prober build 4: newProcess fallback when the Shizuku UserService won't bind

Build 3 settled it: the Lenovo TB330FU/A15 never spawns the UserService (two 25s bind attempts, binder alive, permission granted). Build 4 falls back to the legacy Shizuku.newProcess remote-process API via reflection and records exec_path in the evidence — whether that path works per device is itself the capability question core-shizuku needs answered. Also archives both build-3 reports: phone 7/7 incl. provoked NEIGH transitions in ip_monitor; traceroute.udp4 handled a silent hop ("*") correctly on both devices. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-30 15:10:58 +02:00
parent 0ed36d9103
commit 60989b67ef
6 changed files with 433 additions and 7 deletions
@@ -132,6 +132,13 @@ Archived as `…-build2.json` in `echolot-prober/reports/`. The findings:
 - Tablet Shizuku: binder alive, permission granted, but UserService bind timed out (0/7) —
  first-spawn dex extraction on slow storage suspected; build 3 raises the bind window to
  25 s + one retry. Phone stays 7/7 with rich neighbor/RA/DHCP evidence.
+  **Build-3 verdict: not timing.** Both 25 s attempts timed out (50 s total) — the UserService
+  spawn genuinely fails on the Lenovo/A15. Build 4 adds a reflection fallback to the legacy
+  `Shizuku.newProcess` remote-process API when the bind fails; `exec_path` in the evidence says
+  which path ran. Whatever the outcome, core-shizuku must not assume UserService works
+  everywhere. (Phone build 3: still 7/7; `ip_monitor` now catches provoked NEIGH
+  PROBE→REACHABLE transitions, and a mid-path router dropping one TTL round showed the "*"
+  hop path works in traceroute.udp4.)
 - `ip_monitor` returned no events this run even with the provoked gateway ping (gateway was
  already REACHABLE, so no NEIGH transition happened). Evidence-dependent, not a bug.

@@ -15,7 +15,7 @@ android {
        targetSdk = 35
        // Bump versionCode on EVERY deployed change — it is shown on screen and lands in the
        // JSON report as proberBuild, so a report is attributable to an exact prober build.
-        versionCode = 3
+        versionCode = 4
        versionName = "0.1.0"
    }

@@ -60,10 +60,14 @@ class ShizukuProbe : Probe {
        var ok = 0
        // One bind for the whole battery — per-command binding raced Shizuku's unbind and
        // produced spurious SHIZUKU_BIND_TIMEOUTs (3/7 on the OnePlus 15).
-        for ((key, out) in runner.execBatch(battery, timeoutMs = 6000)) {
+        val batch = runner.execBatch(battery, timeoutMs = 6000)
+        ev["exec_path"] = batch.execPath
+        for ((key, out) in batch.results) {
            // Truncate each excerpt so evidence stays readable; full capture is future work.
            ev[key] = out.trim().take(1200)
-            if (!out.startsWith("SHIZUKU_") && !out.startsWith("EXEC_") && out.isNotBlank()) ok++
+            if (!out.startsWith("SHIZUKU_") && !out.startsWith("EXEC_") &&
+                !out.startsWith("NEWPROCESS_") && out.isNotBlank()
+            ) ok++
        }
        val verdict = if (ok >= 4) Verdict.SUPPORTED else if (ok >= 1) Verdict.PARTIAL else Verdict.UNSUPPORTED
        ProbeResult.of(this@ShizukuProbe, verdict,
@@ -67,17 +67,27 @@ class ShizukuRunner(private val context: Context) {
        .processNameSuffix("prober")
        .version(1)

+    /** How the batch actually executed — recorded as evidence by the probe. */
+    data class BatchResult(
+        val execPath: String,
+        val results: LinkedHashMap<String, String>,
+    )
+
    /**
     * Bind the UserService ONCE, run every command against it, then unbind. The first device run
     * (OnePlus 15) showed why per-command binding is wrong: unbind of command N races the bind of
     * command N+1 inside Shizuku, and 3/7 commands died on SHIZUKU_BIND_TIMEOUT.
     *
+     * If the UserService never binds (Lenovo TB330FU/A15: two 25 s attempts, spawn never
+     * happens), falls back to the legacy Shizuku.newProcess remote-process API via reflection —
+     * itself a capability question worth answering per device.
+     *
     * Returns one output (or error string) per command, keyed like the input.
     */
    suspend fun execBatch(
        commands: List<Pair<String, String>>,
        timeoutMs: Int = 8000,
-    ): LinkedHashMap<String, String> {
+    ): BatchResult {
        val out = LinkedHashMap<String, String>()
        val bound = CompletableDeferred<IUserService?>()
        val conn = object : ServiceConnection {
@@ -100,8 +110,7 @@ class ShizukuRunner(private val context: Context) {
                svc = withTimeoutOrNull(25_000) { bound.await() }
            }
            if (svc == null) {
-                commands.forEach { (key, _) -> out[key] = "SHIZUKU_BIND_TIMEOUT" }
-                return out
+                return execBatchViaNewProcess(commands, timeoutMs)
            }
            for ((key, cmd) in commands) {
                out[key] = try {
@@ -118,6 +127,50 @@ class ShizukuRunner(private val context: Context) {
        } finally {
            runCatching { Shizuku.unbindUserService(serviceArgs, conn, true) }
        }
-        return out
+        return BatchResult("UserService", out)
+    }
+
+    /**
+     * Legacy path: Shizuku.newProcess (private in API 13, reached via reflection — repo
+     * convention for uncertain APIs). Returns a java.lang.Process whose stdout is read with a
+     * deadline. Whether this path works per device/Shizuku build is itself evidence the
+     * production core-shizuku module needs.
+     */
+    private fun execBatchViaNewProcess(
+        commands: List<Pair<String, String>>,
+        timeoutMs: Int,
+    ): BatchResult {
+        val out = LinkedHashMap<String, String>()
+        val method = runCatching {
+            Shizuku::class.java.getDeclaredMethod(
+                "newProcess",
+                Array<String>::class.java, Array<String>::class.java, String::class.java,
+            ).apply { isAccessible = true }
+        }.getOrNull()
+        if (method == null) {
+            commands.forEach { (key, _) -> out[key] = "SHIZUKU_BIND_TIMEOUT; newProcess API absent" }
+            return BatchResult("UserService bind failed; newProcess absent", out)
+        }
+        for ((key, cmd) in commands) {
+            out[key] = runCatching {
+                val proc = method.invoke(null, arrayOf("sh", "-c", cmd), null, null) as Process
+                val output = StringBuilder()
+                val reader = Thread {
+                    runCatching {
+                        proc.inputStream.bufferedReader().forEachLine { line ->
+                            if (output.length < 64 * 1024) output.append(line).append('\n')
+                        }
+                    }
+                }
+                reader.start()
+                reader.join(timeoutMs.toLong())
+                if (reader.isAlive) proc.destroy()
+                output.toString().ifBlank { "EXEC_TIMEOUT(newProcess)" }
+            }.getOrElse { e ->
+                val cause = (e as? java.lang.reflect.InvocationTargetException)?.cause ?: e
+                "NEWPROCESS_ERROR: ${cause.message ?: cause.javaClass.simpleName}"
+            }
+        }
+        return BatchResult("newProcess fallback (UserService bind failed)", out)
    }
 }
@@ -0,0 +1,190 @@
+{
+    "schema": "echolot/prober-report",
+    "schemaVersion": "0.1.0",
+    "proberBuild": 3,
+    "device": {
+        "manufacturer": "OnePlus",
+        "model": "CPH2747",
+        "androidSdk": 36,
+        "androidRelease": "16"
+    },
+    "results": [
+        {
+            "id": "link.snapshot",
+            "title": "LinkProperties snapshot (all active networks)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "3 active network(s) read",
+            "evidence": {
+                "network_count": "3",
+                "net0.cellular.iface": "rmnet_data4",
+                "net0.cellular.mtu": "1500",
+                "net0.cellular.addrs": "2001:4bb8:417:bd78:e4fe:8cff:febe:ca8c/64",
+                "net0.cellular.dns": "fda1:3fb1:0:8:0:10:0:101, fda1:3fb1:0:8:0:10:0:100",
+                "net0.cellular.routes": "::/0 -> fe80::246f:12be:21ef:1b54 rmnet_data4 mtu 1500 | 2001:4bb8:417:bd78::/64 -> :: rmnet_data4 mtu 0",
+                "net0.cellular.domains": "",
+                "net0.cellular.nat64": "none",
+                "net0.cellular.private_dns": "off/opportunistic",
+                "net1.wifi.iface": "wlan0",
+                "net1.wifi.mtu": "0",
+                "net1.wifi.addrs": "fe80::bcf6:edff:fe67:b139/64, 10.13.102.122/24",
+                "net1.wifi.dns": "10.13.102.1",
+                "net1.wifi.routes": "fe80::/64 -> :: wlan0 mtu 0 | ::/0 -> fe80::7a9a:18ff:fe54:b8f9 wlan0 mtu 0 | 10.13.102.0/24 -> 0.0.0.0 wlan0 mtu 0 | 0.0.0.0/0 -> 10.13.102.1 wlan0 mtu 0",
+                "net1.wifi.domains": "hudelist.local",
+                "net1.wifi.nat64": "none",
+                "net1.wifi.private_dns": "off/opportunistic",
+                "net2.cellular.iface": "rmnet_data3",
+                "net2.cellular.mtu": "1500",
+                "net2.cellular.addrs": "10.73.62.113/30, 2001:4bb8:2fb:fe4c:c00:cff:fe8b:4ca5/64",
+                "net2.cellular.dns": "10.88.152.122, 10.88.152.123, fda1:3fb1:0:8:0:10:0:102, fda1:3fb1:0:8:0:10:0:103",
+                "net2.cellular.routes": "0.0.0.0/0 -> 10.73.62.114 rmnet_data3 mtu 1500 | ::/0 -> fe80::f8e0:266:53b9:549 rmnet_data3 mtu 1500 | 10.73.62.112/30 -> 0.0.0.0 rmnet_data3 mtu 0 | 2001:4bb8:2fb:fe4c::/64 -> :: rmnet_data3 mtu 0",
+                "net2.cellular.domains": "",
+                "net2.cellular.nat64": "none",
+                "net2.cellular.private_dns": "off/opportunistic"
+            },
+            "durationMs": 2
+        },
+        {
+            "id": "icmp.ping4",
+            "title": "ICMPv4 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Echo reply on the default network",
+            "evidence": {
+                "default": "reply type=0 rtt_ms=25.6 bytes=22 target=1.1.1.1",
+                "net.cellular": "reply type=0 rtt_ms=45.5 bytes=22 target=1.1.1.1",
+                "net.wifi": "reply type=0 rtt_ms=20.7 bytes=22 target=1.1.1.1"
+            },
+            "durationMs": 96
+        },
+        {
+            "id": "icmp.ping6",
+            "title": "ICMPv6 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Echo reply on cellular only — default network has no v6 path",
+            "evidence": {
+                "default": "error: recvfrom failed: EAGAIN (Try again)",
+                "net.cellular": "reply type=129 rtt_ms=43.7 bytes=22 target=2606:4700:4700::1111",
+                "net.wifi": "error: recvfrom failed: EAGAIN (Try again)"
+            },
+            "durationMs": 6359
+        },
+        {
+            "id": "sockopt.matrix",
+            "title": "Socket options: TTL, RECVERR, MTU_DISCOVER (DF)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "4/4 core sockopts accepted; IP_MTU read=false",
+            "evidence": {
+                "IP_TTL": "accepted (ttl=5)",
+                "IP_TOS/DSCP": "accepted (EF/46)",
+                "IP_RECVERR": "accepted",
+                "IP_MTU_DISCOVER=PROBE": "accepted (DF set)",
+                "IP_MTU(read)": "unreadable: android.system.Os.getsockoptInt [class java.io.FileDescriptor, int, int]"
+            },
+            "durationMs": 2
+        },
+        {
+            "id": "trace.errqueue_reachable",
+            "title": "Traceroute via IP_RECVERR + MSG_ERRQUEUE",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Errqueue path fully reachable from Os API",
+            "evidence": {
+                "IP_RECVERR": "accepted",
+                "IP_TTL=1": "accepted",
+                "StructMsghdr": "true",
+                "Os.recvmsg": "true"
+            },
+            "durationMs": 0
+        },
+        {
+            "id": "traceroute.udp4",
+            "title": "UDP traceroute via MSG_ERRQUEUE (no root, no JNI)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "5 hop(s) read via errqueue — no native shim needed",
+            "evidence": {
+                "recvmsg_api": "StructMsghdr + Os.recvmsg via reflection",
+                "target": "1.1.1.1",
+                "hop.1": "10.13.102.1 icmp type=11 origin=2 ~41 ms",
+                "hop.2": "178.191.103.254 icmp type=11 origin=2 ~41 ms",
+                "hop.3": "195.3.76.32 icmp type=11 origin=2 ~41 ms",
+                "hop.4": "* (no errqueue event in 900 ms)",
+                "hop.5": "172.68.48.30 icmp type=11 origin=2 ~43 ms",
+                "hop.6": "172.68.48.61 icmp type=11 origin=2 ~41 ms"
+            },
+            "durationMs": 1114
+        },
+        {
+            "id": "multinetwork.request_and_bind",
+            "title": "Concurrent per-network binding (Wi-Fi / cellular / ethernet)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "2 transport(s) acquired and bound (only currently-present links can bind)",
+            "evidence": {
+                "wifi": "network acquired; bindSocket=ok; downKbps=27368",
+                "cellular": "network acquired; bindSocket=ok; downKbps=13231",
+                "ethernet": "no network within 4s"
+            },
+            "durationMs": 4014
+        },
+        {
+            "id": "local.mdns_discover",
+            "title": "Multicast reception (MulticastLock + mDNS/NSD)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "mDNS discovery ran; 4 service(s)/type(s) seen across 3 queries",
+            "evidence": {
+                "multicast_lock": "acquired",
+                "meta.started": "true",
+                "meta.found": "0",
+                "meta.type": "_services._dns-sd._udp.",
+                "http.started": "true",
+                "http.found": "4",
+                "http.names": "Magic 2 LAN 1-1, Magic 2 LAN triple #5, Magic 2 LAN triple #4, EPSON WF-7840 Series",
+                "http.type": "_http._tcp.",
+                "googlecast.started": "true",
+                "googlecast.found": "0",
+                "googlecast.type": "_googlecast._tcp."
+            },
+            "durationMs": 10008
+        },
+        {
+            "id": "peer.ble_advertise",
+            "title": "BLE peripheral advertising (peer-mode control channel)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Advertising start: success",
+            "evidence": {
+                "FEATURE_BLUETOOTH_LE": "true",
+                "adapter_enabled": "true",
+                "multi_advertisement_supported": "true",
+                "startAdvertising": "success"
+            },
+            "durationMs": 38
+        },
+        {
+            "id": "shizuku.command_battery",
+            "title": "Shizuku shell tier (ip neigh / route / dumpsys network_stack)",
+            "tier": "SHIZUKU",
+            "verdict": "SUPPORTED",
+            "summary": "Shizuku runs as shell(2000); 7/7 commands returned data",
+            "evidence": {
+                "binder_alive": "true",
+                "version": "13",
+                "runs_as": "shell(2000)",
+                "permission": "true",
+                "id": "uid=2000\nuid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0",
+                "ip_neigh": "uid=2000\n10.13.102.111 dev wlan0  FAILED\n10.13.102.50 dev wlan0 lladdr 50:57:9c:4f:7a:3c STALE\n10.13.102.31 dev wlan0 lladdr 98:5f:d3:f6:f1:75 STALE\n10.13.102.116 dev wlan0 lladdr 0c:08:b4:03:68:0e STALE\n10.13.102.120 dev wlan0 lladdr 0e:d8:14:58:6c:8b REACHABLE\n10.13.102.5 dev wlan0 lladdr 90:09:d0:1a:83:e4 DELAY\n10.13.102.1 dev wlan0 lladdr 78:9a:18:54:b8:f9 REACHABLE\n10.13.102.21 dev wlan0 lladdr c8:7f:54:01:94:7c STALE\nfe80::babe:f4ff:febc:caf9 dev wlan0 lladdr b8:be:f4:bc:ca:f9 REACHABLE\nfe80::7a9a:18ff:fe54:b8f9 dev wlan0 lladdr 78:9a:18:54:b8:f9 router STALE\nfe80::babe:f4ff:febc:cacf dev wlan0 lladdr b8:be:f4:bc:ca:cf REACHABLE\nfe80::babe:f4ff:fec2:bf14 dev wlan0 lladdr b8:be:f4:c2:bf:14 STALE",
+                "ip6_route": "uid=2000\n2001:4bb8:2fb:fe4c::/64 dev rmnet_data3 table 1027 proto kernel metric 256 pref medium\n2001:4bb8:2fb:fe4c::/64 dev rmnet_data3 table 1027 proto static metric 1024 pref medium\nfe80::/64 dev rmnet_data3 table 1027 proto kernel metric 256 pref medium\ndefault via fe80::f8e0:266:53b9:549 dev rmnet_data3 table 1027 proto ra metric 1024 expires 65484sec hoplimit 255 pref medium\nfe80::/64 dev wlan0 table 1028 proto kernel metric 256 pref medium\nfe80::/64 dev wlan0 table 1028 proto static metric 1024 pref medium\ndefault via fe80::7a9a:18ff:fe54:b8f9 dev wlan0 table 1028 proto ra metric 1024 expires 1777sec pref medium\nfe80::/64 dev vgate0 table 1031 proto kernel metric 256 pref medium\n2001:4bb8:417:bd78::/64 dev rmnet_data4 table 1032 proto kernel metric 256 pref medium\n2001:4bb8:417:bd78::/64 dev rmnet_data4 table 1032 proto static metric 1024 pref medium\nfe80::/64 dev rmnet_data4 table 1032 proto kernel metric 256 pref medium\ndefault via fe80::246f:12be:21ef:1b54 dev rmnet_data4 table 1032 proto ra metric 1024 expires 63457sec hoplimit 255 pref medium\n2001:4bb8:2fb:fe4c::/64 dev rmnet_data3 table 1000000027 proto static metric 1024 pref medium\nfe80::/64 dev wlan0 table 1000000028",
+                "ip_addr": "uid=2000\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\n    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1/8 scope host lo\n       valid_lft forever preferred_lft forever\n    inet6 ::1/128 scope host \n       valid_lft forever preferred_lft forever\n2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000\n    link/ether be:3d:e2:93:78:b9 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::bc3d:e2ff:fe93:78b9/64 scope link \n       valid_lft forever preferred_lft forever\n3: ifb0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN group default qlen 1000\n    link/ether ba:6e:46:b5:3d:bb brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::b86e:46ff:feb5:3dbb/64 scope link \n       valid_lft forever preferred_lft forever\n4: ifb1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc htb state UNKNOWN group default qlen 1000\n    link/ether d6:2a:e2:f5:93:8f brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::d42a:e2ff:fef5:938f/64 scope link \n       valid_lft forever preferred_lft forever\n5: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000\n    link/ipip 0.0.0.0 brd 0.0.0.0\n6: gre0@NONE: <NO",
+                "ip_monitor": "uid=2000\n[NEIGH]10.13.102.5 dev wlan0 lladdr 90:09:d0:1a:83:e4 PROBE\n[NEIGH]10.13.102.5 dev wlan0 lladdr 90:09:d0:1a:83:e4 REACHABLE",
+                "dhcp_log": "uid=2000\nRecently active IpClient logs:\nIpClient.wlan0\n  IpClient.wlan0 APF dump:\n    Capabilities: { apfVersionSupported: 6000, maximumApfProgramSize: 4096 }\n    InstallableProgramSizeClamp: 2147483647\n--\n  IpClient.wlan0 current ProvisioningConfiguration:\n    ProvisioningConfiguration{mUniqueEui64AddressesOnly: false, mEnablePreconnection: false, mUsingMultinetworkPolicyTracker: true, mUsingIpReachabilityMonitor: true, mRequestedPreDhcpActionMs: 18000, mInitialConfig: null, mStaticIpConfig: null, mApfCapabilities: ApfCapabilities{version: 6000, maxSize: 4096, format: 1}, mProvisioningTimeoutMs: 18000, mIPv6AddrGenMode: 0, mNetwork: 171, mDisplayName: \"hudeWLAN\", mCreatorUid:1000, mScanResultInfo: SSID: hudeWLAN, BSSID: 24:5a:4c:5f:58:c5, Information Elements: {[ID: 0, [104, 117, 100, 101, 87, 76, 65, 78]][ID: 1, [-126, -124, -117, -106, 18, 36, 72, 108]][ID: 3, [6]][ID: 42, [0]][ID: 50, [12, 24, 48, 96]][ID: 45, [-83, 1, 23, -1, -1, -1, -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 24, 4, -121, 25, 0]][ID: 61, [6, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]][ID: 48, [1, 0, 0, 15, -84, 4, 1, 0, 0, 15, -84, 4, 1, 0, 0, 15, -84, 2, 0, 0]][ID: 127, [0, 0, 8, -128, ",
+                "wifi_dump": "uid=2000\n rec[36]: time=07-30 14:23:23.284 processed=L2ConnectedState org=L3ConnectedState dest=<null> what=CMD_POST_DHCP_ACTION screen=off v4 v4r v4dns v6r\n rec[37]: time=07-30 14:23:23.289 processed=L2ConnectedState org=L3ConnectedState dest=<null> what=CMD_IPV4_PROVISIONING_SUCCESS screen=off DhcpResultsParcelable{baseConfiguration: IP address 10.13.102.122/24 Gateway 10.13.102.1  DNS servers: [ 10.13.102.1 ] Domains hudelist.local, leaseDuration: 600, mtu: 0, serverAddress: 10.13.102.1, vendorInfo: null, serverHostName: , captivePortalApiUrl: null}\n rec[38]: time=07-30 14:23:23.295 processed=ConnectableState org=L3ConnectedState dest=<null> what=CMD_UPDATE_LINKPROPERTIES screen=off 17 0 v4 v4r v4dns v6r\n rec[39]: time=07-30 14:23:44.742 processed=ConnectableState org=L3ConnectedState dest=<null> what=CMD_SCREEN_STATE_CHANGED screen=on 1 0\n--\n rec[51]: time=07-30 14:28:23.334 processed=L2ConnectedState org=L3ConnectedState dest=<null> what=CMD_POST_DHCP_ACTION screen=off v4 v4r v4dns v6r\n rec[52]: time=07-30 14:28:23.339 processed=L2ConnectedState org=L3ConnectedState dest=<null> what=CMD_IPV4_PROVISIONING_SUCCESS screen=off DhcpResultsParcelable{baseConfiguration: IP address 10"
+            },
+            "durationMs": 5900
+        }
+    ]
+}
@@ -0,0 +1,172 @@
+{
+    "schema": "echolot/prober-report",
+    "schemaVersion": "0.1.0",
+    "proberBuild": 3,
+    "device": {
+        "manufacturer": "LENOVO",
+        "model": "TB330FU",
+        "androidSdk": 35,
+        "androidRelease": "15"
+    },
+    "results": [
+        {
+            "id": "link.snapshot",
+            "title": "LinkProperties snapshot (all active networks)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "1 active network(s) read",
+            "evidence": {
+                "network_count": "1",
+                "net0.wifi.iface": "wlan0",
+                "net0.wifi.mtu": "0",
+                "net0.wifi.addrs": "fe80::cd8:14ff:fe58:6c8b/64, 10.13.102.120/24",
+                "net0.wifi.dns": "10.13.102.1",
+                "net0.wifi.routes": "fe80::/64 -> :: wlan0 mtu 0 | ::/0 -> fe80::7a9a:18ff:fe54:b8f9 wlan0 mtu 0 | 10.13.102.0/24 -> 0.0.0.0 wlan0 mtu 0 | 0.0.0.0/0 -> 10.13.102.1 wlan0 mtu 0",
+                "net0.wifi.domains": "hudelist.local",
+                "net0.wifi.nat64": "none",
+                "net0.wifi.private_dns": "off/opportunistic"
+            },
+            "durationMs": 23
+        },
+        {
+            "id": "icmp.ping4",
+            "title": "ICMPv4 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Echo reply on the default network",
+            "evidence": {
+                "default": "reply type=0 rtt_ms=20.0 bytes=22 target=1.1.1.1",
+                "net.wifi": "reply type=0 rtt_ms=27.6 bytes=22 target=1.1.1.1"
+            },
+            "durationMs": 63
+        },
+        {
+            "id": "icmp.ping6",
+            "title": "ICMPv6 echo (unprivileged datagram socket)",
+            "tier": "APP",
+            "verdict": "ERROR",
+            "summary": "No echo reply on any of 2 attempt(s)",
+            "evidence": {
+                "default": "error: recvfrom failed: EAGAIN (Try again)",
+                "net.wifi": "error: recvfrom failed: EAGAIN (Try again)"
+            },
+            "durationMs": 6312
+        },
+        {
+            "id": "sockopt.matrix",
+            "title": "Socket options: TTL, RECVERR, MTU_DISCOVER (DF)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "4/4 core sockopts accepted; IP_MTU read=false",
+            "evidence": {
+                "IP_TTL": "accepted (ttl=5)",
+                "IP_TOS/DSCP": "accepted (EF/46)",
+                "IP_RECVERR": "accepted",
+                "IP_MTU_DISCOVER=PROBE": "accepted (DF set)",
+                "IP_MTU(read)": "unreadable: android.system.Os.getsockoptInt [class java.io.FileDescriptor, int, int]"
+            },
+            "durationMs": 5
+        },
+        {
+            "id": "trace.errqueue_reachable",
+            "title": "Traceroute via IP_RECVERR + MSG_ERRQUEUE",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Errqueue path fully reachable from Os API",
+            "evidence": {
+                "IP_RECVERR": "accepted",
+                "IP_TTL=1": "accepted",
+                "StructMsghdr": "true",
+                "Os.recvmsg": "true"
+            },
+            "durationMs": 12
+        },
+        {
+            "id": "traceroute.udp4",
+            "title": "UDP traceroute via MSG_ERRQUEUE (no root, no JNI)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "5 hop(s) read via errqueue — no native shim needed",
+            "evidence": {
+                "recvmsg_api": "StructMsghdr + Os.recvmsg via reflection",
+                "target": "1.1.1.1",
+                "hop.1": "10.13.102.1 icmp type=11 origin=2 ~45 ms",
+                "hop.2": "178.191.103.254 icmp type=11 origin=2 ~43 ms",
+                "hop.3": "195.3.76.32 icmp type=11 origin=2 ~44 ms",
+                "hop.4": "* (no errqueue event in 900 ms)",
+                "hop.5": "172.68.48.30 icmp type=11 origin=2 ~43 ms",
+                "hop.6": "172.68.48.61 icmp type=11 origin=2 ~44 ms"
+            },
+            "durationMs": 1144
+        },
+        {
+            "id": "multinetwork.request_and_bind",
+            "title": "Concurrent per-network binding (Wi-Fi / cellular / ethernet)",
+            "tier": "APP",
+            "verdict": "PARTIAL",
+            "summary": "1 transport(s) acquired and bound (only currently-present links can bind)",
+            "evidence": {
+                "wifi": "network acquired; bindSocket=ok; downKbps=60000",
+                "cellular": "no network within 4s",
+                "ethernet": "no network within 4s"
+            },
+            "durationMs": 8043
+        },
+        {
+            "id": "local.mdns_discover",
+            "title": "Multicast reception (MulticastLock + mDNS/NSD)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "mDNS discovery ran; 4 service(s)/type(s) seen across 3 queries",
+            "evidence": {
+                "multicast_lock": "acquired",
+                "meta.started": "true",
+                "meta.found": "0",
+                "meta.type": "_services._dns-sd._udp.",
+                "http.started": "true",
+                "http.found": "4",
+                "http.names": "Magic 2 LAN 1-1, Magic 2 LAN triple #4, Magic 2 LAN triple #5, EPSON WF-7840 Series",
+                "http.type": "_http._tcp.",
+                "googlecast.started": "true",
+                "googlecast.found": "0",
+                "googlecast.type": "_googlecast._tcp."
+            },
+            "durationMs": 10035
+        },
+        {
+            "id": "peer.ble_advertise",
+            "title": "BLE peripheral advertising (peer-mode control channel)",
+            "tier": "APP",
+            "verdict": "SUPPORTED",
+            "summary": "Advertising start: success",
+            "evidence": {
+                "FEATURE_BLUETOOTH_LE": "true",
+                "adapter_enabled": "true",
+                "multi_advertisement_supported": "true",
+                "startAdvertising": "success"
+            },
+            "durationMs": 60
+        },
+        {
+            "id": "shizuku.command_battery",
+            "title": "Shizuku shell tier (ip neigh / route / dumpsys network_stack)",
+            "tier": "SHIZUKU",
+            "verdict": "UNSUPPORTED",
+            "summary": "Shizuku runs as shell(2000); 0/7 commands returned data",
+            "evidence": {
+                "binder_alive": "true",
+                "version": "13",
+                "runs_as": "shell(2000)",
+                "permission": "true",
+                "id": "SHIZUKU_BIND_TIMEOUT",
+                "ip_neigh": "SHIZUKU_BIND_TIMEOUT",
+                "ip6_route": "SHIZUKU_BIND_TIMEOUT",
+                "ip_addr": "SHIZUKU_BIND_TIMEOUT",
+                "ip_monitor": "SHIZUKU_BIND_TIMEOUT",
+                "dhcp_log": "SHIZUKU_BIND_TIMEOUT",
+                "wifi_dump": "SHIZUKU_BIND_TIMEOUT"
+            },
+            "durationMs": 50114
+        }
+    ]
+}