docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

docs/validation.md

@@ -0,0 +1,130 @@
+# Validation status
+
+**Partially verified development software, not production-ready.**
+Local validation date: 2026-10-21. No unexecuted iOS application test, hosted CI
+run, production signing, or store publication is represented as completed.
+
+## Executed evidence
+
+- Android debug APK and unsigned release APK/AAB built successfully; both
+  `lintDebug` and `lintRelease` passed. JVM security/picker-policy tests: **7 passed,
+  zero failures/skips**.
+- Android API 35 regular emulator suite: **6 passed, zero failures/skips**.
+  This covers onboarding, invalid URLs, background/resume, hardened settings,
+  cross-origin POST/subresource isolation, opaque-page Blob rejection and activity
+  recreation. Its permission test checks that the API 37 permission UI is absent;
+  it is **not** evidence of API 37 permission grant/denial behavior.
+- Unmodified pinned upstream ran behind a temporary HTTPS reverse proxy.
+  Bootstrap metadata, password login, Secure/HttpOnly/SameSite cookies, persistent
+  session, CSRF rejection, logout/revocation passed in the harness.
+- Android's extended real-server scenario exercises login, HttpOnly cookies,
+  document upload via upstream fetch, native FileTransfer output, bounded Blob
+  export, background/resume, recreation, CSRF-protected logout, revocation,
+  recovery, isolated OIDC return and back navigation. It does not automate the OS
+  camera/document destination picker or prove every upstream module works.
+  Two consecutive API 35 runs have **7 passed, zero failures/skips each**, including the
+  six regular security/onboarding cases and this real-server scenario.
+- The cross-origin POST regression was deliberately observed failing without its
+  guard. The production guard was restored and the API 35 regression passes.
+- Portable Swift production-policy tests: 7 passed (URL and typed metadata).
+  All Swift sources passed format lint and parsing with Swift 6.2.1 on Linux.
+  The portable package excludes BrowserModelTests. This does not build iOS.
+- Selected upstream suites ran successfully: cookie-secure-flag (4),
+  session-sliding (8), two-factor (22), password-reset (24), sw-api-cache (42).
+  Upstream's plain OIDC script also exited successfully. These are upstream tests,
+  not evidence of a provider round-trip or native push support.
+- The HTTPS harness independently passed upstream OIDC discovery, RS256 ID-token
+  signature/nonce validation, S256 PKCE exchange and session creation with a local
+  test IdP. The fixture checks single-use codes, exact redirect URIs and OAuth
+  Basic client authentication. Loopback hosts/ports and automatic fixture consent
+  are not representative of every provider's cross-site/embedded-agent policies.
+- OSV: no listed advisories for **213** locked/direct Maven coordinates and build
+  plugins at scan time. This is not a guarantee that no vulnerabilities exist.
+- ktlint 1.7.1, actionlint 1.7.7, repository invariants, Python compilation,
+  Node syntax and shell syntax checks passed. JUnit-verifier regression suite:
+  **8 passed**, including rejection of absent, empty, malformed, insufficient,
+  failed, errored and skipped evidence.
+- Release APK inspection confirms API 26 minimum / API 37 target, no debuggable
+  flag, backups and cleartext disabled, system-only certificate trust. Exported
+  entry points are the launcher and AndroidX ProfileInstallReceiver protected by
+  the system DUMP permission; file/startup providers are not exported. Debug APK
+  signature verifies; release APK/AAB are unsigned. Collected archives contain no
+  fixture CA/key or signing-key files.
+
+## Emulator limitations and retry evidence
+
+Earlier extended-suite attempts crashed the host emulator with SIGSEGV under
+software/off GPU modes. Host-GPU mode remained running and produced actionable
+JUnit failures: an OIDC-return synchronization timeout, followed by an outage
+assertion that incorrectly assumed the upstream worker could not serve its cached
+app shell, then a document-readiness race after recreation. Tests now verify the
+loaded JavaScript origin, wait for the sign-in window to close, retry only a probe
+lost to document replacement and exercise recovery through uncached metadata.
+The completed retry passes all seven tests without disabling the worker or
+weakening production TLS/CSP/origin policies.
+
+API 37 attempts encountered broken package/activity services and locked
+credential-encrypted storage. **No API 37 runtime pass is claimed.**
+
+Local logs and reports live in `/home/neste/yuvomi-build/`; test XML is under
+`app/outputs/androidTest-results/connected/`. Earlier failing JUnit snapshots are
+preserved as `integration-host-gpu-oidc-race.xml` and
+`integration-host-gpu-sw-cache.xml`, plus
+`integration-host-gpu-document-ready.xml`. Passing evidence is preserved in
+`integration-api35-first-pass.xml` and `integration-api35-repeat-pass.xml`; logs are
+`upstream-integration-final-retry.log` and `upstream-integration-repeat.log`.
+These files are local evidence, not published
+artifacts or a hosted CI result.
+
+Test environment: JDK 17.0.20.1, Node 22.22.1, Python 3.14.4, Android Emulator
+37.2.12, API 35 x86_64 Google APIs image, WebView 124.0.6367.219. The old bundled
+WebView is useful compatibility evidence, not a recommendation to use an unpatched
+engine; a current engine/device run remains mandatory.
+
+## Artifacts
+
+Ignored `artifacts/android/` contains the development-signed debug APK and unsigned
+release APK/AAB, `SHA256SUMS`, `build-info.json` and manifest/policy/signature
+inspection evidence. No integration APK is collected. No IPA or Apple archive
+exists. See [Android build](build-android.md) for repeatable collection commands.
+
+## Commands
+
+```sh
+bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
+python3 scripts/test-integration.py /path/to/pinned-upstream --android
+swift test --package-path ios
+swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
+python3 scripts/check-repository.py
+python3 scripts/check-dependencies.py
+python3 scripts/test-verifier.py
+python3 scripts/collect-android-artifacts.py
+git diff --check
+```
+
+This environment is Linux/WSL. Android SDK and a KVM emulator were installed for
+real execution. Build output relocation was needed because the Windows mount
+rejects some Gradle POSIX metadata operations. Swift's Linux toolchain was
+installed for portable tests. No macOS, Xcode, Apple simulator or physical device
+is available; no iOS build/archive/UI result is claimed.
+
+## Mandatory remaining evidence
+
+- Run Xcode build, XCTest/UI tests and unsigned archive on macOS; fix any compiler
+  or runtime issues. The app has **not** yet been typechecked against Apple SDKs.
+- Validate real IdPs: cancellation, account linking, TOTP after OIDC, and embedded
+  provider policy. Browser-only providers have no native-session handoff upstream.
+- Real-device camera/document picker cancellation, file MIME cases, rotation with
+  an outstanding picker, network loss/reconnect, process kill/memory pressure,
+  session expiry/revocation, OS backup, and offline account isolation.
+- Android 17 private-network permission grant/denial/revocation on a matching OS.
+  Also run minimum-supported API 26 and a current OS/WebView device matrix.
+- VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion,
+  light/dark appearance and responsive web modules on actual supported devices.
+- Operational CI runs on an authorized GitHub repository/runner, private security
+  reporting contact, human security review, store ownership and production signing.
+
+No Firebase/APNs registration, closed-app push, offline editing, App Store approval,
+signing, publication or physical-device validation is claimed. See `SECURITY.md`
+and `docs/security-review.md` for residual limitations.
+Resume work using [maintainer continuation](continuation.md).