Some` (the VPN hijacked the system
+///    default), [`demote::demote`] sends non-corp DNS off-tunnel. If it fails,
+///    step 1's writes are rolled back **to the exact pre-apply scope** so the
+///    system is never left half-changed (scoped but with the default still
+///    hijacked), and the demote error is surfaced. Rolling back this apply's
+///    journal — not a blanket managed-file removal — means a re-apply whose
+///    demote fails restores the previously-working split DNS instead of wiping
+///    it. The demote's own snapshot still lets a later revert restore the default.
+fn apply_with(
+    dir: &Path,
+    servers: &[String],
+    domains: &[String],
+    fallback: Option<&[String]>,
+    scutil: &dyn demote::ScutilRunner,
+    snapshots: &dyn demote::SnapshotStore,
+) -> Result<(), PlatformError> {
+    let journal = apply_to_dir(dir, servers, domains)?;
+
+    if let Some(fallback) = fallback {
+        // `servers` is the corp DNS (what the /etc/resolver scope points at); pass
+        // it so the demote never snapshots the corp resolver as the physical prior
+        // (a hijacker rewriting the physical service between samples — see demote).
+        if let Err(e) = demote::demote(scutil, snapshots, fallback, servers) {
+            // Undo exactly this apply's scope changes — overwritten files back to
+            // their prior bytes, newly-created and pruned files undone — so a
+            // transient demote failure restores the prior scope rather than
+            // dropping every managed resolver file.
+            rollback(&journal);
+            return Err(e);
+        }
+    }
+    Ok(())
+}
+
+/// What a revert changed: how many managed resolver files were removed, and
+/// whether a demoted system default was restored. Either being non-trivial means
+/// resolution changed and the DNS cache must be flushed.
+struct RevertOutcome {
+    removed: usize,
+    restored_default: bool,
+}
+
+/// The revert pipeline, parameterized over the resolver dir and the demote seam.
+/// Removes every managed `/etc/resolver` file AND restores any demoted system
+/// default from the on-disk snapshot. Reports both (see [`RevertOutcome`]) so the
+/// caller can flush the DNS cache when either changed.
+///
+/// The restore runs even when no resolver files were removed: a prior run may
+/// have demoted without (or after pruning) resolver files, and the snapshot is
+/// the record of record. A restore failure is surfaced (not swallowed) so the
+/// caller retries rather than recording a clean revert over a still-demoted
+/// default.
+fn revert_with(
+    dir: &Path,
+    scutil: &dyn demote::ScutilRunner,
+    snapshots: &dyn demote::SnapshotStore,
+) -> Result<RevertOutcome, PlatformError> {
+    let removed = remove_managed(dir, None, None).map_err(|e| {
+        PlatformError::CommandFailed(format!("failed to remove resolver files: {e}"))
+    })?;
+    let restored_default = demote::restore(scutil, snapshots)?;
+    Ok(RevertOutcome {
+        removed,
+        restored_default,
+    })
+}
+
 /// Prior on-disk state of a resolver file before this apply touched it, used to
 /// undo a failed apply.
+#[derive(Debug)]
 enum Prior {
     /// The file existed; these are its bytes, restored on rollback.
     Existed(Vec<u8>),
@@ -118,7 +208,15 @@ enum Prior {
 /// never a partial or empty set. Then prunes our now-unwanted files; a prune
 /// failure is returned (not swallowed) so the caller retries rather than
 /// recording success while a dropped domain's file keeps routing.
-fn apply_to_dir(dir: &Path, servers: &[String], domains: &[String]) -> Result<(), PlatformError> {
+///
+/// On success returns the **journal** of every change made (files overwritten,
+/// created, and pruned), so a caller (the apply pipeline) can undo exactly this
+/// reconcile — restoring the prior scope — if a *later* step (the demote) fails.
+fn apply_to_dir(
+    dir: &Path,
+    servers: &[String],
+    domains: &[String],
+) -> Result<Vec<(PathBuf, Prior)>, PlatformError> {
     // Reject names that are not safe single path components before touching the
     // filesystem: `dir.join("../x")` would escape /etc/resolver, and a
     // slash-containing name would never match the single-component filenames
@@ -201,20 +299,17 @@ fn apply_to_dir(dir: &Path, servers: &[String], domains: &[String]) -> Result<()
 
     let keep: BTreeSet<&str> = domains.iter().map(String::as_str).collect();
     // Surface prune failures: a leftover file for a dropped domain keeps routing
-    // it through the VPN. Roll back this call's writes first — on a failed
-    // reconcile the state machine does not record `applied`, so newly-created
-    // files left behind would be skipped by a later revert. This undoes only
-    // this call's writes; a partially-completed prune is not un-deleted, but
-    // prune only ever removes files that are being dropped or are already stale,
-    // so those deletions are safe to leave. The result stays consistent with the
-    // retained `applied` state.
-    if let Err(e) = remove_managed(dir, Some(&keep)) {
+    // it through the VPN. The prune records each removed file into `written` (as
+    // `Prior::Existed`), so on a prune failure — or a later demote failure — the
+    // rollback restores the pruned files too, leaving the prior scope exactly as
+    // it was rather than a partial set.
+    if let Err(e) = remove_managed(dir, Some(&keep), Some(&mut written)) {
         rollback(&written);
         return Err(PlatformError::CommandFailed(format!(
             "failed to prune stale resolver files: {e}"
         )));
     }
-    Ok(())
+    Ok(written)
 }
 
 /// Undo the writes recorded in `written`, most recent first: restore each
@@ -238,7 +333,15 @@ fn rollback(written: &[(PathBuf, Prior)]) {
 /// filename is in `keep` (when `Some`). A missing `dir` is treated as "nothing
 /// to remove". Returns how many files were removed. Files we do not own (no
 /// marker) and unreadable files are left untouched.
-fn remove_managed(dir: &Path, keep: Option<&BTreeSet<&str>>) -> io::Result<usize> {
+///
+/// When `journal` is `Some`, each removed file is recorded as
+/// `(path, Prior::Existed(bytes))` so a later [`rollback`] can re-create it — the
+/// apply pipeline uses this so a prune is undoable along with the writes.
+fn remove_managed(
+    dir: &Path,
+    keep: Option<&BTreeSet<&str>>,
+    mut journal: Option<&mut Vec<(PathBuf, Prior)>>,
+) -> io::Result<usize> {
     let entries = match fs::read_dir(dir) {
         Ok(entries) => entries,
         Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(0),
@@ -262,11 +365,16 @@ fn remove_managed(dir: &Path, keep: Option<&BTreeSet<&str>>) -> io::Result<usize
         if keep.is_some_and(|keep| keep.contains(name)) {
             continue;
         }
-        // Only touch files we wrote; never a user-authored resolver file.
-        match fs::read_to_string(&path) {
-            Ok(contents) if is_managed(&contents) => {
+        // Only touch files we wrote; never a user-authored resolver file. Read
+        // the bytes (not a lossy string) so a journaled entry restores them
+        // exactly on rollback.
+        match fs::read(&path) {
+            Ok(bytes) if is_managed(&String::from_utf8_lossy(&bytes)) => {
                 fs::remove_file(&path)?;
                 removed += 1;
+                if let Some(journal) = journal.as_deref_mut() {
+                    journal.push((path, Prior::Existed(bytes)));
+                }
             }
             _ => {}
         }
@@ -373,6 +481,226 @@ mod tests {
         vec!["10.0.0.1".to_string(), "10.0.0.2".to_string()]
     }
 
+    // --- scope + demote wiring (apply_with / revert_with) --------------------
+    //
+    // These exercise the two-step pipeline with the demote seam faked, so they
+    // assert BOTH the /etc/resolver files written and the exact scutil script
+    // issued — without touching the live system.
+
+    use super::demote::test_support::{FakeScutil, MemSnapshots};
+
+    #[test]
+    fn apply_with_scopes_and_demotes_to_the_fallback() {
+        let dir = temp_dir("apply-with-demote");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        let corp = vec!["192.0.2.53".to_string()];
+        let fallback = vec!["198.51.100.1".to_string()];
+
+        apply_with(
+            &dir,
+            &corp,
+            &[
+                "corp.example.com".to_string(),
+                "jira.example.com".to_string(),
+            ],
+            Some(&fallback),
+            &scutil,
+            &snaps,
+        )
+        .unwrap();
+
+        // Scope: a managed resolver file per corp domain, pointing at corp DNS.
+        for domain in ["corp.example.com", "jira.example.com"] {
+            let body = fs::read_to_string(dir.join(domain)).unwrap();
+            assert!(is_managed(&body));
+            assert!(body.contains("nameserver 192.0.2.53"));
+        }
+        // Demote: exactly the set-fallback script on the primary service, and
+        // the prior default snapshotted for restore.
+        let scripts = scutil.scripts.borrow();
+        assert_eq!(scripts.len(), 1);
+        assert!(scripts[0].contains("d.add ServerAddresses * 198.51.100.1\n"));
+        assert!(scripts[0].contains("set State:/Network/Service/ABC/DNS\n"));
+        drop(scripts);
+        assert_eq!(
+            snaps.slot.borrow().as_ref().unwrap().prior_servers,
+            vec!["198.51.100.1".to_string()]
+        );
+    }
+
+    #[test]
+    fn apply_with_no_fallback_scopes_only_no_demote() {
+        let dir = temp_dir("apply-scope-only");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        apply_with(
+            &dir,
+            &["192.0.2.53".to_string()],
+            &["corp.example.com".to_string()],
+            None,
+            &scutil,
+            &snaps,
+        )
+        .unwrap();
+        assert!(dir.join("corp.example.com").exists());
+        // No demote issued, nothing snapshotted.
+        assert!(scutil.scripts.borrow().is_empty());
+        assert!(snaps.slot.borrow().is_none());
+    }
+
+    #[test]
+    fn apply_with_rolls_back_the_scope_when_the_demote_fails() {
+        // Transactional across both steps: a demote failure must undo the
+        // resolver scope so the system is never left half-changed.
+        let dir = temp_dir("apply-rollback");
+        let scutil = FakeScutil::up();
+        scutil.fail_on_set();
+        let snaps = MemSnapshots::default();
+
+        let result = apply_with(
+            &dir,
+            &["192.0.2.53".to_string()],
+            &["corp.example.com".to_string()],
+            Some(&["198.51.100.1".to_string()]),
+            &scutil,
+            &snaps,
+        );
+        assert!(result.is_err(), "a demote failure fails the whole apply");
+        // The scope was rolled back — no managed resolver file remains.
+        assert!(
+            !dir.join("corp.example.com").exists(),
+            "the resolver scope must be rolled back on demote failure"
+        );
+    }
+
+    #[test]
+    fn demote_failure_on_a_reapply_restores_the_previous_scope() {
+        // A re-apply over a previously-working scope whose demote then fails must
+        // restore the PRIOR files (overwritten ones back to their old content,
+        // pruned ones re-created), not wipe every managed resolver file.
+        let dir = temp_dir("apply-reapply-rollback");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        // First apply (no demote): two managed files become the working scope.
+        apply_with(
+            &dir,
+            &["192.0.2.53".to_string()],
+            &[
+                "corp.example.com".to_string(),
+                "old.example.com".to_string(),
+            ],
+            None,
+            &scutil,
+            &snaps,
+        )
+        .unwrap();
+        let corp_before = fs::read_to_string(dir.join("corp.example.com")).unwrap();
+        assert!(dir.join("old.example.com").exists());
+
+        // Re-apply with new servers, dropping old.example.com — but the demote fails.
+        scutil.fail_on_set();
+        let result = apply_with(
+            &dir,
+            &["192.0.2.99".to_string()],
+            &["corp.example.com".to_string()],
+            Some(&["198.51.100.1".to_string()]),
+            &scutil,
+            &snaps,
+        );
+        assert!(result.is_err(), "the demote failure fails the apply");
+        // The previous scope is restored exactly: corp.example.com back to its
+        // prior content, and the pruned old.example.com re-created.
+        assert_eq!(
+            fs::read_to_string(dir.join("corp.example.com")).unwrap(),
+            corp_before,
+            "the overwritten file is restored to its pre-reapply content"
+        );
+        assert!(
+            dir.join("old.example.com").exists(),
+            "the pruned file is restored on rollback — not left dropped"
+        );
+        fs::remove_dir_all(&dir).unwrap();
+    }
+
+    #[test]
+    fn revert_with_removes_files_and_restores_the_default() {
+        let dir = temp_dir("revert-with");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        // Apply (scope + demote), then revert.
+        apply_with(
+            &dir,
+            &["192.0.2.53".to_string()],
+            &["corp.example.com".to_string()],
+            Some(&["198.51.100.1".to_string()]),
+            &scutil,
+            &snaps,
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+
+        let outcome = revert_with(&dir, &scutil, &snaps).unwrap();
+        assert_eq!(
+            outcome.removed, 1,
+            "the one managed resolver file is removed"
+        );
+        assert!(outcome.restored_default, "the demoted default was restored");
+        assert!(!dir.join("corp.example.com").exists());
+        // The default was restored to the snapshotted prior servers, and the
+        // snapshot cleared.
+        let scripts = scutil.scripts.borrow();
+        assert_eq!(scripts.len(), 1);
+        assert!(scripts[0].contains("d.add ServerAddresses * 198.51.100.1\n"));
+        drop(scripts);
+        assert!(snaps.slot.borrow().is_none());
+    }
+
+    #[test]
+    fn revert_with_nothing_applied_is_a_clean_noop() {
+        let dir = temp_dir("revert-noop");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        let outcome = revert_with(&dir, &scutil, &snaps).unwrap();
+        assert_eq!(outcome.removed, 0);
+        assert!(!outcome.restored_default);
+        assert!(scutil.scripts.borrow().is_empty());
+    }
+
+    #[test]
+    fn revert_with_reports_a_restore_even_when_no_files_were_removed() {
+        // P2: the resolver files were already gone (removed == 0) but a demote
+        // snapshot still exists (e.g. a prior revert removed the files, then the
+        // scutil restore failed; this retry restores the default). revert_with must
+        // report the restore so the caller still flushes the DNS cache.
+        let dir = temp_dir("revert-restore-only");
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        apply_with(
+            &dir,
+            &["192.0.2.53".to_string()],
+            &["corp.example.com".to_string()],
+            Some(&["198.51.100.1".to_string()]),
+            &scutil,
+            &snaps,
+        )
+        .unwrap();
+        // Simulate the resolver file already being gone from a prior partial revert.
+        fs::remove_file(dir.join("corp.example.com")).unwrap();
+        scutil.scripts.borrow_mut().clear();
+
+        let outcome = revert_with(&dir, &scutil, &snaps).unwrap();
+        assert_eq!(outcome.removed, 0, "no resolver files left to remove");
+        assert!(
+            outcome.restored_default,
+            "the demoted default was still restored → caller must flush"
+        );
+        assert!(
+            snaps.slot.borrow().is_none(),
+            "snapshot cleared after restore"
+        );
+    }
+
     #[test]
     fn apply_writes_one_marked_file_per_domain() {
         let dir = temp_dir("apply-writes");
@@ -423,9 +751,9 @@ mod tests {
         apply_to_dir(&dir, &servers(), &["a.com".to_string()]).unwrap();
         // A resolver file the user wrote by hand.
         let user_file = dir.join("user.example");
-        fs::write(&user_file, "nameserver 9.9.9.9\n").unwrap();
+        fs::write(&user_file, "nameserver 192.0.2.9\n").unwrap();
 
-        let removed = remove_managed(&dir, None).unwrap();
+        let removed = remove_managed(&dir, None, None).unwrap();
         assert_eq!(removed, 1);
         assert!(!dir.join("a.com").exists(), "our file is removed");
         assert!(user_file.exists(), "the user's file is untouched");
@@ -437,7 +765,7 @@ mod tests {
         let mut missing = std::env::temp_dir();
         missing.push(format!("splitway-absent-resolver-{}", std::process::id()));
         let _ = fs::remove_dir_all(&missing);
-        assert_eq!(remove_managed(&missing, None).unwrap(), 0);
+        assert_eq!(remove_managed(&missing, None, None).unwrap(), 0);
     }
 
     #[test]
@@ -498,13 +826,13 @@ mod tests {
         let dir = temp_dir("apply-refuse-unmanaged");
         // The user already has a hand-written resolver for this domain.
         let user = dir.join("corp.example.com");
-        fs::write(&user, "nameserver 9.9.9.9\n").unwrap();
+        fs::write(&user, "nameserver 192.0.2.9\n").unwrap();
 
         let err = apply_to_dir(&dir, &servers(), &["corp.example.com".to_string()]).unwrap_err();
         assert!(matches!(err, PlatformError::CommandFailed(_)));
         // The user's file is left exactly as it was — not replaced by a managed
         // file that a later revert would delete.
-        assert_eq!(fs::read_to_string(&user).unwrap(), "nameserver 9.9.9.9\n");
+        assert_eq!(fs::read_to_string(&user).unwrap(), "nameserver 192.0.2.9\n");
         fs::remove_dir_all(&dir).unwrap();
     }
 
diff --git a/splitway-daemon/src/backend/macos/demote.rs b/splitway-daemon/src/backend/macos/demote.rs
new file mode 100644
index 0000000..aa52db0
--- /dev/null
+++ b/splitway-daemon/src/backend/macos/demote.rs
@@ -0,0 +1,1357 @@
+//! Demoting a hijacked system **default** resolver so non-corp DNS resolves
+//! off-tunnel — the second half of macOS DNS privacy (the first half being the
+//! per-domain `/etc/resolver` scope in [`super::backend`]).
+//!
+//! # Why a demote is needed
+//!
+//! When the VPN client registers the corp resolver as the system *default*
+//! (rather than scoping it to the tunnel), every query that is **not** for a
+//! corp domain would otherwise go to the corp resolver, over the tunnel —
+//! exactly the privacy leak Splitway exists to prevent. Demoting overwrites the
+//! primary network service's `ServerAddresses` (the source of the global
+//! default) with an off-tunnel **fallback** resolver, so only the corp domains
+//! (pinned by the `/etc/resolver` files) reach the corp resolver.
+//!
+//! # Reversibility (the load-bearing property)
+//!
+//! The demote must never leave the machine with a broken or half-changed
+//! resolver. Before overwriting, the prior `ServerAddresses` is **snapshotted to
+//! disk** ([`SnapshotStore`]); restore rewrites exactly that. The snapshot lives
+//! on disk (not just in memory) so an unclean exit — the daemon SIGKILLed
+//! between demote and a later revert — can still be undone on the next start.
+//!
+//! # Testability
+//!
+//! All `scutil` contact goes through the [`ScutilRunner`] seam: the real impl
+//! shells out, tests inject a fake that *captures the exact script issued* and
+//! returns canned state, so the demote/restore logic is unit-tested without
+//! touching the live system. The script text itself is built by pure functions
+//! ([`build_set_dns_script`] / `build_*`) that are tested directly.
+
+use std::fs;
+use std::path::PathBuf;
+
+use serde::{Deserialize, Serialize};
+
+use splitway_shared::platform::PlatformError;
+
+use crate::detector::{macos_same_set as same_set, macos_scutil_script as scutil_script};
+
+/// The dynamic-store key holding the primary network service id we demote.
+const GLOBAL_IPV4_KEY: &str = "State:/Network/Global/IPv4";
+
+/// The snapshot file: the pre-demote primary-service DNS, captured so revert can
+/// restore it byte-for-byte even across an unclean daemon exit. Lives under the
+/// daemon's runtime dir (root-owned, like the socket).
+pub(super) const SNAPSHOT_PATH: &str = "/var/run/splitway/dns-demote.snapshot";
+
+/// A captured pre-demote state: which service was demoted, the `InterfaceName`
+/// it was bound to, and the `ServerAddresses` it had before.
+///
+/// Serialised to [`SNAPSHOT_PATH`] as JSON via `serde` (already a direct
+/// dependency of this crate). JSON is used rather than a bespoke line format so
+/// there is no hand-rolled parser to keep in sync and no silent-corruption edge
+/// from a resolver value that happens to contain the field separator.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub(super) struct DemoteSnapshot {
+    /// The full `State:/Network/Service/<id>/DNS` key that was overwritten.
+    pub service_dns_key: String,
+    /// The `InterfaceName` the service was bound to before the demote, if any.
+    /// Re-applied on demote so the demoted service stays identifiable as the
+    /// physical service by the detector (a `d.init` write would otherwise drop
+    /// it — see [`build_set_dns_script`] and the detector's `decide`).
+    pub interface_name: Option<String>,
+    /// The `ServerAddresses` the service had before the demote (possibly empty
+    /// if the service carried no explicit servers — restore then clears ours).
+    pub prior_servers: Vec<String>,
+    /// The fallback resolver Splitway last installed on this service. Lets a
+    /// same-service re-demote tell our own fallback (which we must NOT capture as
+    /// the "prior") from a real DHCP update — even after a `fallback_dns` config
+    /// change, where the service may still show a *previous* fallback we wrote.
+    /// Updated only after a fallback write succeeds.
+    pub installed_fallback: Vec<String>,
+}
+
+/// The current DNS dict of one service, as read from
+/// `State:/Network/Service/<id>/DNS` — the bits the demote must snapshot and
+/// preserve.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(super) struct ServiceDnsState {
+    /// The `InterfaceName` the service is bound to, if present.
+    pub interface_name: Option<String>,
+    /// The service's `ServerAddresses`.
+    pub servers: Vec<String>,
+}
+
+/// The seam over `scutil`: read the bits the demote needs, and run a script.
+/// The real impl ([`RealScutil`]) shells out; tests inject a fake.
+pub(super) trait ScutilRunner {
+    /// The primary network service id from `State:/Network/Global/IPv4`'s
+    /// `PrimaryService`, or `None` if there is no primary service (offline).
+    fn primary_service(&self) -> Result<Option<String>, PlatformError>;
+
+    /// The current DNS dict (servers + `InterfaceName`) of
+    /// `State:/Network/Service/<id>/DNS`.
+    fn service_dns_state(&self, service_dns_key: &str) -> Result<ServiceDnsState, PlatformError>;
+
+    /// Whether `key` currently exists in the dynamic store. A restore uses this
+    /// to avoid re-creating a phantom `State:` entry for a service configd has
+    /// already torn down (see [`restore_snapshot`]).
+    fn key_exists(&self, key: &str) -> Result<bool, PlatformError>;
+
+    /// Run a `scutil` *set* script (the text piped to `scutil`'s stdin). The impl
+    /// must surface a command failure even when `scutil` reports it on stdout with
+    /// a zero exit (see [`RealScutil::run_script`]).
+    fn run_script(&self, script: &str) -> Result<(), PlatformError>;
+}
+
+/// Build the `scutil` script that overrides `key`'s `ServerAddresses`, leaving
+/// every other field of the service's DNS dictionary intact.
+///
+/// `ServerAddresses` is the only field Splitway manages; the rest of the dict
+/// (`SearchDomains`, `DomainName`, `SupplementalMatchDomains`, `SearchOrder`,
+/// `InterfaceName`, …) belongs to DHCP / the VPN. So the script `get`s the
+/// service's CURRENT dictionary into the working buffer first, then overrides
+/// only `ServerAddresses`, then writes the merged dict back. A bare `d.init`
+/// would instead start from an empty dictionary and the `set` would *replace* the
+/// whole dict, dropping those unmanaged fields until the next network
+/// reconfiguration repopulated them (breaking local search-domain / supplemental
+/// DNS behaviour while Splitway is active). On a missing key `get` leaves the
+/// (empty) initialised dict, so a fresh service is still created.
+///
+/// - `servers` non-empty → override `ServerAddresses` (demote to the fallback, or
+///   restore the prior resolvers).
+/// - `servers` empty → `d.remove ServerAddresses`, dropping only *our* override
+///   while keeping the rest of the dict (restore of a service that had no explicit
+///   prior `ServerAddresses`).
+///
+/// `InterfaceName` is preserved automatically by `get`; it is additionally
+/// re-added when known as a belt-and-suspenders guarantee that the demoted
+/// *physical* service stays identifiable to the detector (which anchors it by
+/// `InterfaceName == PrimaryInterface`; see the detector's `decide`), even on the
+/// missing-key path where `get` loaded nothing.
+pub(super) fn build_set_dns_script(
+    key: &str,
+    servers: &[String],
+    interface_name: Option<&str>,
+) -> String {
+    let mut script = String::new();
+    script.push_str("open\n");
+    script.push_str("d.init\n");
+    // Load the live dict so unmanaged fields ride through unchanged.
+    script.push_str(&format!("get {key}\n"));
+    if !servers.is_empty() {
+        script.push_str("d.add ServerAddresses *");
+        for s in servers {
+            script.push(' ');
+            script.push_str(s);
+        }
+        script.push('\n');
+    } else {
+        // Drop only our ServerAddresses override; keep every other field.
+        script.push_str("d.remove ServerAddresses\n");
+    }
+    if let Some(iface) = interface_name {
+        // A single-value key (no `*`): the interface the service is bound to.
+        script.push_str(&format!("d.add InterfaceName {iface}\n"));
+    }
+    script.push_str(&format!("set {key}\n"));
+    script.push_str("quit\n");
+    script
+}
+
+/// The `State:/Network/Service/<id>/DNS` key for a service id.
+pub(super) fn service_dns_key(service_id: &str) -> String {
+    format!("State:/Network/Service/{service_id}/DNS")
+}
+
+/// The real `scutil`-backed [`ScutilRunner`].
+pub(super) struct RealScutil;
+
+impl ScutilRunner for RealScutil {
+    fn primary_service(&self) -> Result<Option<String>, PlatformError> {
+        let dump = scutil_script(&format!("show {GLOBAL_IPV4_KEY}\n"))?;
+        Ok(crate::detector::macos_parse_scalar_field(
+            &dump,
+            "PrimaryService",
+        ))
+    }
+
+    fn service_dns_state(&self, service_dns_key: &str) -> Result<ServiceDnsState, PlatformError> {
+        let dump = scutil_script(&format!("show {service_dns_key}\n"))?;
+        Ok(ServiceDnsState {
+            interface_name: crate::detector::macos_parse_scalar_field(&dump, "InterfaceName"),
+            servers: crate::detector::macos_parse_array_field(&dump, "ServerAddresses"),
+        })
+    }
+
+    fn key_exists(&self, key: &str) -> Result<bool, PlatformError> {
+        // `scutil` prints `No such key` (exit 0) for a `show` of an absent key;
+        // any other output means the key exists.
+        Ok(!scutil_script(&format!("show {key}\n"))?.contains("No such key"))
+    }
+
+    fn run_script(&self, script: &str) -> Result<(), PlatformError> {
+        // `scutil` in script mode reports a failed command on **stdout** while
+        // still exiting 0 (it prints via `SCPrint`), so the exit-status check in
+        // `scutil_script` alone would record a failed `set` — the exact leak this
+        // demote closes — as success. A successful `open`/`d.init`/`get`/`d.add`/
+        // `set`/`quit` sequence is silent, so any non-benign stdout is a failure;
+        // the only benign output is `No such key` from `build_set_dns_script`'s
+        // `get` on a first-time / missing service key.
+        let out = scutil_script(script)?;
+        if let Some(err) = scutil_set_error(&out) {
+            return Err(PlatformError::CommandFailed(format!(
+                "scutil reported an error running a set script (stdout, exit 0): {err}"
+            )));
+        }
+        Ok(())
+    }
+}
+
+/// Inspect `scutil` script-mode stdout for a reported command failure. Success is
+/// silent, so this returns `Some(joined error lines)` for any non-empty output
+/// other than the benign `No such key` notice (a `get` on a missing service key,
+/// which the demote/restore scripts issue by design), else `None`. Pure so the
+/// stdout-vs-exit-status contract is unit-tested without a live `scutil`.
+fn scutil_set_error(stdout: &str) -> Option<String> {
+    let residue: Vec<&str> = stdout
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.contains("No such key"))
+        .collect();
+    if residue.is_empty() {
+        None
+    } else {
+        Some(residue.join("; "))
+    }
+}
+
+/// Reads/writes the on-disk demote snapshot. A trait so tests inject a temp-dir
+/// store; the real impl uses [`SNAPSHOT_PATH`].
+pub(super) trait SnapshotStore {
+    fn load(&self) -> Option<DemoteSnapshot>;
+    fn save(&self, snapshot: &DemoteSnapshot) -> Result<(), PlatformError>;
+    fn clear(&self);
+}
+
+/// The real on-disk snapshot store at [`SNAPSHOT_PATH`].
+pub(super) struct FileSnapshotStore {
+    path: PathBuf,
+}
+
+impl FileSnapshotStore {
+    pub(super) fn new() -> Self {
+        FileSnapshotStore {
+            path: PathBuf::from(SNAPSHOT_PATH),
+        }
+    }
+}
+
+impl SnapshotStore for FileSnapshotStore {
+    fn load(&self) -> Option<DemoteSnapshot> {
+        let text = fs::read_to_string(&self.path).ok()?;
+        // A garbled/partial file parses to `None` (treated as "nothing demoted"),
+        // never a panic.
+        serde_json::from_str(&text).ok()
+    }
+
+    fn save(&self, snapshot: &DemoteSnapshot) -> Result<(), PlatformError> {
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent).map_err(|e| {
+                PlatformError::CommandFailed(format!(
+                    "creating snapshot dir {}: {e}",
+                    parent.display()
+                ))
+            })?;
+        }
+        let bytes = serde_json::to_vec(snapshot).map_err(|e| {
+            PlatformError::CommandFailed(format!("serialising demote snapshot: {e}"))
+        })?;
+        // atomic_write keeps the snapshot intact on a crash mid-write.
+        splitway_shared::config::atomic_write(&self.path, &bytes)
+            .map_err(|e| PlatformError::CommandFailed(format!("writing demote snapshot: {e}")))
+    }
+
+    fn clear(&self) {
+        let _ = fs::remove_file(&self.path);
+    }
+}
+
+/// Demote the system default resolver to `fallback`, snapshotting the prior
+/// primary-service DNS first so [`restore`] can undo it. Idempotent: re-running
+/// with the same fallback is a no-op-equivalent (it re-sets the same servers);
+/// the snapshot is only captured on the *first* demote (when none exists), so a
+/// re-demote never overwrites the original prior state with our own fallback.
+///
+/// Returns `Ok(false)` (not an error) when there is no primary service to demote
+/// — the caller treats that as "nothing to do".
+///
+/// `corp_dns` is the VPN's own resolver (the servers the `/etc/resolver` scope
+/// points at). Detection guarantees it differs from the physical resolver, so it
+/// is never a legitimate "prior": passing it lets the same-service refresh reject
+/// a `current` that equals it — i.e. a hijacking client that rewrote the physical
+/// service's `ServerAddresses` to its corp DNS between samples — instead of
+/// snapshotting the corp resolver as the off-VPN default a later restore installs.
+pub(super) fn demote(
+    scutil: &dyn ScutilRunner,
+    snapshots: &dyn SnapshotStore,
+    fallback: &[String],
+    corp_dns: &[String],
+) -> Result<bool, PlatformError> {
+    if fallback.is_empty() {
+        return Err(PlatformError::CommandFailed(
+            "refusing to demote the system default to an empty resolver set".to_string(),
+        ));
+    }
+    let Some(service_id) = scutil.primary_service()? else {
+        log::warn!("no primary network service; skipping default-DNS demote");
+        return Ok(false);
+    };
+    let key = service_dns_key(&service_id);
+
+    // Snapshot handling, keyed by the service we are about to demote:
+    //
+    // - No snapshot yet → capture this service's prior DNS (the first demote).
+    // - A snapshot for THIS SAME service → keep it, UNLESS the service's live DNS
+    //   has changed to something other than our fallback (a DHCP renewal handed the
+    //   same service a new resolver and the watcher re-emitted Up): then refresh
+    //   the snapshot to the current resolver, so a later restore writes back the
+    //   latest service DNS rather than the stale pre-change one. A reconcile
+    //   re-apply where the service still shows our fallback keeps the snapshot (we
+    //   must never capture our own fallback as the "prior").
+    // - A snapshot for a DIFFERENT service (the primary changed while up — e.g. a
+    //   Wi-Fi↔Ethernet switch) → restore that previous service from its snapshot
+    //   first, so it is not left stranded on our fallback, then capture and demote
+    //   the new primary. Exactly one service is ever demoted at a time.
+    match snapshots.load() {
+        Some(existing) if existing.service_dns_key == key => {
+            let current = scutil.service_dns_state(&key)?;
+            // Refresh the prior when the service's live DNS is a genuine new
+            // resolver — a DHCP renewal handed the same service a new one and the
+            // watcher re-emitted Up — so a later restore writes the latest rather
+            // than a stale pre-change value. The hard part is telling that apart
+            // from OUR OWN fallback:
+            //
+            // - `current != installed_fallback` — the recorded fallback we last
+            //   wrote — is the primary signal. It stays correct in the default
+            //   config where the fallback tracks the physical DHCP resolver (so a
+            //   DHCP change makes `fallback` itself change): the new resolver still
+            //   differs from the *previously* recorded `installed_fallback`.
+            // - Comparing against the `fallback` we are ABOUT to install is only a
+            //   backstop for when `installed_fallback` is empty (a first-time or
+            //   lost record): then a `current` equal to that fallback is our own
+            //   write, not a DHCP update. Applying this backstop unconditionally
+            //   was the bug — in the default config the new DHCP resolver *equals*
+            //   the new fallback, so it wrongly suppressed the refresh and pinned a
+            //   stale prior. Gate it on `installed_fallback` being empty.
+            // - `current != corp_dns` rejects the VPN's own resolver leaking onto
+            //   the physical service (a hijacker rewrite between samples) — never a
+            //   legitimate prior, since detection requires corp != physical.
+            let installed_is_ours = same_set(&current.servers, &existing.installed_fallback)
+                || (existing.installed_fallback.is_empty() && same_set(&current.servers, fallback));
+            if !current.servers.is_empty()
+                && !installed_is_ours
+                && !same_set(&current.servers, corp_dns)
+            {
+                snapshots.save(&DemoteSnapshot {
+                    service_dns_key: key.clone(),
+                    interface_name: current.interface_name,
+                    prior_servers: current.servers,
+                    // Preserved here; the post-write step below reconciles it to
+                    // the fallback actually installed.
+                    installed_fallback: existing.installed_fallback,
+                })?;
+            }
+            // else: keep the existing snapshot unchanged.
+        }
+        Some(existing) => {
+            // Primary changed: un-demote the old service, then snapshot the new.
+            restore_snapshot(scutil, &existing)?;
+            snapshots.clear();
+            capture_snapshot(scutil, snapshots, &key)?;
+        }
+        None => {
+            capture_snapshot(scutil, snapshots, &key)?;
+        }
+    }
+
+    // Re-apply the interface name we captured so the demoted (physical) service
+    // stays identifiable to the detector (see build_set_dns_script).
+    let interface_name = snapshots.load().and_then(|s| s.interface_name);
+    scutil.run_script(&build_set_dns_script(
+        &key,
+        fallback,
+        interface_name.as_deref(),
+    ))?;
+
+    // Record the fallback now on the service so the NEXT same-service demote
+    // recognises it as ours, even across a `fallback_dns` change. Done AFTER a
+    // successful write so a failed write leaves the previously-recorded fallback
+    // (still the value on the service) intact.
+    //
+    // This save is BEST-EFFORT: the demote's load-bearing effects (the `set` above
+    // and the prior snapshot) already succeeded, so a failure here must NOT fail
+    // the apply. Propagating it would make `apply_with` roll back only the
+    // `/etc/resolver` scope while the default stays demoted — the inverse
+    // half-state (default off-tunnel, but corp domains no longer scoped, so they
+    // leak via the fallback). The only thing lost is the `installed_fallback`
+    // dedup hint, which the same-service branch above already tolerates being
+    // stale/empty (the `installed_fallback.is_empty()` backstop). So log and keep
+    // the demote applied.
+    if let Some(mut snapshot) = snapshots.load() {
+        if !same_set(&snapshot.installed_fallback, fallback) {
+            snapshot.installed_fallback = fallback.to_vec();
+            if let Err(e) = snapshots.save(&snapshot) {
+                log::warn!(
+                    "demote applied, but recording the installed fallback failed: {e}; \
+                     a later re-demote will re-derive it"
+                );
+            }
+        }
+    }
+
+    log::info!("demoted the system default resolver to the off-tunnel fallback");
+    Ok(true)
+}
+
+/// Capture `key`'s current DNS dict (servers + interface name) into the
+/// snapshot store, before it is overwritten by a demote. `installed_fallback` is
+/// left empty here and set by the demote's post-write step once the fallback is
+/// actually on the service.
+fn capture_snapshot(
+    scutil: &dyn ScutilRunner,
+    snapshots: &dyn SnapshotStore,
+    key: &str,
+) -> Result<(), PlatformError> {
+    let state = scutil.service_dns_state(key)?;
+    snapshots.save(&DemoteSnapshot {
+        service_dns_key: key.to_string(),
+        interface_name: state.interface_name,
+        prior_servers: state.servers,
+        installed_fallback: Vec::new(),
+    })
+}
+
+/// Restore the demoted default from the snapshot, then clear it. Returns whether
+/// a snapshot was present and restored (so the caller can flush the DNS cache
+/// even when no resolver files were removed). A missing snapshot is a clean no-op
+/// → `Ok(false)`. Always clears the snapshot on success so a later demote re-snaps.
+pub(super) fn restore(
+    scutil: &dyn ScutilRunner,
+    snapshots: &dyn SnapshotStore,
+) -> Result<bool, PlatformError> {
+    let Some(snapshot) = snapshots.load() else {
+        return Ok(false); // nothing demoted
+    };
+    restore_snapshot(scutil, &snapshot)?;
+    snapshots.clear();
+    log::info!("restored the system default resolver from the demote snapshot");
+    Ok(true)
+}
+
+/// Run the `scutil` write that restores one snapshot's service to its prior DNS.
+/// Restores the prior `ServerAddresses` when there were any, otherwise removes
+/// only our `ServerAddresses` override — either way `get`-preserving the rest of
+/// the service's live DNS dict (so DHCP-provided SearchDomains/etc. survive the
+/// round-trip). Does not touch the snapshot store — the caller owns clearing it.
+fn restore_snapshot(
+    scutil: &dyn ScutilRunner,
+    snapshot: &DemoteSnapshot,
+) -> Result<(), PlatformError> {
+    // Skip the restore if the snapshot's service DNS key no longer exists — the
+    // service departed entirely (e.g. Wi-Fi off → Ethernet in, configd deleted its
+    // DNS/IPv4/IPv6 keys). `build_set_dns_script`'s `get`-then-`set` would re-create
+    // the departed key as a phantom `State:/Network/Service/<old>/DNS` carrying the
+    // stale resolver and (when the snapshot had no interface) no `InterfaceName` and
+    // no live IPv4/IPv6 entity — which the detector reads as an unscoped
+    // default-resolver hijacker → a false "VPN up" pointing corp domains at a dead
+    // resolver. A gone service needs no restore; leaving it absent is correct.
+    if !scutil.key_exists(&snapshot.service_dns_key)? {
+        log::info!(
+            "skipping restore of {}: its service DNS key no longer exists \
+             (the service departed); not re-creating a phantom entry",
+            snapshot.service_dns_key
+        );
+        return Ok(());
+    }
+    let script = build_set_dns_script(
+        &snapshot.service_dns_key,
+        &snapshot.prior_servers,
+        snapshot.interface_name.as_deref(),
+    );
+    scutil.run_script(&script)
+}
+
+/// Test doubles for the demote seam, shared by this module's tests and the
+/// backend's apply/revert wiring tests.
+#[cfg(test)]
+pub(super) mod test_support {
+    use super::*;
+    use std::cell::RefCell;
+
+    /// A fake `scutil` that captures every script run and returns canned state.
+    /// `primary` is interior-mutable so a test can model the primary service
+    /// changing while up (the P2 case). `service_states` maps a service DNS key
+    /// to the dict the fake reports for it; an unmapped key falls back to
+    /// `default_state`.
+    pub(in super::super) struct FakeScutil {
+        pub primary: RefCell<Option<String>>,
+        pub default_state: ServiceDnsState,
+        pub service_states: RefCell<std::collections::HashMap<String, ServiceDnsState>>,
+        pub scripts: RefCell<Vec<String>>,
+        pub fail_on_set: std::cell::Cell<bool>,
+        /// Service DNS keys the fake reports as absent (`key_exists` → false), so a
+        /// test can model a service configd tore down (the phantom-restore case).
+        pub absent_keys: RefCell<std::collections::HashSet<String>>,
+    }
+
+    impl FakeScutil {
+        /// A primary service ("ABC", on en0) with one prior resolver — the
+        /// common case.
+        pub fn up() -> Self {
+            FakeScutil {
+                primary: RefCell::new(Some("ABC".to_string())),
+                default_state: ServiceDnsState {
+                    interface_name: Some("en0".to_string()),
+                    servers: vec!["198.51.100.1".to_string()],
+                },
+                service_states: RefCell::new(std::collections::HashMap::new()),
+                scripts: RefCell::new(Vec::new()),
+                fail_on_set: std::cell::Cell::new(false),
+                absent_keys: RefCell::new(std::collections::HashSet::new()),
+            }
+        }
+
+        /// Make subsequent `set` scripts fail (to test rollback paths).
+        pub fn fail_on_set(&self) {
+            self.fail_on_set.set(true);
+        }
+
+        /// Point `primary_service()` at a different service id (P2: the primary
+        /// changed while up).
+        pub fn set_primary(&self, id: &str) {
+            *self.primary.borrow_mut() = Some(id.to_string());
+        }
+
+        /// Script the DNS dict the fake reports for a specific service key.
+        pub fn set_service_state(&self, key: &str, state: ServiceDnsState) {
+            self.service_states
+                .borrow_mut()
+                .insert(key.to_string(), state);
+        }
+
+        /// Mark a service DNS key as gone from the dynamic store, so `key_exists`
+        /// reports it absent (the service departed — configd tore its keys down).
+        pub fn set_key_absent(&self, key: &str) {
+            self.absent_keys.borrow_mut().insert(key.to_string());
+        }
+    }
+
+    impl ScutilRunner for FakeScutil {
+        fn primary_service(&self) -> Result<Option<String>, PlatformError> {
+            Ok(self.primary.borrow().clone())
+        }
+        fn service_dns_state(&self, key: &str) -> Result<ServiceDnsState, PlatformError> {
+            Ok(self
+                .service_states
+                .borrow()
+                .get(key)
+                .cloned()
+                .unwrap_or_else(|| self.default_state.clone()))
+        }
+        fn key_exists(&self, key: &str) -> Result<bool, PlatformError> {
+            Ok(!self.absent_keys.borrow().contains(key))
+        }
+        fn run_script(&self, script: &str) -> Result<(), PlatformError> {
+            if self.fail_on_set.get() && script.contains("set ") {
+                return Err(PlatformError::CommandFailed("simulated set failure".into()));
+            }
+            self.scripts.borrow_mut().push(script.to_string());
+            Ok(())
+        }
+    }
+
+    /// An in-memory snapshot store for tests.
+    #[derive(Default)]
+    pub(in super::super) struct MemSnapshots {
+        pub slot: RefCell<Option<DemoteSnapshot>>,
+        /// When `Some(n)`, the next `n` saves succeed and every save after that
+        /// fails — so a test can model the post-write `installed_fallback` record
+        /// failing *after* the demote's `set` already took effect (the inverse
+        /// half-state case). `None` = every save succeeds.
+        pub ok_saves: std::cell::Cell<Option<usize>>,
+    }
+    impl SnapshotStore for MemSnapshots {
+        fn load(&self) -> Option<DemoteSnapshot> {
+            self.slot.borrow().clone()
+        }
+        fn save(&self, snapshot: &DemoteSnapshot) -> Result<(), PlatformError> {
+            match self.ok_saves.get() {
+                Some(0) => {
+                    return Err(PlatformError::CommandFailed(
+                        "simulated snapshot save failure".into(),
+                    ))
+                }
+                Some(n) => self.ok_saves.set(Some(n - 1)),
+                None => {}
+            }
+            *self.slot.borrow_mut() = Some(snapshot.clone());
+            Ok(())
+        }
+        fn clear(&self) {
+            *self.slot.borrow_mut() = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::test_support::{FakeScutil, MemSnapshots};
+    use super::*;
+
+    fn snap(
+        key: &str,
+        iface: Option<&str>,
+        servers: &[&str],
+        installed: &[&str],
+    ) -> DemoteSnapshot {
+        DemoteSnapshot {
+            service_dns_key: key.to_string(),
+            interface_name: iface.map(str::to_string),
+            prior_servers: servers.iter().map(|s| s.to_string()).collect(),
+            installed_fallback: installed.iter().map(|s| s.to_string()).collect(),
+        }
+    }
+
+    // --- pure script builders -------------------------------------------------
+
+    #[test]
+    fn set_dns_script_sets_server_addresses_and_preserves_the_interface() {
+        let script = build_set_dns_script(
+            "State:/Network/Service/ABC/DNS",
+            &["198.51.100.1".to_string()],
+            Some("en0"),
+        );
+        assert_eq!(
+            script,
+            "open\n\
+             d.init\n\
+             get State:/Network/Service/ABC/DNS\n\
+             d.add ServerAddresses * 198.51.100.1\n\
+             d.add InterfaceName en0\n\
+             set State:/Network/Service/ABC/DNS\n\
+             quit\n"
+        );
+    }
+
+    #[test]
+    fn set_dns_script_gets_the_live_dict_before_overriding_to_preserve_fields() {
+        // The P2 invariant: `get` the existing dict BEFORE overriding
+        // ServerAddresses so unmanaged DHCP/VPN fields (SearchDomains, DomainName,
+        // SupplementalMatchDomains, …) ride through instead of being replaced by a
+        // minimal dict.
+        let script = build_set_dns_script(
+            "State:/Network/Service/ABC/DNS",
+            &["203.0.113.9".to_string()],
+            Some("en0"),
+        );
+        let get_at = script.find("get State:/Network/Service/ABC/DNS\n").unwrap();
+        let override_at = script.find("d.add ServerAddresses").unwrap();
+        assert!(
+            get_at < override_at,
+            "must load the live dict with `get` before overriding ServerAddresses"
+        );
+        // No bare-init minimal write that would replace the whole dict.
+        assert!(!script.contains("d.init\nd.add ServerAddresses"));
+    }
+
+    #[test]
+    fn set_dns_script_omits_the_interface_when_unknown() {
+        let script = build_set_dns_script(
+            "State:/Network/Service/ABC/DNS",
+            &["198.51.100.1".to_string()],
+            None,
+        );
+        assert!(!script.contains("InterfaceName"));
+        assert!(script.contains("d.add ServerAddresses * 198.51.100.1\n"));
+    }
+
+    #[test]
+    fn set_dns_script_handles_multiple_servers() {
+        let script = build_set_dns_script(
+            "State:/Network/Service/ABC/DNS",
+            &["198.51.100.1".to_string(), "198.51.100.2".to_string()],
+            Some("en0"),
+        );
+        assert!(script.contains("d.add ServerAddresses * 198.51.100.1 198.51.100.2\n"));
+    }
+
+    #[test]
+    fn set_dns_script_with_no_servers_removes_only_our_server_addresses() {
+        // No prior servers → drop our ServerAddresses override (after `get`-ing the
+        // live dict) rather than adding any, keeping every other field intact.
+        let script = build_set_dns_script("State:/Network/Service/ABC/DNS", &[], Some("en0"));
+        assert!(script.contains("get State:/Network/Service/ABC/DNS\n"));
+        assert!(script.contains("d.remove ServerAddresses\n"));
+        assert!(!script.contains("d.add ServerAddresses"));
+        assert!(script.contains("d.add InterfaceName en0\n"));
+        assert!(script.contains("set State:/Network/Service/ABC/DNS\n"));
+    }
+
+    #[test]
+    fn service_dns_key_is_well_formed() {
+        assert_eq!(
+            service_dns_key("ABC-123"),
+            "State:/Network/Service/ABC-123/DNS"
+        );
+    }
+
+    /// Round-trip a snapshot through the on-disk (serde JSON) encoding.
+    fn json_round_trip(s: &DemoteSnapshot) -> DemoteSnapshot {
+        serde_json::from_str(&serde_json::to_string(s).unwrap()).unwrap()
+    }
+
+    #[test]
+    fn snapshot_round_trips_through_disk_format() {
+        let s = snap(
+            "State:/Network/Service/ABC/DNS",
+            Some("en0"),
+            &["198.51.100.1", "198.51.100.2"],
+            &["203.0.113.9", "203.0.113.10"],
+        );
+        assert_eq!(json_round_trip(&s), s);
+    }
+
+    #[test]
+    fn snapshot_round_trips_with_no_prior_servers_and_no_interface() {
+        let s = snap("State:/Network/Service/ABC/DNS", None, &[], &[]);
+        assert_eq!(json_round_trip(&s), s);
+    }
+
+    #[test]
+    fn snapshot_round_trips_with_an_interface_but_no_servers() {
+        let s = snap(
+            "State:/Network/Service/ABC/DNS",
+            Some("en0"),
+            &[],
+            &["203.0.113.9"],
+        );
+        assert_eq!(json_round_trip(&s), s);
+    }
+
+    #[test]
+    fn snapshot_deserialize_rejects_garbage() {
+        // The store's `load` maps any deserialize error to `None` (treated as
+        // "nothing demoted"), never a panic: empty, non-JSON, and JSON missing the
+        // required `service_dns_key` field all fail to parse.
+        assert!(serde_json::from_str::<DemoteSnapshot>("").is_err());
+        assert!(serde_json::from_str::<DemoteSnapshot>("not json at all").is_err());
+        assert!(
+            serde_json::from_str::<DemoteSnapshot>("{\"prior_servers\":[\"192.0.2.1\"]}").is_err()
+        );
+    }
+
+    // --- demote / restore orchestration --------------------------------------
+
+    #[test]
+    fn demote_snapshots_prior_then_sets_the_fallback_preserving_the_interface() {
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        let did = demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert!(did);
+        // Prior state captured for the primary service, including its interface.
+        assert_eq!(
+            snaps.load().unwrap(),
+            snap(
+                "State:/Network/Service/ABC/DNS",
+                Some("en0"),
+                &["198.51.100.1"],
+                &["203.0.113.9"],
+            )
+        );
+        // Exactly one script issued: set the fallback AND re-add InterfaceName so
+        // the demoted physical service stays identifiable (P1 fix).
+        let scripts = scutil.scripts.borrow();
+        assert_eq!(scripts.len(), 1);
+        assert!(scripts[0].contains("d.add ServerAddresses * 203.0.113.9\n"));
+        assert!(
+            scripts[0].contains("d.add InterfaceName en0\n"),
+            "the demote must preserve InterfaceName so detection still finds the physical service"
+        );
+        assert!(scripts[0].contains("set State:/Network/Service/ABC/DNS\n"));
+    }
+
+    #[test]
+    fn redemote_same_service_still_on_our_fallback_keeps_the_snapshot() {
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        let after_first = snaps.load().unwrap();
+        // The demote took effect: the service now reports OUR fallback as its DNS.
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["203.0.113.9".to_string()],
+            },
+        );
+        // A second demote (same primary, still our fallback) must keep the ORIGINAL
+        // prior, not snapshot our own fallback.
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert_eq!(snaps.load().unwrap(), after_first);
+        assert_eq!(
+            after_first.prior_servers,
+            vec!["198.51.100.1".to_string()],
+            "the snapshot must remain the real prior resolver, never our fallback"
+        );
+    }
+
+    #[test]
+    fn redemote_same_service_refreshes_the_snapshot_when_the_dhcp_dns_changed() {
+        // P2: the SAME primary service stays active but its DHCP resolver changes
+        // (a new lease overwrites our fallback) and the watcher re-emits Up. The
+        // snapshot must refresh to the NEW resolver, so a later restore writes back
+        // the latest service DNS instead of pinning the pre-change one.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        // DHCP hands the same service a new resolver.
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["198.51.100.77".to_string()],
+            },
+        );
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert_eq!(
+            snaps.load().unwrap(),
+            snap(
+                "State:/Network/Service/ABC/DNS",
+                Some("en0"),
+                &["198.51.100.77"],
+                &["203.0.113.9"],
+            ),
+            "the snapshot must track the new DHCP resolver so restore is not stale"
+        );
+    }
+
+    #[test]
+    fn redemote_after_a_fallback_change_keeps_the_original_prior() {
+        // P2: `fallback_dns` changes from one resolver to another while demoted, so
+        // the service still shows our PREVIOUS fallback. That previous fallback must
+        // not be mistaken for a DHCP update and captured as the prior — restore must
+        // still write the real DHCP resolver, not our old fallback.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        // The demote took effect: the service shows our first fallback.
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["203.0.113.9".to_string()],
+            },
+        );
+        // fallback_dns changes to a different resolver; re-demote.
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.50".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        let after = snaps.load().unwrap();
+        assert_eq!(
+            after.prior_servers,
+            vec!["198.51.100.1".to_string()],
+            "the prior must stay the real DHCP resolver, never our previous fallback"
+        );
+        assert_eq!(
+            after.installed_fallback,
+            vec!["203.0.113.50".to_string()],
+            "the recorded installed fallback tracks the newly applied one"
+        );
+    }
+
+    #[test]
+    fn redemote_keeps_prior_when_the_installed_fallback_record_was_lost() {
+        // P2: the post-write `installed_fallback` record can fail (e.g. a transient
+        // `/var/run` write error) after the demote's `set` already succeeded, leaving
+        // the snapshot's installed_fallback empty while the service already shows our
+        // fallback. A retry with the SAME fallback must still recognise that value as
+        // ours and keep the real DHCP prior — not snapshot our own fallback (which a
+        // later restore would then write back as if it were the prior resolver).
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        // Seed the post-failure state: the real DHCP prior is captured, but the
+        // installed_fallback record was lost (empty), and the service already shows
+        // the fallback the previous `set` wrote.
+        snaps
+            .save(&snap(
+                "State:/Network/Service/ABC/DNS",
+                Some("en0"),
+                &["198.51.100.1"],
+                &[],
+            ))
+            .unwrap();
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["203.0.113.9".to_string()],
+            },
+        );
+        // Retry the demote with the SAME fallback.
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        let after = snaps.load().unwrap();
+        assert_eq!(
+            after.prior_servers,
+            vec!["198.51.100.1".to_string()],
+            "a retry must not capture our own fallback as the prior when the \
+             installed_fallback record was lost"
+        );
+        assert_eq!(
+            after.installed_fallback,
+            vec!["203.0.113.9".to_string()],
+            "the post-write step repairs the lost installed_fallback record"
+        );
+    }
+
+    #[test]
+    fn redemote_default_config_refreshes_when_dhcp_equals_the_new_fallback() {
+        // P1: in the DEFAULT config the fallback IS the physical DHCP resolver, so
+        // a DHCP change makes the new resolver EQUAL the new fallback. The refresh
+        // must still fire — keyed on the PREVIOUSLY recorded installed_fallback, not
+        // on comparing against the fallback we are about to install — or a later
+        // restore pins the stale pre-change resolver. The old `current != fallback`
+        // guard wrongly suppressed exactly this case.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        // First demote, default config: fallback == the physical DHCP resolver.
+        demote(
+            &scutil,
+            &snaps,
+            &["198.51.100.1".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        // DHCP renews: the service now shows a NEW resolver, and in the default
+        // config the detector's demote-target (== the fallback) is that same value.
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["198.51.100.77".to_string()],
+            },
+        );
+        demote(
+            &scutil,
+            &snaps,
+            &["198.51.100.77".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        let after = snaps.load().unwrap();
+        assert_eq!(
+            after.prior_servers,
+            vec!["198.51.100.77".to_string()],
+            "the prior must refresh to the new DHCP resolver even when it equals the new fallback"
+        );
+        assert_eq!(after.installed_fallback, vec!["198.51.100.77".to_string()]);
+    }
+
+    #[test]
+    fn redemote_never_captures_the_corp_resolver_as_a_prior() {
+        // P1 edge: a hijacking client rewrites the physical service's
+        // ServerAddresses to its OWN corp DNS between samples. That corp value must
+        // never be captured as the prior — a later restore would then install the
+        // corp resolver as the off-VPN default. The real prior stays untouched.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        // The physical service now (transiently) shows the corp resolver.
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec!["192.0.2.53".to_string()],
+            },
+        );
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert_eq!(
+            snaps.load().unwrap().prior_servers,
+            vec!["198.51.100.1".to_string()],
+            "the corp resolver must never be snapshotted as the physical prior"
+        );
+    }
+
+    #[test]
+    fn demote_survives_a_post_write_installed_fallback_save_failure() {
+        // P2: the `set` already demoted the default and the prior snapshot is saved,
+        // but the post-write installed_fallback record fails. The demote must NOT
+        // fail — that would make apply_with roll back only the /etc/resolver scope,
+        // leaving the inverse half-state (default demoted, corp domains unscoped →
+        // they leak via the fallback). It stays applied; only the dedup hint is lost.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        // The first save (capture_snapshot) succeeds; the second (post-write) fails.
+        snaps.ok_saves.set(Some(1));
+        let did = demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert!(
+            did,
+            "the demote stays applied despite the bookkeeping save failure"
+        );
+        // The set took effect (the fallback script was issued)...
+        assert!(scutil
+            .scripts
+            .borrow()
+            .iter()
+            .any(|s| s.contains("d.add ServerAddresses * 203.0.113.9")));
+        // ...and the prior snapshot survived (recoverable on a later revert).
+        let after = snaps.load().unwrap();
+        assert_eq!(after.prior_servers, vec!["198.51.100.1".to_string()]);
+        // The installed_fallback hint was not recorded (its save failed) — tolerated
+        // by the same-service refresh branch's `installed_fallback.is_empty()` path.
+        assert!(after.installed_fallback.is_empty());
+    }
+
+    #[test]
+    fn restore_skips_a_departed_service_instead_of_recreating_a_phantom() {
+        // P1: on VPN-down the demoted service has departed (Wi-Fi off → Ethernet in;
+        // configd tore down its keys). Restore must NOT re-create the key — a
+        // get-then-set would leave a phantom the detector reads as an unscoped
+        // default-resolver hijacker → a false "VPN up" at a dead resolver.
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+        // The demoted service's DNS key is gone.
+        scutil.set_key_absent("State:/Network/Service/ABC/DNS");
+
+        let restored = restore(&scutil, &snaps).unwrap();
+        assert!(
+            restored,
+            "restore reports it handled the snapshot so the caller still flushes"
+        );
+        // No set script re-created the departed key...
+        assert!(
+            scutil
+                .scripts
+                .borrow()
+                .iter()
+                .all(|s| !s.contains("set State:/Network/Service/ABC/DNS")),
+            "a departed service must not be re-created as a phantom"
+        );
+        // ...and the snapshot is cleared.
+        assert!(snaps.load().is_none());
+    }
+
+    #[test]
+    fn demote_on_a_changed_primary_skips_a_departed_old_service() {
+        // P1: the primary switched because the OLD service departed entirely (its
+        // keys are gone). The old service must NOT be restored (no phantom); the new
+        // primary is still snapshotted and demoted.
+        let scutil = FakeScutil::up(); // primary ABC (en0)
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+        // The old primary ABC departed; the new primary is XYZ (en1) with its own DNS.
+        scutil.set_key_absent("State:/Network/Service/ABC/DNS");
+        scutil.set_primary("XYZ");
+        scutil.set_service_state(
+            "State:/Network/Service/XYZ/DNS",
+            ServiceDnsState {
+                interface_name: Some("en1".to_string()),
+                servers: vec!["198.51.100.50".to_string()],
+            },
+        );
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+
+        let scripts = scutil.scripts.borrow();
+        // The departed old service is NOT restored (no phantom re-created).
+        assert!(
+            scripts
+                .iter()
+                .all(|s| !s.contains("set State:/Network/Service/ABC/DNS")),
+            "the departed old service must not be re-created"
+        );
+        // The new primary IS demoted to the fallback.
+        assert!(scripts
+            .iter()
+            .any(|s| s.contains("set State:/Network/Service/XYZ/DNS")
+                && s.contains("d.add ServerAddresses * 203.0.113.9")));
+        drop(scripts);
+        assert_eq!(
+            snaps.load().unwrap().service_dns_key,
+            "State:/Network/Service/XYZ/DNS"
+        );
+    }
+
+    #[test]
+    fn scutil_set_error_flags_stdout_failures_but_allows_no_such_key() {
+        // Success is silent → None.
+        assert!(scutil_set_error("").is_none());
+        assert!(scutil_set_error("\n  \n").is_none());
+        // The benign `get` on a missing key → None (the demote/restore scripts
+        // issue `get` by design, and a first-time service key does not exist yet).
+        assert!(scutil_set_error("  No such key\n").is_none());
+        assert!(scutil_set_error("No such key\nNo such key\n").is_none());
+        // A real stdout-reported failure (exit 0) → Some.
+        let err = scutil_set_error("  SCPreferencesCommitChanges: Permission denied\n").unwrap();
+        assert!(err.contains("Permission denied"));
+        // Mixed: only the non-benign line is reported.
+        let err = scutil_set_error("No such key\n  failed to apply\n").unwrap();
+        assert!(err.contains("failed to apply") && !err.contains("No such key"));
+    }
+
+    #[test]
+    fn demote_on_a_changed_primary_restores_the_old_then_snapshots_the_new() {
+        // P2: the primary service changes while up (e.g. Wi-Fi → Ethernet) with a
+        // snapshot already present. The old service must be un-demoted (not left
+        // stranded on our fallback), and the NEW service snapshotted + demoted.
+        let scutil = FakeScutil::up(); // primary = ABC (en0)
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+
+        // The primary switches to XYZ on en1 with its own DHCP resolver.
+        scutil.set_primary("XYZ");
+        scutil.set_service_state(
+            "State:/Network/Service/XYZ/DNS",
+            ServiceDnsState {
+                interface_name: Some("en1".to_string()),
+                servers: vec!["198.51.100.50".to_string()],
+            },
+        );
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+
+        // The snapshot now tracks the NEW primary with its real prior DNS.
+        assert_eq!(
+            snaps.load().unwrap(),
+            snap(
+                "State:/Network/Service/XYZ/DNS",
+                Some("en1"),
+                &["198.51.100.50"],
+                &["203.0.113.9"],
+            )
+        );
+        let scripts = scutil.scripts.borrow();
+        // First the OLD service is restored to its real prior (198.51.100.1),
+        // then the NEW service is demoted to the fallback.
+        assert!(
+            scripts
+                .iter()
+                .any(|s| s.contains("set State:/Network/Service/ABC/DNS")
+                    && s.contains("d.add ServerAddresses * 198.51.100.1")),
+            "the previous primary must be restored to its real DNS, not left on the fallback"
+        );
+        assert!(
+            scripts
+                .iter()
+                .any(|s| s.contains("set State:/Network/Service/XYZ/DNS")
+                    && s.contains("d.add ServerAddresses * 203.0.113.9")),
+            "the new primary must be demoted to the fallback"
+        );
+    }
+
+    #[test]
+    fn demote_with_no_primary_service_is_a_clean_noop() {
+        let scutil = FakeScutil::up();
+        *scutil.primary.borrow_mut() = None;
+        let snaps = MemSnapshots::default();
+        let did = demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        assert!(!did);
+        assert!(snaps.load().is_none());
+        assert!(scutil.scripts.borrow().is_empty());
+    }
+
+    #[test]
+    fn demote_to_empty_fallback_is_rejected() {
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        assert!(demote(&scutil, &snaps, &[], &["192.0.2.53".to_string()]).is_err());
+        // Nothing captured or issued on rejection.
+        assert!(snaps.load().is_none());
+        assert!(scutil.scripts.borrow().is_empty());
+    }
+
+    #[test]
+    fn restore_sets_prior_servers_with_the_interface_and_clears_snapshot() {
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+
+        restore(&scutil, &snaps).unwrap();
+        let scripts = scutil.scripts.borrow();
+        assert_eq!(scripts.len(), 1);
+        // Restored the original servers AND the interface name...
+        assert!(scripts[0].contains("d.add ServerAddresses * 198.51.100.1\n"));
+        assert!(scripts[0].contains("d.add InterfaceName en0\n"));
+        // ...and cleared the snapshot so a later demote re-snaps.
+        drop(scripts);
+        assert!(snaps.load().is_none());
+    }
+
+    #[test]
+    fn restore_clears_only_our_servers_when_there_were_no_prior_ones() {
+        // A service with no explicit prior ServerAddresses: restore drops just our
+        // override (d.remove ServerAddresses) after `get`-ing the live dict, so any
+        // DHCP-provided SearchDomains/etc. are preserved rather than wiped.
+        let scutil = FakeScutil::up();
+        scutil.set_service_state(
+            "State:/Network/Service/ABC/DNS",
+            ServiceDnsState {
+                interface_name: Some("en0".to_string()),
+                servers: vec![],
+            },
+        );
+        let snaps = MemSnapshots::default();
+        demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        )
+        .unwrap();
+        scutil.scripts.borrow_mut().clear();
+
+        restore(&scutil, &snaps).unwrap();
+        let scripts = scutil.scripts.borrow();
+        assert_eq!(scripts.len(), 1);
+        assert!(scripts[0].contains("get State:/Network/Service/ABC/DNS\n"));
+        assert!(scripts[0].contains("d.remove ServerAddresses\n"));
+        assert!(!scripts[0].contains("d.add ServerAddresses"));
+        assert!(scripts[0].contains("set State:/Network/Service/ABC/DNS\n"));
+    }
+
+    #[test]
+    fn restore_with_no_snapshot_is_a_clean_noop() {
+        let scutil = FakeScutil::up();
+        let snaps = MemSnapshots::default();
+        restore(&scutil, &snaps).unwrap();
+        assert!(scutil.scripts.borrow().is_empty());
+    }
+
+    #[test]
+    fn demote_propagates_a_set_failure_after_snapshotting() {
+        // If the set fails, the snapshot is already on disk, so a later restore
+        // can still recover — the demote surfaces the error rather than masking.
+        let scutil = FakeScutil::up();
+        scutil.fail_on_set();
+        let snaps = MemSnapshots::default();
+        let result = demote(
+            &scutil,
+            &snaps,
+            &["203.0.113.9".to_string()],
+            &["192.0.2.53".to_string()],
+        );
+        assert!(result.is_err());
+        // Snapshot persisted so the half-done demote is recoverable on revert.
+        assert!(snaps.load().is_some());
+    }
+}
diff --git a/splitway-daemon/src/backend/macos/mod.rs b/splitway-daemon/src/backend/macos/mod.rs
index f23754d..50da20d 100644
--- a/splitway-daemon/src/backend/macos/mod.rs
+++ b/splitway-daemon/src/backend/macos/mod.rs
@@ -5,6 +5,7 @@
 //! actual filesystem work lives in [`backend`].
 
 mod backend;
+mod demote;
 mod resolver;
 
 pub struct MacosBackend;
diff --git a/splitway-daemon/src/backend/macos/resolver.rs b/splitway-daemon/src/backend/macos/resolver.rs
index 16d5ca7..b84ce9a 100644
--- a/splitway-daemon/src/backend/macos/resolver.rs
+++ b/splitway-daemon/src/backend/macos/resolver.rs
@@ -68,15 +68,15 @@ mod tests {
 
     #[test]
     fn is_managed_only_for_our_marker() {
-        assert!(is_managed(&resolver_contents(&["1.1.1.1".to_string()])));
+        assert!(is_managed(&resolver_contents(&["192.0.2.1".to_string()])));
         assert!(is_managed(MANAGED_MARKER));
         // A file the user wrote by hand must not be claimed.
-        assert!(!is_managed("nameserver 1.1.1.1\n"));
-        assert!(!is_managed("# some other tool\nnameserver 1.1.1.1\n"));
+        assert!(!is_managed("nameserver 192.0.2.1\n"));
+        assert!(!is_managed("# some other tool\nnameserver 192.0.2.1\n"));
         assert!(!is_managed(""));
         // The marker must be the *first* line, not buried later.
         assert!(!is_managed(&format!(
-            "nameserver 1.1.1.1\n{MANAGED_MARKER}\n"
+            "nameserver 192.0.2.1\n{MANAGED_MARKER}\n"
         )));
     }
 
diff --git a/splitway-daemon/src/daemon/state.rs b/splitway-daemon/src/daemon/state.rs
index 7e19ad3..ace5ebd 100644
--- a/splitway-daemon/src/daemon/state.rs
+++ b/splitway-daemon/src/daemon/state.rs
@@ -132,12 +132,18 @@ pub enum StateCommand {
 /// A snapshot of what is currently applied to the system. Includes the DNS
 /// servers so that a VPN DNS rotation (same interface and domains, different
 /// servers) is seen as out-of-sync and re-applied rather than treated as
-/// already converged.
+/// already converged. Likewise includes the demote-target (macOS off-tunnel
+/// fallback) so a change to it — e.g. the physical DHCP resolver changing after
+/// a Wi-Fi switch — also forces a re-apply (re-demote to the new fallback)
+/// rather than being treated as converged. The demote-target is *not* part of
+/// the wire `AppliedInfo` projection (it is a backend-internal concern, no
+/// protocol change).
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct Applied {
     interface: String,
     domains: Vec<String>,
     dns_servers: Vec<String>,
+    demote_target: Option<Vec<String>>,
 }
 
 /// Project the internal applied snapshot to its wire form. Defined once and used
@@ -204,6 +210,13 @@ pub struct StateMachine {
     /// desired target equals the — now possibly stale — `applied` snapshot, so a
     /// post-failure "already converged" check can never skip a needed re-apply.
     needs_resync: bool,
+    /// Set when the startup reconcile of orphaned persisted state (a global-revert
+    /// backend's demote left by a previous unclean exit) failed transiently. With
+    /// `applied == None`, an ordinary `revert()` is a no-op, so without this the
+    /// orphaned state would linger until a full VPN up→down cycle. While set, each
+    /// `revert()` retries the global cleanup until it succeeds. See
+    /// [`Self::cleanup_orphaned_state_on_startup`].
+    pending_global_cleanup: bool,
     /// Cancel handle for the current watch's forwarding task. Aborting it drops
     /// the detector's `Receiver<VpnEvent>`, which closes the channel and lets the
     /// detector release its resources (see [`Self::arm_watch`]).
@@ -238,6 +251,7 @@ impl StateMachine {
             applied: None,
             orphaned: Vec::new(),
             needs_resync: false,
+            pending_global_cleanup: false,
             watch_cancel: None,
             watch_generation: 0,
             // No watch is armed until `arm_watch` runs (in `run_state`, before
@@ -349,20 +363,68 @@ impl StateMachine {
     /// never set (e.g. one an OpenVPN up-script installed). If a *prior* session
     /// had DNS and the new one does not, this reverts that prior session's rules.
     ///
-    /// The last event's interface must also match the configured `vpn_name`.
-    /// A config change that switches `vpn_name` resets `last_info`/`vpn_up` and
-    /// re-arms the watch (see [`Self::adopt_config`]), so the old interface is
-    /// reverted and the new watch resamples; `last_info.interface_name` therefore
-    /// matches `vpn_name` whenever the configured interface is up.
+    /// On interface-keyed backends (Linux) the last event's interface must also
+    /// match the configured `vpn_name`. A config change that switches `vpn_name`
+    /// resets `last_info`/`vpn_up` and re-arms the watch (see
+    /// [`Self::adopt_config`]), so the old interface is reverted and the new
+    /// watch resamples; `last_info.interface_name` therefore matches `vpn_name`
+    /// whenever the configured interface is up.
+    ///
+    /// On a **global-revert backend** (macOS) detection is driven by the system
+    /// DNS model, not an interface name — the VPN's DNS is the hijacked system
+    /// default, scoped to no `utun`, and the active tunnel index varies between
+    /// sessions. There the interface name is advisory and must NOT gate apply, so
+    /// this check is skipped (the backend gates on its own DNS-model signal).
+    /// Linux behaviour is unchanged.
+    fn interface_gate_passes(&self, info: &VpnInfo) -> bool {
+        if self.backend.reverts_globally() {
+            true
+        } else {
+            info.interface_name == self.config.vpn_name
+        }
+    }
+
+    /// The off-tunnel fallback resolver to fold into the `VpnInfo` handed to the
+    /// backend: the configured `fallback_dns` override if set **and every entry is
+    /// a valid IP literal**, else the detector-supplied `demote_target` (the
+    /// physical interface's own DHCP resolver). A malformed override is ignored —
+    /// it would otherwise reach the root `scutil` demote script verbatim. `None` on
+    /// a backend/VPN that does not demote. The backend applies the demote only when
+    /// this is `Some(non-empty)`.
+    fn effective_demote_target(&self, info: &VpnInfo) -> Option<Vec<String>> {
+        match &self.config.fallback_dns {
+            // A configured override wins — but only when every entry is a real IP
+            // literal. The values are appended verbatim into the root `scutil`
+            // demote script, so a non-IP entry (a typo, a hostname, whitespace, an
+            // empty element) would malform the script rather than fail cleanly.
+            // Reject the whole override in that case and fall back to the detector's
+            // demote-target, logging so the bad config is visible.
+            Some(servers) if !servers.is_empty() => {
+                if servers.iter().all(|s| config::is_ip_literal(s)) {
+                    Some(servers.clone())
+                } else {
+                    log::warn!(
+                        "ignoring fallback_dns: every entry must be an IP literal; \
+                         using the detected physical resolver instead"
+                    );
+                    info.demote_target.clone()
+                }
+            }
+            _ => info.demote_target.clone(),
+        }
+    }
+
     fn desired(&self) -> Option<(VpnInfo, Vec<String>)> {
         let active = self.config.enabled && self.vpn_up && !self.config.vpn_hosts.is_empty();
         match &self.last_info {
             Some(info)
-                if active
-                    && !info.dns_servers.is_empty()
-                    && info.interface_name == self.config.vpn_name =>
+                if active && !info.dns_servers.is_empty() && self.interface_gate_passes(info) =>
             {
-                Some((info.clone(), self.config.vpn_hosts.clone()))
+                // Fold the configured fallback override (if any) into the
+                // demote-target so the backend receives the effective fallback.
+                let mut info = info.clone();
+                info.demote_target = self.effective_demote_target(&info);
+                Some((info, self.config.vpn_hosts.clone()))
             }
             _ => None,
         }
@@ -459,6 +521,9 @@ impl StateMachine {
                     interface: info.interface_name.clone(),
                     domains,
                     dns_servers: info.dns_servers.clone(),
+                    // Already folded with the `fallback_dns` override by
+                    // `desired()`; a change here forces a re-apply (re-demote).
+                    demote_target: info.demote_target.clone(),
                 };
                 // A matching snapshot only means "already converged" when the
                 // last apply/revert actually succeeded; after a failure the
@@ -483,6 +548,10 @@ impl StateMachine {
                         );
                         self.applied = Some(target);
                         self.needs_resync = false;
+                        // Applying establishes our own state (on macOS the demote
+                        // subsumes any prior process's snapshot), so a previously
+                        // pending orphaned-cleanup is no longer outstanding.
+                        self.pending_global_cleanup = false;
                         Ok(())
                     }
                     Ok(Err(e)) => {
@@ -523,8 +592,16 @@ impl StateMachine {
     /// `applied` is left set, so a later reconcile or shutdown retries it.
     async fn revert(&mut self) -> Result<(), PlatformError> {
         let Some(applied) = self.applied.clone() else {
-            // Nothing recorded as applied: the system already matches the
-            // "reverted" goal, so any prior uncertainty is resolved.
+            // Nothing recorded as applied. A previous process's orphaned global
+            // demote may still need cleaning (a startup reconcile that failed
+            // transiently) — retry it here so a Down/disable/reload converges it
+            // instead of waiting for a full VPN up→down cycle.
+            if self.pending_global_cleanup {
+                self.run_global_cleanup().await?;
+                self.pending_global_cleanup = false;
+            }
+            // The system already matches the "reverted" goal, so any prior
+            // uncertainty is resolved.
             self.needs_resync = false;
             return Ok(());
         };
@@ -536,6 +613,16 @@ impl StateMachine {
                 log::info!("reverted rules on {}", applied.interface);
                 self.applied = None;
                 self.needs_resync = false;
+                // On a global-revert backend (macOS) `revert_rules` also restores
+                // the on-disk demote snapshot — exactly the cleanup
+                // `pending_global_cleanup` tracks — so a successful applied-path
+                // revert clears it too. Without this, an apply-fail → revert-success
+                // sequence would leave the flag set and `routing_state()` stuck at
+                // `ApplyFailed` on a system that is in fact clean, until some later
+                // event happened to run the `applied == None` branch.
+                if self.backend.reverts_globally() {
+                    self.pending_global_cleanup = false;
+                }
                 Ok(())
             }
             Ok(Err(e)) => {
@@ -558,6 +645,57 @@ impl StateMachine {
         }
     }
 
+    /// Reconcile orphaned persisted state left by a previous unclean exit, once at
+    /// startup (before the watch is armed).
+    ///
+    /// A **global-revert backend** (macOS) persists its default-DNS demote on disk
+    /// so it survives a SIGKILL. If the daemon was killed while demoted and the VPN
+    /// then went down before this restart, the watch's initial sample is `Down`
+    /// and is suppressed (nothing changed from the watcher's view), so without this
+    /// nothing would restore the default resolver or clear the snapshot — the
+    /// machine would stay pinned to the off-tunnel fallback until the next VPN
+    /// up→down cycle. A global revert is idempotent (a no-op when nothing was
+    /// persisted); and if a VPN is in fact up, the watch's initial `Up` re-applies
+    /// immediately after. Per-interface backends (Linux) keep no cross-restart
+    /// persisted state of this kind, so they skip it (their revert needs a live
+    /// `applied` interface anyway). `applied` stays `None` either way — this only
+    /// cleans state a *previous* process left behind.
+    async fn cleanup_orphaned_state_on_startup(&mut self) {
+        if !self.backend.reverts_globally() {
+            return;
+        }
+        if self.run_global_cleanup().await.is_err() {
+            // A transient failure must not strand the orphaned state: mark it so
+            // every later `revert()` retries until it succeeds.
+            self.pending_global_cleanup = true;
+        }
+    }
+
+    /// Run one global cleanup revert (used by the startup reconcile and the
+    /// retry-on-`revert` path). Logs the outcome and returns the backend result.
+    async fn run_global_cleanup(&self) -> Result<(), PlatformError> {
+        let backend = self.backend.clone();
+        let interface = self.config.vpn_name.clone();
+        match tokio::task::spawn_blocking(move || backend.revert_rules(&interface)).await {
+            Ok(Ok(())) => {
+                log::debug!("reconciled any orphaned default-DNS demote state");
+                Ok(())
+            }
+            Ok(Err(e)) => {
+                log::warn!(
+                    "orphaned-state cleanup failed: {e}; it will be retried on the next reconcile"
+                );
+                Err(e)
+            }
+            Err(e) => {
+                log::error!("orphaned-state cleanup task panicked: {e}");
+                Err(PlatformError::CommandFailed(format!(
+                    "orphaned-state cleanup task panicked: {e}"
+                )))
+            }
+        }
+    }
+
     /// Entry point for a forwarded detector event. Drops events from a watch
     /// generation we have since superseded (an interface switch may leave an
     /// in-flight event from the old forwarding task), so the old interface's
@@ -659,10 +797,14 @@ impl StateMachine {
         // intentionally ignored: shutdown reports cleanliness from the
         // `self.orphaned` check below, which covers the same lingering set.
         let _ = self.revert_orphaned().await;
-        let applied_clean = if self.applied.is_none() {
-            true
-        } else {
-            log::info!("shutdown: reverting active rules");
+        // Revert applied rules, and ALSO run a pending global cleanup (a macOS
+        // startup reconcile that failed transiently) so a stale demote snapshot /
+        // default DNS is not left behind when `applied` is `None`. `revert()`
+        // covers both: it reverts when `applied` is set, and runs the pending
+        // global cleanup otherwise — returning `Err` (→ unclean) if it still fails,
+        // so shutdown does not falsely report clean while a demote may remain.
+        let applied_clean = if self.applied.is_some() || self.pending_global_cleanup {
+            log::info!("shutdown: reverting active rules and any pending cleanup");
             match self.revert().await {
                 Ok(()) => true,
                 Err(e) => {
@@ -670,6 +812,8 @@ impl StateMachine {
                     false
                 }
             }
+        } else {
+            true
         };
         if applied_clean && self.orphaned.is_empty() {
             log::info!("shutdown: system left clean");
@@ -700,16 +844,17 @@ impl StateMachine {
             // surfaced regardless of *apply* state so a client can show the
             // interface's resolver read-only (the DNS-auto model). Sourced from
             // the last detector reading, gated on (a) the interface still being
-            // up and (b) its name matching the configured `vpn_name` — the same
-            // guards `desired()`/`routing_state()` use. The `vpn_up` gate matters
-            // because a `Down` event only flips `vpn_up` and leaves `last_info`
-            // populated, so without it a disconnected VPN would keep reporting its
-            // last DNS as "detected". Empty when no interface is configured, it is
-            // down, or it pushes no DNS.
+            // up and (b) the interface gate — its name matching `vpn_name` on
+            // Linux, or always (DNS-model-driven) on macOS — the same guard
+            // `desired()`/`routing_state()` use. The `vpn_up` gate matters because
+            // a `Down` event only flips `vpn_up` and leaves `last_info` populated,
+            // so without it a disconnected VPN would keep reporting its last DNS
+            // as "detected". Empty when no interface is configured, it is down, or
+            // it pushes no DNS.
             detected_dns: self
                 .last_info
                 .as_ref()
-                .filter(|info| self.vpn_up && info.interface_name == self.config.vpn_name)
+                .filter(|info| self.vpn_up && self.interface_gate_passes(info))
                 .map(|info| info.dns_servers.clone())
                 .unwrap_or_default(),
             detector_health: self.detector_health.clone(),
@@ -729,12 +874,15 @@ impl StateMachine {
     /// occur) is reported as `NoDnsFromVpn` rather than a near-unreachable state.
     ///
     /// A known out-of-sync condition takes precedence over every "inactive"
-    /// reason: a failed apply/revert (`needs_resync`) or an interface orphaned by
-    /// a failed switch (`orphaned` non-empty) means stale split-DNS rules may
-    /// still be installed somewhere, so reporting `Disabled`/`Applied`/etc. would
-    /// claim a clean state the daemon does not believe in. Both surface as
-    /// `ApplyFailed` ("out of sync") until cleanup succeeds — e.g. a `Disable`
-    /// whose revert failed reads `ApplyFailed`, not `Disabled`.
+    /// reason: a failed apply/revert (`needs_resync`), an interface orphaned by a
+    /// failed switch (`orphaned` non-empty), or a pending global cleanup (a macOS
+    /// startup demote-reconcile that failed transiently — `pending_global_cleanup`)
+    /// each means stale split-DNS rules or a stale demoted default may still be
+    /// installed, so reporting `Disabled`/`VpnDown`/`Applied`/etc. would claim a
+    /// clean state the daemon does not believe in. All surface as `ApplyFailed`
+    /// ("out of sync") until cleanup succeeds — e.g. a `Disable` whose revert
+    /// failed reads `ApplyFailed`, not `Disabled`; and a restart that could not
+    /// clear an orphaned demote reads `ApplyFailed`, not `VpnDown`.
     fn routing_state(&self) -> RoutingState {
         // A config file that does not parse takes precedence over everything:
         // the daemon froze on the last-good config, and the user must learn
@@ -743,9 +891,12 @@ impl StateMachine {
         if self.config_invalid {
             return RoutingState::ConfigInvalid;
         }
-        // Out-of-sync (a failed apply/revert, or a lingering orphaned interface)
-        // overrides the inactive-reason branches below — see the doc above.
-        if self.needs_resync || !self.orphaned.is_empty() {
+        // Out-of-sync (a failed apply/revert, a lingering orphaned interface, or a
+        // pending macOS demote-cleanup) overrides the inactive-reason branches
+        // below — see the doc above. Without the pending-cleanup term, a restart
+        // that left an orphaned demote pending would report `VpnDown` while the
+        // default DNS is still demoted.
+        if self.needs_resync || !self.orphaned.is_empty() || self.pending_global_cleanup {
             return RoutingState::ApplyFailed;
         }
         if !self.config.enabled {
@@ -757,11 +908,10 @@ impl StateMachine {
         if !self.vpn_up {
             return RoutingState::VpnDown;
         }
-        let has_vpn_dns = matches!(
-            &self.last_info,
-            Some(info)
-                if !info.dns_servers.is_empty() && info.interface_name == self.config.vpn_name
-        );
+        let has_vpn_dns = self
+            .last_info
+            .as_ref()
+            .is_some_and(|info| !info.dns_servers.is_empty() && self.interface_gate_passes(info));
         if !has_vpn_dns {
             return RoutingState::NoDnsFromVpn;
         }
@@ -1238,10 +1388,25 @@ impl StateMachine {
 }
 
 /// Whether a config delta requires re-arming the detector watch — i.e. it
-/// touches a field the watch is keyed on. Domain/`enabled` edits do not (those
-/// only change `desired()`), so they reconcile without tearing the watch down.
+/// touches a field the watch is keyed on, OR a field whose change needs the
+/// revert + re-sample that a re-arm performs. Domain/`enabled` edits do not
+/// (those only change `desired()`), so they reconcile without tearing the watch
+/// down.
+///
+/// `fallback_dns` is included for the revert + re-sample, not because the watch
+/// is keyed on it: after a macOS demote the detector reads the demoted value back
+/// as the demote-target, so `last_info.demote_target` becomes the override we
+/// installed. Without a fresh sample, removing or changing the override would
+/// leave the physical service pinned to the old fallback (`desired()` still
+/// equals the applied target, so nothing re-applies until the next network/VPN
+/// cycle). The re-arm reverts first — restoring the real prior DHCP resolver from
+/// the demote snapshot — then re-samples, so the next demote targets the correct
+/// resolver. (Harmless on Linux, which ignores `fallback_dns`.)
 fn watch_settings_changed(old: &LocalConfig, new: &LocalConfig) -> bool {
-    old.vpn_name != new.vpn_name || old.vpn_backend != new.vpn_backend || old.openvpn != new.openvpn
+    old.vpn_name != new.vpn_name
+        || old.vpn_backend != new.vpn_backend
+        || old.openvpn != new.openvpn
+        || old.fallback_dns != new.fallback_dns
 }
 
 /// The reply when a mutation cannot read the config file (missing or malformed).
@@ -1270,6 +1435,11 @@ pub async fn run_state(
     mut rx: mpsc::Receiver<StateCommand>,
     mut shutdown: oneshot::Receiver<oneshot::Sender<bool>>,
 ) {
+    // Reconcile any orphaned persisted state left by a previous unclean exit
+    // (e.g. a global-revert backend's default-DNS demote snapshot) before arming
+    // the watch — the initial Down sample is suppressed, so this is the only path
+    // that clears it when the VPN is already down at startup.
+    machine.cleanup_orphaned_state_on_startup().await;
     // Arm the VPN watch once here, before the command loop, so all watch
     // lifecycle (start at boot, re-arm on config change) lives in one owner —
     // the actor — rather than being split with `run_async`.
@@ -1330,6 +1500,9 @@ mod tests {
     #[derive(Default)]
     struct MockBackend {
         applies: Mutex<Vec<(String, Vec<String>)>>,
+        /// The `demote_target` carried by each apply, in order — so tests can
+        /// assert the state machine folded in the `fallback_dns` override.
+        applied_demote_targets: Mutex<Vec<Option<Vec<String>>>>,
         reverts: Mutex<Vec<String>>,
         fail_apply: AtomicBool,
         fail_revert: AtomicBool,
@@ -1401,6 +1574,10 @@ mod tests {
                 .lock()
                 .unwrap()
                 .push((info.interface_name.clone(), domains.to_vec()));
+            self.applied_demote_targets
+                .lock()
+                .unwrap()
+                .push(info.demote_target.clone());
             Ok(())
         }
 
@@ -1529,6 +1706,7 @@ mod tests {
             Ok(VpnInfo {
                 interface_name: interface.to_string(),
                 dns_servers: vec!["10.0.0.1".to_string()],
+                demote_target: None,
             })
         }
 
@@ -1563,6 +1741,7 @@ mod tests {
                     .send(VpnEvent::Up(VpnInfo {
                         interface_name: iface,
                         dns_servers: vec!["10.0.0.1".to_string()],
+                        demote_target: None,
                     }))
                     .await;
                 // Then release on receiver drop, like NM/OpenVPN's `tx.closed()`.
@@ -1712,6 +1891,7 @@ mod tests {
             enabled,
             vpn_backend: config::VpnBackend::default(),
             openvpn: config::OpenVpnConfig::default(),
+            fallback_dns: None,
         }
     }
 
@@ -1719,6 +1899,17 @@ mod tests {
         VpnEvent::Up(VpnInfo {
             interface_name: interface.to_string(),
             dns_servers: vec!["10.0.0.1".to_string()],
+            demote_target: None,
+        })
+    }
+
+    /// A macOS-style Up: the detector reports a demote-target (the physical DHCP
+    /// resolver) alongside the corp DNS. `interface_name` is advisory there.
+    fn vpn_up_macos(interface: &str, demote_target: &[&str]) -> VpnEvent {
+        VpnEvent::Up(VpnInfo {
+            interface_name: interface.to_string(),
+            dns_servers: vec!["192.0.2.53".to_string()],
+            demote_target: Some(demote_target.iter().map(|s| s.to_string()).collect()),
         })
     }
 
@@ -1787,6 +1978,170 @@ mod tests {
         assert!(sm.applied.is_none());
     }
 
+    #[tokio::test]
+    async fn startup_reconciles_orphaned_demote_for_a_global_revert_backend() {
+        // A macOS-style backend persists its default-DNS demote across an unclean
+        // exit, so the daemon reverts any orphaned state once at startup — a
+        // suppressed initial Down would otherwise never clear it.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "startup-cleanup-global",
+        );
+
+        sm.cleanup_orphaned_state_on_startup().await;
+
+        assert_eq!(
+            backend.reverts.lock().unwrap().as_slice(),
+            &["wg0"],
+            "the global-revert backend is reconciled once at boot"
+        );
+        assert!(
+            sm.applied.is_none(),
+            "cleanup records nothing as applied — it only clears a prior process's state"
+        );
+        assert!(
+            !sm.pending_global_cleanup,
+            "a successful cleanup leaves nothing pending"
+        );
+    }
+
+    #[tokio::test]
+    async fn startup_skips_cleanup_for_a_per_interface_backend() {
+        // A per-interface backend (Linux) keeps no cross-restart persisted state of
+        // this kind, so startup must not issue a spurious revert.
+        let backend = Arc::new(MockBackend::default()); // reverts_globally == false
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "startup-cleanup-skip",
+        );
+
+        sm.cleanup_orphaned_state_on_startup().await;
+
+        assert!(
+            backend.reverts.lock().unwrap().is_empty(),
+            "a per-interface backend is not reverted at boot"
+        );
+    }
+
+    #[tokio::test]
+    async fn failed_startup_cleanup_is_retried_on_a_later_reconcile() {
+        // P2: the startup cleanup fails transiently. Because `applied` is None an
+        // ordinary reconcile's revert() would be a no-op — but the pending flag
+        // makes the next revert retry the global cleanup until it succeeds, so an
+        // orphaned demote is not stranded until a full VPN up→down cycle.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        backend.set_fail_revert(true); // the startup cleanup fails
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "startup-cleanup-retry",
+        );
+
+        sm.cleanup_orphaned_state_on_startup().await;
+        assert!(
+            sm.pending_global_cleanup,
+            "a failed cleanup is recorded as pending"
+        );
+        assert_eq!(
+            backend.reverts.lock().unwrap().len(),
+            1,
+            "the failing attempt still issued a revert"
+        );
+
+        // A later reconcile (VPN still down, nothing applied) retries the cleanup,
+        // which now succeeds and clears the pending flag.
+        backend.set_fail_revert(false);
+        sm.reconcile_primary().await.unwrap();
+        assert!(
+            !sm.pending_global_cleanup,
+            "a successful retry clears the pending flag"
+        );
+        assert_eq!(
+            backend.reverts.lock().unwrap().len(),
+            2,
+            "the cleanup is retried until it succeeds"
+        );
+    }
+
+    #[tokio::test]
+    async fn status_reports_apply_failed_while_a_global_cleanup_is_pending() {
+        // P2: a pending macOS demote-cleanup (a startup reconcile that failed) means
+        // a stale default DNS may still be installed, so status must read
+        // ApplyFailed — not VpnDown — even though nothing is applied and the VPN is
+        // down at restart.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        backend.set_fail_revert(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "status-pending-cleanup",
+        );
+        sm.cleanup_orphaned_state_on_startup().await; // fails → pending set
+        assert!(sm.pending_global_cleanup);
+        assert!(!sm.vpn_up, "VPN is down at restart");
+        assert!(sm.applied.is_none());
+
+        assert_eq!(
+            sm.routing_state(),
+            RoutingState::ApplyFailed,
+            "a pending demote-cleanup is out-of-sync, not a clean VpnDown"
+        );
+    }
+
+    #[tokio::test]
+    async fn applied_path_revert_clears_a_pending_global_cleanup() {
+        // P3: startup cleanup failed (pending), then a VPN Up whose apply FAILS
+        // (applied stays Some, so the apply-success clear never runs), then a VPN
+        // Down whose applied-path revert SUCCEEDS. On a global-revert backend that
+        // revert also restores the demote snapshot the pending flag tracks, so it
+        // must be cleared here — otherwise routing_state() stays stuck at
+        // ApplyFailed on a system that is in fact clean, until some later event
+        // happens to run the `applied == None` branch.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        backend.set_fail_revert(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "applied-revert-clears-pending",
+        );
+        sm.cleanup_orphaned_state_on_startup().await; // fails → pending set
+        assert!(sm.pending_global_cleanup);
+
+        // VPN Up, but the apply fails → applied stays Some, pending flag untouched.
+        backend.set_fail_revert(false);
+        backend.set_fail_apply(true);
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        assert!(sm.applied.is_some());
+        assert!(
+            sm.pending_global_cleanup,
+            "an apply failure never clears the pending cleanup"
+        );
+
+        // VPN Down: the applied-path revert succeeds (global) → clears the flag.
+        backend.set_fail_apply(false);
+        sm.on_event(VpnEvent::Down {
+            interface_name: "utun7".to_string(),
+        })
+        .await;
+        assert!(sm.applied.is_none());
+        assert!(
+            !sm.pending_global_cleanup,
+            "a successful global revert clears the pending cleanup"
+        );
+        assert_eq!(
+            sm.routing_state(),
+            RoutingState::VpnDown,
+            "the clean system reads VpnDown, not a stuck ApplyFailed"
+        );
+    }
+
     #[tokio::test]
     async fn down_reverts() {
         let backend = Arc::new(MockBackend::default());
@@ -1877,6 +2232,7 @@ mod tests {
         sm.on_event(VpnEvent::Up(VpnInfo {
             interface_name: "wg0".to_string(),
             dns_servers: vec!["10.9.9.9".to_string()],
+            demote_target: None,
         }))
         .await;
 
@@ -1974,6 +2330,7 @@ mod tests {
         sm.on_event(VpnEvent::Up(VpnInfo {
             interface_name: "wg0".to_string(),
             dns_servers: Vec::new(),
+            demote_target: None,
         }))
         .await;
 
@@ -2005,6 +2362,7 @@ mod tests {
         sm.on_event(VpnEvent::Up(VpnInfo {
             interface_name: "wg0".to_string(),
             dns_servers: Vec::new(),
+            demote_target: None,
         }))
         .await;
 
@@ -2045,6 +2403,7 @@ mod tests {
             enabled: true,
             vpn_backend: config::VpnBackend::default(),
             openvpn: config::OpenVpnConfig::default(),
+            fallback_dns: None,
         };
         sm.config_store.save(&new_cfg).unwrap();
         let resp = sm.on_request(Request::ReloadConfig).await;
@@ -2169,6 +2528,59 @@ mod tests {
         assert!(sm.applied.is_some());
     }
 
+    #[tokio::test]
+    async fn shutdown_runs_a_pending_global_cleanup_even_with_nothing_applied() {
+        // P2: a macOS startup cleanup failed (pending) and nothing is applied. If
+        // the daemon is stopped before any reconcile retries it, shutdown must
+        // still run the global cleanup rather than reporting clean while a stale
+        // demote snapshot / default DNS remains.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        backend.set_fail_revert(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "shutdown-pending-cleanup",
+        );
+        sm.cleanup_orphaned_state_on_startup().await; // fails → pending set
+        assert!(sm.pending_global_cleanup);
+        backend.reverts.lock().unwrap().clear();
+
+        backend.set_fail_revert(false); // the retry at shutdown succeeds
+        let clean = sm.shutdown().await;
+        assert!(clean, "shutdown is clean once the pending cleanup succeeds");
+        assert!(!sm.pending_global_cleanup, "the pending cleanup is cleared");
+        assert_eq!(
+            backend.reverts.lock().unwrap().as_slice(),
+            &["wg0"],
+            "shutdown ran the global cleanup"
+        );
+    }
+
+    #[tokio::test]
+    async fn shutdown_reports_unclean_when_a_pending_cleanup_still_fails() {
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        backend.set_fail_revert(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["a.com"]),
+            "shutdown-pending-fail",
+        );
+        sm.cleanup_orphaned_state_on_startup().await;
+        assert!(sm.pending_global_cleanup);
+
+        let clean = sm.shutdown().await; // fail_revert still true
+        assert!(
+            !clean,
+            "shutdown reports unclean while a demote snapshot may remain"
+        );
+        assert!(
+            sm.pending_global_cleanup,
+            "the pending flag stays set for a future retry"
+        );
+    }
+
     #[tokio::test]
     async fn repeated_disable_retries_a_failed_revert() {
         let backend = Arc::new(MockBackend {
@@ -2496,6 +2908,16 @@ mod tests {
         let mut ovpn = base.clone();
         ovpn.openvpn.management = "127.0.0.1:7505".to_string();
         assert!(watch_settings_changed(&base, &ovpn));
+
+        // A `fallback_dns` change also re-arms: the re-arm's revert + re-sample is
+        // what restores the real prior DHCP resolver and re-demotes to it after the
+        // override is changed/removed (the detector reads the demoted value back, so
+        // a plain reconcile would otherwise stay pinned to the old fallback).
+        let mut fallback = base.clone();
+        fallback.fallback_dns = Some(vec!["203.0.113.9".to_string()]);
+        assert!(watch_settings_changed(&base, &fallback));
+        // ...and removing it again is a change too.
+        assert!(watch_settings_changed(&fallback, &base));
     }
 
     #[tokio::test]
@@ -2533,6 +2955,7 @@ mod tests {
         sm.on_event(VpnEvent::Up(VpnInfo {
             interface_name: "wg0".to_string(),
             dns_servers: Vec::new(),
+            demote_target: None,
         }))
         .await;
         assert_eq!(sm.routing_state(), RoutingState::NoDnsFromVpn);
@@ -3000,6 +3423,140 @@ mod tests {
         );
     }
 
+    // --- macOS DNS-privacy path: gate decoupled from vpn_name, demote folding -
+
+    #[tokio::test]
+    async fn global_revert_backend_applies_regardless_of_interface_name() {
+        // On macOS the VPN's interface is not a stable, DNS-scoped link, so the
+        // configured `vpn_name` must NOT gate apply. A global-revert backend with
+        // an Up whose advisory interface_name differs from `vpn_name` must still
+        // apply (driven by the DNS-model signal the detector already decided).
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        // config.vpn_name is "wg0" (the helper default), but the macOS Up carries
+        // an unrelated advisory interface name.
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["corp.example.com"]),
+            "macos-gate",
+        );
+
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        assert!(
+            sm.applied.is_some(),
+            "macOS apply must not be gated on interface_name == vpn_name"
+        );
+        assert_eq!(
+            backend.applies.lock().unwrap().len(),
+            1,
+            "the corp domains are applied despite the interface-name mismatch"
+        );
+    }
+
+    #[tokio::test]
+    async fn linux_backend_still_gates_on_interface_name() {
+        // The Linux contract is unchanged: a per-interface backend (default,
+        // reverts_globally=false) still requires the Up's interface to match
+        // `vpn_name`, so a mismatched interface does NOT apply.
+        let backend = Arc::new(MockBackend::default()); // reverts_globally = false
+        let mut sm = machine(backend.clone(), config(true, &["a.com"]), "linux-gate");
+        // config.vpn_name == "wg0"; an Up on a different interface must not apply.
+        sm.on_event(vpn_up("wg1")).await;
+        assert!(
+            sm.applied.is_none(),
+            "Linux must still gate apply on interface_name == vpn_name"
+        );
+    }
+
+    #[tokio::test]
+    async fn macos_apply_uses_the_detector_demote_target_without_a_config_override() {
+        // With no `fallback_dns` override, the demote-target handed to the backend
+        // is the detector's (the physical DHCP resolver).
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["corp.example.com"]),
+            "macos-demote",
+        );
+
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        assert_eq!(
+            backend.applied_demote_targets.lock().unwrap().as_slice(),
+            &[Some(vec!["198.51.100.1".to_string()])],
+            "without an override, the detector's demote-target is used"
+        );
+    }
+
+    #[tokio::test]
+    async fn macos_apply_folds_in_the_fallback_dns_config_override() {
+        // A configured `fallback_dns` override replaces the detector's
+        // demote-target in the VpnInfo handed to the backend.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        let mut cfg = config(true, &["corp.example.com"]);
+        cfg.fallback_dns = Some(vec!["203.0.113.9".to_string()]);
+        let mut sm = machine(backend.clone(), cfg, "macos-override");
+
+        // The detector still reports 198.51.100.1, but the config override wins.
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        assert_eq!(
+            backend.applied_demote_targets.lock().unwrap().as_slice(),
+            &[Some(vec!["203.0.113.9".to_string()])],
+            "the fallback_dns override must replace the detector's demote-target"
+        );
+    }
+
+    #[tokio::test]
+    async fn macos_apply_ignores_a_non_ip_fallback_dns_override() {
+        // A `fallback_dns` override with a non-IP entry must NOT reach the backend:
+        // it would be interpolated verbatim into the root `scutil` demote script. It
+        // is rejected as a whole and the detector's demote-target is used instead.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        let mut cfg = config(true, &["corp.example.com"]);
+        cfg.fallback_dns = Some(vec!["not-an-ip".to_string()]);
+        let mut sm = machine(backend.clone(), cfg, "macos-bad-override");
+
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        assert_eq!(
+            backend.applied_demote_targets.lock().unwrap().as_slice(),
+            &[Some(vec!["198.51.100.1".to_string()])],
+            "a non-IP fallback_dns override is ignored; the detector's demote-target is used"
+        );
+    }
+
+    #[tokio::test]
+    async fn macos_reapplies_on_a_redetect_after_the_default_was_reasserted() {
+        // Reconcile-on-event: if the VPN re-asserts its default after a network
+        // change, the detector re-emits Up (the watch fires on the DNS change).
+        // A fresh Up must re-drive apply (the backend re-demotes), bounded — one
+        // re-apply per event, no busy loop (this is purely event-driven; there is
+        // no timer here). We model two Up events and assert two applies.
+        let backend = Arc::new(MockBackend::default());
+        backend.set_reverts_globally(true);
+        let mut sm = machine(
+            backend.clone(),
+            config(true, &["corp.example.com"]),
+            "macos-reapply",
+        );
+
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.1"])).await;
+        // A second Up with a CHANGED demote-target (e.g. Wi-Fi switched, new DHCP
+        // resolver) — the dedup upstream only forwards genuine changes, so the
+        // state machine sees a distinct event and re-applies with the new target.
+        sm.on_event(vpn_up_macos("utun7", &["198.51.100.9"])).await;
+        let targets = backend.applied_demote_targets.lock().unwrap();
+        assert_eq!(
+            targets.as_slice(),
+            &[
+                Some(vec!["198.51.100.1".to_string()]),
+                Some(vec!["198.51.100.9".to_string()]),
+            ],
+            "a re-detected change re-applies the demote with the new target"
+        );
+    }
+
     #[tokio::test]
     async fn watch_stream_ending_on_its_own_marks_detector_error() {
         // Regression for the review: `watch()` returning Ok does not mean the
@@ -3637,6 +4194,7 @@ mod tests {
             enabled: true,
             vpn_backend: config::VpnBackend::default(),
             openvpn: config::OpenVpnConfig::default(),
+            fallback_dns: None,
         };
         let sm = machine(backend.clone(), cfg, "verify-no-iface");
 
diff --git a/splitway-daemon/src/detector/linux/detector.rs b/splitway-daemon/src/detector/linux/detector.rs
index ed6b1b9..768be8c 100644
--- a/splitway-daemon/src/detector/linux/detector.rs
+++ b/splitway-daemon/src/detector/linux/detector.rs
@@ -232,6 +232,9 @@ impl VpnDetector for LinuxDetector {
         Ok(VpnInfo {
             interface_name: interface.to_string(),
             dns_servers,
+            // Linux scopes DNS per link (systemd-resolved); the system default
+            // is never hijacked, so no off-tunnel demote is needed.
+            demote_target: None,
         })
     }
 
diff --git a/splitway-daemon/src/detector/linux/openvpn/detector.rs b/splitway-daemon/src/detector/linux/openvpn/detector.rs
index eeb6ab0..b3d0028 100644
--- a/splitway-daemon/src/detector/linux/openvpn/detector.rs
+++ b/splitway-daemon/src/detector/linux/openvpn/detector.rs
@@ -20,6 +20,8 @@ impl VpnDetector for OpenVpnDetector {
         Ok(VpnInfo {
             interface_name: interface.to_string(),
             dns_servers,
+            // Linux scopes DNS per link; the default is not hijacked.
+            demote_target: None,
         })
     }
 
diff --git a/splitway-daemon/src/detector/linux/openvpn/mgmt.rs b/splitway-daemon/src/detector/linux/openvpn/mgmt.rs
index 0a7fdcc..f33f452 100644
--- a/splitway-daemon/src/detector/linux/openvpn/mgmt.rs
+++ b/splitway-daemon/src/detector/linux/openvpn/mgmt.rs
@@ -401,6 +401,8 @@ async fn handle_line(
             VpnEvent::Up(VpnInfo {
                 interface_name: interface.to_string(),
                 dns_servers: last_dns.clone(),
+                // Linux scopes DNS per link; the default is not hijacked.
+                demote_target: None,
             })
         }
         Transition::Down => {
diff --git a/splitway-daemon/src/detector/macos/detector.rs b/splitway-daemon/src/detector/macos/detector.rs
index 31f07e3..1c0560b 100644
--- a/splitway-daemon/src/detector/macos/detector.rs
+++ b/splitway-daemon/src/detector/macos/detector.rs
@@ -1,22 +1,39 @@
-//! Wires the macOS parser/watch to the [`VpnDetector`] trait.
+//! Wires the macOS structural DNS-model detection to the [`VpnDetector`] trait.
+//!
+//! The I/O here is deliberately thin: it shells `scutil` to dump the
+//! SystemConfiguration dynamic-store keys, hands the raw text to the pure
+//! [`parser`](super::parser) module, and runs the pure structural decision. All
+//! the logic (what counts as "VPN up", which resolver is the demote-target) is
+//! in the parser and unit-tested without a live system.
 
 use std::process::Command;
 
 use splitway_shared::platform::{PlatformError, VpnDetector, VpnEvent, VpnInfo};
 
-use super::parser::parse_scutil_dns;
+use super::parser::{
+    decide, parse_array_field, parse_scalar_field, Detected, DnsModel, ServiceDns,
+};
 use super::MacosDetector;
 
 impl VpnDetector for MacosDetector {
+    /// One-shot detection. The `interface` argument is **advisory on macOS**:
+    /// detection is driven by the system DNS model (which resolver is the
+    /// default vs. the physical interface's own), not by an interface name —
+    /// the active VPN tunnel is not reliably a named, DNS-scoped link here.
     fn detect(&self, interface: &str) -> Result<VpnInfo, PlatformError> {
-        let dns_servers = current_dns(interface)?;
-        if dns_servers.is_empty() {
-            return Err(PlatformError::VpnNotFound(interface.to_string()));
+        match current_vpn_state()? {
+            Detected::Up {
+                corp_dns,
+                demote_target,
+            } => Ok(VpnInfo {
+                // Advisory only — nothing keys on it on macOS. Report the
+                // configured name so status output stays recognisable.
+                interface_name: interface.to_string(),
+                dns_servers: corp_dns,
+                demote_target: Some(demote_target),
+            }),
+            Detected::Down => Err(PlatformError::VpnNotFound(interface.to_string())),
         }
-        Ok(VpnInfo {
-            interface_name: interface.to_string(),
-            dns_servers,
-        })
     }
 
     fn watch(
@@ -27,18 +44,226 @@ impl VpnDetector for MacosDetector {
     }
 }
 
-/// Read the DNS servers macOS currently associates with `interface` via
-/// `scutil --dns`. Returns an empty vec (not an error) when the interface has
-/// no resolver, so the watcher can treat that as "down". Shared by `detect`
-/// and the SCDynamicStore callback.
-pub(super) fn current_dns(interface: &str) -> Result<Vec<String>, PlatformError> {
-    let output = Command::new("scutil").arg("--dns").output()?;
+/// Read the system DNS model from the dynamic store and run the structural
+/// up/down decision. Shared by [`detect`](MacosDetector::detect) and the
+/// SCDynamicStore watch callback.
+///
+/// `Detected::Down` (not an error) means no VPN-imposed default — the watcher
+/// treats it as "down". A genuine `scutil` failure is an `Err` the caller may
+/// retry; "no override" is a normal, successful "nothing here".
+pub(super) fn current_vpn_state() -> Result<Detected, PlatformError> {
+    let model = read_dns_model()?;
+    Ok(decide(&model))
+}
+
+/// Assemble the [`DnsModel`] from the dynamic store via `scutil`: the primary
+/// interface plus every network service's DNS entry. Detection reads the
+/// **per-service** entries (not the mutable global default), so Splitway's own
+/// demote of the physical service does not make detection flip to "down".
+fn read_dns_model() -> Result<DnsModel, PlatformError> {
+    let global_ipv4_dump = scutil_show("State:/Network/Global/IPv4")?;
+    let primary_interface = parse_scalar_field(&global_ipv4_dump, "PrimaryInterface");
+    let primary_service = parse_scalar_field(&global_ipv4_dump, "PrimaryService");
+
+    // Enumerate every per-service DNS key and read its id + InterfaceName + servers.
+    // `scutil`'s `list` does NOT print bare keys: each match is a prefixed row
+    // (`subKey [<n>] = State:/.../DNS`), so the key must be parsed out of the row
+    // before it is shown — otherwise every `show` is fed the whole row, returns
+    // `No such key`, and the model stays empty (detection always "down").
+    let listing = scutil_list("State:/Network/Service/.*/DNS")?;
+    let mut services = Vec::new();
+    for row in listing.lines() {
+        let key = parse_list_key(row);
+        // Skip blank/header rows and anything outside the listed pattern.
+        if !key.starts_with("State:/Network/Service/") {
+            continue;
+        }
+        // Propagate a real `scutil` failure rather than skipping the service: a
+        // missing/vanished key is reported as `No such key` on stdout with exit 0
+        // (→ `Ok`, then empty servers below), so an `Err` here is a genuine command
+        // failure (spawn error or non-zero exit). Skipping it would silently drop a
+        // live service from the model — e.g. the VPN service, read after a
+        // successful `list` — and `decide` could then conclude "down" and revert the
+        // rules. Failing the read instead makes the watcher keep the last known
+        // state until the next change.
+        let dump = scutil_show(key)?;
+        let servers = parse_array_field(&dump, "ServerAddresses");
+        if servers.is_empty() {
+            continue; // a service with no DNS (incl. the `No such key` case) contributes nothing
+        }
+        let service_id = service_id_from_key(key);
+        // The interface binding is read from the service's IPv4/IPv6 entity, NOT
+        // the DNS dict — the DNS schema is the DNS fields (ServerAddresses, …) and
+        // does not reliably carry InterfaceName. Reading it only from the DNS dict
+        // would leave a secondary Wi-Fi/Ethernet service's interface unknown, and
+        // `decide` would then misread that `None` as an unscoped/default hijacker
+        // (a false "VPN up"). Fall back to the DNS dict only if neither entity
+        // names an interface.
+        let interface_name = read_service_interface(&service_id)
+            .or_else(|| parse_scalar_field(&dump, "InterfaceName"));
+        services.push(ServiceDns {
+            service_id,
+            interface_name,
+            servers,
+        });
+    }
+
+    Ok(DnsModel {
+        primary_interface,
+        primary_service,
+        services,
+    })
+}
+
+/// Read the BSD interface a service is bound to, from its IPv4 (then IPv6)
+/// dynamic-store entity — the reliable source for the binding. The per-service
+/// DNS entity does not reliably carry `InterfaceName` (its schema is the DNS
+/// fields), so reading the interface only from the DNS dict can leave a secondary
+/// network's interface unknown, which `decide` would misclassify as an unscoped
+/// (default-hijacker) resolver. Returns `None` only when neither entity names one.
+fn read_service_interface(service_id: &str) -> Option<String> {
+    for entity in ["IPv4", "IPv6"] {
+        let key = format!("State:/Network/Service/{service_id}/{entity}");
+        if let Ok(dump) = scutil_show(&key) {
+            if let Some(iface) = parse_scalar_field(&dump, "InterfaceName") {
+                return Some(iface);
+            }
+        }
+    }
+    None
+}
+
+/// Extract the dynamic-store key from one `scutil list` output row. `scutil`
+/// prints each match as `  subKey [<n>] = State:/Network/Service/<id>/DNS`, not
+/// as a bare key, so the `subKey [n] = ` prefix must be stripped before the key
+/// can be passed to `show` / [`service_id_from_key`]. A row without the ` = `
+/// marker is returned trimmed (defensive); the caller filters anything that is
+/// not a service DNS key.
+fn parse_list_key(row: &str) -> &str {
+    let row = row.trim();
+    match row.rsplit_once(" = ") {
+        Some((_, key)) => key.trim(),
+        None => row,
+    }
+}
+
+/// Extract the `<id>` from a `State:/Network/Service/<id>/DNS` key, so it can be
+/// matched against `PrimaryService`. Returns the whole key if it does not fit
+/// the expected shape (so an unexpected key never silently collides with a real
+/// service id).
+fn service_id_from_key(key: &str) -> String {
+    key.strip_prefix("State:/Network/Service/")
+        .and_then(|rest| rest.strip_suffix("/DNS"))
+        .unwrap_or(key)
+        .to_string()
+}
+
+/// Run `scutil` with a `show <key>` script over stdin and return the dump. A
+/// missing key makes `scutil` print `No such key` (not a process failure); the
+/// parser treats that as empty, so it is returned as-is rather than an error.
+fn scutil_show(key: &str) -> Result<String, PlatformError> {
+    scutil_script(&format!("show {key}\n"))
+}
+
+/// Run `scutil` with a `list <pattern>` script and return the matching keys,
+/// one per line.
+fn scutil_list(pattern: &str) -> Result<String, PlatformError> {
+    scutil_script(&format!("list {pattern}\n"))
+}
+
+/// Drive `scutil` in script mode by piping `script` (terminated by an implicit
+/// quit on EOF) to its stdin. Centralises the spawn + error mapping so the
+/// individual readers stay one-liners and the whole I/O surface is one function.
+///
+/// Shared with the demote backend (`crate::detector::macos_scutil_script`) so the
+/// single `scutil` driver — spawn, stdin pipe, exit-status mapping — has exactly
+/// one implementation; a future change to it (a timeout, non-UTF-8 handling)
+/// lands in one place rather than drifting between two near-identical copies.
+/// Returns the raw stdout; a non-zero exit is mapped to `Err`, but note `scutil`
+/// in script mode also reports some command failures on stdout with exit 0 (a
+/// missing key is `No such key`), so a *set* caller must additionally inspect the
+/// returned stdout (see the demote's `RealScutil::run_script`).
+pub(crate) fn scutil_script(script: &str) -> Result<String, PlatformError> {
+    use std::io::Write;
+    use std::process::Stdio;
+
+    let mut child = Command::new("scutil")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|e| PlatformError::CommandFailed(format!("failed to spawn scutil: {e}")))?;
+
+    // Write the script, then drop stdin so scutil sees EOF and exits.
+    {
+        let stdin = child.stdin.take().ok_or_else(|| {
+            PlatformError::CommandFailed("scutil stdin was not captured".to_string())
+        })?;
+        let mut stdin = stdin;
+        stdin
+            .write_all(script.as_bytes())
+            .map_err(|e| PlatformError::CommandFailed(format!("writing scutil script: {e}")))?;
+    }
+
+    let output = child
+        .wait_with_output()
+        .map_err(|e| PlatformError::CommandFailed(format!("waiting for scutil: {e}")))?;
     if !output.status.success() {
         return Err(PlatformError::CommandFailed(format!(
-            "scutil --dns failed: {}",
+            "scutil exited with {}: {}",
+            output.status,
             String::from_utf8_lossy(&output.stderr).trim()
         )));
     }
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    Ok(parse_scutil_dns(&stdout, interface))
+    Ok(String::from_utf8_lossy(&output.stdout).into_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{parse_list_key, service_id_from_key};
+
+    #[test]
+    fn parse_list_key_strips_the_scutil_subkey_prefix() {
+        // The real `scutil list` row shape — the key must be parsed out, not shown
+        // verbatim (the bug: the whole row went to `show` → `No such key`).
+        assert_eq!(
+            parse_list_key("  subKey [0] = State:/Network/Service/ABC-123/DNS"),
+            "State:/Network/Service/ABC-123/DNS"
+        );
+        assert_eq!(
+            parse_list_key("subKey [12] = State:/Network/Service/XYZ/DNS"),
+            "State:/Network/Service/XYZ/DNS"
+        );
+    }
+
+    #[test]
+    fn parse_list_key_passes_a_bare_key_through() {
+        // Defensive: a row already in bare-key form is returned trimmed.
+        assert_eq!(
+            parse_list_key("  State:/Network/Service/ABC/DNS  "),
+            "State:/Network/Service/ABC/DNS"
+        );
+    }
+
+    #[test]
+    fn service_id_from_key_extracts_the_id() {
+        assert_eq!(
+            service_id_from_key("State:/Network/Service/ABC-123/DNS"),
+            "ABC-123"
+        );
+    }
+
+    #[test]
+    fn service_id_from_key_returns_whole_key_when_shape_is_unexpected() {
+        // An unexpected key shape is returned verbatim, so it never collides with
+        // a real service id.
+        assert_eq!(
+            service_id_from_key("Setup:/Network/Foo"),
+            "Setup:/Network/Foo"
+        );
+        assert_eq!(
+            service_id_from_key("State:/Network/Service/ABC"),
+            "State:/Network/Service/ABC"
+        );
+    }
 }
diff --git a/splitway-daemon/src/detector/macos/mod.rs b/splitway-daemon/src/detector/macos/mod.rs
index cb960c1..6f0b467 100644
--- a/splitway-daemon/src/detector/macos/mod.rs
+++ b/splitway-daemon/src/detector/macos/mod.rs
@@ -1,13 +1,25 @@
-//! macOS VPN detector: reads per-interface DNS from `scutil --dns` and watches
-//! for changes via SCDynamicStore.
+//! macOS VPN detector: reads the SystemConfiguration DNS model from the dynamic
+//! store (via `scutil`) and decides VPN up/down **structurally** — is the system
+//! default resolver overridden by a non-physical (VPN) service? — rather than by
+//! an interface name. See [`parser`] for the rationale (a global-DNS-hijack VPN
+//! client scopes no resolver to any `utun`, so an interface-keyed read is blind).
 //!
-//! Mirrors the Linux split: [`parser`] (pure `scutil` parsing) and [`state`]
-//! (pure up/down mapping + dedup) are unit-tested; [`watch`] is the thin Core
-//! Foundation plumbing, and [`detector`] wires them to the `VpnDetector` trait.
+//! Mirrors the Linux split: [`parser`] (pure dynamic-store parsing + the up/down
+//! decision) and [`state`] (pure dedup + the initial-sample retry policy) are
+//! unit-tested; [`watch`] is the thin Core Foundation plumbing, and [`detector`]
+//! wires them to the `VpnDetector` trait and owns the `scutil` I/O.
 
 mod detector;
 mod parser;
 mod state;
 mod watch;
 
+/// Re-export the pieces the macOS DNS backend's demote reuses so the two macOS
+/// modules share one implementation rather than duplicating it: the dynamic-store
+/// dump parsers (the demote reads the same `scutil` dump shape), the `scutil`
+/// script driver, and the order-insensitive resolver-set compare. See
+/// [`crate::detector`].
+pub(crate) use detector::scutil_script;
+pub(crate) use parser::{parse_array_field, parse_scalar_field, same_set};
+
 pub struct MacosDetector;
diff --git a/splitway-daemon/src/detector/macos/parser.rs b/splitway-daemon/src/detector/macos/parser.rs
index f64e701..59e5b49 100644
--- a/splitway-daemon/src/detector/macos/parser.rs
+++ b/splitway-daemon/src/detector/macos/parser.rs
@@ -1,179 +1,762 @@
-//! Pure parsing of `scutil --dns` output — no I/O, unit tested.
+//! Pure parsing of the macOS SystemConfiguration DNS model — no I/O, unit
+//! tested. This is the structural, vendor-neutral core of macOS VPN detection.
+//!
+//! # Why not `scutil --dns`, and why per-service (not the global default)
+//!
+//! The original detector filtered `scutil --dns` by a chosen `utun*` interface.
+//! That fails against a VPN client that hijacks the system **default** resolver
+//! instead of scoping its DNS to the tunnel: there is then *no* resolver scoped
+//! to any `utun` (the active tunnel `utun` index even varies between sessions),
+//! so an interface-keyed read finds nothing. We instead read the SystemConfig
+//! dynamic store directly and decide structurally over the **per-service** DNS:
+//!
+//! - `State:/Network/Global/IPv4` `PrimaryInterface` / `PrimaryService` — the
+//!   physical primary interface (e.g. `en0`) and its service id.
+//! - each `State:/Network/Service/<id>/DNS` — that service's `ServerAddresses`
+//!   and `InterfaceName`.
+//!
+//! The **physical service** is the one whose id is the primary service (falling
+//! back to the primary interface name); its resolver is the demote-target. A
+//! **VPN service** is any *other* service that (a) carries DNS differing from the
+//! physical resolver AND (b) is plausibly the **default-resolver hijacker** —
+//! i.e. it rides the primary interface's own default route, runs on a tunnel
+//! pseudo-interface (`utun`/`ppp`/`ipsec`/…), or reports no interface (an
+//! unscoped/default resolver). A service bound to a *distinct hardware* interface
+//! (a second Ethernet/Wi-Fi/cellular link while another is primary) is a parallel
+//! physical network, not a hijacker: its differing DHCP resolver must **not** read
+//! as "VPN up". When such a hijacker service exists → **VPN is up** and its
+//! resolver is the corp DNS. The decision keys on this structural *difference* and
+//! on interface *kind* (the stable BSD driver prefix), never on any vendor/product
+//! string, so it generalises across VPN clients.
+//!
+//! Detection deliberately does **not** read `State:/Network/Global/DNS`: Splitway's
+//! own demote overwrites the physical service's DNS, which can change the global
+//! default — so a Global-keyed detector would flip to "down" the instant our
+//! demote took effect, then revert → the VPN re-asserts → re-demote → oscillation.
+//! Reading the VPN's corp DNS from its *own* service entry (which our demote does
+//! not touch) keeps detection stable while the demote is in effect.
 
-/// Collect the DNS servers `scutil --dns` reports for `interface` (e.g.
-/// `utun3`), in order of first appearance and de-duplicated. Returns an empty
-/// vec when the interface has no resolver entry (the VPN is down).
+/// One network service's DNS entry, as read from `State:/Network/Service/<id>/DNS`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct ServiceDns {
+    /// The service id (the `<id>` in the `State:/Network/Service/<id>/DNS` key).
+    /// The authoritative anchor for the *physical* service: it equals the
+    /// `PrimaryService` from `State:/Network/Global/IPv4`. Preferred over the
+    /// interface name, which a VPN service can also report.
+    pub service_id: String,
+    /// The `InterfaceName` the service is bound to (e.g. `en0`), if present.
+    /// The fallback anchor for the physical service when the primary service id
+    /// is unknown; a VPN service is otherwise identified structurally, not by
+    /// name.
+    pub interface_name: Option<String>,
+    /// The service's `ServerAddresses`.
+    pub servers: Vec<String>,
+}
+
+/// The structural DNS picture read from the dynamic store, before the up/down
+/// decision. All fields are plain parsed data — the decision in [`decide`] is a
+/// separate pure step so both halves are independently testable.
 ///
-/// `scutil --dns` groups settings into `resolver #N` blocks; a block's owning
-/// interface is named in its `if_index : N (iface)` line, and its servers in
-/// `nameserver[i] : addr` lines. The interface's resolver typically appears in
-/// both the main and the "scoped queries" sections, so duplicates are expected
-/// and dropped.
-pub(super) fn parse_scutil_dns(output: &str, interface: &str) -> Vec<String> {
-    let mut servers: Vec<String> = Vec::new();
-    let mut block: Vec<String> = Vec::new();
-    let mut block_iface: Option<String> = None;
-
-    for line in output.lines() {
-        let line = line.trim();
-        if line.starts_with("resolver #") {
-            commit(&mut servers, &mut block, &block_iface, interface);
-            block_iface = None;
-        } else if let Some(rest) = line.strip_prefix("nameserver[") {
-            // `nameserver[0] : 10.0.0.1` — require the `[` so only real
-            // `nameserver[N]` keys match, never some other `nameserver*` key.
-            if let Some((_, value)) = rest.split_once(':') {
-                let ip = value.trim();
-                if !ip.is_empty() {
-                    block.push(ip.to_string());
+/// Detection is driven by the **per-service** entries, NOT by
+/// `State:/Network/Global/DNS`. That is deliberate: Splitway's own *demote*
+/// overwrites the primary (physical) service's DNS, which can change the global
+/// default — so a detector keyed on Global would flip to "down" the moment our
+/// demote took effect (Global == physical), then revert → the VPN re-asserts →
+/// re-demote → oscillation. Reading the VPN's corp DNS from its *own* service
+/// entry (which our demote does not touch) keeps detection stable while the
+/// demote is in effect.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(super) struct DnsModel {
+    /// `State:/Network/Global/IPv4` `PrimaryInterface` (e.g. `en0`). `None` if
+    /// the key or field is absent (no primary network — effectively offline).
+    pub primary_interface: Option<String>,
+    /// `State:/Network/Global/IPv4` `PrimaryService` (the primary service id).
+    /// The authoritative anchor for the physical service in [`decide`]; a VPN
+    /// service can also report the primary interface name, so the service id is
+    /// preferred and the interface name is only a fallback.
+    pub primary_service: Option<String>,
+    /// Every network service's DNS entry (from the per-service DNS keys). The
+    /// physical service is the one whose `service_id` is the primary service
+    /// (or, failing that, whose `interface_name` is the primary interface); a
+    /// VPN service is one whose DNS differs from the physical service's.
+    pub services: Vec<ServiceDns>,
+}
+
+/// The detector's verdict over a [`DnsModel`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Detected {
+    /// A non-physical (VPN) service is in play → VPN up. `corp_dns` is that
+    /// service's resolver (queries for the corp domains go here, on-tunnel);
+    /// `demote_target` is where non-corp DNS must be sent so it resolves
+    /// off-tunnel (the physical interface's own DHCP resolver).
+    Up {
+        corp_dns: Vec<String>,
+        demote_target: Vec<String>,
+    },
+    /// No non-physical service (or no primary network) → no VPN. Nothing to do.
+    Down,
+}
+
+/// Parse one `scutil` dictionary dump (the text emitted by `show <key>` /
+/// `get <key>` + `d.show`) and return the values of a named array key.
+///
+/// The dump form (placeholder values):
+/// ```text
+/// <dictionary> {
+///   ServerAddresses : <array> {
+///     0 : 192.0.2.53
+///     1 : 192.0.2.54
+///   }
+///   __CONFIGURATION_ID__ : Default: ...
+///   PrimaryInterface : en0
+/// }
+/// ```
+/// Returns the array elements in order (here for `ServerAddresses`:
+/// `["192.0.2.53", "192.0.2.54"]`). An absent key yields an empty vec.
+pub(crate) fn parse_array_field(dump: &str, field: &str) -> Vec<String> {
+    let mut values = Vec::new();
+    let mut in_array = false;
+    // The `<array>` opener line for the field we want, e.g.
+    // `ServerAddresses : <array> {`.
+    let opener = format!("{field} :");
+    for raw in dump.lines() {
+        let line = raw.trim();
+        if !in_array {
+            // Enter the array only for an exact `<field> : <array> {` opener, so
+            // a same-prefixed field (e.g. `ServerAddressesV6`) is not matched.
+            if line.starts_with(&opener) && line.contains("<array>") && line.ends_with('{') {
+                in_array = true;
+            }
+            continue;
+        }
+        if line == "}" {
+            break; // end of the array
+        }
+        // Array element line: `<index> : <value>`. Keep the value verbatim
+        // (IPv6 with `::` and `%zone` stay intact via split_once on the FIRST
+        // colon only).
+        if let Some((idx, value)) = line.split_once(':') {
+            if idx.trim().chars().all(|c| c.is_ascii_digit()) && !idx.trim().is_empty() {
+                let v = value.trim();
+                if !v.is_empty() {
+                    values.push(v.to_string());
                 }
             }
-        } else if let Some(rest) = line.strip_prefix("if_index") {
-            // `if_index : 14 (utun3)` — take the name inside the parentheses.
-            if let Some(name) = rest.split('(').nth(1).and_then(|s| s.split(')').next()) {
-                block_iface = Some(name.trim().to_string());
+        }
+    }
+    values
+}
+
+/// Parse a scalar string field from a `scutil` dictionary dump, e.g.
+/// `PrimaryInterface : en0` → `Some("en0")`. Returns `None` if absent.
+pub(crate) fn parse_scalar_field(dump: &str, field: &str) -> Option<String> {
+    let opener = format!("{field} :");
+    for raw in dump.lines() {
+        let line = raw.trim();
+        if let Some(rest) = line.strip_prefix(&opener) {
+            // A scalar line is `Field : value`; reject the array opener form so
+            // `Foo : <array> {` is never read as the scalar string "<array> {".
+            let v = rest.trim();
+            if v.contains("<array>") || v.contains("<dictionary>") {
+                return None;
+            }
+            if !v.is_empty() {
+                return Some(v.to_string());
             }
         }
     }
-    commit(&mut servers, &mut block, &block_iface, interface);
-    servers
+    None
 }
 
-/// Fold the just-parsed block into `servers` if it belongs to `interface`,
-/// de-duplicating, then clear the block for the next one.
-fn commit(
-    servers: &mut Vec<String>,
-    block: &mut Vec<String>,
-    block_iface: &Option<String>,
-    interface: &str,
-) {
-    if block_iface.as_deref() == Some(interface) {
-        for ns in block.iter() {
-            if !servers.contains(ns) {
-                servers.push(ns.clone());
+/// The structural decision: is a non-physical (VPN) service in play? Pure over a
+/// fully-assembled [`DnsModel`], reading the **per-service** entries (not the
+/// mutable global default — see [`DnsModel`]).
+///
+/// The physical service is the one bound to the primary interface; its DNS is
+/// the demote-target. A **VPN service** is any *other* service that both carries
+/// DNS differing from the physical service's AND looks like the default-resolver
+/// hijacker (see [`is_default_resolver_hijacker`]) — so a benign secondary
+/// physical network is not mistaken for a VPN. VPN is **up** iff such a service
+/// exists, and `corp_dns` is its resolver.
+///
+/// Edge cases, all → [`Detected::Down`] (no false-positive apply):
+/// - no primary interface (offline) — nothing to anchor on;
+/// - no physical service DNS found — cannot determine the demote-target, and a
+///   demote to nothing is worse than not applying, so stay conservative;
+/// - the only services differing from the physical are distinct secondary
+///   physical networks (not the hijacker) — no VPN.
+pub(super) fn decide(model: &DnsModel) -> Detected {
+    // No primary network at all → nothing is in play.
+    // A primary network must exist to anchor on (offline → nothing in play).
+    if model.primary_interface.is_none() && model.primary_service.is_none() {
+        return Detected::Down;
+    }
+
+    // The physical service, anchored authoritatively by the primary SERVICE id
+    // when known (a VPN service can also report the primary interface name, so
+    // the id is preferred), falling back to the primary interface name. Its
+    // resolver is the demote-target (where non-corp DNS goes off-tunnel).
+    let physical = match model.primary_service.as_deref() {
+        Some(id) => model
+            .services
+            .iter()
+            .find(|s| !s.servers.is_empty() && s.service_id == id),
+        // No authoritative PrimaryService id: anchor on the primary interface
+        // name — but only when EXACTLY ONE DNS-bearing service reports it. A VPN
+        // service can also report the primary interface, so if more than one
+        // matches we cannot tell which is physical; picking the first would risk
+        // selecting the VPN's corp resolver as "physical", inverting corp/fallback
+        // (apply corp domains to the off-tunnel DNS and demote the default to the
+        // corp DNS — a leak). Treat that as ambiguous and stay conservative.
+        None => {
+            let mut matches = model.services.iter().filter(|s| {
+                !s.servers.is_empty()
+                    && s.interface_name.as_deref() == model.primary_interface.as_deref()
+            });
+            match (matches.next(), matches.next()) {
+                (Some(only), None) => Some(only),
+                _ => None, // zero matches, or ambiguous (more than one) → Down below
             }
         }
+    };
+    let Some(physical) = physical else {
+        // No unambiguous physical resolver → cannot pick a safe demote-target.
+        return Detected::Down;
+    };
+
+    // A VPN service: a service OTHER than the physical one, carrying DNS that
+    // differs from the physical resolver (a non-physical resolver is in play).
+    // Excluding the physical service by id means the comparison survives our own
+    // demote (which sets the physical service's DNS to the fallback) — the VPN's
+    // own service still differs — and never mistakes the physical service for a
+    // VPN. This signal is independent of the mutable global default.
+    //
+    // The differing service must ALSO be the default-resolver hijacker, not a
+    // distinct secondary physical network (e.g. Wi-Fi associated while Ethernet is
+    // primary, with its own DHCP DNS) — otherwise that benign secondary resolver
+    // would be a false "VPN up". The hijacker filter precedes the difference check
+    // so, with both a real VPN and a secondary network present, the VPN is still
+    // found regardless of service order.
+    let vpn_dns = model
+        .services
+        .iter()
+        .filter(|s| s.service_id != physical.service_id && !s.servers.is_empty())
+        .filter(|s| is_default_resolver_hijacker(s, model.primary_interface.as_deref()))
+        .find(|s| !same_set(&s.servers, &physical.servers))
+        .map(|s| &s.servers);
+
+    match vpn_dns {
+        Some(corp_dns) => Detected::Up {
+            corp_dns: corp_dns.clone(),
+            demote_target: physical.servers.clone(),
+        },
+        None => Detected::Down,
+    }
+}
+
+/// Order-insensitive equality of two resolver lists (treated as sets). Shared
+/// with the demote (`crate::detector::macos_same_set`) so detection dedup and the
+/// demote's "is the service's live DNS still our fallback" check can never drift
+/// apart on what counts as the "same resolver set".
+pub(crate) fn same_set(a: &[String], b: &[String]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut a_sorted: Vec<&String> = a.iter().collect();
+    let mut b_sorted: Vec<&String> = b.iter().collect();
+    a_sorted.sort();
+    b_sorted.sort();
+    a_sorted == b_sorted
+}
+
+/// macOS tunnel / virtual interface name prefixes. A global-default-hijack VPN
+/// rides one of these pseudo-interfaces (or the primary interface itself); a
+/// *secondary physical* network (Wi-Fi while Ethernet is primary, a second
+/// Ethernet, cellular, a VM/Thunderbolt bridge, …) is bound to a distinct
+/// hardware interface that is none of these. Matching by interface *kind* (the
+/// stable BSD driver prefix) — never a vendor/product string — keeps the detector
+/// vendor-neutral while still excluding parallel physical networks.
+const TUNNEL_INTERFACE_PREFIXES: [&str; 5] = ["utun", "ppp", "ipsec", "tun", "tap"];
+
+/// Whether an interface name is a tunnel / virtual pseudo-interface (a VPN
+/// carrier) rather than a hardware link.
+fn is_tunnel_interface(iface: &str) -> bool {
+    TUNNEL_INTERFACE_PREFIXES
+        .iter()
+        .any(|prefix| iface.starts_with(prefix))
+}
+
+/// Whether a (non-physical) service is plausibly the **default-resolver
+/// hijacker** rather than a benign secondary physical network.
+///
+/// A VPN that hijacks the system default resolver either rides the primary
+/// interface's own default route (its service reports the *primary* interface),
+/// runs on a tunnel pseudo-interface (`utun`/`ppp`/`ipsec`/…), or registers an
+/// unscoped/default resolver (its service reports *no* interface). A service
+/// bound to a *distinct hardware* interface is a parallel physical network — a
+/// second Ethernet/Wi-Fi/cellular link — and its differing DHCP resolver must NOT
+/// read as "VPN up". This signal is stable under Splitway's own demote (it does
+/// not depend on the mutable global default).
+fn is_default_resolver_hijacker(service: &ServiceDns, primary_interface: Option<&str>) -> bool {
+    match service.interface_name.as_deref() {
+        // No interface → an unscoped / default (global-path) resolver.
+        None => true,
+        // Rides the primary default route, or is a VPN tunnel pseudo-interface.
+        // Anything else is a distinct secondary physical link → not a hijacker.
+        Some(iface) => Some(iface) == primary_interface || is_tunnel_interface(iface),
     }
-    block.clear();
 }
 
 #[cfg(test)]
 mod tests {
-    use super::parse_scutil_dns;
-
-    const SCUTIL: &str = "\
-DNS configuration
-
-resolver #1
-  search domain[0] : lan
-  nameserver[0] : 192.168.1.1
-  if_index : 4 (en0)
-  flags    : Request A records, Request AAAA records
-  reach    : 0x00000002 (Reachable)
-
-resolver #2
-  domain   : corp.example.com
-  nameserver[0] : 10.0.0.1
-  nameserver[1] : 10.0.0.2
-  if_index : 14 (utun3)
-  flags    : Request A records
-  order    : 102400
-
-DNS configuration (for scoped queries)
-
-resolver #1
-  nameserver[0] : 192.168.1.1
-  if_index : 4 (en0)
-  flags    : Scoped, Request A records
-
-resolver #2
-  nameserver[0] : 10.0.0.1
-  nameserver[1] : 10.0.0.2
-  if_index : 14 (utun3)
-  flags    : Scoped, Request A records
-";
-
-    #[test]
-    fn collects_vpn_interface_servers_deduped() {
-        // utun3 appears in both the main and scoped sections; dedup to one set,
-        // order preserved.
+    use super::*;
+
+    // The breaking shape (synthetic placeholders): the corp DNS is the system
+    // DEFAULT (no domain / no if_index), and the only scoped resolver is the
+    // physical interface — there is NO utun-scoped resolver. Mirrors a real
+    // global-DNS-hijack VPN client. Values are RFC 5737 placeholders.
+    const GLOBAL_DNS: &str = "\
+<dictionary> {
+  ServerAddresses : <array> {
+    0 : 192.0.2.53
+  }
+  __CONFIGURATION_ID__ : Default: vpn-service 0
+  SearchOrder : 50000
+}";
+
+    const GLOBAL_IPV4: &str = "\
+<dictionary> {
+  PrimaryInterface : en0
+  PrimaryService : 0AFE20D4-0000-0000-0000-PLACEHOLDER01
+  Router : 198.51.100.1
+}";
+
+    // The physical interface's own DHCP resolver — the demote-target source.
+    const PHYSICAL_DNS: &str = "\
+<dictionary> {
+  ServerAddresses : <array> {
+    0 : 198.51.100.1
+  }
+}";
+
+    #[test]
+    fn parses_server_addresses_array() {
+        assert_eq!(
+            parse_array_field(GLOBAL_DNS, "ServerAddresses"),
+            vec!["192.0.2.53".to_string()]
+        );
+    }
+
+    #[test]
+    fn parses_multiple_server_addresses_in_order() {
+        let dump = "\
+<dictionary> {
+  ServerAddresses : <array> {
+    0 : 192.0.2.53
+    1 : 192.0.2.54
+  }
+}";
+        assert_eq!(
+            parse_array_field(dump, "ServerAddresses"),
+            vec!["192.0.2.53".to_string(), "192.0.2.54".to_string()]
+        );
+    }
+
+    #[test]
+    fn array_field_absent_yields_empty() {
+        assert!(parse_array_field(GLOBAL_IPV4, "ServerAddresses").is_empty());
+        assert!(parse_array_field("", "ServerAddresses").is_empty());
+    }
+
+    #[test]
+    fn same_prefixed_array_field_is_not_matched() {
+        // A `ServerAddressesV6` array must not be read as `ServerAddresses`.
+        let dump = "\
+<dictionary> {
+  ServerAddressesV6 : <array> {
+    0 : 2001:db8::1
+  }
+}";
+        assert!(parse_array_field(dump, "ServerAddresses").is_empty());
+    }
+
+    #[test]
+    fn preserves_ipv6_values_intact() {
+        let dump = "\
+<dictionary> {
+  ServerAddresses : <array> {
+    0 : 2001:db8::1
+    1 : fe80::1%en0
+  }
+}";
+        assert_eq!(
+            parse_array_field(dump, "ServerAddresses"),
+            vec!["2001:db8::1".to_string(), "fe80::1%en0".to_string()]
+        );
+    }
+
+    #[test]
+    fn parses_primary_interface_scalar() {
+        assert_eq!(
+            parse_scalar_field(GLOBAL_IPV4, "PrimaryInterface"),
+            Some("en0".to_string())
+        );
+    }
+
+    #[test]
+    fn scalar_field_absent_yields_none() {
+        assert_eq!(parse_scalar_field(GLOBAL_DNS, "PrimaryInterface"), None);
+        assert_eq!(parse_scalar_field("", "PrimaryInterface"), None);
+    }
+
+    #[test]
+    fn scalar_field_does_not_misread_an_array_opener() {
+        // `ServerAddresses : <array> {` must not parse as the scalar "<array> {".
+        assert_eq!(parse_scalar_field(GLOBAL_DNS, "ServerAddresses"), None);
+    }
+
+    // --- the structural decision (per-service model) -------------------------
+
+    fn svc(id: &str, iface: Option<&str>, servers: &[&str]) -> ServiceDns {
+        ServiceDns {
+            service_id: id.to_string(),
+            interface_name: iface.map(str::to_string),
+            servers: servers.iter().map(|s| s.to_string()).collect(),
+        }
+    }
+
+    /// Build a model from a primary interface, the primary service id, and the
+    /// service entries.
+    fn model(
+        primary_iface: Option<&str>,
+        primary_svc: Option<&str>,
+        services: Vec<ServiceDns>,
+    ) -> DnsModel {
+        DnsModel {
+            primary_interface: primary_iface.map(str::to_string),
+            primary_service: primary_svc.map(str::to_string),
+            services,
+        }
+    }
+
+    #[test]
+    fn detects_up_when_a_service_differs_from_the_physical() {
+        // The breaking case: a (VPN) service carries corp DNS that differs from
+        // the physical en0 service's DHCP resolver. The physical service is the
+        // primary service (id "phys").
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]), // physical DHCP
+                svc("vpn", Some("en0"), &["192.0.2.53"]),    // VPN's own service (corp)
+            ],
+        );
+        assert_eq!(
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn detection_survives_our_own_demote_of_the_physical_service() {
+        // After we demote, the PHYSICAL service's DNS is overwritten to the
+        // fallback (== its own DHCP resolver here). Detection must still see the
+        // VPN via its separate service entry — NOT flip to Down — so there is no
+        // oscillation. The physical service still reads 198.51.100.1; the VPN
+        // service still reads 192.0.2.53 → still Up, same verdict.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]), // physical (== demoted value)
+                svc("vpn", Some("en0"), &["192.0.2.53"]),    // VPN service unchanged
+            ],
+        );
         assert_eq!(
-            parse_scutil_dns(SCUTIL, "utun3"),
-            vec!["10.0.0.1".to_string(), "10.0.0.2".to_string()]
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
         );
     }
 
     #[test]
-    fn collects_other_interface_independently() {
+    fn physical_is_anchored_by_service_id_even_if_a_vpn_service_shares_the_interface() {
+        // The deeper P1 concern: a VPN service also reports the primary interface
+        // name. Anchoring the physical service on the primary SERVICE id (not the
+        // interface name) means the VPN service — listed FIRST here — is not
+        // mistaken for physical, so corp/fallback are never swapped.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("vpn", Some("en0"), &["192.0.2.53"]), // VPN, also on en0, listed first
+                svc("phys", Some("en0"), &["198.51.100.1"]), // the real physical service
+            ],
+        );
         assert_eq!(
-            parse_scutil_dns(SCUTIL, "en0"),
-            vec!["192.168.1.1".to_string()]
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn falls_back_to_interface_name_when_primary_service_is_unknown() {
+        // If PrimaryService is absent, anchor on the primary interface name — but
+        // only when EXACTLY ONE DNS service reports it. Here the VPN is on a tunnel,
+        // so the physical en0 service is the unambiguous match.
+        let m = model(
+            Some("en0"),
+            None,
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                svc("vpn", Some("utun4"), &["192.0.2.53"]),
+            ],
+        );
+        assert_eq!(
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn ambiguous_primary_interface_fallback_is_conservative_down() {
+        // P2: PrimaryService is absent AND more than one DNS service reports the
+        // primary interface (a VPN service can also report it). We cannot tell which
+        // is physical, so picking the first risks selecting the VPN's corp resolver
+        // as "physical" — inverting corp/fallback (corp domains to the off-tunnel
+        // DNS, default demoted to corp DNS). Stay conservative: Down.
+        let m = model(
+            Some("en0"),
+            None,
+            vec![
+                svc("vpn", Some("en0"), &["192.0.2.53"]), // VPN also on en0, listed first
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+            ],
+        );
+        assert_eq!(decide(&m), Detected::Down);
+    }
+
+    #[test]
+    fn detects_down_when_only_the_physical_service_exists() {
+        // No VPN: the only service with DNS is the physical interface's own.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![svc("phys", Some("en0"), &["198.51.100.1"])],
         );
+        assert_eq!(decide(&m), Detected::Down);
     }
 
     #[test]
-    fn absent_interface_yields_empty() {
-        assert!(parse_scutil_dns(SCUTIL, "utun9").is_empty());
-        assert!(parse_scutil_dns("", "utun3").is_empty());
+    fn detects_down_when_offline_no_primary() {
+        let m = model(
+            None,
+            None,
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                svc("vpn", Some("en0"), &["192.0.2.53"]),
+            ],
+        );
+        assert_eq!(decide(&m), Detected::Down);
     }
 
     #[test]
-    fn nameservers_without_matching_if_index_are_ignored() {
-        // A block with servers but no if_index line is attributed to no
-        // interface, so nothing is collected.
-        let output = "resolver #1\n  nameserver[0] : 1.2.3.4\n";
-        assert!(parse_scutil_dns(output, "utun3").is_empty());
+    fn detects_down_when_no_physical_service_dns_found() {
+        // The physical service carries no DNS (cannot pick a safe demote-target),
+        // even though some other service has DNS → conservative Down.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &[]),              // physical, no DNS
+                svc("other", Some("en0"), &["192.0.2.53"]), // some other service
+            ],
+        );
+        assert_eq!(decide(&m), Detected::Down);
+    }
+
+    #[test]
+    fn decision_is_order_insensitive() {
+        // A service whose DNS is the SAME set as physical (just reordered) is not
+        // a VPN → Down (no service differs from the physical resolver).
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1", "198.51.100.2"]),
+                svc("other", Some("en0"), &["198.51.100.2", "198.51.100.1"]),
+            ],
+        );
+        assert_eq!(decide(&m), Detected::Down);
     }
 
     #[test]
-    fn attributes_when_if_index_is_the_last_line_of_the_block() {
-        // The buffering invariant: nameservers parsed before the if_index line
-        // are still attributed to the interface named by that later line.
-        let output = "\
-resolver #1
-  nameserver[0] : 10.0.0.1
-  nameserver[1] : 10.0.0.2
-  if_index : 14 (utun3)
-";
+    fn a_tunnel_vpn_is_detected_by_its_differing_dns_not_its_index() {
+        // No SPECIFIC utun index/name is keyed on: a tunnel VPN is recognised by
+        // its differing DNS, and its interface only has to be a tunnel *kind*
+        // (utun/ppp/ipsec/…) — never a particular name — to qualify as a hijacker.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                // Whatever the tunnel interface is named (utun index varies), it
+                // is recognised as a tunnel kind carrying differing DNS.
+                svc("vpn", Some("utun7"), &["192.0.2.53"]),
+            ],
+        );
         assert_eq!(
-            parse_scutil_dns(output, "utun3"),
-            vec!["10.0.0.1".to_string(), "10.0.0.2".to_string()]
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn a_secondary_physical_network_is_not_mistaken_for_a_vpn() {
+        // The P1 false positive: Ethernet en0 is primary while Wi-Fi en1 stays
+        // associated with its own DHCP resolver that differs from en0's. With NO
+        // VPN running, en1 is a distinct *hardware* interface (not the primary,
+        // not a tunnel) → a parallel network, not the default-resolver hijacker →
+        // Down (no false apply of the corp domains to the Wi-Fi resolver).
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                svc("wifi", Some("en1"), &["198.51.100.99"]), // secondary DHCP DNS
+            ],
         );
+        assert_eq!(decide(&m), Detected::Down);
     }
 
     #[test]
-    fn preserves_ipv6_and_double_digit_indices() {
-        // split_once(':') keeps the full IPv6 address (and %zone) intact, and
-        // double-digit nameserver indices parse like single-digit ones.
-        let output = "\
-resolver #1
-  nameserver[0] : 2001:db8::1
-  nameserver[1] : fe80::1%utun3
-  nameserver[10] : 10.0.0.1
-  if_index : 14 (utun3)
-";
+    fn a_tunnel_vpn_is_found_even_alongside_a_secondary_physical_network() {
+        // A real VPN (utun) AND a secondary physical Wi-Fi are both present, with
+        // the secondary listed FIRST. The secondary en1 is excluded; the tunnel
+        // hijacker is still found → Up with the VPN's corp DNS (order-insensitive).
+        let m = model(
+            Some("en0"),
+            Some("phys"),
+            vec![
+                svc("wifi", Some("en1"), &["198.51.100.99"]), // secondary, listed first
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                svc("vpn", Some("utun4"), &["192.0.2.53"]),
+            ],
+        );
         assert_eq!(
-            parse_scutil_dns(output, "utun3"),
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn an_unscoped_hijacker_with_no_interface_is_detected() {
+        // A global-default-hijack VPN whose own service entry carries no
+        // InterfaceName is an unscoped/default resolver → still a hijacker → Up.
+        let m = model(
+            Some("en0"),
+            Some("phys"),
             vec![
-                "2001:db8::1".to_string(),
-                "fe80::1%utun3".to_string(),
-                "10.0.0.1".to_string(),
-            ]
+                svc("phys", Some("en0"), &["198.51.100.1"]),
+                ServiceDns {
+                    service_id: "vpn".to_string(),
+                    interface_name: None,
+                    servers: vec!["192.0.2.53".to_string()],
+                },
+            ],
         );
+        assert_eq!(
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
+        );
+    }
+
+    #[test]
+    fn hijacker_predicate_classifies_by_interface_kind() {
+        // Primary interface en0. Hijackers: the primary itself, any tunnel kind,
+        // or no interface. Non-hijackers: a distinct secondary hardware link.
+        let primary = Some("en0");
+        let h = |iface: Option<&str>| {
+            is_default_resolver_hijacker(&svc("s", iface, &["192.0.2.53"]), primary)
+        };
+        assert!(h(Some("en0")), "rides the primary default route");
+        assert!(
+            h(Some("utun4")) && h(Some("ppp0")) && h(Some("ipsec0")),
+            "tunnel kinds"
+        );
+        assert!(h(None), "unscoped/default resolver");
+        assert!(
+            !h(Some("en1")),
+            "a second Ethernet/Wi-Fi is a secondary network"
+        );
+        assert!(
+            !h(Some("bridge100")),
+            "a VM/Thunderbolt bridge is a secondary network"
+        );
+        assert!(!h(Some("pdp_ip0")), "cellular is a secondary network");
     }
 
     #[test]
-    fn interface_match_is_exact_not_substring() {
-        // utun3 must not match utun30.
-        let output = "\
-resolver #1
-  nameserver[0] : 10.0.0.1
-  if_index : 14 (utun30)
-";
-        assert!(parse_scutil_dns(output, "utun3").is_empty());
+    fn full_fixture_parse_then_decide_is_up() {
+        // End-to-end over the real-form dumps: parse the primary interface +
+        // service id and the two service DNS dicts, assemble the per-service
+        // model, decide → Up with corp=192.0.2.53, demote=198.51.100.1.
+        let primary_iface = parse_scalar_field(GLOBAL_IPV4, "PrimaryInterface");
+        let primary_svc = parse_scalar_field(GLOBAL_IPV4, "PrimaryService");
+        let physical = parse_array_field(PHYSICAL_DNS, "ServerAddresses");
+        // The VPN's own service DNS dump (corp resolver), same form as the others.
+        let vpn_service_dns = "\
+<dictionary> {
+  ServerAddresses : <array> {
+    0 : 192.0.2.53
+  }
+  InterfaceName : en0
+}";
+        let corp = parse_array_field(vpn_service_dns, "ServerAddresses");
+        let phys_id = primary_svc.clone().unwrap();
+        let m = DnsModel {
+            primary_interface: primary_iface,
+            primary_service: primary_svc,
+            services: vec![
+                ServiceDns {
+                    service_id: phys_id,
+                    interface_name: Some("en0".to_string()),
+                    servers: physical,
+                },
+                ServiceDns {
+                    service_id: "vpn-service".to_string(),
+                    interface_name: Some("en0".to_string()),
+                    servers: corp,
+                },
+            ],
+        };
         assert_eq!(
-            parse_scutil_dns(output, "utun30"),
-            vec!["10.0.0.1".to_string()]
+            decide(&m),
+            Detected::Up {
+                corp_dns: vec!["192.0.2.53".to_string()],
+                demote_target: vec!["198.51.100.1".to_string()],
+            }
         );
     }
 }
diff --git a/splitway-daemon/src/detector/macos/state.rs b/splitway-daemon/src/detector/macos/state.rs
index 030347b..3b5ae89 100644
--- a/splitway-daemon/src/detector/macos/state.rs
+++ b/splitway-daemon/src/detector/macos/state.rs
@@ -3,29 +3,33 @@
 //! ([`sample_with_retry`]). Kept here, free of FFI/IO, so both are unit-tested.
 //!
 //! SCDynamicStore re-fires on every related change, so the [`Deduper`]
-//! suppresses samples that carry no new information. Unlike a plain up/down
-//! flag, it tracks the actual DNS server list: a VPN DNS rotation (still "up"
-//! but with different servers) is a real change and must be re-emitted, or the
-//! `/etc/resolver` files would keep pointing at stale servers.
+//! suppresses samples that carry no new information. It tracks the full detected
+//! state ([`Detected`]) — both the corp DNS *and* the demote-target — so a
+//! change to *either* (DNS rotation, or a new physical resolver after a Wi-Fi
+//! switch) is a real change and is re-emitted, while an identical re-sample is
+//! suppressed. Keying on the whole `Detected` (not just the servers) means a
+//! demote-target change is not silently dropped.
 
-/// What the watcher should do for a freshly-sampled DNS server list.
+use super::parser::Detected;
+
+/// What the watcher should do for a freshly-sampled detection result.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(super) enum Emit {
-    /// Emit `Up` with the sampled servers (gained DNS, or the server set changed).
+    /// Emit `Up` (gained an override, or the corp DNS / demote-target changed).
     Up,
-    /// Emit `Down` (lost its DNS).
+    /// Emit `Down` (the override went away).
     Down,
     /// No change since the last emission — emit nothing.
     Nothing,
 }
 
-/// Tracks the last emitted DNS state so identical samples are suppressed while a
-/// changed server set still propagates.
+/// Tracks the last emitted detection so identical samples are suppressed while a
+/// changed state still propagates.
 #[derive(Debug, Default)]
 pub(super) struct Deduper {
-    /// `Some(servers)` = last emitted `Up` with these servers; `None` = last
+    /// `Some(detected)` = last emitted `Up` carrying this state; `None` = last
     /// emitted `Down` (or nothing emitted yet).
-    last: Option<Vec<String>>,
+    last: Option<Detected>,
 }
 
 /// How many times the post-arm initial sample reads `scutil` before giving up.
@@ -57,27 +61,35 @@ pub(super) fn sample_with_retry<T, E>(
 }
 
 impl Deduper {
-    /// Decide what to emit for the just-sampled `servers` (empty = the interface
-    /// is down), recording it as the new last-emitted state.
-    pub(super) fn decide(&mut self, servers: &[String]) -> Emit {
-        if servers.is_empty() {
-            if self.last.is_none() {
-                Emit::Nothing
-            } else {
-                self.last = None;
-                Emit::Down
+    /// Decide what to emit for the just-sampled detection, recording it as the
+    /// new last-emitted state. `Detected::Down` maps to a `Down` only if we were
+    /// previously `Up`; an unchanged `Up` is suppressed; any change to the
+    /// `Up` payload (corp DNS or demote-target) re-emits `Up`.
+    pub(super) fn decide(&mut self, detected: &Detected) -> Emit {
+        match detected {
+            Detected::Down => {
+                if self.last.is_none() {
+                    Emit::Nothing
+                } else {
+                    self.last = None;
+                    Emit::Down
+                }
+            }
+            up @ Detected::Up { .. } => {
+                if self.last.as_ref() == Some(up) {
+                    Emit::Nothing
+                } else {
+                    self.last = Some(up.clone());
+                    Emit::Up
+                }
             }
-        } else if self.last.as_deref() == Some(servers) {
-            Emit::Nothing
-        } else {
-            self.last = Some(servers.to_vec());
-            Emit::Up
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use super::super::parser::Detected;
     use super::{sample_with_retry, Deduper, Emit};
     use std::cell::Cell;
 
@@ -85,6 +97,23 @@ mod tests {
         values.iter().map(|v| v.to_string()).collect()
     }
 
+    /// An `Up` detection with the given corp DNS and a fixed demote-target.
+    fn up(corp: &[&str]) -> Detected {
+        Detected::Up {
+            corp_dns: s(corp),
+            demote_target: s(&["198.51.100.1"]),
+        }
+    }
+
+    /// An `Up` detection with an explicit demote-target (for the demote-change
+    /// test).
+    fn up_with(corp: &[&str], demote: &[&str]) -> Detected {
+        Detected::Up {
+            corp_dns: s(corp),
+            demote_target: s(demote),
+        }
+    }
+
     #[test]
     fn retry_succeeds_on_first_try_without_pausing() {
         let pauses = Cell::new(0);
@@ -93,11 +122,11 @@ mod tests {
             5,
             || {
                 reads.set(reads.get() + 1);
-                Ok(s(&["9.9.9.9"]))
+                Ok(s(&["192.0.2.9"]))
             },
             || pauses.set(pauses.get() + 1),
         );
-        assert_eq!(r, Ok(s(&["9.9.9.9"])));
+        assert_eq!(r, Ok(s(&["192.0.2.9"])));
         assert_eq!(reads.get(), 1, "a first success reads exactly once");
         assert_eq!(pauses.get(), 0, "no pause when the first read succeeds");
     }
@@ -114,12 +143,12 @@ mod tests {
                 if attempt.get() < 3 {
                     Err("scutil hiccup")
                 } else {
-                    Ok(s(&["1.1.1.1"]))
+                    Ok(s(&["192.0.2.1"]))
                 }
             },
             || pauses.set(pauses.get() + 1),
         );
-        assert_eq!(r, Ok(s(&["1.1.1.1"])));
+        assert_eq!(r, Ok(s(&["192.0.2.1"])));
         assert_eq!(attempt.get(), 3);
         assert_eq!(pauses.get(), 2, "paused before each of the two retries");
     }
@@ -148,39 +177,59 @@ mod tests {
             0,
             || {
                 reads.set(reads.get() + 1);
-                Ok(s(&["8.8.8.8"]))
+                Ok(s(&["192.0.2.8"]))
             },
             || panic!("must not pause with a zero budget"),
         );
-        assert_eq!(r, Ok(s(&["8.8.8.8"])));
+        assert_eq!(r, Ok(s(&["192.0.2.8"])));
         assert_eq!(reads.get(), 1);
     }
 
     #[test]
     fn first_up_then_identical_is_suppressed() {
         let mut dedup = Deduper::default();
-        assert_eq!(dedup.decide(&s(&["1.1.1.1"])), Emit::Up);
-        assert_eq!(dedup.decide(&s(&["1.1.1.1"])), Emit::Nothing);
+        assert_eq!(dedup.decide(&up(&["192.0.2.53"])), Emit::Up);
+        assert_eq!(dedup.decide(&up(&["192.0.2.53"])), Emit::Nothing);
     }
 
     #[test]
     fn down_emitted_only_when_previously_up() {
         let mut dedup = Deduper::default();
-        assert_eq!(dedup.decide(&s(&[])), Emit::Nothing); // never up -> nothing
-        assert_eq!(dedup.decide(&s(&["1.1.1.1"])), Emit::Up);
-        assert_eq!(dedup.decide(&s(&[])), Emit::Down);
-        assert_eq!(dedup.decide(&s(&[])), Emit::Nothing); // already down
-        assert_eq!(dedup.decide(&s(&["1.1.1.1"])), Emit::Up); // up again (last reset to None)
+        assert_eq!(dedup.decide(&Detected::Down), Emit::Nothing); // never up -> nothing
+        assert_eq!(dedup.decide(&up(&["192.0.2.53"])), Emit::Up);
+        assert_eq!(dedup.decide(&Detected::Down), Emit::Down);
+        assert_eq!(dedup.decide(&Detected::Down), Emit::Nothing); // already down
+        assert_eq!(dedup.decide(&up(&["192.0.2.53"])), Emit::Up); // up again (last reset to None)
     }
 
     #[test]
-    fn dns_server_rotation_reemits_up() {
+    fn corp_dns_rotation_reemits_up() {
         let mut dedup = Deduper::default();
-        assert_eq!(dedup.decide(&s(&["1.1.1.1"])), Emit::Up);
-        // Still up, but the server changed: must re-emit, not suppress.
-        assert_eq!(dedup.decide(&s(&["2.2.2.2"])), Emit::Up);
-        assert_eq!(dedup.decide(&s(&["2.2.2.2"])), Emit::Nothing);
+        assert_eq!(dedup.decide(&up(&["192.0.2.53"])), Emit::Up);
+        // Still up, but the corp DNS changed: must re-emit, not suppress.
+        assert_eq!(dedup.decide(&up(&["192.0.2.54"])), Emit::Up);
+        assert_eq!(dedup.decide(&up(&["192.0.2.54"])), Emit::Nothing);
         // A different set (added server) is also a change.
-        assert_eq!(dedup.decide(&s(&["2.2.2.2", "3.3.3.3"])), Emit::Up);
+        assert_eq!(dedup.decide(&up(&["192.0.2.54", "192.0.2.55"])), Emit::Up);
+    }
+
+    #[test]
+    fn demote_target_change_reemits_up() {
+        // The demote-target (physical DHCP resolver) changing — e.g. after a
+        // Wi-Fi switch — is a real change even when the corp DNS is unchanged,
+        // so it must re-emit so the backend re-demotes to the new fallback.
+        let mut dedup = Deduper::default();
+        assert_eq!(
+            dedup.decide(&up_with(&["192.0.2.53"], &["198.51.100.1"])),
+            Emit::Up
+        );
+        assert_eq!(
+            dedup.decide(&up_with(&["192.0.2.53"], &["198.51.100.9"])),
+            Emit::Up
+        );
+        assert_eq!(
+            dedup.decide(&up_with(&["192.0.2.53"], &["198.51.100.9"])),
+            Emit::Nothing
+        );
     }
 }
diff --git a/splitway-daemon/src/detector/macos/watch.rs b/splitway-daemon/src/detector/macos/watch.rs
index 9233dd6..ef789dd 100644
--- a/splitway-daemon/src/detector/macos/watch.rs
+++ b/splitway-daemon/src/detector/macos/watch.rs
@@ -48,7 +48,8 @@ use tokio::sync::mpsc::{self, Receiver, Sender};
 
 use splitway_shared::platform::{PlatformError, VpnEvent, VpnInfo};
 
-use super::detector::current_dns;
+use super::detector::current_vpn_state;
+use super::parser::Detected;
 use super::state::{sample_with_retry, Deduper, Emit, INITIAL_SAMPLE_ATTEMPTS};
 
 /// Delay between retries of the post-arm initial sample (see [`emit_initial`]).
@@ -99,14 +100,31 @@ fn run_watch(interface: String, tx: Sender<VpnEvent>) {
         }
     };
 
-    // Watch global DNS plus per-service DNS and per-interface IPv4 changes; any
-    // of these fires when a VPN comes up or goes down. The callback re-reads the
-    // full state, so over-broad keys only cost a redundant (deduped) read.
-    let keys: CFArray<CFString> =
-        CFArray::from_CFTypes(&[CFString::from_static_string("State:/Network/Global/DNS")]);
+    // Watch the per-service DNS and per-interface IPv4 keys (what detection now
+    // reads — see `parser`), plus the two global keys. `State:/Network/Global/IPv4`
+    // is essential, not just an extra trigger: detection reads `PrimaryService`/
+    // `PrimaryInterface` from it to anchor the physical service and demote target,
+    // and macOS can switch the primary route between already-configured services by
+    // updating only this key, without touching any watched DNS key — so without it
+    // the daemon would sleep with a stale primary-service decision. `Global/DNS` is
+    // the extra trigger. The callback re-reads the full model and dedups, so
+    // over-broad keys (and the callback our own demote of a service's DNS triggers)
+    // only cost a redundant, suppressed read — never a spurious state change.
+    let keys: CFArray<CFString> = CFArray::from_CFTypes(&[
+        CFString::from_static_string("State:/Network/Global/IPv4"),
+        CFString::from_static_string("State:/Network/Global/DNS"),
+    ]);
     let patterns: CFArray<CFString> = CFArray::from_CFTypes(&[
         CFString::from_static_string("(State|Setup):/Network/Service/.*/DNS"),
         CFString::from_static_string("State:/Network/Interface/.*/IPv4"),
+        // The per-service IPv4/IPv6 entities carry each service's `InterfaceName`
+        // binding, which `read_service_interface` reads to classify a service
+        // (physical vs. an unscoped default hijacker). A service gaining/losing an
+        // interface binding without a DNS or global change must re-trigger
+        // detection — otherwise the service stays classified from stale data (an
+        // unknown interface can be misread as a hijacker → false "VPN up").
+        CFString::from_static_string("State:/Network/Service/.*/IPv4"),
+        CFString::from_static_string("State:/Network/Service/.*/IPv6"),
     ]);
     if !store.set_notification_keys(&keys, &patterns) {
         log::error!("SCDynamicStore::set_notification_keys failed; macOS VPN watch disabled");
@@ -164,18 +182,18 @@ fn on_change(_store: SCDynamicStore, _changed_keys: CFArray<CFString>, ctx: &mut
     }
 }
 
-/// Steady-state callback path: read the interface's current DNS, decide whether
-/// it represents a new state, and send the corresponding event. Returns `false`
+/// Steady-state callback path: read the current DNS model, decide whether it
+/// represents a new state, and send the corresponding event. Returns `false`
 /// if the receiver has been dropped.
 fn emit_current(interface: &str, tx: &Sender<VpnEvent>, dedup: &mut Deduper) -> bool {
-    match current_dns(interface) {
-        Ok(servers) => emit_servers(interface, tx, dedup, servers),
+    match current_vpn_state() {
+        Ok(detected) => emit_detected(interface, tx, dedup, detected),
         // A transient `scutil` failure is not "VPN down": keep the last known
         // state instead of emitting a spurious Down that would revert rules.
         // SCDynamicStore re-fires the callback on the next change, so a one-off
         // hiccup here recovers on its own.
         Err(e) => {
-            log::warn!("reading DNS for {interface} failed: {e}; keeping last state");
+            log::warn!("reading the DNS model failed: {e}; keeping last state");
             true
         }
     }
@@ -192,16 +210,14 @@ fn emit_current(interface: &str, tx: &Sender<VpnEvent>, dedup: &mut Deduper) ->
 /// notifications that fire during the retries are queued and delivered once the
 /// run loop starts, and the shared dedup prevents a double-emit.
 fn emit_initial(interface: &str, tx: &Sender<VpnEvent>, dedup: &mut Deduper) -> bool {
-    let sample = sample_with_retry(
-        INITIAL_SAMPLE_ATTEMPTS,
-        || current_dns(interface),
-        || std::thread::sleep(INITIAL_SAMPLE_RETRY_DELAY),
-    );
+    let sample = sample_with_retry(INITIAL_SAMPLE_ATTEMPTS, current_vpn_state, || {
+        std::thread::sleep(INITIAL_SAMPLE_RETRY_DELAY)
+    });
     match sample {
-        Ok(servers) => emit_servers(interface, tx, dedup, servers),
+        Ok(detected) => emit_detected(interface, tx, dedup, detected),
         Err(e) => {
             log::error!(
-                "initial DNS read for {interface} failed after {INITIAL_SAMPLE_ATTEMPTS} \
+                "initial DNS-model read failed after {INITIAL_SAMPLE_ATTEMPTS} \
                  attempts: {e}; auto-apply will start on the next DNS/network change"
             );
             true // stay alive; a later notification can still recover
@@ -209,19 +225,29 @@ fn emit_initial(interface: &str, tx: &Sender<VpnEvent>, dedup: &mut Deduper) ->
     }
 }
 
-/// Dedup a freshly-read server list and send the resulting event. Returns
-/// `false` if the receiver has been dropped.
-fn emit_servers(
+/// Dedup a freshly-read detection and send the resulting event. Returns `false`
+/// if the receiver has been dropped. The `interface_name` carried in `Up` is
+/// advisory on macOS (nothing keys on it); the demote-target rides along so the
+/// backend can demote the hijacked default to it.
+fn emit_detected(
     interface: &str,
     tx: &Sender<VpnEvent>,
     dedup: &mut Deduper,
-    servers: Vec<String>,
+    detected: Detected,
 ) -> bool {
-    let event = match dedup.decide(&servers) {
-        Emit::Up => VpnEvent::Up(VpnInfo {
-            interface_name: interface.to_string(),
-            dns_servers: servers,
-        }),
+    let event = match dedup.decide(&detected) {
+        Emit::Up => match detected {
+            Detected::Up {
+                corp_dns,
+                demote_target,
+            } => VpnEvent::Up(VpnInfo {
+                interface_name: interface.to_string(),
+                dns_servers: corp_dns,
+                demote_target: Some(demote_target),
+            }),
+            // `decide` only returns `Up` for a `Detected::Up`.
+            Detected::Down => unreachable!("decide returned Up for a Down detection"),
+        },
         Emit::Down => VpnEvent::Down {
             interface_name: interface.to_string(),
         },
diff --git a/splitway-daemon/src/detector/mod.rs b/splitway-daemon/src/detector/mod.rs
index ed80726..9d8155a 100644
--- a/splitway-daemon/src/detector/mod.rs
+++ b/splitway-daemon/src/detector/mod.rs
@@ -4,6 +4,17 @@ mod linux;
 #[cfg(target_os = "macos")]
 mod macos;
 
+/// Re-export the macOS dynamic-store primitives so the macOS DNS backend can
+/// reuse them for the demote (it reads the same `scutil` dump shape to find the
+/// primary service and its current DNS, drives `scutil` the same way, and
+/// compares resolver sets the same way). Kept here, behind the platform gate, so
+/// the two macOS modules share one implementation rather than duplicating it.
+#[cfg(target_os = "macos")]
+pub(crate) use macos::{
+    parse_array_field as macos_parse_array_field, parse_scalar_field as macos_parse_scalar_field,
+    same_set as macos_same_set, scutil_script as macos_scutil_script,
+};
+
 #[cfg(target_os = "windows")]
 mod windows;
 
diff --git a/splitway-gui-tauri/.gitignore b/splitway-gui-tauri/.gitignore
index 59da3b4..3522b2f 100644
--- a/splitway-gui-tauri/.gitignore
+++ b/splitway-gui-tauri/.gitignore
@@ -5,3 +5,9 @@ ui/dist/
 # Tauri-generated ACL/permission schemas (regenerated by build.rs from
 # tauri.conf.json + capabilities/).
 gen/
+
+# macOS bundle staging: the helper binaries + bootstrap + plist are copied here
+# by scripts/build-macos-app.sh and embedded as app Resources. Build output, not
+# source (bootstrap.sh + the plist are tracked at their real homes; only their
+# staged copies + the release binaries land here). See docs/design/macos-self-install.md.
+resources/
diff --git a/splitway-gui-tauri/scripts/bootstrap.sh b/splitway-gui-tauri/scripts/bootstrap.sh
new file mode 100755
index 0000000..5ebabf3
--- /dev/null
+++ b/splitway-gui-tauri/scripts/bootstrap.sh
@@ -0,0 +1,306 @@
+#!/bin/bash
+#
+# bootstrap.sh — the privileged install/disable steps for the Splitway macOS
+# self-installer, run as ROOT via osascript's `do shell script ... with
+# administrator privileges` (one native password prompt). It is bundled inside
+# Splitway.app (Contents/Resources) alongside the helper binaries and the
+# LaunchDaemon plist; the Tauri `install_service` / `disable_service` commands
+# invoke it as `/bin/bash <this> install` / `<this> disable`.
+#
+# SECURITY: this script is the privileged surface of an UNSIGNED app, so it is
+# deliberately inert — it takes exactly one fixed subcommand (install|disable)
+# and NO data derived from the GUI or any user input. The console user it adds to
+# the group is read from the live system (`stat -f %Su /dev/console`), not passed
+# in. Every step is idempotent and a failure aborts before the next, so a partial
+# run never leaves the system half-configured (mirrors the daemon's own
+# apply-or-rollback contract). See docs/design/macos-self-install.md.
+
+set -euo pipefail
+
+# Pin PATH to the system locations so every privileged tool we invoke (stat,
+# install, dseditgroup, launchctl, xattr, …) resolves to a trusted system binary,
+# never to something on the caller's inherited PATH. A root script must not trust
+# the environment it was launched from.
+export PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# Resolve our own directory (the bundle's Contents/Resources) so the binaries and
+# plist that travel beside us are found regardless of where the .app lives
+# (/Applications, ~/Applications, a mounted volume, …). No hardcoded app path.
+SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+readonly LABEL="com.splitway.daemon"
+readonly PLIST_DST="/Library/LaunchDaemons/${LABEL}.plist"
+readonly BIN_DIR="/usr/local/bin"
+readonly GROUP="splitway"
+
+log() { printf 'splitway-bootstrap: %s\n' "$*"; }
+die() { printf 'splitway-bootstrap: error: %s\n' "$*" >&2; exit 1; }
+
+# True if $1 carries a macOS ACL that could let a NON-root principal modify it
+# (write/delete/rename/replace the entry or its children). macOS ACLs are NOT
+# reflected in the POSIX mode bits and are NOT cleared by a `chmod` mode change,
+# so a root:wheel 0755 directory can still be attacker-writable through an ACL —
+# which would let a non-root user swap the directory that holds the root-run
+# daemon. Parse `ls -lde`: each numbered ACL entry is
+# `<n>: <principal> <allow|deny> <perms>`; flag any `allow` entry for a principal
+# other than root/wheel whose comma-separated perms include a write-class right.
+# Fails closed (any such entry → refuse), matching this script's verify-or-abort
+# discipline for the destination of a root-run binary.
+acl_allows_nonroot_write() {
+    local line principal perms
+    while IFS= read -r line; do
+        # Trim leading whitespace, then keep only ACL entry lines.
+        line="${line#"${line%%[![:space:]]*}"}"
+        case "$line" in
+            [0-9]*:\ *) : ;;
+            *) continue ;;
+        esac
+        line="${line#*: }"        # strip the "<n>: " index
+        # Split on the " allow " action keyword rather than a positional field:
+        # an ACL principal (record/full name) can contain spaces, so field-2
+        # parsing would let `user:First Last allow write` slip through. `deny` and
+        # malformed lines have no " allow " and are skipped (not a grant). Perms are
+        # a single comma-list with no spaces, so " allow " appears exactly once.
+        case " $line " in
+            *" allow "*) : ;;
+            *) continue ;;
+        esac
+        principal="${line%% allow *}"
+        perms="${line##* allow }"
+        case "$principal" in
+            user:root | group:wheel) continue ;;
+        esac
+        case ",$perms," in
+            *,write,* | *,delete,* | *,append,* | *,add_file,* | *,add_subdirectory,* | \
+                *,delete_child,* | *,writeattr,* | *,writeextattr,* | *,writesecurity,* | *,chown,*)
+                return 0
+                ;;
+        esac
+    done < <(ls -lde "$1" 2>/dev/null)
+    return 1
+}
+
+# Walk every ancestor of $1 up to / and refuse unless each is root-owned, not
+# writable by group or other, AND free of an ACL granting a non-root principal
+# write. Renaming or replacing a directory entry needs write access to its
+# PARENT, not to the entry itself — so pinning $BIN_DIR to root:wheel is not
+# enough: a single non-root-writable ancestor (e.g. /usr/local left admin-owned
+# by the Homebrew-on-Intel layout, or one carrying a stray ACL) still lets a
+# non-root user swap the directory out and have launchd exec their binary as
+# root. We verify (never chown/chmod) the parents: touching /usr/local would
+# break a real Homebrew, so an unsafe chain is a hard refusal with an actionable
+# message instead.
+assert_root_only_path() {
+    local dir="$1" owner perm
+    while :; do
+        owner="$(stat -f '%Su' "$dir" 2>/dev/null || true)"
+        perm="$(stat -f '%Lp' "$dir" 2>/dev/null || true)"
+        [ "$owner" = "root" ] || die "${dir} is owned by '${owner:-unknown}', not root; refusing — a non-root owner of an ancestor of ${BIN_DIR} could substitute the root-run daemon binary"
+        # 8#22 = group-write|other-write, base-8 on both operands so the mask is
+        # unambiguous regardless of leading-zero/octal shell quirks.
+        if [ -z "$perm" ] || [ "$(( 8#$perm & 8#22 ))" -ne 0 ]; then
+            die "${dir} (mode ${perm:-unknown}) is writable by group or other; refusing — a writable ancestor of ${BIN_DIR} lets a non-root user substitute the root-run daemon binary"
+        fi
+        if acl_allows_nonroot_write "$dir"; then
+            die "${dir} carries a macOS ACL granting write/delete to a non-root principal; refusing — an ACL-writable ancestor of ${BIN_DIR} lets a non-root user substitute the root-run daemon binary (ACLs are invisible to the mode bits and survive chmod)"
+        fi
+        [ "$dir" = "/" ] && break
+        dir="$(dirname "$dir")"
+    done
+}
+
+# --- install ---------------------------------------------------------------
+
+install_binaries() {
+    # The daemon is exec'd as ROOT by launchd, so its directory MUST be writable
+    # only by root — otherwise a non-root admin (e.g. the Homebrew-on-Intel layout
+    # where /usr/local/bin is admin-owned) could swap the binary and have launchd
+    # run it as root at the next boot (a persistent local privilege escalation).
+    # Create the dir if absent, then pin it to root:wheel 0755 and refuse to
+    # proceed if it cannot be made root-owned. BSD `install` has no -D, so the dir
+    # is handled here.
+    mkdir -p "$BIN_DIR"
+    # Verify the parent chain BEFORE touching ownership, so an unsafe layout (e.g.
+    # Homebrew-on-Intel's admin-owned /usr/local) is a clean refusal that has not
+    # already re-chowned a pre-existing $BIN_DIR out from under the user. A
+    # non-root-writable ancestor can rename/replace $BIN_DIR itself, so pinning it
+    # to root:wheel below is only sound once every parent is root-only.
+    assert_root_only_path "$(dirname "$BIN_DIR")"
+    # ...then resolve symlinks before trusting that result: the check above is
+    # lexical, so a symlinked $BIN_DIR (e.g. /usr/local/bin -> /Users/alice/bin)
+    # would pass it while the REAL target lives in a user-writable tree — letting
+    # that user rename/replace the target and have launchd run it as root. The
+    # lexical parent being root-only (verified above) means a non-root user cannot
+    # swap the symlink itself; this closes the other half by verifying the physical
+    # target's ancestor chain too. On a normal (non-symlink) layout it resolves to
+    # the same path, so the extra check is a no-op.
+    local real_bin
+    real_bin="$(cd "$BIN_DIR" && pwd -P)" || die "cannot resolve the real path of ${BIN_DIR}"
+    [ "$real_bin" = "$BIN_DIR" ] || assert_root_only_path "$(dirname "$real_bin")"
+    chown root:wheel "$BIN_DIR" || die "cannot make ${BIN_DIR} root-owned; refusing to install a root-run binary into a non-root-writable directory"
+    chmod 755 "$BIN_DIR"
+    # A macOS ACL survives the chmod above and is invisible to the mode-bit check,
+    # so an ACL granting another user write/delete on $BIN_DIR would still let them
+    # swap the root-run binary. We own $BIN_DIR, so strip any ACL outright (like the
+    # chown), then confirm none granting non-root write remains.
+    chmod -N "$BIN_DIR" 2>/dev/null || true
+    if acl_allows_nonroot_write "$BIN_DIR"; then
+        die "${BIN_DIR} still carries a macOS ACL granting non-root write after chmod -N; refusing to install a root-run binary there"
+    fi
+    local owner
+    owner="$(stat -f '%Su:%Sg' "$BIN_DIR")"
+    [ "$owner" = "root:wheel" ] || die "${BIN_DIR} is ${owner}, not root:wheel; refusing to install a root-run binary there"
+
+    # SECURITY (trust boundary): the source binaries below are trusted BY
+    # ASSUMPTION, not verified here, and that is deliberate. No in-bundle integrity
+    # check (a compiled-in hash, an in-script source-permission or source-ownership
+    # check) is attempted, because:
+    #  1. CO-LOCATION: this script lives in Contents/Resources beside the very
+    #     binaries it copies (and beside the GUI binary in Contents/MacOS) and is
+    #     run AS ROOT by osascript. The same write access that could swap
+    #     splitway-daemon could edit the check out of THIS script, or replace the
+    #     whole script with a root payload, before any check runs — so a verifier
+    #     that cannot sit outside the writable bundle protects nothing against the
+    #     only attacker who can trigger the bug.
+    #  2. A root-owned-source check would also reject every supported location: a
+    #     drag-installed .app is owned by the installing user, not root, in
+    #     /Applications and ~/Applications alike.
+    # The DESTINATION is what root CAN soundly verify and IS hardened above
+    # (BIN_DIR pinned + re-checked, assert_root_only_path on every ancestor). The
+    # sound source-side fix is an OS-enforced root of trust (Developer-ID signing +
+    # notarization + SMAppService), out of scope. See docs/design/macos-self-install.md
+    # ("Trust boundary of the unsigned self-installer").
+    local name src dst
+    for name in splitway-daemon splitway; do
+        src="${SELF_DIR}/${name}"
+        dst="${BIN_DIR}/${name}"
+        [ -f "$src" ] || die "bundled binary not found: ${src}"
+        # root:wheel 0755 — matches the plist install and the now-hardened dir.
+        install -o root -g wheel -m 755 "$src" "$dst"
+        # A quarantined binary loads but then fails silently under launchd, so
+        # strip the flag on the installed copy (ignore "attribute not found").
+        xattr -d com.apple.quarantine "$dst" 2>/dev/null || true
+        log "installed ${dst}"
+    done
+}
+
+console_user() {
+    # The GUI user to grant socket access. The script runs as root, so $USER is
+    # `root` and $SUDO_USER is unset under osascript escalation — read the user
+    # at the console instead. Empty / `root` / `loginwindow` means no GUI session.
+    stat -f '%Su' /dev/console 2>/dev/null || true
+}
+
+ensure_group() {
+    if dseditgroup -o read "$GROUP" >/dev/null 2>&1; then
+        log "group ${GROUP} already exists"
+    else
+        dseditgroup -o create "$GROUP"
+        log "created group ${GROUP}"
+    fi
+}
+
+add_user_to_group() {
+    local user="$1"
+    if dseditgroup -o checkmember -m "$user" "$GROUP" >/dev/null 2>&1; then
+        log "${user} is already a member of ${GROUP}"
+    else
+        dseditgroup -o edit -a "$user" -t user "$GROUP"
+        log "added ${user} to ${GROUP}"
+    fi
+}
+
+install_plist() {
+    local src="${SELF_DIR}/${LABEL}.plist"
+    [ -f "$src" ] || die "bundled plist not found: ${src}"
+    # launchd refuses a plist not owned by root or that is group-writable.
+    install -m 644 -o root -g wheel "$src" "$PLIST_DST"
+    log "installed ${PLIST_DST}"
+}
+
+# Wait until the service record is gone from the system domain (up to ~3s).
+# `launchctl bootout` returns before launchd has finished reaping the old job and
+# removing its record, and `KeepAlive=true` widens that window — so an immediate
+# `bootstrap` of the same label can fail with "Operation already in progress (37)"
+# or "Input/output error (5)". Polling `launchctl print` to not-found closes the
+# race before we re-bootstrap.
+wait_for_service_gone() {
+    for _ in $(seq 1 30); do
+        launchctl print "system/${LABEL}" >/dev/null 2>&1 || return 0
+        sleep 0.1
+    done
+    # Fall through even if still present; the retry loop below absorbs the residue.
+    return 0
+}
+
+bootstrap_daemon() {
+    # Modern (not legacy `load -w`) idempotent sequence: tear down any prior
+    # instance, then bring it up. bootout of an unloaded service errors, so it is
+    # tolerated; after it we settle (the record may linger briefly) before
+    # re-bootstrapping.
+    launchctl bootout "system/${LABEL}" 2>/dev/null || true
+    wait_for_service_gone
+    # Clear any stale `launchctl disable` flag BEFORE bootstrap — a disabled label
+    # makes bootstrap refuse to load. `enable` on a never-seen/already-enabled
+    # label is a harmless no-op.
+    launchctl enable "system/${LABEL}" 2>/dev/null || true
+    # Retry bootstrap a few times: even after the settle poll, launchd can still
+    # report the transient "already in progress"/I/O races right after a teardown.
+    # The final failure stays fatal (no `|| true`) so a genuine error is not masked.
+    for _ in $(seq 1 10); do
+        if launchctl bootstrap system "$PLIST_DST" 2>/dev/null; then
+            log "bootstrapped ${LABEL}"
+            return 0
+        fi
+        sleep 0.3
+    done
+    # Last attempt without suppression, so its real error message surfaces on die.
+    launchctl bootstrap system "$PLIST_DST" || die "launchctl bootstrap failed for ${LABEL}"
+    log "bootstrapped ${LABEL}"
+}
+
+do_install() {
+    log "installing the Splitway service"
+    install_binaries
+    ensure_group
+
+    local user
+    user="$(console_user)"
+    if [ -z "$user" ] || [ "$user" = "root" ] || [ "$user" = "loginwindow" ]; then
+        # No interactive desktop user to grant access to. Still install + start
+        # the daemon (root can drive it via sudo); the GUI run by a real user
+        # later will surface a clear "add me to the group" state.
+        log "no console user detected; skipping group membership (run from a desktop session to grant GUI access)"
+    else
+        add_user_to_group "$user"
+    fi
+
+    install_plist
+    bootstrap_daemon
+    # The daemon self-creates /var/root/.config/splitway/config.json on first
+    # run, so nothing is seeded here.
+    log "install complete"
+}
+
+# --- disable ---------------------------------------------------------------
+
+do_disable() {
+    log "disabling the Splitway service"
+    # bootout sends SIGTERM, which the daemon traps to revert /etc/resolver
+    # before exiting — the system is left clean. Tolerate an already-stopped
+    # service.
+    launchctl bootout "system/${LABEL}" 2>/dev/null || true
+    # Remove the plist so it does not relaunch at boot. Conservative scope: the
+    # binaries, the group, group membership, and the config are left in place so
+    # a later re-install needs no re-prompt (full uninstall is a separate step).
+    rm -f "$PLIST_DST"
+    log "disable complete"
+}
+
+# --- entry -----------------------------------------------------------------
+
+case "${1:-}" in
+    install) do_install ;;
+    disable) do_disable ;;
+    *) die "usage: bootstrap.sh <install|disable>" ;;
+esac
diff --git a/splitway-gui-tauri/scripts/build-macos-app.sh b/splitway-gui-tauri/scripts/build-macos-app.sh
new file mode 100755
index 0000000..a21ad57
--- /dev/null
+++ b/splitway-gui-tauri/scripts/build-macos-app.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+#
+# build-macos-app.sh — build the distributable, ad-hoc-signed (unsigned)
+# Splitway.app on macOS. This is the macOS counterpart of the Linux Nix package
+# (`nix build .#splitway-gui`): it is an ADDITIVE, machine-bound build path that
+# does not touch the Linux/Nix build. The Tauri bundler is invoked ONLY here (via
+# `cargo tauri build`); `cargo build` and the Nix package never read the bundle
+# config, so this perturbs nothing else. See docs/design/macos-self-install.md.
+#
+# What it does:
+#   1. builds the helper binaries (splitway-daemon, splitway) in release
+#   2. builds the web frontend (tsc + esbuild) into ui/dist
+#   3. stages the binaries + the GUI LaunchDaemon plist + bootstrap.sh + an icon
+#      into the gitignored resources/ dir (embedded as app Resources)
+#   4. runs `cargo tauri build --config tauri.bundle.macos.json --bundles app`
+#
+# Toolchain: this runs the whole build inside the flake dev shell (`nix
+# develop`), which brings a consistent Rust toolchain AND the Nix clang stdenv
+# (the latter sidesteps the Xcode-license gate on its own — no DEVELOPER_DIR
+# override, which would break the Nix clang's SDK lookup; and the system rustc,
+# which may be too old for the workspace's locked deps, is avoided). The frontend
+# + bundler tools (cargo-tauri, node, tsc, esbuild, rsvg-convert) are layered on
+# via `nix shell` since the darwin dev shell does not include them. So a plain
+# `bash scripts/build-macos-app.sh` just works.
+#
+# Output: target/release/bundle/macos/Splitway.app
+
+set -euo pipefail
+
+# Run from the tauri crate dir (this script lives in <crate>/scripts).
+CRATE_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$CRATE_DIR"
+REPO_ROOT="$(cd "$CRATE_DIR/.." && pwd)"
+
+# The build steps run inside the toolchain shell. They are written to a temp file
+# (rather than an inline -c string) to avoid fragile multi-level shell quoting;
+# the paths they need are passed through the environment.
+BUILD_STEPS="$(mktemp -t splitway-build-steps.XXXXXX.sh)"
+trap 'rm -f "$BUILD_STEPS"' EXIT
+
+cat >"$BUILD_STEPS" <<'STEPS'
+set -euo pipefail
+# DEVELOPER_DIR pointed at the Command Line Tools would break the Nix clang's SDK
+# lookup; the dev shell's own clang handles the Xcode license, so clear it.
+unset DEVELOPER_DIR
+cd "$CRATE_DIR"
+
+echo "==> building helper binaries (release)"
+cargo build --release -p splitway-daemon -p splitway-cli
+
+echo "==> building the web frontend (tsc + esbuild)"
+( cd ui && sh build.sh )
+
+echo "==> staging app resources"
+rm -rf "$STAGE"
+mkdir -p "$STAGE"
+cp "$REPO_ROOT/target/release/splitway-daemon" "$STAGE/splitway-daemon"
+cp "$REPO_ROOT/target/release/splitway"        "$STAGE/splitway"
+# Stage the GUI plist variant under the plain LABEL.plist name bootstrap.sh looks
+# up (it copies "${SELF_DIR}/com.splitway.daemon.plist"); the ".gui" suffix only
+# distinguishes it in the repo from the manual/sudo template.
+cp "$GUI_PLIST"                                 "$STAGE/com.splitway.daemon.plist"
+cp scripts/bootstrap.sh                         "$STAGE/bootstrap.sh"
+chmod 0755 "$STAGE/bootstrap.sh"
+
+# A crisp 1024px icon source (the committed icons/icon.png is only 128px):
+# rasterize the high-res SVG, then let `cargo tauri icon` generate the full macOS
+# icon set (incl. icon.icns) the bundler folds into Splitway.app. The bundler
+# needs the named multi-size set, not a lone 1024px png.
+rsvg-convert -w 1024 -h 1024 "$ICON_SVG" -o "$STAGE/icon-1024.png"
+cargo tauri icon "$STAGE/icon-1024.png" --output "$STAGE/icons"
+
+# Force the embedded-frontend codegen to re-run: `generate_context!` embeds
+# ui/dist at compile time, so a frontend-only change (no Rust edit) would
+# otherwise leave the previous dist baked into an up-to-date binary. Touching
+# lib.rs (the macro site) guarantees a fresh embed every build.
+touch src/lib.rs
+
+echo "==> cargo tauri build (.app only, ad-hoc/unsigned)"
+# The bundle overlay is named so Tauri does NOT auto-merge it on a plain
+# `cargo build`/clippy (which would validate the staged resources before they
+# exist) — it is applied ONLY here, via --config.
+cargo tauri build --config tauri.bundle.macos.json --bundles app
+
+echo "==> built: $REPO_ROOT/target/release/bundle/macos/Splitway.app"
+STEPS
+
+# Inside `nix develop` (Rust + Nix clang), layer the frontend/bundler tools via
+# `nix shell`, then run the staged build steps. The paths are exported so the
+# steps file needs no quoting gymnastics.
+export CRATE_DIR REPO_ROOT BUILD_STEPS STAGE="${CRATE_DIR}/resources" \
+  GUI_PLIST="${REPO_ROOT}/packaging/launchd/com.splitway.daemon.gui.plist" \
+  ICON_SVG="${REPO_ROOT}/assets/icon/splitway-icon.svg"
+
+exec nix develop "$REPO_ROOT" --command bash -euo pipefail -c '
+  nix shell \
+    nixpkgs#cargo-tauri \
+    nixpkgs#nodejs \
+    nixpkgs#typescript \
+    nixpkgs#esbuild \
+    nixpkgs#librsvg \
+    --command bash "$BUILD_STEPS"
+'
diff --git a/splitway-gui-tauri/src/bridge.rs b/splitway-gui-tauri/src/bridge.rs
index 35f20dd..8c91590 100644
--- a/splitway-gui-tauri/src/bridge.rs
+++ b/splitway-gui-tauri/src/bridge.rs
@@ -39,7 +39,7 @@ use std::sync::mpsc::{Receiver, RecvTimeoutError, Sender};
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
-use tauri::{AppHandle, Emitter, State};
+use tauri::{AppHandle, Emitter, Manager, State};
 
 use splitway_shared::config::VpnBackend;
 use splitway_shared::ipc::client::{self, ClientError};
@@ -251,6 +251,153 @@ pub async fn check_domain(domain: String) -> CheckOutcome {
     }
 }
 
+// --- privileged service management (macOS self-install) --------------------
+//
+// The macOS GUI installs/disables the root LaunchDaemon itself, so a user never
+// has to touch the terminal. These commands escalate via osascript's `do shell
+// script ... with administrator privileges` (one native password prompt) to run
+// the bundled `bootstrap.sh` as root. Like every other command here they honour
+// the truth contract: they do the privileged work, fire refresh-now so the poll
+// thread re-polls, and return a `Result<(), String>` — they NEVER touch the VM.
+// The real health (`NotRunning` → `PermissionDenied`/`Connected`) flows back only
+// through the next `view-model-changed`. See docs/design/macos-self-install.md.
+
+/// The platform the GUI is running on, for the frontend to branch remediation
+/// copy + affordances (the install/disable flow is macOS-only). A plain custom
+/// command (not ACL-gated) so no `os:` plugin permission is needed.
+#[tauri::command]
+pub fn host_platform() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "macos"
+    } else if cfg!(target_os = "linux") {
+        "linux"
+    } else {
+        "other"
+    }
+}
+
+/// Build the AppleScript that runs the bundled bootstrap as root. Pure and
+/// platform-independent so the quoting/escaping is unit-testable without running
+/// osascript.
+///
+/// The escalated shell command is `/bin/bash <script> <subcommand>`, where the
+/// ONLY variable is `script_path` — a bundle-derived absolute path, never GUI
+/// input. It is injected as an AppleScript string variable (with `"`/`\` escaped
+/// for the AppleScript literal) and handed to the shell via `quoted form of`, so
+/// a path containing spaces (`/Applications/My Apps/Splitway.app/…`) stays a
+/// single shell token. `subcommand` is a fixed literal chosen by which command
+/// ran (`install`/`disable`), so the command text is inert by construction.
+fn build_admin_applescript(script_path: &str, subcommand: &str) -> String {
+    // Escape backslash first, then the double-quote, for the AppleScript string
+    // literal. A real bundle path contains neither, but escape defensively so the
+    // injected value can never break out of the literal.
+    let escaped = script_path.replace('\\', "\\\\").replace('"', "\\\"");
+    format!(
+        "set scriptPath to \"{escaped}\"\n\
+         do shell script \"/bin/bash \" & quoted form of scriptPath & \" {subcommand}\" \
+         with administrator privileges"
+    )
+}
+
+/// Resolve the bundled `bootstrap.sh`, escalate via osascript, and run it with
+/// the given fixed subcommand. macOS-only; on other platforms it is an error
+/// (the command is still registered so the frontend surface is uniform).
+///
+/// Returns `Ok(())` on a clean exit; a user-cancelled password dialog and a
+/// non-zero bootstrap exit both map to a human-readable `Err`.
+fn run_privileged(app: &AppHandle, subcommand: &str) -> Result<(), String> {
+    if !cfg!(target_os = "macos") {
+        return Err("the in-app service installer is macOS-only".to_string());
+    }
+
+    let resource_dir = app
+        .path()
+        .resource_dir()
+        .map_err(|e| format!("could not locate the app resources: {e}"))?;
+    let script = resource_dir.join("bootstrap.sh");
+    if !script.exists() {
+        return Err(format!(
+            "the bundled installer script is missing ({}); rebuild the app",
+            script.display()
+        ));
+    }
+    let script_path = script
+        .to_str()
+        .ok_or_else(|| "the app resource path is not valid UTF-8".to_string())?;
+
+    let applescript = build_admin_applescript(script_path, subcommand);
+    let output = std::process::Command::new("/usr/bin/osascript")
+        .arg("-e")
+        .arg(&applescript)
+        .output()
+        .map_err(|e| format!("failed to launch osascript: {e}"))?;
+
+    if output.status.success() {
+        return Ok(());
+    }
+
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    // osascript reports a cancelled auth dialog as error -128 / "User canceled".
+    if stderr.contains("-128") || stderr.to_lowercase().contains("user canceled") {
+        return Err("authentication was cancelled".to_string());
+    }
+    let detail = stderr.trim();
+    if detail.is_empty() {
+        Err(format!(
+            "the installer exited with status {}",
+            output.status
+        ))
+    } else {
+        Err(detail.to_string())
+    }
+}
+
+/// Run a privileged service action on the blocking pool (osascript blocks on the
+/// password dialog), then fire refresh-now so the poll thread re-polls and the
+/// real health surfaces. Never touches the VM — the truth contract holds exactly
+/// as it does for [`dispatch_mutation`].
+async fn dispatch_service_action(
+    app: AppHandle,
+    subcommand: &'static str,
+    refresh: RefreshSignal,
+) -> Result<(), String> {
+    let result = match tauri::async_runtime::spawn_blocking(move || {
+        run_privileged(&app, subcommand)
+    })
+    .await
+    {
+        Ok(result) => result,
+        Err(e) => Err(format!("internal error: service task failed: {e}")),
+    };
+    // Re-poll on every outcome: success moves the VM toward PermissionDenied /
+    // Connected, and even a failure should refresh (e.g. a partial state). The
+    // emit-on-change gate dedups a genuine no-op.
+    refresh.fire();
+    result
+}
+
+/// Install & start the root Splitway LaunchDaemon (one native password prompt).
+/// Idempotent — safe to re-run over an existing install. Offered by the GUI when
+/// `Health == NotRunning` on macOS.
+#[tauri::command]
+pub async fn install_service(
+    app: AppHandle,
+    refresh: State<'_, RefreshSignal>,
+) -> Result<(), String> {
+    dispatch_service_action(app, "install", refresh.inner().clone()).await
+}
+
+/// Stop the daemon (SIGTERM reverts /etc/resolver) and remove its LaunchDaemon
+/// plist so it will not relaunch at boot. Conservative: binaries, the group, and
+/// the config are left in place.
+#[tauri::command]
+pub async fn disable_service(
+    app: AppHandle,
+    refresh: State<'_, RefreshSignal>,
+) -> Result<(), String> {
+    dispatch_service_action(app, "disable", refresh.inner().clone()).await
+}
+
 /// Drive `core` through one whole poll cycle and return the resulting snapshot.
 ///
 /// `send` performs a single request→reply round-trip (the real thread uses the
@@ -663,4 +810,45 @@ mod tests {
             "the new domain must arrive via the re-poll, not the command"
         );
     }
+
+    // --- privileged service management (macOS self-install) ----------------
+
+    #[test]
+    fn host_platform_reports_a_known_value() {
+        // Whatever we built on, it is one of the three the frontend branches on.
+        assert!(matches!(host_platform(), "macos" | "linux" | "other"));
+    }
+
+    #[test]
+    fn admin_applescript_is_inert_and_fixed_apart_from_the_path() {
+        let script = build_admin_applescript(
+            "/Applications/Splitway.app/Contents/Resources/bootstrap.sh",
+            "install",
+        );
+        // The path is injected only as an AppleScript string variable; the shell
+        // command is fixed and quotes it via `quoted form of`, never bare
+        // interpolation.
+        assert!(script.contains(
+            "set scriptPath to \"/Applications/Splitway.app/Contents/Resources/bootstrap.sh\""
+        ));
+        assert!(script
+            .contains("do shell script \"/bin/bash \" & quoted form of scriptPath & \" install\""));
+        assert!(script.ends_with("with administrator privileges"));
+        // The subcommand is the only other variable, and it is a fixed literal.
+        let disable = build_admin_applescript("/x/bootstrap.sh", "disable");
+        assert!(disable.contains("& \" disable\""));
+        assert!(!disable.contains("install"));
+    }
+
+    #[test]
+    fn admin_applescript_escapes_quotes_and_backslashes_in_the_path() {
+        // A pathological path can never break out of the AppleScript string
+        // literal: a `"` and a `\` are both escaped before injection.
+        let script = build_admin_applescript("/weird/a\"b\\c/bootstrap.sh", "install");
+        assert!(script.contains("set scriptPath to \"/weird/a\\\"b\\\\c/bootstrap.sh\""));
+        // Exactly one statement sets the path and exactly one runs the shell —
+        // the injected value adds no extra AppleScript statements.
+        assert_eq!(script.matches("do shell script").count(), 1);
+        assert_eq!(script.matches("set scriptPath to").count(), 1);
+    }
 }
diff --git a/splitway-gui-tauri/src/lib.rs b/splitway-gui-tauri/src/lib.rs
index a27673f..9bd3661 100644
--- a/splitway-gui-tauri/src/lib.rs
+++ b/splitway-gui-tauri/src/lib.rs
@@ -35,6 +35,15 @@
 //! view-models, so no mutation can write displayed state (the truth contract).
 //! `check_domain` is a one-shot route-check returning its own result; it is never
 //! folded into the VM. See [`docs/design/tauri-mutations.md`](../../docs/design/tauri-mutations.md).
+//!
+//! On macOS the shell also owns the **privileged service bootstrap**
+//! (`install_service` / `disable_service`): it escalates via `osascript ... with
+//! administrator privileges` to run the bundled `bootstrap.sh` as root — one
+//! native password prompt, no terminal. These keep the write-path shape exactly
+//! (do the work → fire refresh-now → never touch the VM); the real health then
+//! flows back through `view-model-changed`. `host_platform` lets the frontend
+//! branch the macOS-vs-Linux remediation copy. See
+//! [`docs/design/macos-self-install.md`](../../docs/design/macos-self-install.md).
 
 pub mod bridge;
 
@@ -71,6 +80,13 @@ pub fn run() {
             bridge::set_config,
             bridge::reload,
             bridge::check_domain,
+            // macOS self-install: escalate via osascript to install/disable the
+            // root LaunchDaemon; host_platform lets the frontend branch the
+            // remediation copy. Custom commands are not ACL-gated, so the
+            // capability file is unchanged.
+            bridge::install_service,
+            bridge::disable_service,
+            bridge::host_platform,
         ])
         .setup(move |app| {
             // Clone the Arc to the shared VM and an AppHandle into the poll
diff --git a/splitway-gui-tauri/tauri.bundle.macos.json b/splitway-gui-tauri/tauri.bundle.macos.json
new file mode 100644
index 0000000..6f5094a
--- /dev/null
+++ b/splitway-gui-tauri/tauri.bundle.macos.json
@@ -0,0 +1,26 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "build": {
+    "beforeBuildCommand": ""
+  },
+  "bundle": {
+    "active": true,
+    "targets": ["app"],
+    "icon": [
+      "resources/icons/32x32.png",
+      "resources/icons/128x128.png",
+      "resources/icons/128x128@2x.png",
+      "resources/icons/icon.icns",
+      "resources/icons/icon.ico"
+    ],
+    "resources": {
+      "resources/splitway-daemon": "splitway-daemon",
+      "resources/splitway": "splitway",
+      "resources/com.splitway.daemon.plist": "com.splitway.daemon.plist",
+      "resources/bootstrap.sh": "bootstrap.sh"
+    },
+    "macOS": {
+      "minimumSystemVersion": "11.0"
+    }
+  }
+}
diff --git a/splitway-gui-tauri/ui/src/api.ts b/splitway-gui-tauri/ui/src/api.ts
index 5443258..061774f 100644
--- a/splitway-gui-tauri/ui/src/api.ts
+++ b/splitway-gui-tauri/ui/src/api.ts
@@ -53,3 +53,28 @@ export function reload(): Promise<void> {
 export function checkDomain(domain: string): Promise<CheckOutcome> {
   return tauri.core.invoke<CheckOutcome>("check_domain", { domain });
 }
+
+// --- macOS self-install commands --------------------------------------------
+//
+// install/disable escalate via osascript (one native password prompt) to run the
+// bundled bootstrap as root; they resolve on success and reject with the error
+// string on failure (incl. a cancelled password dialog), so callers drive their
+// per-action lifecycle exactly like the mutation commands. Neither carries VM
+// truth — the real health arrives via the next view-model-changed.
+
+/** The host platform, so the UI can branch macOS-vs-Linux remediation copy. */
+export type HostPlatform = "macos" | "linux" | "other";
+
+export function hostPlatform(): Promise<HostPlatform> {
+  return tauri.core.invoke<HostPlatform>("host_platform");
+}
+
+/** Install & start the root Splitway LaunchDaemon (macOS; one password prompt). */
+export function installService(): Promise<void> {
+  return tauri.core.invoke<void>("install_service");
+}
+
+/** Stop the daemon and remove its LaunchDaemon plist (macOS). */
+export function disableService(): Promise<void> {
+  return tauri.core.invoke<void>("disable_service");
+}
diff --git a/splitway-gui-tauri/ui/src/app.ts b/splitway-gui-tauri/ui/src/app.ts
index bca6501..1177a96 100644
--- a/splitway-gui-tauri/ui/src/app.ts
+++ b/splitway-gui-tauri/ui/src/app.ts
@@ -52,6 +52,7 @@ import {
 import { configInputForInterface } from "./config-input";
 import { canUndoReadd } from "./domain-undo";
 import * as api from "./api";
+import type { HostPlatform } from "./api";
 import type { DomainCheckInfo, InterfaceInfo, StatusInfo, ViewModel } from "./bindings/view-model";
 
 /** How long the undo snackbar lingers before the delete is left committed. The
@@ -81,6 +82,10 @@ export interface Actions {
   setCheckInput(value: string): void;
   check(): void;
   resync(): void;
+  installService(): void;
+  armDisable(): void;
+  cancelDisable(): void;
+  disableService(): void;
 }
 
 // --- small builders ---------------------------------------------------------
@@ -612,8 +617,46 @@ function checkSection(lc: Lifecycle, actions: Actions): HTMLElement {
 
 // --- footer, message, toast, blockers --------------------------------------
 
-function footer(vm: ViewModel): HTMLElement {
-  return el("div", { class: "foot reveal d5", text: `config ${vm.config_path || "(unknown)"}` });
+function footer(vm: ViewModel, platform: HostPlatform, lc: Lifecycle, actions: Actions): HTMLElement {
+  const foot = el("div", { class: "foot reveal d5" });
+  foot.appendChild(el("span", { class: "config-path", text: `config ${vm.config_path || "(unknown)"}` }));
+  // A discreet "stop the service" control, macOS only (the app owns the
+  // privileged LaunchDaemon there): a rarely-used, mildly-destructive action, so
+  // it is a small link rather than a prominent button. Driven through the same
+  // daemon-first runMutation path; the poll thread surfaces NotRunning afterward.
+  //
+  // Confirmation is a TWO-CLICK arm, not window.confirm(): WKWebView suppresses
+  // native confirm dialogs (returns false), which would silently no-op the stop.
+  // First click arms ("Confirm" + "Cancel"); second click runs disable.
+  if (platform === "macos") {
+    const pending = isPending(lc, "disable");
+    if (pending) {
+      const stopping = el("button", { class: "foot-link", text: "Stopping…" }) as HTMLButtonElement;
+      stopping.type = "button";
+      stopping.disabled = true;
+      foot.appendChild(stopping);
+    } else if (lc.disableArmed) {
+      const confirm = el("button", { class: "foot-link danger", text: "Confirm stop" }) as HTMLButtonElement;
+      confirm.type = "button";
+      confirm.addEventListener("click", () => actions.disableService());
+      const cancel = el("button", { class: "foot-link", text: "Cancel" }) as HTMLButtonElement;
+      cancel.type = "button";
+      cancel.addEventListener("click", () => actions.cancelDisable());
+      foot.append(
+        el("span", { class: "confirm-q", text: "Stop the service?" }),
+        confirm,
+        cancel,
+      );
+    } else {
+      const stop = el("button", { class: "foot-link", text: "Stop the Splitway service" }) as HTMLButtonElement;
+      stop.type = "button";
+      stop.addEventListener("click", () => actions.armDisable());
+      foot.appendChild(stop);
+    }
+    const err = errorFor(lc, "disable");
+    if (err) foot.appendChild(actionError(err));
+  }
+  return foot;
 }
 
 function messageBanner(vm: ViewModel): HTMLElement | null {
@@ -691,7 +734,7 @@ function undoToast(lc: Lifecycle, actions: Actions): HTMLElement {
   return toast;
 }
 
-function blockerNode(blocker: BlockerView): HTMLElement {
+function blockerNode(blocker: BlockerView, lc: Lifecycle, actions: Actions): HTMLElement {
   const icon = el("div", { class: "ic" }, [blockerIcon(blocker.variant)]);
   const body = el("p");
   if (blocker.codeWord && blocker.body.includes("{}")) {
@@ -709,6 +752,23 @@ function blockerNode(blocker: BlockerView): HTMLElement {
     el("h2", { text: blocker.title }),
     body,
   ]);
+  // The in-app remediation button (macOS self-install) takes precedence over a
+  // copy-paste command: one click + the native password prompt. The poll thread
+  // re-polls after it resolves, so the screen moves on via the truth contract —
+  // this never edits lastVm.
+  if (blocker.action) {
+    const pending = isPending(lc, blocker.action.key);
+    const btn = el("button", {
+      class: "blk-action",
+      text: pending ? "Installing…" : blocker.action.label,
+    }) as HTMLButtonElement;
+    btn.type = "button";
+    btn.disabled = pending;
+    btn.addEventListener("click", () => actions.installService());
+    blk.appendChild(btn);
+    const err = errorFor(lc, blocker.action.key);
+    if (err) blk.appendChild(actionError(err));
+  }
   if (blocker.command) blk.appendChild(el("code", { class: "cmd", text: blocker.command }));
   return el("div", { class: "blocker" }, [blk]);
 }
@@ -719,10 +779,16 @@ function connectingNode(): HTMLElement {
   ]);
 }
 
-/** Pure builder: the whole UI from (vm, lifecycle, actions). `vm === null` only
- *  before the first event lands. */
-export function renderApp(vm: ViewModel | null, lc: Lifecycle, actions: Actions): Node[] {
-  const stage: Stage = vm ? stageFor(vm) : { kind: "connecting" };
+/** Pure builder: the whole UI from (vm, platform, lifecycle, actions). `vm ===
+ *  null` only before the first event lands. `platform` only affects the macOS
+ *  self-install affordances (blocker install button + footer stop link). */
+export function renderApp(
+  vm: ViewModel | null,
+  platform: HostPlatform,
+  lc: Lifecycle,
+  actions: Actions,
+): Node[] {
+  const stage: Stage = vm ? stageFor(vm, platform) : { kind: "connecting" };
   const children: Node[] = [topbar(stage)];
 
   if (stage.kind === "connecting") {
@@ -730,7 +796,7 @@ export function renderApp(vm: ViewModel | null, lc: Lifecycle, actions: Actions)
     return children;
   }
   if (stage.kind === "blocker") {
-    children.push(blockerNode(stage.blocker));
+    children.push(blockerNode(stage.blocker, lc, actions));
     return children;
   }
 
@@ -744,7 +810,7 @@ export function renderApp(vm: ViewModel | null, lc: Lifecycle, actions: Actions)
   );
   const message = messageBanner(live);
   if (message) children.push(message);
-  children.push(footer(live), undoToast(lc, actions));
+  children.push(footer(live, platform, lc, actions), undoToast(lc, actions));
   return children;
 }
 
@@ -759,6 +825,10 @@ function rootDataset(stage: Stage): { on: string; mode: string } {
 /** Boot the app into `root`: subscribe, fetch once, render, and wire controls. */
 export function start(root: HTMLElement): void {
   let lastVm: ViewModel | null = null; // the ONLY authoritative state; written only in applyVm
+  // The host platform, fetched once at boot (it cannot change). Defaults to a
+  // non-macOS value so the first paint never offers the macOS install button
+  // before we know; it is corrected before any blocker can render in practice.
+  let platform: HostPlatform = "other";
   const lc = newLifecycle();
   let undoTimer: ReturnType<typeof setTimeout> | null = null;
   let introStarted = false; // the staggered reveal plays once, on the first main paint
@@ -778,7 +848,7 @@ export function start(root: HTMLElement): void {
     const selStart = active instanceof HTMLInputElement ? active.selectionStart : null;
     const selEnd = active instanceof HTMLInputElement ? active.selectionEnd : null;
 
-    const stage: Stage = lastVm ? stageFor(lastVm) : { kind: "connecting" };
+    const stage: Stage = lastVm ? stageFor(lastVm, platform) : { kind: "connecting" };
     const ds = rootDataset(stage);
     root.dataset.on = ds.on;
     root.dataset.mode = ds.mode;
@@ -791,7 +861,7 @@ export function start(root: HTMLElement): void {
       root.classList.add("intro");
       setTimeout(() => root.classList.remove("intro"), 900);
     }
-    root.replaceChildren(...renderApp(lastVm, lc, actions));
+    root.replaceChildren(...renderApp(lastVm, platform, lc, actions));
 
     if (activeId) {
       const restored = document.getElementById(activeId);
@@ -807,6 +877,10 @@ export function start(root: HTMLElement): void {
   // The ONLY writer of lastVm.
   function applyVm(vm: ViewModel): void {
     lastVm = vm;
+    // Disarm the disable-confirm if the daemon is no longer reachably connected:
+    // the footer (and its armed prompt) only renders on the connected main stage,
+    // so a reconnect must not silently re-present a stale armed confirm.
+    if (vm.connection.health !== "Connected") lc.disableArmed = false;
     rerender();
   }
 
@@ -955,8 +1029,45 @@ export function start(root: HTMLElement): void {
     },
 
     resync: () => void runMutation("reload", () => api.reload()),
+
+    // macOS self-install: escalate via the native password prompt to install /
+    // disable the root service. Both go through the daemon-first runMutation
+    // shape — they touch no VM; the poll thread re-polls and the new health
+    // (NotRunning → PermissionDenied/Connected, or back to NotRunning) surfaces
+    // via view-model-changed.
+    installService: () => void runMutation("install", () => api.installService()),
+    // Disable is mildly destructive, so it is a two-click arm (window.confirm is
+    // unreliable under WKWebView). armDisable shows the inline Confirm/Cancel.
+    armDisable: () => {
+      lc.disableArmed = true;
+      // Announce for screen readers: the button was replaced by a confirm prompt
+      // (mirrors the delete/undo flow's announce — the destructive step is where
+      // SR users most need the heads-up).
+      announce("Stop the Splitway service? Confirm or cancel.");
+      rerender();
+    },
+    cancelDisable: () => {
+      lc.disableArmed = false;
+      rerender();
+    },
+    disableService: () => {
+      lc.disableArmed = false;
+      void runMutation("disable", () => api.disableService());
+    },
   };
 
+  // The platform cannot change; fetch it once so blocker copy/affordances branch
+  // correctly. A failure leaves the safe non-macOS default (no install button).
+  api
+    .hostPlatform()
+    .then((p) => {
+      platform = p;
+      rerender();
+    })
+    .catch(() => {
+      /* keep the default platform */
+    });
+
   // Subscribe BEFORE the initial fetch so no push is missed in the mount gap;
   // each event carries the whole VM (last-wins), so an event during the fetch is
   // benign and must not be clobbered by the older initial value.
diff --git a/splitway-gui-tauri/ui/src/contract-check.ts b/splitway-gui-tauri/ui/src/contract-check.ts
index 1208aeb..6941f81 100644
--- a/splitway-gui-tauri/ui/src/contract-check.ts
+++ b/splitway-gui-tauri/ui/src/contract-check.ts
@@ -26,7 +26,7 @@ export const _fixtureHasAllViewModelKeys: HasAllKeys<ViewModel> = sample;
 // 2. renderApp must accept a ViewModel (signature compatibility with the mirror).
 //    Never executed — purely a type assertion.
 export function _renderTypechecks(vm: ViewModel, actions: Actions): Node[] {
-  return renderApp(vm, newLifecycle(), actions);
+  return renderApp(vm, "macos", newLifecycle(), actions);
 }
 
 // 3. CheckOutcome must stay an exhaustively-handled discriminated union — locks
diff --git a/splitway-gui-tauri/ui/src/lifecycle.ts b/splitway-gui-tauri/ui/src/lifecycle.ts
index a6bc3bd..aff3ebd 100644
--- a/splitway-gui-tauri/ui/src/lifecycle.ts
+++ b/splitway-gui-tauri/ui/src/lifecycle.ts
@@ -21,8 +21,18 @@ import type { CheckOutcome } from "./bindings/view-model";
 
 /** A stable key per mutating control, for pending + per-action error tracking.
  *  `iface` is the interface-selector write (a `set_config` that round-trips the
- *  current backend/openvpn unchanged); `reload` is the apply-failed resync. */
-export type ActionKey = "toggle" | "add" | "iface" | "reload" | `remove:${string}`;
+ *  current backend/openvpn unchanged); `reload` is the apply-failed resync.
+ *  `install`/`disable` are the macOS privileged service actions (escalate via the
+ *  native password prompt) — tracked here so the blocker button / footer link show
+ *  a pending state and surface their own per-action error. */
+export type ActionKey =
+  | "toggle"
+  | "add"
+  | "iface"
+  | "reload"
+  | "install"
+  | "disable"
+  | `remove:${string}`;
 
 /** The one-shot CheckDomain query state — ephemeral, never folded into the VM. */
 export type CheckState = "idle" | "pending" | CheckOutcome;
@@ -57,6 +67,11 @@ export interface Lifecycle {
   check: CheckState;
   /** The ephemeral undo snackbar, or null when hidden. */
   undo: UndoState | null;
+  /** Whether the macOS "Stop the Splitway service" link is armed for confirmation
+   *  (a two-click confirm: the first click arms it, the second runs disable). The
+   *  webview's native `window.confirm` is unreliable under WKWebView, so the
+   *  confirmation is in-UI rather than a native dialog. */
+  disableArmed: boolean;
 }
 
 export function newLifecycle(): Lifecycle {
@@ -68,6 +83,7 @@ export function newLifecycle(): Lifecycle {
     ifaceInput: "",
     checkInput: "",
     check: "idle",
+    disableArmed: false,
     undo: null,
   };
 }
diff --git a/splitway-gui-tauri/ui/src/render.ts b/splitway-gui-tauri/ui/src/render.ts
index 02ff78b..60733e6 100644
--- a/splitway-gui-tauri/ui/src/render.ts
+++ b/splitway-gui-tauri/ui/src/render.ts
@@ -11,6 +11,7 @@
 // hold no authoritative state.
 
 import type { DriftVerdict, Health, StatusInfo, VerifyView, ViewModel } from "./bindings/view-model";
+import type { HostPlatform } from "./api";
 
 const SVG_NS = "http://www.w3.org/2000/svg";
 
@@ -91,8 +92,18 @@ export function blockerIcon(variant: BlockerVariant): SVGElement {
 
 export type BlockerVariant = "disconnected" | "no-permission" | "frozen" | "version" | "error";
 
+/** An in-app remediation button a blocker can offer (macOS self-install): the
+ *  one-click action that resolves the degraded state, instead of a copy-paste
+ *  terminal command. `key` selects which privileged command runs. Presentation
+ *  only — it is computed frontend-side from health + platform and is NOT part of
+ *  the serialized view-model, so it never touches the bindings contract. */
+export interface BlockerAction {
+  key: "install";
+  label: string;
+}
+
 /** A full-window blocker: a degraded state the user must resolve before the main
- *  UI is meaningful. Carries its own copy + fix command. */
+ *  UI is meaningful. Carries its own copy + (a fix command and/or an action). */
 export interface BlockerView {
   variant: BlockerVariant;
   /** "neutral" (informational, e.g. daemon down) vs "warn" (needs attention). */
@@ -104,6 +115,8 @@ export interface BlockerView {
   codeWord?: string;
   /** A copy-paste fix command shown in a code block. */
   command?: string;
+  /** An in-app remediation button (macOS), shown instead of / beside `command`. */
+  action?: BlockerAction;
 }
 
 /** The main-screen mode, mapped from the daemon's routing belief. Drives the
@@ -139,30 +152,76 @@ function frozenBlocker(configPath: string): BlockerView {
   };
 }
 
-/** Map a non-connected (or frozen) condition to its full-window blocker, or null
- *  when the main UI should render. ConfigInvalid is a blocker even while the link
- *  is healthy (the daemon froze on the last-good config). */
-function blockerFor(vm: ViewModel): BlockerView | null {
-  const health: Health = vm.connection.health;
-  if (health === "NotRunning" || health === "TransientError") {
+/** The `NotRunning` blocker. On macOS the daemon isn't a thing the user starts by
+ *  hand — the app installs it — so offer the one-click Install action (escalates
+ *  via the native password prompt) instead of a `systemctl` line that doesn't
+ *  apply. On Linux/other, keep the copy-paste status command. */
+function notRunningBlocker(platform: HostPlatform): BlockerView {
+  if (platform === "macos") {
     return {
-      variant: health === "NotRunning" ? "disconnected" : "error",
+      variant: "disconnected",
       tone: "neutral",
-      title: "Can't reach Splitway",
-      body: "The background service isn't responding. Make sure it's running, then it'll reconnect on its own.",
-      command: "systemctl status splitway",
+      title: "Splitway isn't running yet",
+      body: "Install the background service to start routing. You'll be asked for your password once — no Terminal needed.",
+      action: { key: "install", label: "Install & start the Splitway service" },
     };
   }
-  if (health === "PermissionDenied") {
+  return {
+    variant: "disconnected",
+    tone: "neutral",
+    title: "Can't reach Splitway",
+    body: "The background service isn't responding. Make sure it's running, then it'll reconnect on its own.",
+    command: "systemctl status splitway",
+  };
+}
+
+/** The `PermissionDenied` blocker. On macOS there are two ways to land here:
+ *  (a) the in-app installer added the user to the `splitway` group and macOS only
+ *  applies new group access at login — so the remaining step is a sign-out (NOT a
+ *  `usermod`, which is the wrong OS and already done); or (b) the user set up the
+ *  manual/sudo daemon, whose socket is root-only (no `--socket-group splitway`),
+ *  where signing out cannot help and re-running the installer migrates the service
+ *  to the group-reachable socket. So macOS offers BOTH the sign-out guidance and
+ *  the (idempotent) Install/repair action, since the view-model cannot tell the
+ *  two cases apart. On Linux, keep the add-to-group command + re-login guidance. */
+function permissionDeniedBlocker(platform: HostPlatform): BlockerView {
+  if (platform === "macos") {
     return {
       variant: "no-permission",
       tone: "warn",
-      title: "No permission to make changes",
-      body: "Your user isn't in the {} group. Add it, then sign out and back in.",
+      title: "Almost done — one more step",
+      body: "Splitway is running but your account can't reach it yet. If you installed it from this app, your account was added to the {} group — macOS applies new group access at login, so sign out and back in (or restart). If you set the service up manually, install the managed service below to grant access without sudo.",
       codeWord: "splitway",
-      command: "sudo usermod -aG splitway $USER",
+      action: { key: "install", label: "Install / repair the Splitway service" },
+    };
+  }
+  return {
+    variant: "no-permission",
+    tone: "warn",
+    title: "No permission to make changes",
+    body: "Your user isn't in the {} group. Add it, then sign out and back in.",
+    codeWord: "splitway",
+    command: "sudo usermod -aG splitway $USER",
+  };
+}
+
+/** Map a non-connected (or frozen) condition to its full-window blocker, or null
+ *  when the main UI should render. ConfigInvalid is a blocker even while the link
+ *  is healthy (the daemon froze on the last-good config). `platform` selects the
+ *  macOS self-install affordances over the Linux copy-paste commands. */
+function blockerFor(vm: ViewModel, platform: HostPlatform): BlockerView | null {
+  const health: Health = vm.connection.health;
+  if (health === "NotRunning") return notRunningBlocker(platform);
+  if (health === "TransientError") {
+    return {
+      variant: "error",
+      tone: "neutral",
+      title: "Can't reach Splitway",
+      body: "The background service isn't responding. Make sure it's running, then it'll reconnect on its own.",
+      command: platform === "macos" ? undefined : "systemctl status splitway",
     };
   }
+  if (health === "PermissionDenied") return permissionDeniedBlocker(platform);
   if (health === "VersionMismatch") {
     return {
       variant: "version",
@@ -178,10 +237,11 @@ function blockerFor(vm: ViewModel): BlockerView | null {
   return null;
 }
 
-/** Reduce the VM to the stage the window renders. */
-export function stageFor(vm: ViewModel): Stage {
+/** Reduce the VM to the stage the window renders. `platform` only affects blocker
+ *  copy/affordances (the main stage is platform-agnostic). */
+export function stageFor(vm: ViewModel, platform: HostPlatform): Stage {
   if (vm.connection.health === "Unknown") return { kind: "connecting" };
-  const blocker = blockerFor(vm);
+  const blocker = blockerFor(vm, platform);
   if (blocker) return { kind: "blocker", blocker };
   // Connected with a trustworthy status (dropped to null only on a non-status
   // reply, which `blockerFor` already routed to a blocker via health).
diff --git a/splitway-gui-tauri/ui/src/styles.css b/splitway-gui-tauri/ui/src/styles.css
index 7e24c69..33a8c10 100644
--- a/splitway-gui-tauri/ui/src/styles.css
+++ b/splitway-gui-tauri/ui/src/styles.css
@@ -819,6 +819,56 @@ select.sel:disabled {
   letter-spacing: 0.03em;
   border-top: 1px solid var(--border-soft);
   margin-top: 18px;
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 6px 14px;
+}
+.foot .config-path {
+  flex: 1;
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+/* A discreet "stop the service" control (macOS): a quiet text link, not a
+   prominent button — it is rarely used and mildly destructive. */
+.foot-link {
+  appearance: none;
+  border: none;
+  background: none;
+  cursor: pointer;
+  padding: 0;
+  font-family: var(--sans);
+  font-size: 11px;
+  letter-spacing: normal;
+  color: var(--text-dim);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  transition: color 0.15s;
+}
+.foot-link:hover:not(:disabled) {
+  color: var(--rose);
+}
+.foot-link:disabled {
+  cursor: default;
+  color: var(--text-faint);
+  text-decoration: none;
+}
+/* The armed "Confirm stop" link reads as the destructive option. */
+.foot-link.danger {
+  color: var(--rose);
+  font-weight: 600;
+}
+/* The inline "Stop the service?" prompt beside the Confirm/Cancel links. */
+.foot .confirm-q {
+  font-family: var(--sans);
+  font-size: 11px;
+  letter-spacing: normal;
+  color: var(--text-dim);
+}
+.foot .action-error {
+  flex-basis: 100%;
+  font-family: var(--sans);
+  letter-spacing: normal;
 }
 
 /* A transient daemon message (info/error), shown above the footer. */
@@ -987,6 +1037,33 @@ select.sel:disabled {
   padding: 10px 12px;
   border-radius: 9px;
 }
+/* The in-app remediation button (macOS self-install): a prominent primary
+   action inside the blocker, sized larger than the inline .btn since it is the
+   one thing the user should click here. */
+.blk-action {
+  appearance: none;
+  border: none;
+  cursor: pointer;
+  background: var(--accent);
+  color: #0d0f2b;
+  font-family: var(--sans);
+  font-weight: 600;
+  font-size: 13.5px;
+  height: 42px;
+  padding: 0 22px;
+  margin-top: 4px;
+  border-radius: 11px;
+  transition: filter 0.15s, background 0.15s;
+}
+.blk-action:hover:not(:disabled) {
+  filter: brightness(1.05);
+}
+.blk-action:disabled {
+  cursor: default;
+  background: var(--surface-2);
+  color: var(--text-dim);
+  filter: none;
+}
 
 /* --- utilities ------------------------------------------------------------ */
 
@@ -1013,6 +1090,8 @@ select.sel:disabled {
 
 .btn:focus-visible,
 .add:focus-visible,
+.blk-action:focus-visible,
+.foot-link:focus-visible,
 select.sel:focus-visible,
 .field:focus-visible,
 .switch:focus-visible,
diff --git a/splitway-gui-tauri/ui/test/stage.test.ts b/splitway-gui-tauri/ui/test/stage.test.ts
index fb54e7f..3cbbea8 100644
--- a/splitway-gui-tauri/ui/test/stage.test.ts
+++ b/splitway-gui-tauri/ui/test/stage.test.ts
@@ -59,7 +59,7 @@ function frozen(configPath: string): ViewModel {
 }
 
 test("frozen blocker points at the daemon's actual config path", () => {
-  const stage = stageFor(frozen("/home/user/.config/splitway/config.json"));
+  const stage = stageFor(frozen("/home/user/.config/splitway/config.json"), "linux");
   assert.equal(stage.kind, "blocker");
   if (stage.kind !== "blocker") return;
   assert.equal(stage.blocker.variant, "frozen");
@@ -67,7 +67,7 @@ test("frozen blocker points at the daemon's actual config path", () => {
 });
 
 test("frozen blocker falls back to the default path when unknown", () => {
-  const stage = stageFor(frozen(""));
+  const stage = stageFor(frozen(""), "linux");
   assert.equal(stage.kind === "blocker" && stage.blocker.command, "/var/lib/splitway/config.json");
 });
 
@@ -79,12 +79,59 @@ test("connection health maps to the right blocker / main", () => {
     ["TransientError", "error"],
   ];
   for (const [health, variant] of cases) {
-    const stage = stageFor(withHealth(health));
+    const stage = stageFor(withHealth(health), "linux");
     assert.equal(stage.kind, "blocker", `${health} should be a blocker`);
     if (stage.kind === "blocker") assert.equal(stage.blocker.variant, variant);
   }
-  assert.equal(stageFor(withHealth("Connected")).kind, "main");
-  assert.equal(stageFor(withHealth("Unknown")).kind, "connecting");
+  assert.equal(stageFor(withHealth("Connected"), "linux").kind, "main");
+  assert.equal(stageFor(withHealth("Unknown"), "linux").kind, "connecting");
+});
+
+test("macOS NotRunning offers the install action, not a systemctl command", () => {
+  const stage = stageFor(withHealth("NotRunning"), "macos");
+  assert.equal(stage.kind, "blocker");
+  if (stage.kind !== "blocker") return;
+  assert.equal(stage.blocker.variant, "disconnected");
+  // The one-click install button, no terminal command.
+  assert.equal(stage.blocker.action?.key, "install");
+  assert.equal(stage.blocker.command, undefined);
+});
+
+test("Linux NotRunning keeps the systemctl command, no install action", () => {
+  const stage = stageFor(withHealth("NotRunning"), "linux");
+  if (stage.kind !== "blocker") return assert.fail("expected a blocker");
+  assert.equal(stage.blocker.command, "systemctl status splitway");
+  assert.equal(stage.blocker.action, undefined);
+});
+
+test("macOS PermissionDenied gives sign-out guidance plus an install/repair action, not usermod", () => {
+  const stage = stageFor(withHealth("PermissionDenied"), "macos");
+  if (stage.kind !== "blocker") return assert.fail("expected a blocker");
+  assert.equal(stage.blocker.variant, "no-permission");
+  // No usermod (wrong OS); keep the sign-out guidance for the GUI-install path.
+  assert.equal(stage.blocker.command, undefined);
+  assert.match(stage.blocker.body, /sign out/i);
+  // ...and offer the idempotent install/repair action for the manual/sudo-daemon
+  // path (root-only socket), where signing out alone cannot grant GUI access.
+  assert.equal(stage.blocker.action?.key, "install");
+});
+
+test("Linux PermissionDenied keeps the usermod command", () => {
+  const stage = stageFor(withHealth("PermissionDenied"), "linux");
+  if (stage.kind !== "blocker") return assert.fail("expected a blocker");
+  assert.equal(stage.blocker.command, "sudo usermod -aG splitway $USER");
+});
+
+test("TransientError omits the systemctl command on macOS, keeps it on Linux", () => {
+  const mac = stageFor(withHealth("TransientError"), "macos");
+  if (mac.kind !== "blocker") return assert.fail("expected a blocker");
+  assert.equal(mac.blocker.variant, "error");
+  assert.equal(mac.blocker.command, undefined);
+  assert.equal(mac.blocker.action, undefined);
+
+  const linux = stageFor(withHealth("TransientError"), "linux");
+  if (linux.kind !== "blocker") return assert.fail("expected a blocker");
+  assert.equal(linux.blocker.command, "systemctl status splitway");
 });
 
 console.log(`stage: ${passed} passed`);
diff --git a/splitway-shared/src/config/mod.rs b/splitway-shared/src/config/mod.rs
index a16392e..ed66fa2 100755
--- a/splitway-shared/src/config/mod.rs
+++ b/splitway-shared/src/config/mod.rs
@@ -50,6 +50,7 @@ pub fn create_empty_config_at(path: &Path) -> Result<(), ConfigParseError> {
         enabled: default_enabled(),
         vpn_backend: VpnBackend::default(),
         openvpn: OpenVpnConfig::default(),
+        fallback_dns: None,
     };
     save_config_to(path, &empty_config)
 }
@@ -145,6 +146,17 @@ pub fn config_file_path() -> PathBuf {
     config_folder_path().join("config.json")
 }
 
+/// Whether `s` is a bare IPv4/IPv6 address literal — not a hostname, not empty,
+/// and with no surrounding or embedded whitespace. Used to validate resolver
+/// addresses before they reach a platform DNS command that interpolates them
+/// verbatim (e.g. the macOS `scutil` demote script: a non-IP value would malform
+/// the script rather than fail cleanly). `IpAddr` parsing is strict — it rejects
+/// trailing/leading spaces and embedded newlines — so this doubles as an
+/// injection guard. Pure; unit-tested without a live system.
+pub fn is_ip_literal(s: &str) -> bool {
+    s.parse::<std::net::IpAddr>().is_ok()
+}
+
 fn config_folder_path() -> PathBuf {
     // Resolve without panicking — this runs inside a long-lived daemon that
     // may be a systemd service where HOME is not guaranteed. Prefer
@@ -228,6 +240,16 @@ pub struct LocalConfig {
     /// pre-3c configs parsing; ignored unless `vpn_backend = openvpn`.
     #[serde(default)]
     pub openvpn: OpenVpnConfig,
+    /// Optional override for the off-tunnel fallback resolver used on platforms
+    /// that demote a hijacked system default (macOS — see
+    /// [`crate::platform::VpnInfo::demote_target`]). `None` (the default, and
+    /// always on Linux) means "use the physical primary interface's own DHCP
+    /// resolver", which the detector discovers; `Some(servers)` pins a specific
+    /// public resolver (e.g. `["203.0.113.9"]`) for non-corp DNS instead. Ignored on
+    /// platforms that do not demote. `#[serde(default)]` keeps older configs
+    /// (without this field) parsing unchanged.
+    #[serde(default)]
+    pub fallback_dns: Option<Vec<String>>,
 }
 
 #[derive(Debug)]
@@ -302,6 +324,8 @@ mod tests {
                 management: "127.0.0.1:7505".to_string(),
                 management_password_file: Some("/etc/splitway/mgmt.pass".to_string()),
             },
+            // A non-default value so the round-trip exercises the new field.
+            fallback_dns: Some(vec!["192.0.2.1".to_string()]),
         };
 
         let json = serde_json::to_string(&config).unwrap();
@@ -373,6 +397,21 @@ mod tests {
         assert!(!leftover_temp, "atomic_write left a temp file behind");
     }
 
+    #[test]
+    fn is_ip_literal_accepts_addresses_and_rejects_everything_else() {
+        assert!(is_ip_literal("192.0.2.1"));
+        assert!(is_ip_literal("2001:db8::1"));
+        // Rejected: a hostname, an empty element, and — critically for the
+        // unescaped `scutil` script — embedded whitespace or a newline.
+        assert!(!is_ip_literal("example.com"));
+        assert!(!is_ip_literal(""));
+        assert!(!is_ip_literal("192.0.2.1 q"));
+        assert!(!is_ip_literal(" 192.0.2.1"));
+        assert!(!is_ip_literal(
+            "192.0.2.1\nset State:/Network/Service/x/DNS"
+        ));
+    }
+
     #[test]
     fn save_config_to_round_trips() {
         let path = temp_config("save-round-trip");
@@ -382,6 +421,7 @@ mod tests {
             enabled: true,
             vpn_backend: VpnBackend::default(),
             openvpn: OpenVpnConfig::default(),
+            fallback_dns: None,
         };
         save_config_to(&path, &config).unwrap();
         let loaded = load_config_from(&path).unwrap();
diff --git a/splitway-shared/src/platform.rs b/splitway-shared/src/platform.rs
index d1b34ab..319b808 100755
--- a/splitway-shared/src/platform.rs
+++ b/splitway-shared/src/platform.rs
@@ -24,6 +24,21 @@ pub enum PlatformError {
 pub struct VpnInfo {
     pub interface_name: String,
     pub dns_servers: Vec<String>,
+    /// The resolver to fall back to for *non*-routed (off-tunnel) DNS when the
+    /// VPN client has hijacked the system **default** resolver rather than
+    /// scoping its DNS to the tunnel interface (observed on macOS: the corp
+    /// resolver is registered as the global default, so every query — not just
+    /// corp ones — would otherwise traverse the tunnel).
+    ///
+    /// `Some(servers)` means the backend must, in addition to scoping the corp
+    /// domains, **demote** the system default to these servers so non-corp DNS
+    /// resolves off-tunnel. Typically the physical primary interface's own DHCP
+    /// resolver, surfaced by the detector that found the default was overridden.
+    ///
+    /// `None` (the Linux case, and macOS when no default override is detected)
+    /// means scope-only: the platform already keeps the default off-tunnel, so
+    /// no demote is needed. Additive — backends that ignore it are unaffected.
+    pub demote_target: Option<Vec<String>>,
 }
 
 #[derive(Debug, Clone)]