docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

docs/build-android.md

@@ -0,0 +1,67 @@
+# Android development
+
+Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current
+platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26).
+Use a maintained Android System WebView. Target API 37. On Android 17, choose
+"Allow private-network servers" when using a LAN instance; public HTTPS servers
+do not need this optional runtime permission. No discovery/scanning is performed.
+
+```sh
+export ANDROID_HOME=/path/to/android-sdk
+bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
+bash android/gradlew -p android connectedDebugAndroidTest
+```
+
+Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin
+with the build-cache fix in KGP 2.4.21. Maven versions are locked. No dynamic
+application dependencies or private Maven repository is required.
+
+Ordinary outputs:
+
+- `android/app/build/outputs/apk/debug/app-debug.apk` (development-signed)
+- `android/app/build/outputs/apk/release/app-release-unsigned.apk`
+- `android/app/build/outputs/bundle/release/app-release.aab` (unsigned unless signed later)
+- `android/app/build/reports/` (lint, JVM and emulator results)
+
+Immediately after building, collect and inspect the outputs:
+
+```sh
+python3 scripts/collect-android-artifacts.py
+```
+
+This writes ignored `artifacts/android/` copies, `SHA256SUMS`, source identity and
+manifest/network-policy/signature evidence. It requires `ANDROID_HOME` and respects
+`YUVOMI_BUILD_DIR`. Source identity records the checkout at collection time; always
+rebuild immediately beforehand and use a clean worktree for a release candidate.
+
+The unsigned release cannot be installed/published as-is. See release signing
+instructions. `gradle-wrapper.jar` is the standard generated Gradle bootstrap
+binary; it is intentionally versioned, unlike generated APKs or caches.
+
+On WSL/Windows mounts that reject POSIX metadata operations, put outputs on the
+Linux filesystem:
+
+```sh
+export YUVOMI_BUILD_DIR="$HOME/yuvomi-build"
+bash android/gradlew -p android testDebugUnitTest assembleDebug
+```
+
+The application never permits HTTP, including debug builds. Use real HTTPS for
+manual development. For a temporary local HTTPS integration environment:
+
+```sh
+git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upstream
+git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
+npm ci --omit=dev --prefix /path/to/upstream
+python3 scripts/test-integration.py /path/to/upstream --android
+```
+
+Requires Node 22.14+ and a running emulator. The harness creates and removes its
+own CA/key/database, uses `adb reverse`, and builds `.integration` with explicit
+test trust. It does not weaken production TLS. Test credentials are ephemeral.
+Keep test reports private if you customize the harness with real data (not advised).
+
+For dependency updates run `:app:dependencies --write-locks`, the full pipeline,
+and `python3 scripts/check-dependencies.py`. Review lockfile changes. The version
+update lint recommendations are informational, not suppressed correctness errors;
+OSV checks independently fail on known advisories.