Fix a CottenMax startup timeout that could leave Android waiting at 3%.
- Max retries authentication and transfer verification automatically after transient resolver outages, without waiting for application traffic or requiring another tap on Connect.
- Authentication and transfer verification have separate deadlines. Slow authentication no longer consumes the transfer check's entire time budget.
- Connection progress now distinguishes starting, authentication, verification and retrying.
- VPN/proxy activation still requires authenticated tunnel proof. An open local proxy port alone is not reported as connected.
- Cancelling startup stops pending work cleanly.
All four CottenDNS native ABIs use core 7cca6c28baefa8297bd894842f3d188886d17e8f. Normal CottenDNS, Soar and StormDNS retain their runtime behavior. Keep your existing domain and key; no server rollback or separate Max configuration is required.
Validation includes a 31-second DNS outage reproduction: the previous one-shot startup remained unready; the fix recovered without application traffic and then transferred exact data. Server tests passed before and after PR #15 with 512-byte answers, QNAME limits and packet loss. Physical-device and network conditions still vary.