[andre487]

Add opt-in source validation in Split tunneling (Android 10+), applied on reconnection. Both levels check TCP admission. Standard caches UDP permission for a fixed non-sliding second per live flow; Advanced checks every outgoing datagram. Existing enabled settings without a level migrate to Advanced; fresh opt-in selects Standard. Settings remain local and survive imports without being exported.

Disabled sessions retain the original transport and link endpoint instances and use Mobile.start, without source wrappers, UID queries or per-packet mode checks. Enabled sessions bound new admissions to 64 and ownership JNI calls to 8 across active and retiring sessions; overload fails closed. UDP numeric endpoint strings are prepared once per flow. The Echo filter reads only short headers for ordinary packets, with a single bounded copy for unusually long extension chains. Strict non-DNS UDP relays close both sides on denial/error instead of retaining idle upstream associations until the 60-second timeout; existing DNS cleanup and reply peer validation are preserved.

Visibility reports the actual running level and pending reconnection as a session status, not a separate-app bypass test. EN/RU UI and standalone documentation explain TCP setup latency, UDP cost, the Standard stale-owner window, shared UID limits and the non-atomic lookup/forwarding boundary.

Validation:

• bundle exec fastlane android native_tests: final full run passed, 315 tests with race detection.
• bundle exec fastlane android android_checks: 359 JVM/UI tests, lint, debug and unsigned release builds passed locally (arm64-v8a native AAR).
• bundle exec fastlane android native_fuzz: 20-second parser fuzzing passed, about 90,000 executions, including new ICMP seeds.
• Targeted source tests verify concurrency bounds across sessions, zero Go allocations for repeated UDP tuple checks, immediate upstream cleanup, peer filtering, invalid/truncated/segmented packet handling, cache expiry and disabled handler identity.
• Isolated packet-filter microbenchmark on Apple M4 Pro (without race instrumentation): 1500-byte packets, previous full copy 107.6 ns/op versus 10.49 ns/op for header inspection; 65535-byte packets, 1256 versus 10.43 ns/op. Disabled dispatch remains 0 B/op and 0 allocs/op. These measurements isolate filter CPU work; Android Binder latency and whole-app memory under device stress were not measured.
• API 35 TUN/JNI traffic tests exercise both levels in CI; local Docker fixtures were unavailable. git diff --check passed.

One preliminary full native run observed a 5-second timeout in the unchanged MASQUE MTU-discovery test, which does not execute source validation. Later full runs after further code changes passed; the timeout cause was not established, and test timeouts/retry policy were not changed.

APK artifacts

• Download debug APK — signed with the disposable Android debug key
• Download unsigned release APK — verified unsigned

Built from commit 88d8d8ef by CI run #435.
Artifacts expire after 14 days. Neither APK uses the MegaProxy release key.