diff --git a/luci-app-network-modes/CODEX-v0.3.5.md b/luci-app-network-modes/CODEX-v0.3.5.md
new file mode 100644
index 00000000..c353c0bd
--- /dev/null
+++ b/luci-app-network-modes/CODEX-v0.3.5.md
@@ -0,0 +1,1176 @@
+# Network Modes v0.3.5 Development Codex
+
+**Target Version:** 0.3.5
+**Current Version:** 0.3.4
+**Release Date:** 2025-01-15
+**Priority:** High - Production Feature Completion
+**Maintainer:** SecuBox Development Team
+
+---
+
+## 🎯 Mission Statement
+
+Transform `luci-app-network-modes` from a **50% placeholder UI** into a **production-ready network mode switching system** by implementing real backend functionality for WireGuard relay, web proxy, HTTPS reverse proxy, advanced WiFi features, and packet capture.
+
+---
+
+## 📊 Current State Analysis (v0.3.4)
+
+### ✅ What's Production-Ready (50-60%)
+
+**Core Framework:**
+- ✅ Mode switching with 2-minute auto-rollback protection
+- ✅ UCI-based configuration persistence (26 options)
+- ✅ Automatic backup/restore (`/etc/network-modes-backup/`)
+- ✅ RPCD backend with 18 methods (1190 lines)
+- ✅ 7 JavaScript views with real RPC wiring
+- ✅ Status dashboard with interface/service monitoring
+
+**Basic Network Modes:**
+- ✅ Router mode: WAN/LAN, NAT, DHCP server, firewall zones
+- ✅ Access Point mode: WiFi channel, HT mode, TX power, bridge DHCP
+- ✅ Sniffer mode: Bridge config, promiscuous mode, Netifyd toggle
+- ✅ Relay mode: Basic STA+AP relay, relayd configuration
+
+### ❌ What's Placeholder (40-50%)
+
+**Router Mode Gaps:**
+- ❌ Web proxy (Squid/TinyProxy/Privoxy) - UI only, no config generation
+- ❌ HTTPS reverse proxy (Nginx/HAProxy) - no config files created
+- ❌ Let's Encrypt automation - no ACME integration
+- ❌ DNS over HTTPS - no DoH proxy setup
+- ❌ Virtual host deployment - stored in UCI but not applied
+
+**Access Point Mode Gaps:**
+- ❌ 802.11r Fast Roaming - flag set, no MDID/FT config
+- ❌ 802.11k RRM - no neighbor reports generated
+- ❌ 802.11v BSS Transition - no WNM/TFS rules
+- ❌ Band steering - no actual steering algorithm
+- ❌ Airtime fairness - flag only, no hostapd config
+
+**Relay Mode Gaps:**
+- ❌ WireGuard key generation - no wg genkey integration
+- ❌ WireGuard peer config - UI shows but backend doesn't deploy
+- ❌ MTU/MSS clamping - stored but no iptables rules created
+- ❌ TCP BBR congestion control - mentioned but not implemented
+- ❌ WireGuard interface up/down control
+
+**Sniffer Mode Gaps:**
+- ❌ PCAP capture to file - no tcpdump integration
+- ❌ Capture filter validation - stored but not applied
+- ❌ SPAN port config - not implemented
+- ❌ Wireshark export - mentioned only
+- ❌ Long-term packet storage management
+
+---
+
+## 🚀 Version 0.3.5 Goals
+
+### Primary Objectives
+
+1. **Implement WireGuard Relay Features** (Critical - 30% of v0.3.5)
+   - Generate WireGuard private/public keys
+   - Deploy peer configurations to `/etc/config/network`
+   - Create iptables MSS/MTU clamping rules
+   - Enable TCP BBR congestion control
+
+2. **Implement Web Proxy Features** (High - 25% of v0.3.5)
+   - Generate Squid configuration files
+   - Implement transparent proxy iptables rules
+   - Add TinyProxy/Privoxy as alternatives
+   - Create DNS over HTTPS proxy config
+
+3. **Implement HTTPS Reverse Proxy** (High - 20% of v0.3.5)
+   - Generate Nginx/HAProxy vhost configs
+   - Integrate ACME (Let's Encrypt) automation
+   - Implement certificate renewal cron jobs
+   - Add SSL certificate validation
+
+4. **Implement Advanced WiFi Features** (Medium - 15% of v0.3.5)
+   - Generate 802.11r MDID and FT keys
+   - Create 802.11k neighbor reports
+   - Implement basic band steering
+   - Add hostapd config for 802.11v
+
+5. **Implement Packet Capture Features** (Medium - 10% of v0.3.5)
+   - Integrate tcpdump for PCAP capture
+   - Add capture filter validation
+   - Implement PCAP rotation logic
+   - Create passive monitor mode config
+
+### Success Criteria
+
+- [ ] All 18 RPCD methods have real backend implementations (not just UCI storage)
+- [ ] Generated configs are validated before deployment
+- [ ] Services are automatically started/stopped/reloaded
+- [ ] Rollback mechanism restores service configs (not just UCI)
+- [ ] Integration tests pass for all 4 network modes
+- [ ] Documentation updated with real command examples
+- [ ] No placeholder comments remain in RPCD backend
+
+---
+
+## 🔧 Technical Implementation Plan
+
+### Phase 1: WireGuard Relay Features (Week 1-2)
+
+#### Task 1.1: WireGuard Key Management
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `generate_wireguard_keys()` (new)
+
+**Implementation:**
+```bash
+generate_wireguard_keys() {
+    # Check if wireguard-tools is installed
+    if ! command -v wg >/dev/null 2>&1; then
+        printf '{"error": "wireguard-tools not installed", "success": false}\n'
+        return 1
+    fi
+
+    # Generate private key
+    local privkey=$(wg genkey)
+    local pubkey=$(echo "$privkey" | wg pubkey)
+
+    # Store in UCI (encrypted private key)
+    uci set network-modes.relay.wg_private_key="$privkey"
+    uci set network-modes.relay.wg_public_key="$pubkey"
+    uci commit network-modes
+
+    printf '{"private_key": "%s", "public_key": "%s", "success": true}\n' \
+        "$privkey" "$pubkey"
+}
+```
+
+**Dependencies:**
+- `wireguard-tools` package
+- `/etc/config/network-modes` relay section
+
+**Validation:**
+- Keys are 44 characters base64
+- Public key derives from private key
+- UCI storage is persistent
+
+---
+
+#### Task 1.2: WireGuard Interface Deployment
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `apply_wireguard_config()` (new)
+
+**Implementation:**
+```bash
+apply_wireguard_config() {
+    local wg_enabled=$(uci -q get network-modes.relay.wireguard_enabled || echo "0")
+    [ "$wg_enabled" = "1" ] || return 0
+
+    local privkey=$(uci -q get network-modes.relay.wg_private_key)
+    local peer_pubkey=$(uci -q get network-modes.relay.wg_peer_pubkey)
+    local peer_endpoint=$(uci -q get network-modes.relay.wg_peer_endpoint)
+    local wg_port=$(uci -q get network-modes.relay.wg_port || echo "51820")
+    local wg_ip=$(uci -q get network-modes.relay.wg_ip || echo "10.200.200.2/24")
+
+    # Create WireGuard interface in /etc/config/network
+    uci set network.wg0=interface
+    uci set network.wg0.proto='wireguard'
+    uci set network.wg0.private_key="$privkey"
+    uci set network.wg0.listen_port="$wg_port"
+    uci add_list network.wg0.addresses="$wg_ip"
+
+    # Add peer
+    uci set network.wg0_peer=wireguard_wg0
+    uci set network.wg0_peer.public_key="$peer_pubkey"
+    uci set network.wg0_peer.endpoint_host="$peer_endpoint"
+    uci set network.wg0_peer.endpoint_port="$wg_port"
+    uci set network.wg0_peer.persistent_keepalive='25'
+    uci add_list network.wg0_peer.allowed_ips='0.0.0.0/0'
+
+    uci commit network
+    /etc/init.d/network reload
+}
+```
+
+**Config Example:**
+```uci
+config interface 'wg0'
+    option proto 'wireguard'
+    option private_key 'AAAA...ZZZZ='
+    option listen_port '51820'
+    list addresses '10.200.200.2/24'
+
+config wireguard_wg0
+    option public_key 'BBBB...YYYY='
+    option endpoint_host 'vpn.example.com'
+    option endpoint_port '51820'
+    option persistent_keepalive '25'
+    list allowed_ips '0.0.0.0/0'
+```
+
+---
+
+#### Task 1.3: MTU/MSS Clamping Rules
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `apply_mtu_clamping()` (new)
+
+**Implementation:**
+```bash
+apply_mtu_clamping() {
+    local mtu_optimize=$(uci -q get network-modes.relay.mtu_optimize || echo "0")
+    [ "$mtu_optimize" = "1" ] || return 0
+
+    local wg_mtu=$(uci -q get network-modes.relay.wg_mtu || echo "1420")
+    local mss_value=$((wg_mtu - 40))  # MTU - TCP/IP headers
+
+    # Add MSS clamping to firewall
+    uci set firewall.mss_clamping=rule
+    uci set firewall.mss_clamping.name='WireGuard MSS Clamping'
+    uci set firewall.mss_clamping.src='lan'
+    uci set firewall.mss_clamping.dest='wan'
+    uci set firewall.mss_clamping.proto='tcp'
+    uci set firewall.mss_clamping.tcp_flags='SYN'
+    uci set firewall.mss_clamping.target='TCPMSS'
+    uci set firewall.mss_clamping.set_mss="$mss_value"
+
+    uci commit firewall
+    /etc/init.d/firewall reload
+}
+```
+
+**iptables Rule Generated:**
+```bash
+iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380
+```
+
+---
+
+#### Task 1.4: TCP BBR Congestion Control
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `enable_tcp_bbr()` (new)
+
+**Implementation:**
+```bash
+enable_tcp_bbr() {
+    local tcp_optimize=$(uci -q get network-modes.relay.tcp_optimize || echo "0")
+    [ "$tcp_optimize" = "1" ] || return 0
+
+    # Check kernel support for BBR
+    if ! modprobe tcp_bbr 2>/dev/null; then
+        printf '{"error": "BBR not supported by kernel", "success": false}\n'
+        return 1
+    fi
+
+    # Enable BBR in sysctl
+    cat > /etc/sysctl.d/90-tcp-bbr.conf <<EOF
+net.core.default_qdisc=fq
+net.ipv4.tcp_congestion_control=bbr
+EOF
+
+    sysctl -p /etc/sysctl.d/90-tcp-bbr.conf
+
+    printf '{"success": true, "congestion_control": "bbr"}\n'
+}
+```
+
+**Validation:**
+```bash
+sysctl net.ipv4.tcp_congestion_control  # Should return: bbr
+```
+
+---
+
+### Phase 2: Web Proxy Features (Week 3-4)
+
+#### Task 2.1: Squid Proxy Configuration
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `generate_squid_config()` (new)
+
+**Implementation:**
+```bash
+generate_squid_config() {
+    local proxy_type=$(uci -q get network-modes.router.web_proxy || echo "none")
+    [ "$proxy_type" = "squid" ] || return 0
+
+    local proxy_port=$(uci -q get network-modes.router.proxy_port || echo "3128")
+    local cache_size=$(uci -q get network-modes.router.proxy_cache_size || echo "256")
+
+    # Generate Squid configuration
+    cat > /etc/squid/squid.conf <<EOF
+# SecuBox Network Modes - Squid Configuration
+# Generated: $(date)
+
+# Port configuration
+http_port $proxy_port transparent
+
+# Cache configuration
+cache_dir ufs /var/spool/squid $cache_size 16 256
+cache_mem 64 MB
+maximum_object_size 4096 KB
+minimum_object_size 0 KB
+
+# Access control
+acl localnet src 192.168.0.0/16
+acl localnet src 10.0.0.0/8
+acl localnet src fc00::/7
+acl SSL_ports port 443
+acl Safe_ports port 80
+acl Safe_ports port 443
+acl CONNECT method CONNECT
+
+http_access deny !Safe_ports
+http_access deny CONNECT !SSL_ports
+http_access allow localhost manager
+http_access deny manager
+http_access allow localnet
+http_access allow localhost
+http_access deny all
+
+# Logging
+access_log /var/log/squid/access.log squid
+cache_log /var/log/squid/cache.log
+
+# DNS nameservers
+dns_nameservers 1.1.1.1 8.8.8.8
+
+# Forwarding
+forwarded_for on
+via on
+EOF
+
+    # Initialize cache directory
+    mkdir -p /var/spool/squid
+    mkdir -p /var/log/squid
+    squid -z 2>/dev/null || true
+
+    # Restart Squid
+    /etc/init.d/squid restart
+
+    printf '{"success": true, "proxy": "squid", "port": %d}\n' "$proxy_port"
+}
+```
+
+**Dependencies:**
+- `squid` package
+- `/var/spool/squid` directory (cache)
+
+---
+
+#### Task 2.2: Transparent Proxy iptables Rules
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `apply_transparent_proxy_rules()` (new)
+
+**Implementation:**
+```bash
+apply_transparent_proxy_rules() {
+    local proxy_type=$(uci -q get network-modes.router.web_proxy || echo "none")
+    [ "$proxy_type" != "none" ] || return 0
+
+    local proxy_port=$(uci -q get network-modes.router.proxy_port || echo "3128")
+
+    # Add redirect rule to firewall
+    uci set firewall.proxy_redirect=redirect
+    uci set firewall.proxy_redirect.name='Transparent Web Proxy'
+    uci set firewall.proxy_redirect.src='lan'
+    uci set firewall.proxy_redirect.proto='tcp'
+    uci set firewall.proxy_redirect.src_dport='80'
+    uci set firewall.proxy_redirect.dest_port="$proxy_port"
+    uci set firewall.proxy_redirect.target='DNAT'
+
+    uci commit firewall
+    /etc/init.d/firewall reload
+}
+```
+
+**Generated Rule:**
+```bash
+iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 80 -j REDIRECT --to-ports 3128
+```
+
+---
+
+#### Task 2.3: DNS over HTTPS (DoH) Proxy
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `configure_doh_proxy()` (new)
+
+**Implementation:**
+```bash
+configure_doh_proxy() {
+    local doh_enabled=$(uci -q get network-modes.router.doh_enabled || echo "0")
+    [ "$doh_enabled" = "1" ] || return 0
+
+    local doh_provider=$(uci -q get network-modes.router.doh_provider || echo "cloudflare")
+
+    case "$doh_provider" in
+        cloudflare)
+            local doh_url="https://1.1.1.1/dns-query"
+            ;;
+        google)
+            local doh_url="https://dns.google/dns-query"
+            ;;
+        quad9)
+            local doh_url="https://dns.quad9.net/dns-query"
+            ;;
+        *)
+            local doh_url="https://1.1.1.1/dns-query"
+            ;;
+    esac
+
+    # Configure dnsmasq to use DNS over HTTPS
+    uci set dhcp.@dnsmasq[0].noresolv='1'
+    uci add_list dhcp.@dnsmasq[0].server="127.0.0.1#5053"
+    uci commit dhcp
+
+    # Configure https_dns_proxy
+    uci set https-dns-proxy.dns.bootstrap_dns='1.1.1.1,1.0.0.1'
+    uci set https-dns-proxy.dns.listen_addr='127.0.0.1'
+    uci set https-dns-proxy.dns.listen_port='5053'
+    uci set https-dns-proxy.dns.url_prefix="$doh_url"
+    uci commit https-dns-proxy
+
+    /etc/init.d/https-dns-proxy restart
+    /etc/init.d/dnsmasq restart
+
+    printf '{"success": true, "doh_provider": "%s"}\n' "$doh_provider"
+}
+```
+
+**Dependencies:**
+- `https-dns-proxy` package
+- dnsmasq with DoH support
+
+---
+
+### Phase 3: HTTPS Reverse Proxy (Week 5-6)
+
+#### Task 3.1: Nginx Virtual Host Generator
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `deploy_nginx_vhosts()` (new)
+
+**Implementation:**
+```bash
+deploy_nginx_vhosts() {
+    local https_frontend=$(uci -q get network-modes.router.https_frontend || echo "0")
+    [ "$https_frontend" = "1" ] || return 0
+
+    # Get list of virtual hosts from UCI
+    local vhost_count=0
+
+    # Clear existing vhost configs
+    rm -f /etc/nginx/conf.d/vhost-*.conf
+
+    # Iterate through virtual hosts stored in UCI
+    config_load network-modes
+    config_cb() {
+        local type="$1"
+        local name="$2"
+        [ "$type" = "vhost" ] || return 0
+
+        local domain backend_ip backend_port ssl_enabled
+        config_get domain "$name" domain
+        config_get backend_ip "$name" backend_ip
+        config_get backend_port "$name" backend_port "80"
+        config_get ssl_enabled "$name" ssl "0"
+
+        [ -n "$domain" ] || return 0
+
+        # Generate Nginx vhost config
+        cat > /etc/nginx/conf.d/vhost-${name}.conf <<EOF
+# Virtual Host: $domain
+# Backend: $backend_ip:$backend_port
+# SSL: $ssl_enabled
+
+server {
+    listen 80;
+    server_name $domain;
+
+$(if [ "$ssl_enabled" = "1" ]; then
+    echo "    # Redirect to HTTPS"
+    echo "    return 301 https://\$server_name\$request_uri;"
+else
+    echo "    location / {"
+    echo "        proxy_pass http://$backend_ip:$backend_port;"
+    echo "        proxy_set_header Host \$host;"
+    echo "        proxy_set_header X-Real-IP \$remote_addr;"
+    echo "        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;"
+    echo "        proxy_set_header X-Forwarded-Proto \$scheme;"
+    echo "    }"
+fi)
+}
+
+$(if [ "$ssl_enabled" = "1" ]; then
+    cat <<SSLEOF
+server {
+    listen 443 ssl http2;
+    server_name $domain;
+
+    ssl_certificate /etc/acme/$domain/fullchain.cer;
+    ssl_certificate_key /etc/acme/$domain/$domain.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    location / {
+        proxy_pass http://$backend_ip:$backend_port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+SSLEOF
+fi)
+EOF
+
+        vhost_count=$((vhost_count + 1))
+    }
+
+    config_load network-modes
+
+    # Reload Nginx
+    /etc/init.d/nginx reload
+
+    printf '{"success": true, "vhosts_deployed": %d}\n' "$vhost_count"
+}
+```
+
+**Generated Config Example:**
+```nginx
+# Virtual Host: app.example.com
+server {
+    listen 443 ssl http2;
+    server_name app.example.com;
+
+    ssl_certificate /etc/acme/app.example.com/fullchain.cer;
+    ssl_certificate_key /etc/acme/app.example.com/app.example.com.key;
+
+    location / {
+        proxy_pass http://192.168.1.100:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+---
+
+#### Task 3.2: Let's Encrypt ACME Integration
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `issue_letsencrypt_cert()` (new)
+
+**Implementation:**
+```bash
+issue_letsencrypt_cert() {
+    local domain="$1"
+    [ -n "$domain" ] || return 1
+
+    local acme_email=$(uci -q get network-modes.router.acme_email)
+    [ -n "$acme_email" ] || acme_email="admin@$domain"
+
+    # Install acme.sh if not present
+    if [ ! -f /usr/lib/acme/acme.sh ]; then
+        opkg update
+        opkg install acme acme-dnsapi
+    fi
+
+    # Issue certificate using HTTP-01 challenge
+    /usr/lib/acme/acme.sh --issue \
+        -d "$domain" \
+        --webroot /www \
+        --accountemail "$acme_email" \
+        --force
+
+    if [ $? -eq 0 ]; then
+        # Install certificate
+        /usr/lib/acme/acme.sh --install-cert \
+            -d "$domain" \
+            --cert-file /etc/acme/$domain/cert.cer \
+            --key-file /etc/acme/$domain/$domain.key \
+            --fullchain-file /etc/acme/$domain/fullchain.cer \
+            --reloadcmd "/etc/init.d/nginx reload"
+
+        printf '{"success": true, "domain": "%s", "expires": 90}\n' "$domain"
+    else
+        printf '{"success": false, "error": "ACME challenge failed"}\n'
+        return 1
+    fi
+}
+```
+
+**Auto-Renewal Cron Job:**
+```bash
+# Add to /etc/crontabs/root
+0 0 * * * /usr/lib/acme/acme.sh --cron --home /etc/acme
+```
+
+---
+
+#### Task 3.3: SSL Certificate Validation
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `validate_ssl_cert()` (new)
+
+**Implementation:**
+```bash
+validate_ssl_cert() {
+    local domain="$1"
+    [ -n "$domain" ] || return 1
+
+    local cert_file="/etc/acme/$domain/fullchain.cer"
+    [ -f "$cert_file" ] || {
+        printf '{"valid": false, "error": "Certificate not found"}\n'
+        return 1
+    }
+
+    # Check expiration date
+    local expiry_date=$(openssl x509 -enddate -noout -in "$cert_file" | cut -d= -f2)
+    local expiry_epoch=$(date -d "$expiry_date" +%s 2>/dev/null || echo "0")
+    local now_epoch=$(date +%s)
+    local days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
+
+    if [ "$days_left" -lt 0 ]; then
+        printf '{"valid": false, "expired": true, "days_left": %d}\n' "$days_left"
+        return 1
+    fi
+
+    # Check certificate chain
+    local issuer=$(openssl x509 -issuer -noout -in "$cert_file" | grep -o 'Let.*Encrypt')
+
+    printf '{"valid": true, "domain": "%s", "days_left": %d, "issuer": "%s"}\n' \
+        "$domain" "$days_left" "$issuer"
+}
+```
+
+---
+
+### Phase 4: Advanced WiFi Features (Week 7-8)
+
+#### Task 4.1: 802.11r Fast Roaming
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `configure_80211r()` (new)
+
+**Implementation:**
+```bash
+configure_80211r() {
+    local ft_enabled=$(uci -q get network-modes.accesspoint.ieee80211r || echo "0")
+    [ "$ft_enabled" = "1" ] || return 0
+
+    local ssid=$(uci -q get wireless.@wifi-iface[0].ssid)
+    local mobility_domain=$(echo -n "$ssid" | md5sum | cut -c1-4)
+
+    # Configure hostapd for 802.11r
+    uci set wireless.@wifi-iface[0].ieee80211r='1'
+    uci set wireless.@wifi-iface[0].mobility_domain="$mobility_domain"
+    uci set wireless.@wifi-iface[0].ft_over_ds='1'
+    uci set wireless.@wifi-iface[0].ft_psk_generate_local='1'
+    uci set wireless.@wifi-iface[0].reassociation_deadline='1000'
+
+    uci commit wireless
+    wifi reload
+
+    printf '{"success": true, "mobility_domain": "%s"}\n' "$mobility_domain"
+}
+```
+
+**hostapd Config Generated:**
+```
+mobility_domain=a1b2
+ft_over_ds=1
+ft_psk_generate_local=1
+reassociation_deadline=1000
+```
+
+---
+
+#### Task 4.2: 802.11k Neighbor Reports
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `configure_80211k()` (new)
+
+**Implementation:**
+```bash
+configure_80211k() {
+    local rrm_enabled=$(uci -q get network-modes.accesspoint.ieee80211k || echo "0")
+    [ "$rrm_enabled" = "1" ] || return 0
+
+    # Enable RRM in hostapd
+    uci set wireless.@wifi-iface[0].ieee80211k='1'
+    uci set wireless.@wifi-iface[0].rrm_neighbor_report='1'
+    uci set wireless.@wifi-iface[0].rrm_beacon_report='1'
+
+    uci commit wireless
+    wifi reload
+
+    printf '{"success": true, "rrm_enabled": true}\n'
+}
+```
+
+**hostapd Config:**
+```
+rrm_neighbor_report=1
+rrm_beacon_report=1
+```
+
+---
+
+#### Task 4.3: Band Steering Algorithm
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `enable_band_steering()` (new)
+
+**Implementation:**
+```bash
+enable_band_steering() {
+    local band_steering=$(uci -q get network-modes.accesspoint.band_steering || echo "0")
+    [ "$band_steering" = "1" ] || return 0
+
+    # Check if both 2.4GHz and 5GHz radios exist
+    local radio_2g=$(uci show wireless | grep "radio.*band='2g'" | cut -d. -f2 | cut -d= -f1 | head -n1)
+    local radio_5g=$(uci show wireless | grep "radio.*band='5g'" | cut -d. -f2 | cut -d= -f1 | head -n1)
+
+    if [ -z "$radio_2g" ] || [ -z "$radio_5g" ]; then
+        printf '{"success": false, "error": "Dual-band radios required"}\n'
+        return 1
+    fi
+
+    # Enable hostapd band steering (requires wpa_supplicant)
+    uci set wireless.@wifi-iface[0].bss_load_update_period='60'
+    uci set wireless.@wifi-iface[0].chan_util_avg_period='600'
+    uci set wireless.@wifi-iface[0].disassoc_low_ack='1'
+
+    uci commit wireless
+    wifi reload
+
+    printf '{"success": true, "band_steering": "enabled"}\n'
+}
+```
+
+---
+
+### Phase 5: Packet Capture Features (Week 9)
+
+#### Task 5.1: tcpdump PCAP Capture
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `start_packet_capture()` (new)
+
+**Implementation:**
+```bash
+start_packet_capture() {
+    local pcap_enabled=$(uci -q get network-modes.sniffer.pcap_capture || echo "0")
+    [ "$pcap_enabled" = "1" ] || return 0
+
+    local capture_filter=$(uci -q get network-modes.sniffer.capture_filter || echo "")
+    local capture_interface=$(uci -q get network-modes.sniffer.capture_interface || echo "br-lan")
+    local max_size=$(uci -q get network-modes.sniffer.pcap_max_size || echo "100")
+    local rotate_count=$(uci -q get network-modes.sniffer.pcap_rotate || echo "10")
+
+    # Create capture directory
+    mkdir -p /var/log/pcap
+
+    # Kill existing tcpdump
+    killall tcpdump 2>/dev/null
+
+    # Start tcpdump with rotation
+    tcpdump -i "$capture_interface" \
+        -w /var/log/pcap/capture.pcap \
+        -C "$max_size" \
+        -W "$rotate_count" \
+        ${capture_filter:+-s 0 $capture_filter} \
+        >/dev/null 2>&1 &
+
+    local tcpdump_pid=$!
+    echo "$tcpdump_pid" > /var/run/tcpdump.pid
+
+    printf '{"success": true, "pid": %d, "interface": "%s"}\n' \
+        "$tcpdump_pid" "$capture_interface"
+}
+```
+
+**tcpdump Command Example:**
+```bash
+tcpdump -i br-lan -w /var/log/pcap/capture.pcap -C 100 -W 10 -s 0 'port 80 or port 443'
+```
+
+---
+
+#### Task 5.2: Capture Filter Validation
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `validate_pcap_filter()` (new)
+
+**Implementation:**
+```bash
+validate_pcap_filter() {
+    local filter="$1"
+    [ -n "$filter" ] || {
+        printf '{"valid": true, "filter": "all"}\n'
+        return 0
+    }
+
+    # Test filter syntax with tcpdump
+    if tcpdump -i any -d "$filter" >/dev/null 2>&1; then
+        printf '{"valid": true, "filter": "%s"}\n' "$filter"
+        return 0
+    else
+        printf '{"valid": false, "error": "Invalid BPF syntax"}\n'
+        return 1
+    fi
+}
+```
+
+**Valid Filter Examples:**
+- `port 80 or port 443` - HTTP/HTTPS traffic
+- `tcp and not port 22` - All TCP except SSH
+- `host 192.168.1.100` - Specific host
+- `net 10.0.0.0/8` - Network range
+
+---
+
+#### Task 5.3: PCAP Rotation Management
+**File:** `root/usr/libexec/rpcd/luci.network-modes`
+**Method:** `cleanup_old_pcaps()` (new)
+
+**Implementation:**
+```bash
+cleanup_old_pcaps() {
+    local max_age=$(uci -q get network-modes.sniffer.pcap_retention_days || echo "7")
+    local pcap_dir="/var/log/pcap"
+
+    # Find and delete old PCAP files
+    local deleted_count=0
+    find "$pcap_dir" -name "*.pcap*" -mtime +${max_age} -type f | while read -r pcap_file; do
+        rm -f "$pcap_file"
+        deleted_count=$((deleted_count + 1))
+    done
+
+    # Calculate total size
+    local total_size=$(du -sm "$pcap_dir" 2>/dev/null | cut -f1 || echo "0")
+
+    printf '{"success": true, "deleted": %d, "total_size_mb": %d}\n' \
+        "$deleted_count" "$total_size"
+}
+```
+
+**Cron Job for Auto-Cleanup:**
+```bash
+# Add to /etc/crontabs/root
+0 2 * * * /usr/libexec/rpcd/luci.network-modes call cleanup_old_pcaps
+```
+
+---
+
+## 🧪 Testing & Validation
+
+### Unit Tests
+
+**Test File:** `tests/test-network-modes.sh` (new)
+
+```bash
+#!/bin/sh
+# Network Modes v0.3.5 Test Suite
+
+test_wireguard_keys() {
+    echo "Testing WireGuard key generation..."
+    result=$(ubus call luci.network-modes generate_wireguard_keys)
+    privkey=$(echo "$result" | jsonfilter -e '@.private_key')
+    pubkey=$(echo "$result" | jsonfilter -e '@.public_key')
+
+    [ ${#privkey} -eq 44 ] || { echo "FAIL: Private key length"; return 1; }
+    [ ${#pubkey} -eq 44 ] || { echo "FAIL: Public key length"; return 1; }
+
+    echo "PASS: WireGuard keys generated"
+}
+
+test_squid_config() {
+    echo "Testing Squid configuration..."
+    uci set network-modes.router.web_proxy='squid'
+    result=$(ubus call luci.network-modes generate_squid_config)
+
+    [ -f /etc/squid/squid.conf ] || { echo "FAIL: Squid config not created"; return 1; }
+    grep -q "http_port 3128 transparent" /etc/squid/squid.conf || { echo "FAIL: Wrong port"; return 1; }
+
+    echo "PASS: Squid config generated"
+}
+
+test_nginx_vhost() {
+    echo "Testing Nginx virtual host deployment..."
+    uci set network-modes.router.https_frontend='1'
+    uci set network-modes.vhost1=vhost
+    uci set network-modes.vhost1.domain='test.example.com'
+    uci set network-modes.vhost1.backend_ip='192.168.1.100'
+    uci set network-modes.vhost1.backend_port='8080'
+    uci commit network-modes
+
+    result=$(ubus call luci.network-modes deploy_nginx_vhosts)
+    vhost_count=$(echo "$result" | jsonfilter -e '@.vhosts_deployed')
+
+    [ "$vhost_count" -ge 1 ] || { echo "FAIL: No vhosts deployed"; return 1; }
+    [ -f /etc/nginx/conf.d/vhost-vhost1.conf ] || { echo "FAIL: Vhost config not created"; return 1; }
+
+    echo "PASS: Nginx vhost deployed"
+}
+
+test_80211r_config() {
+    echo "Testing 802.11r configuration..."
+    uci set network-modes.accesspoint.ieee80211r='1'
+    result=$(ubus call luci.network-modes configure_80211r)
+
+    mobility_domain=$(uci -q get wireless.@wifi-iface[0].mobility_domain)
+    [ -n "$mobility_domain" ] || { echo "FAIL: No mobility domain"; return 1; }
+
+    echo "PASS: 802.11r configured (MDID: $mobility_domain)"
+}
+
+test_pcap_capture() {
+    echo "Testing packet capture..."
+    uci set network-modes.sniffer.pcap_capture='1'
+    result=$(ubus call luci.network-modes start_packet_capture)
+
+    pid=$(echo "$result" | jsonfilter -e '@.pid')
+    [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null || { echo "FAIL: tcpdump not running"; return 1; }
+
+    killall tcpdump
+    echo "PASS: Packet capture started"
+}
+
+# Run all tests
+test_wireguard_keys
+test_squid_config
+test_nginx_vhost
+test_80211r_config
+test_pcap_capture
+
+echo ""
+echo "Test suite completed."
+```
+
+---
+
+### Integration Tests
+
+**Test Scenarios:**
+
+1. **Router Mode with Squid + Nginx**
+   - Enable web_proxy=squid
+   - Add 2 virtual hosts
+   - Issue Let's Encrypt certificates
+   - Verify transparent proxy redirects HTTP traffic
+   - Verify Nginx proxies HTTPS to backends
+
+2. **Access Point with 802.11r/k/v**
+   - Enable all WiFi optimization flags
+   - Connect 2 devices
+   - Force roaming between APs
+   - Verify FT handshake occurs (<50ms)
+   - Check neighbor reports in hostapd
+
+3. **Relay Mode with WireGuard**
+   - Generate WireGuard keys
+   - Configure peer endpoint
+   - Apply MTU/MSS clamping
+   - Enable TCP BBR
+   - Verify tunnel UP
+   - Test throughput (should be >90% of baseline)
+
+4. **Sniffer Mode with PCAP**
+   - Start packet capture with filter "port 80"
+   - Generate HTTP traffic
+   - Verify PCAP files created
+   - Check rotation works (10 files max)
+   - Cleanup old captures (7 day retention)
+
+---
+
+## 📋 Pre-Release Checklist
+
+### Code Quality
+- [ ] All RPCD methods return valid JSON
+- [ ] Error handling for missing dependencies (wireguard-tools, squid, nginx, tcpdump)
+- [ ] Input validation for user-provided data (domains, IPs, filters)
+- [ ] No hardcoded passwords or secrets
+- [ ] Shellcheck passes on all RPCD scripts
+- [ ] No placeholder comments remain
+
+### Functionality
+- [ ] WireGuard keys generate correctly
+- [ ] Squid config includes cache and ACLs
+- [ ] Nginx vhosts proxy to backends
+- [ ] Let's Encrypt certificates issue successfully
+- [ ] 802.11r MDID is consistent across APs
+- [ ] tcpdump captures with BPF filters
+- [ ] PCAP rotation works (file count limit)
+- [ ] All services start/stop/reload correctly
+
+### Safety
+- [ ] Rollback mechanism restores service configs
+- [ ] Backup includes /etc/squid/, /etc/nginx/, /etc/acme/
+- [ ] Config validation before apply
+- [ ] No destructive operations without confirmation
+- [ ] Service failures don't brick the router
+
+### Documentation
+- [ ] README.md updated with real command examples
+- [ ] Dependency list includes new packages
+- [ ] Configuration examples for each mode
+- [ ] Troubleshooting section added
+- [ ] API documentation for new RPCD methods
+
+### Testing
+- [ ] Unit tests pass (test-network-modes.sh)
+- [ ] Integration tests pass (all 4 modes)
+- [ ] Manual testing on real hardware
+- [ ] Performance benchmarks (WireGuard throughput, proxy latency)
+- [ ] Security audit (no command injection, XSS in UI)
+
+---
+
+## 🚢 Release Process
+
+### Version Bump
+```bash
+# Update Makefile
+sed -i 's/PKG_VERSION:=0.3.4/PKG_VERSION:=0.3.5/' luci-app-network-modes/Makefile
+sed -i 's/PKG_RELEASE:=1/PKG_RELEASE:=1/' luci-app-network-modes/Makefile
+
+# Update README.md
+sed -i 's/Version: 0.3.4/Version: 0.3.5/' luci-app-network-modes/README.md
+
+# Update MODULE_STATUS.md
+# (Update implementation percentage to 85-90%)
+```
+
+### Git Workflow
+```bash
+# Commit changes
+git add luci-app-network-modes/
+git commit -m "feat(network-modes): Implement v0.3.5 production features
+
+- WireGuard: Key generation, peer config, MTU clamping, TCP BBR
+- Web Proxy: Squid config, transparent proxy, DoH
+- HTTPS: Nginx vhosts, Let's Encrypt, SSL validation
+- WiFi: 802.11r/k/v implementation, band steering
+- Sniffer: tcpdump integration, PCAP rotation
+
+Closes #XX, #YY, #ZZ"
+
+# Tag release
+git tag -a v0.3.5 -m "Release v0.3.5: Production Feature Completion
+
+Major Features:
+- WireGuard relay with automatic key management
+- Web proxy with Squid/TinyProxy support
+- HTTPS reverse proxy with Let's Encrypt
+- Advanced WiFi (802.11r/k/v)
+- Packet capture with rotation
+
+Testing:
+- All unit tests passing
+- Integration tests on x86_64, ARM64
+- Performance benchmarks included
+
+Breaking Changes: None
+Migration: Automatic (UCI config preserved)"
+
+# Push
+git push origin master --tags
+```
+
+### Build & Deploy
+```bash
+# Build packages for all architectures
+./secubox-tools/local-build.sh build luci-app-network-modes
+
+# Test on staging router
+scp build/x86-64/luci-app-network-modes_0.3.5-1_all.ipk root@staging:/tmp/
+ssh root@staging "opkg install /tmp/luci-app-network-modes_0.3.5-1_all.ipk"
+
+# Deploy to production
+# (After testing succeeds)
+```
+
+---
+
+## 🎓 Implementation Guidelines
+
+### Code Style
+- Follow existing RPCD patterns in `luci.network-modes`
+- Use UCI for all configuration storage
+- Return JSON with `{"success": true/false}` for all methods
+- Log errors to `/var/log/network-modes.log`
+- Use helper functions for repetitive tasks
+
+### Security Best Practices
+- Validate all user input (domains, IPs, ports, filters)
+- Escape shell variables: `"$var"` not `$var`
+- Use `uci -q get` to avoid errors on missing configs
+- Check command existence: `command -v cmd >/dev/null`
+- Don't store passwords in UCI (use /etc/shadow or encrypted storage)
+
+### Performance Considerations
+- Don't restart services unnecessarily (use reload)
+- Cache expensive operations (WireGuard key generation)
+- Use background jobs for long operations (Let's Encrypt)
+- Implement timeouts for external commands
+- Clean up temp files after operations
+
+### Error Handling
+```bash
+# Example error handling pattern
+do_operation() {
+    local result
+    result=$(some_command 2>&1) || {
+        logger -t network-modes "ERROR: some_command failed: $result"
+        printf '{"success": false, "error": "%s"}\n' "$result"
+        return 1
+    }
+
+    printf '{"success": true, "result": "%s"}\n' "$result"
+}
+```
+
+---
+
+## 📊 Success Metrics
+
+**Completion Targets:**
+- Implementation: 85-90% (up from 50-60%)
+- Feature Parity: 18/18 RPCD methods fully functional
+- Test Coverage: 90%+ unit tests passing
+- Documentation: 100% of new features documented
+- Performance: <5% overhead vs manual configuration
+
+**User Impact:**
+- One-click WireGuard VPN setup (vs 30+ manual commands)
+- Automatic HTTPS with Let's Encrypt (vs hours of nginx config)
+- Professional web proxy in 2 clicks (vs Squid complexity)
+- WiFi roaming optimization (vs hostapd expertise required)
+- Network-wide packet capture (vs tcpdump command-line)
+
+---
+
+## 🔗 References
+
+**OpenWrt Documentation:**
+- [UCI Configuration](https://openwrt.org/docs/guide-user/base-system/uci)
+- [WireGuard Setup](https://openwrt.org/docs/guide-user/services/vpn/wireguard/start)
+- [Nginx on OpenWrt](https://openwrt.org/docs/guide-user/services/webserver/nginx)
+- [hostapd WiFi](https://openwrt.org/docs/guide-user/network/wifi/basic)
+
+**External Tools:**
+- [Squid Proxy](http://www.squid-cache.org/Doc/)
+- [Let's Encrypt ACME](https://letsencrypt.org/docs/)
+- [tcpdump Filters](https://www.tcpdump.org/manpages/pcap-filter.7.html)
+- [802.11r/k/v Guide](https://www.intel.com/content/www/us/en/support/articles/000054799/)
+
+**SecuBox Integration:**
+- [DEVELOPMENT-GUIDELINES.md](../DEVELOPMENT-GUIDELINES.md)
+- [QUICK-START.md](../QUICK-START.md)
+- [MODULE_STATUS.md](../DOCS/MODULE_STATUS.md)
+
+---
+
+**Next Steps:**
+1. Review this codex with team
+2. Assign tasks to developers
+3. Set up development branches
+4. Begin Phase 1 (WireGuard) implementation
+5. Weekly progress reviews
+
+**Questions/Feedback:** Contact maintainers or open GitHub issue
+
+---
+
+*Generated: 2025-12-28*
+*Codex Version: 1.0*
+*Target Release: 2025-01-15*