docs: allowing Chrome on Android 17 to reach the local network

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 17 insertions, 2 deletions

diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md
index dc263b8d..31e12cba 100644
--- a/docs/QUICKSTART.md
+++ b/docs/QUICKSTART.md
@@ -376,7 +376,7 @@ config       /home/you/.config/meshbay/node.toml
 operator     yourname  key AAAC3NzaC1lZDI1…  paired 2026-09-18T14:02:11Z
 ```
 
-If a line is missing, `status` names the command that fixes it. The four that
+If a line is missing, `status` names the command that fixes it. The ones that
 catch most people:
 
 | Symptom | Cause |
@@ -385,6 +385,7 @@ catch most people:
 | `operator NONE PAIRED` | Step 8 — invites and file deletion are refused until this is done |
 | an `action needed:` block naming a group key | Step 7's `gek init` was skipped — `meshbay-node group list` shows it as `NO KEY` |
 | Group shows files to you, nothing to a member | The member never redeemed a code, or the firewall in Step 9 |
+| An Android phone opens the group on mobile data, not on your Wi-Fi | Android 17 lets a browser reach your local network only once allowed: **Settings → Apps → Chrome → Permissions → Nearby devices → Allow** ([`USERGUIDE.md` §9](USERGUIDE.md#9-when-something-breaks)) |
 
 ---
 
@@ -397,7 +398,11 @@ catch most people:
   Files and Settings always stay.
 - **Add your other devices.** Your phone's browser, the desktop application:
   each one asks to be recognised, and you approve it from a device already
-  linked. Nobody else is involved.
+  linked. Nobody else is involved. On an Android phone at home, allow the
+  browser to reach your local network the first time (**Settings → Apps →
+  Chrome → Permissions → Nearby devices**): Android 17 requires it and
+  Chrome does not ask, and without it the phone reaches your node only on
+  mobile data.
 - **Read [`USERGUIDE.md`](USERGUIDE.md)** — what each application does, how
   members are managed, what happens when someone leaves, what is private and
   what is not, and what to do when something breaks.
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index ab5ee8ca..7855c234 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -1103,6 +1103,16 @@ The firewall. A browser on your LAN has to be able to call the node, and a node
 refusing unsolicited inbound UDP cannot be called. See
 [`QUICKSTART.md` Step 9](QUICKSTART.md#step-9--let-people-reach-you).
 
+**On an Android phone, a group opens on mobile data but not on the Wi-Fi its node is on.**
+Android 17 lets an application reach devices on the local network only once
+you allow it, and Chrome comes under that rule from version 155 without asking
+you. Until you allow it, Chrome on the phone cannot reach a node on its own
+Wi-Fi, while on mobile data it reaches the node from outside, so the group
+opens. The group says so rather than
+"DataChannel closed". To allow it: Android **Settings → Apps → Chrome →
+Permissions → Nearby devices → Allow**, then **Retry**. The same goes for any
+other browser you use on the phone. A browser on a computer is not affected.
+
 **A shared directory reads as empty and everything else looks right.**
 A mount the service cannot see. The systemd drop-in needs
 `RequiresMountsFor` as well as `ReadWritePaths` — the service has its own mount