RKNHardering/app/src/main/res/values/strings.xml

<resources>
    <string name="app_name">RKNHardering</string>
    <string name="github_repo_url">https://github.com/xtclovver/RKNHardering</string>
    <string name="matrix_room_url">https://matrix.to/#/%23RKN_Hardering:matrix.kangel.tech</string>
    <string name="run_check_notice">During a check, depending on enabled checks and permissions, the app may make network requests to these endpoints:\n• api.beacondb.net\n• api.ipapi.is\n• www.iplocate.io\n• ip.mail.ru\n• api4.ipify.org\n• api6.ipify.org\n• 2ip.ru\n• ipv4-internet.yandex.net\n• ipv6-internet.yandex.net\n• api.sypexgeo.net\n• ifconfig.me\n• checkip.amazonaws.com\n• api.ipify.org\n• api-ipv4.ip.sb\n• api-ipv6.ip.sb\n\nIf split tunnel bypass, local proxy scan, or Xray API scan is enabled, the app may connect to local loopback endpoints:\n• 127.0.0.1 on selected ports\n• ::1 on selected ports\nPopular scans include ports 1080, 1081, 1443, 2080, 2081, 3067, 7890, 7891, 8080, 10085, 10808, 10809, and 12334; full scans use the configured range.\n\nIf a preset DNS resolver is selected, the app may also connect to these DNS endpoints:\n• 1.1.1.1\n• 1.0.0.1\n• 8.8.8.8\n• 8.8.4.4\n• 77.88.8.8\n• 77.88.8.1\n• cloudflare-dns.com\n• dns.google\n• common.dot.dns.yandex.net\n\nIf a custom DNS resolver is selected, the app may also connect to its user-entered IP addresses or DoH domain.\n\nIf CDN pulling is enabled, the app may additionally send HTTPS requests to these endpoints:\n• redirector.googlevideo.com\n• www.cloudflare.com\n• one.one.one.one\n• rutracker.org\n• meduza.io\n\nIf Call transport leak probe is enabled, the app may additionally send UDP/STUN requests to these endpoints:\n• stun.fitauto.ru:3478\n• stun.sberbank.ru:3478\n• stun.l.google.com:19302\n• stun1.l.google.com:19302\n• stun2.l.google.com:19302\n• stun3.l.google.com:19302\n• stun4.l.google.com:19302\n• stun.cloudflare.com:3478\n• global.stun.twilio.com:3478\n• stun.nextcloud.com:443\n• stun.sipgate.net:3478\n• stun.voip.blackberry.com:3478\n• stun.voipgate.com:3478\n• stun.antisip.com:3478\n• stun.sip.us:3478\n• stun.1und1.de:3478\n• stun.voipbuster.com:3478\n• stun.counterpath.net:3478\n• stun.ekiga.net:3478\n• stun.stunprotocol.org:3478\n• stun.schlund.de:3478\n• stun.linphone.org:3478\n\nFor proxy-assisted Telegram MTProto probing, the app may ask a local SOCKS5 proxy to connect to:\n• 149.154.167.51:443\n• 149.154.167.41:443\n\nIf ICMP spoofing detection is enabled, the app may additionally resolve and ping:\n• instagram.com\n• google.com\n\nIf update checks are enabled, the app may contact api.github.com.\n\nIf Debug diagnostics is enabled, the app can also prepare a copyable diagnostics report from the last completed scan, even when the scan finished successfully. That report is kept only in memory until you copy it. CDN pulling responses are included in that report.\n\nBy tapping "Run check", you agree that these network requests will be made from your device.\n\nThe app does not keep logs of these requests. Network access can be disabled in the app settings.</string>
    <string name="settings_title">Settings</string>
    <string name="settings_section_checks">Checks</string>
    <string name="settings_section_privacy">Privacy</string>
    <string name="settings_section_appearance">Appearance</string>
    <string name="settings_section_about">About</string>
    <string name="settings_subsection_local_scan">Local scan</string>
    <string name="settings_subsection_network">Network</string>
    <string name="settings_subsection_dns">DNS</string>
    <string name="settings_cat_split_tunnel">Split tunnel bypass</string>
    <string name="settings_cat_split_tunnel_desc">Ports &amp; probe</string>
    <string name="settings_cat_network">Network</string>
    <string name="settings_cat_network_desc">Requests &amp; CDN</string>
    <string name="settings_cat_dns">DNS</string>
    <string name="settings_cat_dns_desc">Resolver</string>
    <string name="settings_cat_privacy">Privacy</string>
    <string name="settings_cat_privacy_desc">IP masking</string>
    <string name="settings_cat_appearance">Appearance</string>
    <string name="settings_cat_appearance_desc">Theme &amp; language</string>
    <string name="settings_cat_accessibility">Accessibility</string>
    <string name="settings_cat_accessibility_desc">Color vision</string>
    <string name="settings_cat_about">About</string>
    <string name="settings_cat_about_desc">GitHub</string>
    <string name="settings_cat_debug">Debug</string>
    <string name="settings_cat_debug_desc">Diagnostics snapshot</string>
    <string name="settings_group_checks">Checks</string>
    <string name="settings_group_app">Application</string>
    <string name="settings_group_diagnostics">Diagnostics</string>
    <string name="settings_group_info">Information</string>
    <string name="settings_split_tunnel">Split tunnel bypass</string>
    <string name="settings_split_tunnel_desc">Port scanning takes a long time</string>
    <string name="settings_tun_probe_debug">Debug diagnostics</string>
    <string name="settings_tun_probe_debug_desc">Keeps an in-memory diagnostics snapshot from the last completed scan, including CDN pulling responses, and enables the Copy diagnostics button on the main screen.</string>
    <string name="settings_tun_probe_mode_title">TUN probe method</string>
    <string name="settings_tun_probe_mode_desc">Overrides the TUN public-IP probe method used during split tunnel checks.</string>
    <string name="settings_tun_probe_mode_auto">Auto</string>
    <string name="settings_tun_probe_mode_strict">Strict same-path</string>
    <string name="settings_tun_probe_mode_curl">Curl-compatible</string>
    <string name="settings_proxy_scan_title">Local proxy scan</string>
    <string name="settings_proxy_scan_desc">Scans localhost for open SOCKS5/HTTP proxy ports.</string>
    <string name="settings_xray_api_scan_title">Xray gRPC API scan</string>
    <string name="settings_xray_api_scan_desc">Scans localhost for exposed Xray gRPC API ports.</string>
    <string name="settings_port_range">Port range</string>
    <string name="settings_port_range_desc_scans">Used by enabled localhost proxy and Xray scans.</string>
    <string name="settings_port_popular">Popular</string>
    <string name="settings_port_extended">Extended</string>
    <string name="settings_port_full">Full</string>
    <string name="settings_port_custom">Custom</string>
    <string name="settings_network_requests">Network requests</string>
    <string name="settings_network_requests_desc">GeoIP, IP comparison, CDN pulling, BeaconDB, call transport probe, ICMP spoofing</string>
    <string name="settings_auto_update">Update checks</string>
    <string name="settings_auto_update_desc">Checks api.github.com for GitHub Releases and offers to download a newer APK.</string>
    <string name="settings_network_disable_title">Disable network requests?</string>
    <string name="settings_network_disable_message">If disabled:\n\n• GeoIP checks will not run\n• IP address comparison via external services will be disabled\n• CDN pulling checks will be disabled\n• Geolocation via BeaconDB (cell towers/Wi-Fi) will be disabled\n• Call transport leak probing will be disabled\n• ICMP spoofing checks will be disabled\n\nOnly local checks will remain available: direct signs, indirect signs, and port scanning</string>
    <string name="settings_cdn_pulling">CDN pulling</string>
    <string name="settings_cdn_pulling_desc">Sends HTTPS requests to Google/YouTube redirector and Cloudflare trace endpoints.</string>
    <string name="settings_cdn_pulling_warning_title">Enable CDN pulling?</string>
    <string name="settings_cdn_pulling_warning_message">The app will send normal web requests to Google/YouTube, www.cloudflare.com, one.one.one.one, rutracker.org and meduza.io. These sites may see your device public IP and return short network details like country, datacenter, or proxy mode.</string>
    <string name="settings_cdn_pulling_warning_confirm">Enable</string>
    <string name="settings_cdn_pulling_meduza">Include meduza.io</string>
    <string name="settings_cdn_pulling_meduza_desc">Send a request to meduza.io/cdn-cgi/trace as part of CDN pulling.</string>
    <string name="settings_call_transport_probe">Call transport &amp; STUN probe</string>
    <string name="settings_call_transport_probe_desc">Sends UDP/STUN requests to public STUN servers (global and Russian) and probes local SOCKS5 proxy for Telegram MTProto traffic.</string>
    <string name="settings_network_disable_confirm">Disable</string>
    <string name="settings_dns_resolver">DNS resolver</string>
    <string name="settings_dns_resolver_desc">Used for GeoIP, IP Comparison, and BeaconDB. It does not change the Android system DNS and does not affect local DNS checks.</string>
    <string name="settings_dns_mode_system">System</string>
    <string name="settings_dns_mode_direct">Direct DNS</string>
    <string name="settings_dns_mode_doh">DoH</string>
    <string name="settings_dns_preset_custom">Custom</string>
    <string name="settings_dns_preset_cloudflare">Cloudflare</string>
    <string name="settings_dns_preset_google">Google</string>
    <string name="settings_dns_preset_yandex">Yandex</string>
    <string name="settings_dns_direct_servers">DNS servers</string>
    <string name="settings_dns_direct_servers_hint">1.1.1.1, 1.0.0.1</string>
    <string name="settings_dns_doh_url">DoH URL</string>
    <string name="settings_dns_doh_url_hint">https://dns.google/dns-query</string>
    <string name="settings_dns_bootstrap">Bootstrap IPs</string>
    <string name="settings_dns_bootstrap_hint">8.8.8.8, 8.8.4.4</string>
    <string name="settings_privacy_mode">Privacy mode</string>
    <string name="settings_privacy_mode_desc">IP is shown as 185.22.*.*</string>
    <string name="settings_theme">Theme</string>
    <string name="settings_theme_light">Light</string>
    <string name="settings_theme_dark">Dark</string>
    <string name="settings_theme_system">System</string>
    <string name="settings_language">Language</string>
    <string name="settings_language_system">System</string>
    <string name="settings_language_en">English</string>
    <string name="settings_language_ru">Русский</string>
    <string name="settings_language_fa">فارسی</string>
    <string name="settings_language_zh">中文</string>
    <string name="settings_color_vision_mode">Color vision mode</string>
    <string name="settings_color_vision_preview">Status preview</string>
    <string name="settings_color_vision_off">Off</string>
    <string name="settings_color_vision_red_green">Red-green</string>
    <string name="settings_color_vision_blue_yellow">Blue-yellow</string>
    <string name="settings_color_vision_achromatopsia">Achromatopsia</string>
    <string name="settings_accessibility_status_preview_content">%1$s status</string>
    <string name="settings_permissions">Permissions</string>
    <string name="settings_permissions_desc">Manage app permissions</string>
    <string name="settings_github">GitHub</string>
    <string name="main_copy_diagnostics">Copy diagnostics</string>
    <string name="main_diagnostics_copied">Diagnostics copied</string>
    <string name="main_export">Export</string>
    <string name="main_export_title">Export result</string>
    <string name="main_export_markdown">Markdown (.md)</string>
    <string name="main_export_json">JSON (.json)</string>
    <string name="main_export_save_file">Save file</string>
    <string name="main_export_copy_to_clipboard">Copy to clipboard</string>
    <string name="main_export_copied">Export copied</string>
    <string name="main_export_saved">Export saved</string>
    <string name="main_export_failed">Failed to save export</string>
    <string name="settings_github_desc">xtclovver/RKNHardering</string>
    <string name="settings_matrix">Matrix</string>
    <string name="settings_matrix_desc">RKN_Hardering:matrix.kangel.tech</string>
    <string name="settings_port_range_from">From</string>
    <string name="settings_port_range_to">To</string>

    <string name="main_subtitle">VPN/Proxy self-check</string>
    <string name="main_run_check">Run check</string>
    <string name="main_run_check_again">Run check again</string>
    <string name="main_stop_check">Stop</string>
    <string name="main_card_geo_ip" translatable="false">GeoIP</string>
    <string name="main_card_ip_comparison">IP comparison</string>
    <string name="main_card_cdn_pulling">CDN pulling</string>
    <string name="main_card_direct_signs">Direct signs</string>
    <string name="main_card_indirect_signs">Indirect signs</string>
    <string name="main_card_call_transport">STUN servers</string>
    <string name="main_card_call_transport_status_baseline">Responded</string>
    <string name="main_card_call_transport_status_no_signal">No response</string>
    <string name="main_card_call_transport_status_needs_review">Needs review</string>
    <string name="main_card_call_transport_status_unsupported">Unsupported</string>
    <string name="main_card_call_transport_status_error">Error</string>
    <string name="main_card_call_transport_path_active">Active network</string>
    <string name="main_card_call_transport_path_underlying">Underlying network</string>
    <string name="main_card_call_transport_path_proxy">Local proxy</string>
    <string name="main_card_call_transport_header">%1$s · %2$s · %3$s</string>
    <string name="main_card_call_transport_reason_no_response">No STUN response</string>
    <string name="main_card_call_transport_reason_telegram_dc_unreachable">Telegram DC is unreachable through the local SOCKS5 proxy</string>
    <string name="main_card_call_transport_reason_targets_unavailable">Targets for this check are unavailable</string>
    <string name="main_card_call_transport_stun_group_global">Global STUN</string>
    <string name="main_card_call_transport_stun_group_ru">RU STUN</string>
    <string name="ip_channels_title">IP channels</string>
    <string name="ip_channels_channel_direct">Direct</string>
    <string name="ip_channels_channel_vpn">VPN</string>
    <string name="ip_channels_channel_proxy">Proxy</string>
    <string name="ip_channels_channel_cdn">CDN</string>
    <string name="ip_channels_target_ru">RU</string>
    <string name="ip_channels_target_non_ru">Non-RU</string>
    <string name="ip_channels_flag_cross_channel_mismatch">Cross-channel mismatch detected</string>
    <string name="ip_channels_flag_warp_like_behavior">WARP-like behavior detected</string>
    <string name="ip_channels_flag_geo_country_mismatch">Geo-country mismatch</string>
    <string name="ip_channels_flag_probe_target_divergence">Probe-target divergence</string>
    <string name="ip_channels_flag_probe_target_direct_divergence">Probe-target direct divergence</string>
    <string name="ip_channels_flag_channel_conflict">Channel conflict: %1$s</string>
    <string name="ip_channels_flag_needs_review">Needs review</string>
    <string name="main_card_call_transport_stun_responded">%1$d of %2$d responded</string>
    <string name="main_card_call_transport_stun_none_responded">No response</string>
    <string name="main_card_call_transport_stun_ipv4">IPv4</string>
    <string name="main_card_call_transport_stun_ipv6">IPv6</string>
    <string name="main_card_call_transport_stun_no_response">No response</string>
    <string name="main_card_call_transport_stun_error">Error</string>
    <string name="main_card_icmp_spoofing">ICMP spoofing β</string>
    <string name="main_card_location_signals">Location signals</string>
    <string name="main_card_native_signs">Native signs</string>
    <string name="main_verdict_details">Details</string>

    <string name="main_perm_title">Additional permission</string>
    <string name="main_perm_allow">Allow</string>
    <string name="main_perm_skip">Skip</string>
    <string name="main_perm_all_granted">All permissions are already granted</string>
    <string name="main_perm_blocked">Permission is blocked. Open the app settings.</string>
    <string name="main_perm_rationale">For a more accurate check, the app needs additional permissions.\n\nThey are used to read cell tower identifiers and perform geolocation lookups via BeaconDB.\n\n%s\n\nWithout these permissions, the check will still run, but some location signals, Wi-Fi scanning, and dual-SIM diagnostics will be unavailable.</string>
    <string name="main_perm_rationale_wifi_13">On Android 13+, the app also requests access to nearby Wi-Fi devices to discover nearby Wi-Fi access points.</string>
    <string name="main_perm_rationale_wifi">The app also uses Wi-Fi scanning to discover nearby access points.</string>
    <string name="main_perm_rationale_phone_state">The app also requests phone state access to read active SIM subscriptions for dual-SIM diagnostics.</string>

    <string name="main_check_running">Check in progress. Cards update live as data arrives.</string>
    <string name="main_check_stopped">Check stopped</string>
    <string name="main_status_cancelled">Cancelled</string>
    <string name="main_status_stopped">Stopped</string>

    <string name="main_loading_status_scanning">Scanning</string>
    <string name="main_loading_status_checking">Checking</string>
    <string name="main_loading_status_progress" translatable="false">%1$s%2$s</string>

    <string name="main_preview_geo_ip">Country, ASN, and hosting indicators will be checked.</string>
    <string name="main_preview_ip_comparison">The public IP will be compared through multiple independent services.</string>
    <string name="main_preview_cdn_pulling">It will be checked what blocked or CDN-backed endpoints return about your network.</string>
    <string name="main_preview_direct">A search for direct signs of VPNs, proxies, and installed clients will be performed.</string>
    <string name="main_preview_indirect">Interfaces, DNS, routes, and local technical signals will be checked.</string>
    <string name="main_preview_native_signs">Native interfaces, routes, and low-level library signals will be checked.</string>
    <string name="main_preview_call_transport">STUN server responses and call transport leak signals will be checked.</string>
    <string name="main_preview_icmp">Blocked and control hosts will be resolved and pinged through the active route.</string>
    <string name="main_preview_rtt_triangulation">Local and foreign services will be pinged to compare round-trip latency.</string>
    <string name="main_preview_location">Carrier, cell tower, and nearby Wi-Fi signals will be collected.</string>
    <string name="main_preview_bypass">A search for local split tunnel bypasses and available proxy endpoints will be performed.</string>

    <string name="main_loading_geo_ip">Checking country, ASN, and hosting indicators.</string>
    <string name="main_loading_ip_comparison">Comparing the public IP through multiple independent services.</string>
    <string name="main_loading_cdn_pulling">Checking what blocked or CDN-backed endpoints return about your network.</string>
    <string name="main_loading_icmp">Resolving and pinging blocked and control hosts through the active route.</string>
    <string name="main_loading_rtt_triangulation">Pinging local and foreign services to compare round-trip latency.</string>
    <string name="main_loading_direct">Looking for direct signs of VPNs, proxies, and installed clients.</string>
    <string name="main_loading_indirect">Checking interfaces, DNS, routes, and local technical signals.</string>
    <string name="main_loading_native_signs">Checking native interfaces, routes, and low-level library signals.</string>
    <string name="main_loading_call_transport">Checking STUN server responses and call transport leak signals.</string>
    <string name="main_loading_location">Collecting carrier, cell tower, and nearby Wi-Fi signals.</string>
    <string name="main_loading_bypass">Looking for local split tunnel bypasses and available proxy endpoints.</string>

    <string name="main_stopped_scan">Scanning was stopped before this stage completed.</string>
    <string name="main_stopped_check">This stage was stopped before completion.</string>

    <string name="main_card_status_detected">Detected</string>
    <string name="main_card_status_error">Error</string>
    <string name="main_card_status_needs_review">Needs review</string>
    <string name="main_card_status_clean">Clean</string>

    <string name="main_verdict_not_detected">Bypass not detected</string>
    <string name="main_verdict_needs_review">Needs additional review</string>
    <string name="main_verdict_detected">Bypass detected</string>

    <string name="main_verdict_section_meaning">What this means</string>
    <string name="main_verdict_section_discovered">What was discovered</string>
    <string name="main_verdict_section_reasons">Why this verdict was reached</string>

    <string name="main_verdict_hide_details">Hide details</string>

    <string name="main_ipv6_error_ignored">IPv6 error ignored: </string>
    <string name="main_ip_comparison_ipv4_unavailable">IPv4: n/a</string>

    <string name="settings_port_range_preview_proxy_xray">Localhost ports to scan for proxy and Xray API: %1$s (%2$s)</string>
    <string name="settings_port_range_preview_proxy_only">Localhost ports to scan for proxy: %1$s (%2$s)</string>
    <string name="settings_port_range_preview_xray_only">Localhost ports to scan for Xray API: %1$s (%2$s)</string>
    <string name="settings_port_range_preview_disabled">Local proxy and Xray scans are disabled.</string>
    <string name="settings_port_range_start_default" translatable="false">1024</string>
    <string name="settings_port_range_end_default" translatable="false">65535</string>
    <plurals name="settings_port_word">
        <item quantity="one">%1$s port</item>
        <item quantity="other">%1$s ports</item>
    </plurals>

    <!-- VerdictNarrative: ExposureStatus labels -->
    <string name="narrative_exposure_remote_endpoint">Remote endpoint discovered</string>
    <string name="narrative_exposure_public_ip">Only public IP discovered</string>
    <string name="narrative_exposure_local_proxy">Only local proxy/API found</string>
    <string name="narrative_exposure_technical_signal">Only technical network signals found</string>
    <string name="narrative_exposure_insufficient">No server data collected</string>

    <!-- VerdictNarrative: explanation base -->
    <string name="narrative_explanation_detected">The automated check considers the bypass confirmed.</string>
    <string name="narrative_explanation_needs_review">The automated check is not enough for a clear conclusion.</string>
    <string name="narrative_explanation_not_detected">The check did not find convincing signs of a bypass.</string>

    <!-- VerdictNarrative: explanation exposure -->
    <string name="narrative_explanation_exposure_remote">The local Xray API exposed a remote endpoint address.</string>
    <string name="narrative_explanation_exposure_public_ip">Only the public egress IP was visible, not the final server address.</string>
    <string name="narrative_explanation_exposure_local_proxy">Only a local proxy/API on the device was visible, without the remote endpoint address.</string>
    <string name="narrative_explanation_exposure_technical">Only technical network and routing signals were available, without a server address.</string>
    <string name="narrative_explanation_exposure_insufficient">Neither a server address nor a public IP could be obtained.</string>

    <!-- VerdictNarrative: meaning rows -->
    <string name="narrative_meaning_detected">A red verdict means the automated check collected enough signs of a bypass.</string>
    <string name="narrative_meaning_needs_review">A yellow verdict means signals exist, but they need manual verification.</string>
    <string name="narrative_meaning_not_detected">A green verdict means no decisive bypass signals were found.</string>
    <string name="narrative_meaning_exposure_remote">An actual remote endpoint address was obtained, not just a public IP.</string>
    <string name="narrative_meaning_exposure_public_ip">A public IP and a final server address are not the same: internet services only see the egress IP, which may be just an exit point.</string>
    <string name="narrative_meaning_exposure_local_proxy">A local proxy/API indicates an on-device bypass mechanism, but does not reveal the remote server by itself.</string>
    <string name="narrative_meaning_exposure_technical">Technical signals confirm network behavior, but do not reveal the remote endpoint address.</string>
    <string name="narrative_meaning_exposure_insufficient">With the current data, it is not possible to tell whether the app learned the bypass server address.</string>

    <!-- VerdictNarrative: discovered row labels -->
    <string name="narrative_label_exposure_level">Exposure level</string>
    <string name="narrative_label_xray_api">Local Xray API</string>
    <string name="narrative_label_remote_endpoint">Remote endpoint</string>
    <string name="narrative_label_remote_endpoint_extra">Additional remote endpoint</string>
    <string name="narrative_label_local_proxy">Local proxy</string>
    <string name="narrative_label_owner_app">Owner app</string>
    <string name="narrative_label_vpn_network_ip">IP via VPN Network</string>
    <string name="narrative_label_real_ip">IP outside VPN</string>
    <string name="narrative_label_direct_ip">Direct public IP</string>
    <string name="narrative_label_proxy_ip">Public IP via proxy</string>
    <string name="narrative_label_checkers_ip">IP from external checkers</string>
    <string name="narrative_label_ru_checkers_ip">IP from RU checkers</string>
    <string name="narrative_label_non_ru_checkers_ip">IP from non-RU checkers</string>
    <string name="narrative_label_geo_ip">IP from GeoIP</string>
    <string name="narrative_label_call_transport">Call transport</string>
    <string name="narrative_label_call_transport_path">Call transport path</string>
    <string name="narrative_label_call_transport_target">Call transport target</string>
    <string name="narrative_label_call_transport_public_ip">Call transport public IP</string>
    <string name="narrative_label_call_transport_mapped_ip">Call transport mapped IP</string>
    <string name="narrative_value_call_transport_direct_udp_stun">direct UDP STUN</string>
    <string name="narrative_value_call_transport_proxy_assisted_telegram">proxy-assisted Telegram TCP</string>
    <string name="narrative_value_call_transport_proxy_assisted_udp_stun">proxy-assisted UDP STUN</string>

    <!-- VerdictNarrative: reason rows -->
    <string name="narrative_reason_xray_api">A local Xray API was found on the device and exposes outbound addresses.</string>
    <string name="narrative_reason_split_tunnel">The direct IP and the IP via the local proxy differ.</string>
    <string name="narrative_reason_vpn_gateway_leak">With VPN active, the app was able to access the non-VPN network.</string>
    <string name="narrative_reason_vpn_network_binding">The app was able to use the VPN Network object separately from the regular network.</string>
    <string name="narrative_reason_bypass_unconfirmed">A local proxy was found, but the bypass was not automatically confirmed.</string>
    <string name="narrative_reason_ip_comparison_detected">RU and non-RU IP checkers returned different public IPs.</string>
    <string name="narrative_reason_ip_comparison_review">External IP checkers responded incompletely or inconsistently.</string>
    <string name="narrative_reason_geo_location_conflict">Location signals point to Russia, while GeoIP points to an external address.</string>
    <string name="narrative_reason_geo_foreign">GeoIP indicates an external or suspicious address.</string>
    <string name="narrative_reason_direct_signs">Direct signs of a local proxy/VPN were found.</string>
    <string name="narrative_reason_indirect_signs">Indirect signs of tunneling, routing changes, or DNS replacement were found.</string>
    <string name="narrative_reason_call_transport_signal">A call transport endpoint responded and exposed mapped/public network data.</string>
    <string name="narrative_reason_icmp_signal">ICMP reachability or RTT looked inconsistent with a normal Russian route.</string>
    <string name="narrative_reason_fallback_detected">The verdict is based on a combination of multiple check signals.</string>
    <string name="narrative_reason_fallback_review">Signals are partial or contradictory, so manual review is needed.</string>
    <string name="narrative_reason_fallback_clean">No decisive bypass signals were found.</string>

    <!-- Checker strings -->
    <string name="checker_yes">yes</string>
    <string name="checker_no">no</string>
    <string name="checker_proxy_owner_suffix"> (owner: %1$s)</string>
    <string name="checker_proxy_owner_single">%1$s (%2$s, uid %3$d)</string>
    <string name="checker_proxy_owner_named_uid">%1$s (uid %2$d)</string>
    <string name="checker_proxy_owner_shared">uid %1$d: %2$s</string>
    <string name="checker_proxy_owner_uid_only">uid %1$d</string>
    <string name="checker_proxy_owner_unresolved">unresolved</string>
    <string name="checker_proxy_owner_ambiguous">ambiguous</string>

    <!-- GeoIpChecker -->
    <string name="checker_geo_error_no_provider">No GeoIP provider returned data</string>
    <string name="checker_geo_error_fetch">Could not fetch GeoIP data: %1$s</string>
    <string name="checker_geo_info_ip">IP: %1$s</string>
    <string name="checker_geo_info_country">Country: %1$s (%2$s)</string>
    <string name="checker_geo_info_isp">ISP: %1$s</string>
    <string name="checker_geo_info_org">Organization: %1$s</string>
    <string name="checker_geo_info_asn">ASN: %1$s</string>
    <string name="checker_geo_foreign_ip_yes">IP outside Russia: yes (%1$s)</string>
    <string name="checker_geo_foreign_ip_no">IP outside Russia: no</string>
    <string name="checker_geo_hosting_prefix">IP belongs to a hosting provider: %1$s</string>
    <string name="checker_geo_proxy_db">IP is listed in known proxy/VPN databases: %1$s</string>

    <!-- IpComparisonChecker -->
    <string name="checker_ip_comp_ru_checkers">RU checkers</string>
    <string name="checker_ip_comp_non_ru_checkers">Non-RU checkers</string>
    <string name="checker_ip_comp_summary_detected">RU and non-RU checkers returned different IPs: %1$s and %2$s</string>
    <string name="checker_ip_comp_summary_family_mismatch">RU and non-RU checkers returned addresses from different families: %1$s and %2$s</string>
    <string name="checker_ip_comp_summary_raw_mismatch">IPs differ, but the data is incomplete: %1$s and %2$s</string>
    <string name="checker_ip_comp_summary_ipv4_only">All responding IPv4 checkers returned the same IP: %1$s</string>
    <string name="checker_ip_comp_summary_all_same">All checkers returned the same IP: %1$s</string>
    <string name="checker_ip_comp_summary_no_response">No IP checker returned a response</string>
    <string name="checker_ip_comp_summary_incomplete">Comparison is incomplete: some checkers did not respond</string>
    <string name="checker_ip_comp_status_has_response">Has response</string>
    <string name="checker_ip_comp_status_no_response">No response</string>
    <string name="checker_ip_comp_status_ipv6_ignored">IPv6 ignored</string>
    <string name="checker_ip_comp_status_ipv4_ipv6">IPv4/IPv6</string>
    <string name="checker_ip_comp_status_mismatch">Mismatch</string>
    <string name="checker_ip_comp_status_match">Match</string>
    <string name="checker_ip_comp_single_ip">IP: %1$s</string>
    <string name="checker_ip_comp_single_error">Error: %1$s</string>
    <string name="checker_ip_comp_single_no_answer">Service did not respond</string>
    <string name="checker_ip_comp_no_ip_returned">No service returned an IP</string>
    <string name="checker_ip_comp_ipv6_ignored_no_ipv4">IPv6 errors were ignored, but there is no valid IPv4 response</string>
    <string name="checker_ip_comp_mixed_families">Services returned addresses from different families: %1$s</string>
    <string name="checker_ip_comp_different_ips">Services returned different IPs: %1$s</string>
    <string name="checker_ip_comp_all_same">All responding services in the group returned IP %1$s</string>
    <string name="checker_ip_comp_ipv6_ignored_suffix">; IPv6 errors ignored: %1$d</string>

    <!-- CdnPullingChecker -->
    <string name="checker_cdn_pulling_summary_error">None of the CDN targets returned usable data</string>
    <string name="checker_cdn_pulling_summary_mixed_ips">Different CDN targets exposed different IPs: %1$s</string>
    <string name="checker_cdn_pulling_summary_detected_full">All CDN targets exposed the same IP: %1$s</string>
    <string name="checker_cdn_pulling_summary_detected_partial">%2$d of %3$d CDN targets responded and exposed IP %1$s</string>
    <string name="checker_cdn_pulling_summary_detected_no_ip">%1$d of %2$d CDN targets returned trace data, but not all responses included an IP</string>
    <string name="checker_cdn_pulling_error_unrecognized">Response format is not recognized</string>
    <string name="checker_cdn_pulling_error_tls_certificate">Could not verify the TLS certificate chain. Possible causes: HTTPS interception, a wrong DNS answer, or an outdated Android CA store.</string>
    <string name="checker_cdn_pulling_error_details">Details: %1$s</string>

    <!-- DirectSignsChecker -->
    <string name="checker_direct_category_name">Direct signs</string>
    <string name="checker_direct_no_active_network">No active network found</string>
    <string name="checker_direct_caps_unavailable">NetworkCapabilities unavailable</string>
    <string name="checker_direct_transport_vpn">TRANSPORT_VPN: %1$s</string>
    <string name="checker_direct_detected">detected</string>
    <string name="checker_direct_not_detected">not detected</string>
    <string name="checker_direct_flag_is_vpn">IS_VPN flag found in capabilities</string>
    <string name="checker_direct_vpn_transport_info">VpnTransportInfo found in transport info</string>
    <string name="checker_direct_http_proxy">HTTP proxy</string>
    <string name="checker_direct_socks_proxy">SOCKS proxy</string>
    <string name="checker_direct_proxy_not_configured">%1$s: not configured</string>
    <string name="checker_direct_proxy_endpoint">%1$s: %2$s:%3$s</string>
    <string name="checker_direct_proxy_known_port">%1$s uses known port %2$s</string>
    <string name="checker_direct_proxy_no_valid_port">%1$s: host found without a valid port</string>
    <string name="checker_direct_proxyinfo_default">ProxyInfo default proxy</string>
    <string name="checker_direct_proxyinfo_network">ProxyInfo on network %1$s</string>
    <string name="checker_direct_proxyinfo_unknown_interface">unknown interface</string>
    <string name="checker_direct_proxyinfo_network_scan">ProxyInfo on tracked networks</string>
    <string name="checker_direct_proxyinfo_details">%1$s: %2$s</string>
    <string name="checker_direct_proxyinfo_invalid">%1$s: invalid proxy profile</string>
    <string name="checker_direct_proxyinfo_unavailable">%1$s: ProxyInfo check unavailable (%2$s)</string>
    <string name="checker_direct_proxyinfo_network_none">ProxyInfo on tracked networks: not detected</string>

    <!-- IndirectSignsChecker -->
    <string name="checker_indirect_category_name">Indirect signs</string>
    <string name="checker_indirect_capability_not_vpn">Capability NOT_VPN: %1$s</string>
    <string name="checker_indirect_present">present</string>
    <string name="checker_indirect_absent_suspicious">absent (suspicious)</string>
    <string name="checker_indirect_no_vpn_interfaces">VPN interfaces (tun/tap/wg/ppp or confirmed IPsec): none detected</string>
    <string name="checker_indirect_vpn_interface_found">VPN interface detected: %1$s</string>
    <string name="checker_indirect_interface_error">Error while checking interfaces: %1$s</string>
    <string name="checker_indirect_mtu_anomaly">MTU anomaly: %1$s MTU=%2$d (&lt; 1500)</string>
    <string name="checker_indirect_mtu_no_anomalies">MTU: no anomalies detected</string>
    <string name="checker_indirect_mtu_error">Error while checking MTU: %1$s</string>
    <string name="checker_indirect_ipsec_classification">IPsec network %1$s: %2$s</string>
    <string name="checker_indirect_ipsec_capabilities">Capabilities %1$s: NOT_VPN=%2$s, TRANSPORT_VPN=%3$s, IMS=%4$s, EIMS=%5$s, MMTEL=%6$s</string>
    <string name="checker_indirect_ipsec_class_confirmed_vpn">confirmed VPN tunnel</string>
    <string name="checker_indirect_ipsec_class_carrier_ims">carrier IMS / not a VPN</string>
    <string name="checker_indirect_ipsec_class_unknown">unknown IPsec tunnel</string>
    <string name="checker_indirect_default_route_standard">Default route: %1$s (standard)</string>
    <string name="checker_indirect_default_route_nonstandard">Default route via a non-standard interface: %1$s</string>
    <string name="checker_indirect_dedicated_routes">Dedicated routes via VPN/non-standard interface: %1$s</string>
    <string name="checker_indirect_proc_default_route_standard">Default route (/proc/net/route): %1$s (standard)</string>
    <string name="checker_indirect_proc_default_route_nonstandard">Default route (/proc/net/route) via a non-standard interface: %1$s</string>
    <string name="checker_indirect_split_tunnel_routes">Routing indicates split tunneling: both direct and tunnel routes are visible</string>
    <string name="checker_indirect_gateway_route_unavailable">Gateway route: could not assess via Android API</string>
    <string name="checker_indirect_routing_no_anomalies">Routing: no anomalies detected</string>
    <string name="checker_indirect_dns_no_active_network">DNS: no active network found</string>
    <string name="checker_indirect_dns_servers_not_found">DNS servers: none detected</string>
    <string name="checker_indirect_dns_localhost">DNS points to localhost: %1$s (typical for VPN/local proxy)</string>
    <string name="checker_indirect_dns_inherited_private">DNS: %1$s (inherited from the same private subnet as the main network)</string>
    <string name="checker_indirect_dns_private">DNS in a private subnet: %1$s</string>
    <string name="checker_indirect_dns_private_changed">DNS in a private subnet: %1$s (differs from the underlying network)</string>
    <string name="checker_indirect_dns_replaced_vpn">DNS was replaced while VPN is active: %1$s</string>
    <string name="checker_indirect_dns_source_unknown">DNS: %1$s (source could not be matched to the underlying network)</string>
    <string name="checker_indirect_dns_plain">DNS: %1$s</string>
    <string name="checker_indirect_dns_link_local">DNS: %1$s (link-local)</string>
    <string name="checker_indirect_proxy_tool_installed">Proxy utility installed: %1$s (%2$s)</string>
    <string name="checker_indirect_local_listener">Local listener on proxy port: %1$s:%2$d/%3$s</string>
    <string name="checker_indirect_many_localhost_listeners">Multiple localhost listeners detected on high ports: %1$d</string>
    <string name="checker_indirect_no_proxy_technical">Additional technical proxy signs: none detected</string>
    <string name="checker_indirect_limited_checks">Checks for processes, iptables/pf, and system certificates are limited without root/privileged access</string>
    <string name="checker_indirect_dumpsys_vpn_unavailable">dumpsys vpn_management: unavailable</string>
    <string name="checker_indirect_dumpsys_vpn_none">dumpsys vpn_management: no active VPNs</string>
    <string name="checker_indirect_dumpsys_vpn_line">VPN management: %1$s</string>
    <string name="checker_indirect_dumpsys_vpn_error">dumpsys vpn_management: %1$s</string>
    <string name="checker_indirect_dumpsys_service_unavailable">dumpsys activity services VpnService: unavailable</string>
    <string name="checker_indirect_dumpsys_service_none">Active VpnService instances: none detected</string>
    <string name="checker_indirect_dumpsys_service_active">VpnService active: %1$s</string>
    <string name="checker_indirect_dumpsys_service_error">dumpsys activity services: %1$s</string>

    <!-- BypassChecker -->
    <string name="checker_bypass_progress_port_scan_phase">Port scan</string>
    <string name="checker_bypass_progress_port_scan_detail">Looking for open proxies on localhost&#8230;</string>
    <string name="checker_bypass_progress_popular_ports">Popular ports</string>
    <string name="checker_bypass_progress_full_scan">Full scan</string>
    <string name="checker_bypass_progress_port_detail">Port %1$d (%2$d%%)</string>
    <string name="checker_bypass_progress_xray_detail">Looking for a gRPC API on localhost&#8230;</string>
    <string name="checker_bypass_progress_underlying_detail">Checking access to the non-VPN network&#8230;</string>
    <string name="checker_bypass_progress_ip_phase">IP check</string>
    <string name="checker_bypass_progress_ip_detail">Obtaining the direct IP and the IP via proxy&#8230;</string>
    <string name="checker_bypass_progress_mtproto_detail">Checking Telegram DC via proxy&#8230;</string>
    <string name="checker_bypass_ip_unavailable">unavailable</string>
    <string name="checker_bypass_direct_ip">Direct IP: %1$s</string>
    <string name="checker_bypass_proxy_ip">IP via proxy: %1$s</string>
    <string name="checker_bypass_split_confirmed">Per-app split bypass: confirmed (IPs differ)</string>
    <string name="checker_bypass_split_disabled">Per-app split is disabled: IPs match</string>
    <string name="checker_bypass_auth_required">Proxy requires authentication: bypass status unconfirmed</string>
    <string name="checker_bypass_mtproto_reachable">MTProto proxy: Telegram DC is reachable via %1$s -&gt; %2$s</string>
    <string name="checker_bypass_mtproto_unreachable">MTProto probe: Telegram DC is unreachable via proxy</string>
    <string name="checker_bypass_no_open_proxy">Open proxies on localhost: none detected</string>
    <string name="checker_bypass_open_proxy">Open %1$s proxy: %2$s</string>
    <string name="checker_bypass_open_proxy_review_suffix"> (requires bypass confirmation)</string>
    <string name="checker_bypass_no_xray">Xray gRPC API: not found</string>
    <string name="checker_bypass_xray_api">Xray gRPC API: %1$s</string>
    <plurals name="checker_bypass_extra_outbounds">
        <item quantity="one">&#160;&#160;&#8230;%1$d more outbound</item>
        <item quantity="other">&#160;&#160;&#8230;%1$d more outbounds</item>
    </plurals>
    <string name="checker_bypass_vpn_not_active">Underlying network: VPN is not active, the check is not required</string>
    <string name="checker_bypass_vpn_network_binding">VPN network binding: the app can reach both the default non-VPN path and VPN Network (VPN IP: %1$s, default IP: %2$s)</string>
    <string name="checker_bypass_tun_probe_success">TUN active probe: IP %1$s</string>
    <string name="checker_bypass_tun_probe_success_direct">TUN active probe, direct: IP %1$s</string>
    <string name="checker_bypass_tun_probe_success_proxy">TUN active probe, proxy: IP %1$s</string>
    <string name="checker_bypass_tun_probe_success_direct_target">TUN active probe, %1$s, direct: IP %2$s</string>
    <string name="checker_bypass_tun_probe_success_proxy_target">TUN active probe, %1$s, via proxy: IP %2$s</string>
    <string name="checker_bypass_tun_probe_success_transport_only">TUN active probe: IP %1$s</string>
    <string name="checker_bypass_tun_probe_success_curl_compatible">TUN active probe: IP %1$s</string>
    <string name="checker_bypass_tun_probe_failure">TUN active probe: a request via VPN Network is unavailable (the interface is blocked or filtered)</string>
    <string name="checker_bypass_tun_probe_failure_reason">TUN active probe: a request via VPN Network failed (%1$s)</string>
    <string name="checker_bypass_tun_probe_dns_mismatch">TUN active probe: strict same-path failed (%1$s), but the curl-compatible transport-only path succeeded; DNS path mismatch is likely</string>
    <string name="checker_bypass_tun_probe_dns_mismatch_curl_compatible">TUN active probe: strict same-path failed (%1$s), but the curl-compatible path succeeded; DNS path mismatch is likely</string>
    <string name="checker_bypass_default_non_vpn_ip">Default non-VPN IP: %1$s</string>
    <string name="checker_bypass_underlying_unreachable">Underlying network: the non-VPN network is unavailable (full tunnel)</string>
    <string name="checker_bypass_underlying_unreachable_reason">Underlying network: the non-VPN network is unavailable (%1$s)</string>
    <string name="checker_bypass_gateway_leak">VPN gateway leak: the app can bypass the VPN tunnel (VPN IP: %1$s, real IP: %2$s)</string>
    <string name="checker_bypass_underlying_same_ip">The underlying network is reachable, but the IP matches the VPN%1$s: split tunnel not confirmed</string>
    <string name="checker_bypass_compare_family_mismatch">Split tunnel comparison returned different IP families (VPN IP: %1$s, non-VPN IP: %2$s): manual review is needed</string>
    <string name="checker_bypass_compare_incomplete">Split tunnel comparison is incomplete (VPN IP: %1$s, non-VPN IP: %2$s): manual review is needed</string>
    <string name="checker_bypass_transport_only_used">Split tunnel comparison used a curl-compatible transport-only fallback for: %1$s</string>
    <string name="checker_bypass_curl_compatible_used">Split tunnel comparison used a curl-compatible fallback for: %1$s</string>
    <string name="checker_bypass_transport_only_vpn_path">VPN path</string>
    <string name="checker_bypass_transport_only_underlying_path">underlying path</string>
    <string name="checker_tun_probe_debug_summary">%1$s debug: effective mode %2$s, selected mode %3$s, strict %4$s, curl-compatible %5$s, dnsPathMismatch %6$s</string>
    <string name="checker_tun_probe_path_vpn">VPN path</string>
    <string name="checker_tun_probe_path_underlying">underlying path</string>
    <string name="checker_tun_probe_mode_none">none</string>
    <string name="checker_tun_probe_status_succeeded">succeeded</string>
    <string name="checker_tun_probe_status_failed">failed</string>
    <string name="checker_tun_probe_status_skipped">skipped</string>

    <!-- InstalledVpnAppDetector -->
    <string name="checker_vpn_known_apps_none">Known VPN/Proxy apps and VpnService providers: none detected</string>
    <string name="checker_vpn_installed_app">Installed app: %1$s (%2$s)</string>
    <string name="checker_vpn_installed_app_by_name">Installed app with "VPN" in name: %1$s (%2$s)</string>
    <string name="checker_vpn_declares_service">App declares VpnService: %1$s (%2$s)</string>

    <!-- Redesign: main screen -->
    <string name="verdict_label">Verdict</string>
    <string name="verdict_title_clean">No bypass detected</string>
    <string name="verdict_title_review">Needs review</string>
    <string name="verdict_title_detected">Bypass detected</string>
    <string name="verdict_title_idle">Check not started</string>
    <string name="verdict_subtitle_idle">Run the check to see the verdict</string>
    <string name="verdict_subtitle_running">Check in progress\u2026</string>
    <string name="verdict_subtitle_done">Completed \u00b7 %1$d categories</string>
    <string name="section_check_details">Check details</string>
    <string name="privacy_footer_text">Check runs locally \u00b7 network endpoints listed</string>
    <string name="privacy_footer_action">What\u2019s this?</string>
    <string name="tile_hint_placeholder">\u2014</string>
    <string name="tile_hint_loading">Checking\u2026</string>
    <string name="tile_hint_stopped">Stopped</string>
    <string name="tile_hint_clean">Clean</string>
    <string name="tile_hint_clean_count">%1$d checks \u00b7 clean</string>
    <string name="tile_hint_detected_count">%1$d of %2$d detected</string>
    <string name="tile_hint_review">Needs review</string>
    <string name="tile_hint_error">Error</string>
    <string name="settings_status_no_data">No data</string>
    <string name="settings_value_on">On</string>
    <string name="settings_value_off">Off</string>
    <string name="settings_value_network_all">All requests</string>
    <string name="settings_value_network_disabled">Disabled</string>
    <string name="settings_value_privacy_masking">IP masking</string>
    <string name="settings_value_appearance_format">%1$s \u00b7 %2$s</string>

    <!-- NativeSignsChecker -->
    <string name="checker_native_category_name">Native signs β</string>
    <string name="checker_icmp_summary_clean">%1$s did not reply, and %2$s stayed above the RTT threshold (avg %3$s)</string>
    <string name="checker_icmp_summary_blocked_replied">%1$s replied to ICMP even though it is expected to stay silent on a Russian route</string>
    <string name="checker_icmp_summary_control_too_fast">%1$s replied with suspiciously low RTT (min %2$s, avg %3$s)</string>
    <string name="checker_icmp_summary_both_suspicious">%1$s replied and %2$s was too fast (min %3$s, avg %4$s)</string>
    <string name="checker_icmp_summary_inconclusive">ICMP check is inconclusive because %1$s did not reply</string>
    <string name="checker_icmp_summary_unavailable">ICMP spoofing check is unavailable on this device</string>
    <string name="checker_icmp_target_blocked">Blocked target %1$s (%2$s): %3$d/%4$d replies</string>
    <string name="checker_icmp_target_control">Control target %1$s (%2$s): %3$d/%4$d replies, min %5$s, avg %6$s, max %7$s</string>
    <string name="checker_icmp_evidence_both">%1$s replied and %2$s RTT stayed below the expected threshold</string>
    <string name="checker_icmp_evidence_blocked_replied">%1$s replied over ICMP on the active route</string>
    <string name="checker_icmp_evidence_control_too_fast">%1$s RTT stayed below the expected threshold on the active route</string>
    <string name="main_card_rtt_triangulation">RTT triangulation β</string>
    <string name="main_card_rtt_triangulation_description">Detects VPN by comparing latency to local vs foreign services</string>
    <string name="checker_rtt_summary_clean">Latency profile matches your region</string>
    <string name="checker_rtt_summary_detected">Local services slower than foreign — possible tunnel</string>
    <string name="checker_rtt_summary_needs_review">Latency unusual but inconclusive</string>
    <string name="checker_rtt_summary_inconclusive">Home country undetermined</string>
    <string name="checker_rtt_summary_unsupported_country">RTT triangulation supports RU only in this build</string>
    <string name="checker_rtt_summary_unavailable">RTT probes unavailable</string>
    <string name="checker_rtt_target_home">Local</string>
    <string name="checker_rtt_target_foreign">Foreign</string>
    <string name="checker_rtt_evidence_template">%1$s — %2$.0f ms (jitter %3$.0f ms)</string>
    <string name="checker_rtt_evidence_unreachable">%1$s — unreachable</string>
    <string name="checker_rtt_finding_target">%1$s %2$s (%3$s): %4$d/%5$d replies, avg %6$.0f ms, jitter %7$.0f ms</string>
    <string name="checker_rtt_finding_target_unreachable">%1$s %2$s (%3$s): unreachable</string>
    <string name="checker_rtt_finding_medians">Median latency: local %1$s ms, foreign %2$s ms (threshold %3$.0f ms)</string>
    <string name="checker_rtt_finding_threshold_note">A local median above the threshold suggests traffic is leaving the country before reaching local services.</string>
    <string name="checker_rtt_finding_jitter_note">High jitter on the majority of targets — confidence reduced.</string>
    <string name="checker_rtt_value_unavailable">n/a</string>
    <string name="settings_rtt_triangulation_title">RTT triangulation</string>
    <string name="settings_rtt_triangulation_description">Experimental: pings local and foreign servers to detect VPN by latency anomalies. May produce false positives on cellular, satellite, CGNAT, or congested networks.</string>
    <string name="checker_native_card_title">Native low-level checks β</string>
    <string name="checker_native_unavailable">Native library not loaded; native checks are unavailable.</string>
    <string name="checker_native_unavailable_with_reason">Native library not loaded: %1$s</string>
    <string name="checker_native_no_anomalies">Native signals: no anomalies detected</string>
    <string name="checker_native_interfaces_empty">getifaddrs() returned no interfaces</string>
    <string name="checker_native_interfaces_summary">getifaddrs(): %1$d interfaces (%2$d up)</string>
    <string name="checker_native_vpn_interface">Native VPN-like interface: %1$s (index %2$d, MTU %3$d)</string>
    <string name="checker_native_ipsec_interface">Native IPsec-like interface: %1$s (index %2$d)</string>
    <string name="checker_native_mismatch_missing_in_jvm">Interface %1$s: visible in native but missing in JVM</string>
    <string name="checker_native_mismatch_missing_in_native">Interface %1$s: visible in JVM but missing in native</string>
    <string name="checker_native_mismatch_index">Interface %1$s index mismatch: native=%2$d jvm=%3$d</string>
    <string name="checker_native_mismatch_addresses">Interface %1$s address mismatch: native-only=%2$s, jvm-only=%3$s</string>
    <string name="checker_native_routes_empty">/proc/net/route: unavailable</string>
    <string name="checker_native_routes_no_default">/proc/net/route: no default route</string>
    <string name="checker_native_route_default">Default route via %1$s</string>
    <string name="checker_native_hooks_clean">/proc/self/maps: no known hook markers</string>
    <string name="checker_native_hook_marker">Hook marker in /proc/self/maps: %1$s</string>
    <string name="checker_native_rwx_regions">/proc/self/maps: %1$s large RWX regions</string>
    <string name="checker_native_symbols_clean">Library symbols: all resolve to libc</string>
    <string name="checker_native_symbol_missing">dlsym %1$s: missing</string>
    <string name="checker_native_symbol_foreign_library">dlsym %1$s resolves to foreign library: %2$s</string>

    <!-- NativeSignsChecker: root detection -->
    <string name="checker_native_root_clean">Root indicators: no signs of root access detected</string>
    <string name="checker_native_root_su_binary">su binary found: %1$s</string>
    <string name="checker_native_root_property">Suspicious system property: %1$s</string>
    <string name="checker_native_root_mgmt_artifact">Root management artifact: %1$s</string>
    <string name="checker_native_root_system_rw">/system partition is writable</string>
    <string name="checker_native_root_suspicious_mount">Suspicious mount entry: %1$s</string>
    <string name="checker_native_root_overlay_mount">Overlay mount on system partition: %1$s</string>
    <string name="checker_native_root_selinux_permissive">SELinux is in permissive mode</string>
    <string name="checker_native_root_selinux_absent">SELinux enforcement status is not accessible</string>
    <string name="checker_native_root_uid">Process is running with root UID: %1$s</string>
    <string name="checker_native_root_magisk_prop">Magisk property detected: %1$s</string>

    <!-- App update checker -->
    <string name="update_dialog_title">Update available</string>
    <string name="update_dialog_message">Installed version: %1$s\nLatest version: %2$s</string>
    <string name="update_dialog_download">Download</string>
    <string name="update_dialog_skip">Skip this version</string>
    <string name="update_dialog_later">Later</string>
    <string name="auto_update_onboarding_title">Enable update checks?</string>
    <string name="auto_update_onboarding_message">On first launch the app can contact api.github.com to check GitHub Releases for a newer APK. If you disable this now, the app will not perform this check until you enable it manually in network settings.</string>
    <string name="auto_update_onboarding_enable">Enable</string>
    <string name="auto_update_onboarding_disable">Do not enable</string>
</resources>