diff --git a/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt b/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
index 582b077..dfbc525 100644
--- a/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
+++ b/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
@@ -147,6 +147,18 @@ class ServerStore(private val scheme: String, private val keyAlias: String) {
  * the OS drops the traffic, so a blocked app and an unreachable server produce the same connect
  * timeout. Without asking explicitly there is no way to tell those apart, and the failure shown
  * would blame the server or the tunnel for something neither is doing.
+ *
+ * **The permission is still required when the server is reached through WireGuard, and the
+ * platform's own documentation says otherwise.** Android's Local Network Definition describes a
+ * local network as one that "utilizes a broadcast-capable network interface, such as Wi-Fi or
+ * Ethernet, but excludes cellular (WWAN) or VPN connections" — read straight, a tunnelled 10.66.0.1
+ * is excluded and needs nothing. Measured on a real device on 2026-08-28: it is not excluded, and
+ * without the permission the traffic is dropped. Do not remove the permission on the strength of
+ * that paragraph.
+ *
+ * **Neither project can catch this in an emulator.** The API 36 images both are tested against do
+ * not enforce the permission at all, so removing it passes every local test and fails only on a
+ * phone. That asymmetry is the reason this note is here rather than in a commit message.
  */
 fun localNetworkAllowed(context: Context): Boolean =
     android.os.Build.VERSION.SDK_INT < 37 ||