# Test matrix

## Automated

- Portable TUN/TAP bridge conversion and ARP behavior under CTest.
- Full pinned n3n static compilation on Linux.
- Android route planning unit tests.
- Android debug APK and unit-test build in CI.
- iOS simulator compile on an explicitly enabled macOS runner.
- n3n commit and clean-source verification.
- REST API authorization, schema, route, and complete regression suite.
- Portal mobile handoff helpers, component regression suite, and production build.

## Required device tests

Run each case on at least one physical Android 10 device, a current Android
device, an iPhone on iOS 16, and a current iPhone:

| Case | Expected result |
| --- | --- |
| Native sign-in | Login and device selection stay in the app's system browser; the verified App Link returns to the native UI |
| App absent | Fallback page keeps ticket out of URL history and offers install |
| Valid handoff | One OS VPN consent, then connected status in app and portal |
| Disclosure cancelled | Ticket remains unredeemed and no mobile VPN session is created |
| Reuse ticket | Redeem rejected without exposing session data |
| Expired/cancelled handoff | App shows terminal error and creates no connection |
| Local subnet overlap | Conflicting route omitted and reported |
| Overlay overlap | Tunnel fails before route installation |
| UDP available | Transport reports `udp-p2p` |
| UDP blocked | Connection falls back to `tcp-relay` |
| Wi-Fi to mobile | Tunnel reconnects without a second handoff |
| Screen locked/background | OS indicator remains and session stays healthy |
| Runtime restart | Runtime WebSocket reconnects or session fails explicitly |
| Portal cancellation | Native tunnel stops and credentials are removed |
| Connecting/connected UI | No portal action is shown; only the relevant disconnect action remains |
| App force-stop/reboot | No silent unauthorized tunnel; saved session is reconciled |
| Private runtime CA/pin | Correct certificate succeeds; mismatch fails closed |

Also verify that device and proxy logs contain no handoff ticket, mobile bearer,
n3n community/key, or decrypted connection payload.
