diff --git a/eastmesh-docs/custom-cli.md b/eastmesh-docs/custom-cli.md
index e8688108..45bb77e8 100644
--- a/eastmesh-docs/custom-cli.md
+++ b/eastmesh-docs/custom-cli.md
@@ -293,8 +293,27 @@ Recovery steps:
    retries the network with the new credentials
 4. `reboot` (or just wait — see below)
 
-While the AP is up the device keeps retrying its configured network in the
-background; as soon as the station connection succeeds, the recovery AP shuts down
-automatically (this also drops your rescue session — that's the sign it worked).
-The MeshCore app can also reach the device through the AP on the usual companion
-TCP port.
+While the AP is up the device keeps retrying its configured network about once a
+minute (expect a brief AP hiccup at each attempt); as soon as the station
+connection succeeds, the recovery AP shuts down automatically (this also drops
+your rescue session — that's the sign it worked).
+
+### Using the Companion App over the AP (Roaming)
+
+The recovery AP is not just for fixing credentials — the full companion protocol
+is available through it, which makes it a roaming access mode when the device is
+away from its configured network:
+
+1. join `EastMesh-WiFi` with the pin-derived password (see the table above)
+2. in the MeshCore companion app, add/connect a Wi-Fi device with host
+   `192.168.4.1` and port `5000`
+3. use the app normally — messages, contacts, channels all work over the AP
+
+Notes for roaming use:
+
+- run `set pin <pin>` once so the AP password stays fixed across reboots;
+  otherwise devices with a screen pick a new random pin every boot
+- the AP appears about 60 seconds after boot (the device tries its configured
+  network first), and stays up for as long as that network is unreachable
+- back in range of its configured network, the device joins it and shuts the AP
+  down automatically — reconnect the app via the LAN address instead
diff --git a/release-notes.yml b/release-notes.yml
index 14752607..4da71bdf 100644
--- a/release-notes.yml
+++ b/release-notes.yml
@@ -71,9 +71,15 @@ releases:
       - type: added
         area: cli
         text: "Exposed the rescue CLI over TCP port 23 on the recovery AP (`telnet 192.168.4.1`), so `set wifi.ssid`, `set wifi.pwd`, and `reboot` work without a serial cable."
+      - type: added
+        area: wifi
+        text: "The companion app works over the recovery AP too: connect to host `192.168.4.1` port `5000` for full app connectivity while roaming away from the configured network."
       - type: added
         area: wifi
         text: "Gave companion WiFi builds the BLE-style device pin rules: displays show a per-session `Pin:NNNNNN` on the home screen, headless devices default to pin `123456` (AP password `00123456`), and `set pin` overrides both persistently."
+      - type: fixed
+        area: wifi
+        text: "Kept the recovery AP joinable by pausing constant station rescans while it is up (they broke joining clients' WPA2 handshakes, which phones report as a wrong password); the configured network is retried once a minute instead."
       - type: changed
         area: prefs
         text: "Moved saved node settings to upstream's new key-based `prefs.json` format; existing settings, including persisted Wi-Fi credentials, are migrated automatically on first boot."