prober: fix three bugs exposed by the first device report (OnePlus 15/A16)

- AndroidManifest: add CHANGE_NETWORK_STATE — requestNetwork threw
  SecurityException, multinetwork.request_and_bind could never run.
- IcmpProbe: format rtt_ms with Locale.ROOT — Austrian locale produced
  "38,1" in the JSON report.
- ShizukuRunner/ShizukuProbe: bind the UserService once per battery
  (execBatch) instead of per command; the per-command bind/unbind raced
  Shizuku and 3/7 commands died on SHIZUKU_BIND_TIMEOUT.

Archive the report at echolot-prober/reports/, record findings in
build-status.md. Notable: errqueue path fully reachable on Android 16 —
the native shim may be unnecessary on modern devices.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/settings.json

@@ -2,6 +2,7 @@
   "permissions": {
     "allow": [
       "WebFetch(domain:open-vsx.org)"
+      "WebFetch(domain:github.com)"
     ]
   }
 }

.gitea/workflows/deploy-site.yml

@@ -0,0 +1,28 @@
+# Deploys web/ to Cloudflare Workers on every push that touches it.
+# Inert until two repo secrets exist (Settings → Actions → Secrets):
+#   CLOUDFLARE_API_TOKEN   token from the "Edit Cloudflare Workers" template
+#   CLOUDFLARE_ACCOUNT_ID  dashboard → Workers & Pages, right sidebar
+# See web/README.md for the full deploy story (custom domains, manual deploy).
+
+name: deploy-site
+on:
+  push:
+    branches: [main, master]
+    paths: ["web/**"]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Deploy Worker + assets
+        working-directory: web
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: npx --yes wrangler@4 deploy

docs/build-status.md

@@ -33,7 +33,7 @@ Could NOT be compiled in the cloud sandbox: dl.google.com (Google Maven) and ser
 are proxy-blocked, and no device is reachable for on-device runs. Build + iterate locally
 (Android Studio / Claude Code). Wrapper is pinned to Gradle 8.14.3.
 
-## Website — `web/` (2026-07-30)
+## Website — `web/` (2026-07-30, LIVE at https://echo-lot.app)
 Single-page site for echo-lot.app on Cloudflare Workers: static `public/` from the edge, a small
 Worker for the stable short URLs (`/apk`, `/apk.sha256`, `/fdroid`, `/source`) and `/api/latest`.
 Version info is resolved from the Gitea releases API at request time (edge-cached 5 min), so
@@ -42,8 +42,10 @@ progressive-enhancement JS and falls back to pre-release copy otherwise. Auto li
 `prefers-color-scheme`: dark = sonar display, light = chart-recorder printout, same amber-accent
 token system. Deploy: `npx wrangler deploy` from `web/`, or CI via
 `.gitea/workflows/deploy-site.yml` (needs `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID`
-secrets); full story in `web/README.md`. Open: favicon/wordmark are placeholders until the
+secrets); full story in `web/README.md`. Branding applied (2026-07-30): real favicon/wordmark
-branding assets land (in progress in a parallel session).
+copied into `web/public/assets/` (copies — `assets/branding/` is the source of truth), palette
+switched to abyss/teal/amber with teal-as-instrument semantics, sonar-sweep hero replaced by a
+Focus-lattice panel (rogue-DHCP finding vignette), tagline "measure, don't guess".
 
 ## Branding — `assets/branding/` (2026-07-30)
 Identity chosen: the **Focus** mark — a quiet lattice of nodes with exactly one under examination
@@ -58,6 +60,32 @@ is the signature teal ring + amber ping. Assets: `icon.svg` (+ `icon.png` 512²
 Gitea/GitHub social-preview slot). The website's placeholder favicon/wordmark can now be replaced
 from these.
 
+## First device report — OnePlus 15, Android 16/SDK 36 (2026-07-30)
+Archived at `echolot-prober/reports/CPH2747-android16-sdk36.json`. Collection workflow that works:
+deploy over (wireless) adb, but the **user** starts the run and exports the JSON manually — probe
+runs reliably kill the adb-over-wifi session (multinetwork/multicast churn the link adb rides on).
+
+OS findings:
+- `link.snapshot`, `icmp.ping4` (38 ms), `sockopt.matrix` 4/4, `peer.ble_advertise`: SUPPORTED.
+- **`trace.errqueue_reachable` SUPPORTED** — full Os-API errqueue path exists on Android 16;
+  the C-over-JNI shim (next-steps #2) may be unnecessary on modern devices. Still needs a real
+  errqueue round-trip test, and older devices may differ.
+- `icmp.ping6` EAGAIN — topology, not capability: wifi was v4-only, v6 only on cellular, socket
+  used the default network. Probe should bind per-network (also covers the ping4 case properly).
+- `shizuku.command_battery` SUPPORTED, shell(2000): real `ip -6 route` RA data (lifetimes,
+  per-table), `ip monitor` NEIGH events, wifi dump with full DhcpResults. Vendor formats look
+  parseable.
+- `local.mdns_discover`: lock acquired, discovery ran, 0 services in the 4 s window — needs a
+  longer window / known-good reference network before calling it more than formally SUPPORTED.
+
+Prober bugs the run exposed (all fixed same day):
+- rotation wiped results + cancelled runs → state moved to a ViewModel;
+- `multinetwork.request_and_bind` ERROR → missing `CHANGE_NETWORK_STATE` in the manifest;
+- `rtt_ms: "38,1"` → device locale leaked into report numbers, now `Locale.ROOT`;
+- 3/7 Shizuku commands `SHIZUKU_BIND_TIMEOUT` → bind/unbind-per-command raced Shizuku; now one
+  bind per battery (`execBatch`).
+Open: re-run on-device to confirm the multinetwork + Shizuku fixes; then re-export.
+
 ## Next steps
 1. Build locally, run on several physical devices (varied Android versions/vendors), collect the
    JSON reports — especially the real per-device Shizuku dump formats.

echolot-prober/app/src/main/AndroidManifest.xml

@@ -4,6 +4,9 @@
 
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <!-- Normal (install-time) permission; required by ConnectivityManager.requestNetwork.
+         Missing it made multinetwork.request_and_bind ERROR on the first device run. -->
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
     <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
     <uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />
     <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />

echolot-prober/app/src/main/java/app/echo_lot/prober/probe/IcmpProbe.kt

@@ -13,6 +13,7 @@ import java.io.FileDescriptor
 import java.net.Inet4Address
 import java.net.InetAddress
 import java.nio.ByteBuffer
+import java.util.Locale
 
 /**
  * Probes the unprivileged ICMP echo path: socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP).
@@ -55,7 +56,9 @@ class IcmpProbe(
             val received = Os.recvfrom(fd, buf, 0, null)
             val rttMs = (System.nanoTime() - t0) / 1_000_000.0
             ev["bytes_received"] = received.toString()
-            ev["rtt_ms"] = "%.1f".format(rttMs)
+            // Locale.ROOT: the device's locale must not leak into the report ("38,1" broke
+            // the schema's number format on the first Austrian-locale device).
+            ev["rtt_ms"] = "%.1f".format(Locale.ROOT, rttMs)
 
             // ICMP datagram (ping) sockets deliver the ICMP message with NO IP header, so the
             // type byte is at offset 0 for both families. v4 echo reply = 0, v6 echo reply = 129.

echolot-prober/app/src/main/java/app/echo_lot/prober/probe/ShizukuProbe.kt

@@ -56,8 +56,9 @@ class ShizukuProbe : Probe {
         }
 
         var ok = 0
-        for ((key, cmd) in battery) {
+        // One bind for the whole battery — per-command binding raced Shizuku's unbind and
-            val out = runner.exec(cmd, timeoutMs = 6000)
+        // produced spurious SHIZUKU_BIND_TIMEOUTs (3/7 on the OnePlus 15).
+        for ((key, out) in runner.execBatch(battery, timeoutMs = 6000)) {
             // Truncate each excerpt so evidence stays readable; full capture is future work.
             ev[key] = out.trim().take(1200)
             if (!out.startsWith("SHIZUKU_") && !out.startsWith("EXEC_") && out.isNotBlank()) ok++

echolot-prober/app/src/main/java/app/echo_lot/prober/shizuku/ShizukuRunner.kt

@@ -67,8 +67,18 @@ class ShizukuRunner(private val context: Context) {
         .processNameSuffix("prober")
         .version(1)
 
-    /** Bind the UserService, run one command, and return combined output (or an error string). */
+    /**
-    suspend fun exec(command: String, timeoutMs: Int = 8000): String {
+     * Bind the UserService ONCE, run every command against it, then unbind. The first device run
+     * (OnePlus 15) showed why per-command binding is wrong: unbind of command N races the bind of
+     * command N+1 inside Shizuku, and 3/7 commands died on SHIZUKU_BIND_TIMEOUT.
+     *
+     * Returns one output (or error string) per command, keyed like the input.
+     */
+    suspend fun execBatch(
+        commands: List<Pair<String, String>>,
+        timeoutMs: Int = 8000,
+    ): LinkedHashMap<String, String> {
+        val out = LinkedHashMap<String, String>()
         val bound = CompletableDeferred<IUserService?>()
         val conn = object : ServiceConnection {
             override fun onServiceConnected(name: ComponentName?, binder: IBinder?) {
@@ -78,16 +88,28 @@ class ShizukuRunner(private val context: Context) {
             }
             override fun onServiceDisconnected(name: ComponentName?) {}
         }
-        return try {
+        try {
             Shizuku.bindUserService(serviceArgs, conn)
             val svc = withTimeoutOrNull(10000) { bound.await() }
-                ?: return "SHIZUKU_BIND_TIMEOUT"
+            if (svc == null) {
-            withTimeoutOrNull(timeoutMs.toLong() + 4000) { svc.exec(command, timeoutMs) }
+                commands.forEach { (key, _) -> out[key] = "SHIZUKU_BIND_TIMEOUT" }
-                ?: "EXEC_TIMEOUT"
+                return out
+            }
+            for ((key, cmd) in commands) {
+                out[key] = try {
+                    withTimeoutOrNull(timeoutMs.toLong() + 4000) { svc.exec(cmd, timeoutMs) }
+                        ?: "EXEC_TIMEOUT"
+                } catch (e: Throwable) {
+                    "SHIZUKU_ERROR: ${e.message ?: e.javaClass.simpleName}"
+                }
+            }
         } catch (e: Throwable) {
-            "SHIZUKU_ERROR: ${e.message ?: e.javaClass.simpleName}"
+            commands.forEach { (key, _) ->
+                out.putIfAbsent(key, "SHIZUKU_ERROR: ${e.message ?: e.javaClass.simpleName}")
+            }
         } finally {
             runCatching { Shizuku.unbindUserService(serviceArgs, conn, true) }
         }
+        return out
     }
 }

echolot-prober/reports/CPH2747-android16-sdk36.json

@@ -0,0 +1,156 @@
+{
+    "schema": "echolot/prober-report",
+    "schemaVersion": "0.1.0",
+    "device": {
+        "manufacturer": "OnePlus",
+        "model": "CPH2747",
+        "androidSdk": 36,
+        "androidRelease": "16"
+    },
+    "results": [
+        {
+            "id": "link.snapshot",
+            "title": "LinkProperties snapshot (all active networks)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "2 active network(s) read",
+            "evidence": {
+                "network_count": "2",
+                "net0.cellular.iface": "rmnet_data4",
+                "net0.cellular.mtu": "1500",
+                "net0.cellular.addrs": "2001:4bb8:417:bd78:e4fe:8cff:febe:ca8c/64",
+                "net0.cellular.dns": "fda1:3fb1:0:8:0:10:0:101, fda1:3fb1:0:8:0:10:0:100",
+                "net0.cellular.routes": "::/0 -> fe80::246f:12be:21ef:1b54 rmnet_data4 mtu 1500 | 2001:4bb8:417:bd78::/64 -> :: rmnet_data4 mtu 0",
+                "net0.cellular.domains": "",
+                "net0.cellular.nat64": "none",
+                "net0.cellular.private_dns": "off/opportunistic",
+                "net1.wifi.iface": "wlan0",
+                "net1.wifi.mtu": "0",
+                "net1.wifi.addrs": "fe80::7a:75ff:fee9:ae9e/64, 10.13.102.124/24",
+                "net1.wifi.dns": "10.13.102.1",
+                "net1.wifi.routes": "fe80::/64 -> :: wlan0 mtu 0 | ::/0 -> fe80::7a9a:18ff:fe54:b8f9 wlan0 mtu 0 | 10.13.102.0/24 -> 0.0.0.0 wlan0 mtu 0 | 0.0.0.0/0 -> 10.13.102.1 wlan0 mtu 0",
+                "net1.wifi.domains": "hudelist.local",
+                "net1.wifi.nat64": "none",
+                "net1.wifi.private_dns": "off/opportunistic"
+            },
+            "durationMs": 1
+        },
+        {
+            "id": "icmp.ping4",
+            "title": "ICMPv4 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Echo reply from 1.1.1.1 in 38,1 ms",
+            "evidence": {
+                "socket": "opened family=2 proto=1",
+                "target": "1.1.1.1",
+                "bytes_received": "22",
+                "rtt_ms": "38,1",
+                "reply_type": "0",
+                "reply_type_meaning": "echo reply (v4)"
+            },
+            "durationMs": 38
+        },
+        {
+            "id": "icmp.ping6",
+            "title": "ICMPv6 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "ERROR",
+            "summary": "ICMP datagram socket failed: recvfrom failed: EAGAIN (Try again)",
+            "evidence": {
+                "socket": "opened family=10 proto=58",
+                "target": "2606:4700:4700::1111",
+                "error": "recvfrom failed: EAGAIN (Try again)"
+            },
+            "durationMs": 3116
+        },
+        {
+            "id": "sockopt.matrix",
+            "title": "Socket options: TTL, RECVERR, MTU_DISCOVER (DF)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "4/4 core sockopts accepted; IP_MTU read=false",
+            "evidence": {
+                "IP_TTL": "accepted (ttl=5)",
+                "IP_TOS/DSCP": "accepted (EF/46)",
+                "IP_RECVERR": "accepted",
+                "IP_MTU_DISCOVER=PROBE": "accepted (DF set)",
+                "IP_MTU(read)": "unreadable: android.system.Os.getsockoptInt [class java.io.FileDescriptor, int, int]"
+            },
+            "durationMs": 3
+        },
+        {
+            "id": "trace.errqueue_reachable",
+            "title": "Traceroute via IP_RECVERR + MSG_ERRQUEUE",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Errqueue path fully reachable from Os API",
+            "evidence": {
+                "IP_RECVERR": "accepted",
+                "IP_TTL=1": "accepted",
+                "StructMsghdr": "true",
+                "Os.recvmsg": "true"
+            },
+            "durationMs": 1
+        },
+        {
+            "id": "multinetwork.request_and_bind",
+            "title": "Concurrent per-network binding (Wi-Fi / cellular / ethernet)",
+            "tier": "APP",
+            "verdict": "ERROR",
+            "summary": "multi-network probe failed",
+            "evidence": {
+                "error": "app.echo_lot.prober was not granted either of these permissions:android.permission.CHANGE_NETWORK_STATE,android.permission.WRITE_SETTINGS."
+            },
+            "durationMs": 6
+        },
+        {
+            "id": "local.mdns_discover",
+            "title": "Multicast reception (MulticastLock + mDNS/NSD)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "mDNS discovery ran; 0 service type(s) seen",
+            "evidence": {
+                "multicast_lock": "acquired",
+                "discovery_started": "true",
+                "services_found": "0"
+            },
+            "durationMs": 4002
+        },
+        {
+            "id": "peer.ble_advertise",
+            "title": "BLE peripheral advertising (peer-mode control channel)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Advertising start: success",
+            "evidence": {
+                "FEATURE_BLUETOOTH_LE": "true",
+                "adapter_enabled": "true",
+                "multi_advertisement_supported": "true",
+                "startAdvertising": "success"
+            },
+            "durationMs": 30
+        },
+        {
+            "id": "shizuku.command_battery",
+            "title": "Shizuku shell tier (ip neigh / route / dumpsys network_stack)",
+            "tier": "SHIZUKU",
+            "verdict": "SUPPORTED",
+            "summary": "Shizuku runs as shell(2000); 4/7 commands returned data",
+            "evidence": {
+                "binder_alive": "true",
+                "version": "13",
+                "runs_as": "shell(2000)",
+                "permission": "true",
+                "id": "uid=2000\nuid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0",
+                "ip_neigh": "SHIZUKU_BIND_TIMEOUT",
+                "ip6_route": "uid=2000\nfe80::/64 dev wlan0 table 1028 proto kernel metric 256 pref medium\ndefault via fe80::7a9a:18ff:fe54:b8f9 dev wlan0 table 1028 proto ra metric 1024 expires 1698sec pref medium\nfe80::/64 dev vgate0 table 1031 proto kernel metric 256 pref medium\n2001:4bb8:417:bd78::/64 dev rmnet_data4 table 1032 proto kernel metric 256 pref medium\n2001:4bb8:417:bd78::/64 dev rmnet_data4 table 1032 proto static metric 1024 pref medium\nfe80::/64 dev rmnet_data4 table 1032 proto kernel metric 256 pref medium\ndefault via fe80::246f:12be:21ef:1b54 dev rmnet_data4 table 1032 proto ra metric 1024 expires 58221sec hoplimit 255 pref medium\n2001:4bb8:417:bd78::/64 dev rmnet_data4 table 1000000032 proto static metric 1024 pref medium\nfe80::/64 dev dummy0 table 1002 proto kernel metric 256 pref medium\ndefault dev dummy0 table 1002 proto static metric 1024 pref medium\nfe80::/64 dev ifb0 table 1003 proto kernel metric 256 pref medium\nfe80::/64 dev ifb1 table 1004 proto kernel metric 256 pref medium\nfe80::/64 dev ifb2 table 1019 proto kernel metric 256 pref medium\nfe80::/64 dev rmnet_data0 table 1020 proto kernel metric 256 pref medium\nfe80::/64 dev r_rmnet_data2 table 1023 proto kernel metric 256 pref medi",
+                "ip_addr": "SHIZUKU_BIND_TIMEOUT",
+                "ip_monitor": "uid=2000\n[NEIGH]10.13.102.1 dev wlan0 lladdr 78:9a:18:54:b8:f9 REACHABLE",
+                "dhcp_log": "SHIZUKU_BIND_TIMEOUT",
+                "wifi_dump": "uid=2000\n rec[0]: time=07-30 10:53:23.012 processed=ConnectableState org=L3ConnectedState dest=<null> what=CMD_UPDATE_LINKPROPERTIES screen=on 16 0 v4 v4r v4dns v6r\n rec[1]: time=07-30 10:55:59.615 processed=ConnectableState org=L3ConnectedState dest=<null> what=CMD_INSTALL_PACKET_FILTER screen=on len=1512\n--\n rec[33]: time=07-30 10:57:24.663 processed=L2ConnectedState org=L3ProvisioningState dest=<null> what=CMD_IPV4_PROVISIONING_SUCCESS screen=on DhcpResultsParcelable{baseConfiguration: IP address 10.13.102.124/24 Gateway 10.13.102.1  DNS servers: [ 10.13.102.1 ] Domains hudelist.local, leaseDuration: 600, mtu: 0, serverAddress: 10.13.102.1, vendorInfo: null, serverHostName: , captivePortalApiUrl: null}\n rec[34]: time=07-30 10:57:24.663 processed=ConnectableState org=L3ProvisioningState dest=<null> what=CMD_UPDATE_LINKPROPERTIES screen=on 16 0 v4r\n--\n rec[36]: time=07-30 10:57:24.667 processed=ConnectableState org=L3ProvisioningState dest=<null> what=CMD_UPDATE_LINKPROPERTIES screen=on 16 0 v4 v4r v4dns\n rec[37]: time=07-30 10:57:24.667 processed=L2ConnectedState org=L3ProvisioningState dest=L3ConnectedState what=CMD_IP_CONFIGURATION_SUCCESSFUL screen=on 16 0\n--\n rec[41]: time=07"
+            },
+            "durationMs": 33957
+        }
+    ]
+}