diff --git a/Furious/Frozenlib/AGENTS.md b/Furious/Frozenlib/AGENTS.md
index 0552a785..3541114f 100644
--- a/Furious/Frozenlib/AGENTS.md
+++ b/Furious/Frozenlib/AGENTS.md
@@ -48,6 +48,11 @@ Read `Furious/Frozenlib/AppSettings.py` with `tests/test_frozenlib.py`; paths ar
 - Prefer argument vectors over shell strings. Require host helpers to bound individual external calls; workflow callers
   also account for the number of calls, retries, privilege interactions, and rollback. A helper timeout and a total
   operation deadline answer different questions; build-time commands and GUI-time mutation have different budgets.
+- `SingTUNRouting.py` owns sing-tun's Linux prerequisites, routing identifiers, command construction, privileged
+  helper processes/scripts, interface/DNS operations and exact cleanup checks. It remains independent of tun2socks'
+  managed routing state. The service holds one helper per attempt and supplies its cancellation event; this module
+  neither imports Service nor starts work during import. `tests/test_sing_tun_linux_host.py` covers the helper
+  boundary; `tests/test_sing_tun.py` covers its use by the service, with privileged Linux smoke testing separate.
 - Windows proxy calls, Linux desktop settings/host bridging, and macOS network-service operations are distinct
   paths. Application tun2socks host routing differs from backend-native TUN; preserve privilege, DNS restoration,
   and managed route cleanup for the selected path. Some helpers block synchronously and need caller-level
diff --git a/Furious/Service/AGENTS.md b/Furious/Service/AGENTS.md
index 2d5d91cd..e6d96cd9 100644
--- a/Furious/Service/AGENTS.md
+++ b/Furious/Service/AGENTS.md
@@ -55,12 +55,20 @@ source tree's root.
   `CustomSingTUNSettings`, while tun2socks uses `CustomTUNSettings`; edits and missing defaults must never import
   preferences from the other engine. Their repository/host policies remain independent while orchestration,
   leases and general utilities may be reused.
-- For sing-tun, resolve automatic and manual remote exclusions before native auto-routing, then require
+- For sing-tun, resolve automatic and manual remote exclusions before applying host routing, then require
   native readiness and checked DNS application before commit. `SingTUNHostPlan` owns only its assigned identifiers
   and DNS snapshots, independently of legacy `SystemRoutingTable.managedRoutes`; refuse ambiguous recovery and
   retain ownership for retry. Host preparation/DNS commands run in its owned worker, while synchronous compatibility
-  startup and bounded cleanup joins remain explicit responsiveness limits. Consult `tests/test_sing_tun.py` and
-  `tests/test_native_tun_semantics.py`; mocked host tests do not establish privileged OS behavior.
+  startup and bounded cleanup joins remain explicit responsiveness limits. Delegate Linux host operations to
+  `Frozenlib/SingTUNRouting.py`; the service retains attempt orchestration, its worker and the helper's lifetime.
+  Linux uses an attempt-owned PolicyKit
+  helper to create a persistent TUN owned by the calling user and configure routes/DNS; the unprivileged binding
+  receives external-configuration options only in its runtime copy. Windows/macOS retain native auto-routing.
+  Retain unfinished helpers and their cancellation scripts until they are reaped; cancellation does not grant
+  permission to forget an elevated process. Delete only an interface whose captured index matches, and
+  match complete policy-rule selectors rather than flushing tables or deleting priority ranges. Consult
+  `tests/test_sing_tun.py`, `tests/test_sing_tun_linux_host.py` and `tests/test_native_tun_semantics.py`;
+  mocked host tests do not establish privileged OS behavior.
 - Construct a runtime event router before asking a plugin to create its runtime. One lease owns the runtime/router from
   acquisition through attempt ownership, commit, and reverse-order release; commit changes logical delivery without
   replacing the runtime callback. Worker-thread exits are queued to the router's Qt thread, delivered at most once, and