docs: record verified Android login fix artifact and regression results

docs/continuation.md

@@ -24,6 +24,14 @@ certificate checks, redirect refusal, encryption and expiry are unchanged. Login
 errors now distinguish credential/code rejection from session-cookie problems and
 a successful retry clears the old error. Both secure/default-cookie test modes
 are in CI; see `login-troubleshooting.md` and the latest validation section.
+The fix is source `4b483c2`; local 13 JVM, both 7-test cookie modes, 6 ordinary
+native UI tests, lint and all packages pass. Gitea build job 1071/run 666 (#11)
+passed and published the actual 0.2.1/code-3 APK; downloaded, verified and installed/
+launched on `emulator-5554`. Exact link/checksum are in `validation.md`.
+That CI-signed debug APK is now installed on the local emulator. Its certificate
+differs from the local Gradle debug key: before another local device-test run,
+remove only this synthetic preview package or use a fresh AVD. An install failure
+with zero tests must not be reported as a passing instrumentation run.
 
 The owner-authorized signing key and four Gitea secrets were created before this
 correction. Their private backup is `/home/neste/yuvomi-signing/initial-20261021`.

docs/login-troubleshooting.md

@@ -16,6 +16,11 @@ AndroidKeyStore encryption and absolute expiry remain unchanged. The native clie
 does not depend on weakening the server or changing its configuration. For browser
 security, server operators should still use `SESSION_SECURE=true` on HTTPS sites.
 
+[Download the fixed 0.2.1 preview APK ZIP](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk)
+(verified Gitea build job 1071; repository access required, 14-day retention).
+Extract `app-debug.apk` and install it. The downloaded artifact's version and
+signature were checked and installation/launch tested on the authorized emulator.
+
 ## Error distinctions
 
 - Rejected username/password: the server rejected `/auth/login` with HTTP 401.

docs/validation.md

@@ -27,8 +27,21 @@ and session-only cookie persistence remain disallowed.
   error, native dashboard/recreation, task/note/shopping calls and logout.
 - 13 JVM tests passed, including default-cookie persistence/deletion, expired/empty
   session detection and separate credential/2FA/session-handoff error messages.
+- Both lint variants, debug/unsigned release APK/AAB builds and the 6-test ordinary
+  native UI suite passed. Its first attempt hit a leftover CI-debug certificate
+  mismatch and produced zero tests; the verifier correctly rejected it. After
+  confirming the fixture package was absent, the rerun executed all 6 with no
+  failures/skips (`/home/neste/yuvomi-login-debug-retry.log`).
 - Logs: `/home/neste/yuvomi-login-cookie-after.log`,
-  `/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`.
+  `/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`,
+  `/home/neste/yuvomi-login-validation.log`.
+- Gitea run #11/global 666, build job 1071 at `4b483c2`: packages, JVM/lint,
+  repository/script/format checks, OSV and artifact uploads all succeeded.
+- [Download fixed Android 0.2.1/code 3](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk).
+  The ZIP was downloaded and its sole APK version/v2 signature checked; it was
+  installed and launched on the authorized local emulator. APK SHA-256:
+  `a769118f0bd16988f76a8ee95c0aa0c5e248104e8ea529eee2e0c83d78b6ca5a`.
+  This does not certify the still-blocked remote emulator matrix or Apple pipeline.
 
 See [login troubleshooting](login-troubleshooting.md). This reproduces a matching
 compatibility defect without accessing the user's server or credentials; it does