app: listen to what the segment says unprompted

Four passive collectors join long mode: SSDP (passive NOTIFY plus paced
M-SEARCH from the capture socket, so unicast replies land in the same
capture), LLMNR, NetBIOS-NS and WS-Discovery. All are periodic and sparse
by nature, which is exactly why they belong to a window rather than a
probe - a thirty-second run mostly hears silence and would report an
empty network as confidently as a quiet one.

NetBIOS reports unsupported on the app tier and says why: UDP 137 is
privileged. The decoder and evidence shape are tested and waiting for the
Shizuku tier; a recorded reason beats a missing test.

Silence without a multicast lock or a group join is PARTIAL, never OK -
that case is a fact about this app, not about the network. Hostnames,
banners and device UUIDs are classified in core-privacy so the anonymizer
treats them like every other identifier rather than letting a neighbour's
device model ride out in an upload.

No active WSD Probe and no NBSTAT sweep: the app listens to what a
network broadcasts, it does not announce itself to strangers or
interrogate its neighbours.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -1399,6 +1399,20 @@ plus periodic M-SEARCH), LLMNR, NetBIOS-NS and WS-Discovery — all IP multicast
 sockets an app may open. The security reading matters as much as the inventory: LLMNR and
 NetBIOS-NS being live on a segment is a finding in itself, since both are trivially spoofable.
 
+**One of those four cannot run at app tier either, and says so.** `local.netbios_inventory`
+reports `unsupported` with the bind error attached: UDP 137 is below 1024, and Android reserves
+privileged ports exactly like any other Linux. The decoder, the evidence shape and the registry
+id are built and tested, waiting for the Shizuku tier to supply a socket. Recorded as a result
+rather than dropped, so nobody later reads its absence as an oversight.
+
+Two deliberate restraints in that work, both worth keeping: no active WS-Discovery Probe (an
+M-SEARCH is traffic every SSDP device expects constantly, whereas a WSD Probe from an unknown
+host announces *this* device to the segment), and no NBSTAT sweep (that is host scanning, not
+measurement — the app listens to what a network broadcasts, it does not interrogate its
+neighbours). The parsers are also hardened against the input they will actually meet: a DNS
+compression pointer is refused rather than followed (the classic parser hang), and the WSD
+extractor is string-based on purpose, tested against an entity bomb and 20 000-deep nesting.
+
 ## Design note: what BLE between two devices is actually for (2026-08-02, not built)
 
 Two or more phones running Echolot, talking over Bluetooth LE. The schema already anticipates