diff --git a/docs/impl/reports/SIM7600-SETUP.md b/docs/impl/reports/SIM7600-SETUP.md
index a7c8988..57b0f40 100644
--- a/docs/impl/reports/SIM7600-SETUP.md
+++ b/docs/impl/reports/SIM7600-SETUP.md
@@ -106,6 +106,24 @@ ip route show default               # wlP1p1s0 metric 600, wwan0 metric 1000
 curl --interface wwan0 https://ifconfig.me
 ```
 
+### Failover test (2026-10-08)
+
+Ran `/usr/local/sbin/lte-failover-test.sh` as a detached unit (`systemd-run --unit=lte-failover-test`). It turns the WiFi radio off for 180 s,
+samples every 10 s, then turns it back on, logging to `/var/log/lte-failover-test.log`. A `wifi-failsafe` timer (`systemd-run --on-active=10min nmcli radio wifi on`)
+was armed first, so a broken LTE path couldn't lock out a remote session.
+
+| Phase | Default route | Public IPv4 | Ping 1.1.1.1 | Tailscale → halogen |
+|-------|---------------|-------------|--------------|---------------------|
+| WiFi on | `wlP1p1s0` (600) | home ISP | ~12 ms | direct, LAN (3–4 ms) |
+| WiFi off | `wwan0` (1000), within 10 s | KDDI `106.128.x.x` | 25–55 ms | **direct over IPv6** to halogen's home IPv6 (40–85 ms), no DERP relay |
+| WiFi back | `wlP1p1s0`; IPv4 within 15 s, IPv6 within ~45 s (NM connectivity check) | home ISP | ~12 ms | direct, LAN |
+
+Zero failed samples (IPv4, DNS, Tailscale ping). An SSH session over Tailscale stayed up across both switches.
+Carrier CGNAT on IPv4 doesn't matter because povo gives a global IPv6 address, which Tailscale uses for a direct path.
+
+Note: `wwan0` also gets a kernel-installed IPv6 RA default route at metric 1024. That still ranks below WiFi (600) and only wins during the
+brief NM connectivity-check penalty (`+20000`) after WiFi returns.
+
 ### GNSS
 
 - GNSS engine was already running (`AT+CGPS?` → `1,1`). Set to start on boot: `AT+CGPSAUTO=1` (persists in modem).