Merge vc25 (PR #111) — handoff reconciled: vps2 daemon restart resolved the mesh path; private-tree withdrawn

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HANDOFF-2026-07-23-companion-apk-deploy.md

@@ -127,6 +127,18 @@ Chain of findings, each verified live:
 - **Upstream:** report the direct-peer session-path asymmetry to
   jmcorgan/fips (0.4.1).
 
+## App-side recommendations implemented (23:30–23:50, Mac agent — 0.5.5/vc25)
+
+- Connect probe: mesh ULA now probed inside a **60s budget** with 15s
+  per-phase timeouts (rides out TCP retransmit backoff), replacing the old
+  ~8s window.
+- **Session pre-warm**: the VPN service starts probing every saved node ULA
+  the moment the tunnel is up (5s cadence for the first minute, then a 60s
+  keep-warm tick) — discovery/handshake cost is paid in the background, and
+  the session never idles out while the mesh is connected.
+- (A phone-side ping test in this window still showed zero replies — that
+  measurement predated the vps2 daemon restart below and is superseded.)
+
 ## RESOLVED — root cause was vps2's degraded daemon, NOT the public tree (23:45)
 
 The privatize-the-mesh recommendation above is WITHDRAWN. Final diagnosis: