What happened#
A restarted or not-yet-unlocked phone can have different storage and system-start conditions from an app that was already running.
What has not changed#
A saved Always-on preference is not proof that a protected tunnel returned after reboot.
What to do next#
Unlock the device and reopen the app. Review its current state and any system VPN policy. Do not assume browsing is protected until the actual native session and applicable platform policy are confirmed.
Before you continue#
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.