docs: over-the-air upgrades need the tunnel off first

An update from the install page downloads in full and then silently does nothing while
the tunnel is running. No error, no progress, the app stays at the old version — which
cost several hours yesterday, chasing the manifest, the short version string, the
signing and the server headers in turn.

Established across seven attempts on 2026-08-15: every upgrade with the tunnel down
succeeded, every upgrade with it up failed identically. The server log is the only place
the two are distinguishable, and both look the same up to the point where the download
completes.

The likely cause is that iOS will not replace a bundle whose network extension is live,
the packet tunnel being inside the very bundle being replaced. The same .ipa installs
fine while connected via devicectl, which goes through developer services rather than
the ordinary installer.

The workaround is one tap in the app — toggle the VPN off, install, toggle it back on —
and needs no trip to iOS Settings. A first install is unaffected, since there is no
tunnel yet, which is the case that matters for anyone new.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -149,3 +149,29 @@ built artifacts contain their code, and covers the trademark position separately
 
 OffScale is an independent, unofficial client. It is not affiliated with, endorsed by or supported by
 Tailscale Inc. Please do not ask their support about it.
+
+## Upgrading over the air: turn the tunnel off first
+
+An update from the install page **downloads in full and then silently does nothing** while the tunnel
+is running. No error, no progress, the app simply stays at the old version.
+
+Toggle the VPN off in OffScale, install, toggle it back on. That is the whole workaround — it is done
+in the app, not in iOS Settings, and it takes a tap.
+
+Established on 2026-08-15 across seven attempts. Every upgrade with the tunnel down succeeded; every
+upgrade with it up failed the same way. The server log tells them apart, and it is the only place the
+difference is visible:
+
+```
+working    GET manifest.plist → HEAD .ipa → GET .ipa   then the app updates
+failing    GET manifest.plist → HEAD .ipa → GET .ipa   then nothing, and a retry
+```
+
+The likely cause is that iOS will not replace a bundle whose network extension is live — the packet
+tunnel runs from inside the app bundle being replaced. Installing the same .ipa with
+`devicectl device install app` succeeds while connected, because that path goes through developer
+services rather than the ordinary installer.
+
+Not yet worked around in software, and it may not be worth it: the OS gives the app no signal that an
+install was attempted, so there is nothing to react to. A first install is unaffected — there is no
+tunnel yet — which is the case that matters for someone new.