diff --git a/.gitmodules b/.gitmodules
index 2ab0266..5ce0344 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -14,4 +14,4 @@
 [submodule "backend/url-shortener"]
 	path = backend/url-shortener
 	url = git://f0xx.org/androidcast_project/url-shortener
-	branch = main
+	branch = next
diff --git a/AGENTS.md b/AGENTS.md
index a91e54c..89f10bd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,6 +18,6 @@ After a **reset** or new session on deploy/infra work:
 2. For hub deploy only: **[examples/app_hub/DEPLOY.md](examples/app_hub/DEPLOY.md)**.
 3. For PHP/DB/tickets: **[examples/crash_reporter/backend/README.md](examples/crash_reporter/backend/README.md)**.
 4. For git branches: **[docs/GIT_FLOW.md](docs/GIT_FLOW.md)** — work on `feature/*` from `next`; do not commit unless asked.
-5. **URL shortener** is a **git submodule** at `backend/url-shortener` → `git://f0xx.org/androidcast_project/url-shortener`. **Never** edit shorten API PHP in the monorepo tree without committing inside the submodule first. Flow: `cd backend/url-shortener` → commit & push `main` → parent repo `git add backend/url-shortener` → bump submodule SHA. See [backend/README.md](backend/README.md).
+5. **URL shortener** is a **git submodule** at `backend/url-shortener` → `git://f0xx.org/androidcast_project/url-shortener`. **Never** edit shorten API PHP in the monorepo tree without committing inside the submodule first. Flow: `cd backend/url-shortener` → commit & push `next` → parent repo `git add backend/url-shortener` → bump submodule SHA. See [backend/README.md](backend/README.md).
 
 **Hard rule:** Port **8089** is **not** the androidcast vhost (Janus/other). Public apps path is **`https://apps.f0xx.org`** → BE **`http://artc0.intra.raptor.org:80`**.
diff --git a/backend/README.md b/backend/README.md
index 6d373bb..609f0ab 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -15,9 +15,9 @@ git submodule update --init backend/url-shortener
 1. **URL shortener changes** — work inside the submodule only:
    ```bash
    cd backend/url-shortener
-   git checkout main && git pull
+   git checkout next && git pull
    # edit, test, commit, push to url-shortener remote
-   git push origin main
+   git push origin next
    ```
 2. **Pin new submodule SHA in android_cast** — after the submodule push:
    ```bash
diff --git a/backend/url-shortener b/backend/url-shortener
index 7363985..3a28f62 160000
--- a/backend/url-shortener
+++ b/backend/url-shortener
@@ -1 +1 @@
-Subproject commit 7363985a0c30219fefc0ff9a92e847fd6517fb67
+Subproject commit 3a28f622f3901a031d7072e0be0a1a9d8094bd1d
diff --git a/docs/DRs/20100611_3_url_shortener.md b/docs/DRs/20100611_3_url_shortener.md
index 2d8d7fb..bc814f3 100644
--- a/docs/DRs/20100611_3_url_shortener.md
+++ b/docs/DRs/20100611_3_url_shortener.md
@@ -79,7 +79,7 @@ Questions from draft §“TBD and open questions list” and inline `TBD` marker
 | Q4 | Java hash vs SHA-256 | **SHA-256** (see [§4](#4-slug-algorithm)). Java hash is 32-bit, non-cryptographic, JVM-stable but poor for URL slugs. |
 | Q5 | Interleaved URL+TOKEN string | **Rejected** for production. Deterministic `SHA256(bearer_id ‖ normalized_url)` instead. Draft interleave kept as historical note only. |
 | Q6 | Authentication: “app-wide shared session, project-wise token” | **Split roles:** `curl`/services → **project bearer token**; console operators → **shared `ac_crash_sess`** to create/revoke tokens (same RBAC as crashes/tickets). Shorten API does **not** accept PHP session cookies. |
-| Q7 | Submodule remote | **Done** — `git://f0xx.org/androidcast_project/url-shortener`; pinned at `backend/url-shortener/` submodule (`main`). |
+| Q7 | Submodule remote | **Done** — `git://f0xx.org/androidcast_project/url-shortener`; pinned at `backend/url-shortener/` submodule (`next`). |
 | Q8 | OTA-style “invalid URL” on unrelated services | N/A here; shorten service validates URL scheme/host and returns `INVALID_URL`. |
 | Q9 | Step 9.1.1 / 9.1.2 trusted sub-capabilities | `can_temporary` on bearer; `can_permanent` on bearer **and** valid signer required for `ttl=0`. |
 | Q10 | Cached hit when TTL “exceeds given limits” | If stored link **expired** → error `TTL_EXPIRED`, not silent renew. If valid → return same slug with **remaining** `ttl` in response (draft step 8). |