docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/architecture.md

@@ -1,41 +1,52 @@
-# Architecture
+# Native client architecture
 
-Two independent native applications share a policy, not a cross-platform runtime:
+The requested product is a native reconstruction of Yuvomi's PWA, not a native
+window around that website. Both shipping entry points now render native views:
 
 | Responsibility | Android | iOS |
 | --- | --- | --- |
-| Native entry/configuration | ComponentActivity and platform widgets | SwiftUI |
-| Web application | Android WebView | WKWebView |
-| Server URL policy | ServerAddress | ServerAddress |
-| Reachability/metadata | HttpsURLConnection, no redirects/cookies | Ephemeral URLSession, no redirects/cookies |
-| Authentication | Upstream web UI and OS cookie jar | Upstream web UI and WKWebsiteDataStore |
-| OIDC | Separate restricted web view after consent | Separate restricted web view after consent |
-| Downloads | Origin-bound streaming / bounded blob capture and pull | WKDownload to temporary protected file, system export |
+| Screens and navigation | Jetpack Compose / Material 3 primitives, Yuvomi tokens | SwiftUI, Yuvomi tokens |
+| Application state | AndroidViewModel + Compose state | MainActor ObservableObject |
+| JSON API | HttpsURLConnection, serialized worker | URLSession actor, bounded streaming delegate |
+| Session ownership | Explicit origin-bound secure-cookie jar | Private ephemeral URLSession cookie storage |
+| Persistent cookies | AES-GCM, AndroidKeyStore key, origin as authenticated data | Keychain, WhenUnlockedThisDeviceOnly, origin-scoped account |
+| Server logic | Existing unmodified Yuvomi API | Existing unmodified Yuvomi API |
 
-The client never reimplements a Yuvomi module or introduces a backend. The user
-selects the origin. Bootstrap calls check the actual upstream unauthenticated
-metadata contract before loading the server application. Configuration stores only
-the origin and a query/fragment-free last path; auth/reset/invite routes are not
-restored. No native password or API-token storage exists.
+There is no WebView/WKWebView in either shipped source tree and no browser
+fallback for missing modules. The old implementation and browser tests are
+archived in `legacy/`; their results are historical, not evidence for this client.
 
-The current web view remains alive across background/resume and ordinary rotation.
-Android handles orientation changes in the existing activity; process recreation
-loads the remembered path and retains OS cookies, not unsaved web form memory.
-iOS retains a StateObject-owned view; cold launch restores path and persistent
-cookies. No resume reload is imposed. Native recovery offers Retry, Keep viewing,
-and server management without hiding the route back to configuration.
+The first native slice contains HTTPS onboarding, setup/password/TOTP login,
+session restoration, a basic dashboard, task/note/shopping interactions, read-only
+permission handling and local sign-out/server removal. Exact feature and visual
+parity is tracked in [native parity](native-parity.md), not inferred from a list of
+navigation destinations. The other modules remain unfinished.
 
-Server erasure destroys the browsing context and clears all website storage before
-another server is loaded. The local wipe does not invalidate the remote session;
-logout is still a server-side operation. Web application history remains native
-web history. External schemes, universal links and app links are not registered
-because arbitrary self-hosted domains cannot be verified by this app in advance.
+## Transport and state boundaries
 
-The optional integration build has a different Android package ID and adds trust
-for a fresh test CA generated outside the repository. It uses the same production
-code and the unmodified pinned upstream server. Neither normal debug nor release
-resources include that CA. Never distribute an integration APK.
+- One configured root HTTPS origin/port; system certificate validation only.
+- API calls never follow redirects. No cookie or Authorization state is replayed
+  to another host. Authentication proxies returning HTML are not treated as APIs.
+- JSON reads have byte limits and timeouts. Writes are not queued for offline
+  replay. Only a server-declared `csrf_invalid` rejection permits one token refresh
+  and retry; ordinary authorization failures and transport failures do not.
+- Server session cookies are persisted, not passwords or TOTP/recovery codes.
+  Session-only cookies are not converted to long-lived cookies.
+- Native UI mutations wait for the server result. Permissions remain enforced
+  server-side; sparse module/widget permissions also control native affordances.
+- Local removal clears the native cookie vault and in-memory records. It is not
+  remote revocation. Logout attempts server revocation and still erases the local
+  session if the server cannot be reached.
+- A prior WebView prototype installation may retain its old OS website data.
+  This data is never imported by the native client. Clear app data/reinstall the
+  prototype before reviewing this native preview if complete legacy erasure is
+  required; no migration of private household records is performed.
 
-Read-only offline functionality belongs to upstream's service worker. The app
-preserves it where the platform engine supports it, but does not promise offline
-editing, synchronization, or the same PWA cache behavior on all OS versions.
+## Explicit gaps
+
+No native OIDC handoff has been implemented. A browser sign-in is not represented
+as a successful native API session. Password reset/invitation flows, the remaining
+modules, configurable dashboard, uploads/downloads, notification integrations,
+offline cache, localization parity and visual baseline comparison remain open.
+The signing setup was paused by the maintainer's native-rebuild correction; it
+must not be used to label this incomplete client as a finished release.