docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/legacy-wrapper-security-review.md

@@ -0,0 +1,47 @@
+# Historical security review — superseded WebView prototype
+
+This is an engineering review, not an independent penetration test or certification.
+
+Addressed during implementation:
+
+- Canonical, HTTPS-only origin/port comparison; credential, fragment, query,
+  subpath, scheme, lookalike-host and TLS-downgrade regression cases.
+- A main-frame POST can bypass Android's usual navigation callback. The request
+  interception gate now rejects **all** cross-origin requests, not only subresources.
+  The emulator regression was observed failing when the main-frame guard was
+  deliberately removed, then rerun with the fix restored.
+- TLS failures cancel by default. Native download redirects are refused before
+  cookies can be replayed to another origin. Bootstrap requests use neither
+  cookies nor automatic redirects and have bounded metadata reads/timeouts.
+- Files use explicit system selection/content URIs; no filesystem or storage
+  permission is granted to web content. Blob exports have no native JS bridge.
+- Complete Android browsing-data deletion uses WebStorageCompat, with OS app
+  reset for engines without that capability. WebStorage.deleteAllData alone was
+  insufficient for service-worker CacheStorage/IndexedDB and is not relied upon.
+- iOS server erase replaces the WKWebView, not only its URL, eliminating old
+  history/back-forward contexts as well as persistent website data.
+- iOS metadata uses typed decoding, rejecting numeric values masquerading as booleans.
+- Native picker results are bound to the browsing generation/request. Android
+  rejects stale upload/download selections, revokes camera URI grants, and clears
+  capture cache on erasure. iOS ignores export-cancellation callbacks from an old
+  download. Apple-specific callback regressions have not run without Xcode.
+- KGP was upgraded after OSV identified CVE-2026-53914 in the original build tool.
+  The final OSV scan found no listed advisories across 213 locked/direct Maven
+  coordinates and build plugins. Rescan after resolution/lock updates.
+- The inspected release APK is not debuggable, rejects cleartext, disables backup
+  and trusts system CAs only. AndroidX's exported profile installer receiver is
+  protected by the system DUMP permission; app providers are not exported.
+
+Release gates still requiring evidence:
+
+- Actual Xcode typecheck, simulator, archive, physical-device and accessibility review.
+- End-to-end IdP flows, especially providers that prohibit embedded agents; no
+  browser-to-native session transfer is supported by the current upstream protocol.
+- iOS unknown-length download disk-pressure behavior; a post-download size check
+  is not a streaming quota. Verify file picker/camera cancellation on real devices.
+- Android file-picker/camera/rotation while a picker is outstanding; cancellation
+  on process death intentionally loses the selection, never silently retries it.
+- Offline sign-out/account switching, stale-worker updates and server erasure on
+  current WebView/WKWebView versions. Upstream tests are not native device proof.
+- Reverify final signed release manifests, signing, store ownership, private vulnerability contact
+  and applicable privacy disclosures. No claim that all vulnerabilities are absent.