diff --git a/docs/build-status.md b/docs/build-status.md
index ee77965..86b0c83 100644
--- a/docs/build-status.md
+++ b/docs/build-status.md
@@ -285,3 +285,17 @@ The daemon now proves its own host is a clean measurement target:
 - Both signals ride in the profile as `server_selftest{mtu_ok,sysctl_ok}` so a client can skip
   MTU testing when the server can't support it honestly.
 fmr profile now: `{mtu_ok: true, sysctl_ok: true}`.
+
+## Server v0.3.6 — tls-echo / JA4: spec §4 COMPLETE (2026-07-31)
+The elt-echo TLS variant runs on the TCP-echo port (8441), multiplexed by a timed 0x16 peek
+(plain echo stays server-speaks-first; a TLS ClientHello routes to the TLS path). It captures
+the full ClientHello, returns it raw (b64) + as a JA4 fingerprint (FoxIO), then TLS byte-echoes —
+the sec.clienthello_echo evidence. Hand-rolled ClientHello parser (ciphers/exts/ALPN/
+supported_versions/sig-algs, GREASE-excluded), unit-tested. **Cross-client verified on fmr**:
+openssl → t13d3013eo (30 ciphers), python ssl → t13d1712eo (17) — different stacks, different
+fingerprints, correct _a structure both. Capability tls-echo.
+
+Spec §4 (TCP/TLS/HTTP/STUN) is now fully implemented. Server capabilities: udp-probe,
+delayed-echo, connect-back, http-echo, tcp-echo, tls-echo, stun-5780, canary-dns.
+Remaining spec: §5 heavy actions (downtrain/big_send/frag_send/throughput) + the TRAIN_REPORT
+retrieval path — all gated on the anti-amplification grant machinery (§3.4) — and a real admin UI.