docs: record verified native preview and unfinished PWA parity

Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.

docs/validation.md

@@ -1,92 +1,60 @@
-# Validation status
+# Native validation
 
-**Partially verified development software, not production-ready.**
-Local validation date: 2026-10-21. No unexecuted iOS application test, hosted CI
-run, production signing, or store publication is represented as completed.
+**Incomplete native rebuild; not full PWA parity and not production-ready.**
+The old browser results are [historical only](legacy-wrapper-validation.md).
 
-## Executed evidence
+The new shipping surfaces are Android Compose and iOS SwiftUI. Current native
+tests are in `androidTestNative` / `androidTestNativeIntegration`, JVM native policy
+tests, and Swift production contracts/transport tests. Archived WebView tests are
+not included in the native suites or counted toward native completion.
 
-- Android debug APK and unsigned release APK/AAB built successfully; both
-  `lintDebug` and `lintRelease` passed. JVM security/picker-policy tests: **7 passed,
-  zero failures/skips**.
-- Android API 35 regular emulator suite: **6 passed, zero failures/skips**.
-  This covers onboarding, invalid URLs, background/resume, hardened settings,
-  cross-origin POST/subresource isolation, opaque-page Blob rejection and activity
-  recreation. Its permission test checks that the API 37 permission UI is absent;
-  it is **not** evidence of API 37 permission grant/denial behavior.
-- Unmodified pinned upstream ran behind a temporary HTTPS reverse proxy.
-  Bootstrap metadata, password login, Secure/HttpOnly/SameSite cookies, persistent
-  session, CSRF rejection, logout/revocation passed in the harness.
-- Android's extended real-server scenario exercises login, HttpOnly cookies,
-  document upload via upstream fetch, native FileTransfer output, bounded Blob
-  export, background/resume, recreation, CSRF-protected logout, revocation,
-  recovery, isolated OIDC return and back navigation. It does not automate the OS
-  camera/document destination picker or prove every upstream module works.
-  Two consecutive API 35 runs have **7 passed, zero failures/skips each**, including the
-  six regular security/onboarding cases and this real-server scenario.
-- The cross-origin POST regression was deliberately observed failing without its
-  guard. The production guard was restored and the API 35 regression passes.
-- Portable Swift production-policy tests: 7 passed (URL and typed metadata).
-  All Swift sources passed format lint and parsing with Swift 6.2.1 on Linux.
-  The portable package excludes BrowserModelTests. This does not build iOS.
-- Selected upstream suites ran successfully: cookie-secure-flag (4),
-  session-sliding (8), two-factor (22), password-reset (24), sw-api-cache (42).
-  Upstream's plain OIDC script also exited successfully. These are upstream tests,
-  not evidence of a provider round-trip or native push support.
-- The HTTPS harness independently passed upstream OIDC discovery, RS256 ID-token
-  signature/nonce validation, S256 PKCE exchange and session creation with a local
-  test IdP. The fixture checks single-use codes, exact redirect URIs and OAuth
-  Basic client authentication. Loopback hosts/ports and automatic fixture consent
-  are not representative of every provider's cross-site/embedded-agent policies.
-- OSV: no listed advisories for **213** locked/direct Maven coordinates and build
-  plugins at scan time. This is not a guarantee that no vulnerabilities exist.
-- ktlint 1.7.1, actionlint 1.7.7, repository invariants, Python compilation,
-  Node syntax and shell syntax checks passed. JUnit-verifier regression suite:
-  **8 passed**, including rejection of absent, empty, malformed, insufficient,
-  failed, errored and skipped evidence.
-- Release APK inspection confirms API 26 minimum / API 37 target, no debuggable
-  flag, backups and cleartext disabled, system-only certificate trust. Exported
-  entry points are the launcher and AndroidX ProfileInstallReceiver protected by
-  the system DUMP permission; file/startup providers are not exported. Debug APK
-  signature verifies; release APK/AAB are unsigned. Collected archives contain no
-  fixture CA/key or signing-key files.
+## Executed locally — 2026-10-21
 
-## Emulator limitations and retry evidence
+| Check | Observed result |
+| --- | --- |
+| Android JVM tests | 10 passed; zero failed/skipped |
+| Native Compose UI/security suite, API 35 emulator | 6 passed; zero failed/skipped |
+| Real-upstream native integration suite | 7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario) |
+| Native scenario | Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure |
+| Integration screenshot export | Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only |
+| Android lint | Debug and release passed; newer-version recommendations remain informational |
+| Android packages | Debug APK and unsigned release APK/AAB built successfully |
+| Swift portable suite | 16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution |
+| Swift formatting/parsing | Strict format lint and parsing passed, including Apple-only sources |
+| Script regressions | 10 runner-preflight, 8 JUnit-evidence and 5 screenshot-output tests passed |
+| Repository/workflows | Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed |
+| OSV | No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit |
 
-Earlier extended-suite attempts crashed the host emulator with SIGSEGV under
-software/off GPU modes. Host-GPU mode remained running and produced actionable
-JUnit failures: an OIDC-return synchronization timeout, followed by an outage
-assertion that incorrectly assumed the upstream worker could not serve its cached
-app shell, then a document-readiness race after recreation. Tests now verify the
-loaded JavaScript origin, wait for the sign-in window to close, retry only a probe
-lost to document replacement and exercise recovery through uncached metadata.
-The completed retry passes all seven tests without disabling the worker or
-weakening production TLS/CSP/origin policies.
+Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1,
+Kotlin/Compose compiler 2.4.21, API 35 `sdk_gphone64_x86_64` emulator, Swift 6.2.1.
+The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated
+protobuf warning; the final Android validation log has no such warning.
 
-API 37 attempts encountered broken package/activity services and locked
-credential-encrypted storage. **No API 37 runtime pass is claimed.**
+The first integration attempt missed the scrolled-off login button. Later,
+post-uninstall screenshot retrieval failed, and the first compositor capture was
+black. The final test scrolls the real button, uses native-window capture with a
+nonblank-pixel assertion and writes through `PlatformTestStorageRegistry` for AGP
+collection. The latest complete harness exits successfully, not just its JUnit
+subprocess. Ordinary builds retain screenshot protection.
 
-Local logs and reports live in `/home/neste/yuvomi-build/`; test XML is under
-`app/outputs/androidTest-results/connected/`. Earlier failing JUnit snapshots are
-preserved as `integration-host-gpu-oidc-race.xml` and
-`integration-host-gpu-sw-cache.xml`, plus
-`integration-host-gpu-document-ready.xml`. Passing evidence is preserved in
-`integration-api35-first-pass.xml` and `integration-api35-repeat-pass.xml`; logs are
-`upstream-integration-final-retry.log` and `upstream-integration-repeat.log`.
-These files are local evidence, not published
-artifacts or a hosted CI result.
+The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust,
+metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is **not
+native SSO**: the native client refuses the redirect and SSO remains pending.
 
-Test environment: JDK 17.0.20.1, Node 22.22.1, Python 3.14.4, Android Emulator
-37.2.12, API 35 x86_64 Google APIs image, WebView 124.0.6367.219. The old bundled
-WebView is useful compatibility evidence, not a recommendation to use an unpatched
-engine; a current engine/device run remains mandatory.
+Evidence paths in the local external build directory:
 
-## Artifacts
+- `app/test-results/testDebugUnitTest/`
+- `app/outputs/androidTest-results/connected/{debug,integration}/`
+- `app/outputs/native-screenshots/native-dashboard.png`
+- `app/reports/lint-results-{debug,release}.html`
+- Logs: `/home/neste/yuvomi-native-validation.log`,
+  `/home/neste/yuvomi-native-integration-final.log`,
+  `/home/neste/yuvomi-native-swift.log`.
 
-Ignored `artifacts/android/` contains the development-signed debug APK and unsigned
-release APK/AAB, `SHA256SUMS`, `build-info.json` and manifest/policy/signature
-inspection evidence. No integration APK is collected. No IPA or Apple archive
-exists. See [Android build](build-android.md) for repeatable collection commands.
+No Apple SDK application build, simulator UI test or physical-device result is
+claimed from these Linux runs. The modified Mac bootstrap and remote APK upload
+still require inspection of the next actual Gitea run. Prior remote emulator jobs
+failed KVM preflight; the prerequisite was not weakened or counted as passing.
 
 ## Commands
 
@@ -97,47 +65,18 @@ swift test --package-path ios
 swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
 python3 scripts/check-repository.py
 python3 scripts/check-dependencies.py
-python3 scripts/test-verifier.py
-python3 scripts/collect-android-artifacts.py
-git diff --check
+python3 scripts/lint-workflows.py /path/to/actionlint
 ```
 
-This environment is Linux/WSL. Android SDK and a KVM emulator were installed for
-real execution. Build output relocation was needed because the Windows mount
-rejects some Gradle POSIX metadata operations. Swift's Linux toolchain was
-installed for portable tests. No macOS, Xcode, Apple simulator or physical device
-is available; no iOS build/archive/UI result is claimed.
+On the local WSL checkout use `YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build`
+and the SDK paths from [continuation](continuation.md). Select only the authorized
+test emulator with `ANDROID_SERIAL=emulator-5554`; unrelated/unauthorized attached
+devices are not test targets.
 
-## Mandatory remaining evidence
+## External gates
 
-- Run Xcode build, XCTest/UI tests and unsigned archive on macOS; fix any compiler
-  or runtime issues. The app has **not** yet been typechecked against Apple SDKs.
-- Validate real IdPs: cancellation, account linking, TOTP after OIDC, and embedded
-  provider policy. Browser-only providers have no native-session handoff upstream.
-- Real-device camera/document picker cancellation, file MIME cases, rotation with
-  an outstanding picker, network loss/reconnect, process kill/memory pressure,
-  session expiry/revocation, OS backup, and offline account isolation.
-- Android 17 private-network permission grant/denial/revocation on a matching OS.
-  Also run minimum-supported API 26 and a current OS/WebView device matrix.
-- VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion,
-  light/dark appearance and responsive web modules on actual supported devices.
-- Successful CI runs on the configured Gitea runners, private security
-  reporting contact, human security review, store ownership and production signing.
-
-No Firebase/APNs registration, closed-app push, offline editing, App Store approval,
-signing, publication or physical-device validation is claimed. See `SECURITY.md`
-and `docs/security-review.md` for residual limitations.
-Resume work using [maintainer continuation](continuation.md).
-
-## Gitea runner adaptation
-
-Workflows now live in `.gitea/workflows/` and target the supplied `ubuntu-latest`
-pool and native `macos-arm64` M4 Pro runner. Local workflow grammar lint (Gitea URL
-syntax normalized), repository invariants, shell/Python syntax, ten mocked runner
-preflight regressions and eight evidence-verifier regressions pass. SHA-256 Git
-initialization/fetch was exercised locally; the pinned XcodeGen archive's checksum
-and native arm64 slice were verified. These are not remote runner execution or
-Apple SDK results. See [runner requirements](ci-runners.md); the local emulator
-preflight currently rejects unavailable/inaccessible KVM as designed. Original
-application build evidence above remains historical and is not a rebuild of the
-workflow-only changes.
+Apple SDK builds, real supported devices/current engines, Android API 37, native
+SSO/reset/invite protocols, permission/role cases, files/offline/notifications,
+complete module and settings parity, visual baselines, accessibility and human
+security review remain open. Missing modules are listed in
+[native parity](native-parity.md), not silently represented as working.