docs(android): record what the device run proved and what is still open

The correction section written earlier today said A34/A35 had no code and
device QA was ~0%. Both were true when written and are not any more, so they
are marked resolved rather than left to mislead the next reader — with the
instrumented invocation recorded (the emulator needs
ALLOWED_ORIGINS=http://10.0.2.2:<port>, because allowed origins are derived
from NIC IPs and 10.0.2.2 is not one).

What stays open is stated plainly: S2 needs two physical handsets under Doze,
the rest of DEVICE_QA_CHECKLIST has no automated cover, and one instrumented
test kills the process when driven without host arguments on a heavily-recycled
emulator while passing reproducibly under the documented invocation — which is
recorded as unresolved rather than explained away.

android/PROGRESS_ANDROID.md

@@ -437,12 +437,31 @@ with Tink AEAD under an AndroidKeyStore key, **fail-closed** (a seal failure per
 than falling back to plaintext), and `allowBackup=false` keeps a 30-day shell credential out of Google
 Drive and D2D transfer.
 
-**Still not done — do not read the section below as saying otherwise:**
-  - **A34 / A35 have no code.** There is no `:app` androidTest source set and no benchmark module; the
-    AW6 entry marking them `[x]` reflects them being converted into checklist bullets, not implemented.
-  - **Device QA remains ~0%.** One emulator smoke screenshot of the pairing screen is the only on-device
-    evidence in the repo. Every fix above is JVM-verified only.
-  - Release signing, versioning and minification; the S2 FCM real-handset spike; copy-out via selection.
+**RESOLVED LATER THE SAME DAY** (this list was accurate when written; it is not any more):
+  - **A34 / A35 now exist and RUN.** `:app/src/androidTest/**` holds 67 instrumented tests — the four
+    crash regressions, the A34 E2E set (attach→output, ring-buffer replay, spawn failure via a second
+    deliberately-broken server, a gate resolved through `POST /hook/decision`, and the F9 bad-Origin
+    rejection), and the Compose UI tests plan §7 named — plus `macrobenchmark/` for A35. All 67 execute
+    green on `emulator-5554` against this repo's own server. Reaching the host needs
+    `ALLOWED_ORIGINS=http://10.0.2.2:<port>` (the server derives allowed origins from NIC IPs, and
+    10.0.2.2 is the emulator's alias for the host, not an interface address).
+  - **Device QA is no longer ~0%.** The blocker fixes are device-verified, not just JVM-verified.
+  - Release signing, versioning and minification are done: `assembleRelease` runs R8 and now REFUSES to
+    emit an unsigned artifact instead of quietly producing one.
+  - **Copy-out is done** — a first-party selection layer over `TerminalBuffer.getSelectedText` +
+    `ClipboardManager`, since the stock ActionMode's Copy handler dereferences the absent session.
+  - The six audit leftovers are closed too: silent certificate rotation (+ `/device/:id/recover`), the W2
+    inject-queue routes, unread-watermark persistence, host-removal UI, and `/config/ui` finally honoured
+    (fail-closed).
+
+**Still genuinely open:**
+  - **S2** — the FCM real-handset delivery spike. Needs ≥2 physical devices under Doze/OEM battery
+    managers; an emulator cannot answer it.
+  - One instrumented test (`wheelInsideTheAlternateBuffer_emitsThreeArrowsPerNotch`) was seen to kill the
+    test process when the suite was driven WITHOUT the host arguments on a heavily-recycled emulator. It
+    passes reproducibly under the documented invocation on a clean install. Re-check on real hardware
+    before trusting it either way.
+  - Everything else device-observable in `DEVICE_QA_CHECKLIST.md` that no automated test covers.
 
 ---