diff --git a/docs/build-status.md b/docs/build-status.md
index acff43f..8732645 100644
--- a/docs/build-status.md
+++ b/docs/build-status.md
@@ -343,3 +343,15 @@ extension; that was the one build gotcha). Modules added:
   follow-ups (app degrades gracefully without them, like the prober).
 Debug APK: 9.5 MB, `echolot-app/app/build/outputs/apk/debug/app-debug.apk`. Not yet run on device
 (needs the user's phone). core-shizuku (dual-path executor) deferred as additive.
+
+## App verified on-device — both phones (2026-07-31)
+The production Echolot app runs on real hardware, on BOTH devices, via the beacon-managed adb:
+- OnePlus 15 (CPH2747, A16) and Lenovo TB330FU (A15): link.snapshot OK, icmp.ping4 OK
+  (per-network, RTT ~40ms), icmp.ping6 FAILED → finding "No IPv6 ICMP path on any active network"
+  → category ipv6 yellow → **Overall YELLOW**. The verdict is driven by the real broken-LAN IPv6
+  (RA default route, no global prefix) we first found with the prober — the product now surfaces
+  it end to end (probe → schema → verdict → traffic-light UI).
+Wireless-adb beacon (tools/adb-beacon) made this practical: both devices self-report their
+rotating wireless-debug port to fmr:443; a PC connector keeps adb connected. Debugged live
+against the restricted LAN (cleartext policy, egress filtering, shared-LAN mDNS crossing, fast
+port rotation) — all handled.