docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

SECURITY.md

@@ -1,4 +1,56 @@
-# Security policy
+# Security policy — native rebuild
+
+**The current native client is an incomplete development preview, not an audited
+release or full PWA replacement.** See [native parity](docs/native-parity.md).
+
+Report vulnerabilities privately to the repository owner through an established
+private channel. No reporting mailbox has been provided; do not invent one or put
+cookies, keys, household records or exploit details into public issues. Upstream
+server vulnerabilities belong in its private reporting channel.
+
+## Current native security model
+
+- Native Compose/SwiftUI screens call one configured HTTPS origin. System TLS
+  validation is mandatory and API redirects are refused. No WebView/WKWebView is
+  shipped as the app surface or used as a missing-feature fallback.
+- Passwords and second-factor codes exist transiently for the API request; they
+  are not saved to preferences, keychains, logs, artifacts or application state
+  restoration. Server cookies, not passwords, persist the session.
+- Android persists allow-listed Secure cookies with their absolute expiry in
+  AES-GCM ciphertext backed by AndroidKeyStore, with the origin authenticated as
+  additional data. iOS uses a private ephemeral URLSession jar and origin-scoped
+  Keychain items protected with WhenUnlockedThisDeviceOnly.
+- CSRF tokens follow the upstream API protocol. Only an explicit `csrf_invalid`
+  rejection allows one refresh/retry. Other permission errors or ambiguous network
+  failures never cause automatic mutation replay. The server remains authoritative
+  for authorization, recurrence, reward accounting and cross-module rules.
+- Reads are bounded and timed out. There is no offline mutation queue or native
+  remote push implementation. Missing features are documented, not simulated.
+- Logout attempts remote revocation and clears the native local session. Local
+  server removal is not remote revocation. Old prototype WebKit data is not
+  imported; use OS app-data removal/reinstall to erase that legacy installation.
+- Android screenshots are blocked. The iOS view is obscured while inactive. The
+  Android integration test temporarily permits a screenshot only of its synthetic
+  private fixture, restores the restriction and never uses real household data.
+- The owner-authorized initial signing key is backed up outside the repository.
+  Four repository signing secrets exist, but signing/release changes are parked
+  during the native rebuild. No private key belongs in Git or downloadable CI
+  artifacts. Protect trusted-branch write access and isolate persistent runners.
+
+## Mandatory gates
+
+Native transports, secure storage, session erasure, actual Apple SDK compilation,
+real-device behavior, accessibility, supported authentication flows and dependency
+resolution need review and evidence before release. OIDC, file transfers, offline
+storage and the remaining modules are not implemented native capabilities yet.
+Advisory scans and parser/unit checks are not a guarantee that code is secure.
+
+The superseded prototype policy is retained below as historical context only;
+it must not be used to claim capabilities of the native rebuild.
+
+---
+
+## Historical WebView prototype policy
 
 **Development software: no production-readiness claim.** Only the current
 development branch is maintained; no stable mobile release exists yet.