# Changelog

## [Unreleased]

### Android 0.2.2 native preview (code 4)

- Replace the initial Material-style slice with native PWA-derived typography,
  light/dark colors, module icons/seals, compact cards, list rows, capsule
  navigation and bottom-sheet editors. Remove the duplicate overview heading.
- Read personal dashboard/favorite preferences, select the first shopping list,
  and save supported widget visibility without deleting unsupported config.
- Add real-PWA reference capture and a native ten-view light/dark screenshot
  gallery with measured content viewport; browser automation is tooling only.
- Preserve the confirmed HTTPS login/session fix. This is an Android design pass,
  **not accepted 1:1 parity**; iOS and remaining modules are unchanged/incomplete.

### Android 0.2.1 native preview (code 3)

- Fix login against upstream-default session cookies without `Secure`: Android
  now retains them in its origin-bound HTTPS-only jar instead of losing the
  authenticated session. HTTP, cross-origin redirects and invalid TLS remain denied.
- Distinguish credential/code rejection from a missing/rejected native session;
  clear a previous login error after a successful retry.
- Exercise both upstream cookie configurations over real HTTPS, including a wrong
  password followed by a successful native login. See `docs/login-troubleshooting.md`.

### Initial native preview

- Begin the genuine native rebuild: Compose/SwiftUI screens, direct HTTPS API,
  protected native session storage and initial auth/dashboard/task/note/shopping
  flows. Archive the rejected WebView renderer and its tests. Full PWA parity is
  explicitly incomplete; see `docs/native-parity.md`.

- Gitea workflows for the maintainer's Ubuntu pool and native M4 Pro runner,
  explicit SDK/KVM prerequisites, SHA-256 checkout and unsigned-only CI release builds.

### Archived browser prototype (not shipped)

- Native Android HTTPS onboarding, origin-bound browsing, session persistence,
  recovery, server erasure, camera/document selection, downloads and blob exports.
- SwiftUI/WKWebView iOS implementation, isolated web sign-in, native settings,
  recovery, file export, and strict URL/metadata policies; Xcode validation pending.
- JVM, Android emulator, portable Swift, and real pinned-upstream HTTPS tests.
- Reproducible build configuration, CI and maintainer-controlled release procedures.
- MIT licensing, upstream audit, security model and release documentation.

No stable release has been published. No native push or browser-to-app session
handoff is claimed. See validation records for what has actually been executed.