T-Mobile Russia is an MVNO over Tele2 and inherits the base carrier's TSPU blocking. By late July 2026 OpenVPN, WireGuard, IKEv2/IPSec and legacy Shadowsocks are mass-blocked; XRay VLESS+Reality and AmneziaWG 2.0 still work; in "whitelist" mode no VPN works.

opencode 1.18.7 fails TLS verification on streaming responses to api.minimax.io because the embedded Bun runtime does not chase the YR2 cross-sign and the new LE root is not in any of its three CA sources. Fixed with a personal augmented CA bundle; every running opencode has to be bounced.