docs: record wave 4 acceptance and what it left undone

Wave 4 is verified complete. Also records the two mechanisms that stopped F3
from reporting (the 600s background-task ceiling in `claude -p`, then the quota
wait) so the next worker launch does not repeat it, and flags the one thing
wave 4 owed and never delivered: nobody has looked at the fourteen new
screenshots.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014TyzeWmdTqi7U85iYNGy7P

docs/HANDOFF.md

@@ -230,3 +230,58 @@ Commit `a022a1b` (32 files, +3081).
 3. No Room foreign keys between books/shelves/bookcases (deliberate, worker C).
 4. No emulator on this box: nothing has ever been *run*, only compiled and unit-tested.
    Paparazzi PNGs are the only evidence of how any of it actually looks.
+
+## Wave 4 — COMPLETE, verified by the orchestrator on 2026-09-08
+This is the last planned wave. All of SPEC's build/verify gates now pass.
+
+| Check | Result |
+|---|---|
+| `./tasks/gw assembleDebug` | **exit 0** |
+| `./tasks/gw testDebugUnitTest` | **exit 0 — 102 tests, 1 skipped, 0 failures, 0 errors** |
+| `./tasks/gw assembleRelease` | **exit 0** |
+| signed APK | `app/app/build/outputs/apk/release/app-release.apk`, 41,777,344 bytes |
+| `apksigner verify --print-certs` | V2 signer `CN=Bookshelf, O=Montanaro` — the real release key, not the debug cert |
+| secrets | `app/release-keystore.jks` + `app/keystore.properties` gitignored and NOT committed — re-verified against the staged file list before committing |
+
+The skipped test is `LiveSyncTest` — opt-in, it needs the live PocketBase. It
+PASSED in wave 4's first half; the cover round-trip gap from wave 3 is closed.
+
+Commits `5455df2` (app work) + `0f47ee9` (orchestration). Pushed to `origin/main`
+(`ssh://git@git.jfmonty2.com:2022/jfmonty2/bookshelf.git`) — the repo now has a
+remote, so pushing after each commit is the norm.
+
+### How wave 4 actually ended — F3 never reported
+F3-release wrote all four deliverables between 20:34 and 20:46 on 09-08 and then
+could not finish. Two separate mechanisms:
+- `claude -p` terminates background tasks after 600s (`Background tasks still
+  running after 600s; terminating. Set CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 to
+  wait indefinitely.`). F3 had launched `assembleRelease` in the background with a
+  Monitor and ended its turn saying it would report when done — the exact failure
+  its own prompt forbade.
+- It then hit the 5h quota and went into a 600s wait loop, so the service
+  supervisor would have kept re-running verification on finished work indefinitely.
+
+The orchestrator ran the verification itself, wrote `logs/WAVE4-DONE` by hand
+(noting it was NOT written by `service-worker.sh`), and stopped the service.
+**If you launch another worker, set `CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0` in
+`run-task.sh`, or tell the worker to run builds in the FOREGROUND.** A worker that
+backgrounds a 10-minute Gradle build cannot ever report on it.
+
+### The one thing wave 4 owed and did not deliver
+F3 was asked to say candidly what the rendered screens get WRONG against SPEC's
+design language, now that they can finally be seen. It never reported. **Fourteen
+new PNGs are on disk, unreviewed by anyone.** The user explicitly cares how this
+looks, so this is the top open item — not a build problem, a design-review one:
+`app/app/src/test/snapshots/images/` (setup, detail, scan ×2, locations, settings,
+library, scaffold — each light + dark).
+
+## STATE: what is NOT done (as of 2026-09-08)
+1. **Nobody has looked at the screenshots.** See above. Highest-value next step.
+2. **The app has still never run on a device or emulator** (no KVM on this box).
+   Everything is compile + unit-test + Paparazzi evidence only. Installing the
+   signed APK on a real phone is the only way past this, and it needs the user.
+3. **R8 is off.** Acceptable per F3's prompt, but the release APK is 41.8MB.
+   Turning it on requires proving Room/Retrofit/kotlinx-serialization/ML Kit
+   survive minification.
+4. Still-open user questions, unchanged: where the server will actually live, and
+   the two account emails for `create-user.sh`.