prober: fix three bugs exposed by the first device report (OnePlus 15/A16)

- AndroidManifest: add CHANGE_NETWORK_STATE — requestNetwork threw
  SecurityException, multinetwork.request_and_bind could never run.
- IcmpProbe: format rtt_ms with Locale.ROOT — Austrian locale produced
  "38,1" in the JSON report.
- ShizukuRunner/ShizukuProbe: bind the UserService once per battery
  (execBatch) instead of per command; the per-command bind/unbind raced
  Shizuku and 3/7 commands died on SHIZUKU_BIND_TIMEOUT.

Archive the report at echolot-prober/reports/, record findings in
build-status.md. Notable: errqueue path fully reachable on Android 16 —
the native shim may be unnecessary on modern devices.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -33,7 +33,7 @@ Could NOT be compiled in the cloud sandbox: dl.google.com (Google Maven) and ser
 are proxy-blocked, and no device is reachable for on-device runs. Build + iterate locally
 (Android Studio / Claude Code). Wrapper is pinned to Gradle 8.14.3.
 
-## Website — `web/` (2026-07-30)
+## Website — `web/` (2026-07-30, LIVE at https://echo-lot.app)
 Single-page site for echo-lot.app on Cloudflare Workers: static `public/` from the edge, a small
 Worker for the stable short URLs (`/apk`, `/apk.sha256`, `/fdroid`, `/source`) and `/api/latest`.
 Version info is resolved from the Gitea releases API at request time (edge-cached 5 min), so
@@ -42,8 +42,10 @@ progressive-enhancement JS and falls back to pre-release copy otherwise. Auto li
 `prefers-color-scheme`: dark = sonar display, light = chart-recorder printout, same amber-accent
 token system. Deploy: `npx wrangler deploy` from `web/`, or CI via
 `.gitea/workflows/deploy-site.yml` (needs `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID`
-secrets); full story in `web/README.md`. Open: favicon/wordmark are placeholders until the
-branding assets land (in progress in a parallel session).
+secrets); full story in `web/README.md`. Branding applied (2026-07-30): real favicon/wordmark
+copied into `web/public/assets/` (copies — `assets/branding/` is the source of truth), palette
+switched to abyss/teal/amber with teal-as-instrument semantics, sonar-sweep hero replaced by a
+Focus-lattice panel (rogue-DHCP finding vignette), tagline "measure, don't guess".
 
 ## Branding — `assets/branding/` (2026-07-30)
 Identity chosen: the **Focus** mark — a quiet lattice of nodes with exactly one under examination
@@ -58,6 +60,32 @@ is the signature teal ring + amber ping. Assets: `icon.svg` (+ `icon.png` 512²
 Gitea/GitHub social-preview slot). The website's placeholder favicon/wordmark can now be replaced
 from these.
 
+## First device report — OnePlus 15, Android 16/SDK 36 (2026-07-30)
+Archived at `echolot-prober/reports/CPH2747-android16-sdk36.json`. Collection workflow that works:
+deploy over (wireless) adb, but the **user** starts the run and exports the JSON manually — probe
+runs reliably kill the adb-over-wifi session (multinetwork/multicast churn the link adb rides on).
+
+OS findings:
+- `link.snapshot`, `icmp.ping4` (38 ms), `sockopt.matrix` 4/4, `peer.ble_advertise`: SUPPORTED.
+- **`trace.errqueue_reachable` SUPPORTED** — full Os-API errqueue path exists on Android 16;
+  the C-over-JNI shim (next-steps #2) may be unnecessary on modern devices. Still needs a real
+  errqueue round-trip test, and older devices may differ.
+- `icmp.ping6` EAGAIN — topology, not capability: wifi was v4-only, v6 only on cellular, socket
+  used the default network. Probe should bind per-network (also covers the ping4 case properly).
+- `shizuku.command_battery` SUPPORTED, shell(2000): real `ip -6 route` RA data (lifetimes,
+  per-table), `ip monitor` NEIGH events, wifi dump with full DhcpResults. Vendor formats look
+  parseable.
+- `local.mdns_discover`: lock acquired, discovery ran, 0 services in the 4 s window — needs a
+  longer window / known-good reference network before calling it more than formally SUPPORTED.
+
+Prober bugs the run exposed (all fixed same day):
+- rotation wiped results + cancelled runs → state moved to a ViewModel;
+- `multinetwork.request_and_bind` ERROR → missing `CHANGE_NETWORK_STATE` in the manifest;
+- `rtt_ms: "38,1"` → device locale leaked into report numbers, now `Locale.ROOT`;
+- 3/7 Shizuku commands `SHIZUKU_BIND_TIMEOUT` → bind/unbind-per-command raced Shizuku; now one
+  bind per battery (`execBatch`).
+Open: re-run on-device to confirm the multinetwork + Shizuku fixes; then re-export.
+
 ## Next steps
 1. Build locally, run on several physical devices (varied Android versions/vendors), collect the
    JSON reports — especially the real per-device Shizuku dump formats.