A Shadowrocket policy-group failure leaves the VPN toggle green and only the traffic that hashed into that group dead. Open the group: is the selection empty, a name missing from the subscription, or a URL Test stuck on a probe nobody answers? Manually select a node you can browse with, prove the web, then repair automation. Perfect rules plus an empty group is still a black hole.
Hit logic: exceptions and groups overview. Misleading latency: URL Test. Empty subscription rows: update fail or expired. App: download.
Three kinds of empty
UI empty: the group contains zero nodes—template rendered [] or a filter ate every name. Reference empty: names on screen, connect fails immediately, because the id was deleted and the label remained. Probe empty: nodes would load a page, the probe URL is blocked, the group declares everyone dead and fails open to DIRECT or a pessimistic last member.
Bypass the group: pick a node that still sits in the raw subscription list. If that works, nodes and rules are not the villain. If that fails, go to DNS or decrypt. Do not mash Update on an empty group—the template may regenerate empty.
| Type | Typical failure | First move |
|---|---|---|
| select | Stuck on a deleted name | Pick one that still exists |
| url-test | Probe URL all-timeout | Change probe or switch to select |
| fallback | A half-dead member still “up” | Manual second member |
| load-balance | Session pinned to the corpse | Temporarily select |
Filters, emoji renames, nesting
Providers rename HK to 香港 and your filter HK goes empty. Filter on a stable field or build a tiny hand-made select of five nodes you actually use. Restored backups reintroduce the dead filter—backup.
More than two layers: Streaming → Auto → Region → node. Any hollow layer greens the outer chip and kills the inner path. Collapse to “business group contains nodes.” Cycles burn battery and mimic On Demand bugs; exclude rings before you touch On Demand.
When handoff and modules sit on the same minute
Leaving office Wi-Fi, url-test has not finished; the group still points at a pop that only exists on that SSID. Timing, not a forever-broken group—handoff. Wait one probe cycle or pick by hand.
A REJECT module that eats the probe URL makes every member look dead. Disable modules until numbers appear. See REJECT. Decrypt will also fail probes on certs; keep it off while you debug groups.
Once manual select works, stop worshipping url-test
If a hand-picked node opens the site, you do not owe URL Test a successful evening. Five subscription refreshes still spawn an empty group: screenshot traffic and expiry. Expired → that article. Not expired → delete the filter keyword. Guides: hub. FAQ: FAQ. Do not paste a stranger’s group block over a profile that still works.
Shadowrocket is a rule client; a group is only an egress picker. Write group name, selection, and last subscription time on the first line of a note so tomorrow you can tell a provider rename from your own filter.