diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 81060a5..246436c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,9 +1,9 @@
 # Release publishing — the *publishing* half. `release-please.yml` is the *versioning* half.
 #
-# Publishes all 43 `geiserx_*` workspace crates to crates.io for a `v{version}` tag, using
+# Publishes all 44 `geiserx_*` workspace crates to crates.io for a `v{version}` tag, using
 # crates.io **trusted publishing** (OIDC — no stored token). Driven by `scripts/publish-crates.sh`
 # (leaf-first dependency order, `SKIP_PUBLISHED=1` so a re-run resumes past already-published
-# crates, and self-healing through crates.io's sliding-window 429 rate limit — which a 43-crate
+# crates, and self-healing through crates.io's sliding-window 429 rate limit — which a 44-crate
 # release reliably trips).
 #
 # Triggers:
@@ -37,7 +37,7 @@ concurrency:
 
 jobs:
   publish-crates:
-    name: publish 43 crates to crates.io (trusted publishing)
+    name: publish 44 crates to crates.io (trusted publishing)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/Cargo.lock b/Cargo.lock
index 59fcc75..80f31cc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -653,7 +653,7 @@ dependencies = [
 
 [[package]]
 name = "checks"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "clap 4.6.1",
  "globwalk",
@@ -1840,7 +1840,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_tailscale"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "axum",
  "bytes",
@@ -1879,7 +1879,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_array256"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_bitset",
  "heapless",
@@ -1891,7 +1891,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_bart"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "cfg-if",
  "divan",
@@ -1910,7 +1910,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_bart_packetfilter"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_array256",
  "geiserx_ts_bart",
@@ -1925,7 +1925,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_bitset"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "cfg-if",
  "divan",
@@ -1935,14 +1935,14 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_capabilityversion"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "geiserx_ts_control"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -1985,7 +1985,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_control_noise"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -2010,7 +2010,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_control_serde"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -2028,7 +2028,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_dataplane"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "etherparse",
  "geiserx_ts_bart",
@@ -2045,7 +2045,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_derp"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "crypto_box",
@@ -2073,7 +2073,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_disco_protocol"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "aead 0.5.2",
  "crypto_box",
@@ -2087,11 +2087,11 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_dns_wire"
-version = "0.39.0"
+version = "0.40.0"
 
 [[package]]
 name = "geiserx_ts_dynbitset"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_bitset",
  "proptest",
@@ -2100,7 +2100,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_elixir"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_tailscale",
  "geiserx_ts_control",
@@ -2111,7 +2111,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_ffi"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "cbindgen",
  "geiserx_tailscale",
@@ -2123,7 +2123,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_forwarder"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "geiserx_ts_netstack_smoltcp",
@@ -2135,14 +2135,14 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_hexdump"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "heapless",
 ]
 
 [[package]]
 name = "geiserx_ts_host_net"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "ipnet",
  "thiserror 2.0.18",
@@ -2151,7 +2151,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_http_util"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "futures",
@@ -2172,7 +2172,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_keys"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "crypto_box",
  "ed25519-dalek 2.2.0",
@@ -2188,7 +2188,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_magicsock"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_disco_protocol",
  "geiserx_ts_keys",
@@ -2206,11 +2206,11 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_metrics"
-version = "0.39.0"
+version = "0.40.0"
 
 [[package]]
 name = "geiserx_ts_netcheck"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_control",
  "geiserx_ts_control_serde",
@@ -2228,7 +2228,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_netmon"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "tokio",
  "tracing",
@@ -2236,7 +2236,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_netstack_smoltcp"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "axum",
  "bytes",
@@ -2257,7 +2257,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_netstack_smoltcp_core"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "flume",
@@ -2271,7 +2271,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_netstack_smoltcp_socket"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "futures-io",
@@ -2282,7 +2282,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_nodecapability"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "cfg-if",
  "serde",
@@ -2291,7 +2291,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_overlay_router"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_bart",
  "geiserx_ts_packet",
@@ -2302,7 +2302,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_packet"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "crypto_box",
@@ -2311,7 +2311,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_packetfilter"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "hashbrown 0.17.1",
  "ipnet",
@@ -2321,7 +2321,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_packetfilter_serde"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_nodecapability",
  "geiserx_ts_peercapability",
@@ -2334,7 +2334,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_packetfilter_state"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "divan",
  "geiserx_ts_bart_packetfilter",
@@ -2347,7 +2347,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_peercapability"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "serde",
  "url",
@@ -2355,7 +2355,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_python"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_tailscale",
  "geiserx_ts_control",
@@ -2368,7 +2368,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_runtime"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -2413,14 +2413,14 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_time"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "proptest",
 ]
 
 [[package]]
 name = "geiserx_ts_tka"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "argon2 0.5.3",
  "blake2 0.10.6",
@@ -2432,7 +2432,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_tls_util"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "rcgen",
  "ring",
@@ -2447,14 +2447,14 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_transport"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_packet",
 ]
 
 [[package]]
 name = "geiserx_ts_transport_tun"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "geiserx_ts_hexdump",
@@ -2470,7 +2470,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_tunnel"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "aead 0.5.2",
  "base64 0.22.1",
@@ -2498,7 +2498,7 @@ dependencies = [
 
 [[package]]
 name = "geiserx_ts_underlay_router"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "geiserx_ts_packet",
  "geiserx_ts_transport",
@@ -6386,7 +6386,7 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "ts_cli_util"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "cfg-if",
  "clap 4.6.1",
@@ -6405,7 +6405,7 @@ dependencies = [
 
 [[package]]
 name = "ts_devtools"
-version = "0.39.0"
+version = "0.40.0"
 dependencies = [
  "bytes",
  "clap 4.6.1",
@@ -6421,7 +6421,7 @@ dependencies = [
 
 [[package]]
 name = "ts_test_util"
-version = "0.39.0"
+version = "0.40.0"
 
 [[package]]
 name = "tun-rs"
diff --git a/scripts/publish-crates.sh b/scripts/publish-crates.sh
index 8b6df3c..0520be9 100755
--- a/scripts/publish-crates.sh
+++ b/scripts/publish-crates.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Publish all 43 geiserx_* workspace crates to crates.io in leaf-first dependency order.
+# Publish all 44 geiserx_* workspace crates to crates.io in leaf-first dependency order.
 #
 # Names on crates.io are GLOBAL and PERMANENT — once published they cannot be deleted (only
 # yanked) or reused. Run this only when you are sure.
@@ -62,7 +62,7 @@ else
   echo "Inter-crate pins now at $WS_VERSION."
 fi
 
-# Leaf-first publish order (topologically sorted; facade at #40, bindings last).
+# Leaf-first publish order (topologically sorted; facade at #41, bindings last).
 CRATES=(
   geiserx_ts_bitset
   geiserx_ts_capabilityversion
@@ -102,6 +102,7 @@ CRATES=(
   geiserx_ts_dataplane
   geiserx_ts_control
   geiserx_ts_netcheck
+  geiserx_ts_netmon
   geiserx_ts_runtime
   geiserx_tailscale
   geiserx_ts_elixir
@@ -112,7 +113,7 @@ CRATES=(
 total=${#CRATES[@]}
 i=0
 # crates.io heavily rate-limits NEW crate names (~1 new crate per 10 min after a small burst).
-# On a 429 we parse its "try again after <RFC2822>" and sleep until then, so a 43-new-crate split
+# On a 429 we parse its "try again after <RFC2822>" and sleep until then, so a 44-new-crate split
 # publishes unattended (it just takes hours). Publishing new *versions* of existing crates is not
 # limited, so a resume after the burst flies through already-published ones via SKIP_PUBLISHED.
 # Max attempts to wait out a crates.io index-propagation lag for a single crate before giving up