@@ -17,7 +17,8 @@ comments, everything. Do not emit Chinese in project files.
 - **Delivered in layers**: L1 TLS/TCP → L2 Mux → L3 QUIC. Each layer ships to
   internal testing and leaves a fix-back window. No big-bang release.
 - **All three layers are delivered** (L1 and L2 on 2026-08-27, L3 on 2026-08-29),
-  together with the release tail. A bare `nowhere://key@host:port` — a QUIC node,
+  together with the release tail and L4 — IPv6 end to end, `pin` on the QUIC
+  carrier, node failover, a scheduled subscription refresh and a tile. A bare `nowhere://key@host:port` — a QUIC node,
   because the specification defaults both directions to `udp` — connects and
   carries traffic, and the oracle differential agrees on every case over every
   carrier combination. What has *not* happened is a physical device: every device
@@ -32,7 +33,7 @@ comments, everything. Do not emit Chinese in project files.
 | `app/src/main/jni/` | Vendored lwIP and its JNI bridge, inherited from the donor, plus the QUIC bridge and the library's export map |
 | `tools/quic/` | The QUIC stack's pinned commits and the script that fetches and builds them. Not vendored (D-17); the conformance probe reads the same pin |
 | `conformance/` | Byte-level vectors, self-verifying checker, end-to-end smoke test, drift detection, test matrix |
-| `app/src/main/assets/rules/` | The bundled rule set (D-14), network-structural tier only, carrying a provenance header |
+| `app/src/main/assets/rules/` | The bundled rule set (D-14), network-structural tier only, both address families, carrying a provenance header |
 | `docs/` | Architecture, the design system, i18n, brand, privacy, store policy, and the TLS exporter ADR |
 
 The lwIP layer is inherited from `NodePassProject/Anywhere-Android` (GPL-3.0) at
@@ -325,6 +326,59 @@ Two rules from those documents that reach into protocol code:
     oracle differential caught split-UDP diverging when the framing was attached
     to the flow instead. `DatagramLane` is the shared piece both directions use.
 
+33. **A poll interval is not a protocol deadline.** `MuxCarrier.readStream`
+    answers three things with three values, and **0 means "nothing in the last
+    250 ms"** rather than a verdict. `open` read it as one, so a Portal that
+    answered a SYN slower than a quarter of a second was reported as
+    "authentication most likely failed" — the most misleading sentence
+    available. A dedicated lane gives the same protocol step fifteen seconds;
+    the carrier now gives it the same, because how long a Portal takes to dial
+    a target belongs to the target rather than to the carrier.
+34. **A rejected flow must not be reset.** The rejection *is* the teardown — the
+    Portal answers and forgets the stream in the same breath — and section 3
+    says STREAM data for an unknown flow is a **carrier** error. So a RST after
+    a rejection closes the whole connection and fails every other flow on it.
+    The trigger is ordinary and permanent: Android's Private DNS probes port 853
+    the moment a tunnel comes up, the Portal answers `DIAL_FAILED`, and whichever
+    shard the probe landed on lost its other flows half a second later. One to
+    four of sixteen concurrent fetches came back empty, intermittently. This
+    client now sends no RST at all; reading one stays implemented, because the
+    Portal may send one.
+35. **The TUN was one route away from carrying IPv6.** `LWIP_IPV6` was on, the
+    netif had a valid v6 address, the bridge threaded `is_ipv6` through every
+    callback, `FakeIpPool` minted `fc00::/96`, `RoutingRules` had a v6 trie, and
+    an IPv6 Portal host parsed — all switched off by a builder that added one
+    IPv4 address and one `0.0.0.0/0` route. And the leak was narrower than it
+    looked: a destination reached by *name* never leaked, because AAAA is
+    answered NODATA by design and the **name** is what travels to the Portal.
+    Only a literal IPv6 destination left the tunnel.
+36. **A declined DNS query must be forwarded to whatever resolver exists**, not
+    only to one of the family it arrived over. The reply is written back from
+    the address the device addressed, whatever family the forward was dialled
+    over. Requiring a match meant that on an IPv6-only network every query the
+    interceptor declines — MX, SRV, PTR, and the HTTPS records a browser asks
+    for before it connects — was answered SERVFAIL while A and AAAA kept
+    working, which reads as the site being broken.
+37. **`getHostAddress` does not agree with itself across implementations for
+    IPv6.** One prints `fd66::2` and another `fd66:0:0:0:0:0:0:2`. A device test
+    comparing printed forms passes or fails for reasons unrelated to the
+    tunnel; compare `InetAddress.address` bytes.
+38. **A Portal container that publishes only TCP makes every QUIC connection
+    look like a client defect.** It does not refuse — it waits out the handshake
+    deadline and reports a timeout. A round of the certificate work was spent
+    debugging that as a verification failure before `-p PORT:PORT/udp` was the
+    answer.
+39. **`TunnelController.state` is process-wide and outlives the test that set
+    it.** "Wait until it is not Connecting" is true before the service has run,
+    because the state before a start is Disconnected; "wait until it is Failed"
+    is true because the *previous* test failed. Both were written and both
+    passed vacuously. Wait on something `@Before` clears.
+40. **Lint's `StartActivityAndCollapseDeprecated` is not suppressible.** Neither
+    `@Suppress` nor `@SuppressLint` on the enclosing function silences it, even
+    inside the `Build.VERSION` check that makes the call safe. The tile
+    therefore calls `startActivity` below API 34 and opens the app with the
+    shade still over it, which is recorded rather than left to be rediscovered.
+
 ## Already verified — do not redo
 
 - The donor project `Anywhere-Android` **builds clean** on this toolchain
 
@@ -19,19 +19,23 @@ which is a QUIC node, because the specification's default for both directions is
 | Protocol, L2 | TLS Mux. Sixteen concurrent flows measured over four connections, at upstream's stated shard density |
 | Protocol, L3 | QUIC: authentication, TCP flows over reliable streams, UDP over DATAGRAM with fragmentation, split flows across two carriers |
 | Carriers | All four combinations — `tcp/tcp`, `udp/udp`, `udp/tcp`, `tcp/udp` — compared case by case against the reference implementation, which agrees on every one |
-| Tunnel | `VpnService` + lwIP, TCP with back-pressure, UDP, DNS interception with fake-IP, live throughput |
-| Routing | A rule matcher, an import path, a bundled network-structural rule set, a direct path, a reject path |
+| Tunnel | `VpnService` + lwIP, **both address families**, TCP with back-pressure, UDP, DNS interception with fake-IP over IPv4 and IPv6, live throughput |
+| Routing | A rule matcher, an import path, a bundled network-structural rule set for both families, a direct path, a reject path |
 | Per-app | A real installed list, a persisted selection, and this client structurally outside its own tunnel |
-| Nodes | Stored, imported from a `nowhere://` link, probed for reachability |
-| Subscription | Fetching and parsing, with upstream's actual quota semantics |
-| UI | Nine screens, both themes, three locales |
+| Nodes | Stored, imported from a `nowhere://` link, probed for reachability, and failed over when one cannot be reached |
+| Subscription | Fetching and parsing with upstream's actual quota semantics, and a periodic refresh that is off until asked for |
+| UI | Nine screens, both themes, three locales, and a quick-settings tile |
 
 **What is not done**, stated as plainly as the rest:
 
 - **Nothing has ever run on physical hardware.** Every device result is from an
   emulator. Private DNS over DoT, IPv6-only and NAT64 networks, a real Wi-Fi to
   cellular change, Doze and a path MTU below 1500 are all things an emulator
   cannot represent, and all things a VPN meets on the first real device.
+- **Start on boot is deliberately absent.** Android's always-on VPN starts the
+  tunnel before applications run and can block traffic while it is down; an
+  in-app boot receiver would be a worse version of it. Settings links to the
+  system switch instead.
 - **The QUIC carrier does not verify a certificate chain.** `pin` works on both
   carriers; a node carrying `sni` is refused rather than carried without it. See
   [ADR-0002](docs/adr-0002-quic-certificate-verification.md).
@@ -50,8 +54,9 @@ There is no big-bang release.
 | **L2** · TLS Mux | The Mux carrier at upstream's own shard density, and concurrency measured over it | **Done**, 2026-08-27 |
 | **L3** · QUIC | ngtcp2 over aws-lc, authentication, TCP over reliable streams, UDP over DATAGRAM, split flows across two carriers, keep-alive, and every carrier combination compared against the reference implementation | **Done**, 2026-08-29 |
 | **Release tail** | A bundled rule set, a connection log that shows what the Portal actually said, a launcher icon, a release build that has been run rather than only produced, and the documents a VPN-class listing requires | **Done**, 2026-08-29 |
+| **L4** · product surface | IPv6 end to end, `pin` on the QUIC carrier, node health and failover, a scheduled subscription refresh and a quick-settings tile | **Done**, 2026-08-29 |
 | **Device pass** | The first run on physical hardware: Private DNS, a real per-app list, a Wi-Fi to cellular change, Doze, a path MTU below 1500 | **Not started.** No physical device has ever been attached to this project |
-| **L4** · product surface | Subscription refresh, latency testing, encrypted DNS. Scope deliberately not fixed before a device pass says what the product actually needs | **Not started** |
+| **L5** · what the device pass asks for | Chain verification against `sni` on QUIC ([ADR-0002](docs/adr-0002-quic-certificate-verification.md)), and whatever a real phone turns out to need | **Not started**, deliberately: scope fixed after a device pass, not before |
 | **Publication** | A signing key, a distribution channel, a first release | **Waiting on decisions rather than on code** |
 
 ### How much of it is done
@@ -66,9 +71,9 @@ from the table.
 | Layer | Rows | Covered by a test | Partly, with the gap named | Blocked |
 |---|---|---|---|---|
 | L1 | 63 | 62 | 1 | 0 |
-| L2 | 21 | 20 | 1 | 0 |
+| L2 | 23 | 22 | 1 | 0 |
 | L3 | 27 | 25 | 2 | 0 |
-| **Total** | **111** | **107** | **4** | **0** |
+| **Total** | **113** | **109** | **4** | **0** |
 
 The four partial rows are each half of a pair: this client's half is tested, and
 the other half needs something no repository can contain — a running dashboard, a
 
@@ -168,7 +168,8 @@ Three things, which is the argument for writing it rather than assuming it:
 
 # L2
 
-Twenty-one rows, added when the Mux carrier landed. The same three states, and
+Twenty-three rows, added when the Mux carrier landed and extended when a
+concurrency measurement that had been passing vacuously was repaired. The same three states, and
 the same rule: no row is silent.
 
 | # | Case | State | Covered by |
@@ -183,6 +184,8 @@ the same rule: no row is silent.
 | 8 | RST must be the only flag with `value=0` | covered | `MuxHeaderVectorTest.everyRejectionVectorIsRefused` (both halves: `ResetNotAlone` and `ResetWithValue`) |
 | 9 | Any other flag bit set is rejected | covered | `MuxHeaderVectorTest.everyReservedFlagBitIsRejected` |
 | 10 | Late FIN and RST processing is idempotent | covered | `MuxCarrierTest.lateFinAndResetAreIdempotent`. This row found a real defect: the first carrier treated a late FIN as data for an unknown flow and tore itself down whenever any flow closed |
+| 10a | A rejected flow is released, never reset | covered | `MuxCarrierRefusalTest.aRejectedFlowIsReleasedRatherThanReset`. **The mirror of row 10, from this client's side, and a defect until 2026-08-29.** Section 3 makes STREAM data for an unknown flow a *carrier* error, and the Portal forgets a refused stream as it answers — so a RST after a rejection closed the connection and failed every other flow multiplexed onto it. Found on a device: Android's Private DNS probes port 853 the moment a tunnel comes up, the Portal answers `DIAL_FAILED`, and one to four of sixteen concurrent fetches came back empty depending on which shard the probe landed on. This client now writes no RST at all |
+| 10b | A slow SYN answer is waited for, not called a refusal | covered | `MuxCarrierTest.aPortalThatTakesItsTimeAnsweringIsNotAFailedAuthentication`, `.theSetupDeadlineIsTheDedicatedLanesRatherThanAPollInterval`. The carrier gave the setup byte a 250 ms queue-poll interval where a dedicated lane gives the identical protocol step fifteen seconds, and reported anything slower as "authentication most likely failed" |
 | 11 | Payload needs both credits before queueing | covered | `MuxCarrierCreditTest.aWindowWithFlowZeroReplenishesTheConnection` — stream credit alone is shown not to be enough. Verified to fail: removing the connection-credit check turns it red |
 | 12 | WINDOW with `flowId=0` replenishes connection credit | covered | as row 11 |
 | 13 | Credit beyond the configured window closes the carrier | covered | `MuxCreditTest.creditBeyondTheWindowIsRefused`, `MuxCarrierCreditTest.creditBeyondTheWindowClosesTheCarrier` |
 
@@ -121,30 +121,6 @@ else
     note "IPv4 only, so nothing here exercises the v6 half. Re-run on a network that has it."
 fi
 
-head2 "3b. What the platform actually built"
-# Read from the device rather than from the source: Builder.addAddress accepts
-# what it is given and establish() returns null rather than explaining itself,
-# so a family Android declined looks exactly like one it did not.
-TUN_IFACE="$(sh 'ip -4 addr show' | grep -B2 '10\.66\.0\.2' | head -1 | sed 's/^[0-9]*: \([^:]*\).*/\1/')"
-if [ -z "$TUN_IFACE" ]; then
-    note "no interface carries 10.66.0.2, so the tunnel is not up. Start it and re-run; §4 brings it up on its own."
-else
-    echo "  tunnel interface: $TUN_IFACE"
-    TUN_V4="$(sh "ip -4 addr show dev $TUN_IFACE" | grep -c 'inet ' || true)"
-    TUN_V6="$(sh "ip -6 addr show dev $TUN_IFACE" | grep -c 'inet6' || true)"
-    TUN_ROUTE6="$(sh "ip -6 route show dev $TUN_IFACE" | grep -c 'default\|^::/0' || true)"
-    if [ "${TUN_V4:-0}" -gt 0 ] && [ "${TUN_V6:-0}" -gt 0 ]; then
-        pass "$TUN_IFACE carries both families"
-    else
-        miss "$TUN_IFACE carries v4=$TUN_V4 v6=$TUN_V6 — the platform declined a family this client declares, and the DNS layer is minting placeholders for it"
-    fi
-    if [ "${TUN_ROUTE6:-0}" -gt 0 ]; then
-        pass "an IPv6 default route points into $TUN_IFACE"
-    else
-        miss "no IPv6 default route into $TUN_IFACE, so v6 traffic leaves the device outside the tunnel"
-    fi
-fi
-
 head2 "3c. A synthetic IPv6 address, end to end"
 # The v6 half of the fake-IP layer, proved with nothing but this device: the
 # name is resolved through the tunnel's own resolver, which answers AAAA with an
@@ -192,6 +168,67 @@ for CARRIER in tcp udp; do
     fi
 done
 
+head2 "4a. What the platform actually built"
+# Read from the device rather than from the source: Builder.addAddress accepts
+# what it is given and establish() returns null rather than explaining itself,
+# so a family Android declined looks exactly like one it did not. The
+# instrumentation case brings the tunnel up itself and reads the interface while
+# it is there, which a shell probe between two other checks cannot.
+if adb -s "$DEVICE" shell am instrument -w \
+        -e class eu.nodepass.somewhere.vpn.TunFamiliesOnDeviceTest \
+        -e nowhereE2ePortal "$PORTAL" \
+        -e nowhereE2eKey "${NOWHERE_E2E_KEY:-conformance-smoke-key}" \
+        eu.nodepass.somewhere.test/androidx.test.runner.AndroidJUnitRunner 2>/dev/null \
+        | tee /tmp/somewhere-families.log | grep -q "^OK ("; then
+    pass "the TUN carries both families at the MTU asked for"
+else
+    miss "TUN families: $(grep -m1 'stack=' /tmp/somewhere-families.log | cut -c1-200)"
+fi
+
+# ── 4b. Failing over to another node ────────────────────────────────────────
+# Two nodes, one that cannot be reached. The instrumentation case is the
+# assertion; this runs it here so the whole device pass is still one command,
+# and so a phone with a real network is what it runs on.
+head2 "4b. Failover"
+if adb -s "$DEVICE" shell am instrument -w \
+        -e class eu.nodepass.somewhere.vpn.FailoverOnDeviceTest \
+        -e nowhereE2ePortal "$PORTAL" \
+        eu.nodepass.somewhere.test/androidx.test.runner.AndroidJUnitRunner 2>/dev/null \
+        | tee /tmp/somewhere-failover.log | grep -q "^OK ("; then
+    pass "an unreachable node is recorded as unreachable, and a refused one is not"
+else
+    miss "failover: $(grep -m1 'stack=' /tmp/somewhere-failover.log | cut -c1-160)"
+fi
+
+# ── 4c. The background surface ──────────────────────────────────────────────
+head2 "4c. Subscription refresh, and the tile"
+if adb -s "$DEVICE" shell am instrument -w \
+        -e class eu.nodepass.somewhere.subscription.SubscriptionRefreshScheduleTest \
+        eu.nodepass.somewhere.test/androidx.test.runner.AndroidJUnitRunner 2>/dev/null \
+        | tee /tmp/somewhere-refresh.log | grep -q "^OK ("; then
+    pass "the platform accepts the refresh schedule, persists it, and drops it with the switch"
+else
+    miss "refresh schedule: $(grep -m1 'stack=' /tmp/somewhere-refresh.log | cut -c1-160)"
+fi
+
+# Whether the job ever *fires* is Doze's decision and cannot be asserted from
+# here; it can be provoked, which is a different thing and worth saying so.
+if [ "${EMULATED:-0}" = "1" ]; then
+    note "Doze is not real on an emulator. On a phone: adb shell cmd deviceidle force-idle, wait, then adb shell cmd jobscheduler run -f $APP_ID 0x50FA, and check the subscription's timestamp moved."
+else
+    note "to see the refresh actually fire under Doze: adb shell cmd deviceidle force-idle, then adb shell cmd jobscheduler run -f $APP_ID 0x50FA, then look at the subscription timestamp on the Nodes screen."
+fi
+
+# Asked of the package manager's own resolution rather than of the manifest:
+# a tile declared but not resolvable — a missing intent-filter, a permission
+# the system does not accept — is a service that exists and can never be added.
+TILE="$(adb -s "$DEVICE" shell pm query-services --brief -a android.service.quicksettings.action.QS_TILE 2>/dev/null | grep -F "$APP_ID/.vpn.TunnelTileService" | tr -d ' \r')"
+if [ -n "$TILE" ]; then
+    note "the tile is registered as $TILE. Add it from the shade's editor and check by hand: it shows the node name, it opens the app when no node has ever connected, and it refuses to start without VPN consent."
+else
+    miss "the quick-settings tile is not registered on this device"
+fi
+
 # ── 5. Doze and battery management ──────────────────────────────────────────
 # Vendor battery managers kill foreground services that survive indefinitely on
 # an emulator. There is no way to assert the outcome from here; what can be