andre487 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/PRIVACY.md b/PRIVACY.md
@@ -1,6 +1,6 @@
 # Privacy Policy
 
-**Last updated: October 11, 2026**
+**Last updated: October 27, 2026**
 
 MegaProxy is an Android VPN client for proxy servers you choose. It does not provide a proxy
 service, require an account, or automatically send usage data or crash reports to the developer.
@@ -14,6 +14,8 @@ connect to your servers. Passwords, imported private keys, configuration-subscri
 For per-app routing, MegaProxy reads the applications visible to it on your device and stores
 which applications you select. This information is used locally to configure routing, not
 uploaded as an application inventory. Profile exports can include these routing selections.
+Optional strict source validation also uses Android's local socket-owner lookup to check which app owns TCP/UDP traffic. These ownership
+checks and their settings stay on the device; they do not send an app inventory to a server.
 
 Connection statistics and diagnostic/crash logs are processed locally to display connection
 status and help troubleshoot failures. Logs contain operational events and error details;
@@ -53,9 +55,12 @@ device by public IP for 24 hours, and does not add them to diagnostic logs.
 When you explicitly start the speed test, MegaProxy contacts `https://h3.speed.cloudflare.com/`
 through each available route. Cloudflare receives the route's public IP and connection metadata.
 MegaProxy downloads and uploads the selected 10, 25 or 50 MB per route and displays the exit IP,
-country, negotiated protocol, latency and transfer speeds. The speed screen shows a temporary
-in-memory log of timing, protocol selection, HTTP status and transfer measurements; it contains
-no exit IP or response payloads and is discarded when the screen is closed.
+country, negotiated protocol, latency and transfer speeds. Diagnostics shares a bounded
+in-memory log between connection and speed tests, including timing, protocol selection, HTTP status
+and transfer measurements, without exit IPs or response payloads. Leaving Diagnostics cancels speed
+transfers; the shared log remains until the next connection test or process restart. It is copied
+or exported only when you choose that action. Diagnostic events are also written to the rotating
+local diagnostic log, which you can clear in Settings → Diagnostic log.
 
 If you configure a configuration subscription, MegaProxy downloads snapshots from the HTTPS
 sources you configure or their trusted replacements, automatically at the interval you choose when Android permits background work,

diff --git a/README.md b/README.md
@@ -12,7 +12,8 @@
 
 MegaProxy is an open-source Android VPN client for HTTPS, SOCKS5, MASQUE α (HTTP/3)
 and SSH servers you control or trust, including **HTTPS and SSH jump hosts** for multi-hop connections.
-Route all apps or selected apps through your server.
+Route all apps or selected apps through your server. Optional **app ownership checks** on Android 10+
+validate TCP/UDP sources. Disabled by default, with [Standard and Advanced levels](docs/en/source-validation.md).
 No account, ads, analytics or remote telemetry. **Servers and credentials are not included.**
 
 ## Installation
@@ -33,7 +34,8 @@ install over the existing app to preserve profiles. PR APKs are test builds.
 
 1. Add or import a server profile.
 2. Choose global routing or select apps for split tunneling.
-3. Run **Test** from the main menu, then **Connect** and approve Android's VPN request.
+3. Tap **Connect** and approve Android's VPN request.
+4. Open **Diagnostics**: the connection test starts automatically; speed tests unlock after success.
 
 Server setup: [MegaProxyServer](https://github.com/andre487/MegaProxyServer).
 All guides: [English](docs/en/index.md) / [Русский](docs/ru/index.md).
@@ -44,13 +46,14 @@ All guides: [English](docs/en/index.md) / [Русский](docs/ru/index.md).
 - HTTPS CONNECT over HTTP/1.1 or multiplexed HTTP/2; optional HTTP/3 preference with HTTPS fallback.
 - SOCKS5 TCP/UDP, experimental MASQUE TCP/UDP over HTTP/3 and SSH.
 - Per-app routing, local-network bypass, optional IPv6 and Android Always-on VPN.
-- Optional [strict source validation](docs/en/source-validation.md) on Android 10+: app ownership checks and ping blocking, applied on reconnection.
+- Optional [app ownership checks](docs/en/source-validation.md): Standard/Advanced UDP policies, TCP admission and ping blocking; applied on reconnection.
 - Multiple profiles, import/export, HTTPS configuration subscriptions and automatic failover.
 - DNS-over-HTTPS, optional plain TCP/UDP DNS, selectable TLS/QUIC/SSH fingerprints and custom JA3.
-- Traffic totals/rates, passive TCP/QUIC metrics, connection tests, download/upload speed tests
-  and VPN visibility with ProxyCheck IP reputation.
+- Traffic totals/rates in IEC or SI, passive TCP/QUIC metrics, connection/speed diagnostics
+  with a shared exportable log, and VPN visibility with ProxyCheck IP reputation.
 - Local diagnostic logs, encrypted stored credentials, English and Russian interfaces.
 
+[Profiles, routing and Always-on](docs/en/profiles-and-routing.md) ·
 [Diagnostics and measurement limits](docs/en/connection-metrics.md) ·
 [Subscriptions](docs/en/subscriptions.md) · [App updates](docs/en/updates.md).
 
@@ -93,26 +96,24 @@ configured subscriptions and enabled app-update checks can also run in the backg
 | Subscriptions | Configured HTTPS sources receive their URL/query, optional Basic Auth, app version and `android` client ID; normal MegaProxy routing applies |
 | App updates | Selected F-Droid or GitHub source; [metadata/download endpoints and consent](docs/en/updates.md#network-and-implementation-details) |
 
-Speed defaults to h3 → h2 → h1; fallback only applies to initial protocol negotiation.
-Latency is median time to first byte from three requests, not passive proxy RTT. Leaving the
-screen cancels transfers; backgrounding alone does not. Its temporary timing log excludes IPs
-and response payloads. [Details](docs/en/connection-metrics.md#test-speed-and-vpn-visibility).
+Speed defaults to **h2 with h1 fallback**; h3 is optional. Fallback applies only to initial
+negotiation. Latency is median time to first byte from three requests, not passive proxy RTT.
+Leaving Diagnostics cancels speed transfers; Home does not. The shared log stays in memory until
+the next connection test or process restart; events also enter the rotating local diagnostic log.
+[Measurement and log details](docs/en/connection-metrics.md#test-speed-and-vpn-visibility).
 UDP probes test the proxy path, not every app's routing; fingerprint presets approximate handshakes,
 not complete browser behaviour. ProxyCheck verdicts and local VPN heuristics are not proof of anonymity.
 
 ## Configuration
 
-Import MegaProxy JSON, ProxyList, FoxyProxy JSON or supported SuperProxy text. Portable JSON version 8
-uses stable profile IDs; omitted secrets preserve saved values only for unchanged endpoints and accounts;
-explicit empty values clear them.
-Unsupported explicit transports are rejected. [Schema and examples](config-schema/) ·
-[MegaProxyConfig contract](https://github.com/andre487/MegaProxyConfig).
+Import MegaProxy JSON, ProxyList, FoxyProxy JSON or supported SuperProxy text. JSON transfers
+profiles and portable settings; ProxyList exports standalone HTTPS/MASQUE/SOCKS5 endpoints.
+Omitted secrets are kept only for unchanged servers/accounts; exported credentials and URL
+tokens are sensitive. Device-local settings, including app ownership checks, stay local.
+[Profiles and transfers](docs/en/profiles-and-routing.md) · [Schemas and examples](config-schema/).
+
 Trusted [configuration subscriptions](docs/en/subscriptions.md) refresh owned profiles without
 replacing local profiles or interrupting current tunnels; changed live settings offer reconnect.
-Exported credentials and URL tokens are sensitive.
-JSON transfers profiles and portable settings, not a full app backup. MTU, DNS security approvals,
-language, traffic units and update preferences stay local. ProxyList exports only standalone
-HTTPS/MASQUE/SOCKS5 endpoints; use JSON for SSH, Jump and other settings.
 
 ## Limitations
 

diff --git a/docs/en/connection-metrics.md b/docs/en/connection-metrics.md
@@ -1,5 +1,7 @@
 # Connection quality metrics
 
+[Русский](../ru/connection-metrics.md) · [All guides](index.md)
+
 The main screen displays payload totals/rates and passive metrics to the **first proxy**:
 TCP RTT/retransmits for TCP transports, QUIC RTT/loss declarations for HTTP/3. An established
 HTTP/3 session identifies the transport before any tunnel payload is sent.
@@ -13,8 +15,8 @@ HTTP/3 session identifies the transport before any tunnel payload is sent.
   while the process runs; deltas are assigned to their observation time. Android
   suspension can delay observations. No probe traffic or wake lock is added.
 - Both metrics cover the phone to the **first proxy only**. SSH/HTTP2 channels and
-  subsequent jump hops are not counted again. Local bypass traffic and standalone
-  connection diagnostics are excluded from these TCP metrics.
+  subsequent jump hops are not counted again. SOCKS5 UDP control sockets are included,
+  not UDP path metrics. Local bypass traffic and standalone diagnostics are excluded.
 - Retransmits describe the phone's outgoing segments, not a packet-loss percentage.
   They cannot measure all download losses or the proxy-to-destination path. Zero
   retransmits does not prove a healthy end-to-end connection. Failed TCP dials
@@ -90,12 +92,6 @@ log complete TLS/SSH state objects. HTTP rejection messages use numeric status
 codes, not server-provided reason text; connection-test providers use indices.
 
 
-SOCKS5 profiles support TCP CONNECT and UDP ASSOCIATE, with optional credentials
-(1–255 UTF-8 bytes each), on port 1080 by default. SOCKS5 adds no encryption or TLS
-fingerprint. DNS defaults to DoH through the proxy; see [DNS modes](dns.md). The connection test also checks
-end-to-end HTTP/3 over SOCKS5 UDP. TCP metrics cover proxy TCP connections, including
-UDP control connections; they do not measure UDP loss or RTT.
-
 ## Test, Speed and VPN visibility
 
 Diagnostics and VPN visibility are available in the main menu. Diagnostics starts the connection test on opening; speed checks unlock only after it passes. Speed checks require an explicit start. Both operations share a bounded log at the bottom, with copying and export to a text file. Running another connection test clears the log and locks speed checks until success. The connection test cannot be restarted during a speed check.
@@ -122,13 +118,13 @@ it is not SSL-handshake time, an ICMP ping or the main screen's passive RTT.
 Cloudflare's `h3.speed.cloudflare.com` endpoint is used for protocol-capable measurements.
 The log records DNS/TCP/TLS/QUIC stages, protocol/fallback, HTTP status, connection reuse,
 bytes and transfer timing; no response payloads or exit IP are added to the log.
-Leaving Diagnostics or recreating its UI cancels speed requests and discards speed results. The shared in-memory log remains until the next connection test or process restart. Home/background alone does not cancel requests.
+Leaving Diagnostics or recreating its UI cancels speed requests and discards speed results. The shared in-memory log remains until the next connection test or process restart. Home/background alone does not cancel requests. Events are also copied to the rotating local
+diagnostic log; clear or export it separately in **Settings → Diagnostic log**.
 
 ProxyCheck success is cached per public IP for 24 hours. Daily quota exhaustion, network failure
 and unknown response format are distinct states; unavailable routes are shown separately.
 Tests parse fixtures rather than contacting ProxyCheck. Full endpoint inventory: [README](../../README.md#privacy-and-security).
 
-[Русская версия](../ru/connection-metrics.md)
 
 UDP forwarding is available with MASQUE, SOCKS5 and HTTPS when HTTP/3 is negotiated.
 HTTPS over TCP and SSH block ordinary UDP; DNS has its own routing rules in the

diff --git a/docs/en/index.md b/docs/en/index.md
@@ -1,84 +1,52 @@
 # MegaProxy documentation
 
-Server configurations and setup instructions have moved to the dedicated
-[MegaProxyServer repository](https://github.com/andre487/MegaProxyServer).
+[Русский](../ru/index.md)
 
-Client documentation:
+MegaProxy connects your Android device to servers you control or trust. Servers and credentials
+are not included; server setup lives in [MegaProxyServer](https://github.com/andre487/MegaProxyServer).
 
-- [Configuration subscriptions](subscriptions.md)
-- [Strict traffic source validation](source-validation.md)
-- [Installation](installation.md)
-- [App updates](updates.md)
-- [Connection metrics, Test, Speed and VPN visibility](connection-metrics.md)
-- [SOCKS5](#socks5)
-- [MASQUE α (HTTP/3), experimental](masque.md)
-- [HTTPS with Jump](#https-with-jump)
+## Start here
 
-Developer documentation:
+1. [Install MegaProxy](installation.md), then add or import a [server profile](profiles-and-routing.md).
+2. Select all apps or choose apps in **Split tunneling**. Android 10+ also offers optional
+   [app ownership checks](source-validation.md), off by default.
+3. Tap **Connect** and approve Android's VPN request.
+4. Open **Diagnostics**: the connection test starts automatically; speed tests unlock after success.
 
-- [Fastlane workflow](fastlane.md)
-- [Testing policy and release acceptance](release-testing.md)
-- [Release automation](release-automation.md)
+## Guides
 
-## SOCKS5
+| Guide | Covers |
+| --- | --- |
+| [Profiles and routing](profiles-and-routing.md) | HTTPS/SSH/Jump/SOCKS5, app selection, LAN bypass, failover, Always-on, import/export and local settings |
+| [App ownership checks](source-validation.md) | Standard/Advanced UDP policies, TCP admission, ping blocking and compatibility limits |
+| [DNS](dns.md) | DoH, plain TCP/UDP, routing and local security approvals |
+| [MASQUE α](masque.md) | Experimental HTTP/3 setup, fingerprints and interoperability limits |
+| [Diagnostics and metrics](connection-metrics.md) | Connection/speed checks, shared log, VPN visibility, passive metrics and MTU |
+| [Configuration subscriptions](subscriptions.md) | HTTPS sources, refresh, profile ownership and reconnect notifications |
+| [App updates](updates.md) | F-Droid/GitHub selection, daily checks, consent and version/signature rules |
 
-Select **SOCKS5** and enter the server hostname and port (default 1080). Leave both
-credentials empty, or enter a username and password of 1–255 UTF-8 bytes each.
-SOCKS5 does not encrypt the proxy connection or credentials and does not apply a
-browser TLS fingerprint. Application TLS and DoH retain their own encryption.
-By default, DNS uses the selected DoH provider over proxied TCP; other UDP uses UDP ASSOCIATE.
-The relay must return a reachable IP address and nonzero UDP port. Wildcard relay
-addresses use the proxy bootstrap IP; hostname relays are rejected without system DNS.
-Local-network bypass, app routing, IPv6 policy, failover and traffic counters apply.
-TCP RTT/retransmits describe the first proxy's TCP sockets, including UDP control
-connections; these are not measurements of the relayed UDP path. No SOCKS5 Jump
-mode is defined. JSON uses `proxy.type: "SOCKS5"`; ProxyList accepts
-`socks5://host:1080` and `socks5://user:password@host:1080`.
+## SOCKS5
 
-For GOST, enable UDP explicitly: `gost -L 'socks5://user:password@:1080?udp=true'`.
-See [GOST SOCKS5 documentation](https://gost.run/en/tutorials/protocols/socks/).
-The proxy's advertised UDP relay must be reachable through its firewall/NAT.
+TCP CONNECT and UDP ASSOCIATE with optional credentials. **SOCKS5 does not encrypt the
+connection or password.** [Setup and relay limits](profiles-and-routing.md#socks5).
 
 ## HTTPS with Jump
 
-Select **HTTPS with Jump** to use two HTTPS CONNECT proxies in sequence:
-phone → jump proxy → destination proxy → website. Enter the destination proxy in the main
-connection fields and the first hop in **Jump HTTPS proxy**. Both ports default to 443.
-The jump proxy must allow CONNECT to the destination proxy hostname and port; it resolves that
-hostname. Only the jump proxy is bootstrapped on the phone. Both hops use the selected TLS
-fingerprint and support HTTP/1.1 and HTTP/2 CONNECT independently.
-
-Each hop verifies its own TLS certificate and can use separate Basic Auth credentials. The
-optional shared-authentication setting reuses the destination username and password. Certificate
-verification exceptions apply only to the selected hop. Connection tests and DoH use the chain;
-local-network destinations still follow the existing bypass setting. A failed hop never causes
-fallback to a direct connection to the destination proxy.
-
-JSON schema version 8 stores this mode as `proxy.type: "HTTPS_JUMP"`, with first-hop settings in
-`proxy.jump`: `host`, `port`, `sameAuthentication`, `username`, `password`, and
-`allowInvalidProxyCertificate`. Export passwords only when needed. Older application versions
-reject version 8 files, preventing a chain from being imported as a single proxy. ProxyList
-exports support single HTTPS, MASQUE and SOCKS5 proxies and omit chain profiles.
-
-HTTPS profiles, including HTTPS with Jump, also offer **Prefer HTTP/3 α** (off by default): try MASQUE
-on the same host/UDP port, then HTTPS when unavailable. Certificate and
-authentication errors remain terminal. HTTPS fallback blocks ordinary UDP and
-shows a warning; explicit MASQUE profiles never fall back. JSON stores the
-preference in `profiles[].proxy.preferHttp3`. With Jump, both nodes must support
-MASQUE and a usable datagram MTU; otherwise the entire chain retains HTTPS.
-
-[Русская версия](../ru/index.md)
-
-[DNS: modes, routing and certificates](dns.md).
+Two proxies with independent authentication and certificate checks; optional HTTP/3 requires
+both hops to support MASQUE. [Setup and fallback](profiles-and-routing.md#https-and-jump).
 
 ## Fingerprints and diagnostic logs
 
-The default HTTPS fingerprint currently follows Chrome Android; a future update may
-choose a different browser preset. SSH presets control the client banner and the
-preferred key-exchange, cipher and MAC ordering. These settings describe the connection
-to the proxy, not the browser or other apps inside the tunnel. QUIC presets and manual
-JA3 requirements are documented in [MASQUE](masque.md).
+Fingerprints describe the proxy connection, not the applications inside it. The persistent
+log rotates within a configurable storage limit; the Diagnostics screen has a separate shared
+in-memory log. [Controls](profiles-and-routing.md#import-export-and-local-controls) ·
+[Measured and logged data](connection-metrics.md).
 
-The log size setting limits the combined size of two rotating segments to 1–100 MiB.
-Older events are removed as the segments rotate; clearing the log deletes both.
-See [connection metrics](connection-metrics.md) for what is measured and logged.
+## For developers
+
+- [Fastlane commands and setup](fastlane.md)
+- [Testing policy and release acceptance](release-testing.md)
+- [Native benchmarks and their limits](native-benchmarks.md)
+- [Release automation](release-automation.md)
+- [Artwork and F-Droid graphics](graphics.md)
+- [Go dataplane](../../native/README.md)
diff --git a/docs/en/installation.md b/docs/en/installation.md
@@ -26,9 +26,9 @@ link above or search for MegaProxy (`net.megaproxy487`), and install. Grant F-Dr
 permission if Android requests it.
 
 In MegaProxy, allow notifications for connection controls, add/import a profile, select global or
-per-app routing, and tap **Connect**. Confirm Android's VPN request. **Test**, **Speed** and
-**VPN visibility** are separate main-menu screens. MegaProxy's prominent split-routing switch
-and its app-list checkbox control the same selection; upstream sockets remain protected from loops.
+per-app routing, and tap **Connect**. Confirm Android's VPN request. **Diagnostics** starts a connection test on opening and unlocks speed tests after success; both
+share an exportable log. **Visibility** is a separate main-menu screen. For app selection and
+optional Android 10+ app ownership checks, see [profiles and routing](profiles-and-routing.md).
 
 ## Update safely