docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/legacy-wrapper-compatibility.md

@@ -0,0 +1,70 @@
+# Historical server compatibility — superseded WebView prototype
+
+Source reference: upstream 2.78.0 revision
+`10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`. No general version range has been
+certified. Anonymous bootstrap metadata deliberately omits the exact version;
+native probing verifies shape, not an invented minimum-version comparison.
+
+Use `https://family.example.com` or `https://family.example.com:8443`, backed by a
+root-hosted Yuvomi installation and a valid system-trusted certificate. Operators
+should set `SESSION_SECURE=true`, correct `BASE_URL`, and correct proxy trust.
+Private servers are supported through reachable HTTPS/VPN, not TLS bypasses.
+International hostnames should be entered in ASCII/punycode for both platforms.
+
+Root-relative assets, API endpoints, cookie paths, callback redirects and worker
+registration mean `/yuvomi/` subpaths are not supported by the inspected source.
+Use a dedicated hostname. Reverse proxies must pass `/api/v1/*`, cookies, HTML,
+JavaScript and the service worker consistently. An external authentication proxy
+that intercepts bootstrap calls is rejected with a connection error; it is not
+silently identified as a Yuvomi server.
+
+## Authentication
+
+Password login, TOTP/recovery codes, password reset, invitations, server-side
+session expiry/revocation and logout remain upstream web flows. No native code
+stores the password, supplies a CSRF bypass, or extends an expired session.
+Backgrounding does not clear cookies. Native server erasure does not revoke a
+remote session; use Yuvomi logout first or revoke sessions server-side.
+
+### OIDC: local fixture verified; real-provider validation pending
+
+The initiating Yuvomi session contains OIDC state, nonce and PKCE verifier. When
+the server redirects to an identity provider, native consent offers an isolated
+web sign-in window sharing the OS website cookie store. HTTPS-only redirects
+can return to the server callback; the final same-origin page returns to the main
+view. No app-capability handlers or JS bridge are installed in that auth window.
+
+Some providers (including configurations that prohibit embedded user agents)
+require a system browser. **Those cannot sign the native view in with upstream's
+current protocol.** Use Server settings -> Open server in browser, and sign in
+there for an independent browser session. Opening only the external authorization
+link in a browser does not transfer the initiating cookie. Browser cookies are
+never copied into the app, and custom-scheme callbacks are not fabricated.
+
+The API 35 integration suite completes a native isolated-window round trip with
+a local test IdP, real RS256 ID tokens, nonce and S256 PKCE. No external
+IdP/developer account was supplied. Validate the actual provider, including
+cross-site cookies, cancellation, errors, TOTP and account linking, before relying
+on that deployment. iOS authentication has not run against Apple SDKs. A native
+browser handoff would require an independently reviewed upstream protocol; no
+such upstream change is included or published.
+
+Android generated exports require a current WebView supporting document-start
+scripts and are capped at 25 MB. A bounded Blob registry preserves a generated
+file even when upstream immediately revokes its object URL; it does not fetch
+blob URLs or alter the server's CSP. HTTPS file downloads are capped at 100 MB.
+Update the system WebView if generated exports are unavailable on an old engine.
+
+## Notifications and offline
+
+Upstream implements Web Push and optional ntfy/Gotify/webhook/email channels.
+Embedded web views do not supply a portable native push subscription. This app
+has **no native remote-push claim**, no Firebase/APNs secrets, no background
+polling service, and no fake notification-registration UI. Configure an existing
+optional upstream ntfy/Gotify channel and its client if desired. No centralized
+service is required by this application.
+
+Upstream service-worker caching is read-only, allow-listed, and versioned.
+Mutations/authentication remain online. Platform-specific cache/resume behavior
+and offline account switching still need device validation. Do not rely on offline
+editing, synchronization, or closed-app push in this native development build.