GeForce NOW refuses to stream when it decides you are on a VPN, and it never inspects routing: a visible utun carrying a 100.64/10 address, plus a DNS resolver that is not the gateway, is the whole tell. Tailscale trips both with no exit node set, where not one streamed packet enters the tunnel. Separately, AirDrop's awdl0 radio hops the Wi-Fi card off-channel mid-match — measured on blueberry, the difference between avg 18 ms / max 80 ms and avg 3.5 / max 18 on the gateway hop. Two unrelated faults, one moment you hit them. So Fleet & System gains a single switch that pauses the tailnet, pins awdl0 down and makes AirDrop undiscoverable, and puts all three back on the way out — discoverability to the setting it found, not a guess. The submenu reports what the machine actually is rather than what the switch was told, including the exact tell GFN reads, and it tells a radio that is merely idle apart from one Slab is holding: macOS parks awdl0 on its own and raises it again unasked. Auto-detect engages on GeForce NOW's launch and stands down when it quits; a hold set by hand outlives the app that happened to be open. Holding the radio needs root, so a small LaunchDaemon watches a flag file this app owns — one admin prompt ever, and until it is installed the mode does the tailnet half alone, which is what keeps an unattended engage from raising a dialog over a running game. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>