docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/build-android.md

@@ -2,8 +2,8 @@
 
 Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current
 platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26).
-Use a maintained Android System WebView. Target API 37. On Android 17, choose
-"Allow private-network servers" when using a LAN instance; public HTTPS servers
+The application surface is Jetpack Compose, not Android System WebView. Target
+API 37. On Android 17, choose "Zugriff auf private Netzwerke erlauben" for a LAN instance; public HTTPS servers
 do not need this optional runtime permission. No discovery/scanning is performed.
 
 ```sh
@@ -13,7 +13,7 @@ bash android/gradlew -p android connectedDebugAndroidTest
 ```
 
 Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin
-with the build-cache fix in KGP 2.4.21. Maven versions are locked. No dynamic
+with KGP and Compose compiler plugin 2.4.21. Maven versions are locked. No dynamic
 application dependencies or private Maven repository is required.
 
 Ordinary outputs:
@@ -23,6 +23,14 @@ Ordinary outputs:
 - `android/app/build/outputs/bundle/release/app-release.aab` (unsigned unless signed later)
 - `android/app/build/reports/` (lint, JVM and emulator results)
 
+The Gitea build job uploads `android-native-debug-apk`, containing an installable
+development-signed `app-debug.apk`. It is a native preview, not a signed stable
+release or a claim of full PWA parity. See `native-parity.md` before testing it.
+
+Native UI tests live in `src/androidTestNative/java` and the real-server native
+scenario in `src/androidTestNativeIntegration/java`. The old browser tests and
+renderer are archived under `legacy/` and are not compiled into the app/suites.
+
 Immediately after building, collect and inspect the outputs:
 
 ```sh
@@ -60,6 +68,16 @@ Requires Node 22.14+ and a running emulator. The harness creates and removes its
 own CA/key/database, uses `adb reverse`, and builds `.integration` with explicit
 test trust. It does not weaken production TLS. Test credentials are ephemeral.
 Keep test reports private if you customize the harness with real data (not advised).
+The native test calls the real API through native controls and saves a synthetic
+dashboard screenshot under `app/build/outputs/native-screenshots/`. It does not
+demonstrate native SSO merely because the protocol fixture also tests OIDC.
+The test writes through `PlatformTestStorageRegistry`; AGP collects the file in
+`outputs/connected_android_test_additional_output/integrationAndroidTest/` before
+uninstalling the fixture. The harness rejects missing/ambiguous output and removes
+only its known screenshot from previous runs. Do not extract app-private files
+after Gradle returns: UTP has already uninstalled the `.integration` package.
+Capture uses the native window and asserts nonuniform pixels; a valid PNG header
+alone is not sufficient screenshot evidence.
 
 For dependency updates run `:app:dependencies --write-locks`, the full pipeline,
 and `python3 scripts/check-dependencies.py`. Review lockfile changes. The version