[andre487]

Busy DNS workloads could exhaust the 64-flow budget with already completed UDP queries, while JSON subscription refreshes discarded local DNS approvals. Completed UDP flows are now evicted with their TUN mappings; pending replies and TCP DNS streams remain protected. Local approvals survive unchanged resolver updates/imports and reset when the resolver changes.

MegaProxy is also selected for split tunneling by default, including a one-time migration of existing lists. Subsequent explicit exclusion persists. The speed screen explains how to enable MegaProxy routing and reconnect when it is excluded.

The failing JVM configuration-loading checks now use deterministic configuration dispatch, with a separate controlled-worker test for the real background-read boundary. Notification-stop integration invokes the published Android PendingIntent, so collapsed notification layouts cannot hide the tested action.

Validation:

• bundle exec fastlane android native_tests: 283 tests passed with the race detector.
• bundle exec fastlane android android_checks: 327 JVM tests, lint, debug and unsigned release builds passed.
• Instrumentation build and final lint passed after the notification-test change.
• Controlled API 26/API 35 emulator scenarios passed: all DNS transport modes, over 80 successive UDP DNS queries and reuse of an evicted socket mapping, real traffic/start/stop, the published notification stop action, and Keystore process restarts. API 35 also passed the denied-notification scenario. The initial API 35 notification-shade failure was investigated and its test changed before revalidation; no unchanged failed test was retried.

CI follow-up: main's Compose configuration-loading timeout is covered by the dispatcher fix above. Both main and an earlier PR run also lost the emulator ADB transport during post-test log collection; the root cause is unconfirmed. Kernel output now streams independently of ADB, and failed emulator jobs retain host resource/kernel diagnostics. No test-failure retries or coverage exclusions were added.

Latest candidate f6b279d: full API 26 and API 35 suites, Android JVM/lint/build, native race/integration, and 73 Python checks all passed. GitHub returned HTTP 404 while updating the Python report Check Run; publication of the existing artifact succeeded on retry. All current PR checks are green.

Physical CPH2551/Wi-Fi smoke with a separate test installation: 128 fresh UDP DNS sockets plus reuse of an evicted socket completed without errors (median 46 ms, maximum 108 ms). Split-tunnel h3 and h2 download/upload checks completed; Vivaldi Internetometer measured 65.0/48.7 Mbps. Speeds varied between runs, so elimination of the reported slowdown is not established. Exclusion warning and connection diagnostics worked. Original release VPN and UID routing were restored; temporary phone config/probe removed.