When Shadowrocket drops on a Wi-Fi → cellular handoff, treat it as an interface change, not a dead subscription. Turn off Wi-Fi Assist, stop On Demand from killing the tunnel the moment the SSID is unknown, and wait until the status bar actually shows LTE. A building portal that never logged out keeps the phone associated with a network that cannot carry your pop. A different node will not shorten those fifteen seconds.
SSID list craft: On Demand. After the radio settles, a group still aimed at the office pop: groups. DNS still asking the old gateway: DNS. App: download. Apple VPN UI: VPN on iPhone.
What those fifteen seconds are
iOS marks Wi-Fi weak; Assist injects cellular packets; Shadowrocket’s tunnel is still bound to the old interface; TCP resets with the glyph still on. Then Wi-Fi really dies. On Demand “connect only on these SSIDs” tears the VPN down on the sidewalk; “disconnect on these SSIDs” tears it down when you enter the subway. Opposite behaviours—read your own On Demand screen, do not paste a forum screenshot.
An expired captive portal still shows full bars. iOS believes it has a LAN and will not use LTE. Forget the SSID or disable Auto-Join. The portal article is elsewhere; the leftover association is this page’s villain.
| Scene | Likely | Move |
|---|---|---|
| Dead for 10 s leaving a building, fine later | Assist + NIC change | Assist off for a week |
| Only at one lobby door | Captive / 802.1X remnant | Ignore that SSID |
| On LTE, everything goes Direct | On Demand tore the VPN | Fix On Demand, not rules |
| VPN stays, one app dies | Group or module | Not a handoff bug |
Cellular Data switch, Low Data Mode, dual SIM
If Cellular Data is off for Shadowrocket, you will not notice on Wi-Fi. Low Data Mode delays background refresh; the subscription stays a week old; groups go hollow—see the group article. Dual SIM: the data SIM cannot reach the subscription host, which looks like a radio bug and is actually update fail.
5G SA/NSA swaps the IP and kills UDP sessions; TCP members survive a commute better. If you always drop on the same bridge, pin that member to TCP / “compatibility” transport. That is not your living-room speed test.
Modules and decrypt during the blink
A module that keys off “current SSID” may REJECT everything for a second. Ride a commute with modules off. If drops vanish, do not debug JS on the train. A decrypt cert prompt mid-handoff cancels the Network Extension. Risk: decrypt. Commute with it off.
Prove it on the same commute three days
After Assist and On Demand changes, log station, LTE bars, and whether Settings still shows the VPN on. One clean ride can be a strong SSID. Three days, same doorway: switch On Demand to manual and stop. Do not sideload an enterprise IPA “for commuting.”
Screenshot the On Demand page that works before you swap phones—backup. Indexes: guides, FAQ. Streaming region flip after a handoff: wait thirty seconds before you purge caches—streaming—do not mash Update in an underground garage.