diff --git a/plans/todo.md b/plans/todo.md
index 53d548a..1e7414f 100644
--- a/plans/todo.md
+++ b/plans/todo.md
@@ -1,11 +1,91 @@
 # Next-session TODO
 
-Hand-off list as of 2026-05-10. Deploy target is GitHub Pages
-(`/loto/` base). All prior plan folders + their reports have been
-swept after shipping; residual / new items live here directly.
+Hand-off list as of 2026-08-19. Covers both `web/` (SvelteKit PWA,
+deployed to GitHub Pages at the `/loto/` base) and `android/` (Capacitor
+wrapper). Shipped plan folders are swept after release; residual and new
+items live here directly.
 
 ## Highest leverage (start here)
 
+### Android device QA (blocked: no device or emulator)
+
+Carried from the shipped Android experience pass. The native code is
+merged and statically reviewed, but every item below is device-only —
+this environment is headless ARM64 with no emulator and no Android SDK.
+
+- [ ] Tap a cell → vibrates; enable reduced-motion → silent.
+- [ ] Auto-call 3+ min untouched → screen stays lit. Stop → sleeps normally.
+- [ ] Background during auto-call, return → still lit.
+- [ ] Finish a round (remaining 0) → lock releases.
+- [ ] Back with bingo modal open → modal closes, app stays.
+- [ ] Back with settings open → sheet closes.
+- [ ] Back at root → Vietnamese exit dialog; "Ở lại" keeps state.
+- [ ] System font 200% → grid intact; Settings → Cỡ chữ bảng resizes;
+      survives reload.
+- [ ] Gesture nav + status bar clear of the settings gear and footer.
+- [ ] Volume rocker during a call → media slider.
+- [ ] Launcher shows `Lô tô` with the brand icon; themed-icon mode tints it.
+- [ ] Cold start in dark mode → dark splash, no white flash.
+
+Two assumptions the checklist doubles as a test for: the WebView has no
+history at rest (SvelteKit hydrates with `replaceState`), so back at root
+should exit rather than navigate; and `OnBackPressedCallback` / `Bridge`
+resolve transitively through `appcompat` / `capacitor-android` — never
+compiled here, so a build failure would show up first.
+
+### Android wrapper — open items
+
+Merged from `android/plans/todo.md` on 2026-08-19. Items that the Android
+experience pass already shipped (haptics, back button, safe-area insets,
+launcher icon, splash + night variant) were dropped rather than carried;
+verified present in `MainActivity.java`, `web/src/app.css`, and
+`android/android/app/src/main/res/`.
+
+- [ ] Sideload onto real devices (API 24, 31, 36) and BlueStacks. Overlaps
+      the device QA list above — do both in one sitting.
+- [ ] Cold start: app loads `https://localhost/`, no white flash > 1s.
+- [ ] Offline: airplane mode, kill app, relaunch — must work.
+- [ ] Audio: tap a number → Vietnamese voice plays; both voices switch
+      correctly (`hoai-my` ↔ `nam-minh`).
+- [ ] First-launch SW registration: confirm Workbox precaches the bundled
+      audio without errors (should be idempotent — assets already on disk).
+- [ ] Audio focus: the WebView `<audio>` never claims `AUDIOFOCUS_GAIN`.
+      Test an incoming call mid-round — does playback duck or pause?
+      Explicitly out of scope for the experience pass; still unanswered.
+- [ ] Confirm `android:supportsRtl="true"` (Capacitor default) does not
+      flip the Vietnamese UI.
+- [ ] Store listing assets: feature graphic 1024×500, 2–8 phone
+      screenshots, short (≤80) and full (≤4000) descriptions.
+
+**versionCode footgun (unresolved).** Every release must increment
+`versionCode` in `android/android/app/build.gradle` — currently 4, at
+versionName 0.1.0 — before tagging, or Play rejects the upload. Still
+manual discipline. Options never decided: a pre-tag CI check that fails
+on an unbumped code, or deriving it from the git tag.
+
+### Play production access (clock running)
+
+12 testers collected as of 2026-08-19 — the closed-test minimum is met.
+Now the 14-day continuous window has to hold: if opt-ins drop below 12 at
+any point the window resets, so keep spares on hand. Log tester feedback
+and which features they exercised while the test runs — the production
+application asks for both, and Play has been rejecting thin engagement
+since April 2026.
+
+Blocker to resolve first: CI uploads to the **internal** track, which does
+not count toward the requirement. Builds must reach the **closed** track —
+promote each release in the Console, or repoint `tracks:` in
+`.github/workflows/android-release.yml`. See
+`docs/play-store-publishing.md` → "Closed testing → production access".
+
+### Clipped web PWA icons
+
+`web/static/icons/*.png` are visibly clipped. Root cause is
+`font-size="240"` in `source.svg`, which overflows the 512 canvas. The
+Android art was regenerated at a corrected 200/160, but the web icons
+still carry the bug — it was out of scope for that pass. Fixing it
+changes the GitHub Pages / PWA / OG card images.
+
 ### PWA install verification (manual, post-deploy)
 
 Needs production deploy on GitHub Pages + physical Android Chrome +
@@ -41,6 +121,30 @@ iOS Safari. No code; verification only.
 - iOS install shows wrong icon → ensure `icons/icon-192.png` is
   192×192 actual size.
 
+## Supply chain
+
+- [ ] `npm audit` both `web/` and `android/`. The old note about auditing
+      "the loto submodule" is obsolete — `web/` is a plain directory in
+      this monorepo, there is no submodule.
+- [ ] Consider Dependabot or Renovate for both `package.json` files.
+
+## Parked (Android)
+
+- `@capacitor/share` for sharing the called-numbers card.
+- Background audio (play numbers while the screen is off). WebView audio
+  is foreground-only; needs a native plugin or service shim.
+- iOS target (`npx cap add ios`) — same wrapper, near-zero extra code.
+
+## Decisions record (Android)
+
+- **Capacitor 8 wrapper, not TWA** — chosen for the first-launch offline
+  guarantee; a TWA needs network for the first PWA fetch.
+- **No INTERNET permission** — makes "fully offline" a hard guarantee.
+  Would have to come back if any remote feature is introduced.
+- **Native Kotlin/Compose port retired** (2026-05-10) in favour of the
+  wrapper, for maintenance parity. The ExoPlayer + Compose UI lives at
+  commits `fe52232` / `9a35686` if it is ever wanted back.
+
 ## UX polish (carried over)
 
 - **`MasterEmptyState` ↔ PlayerBoard ghost-grid duplication.** Two
@@ -50,10 +154,14 @@ iOS Safari. No code; verification only.
 
 ## Tech debt
 
-- **`cookie` and `serialize-javascript` overrides are temporary.**
-  Remove the `overrides` block in `package.json` once
-  `@sveltejs/kit` and `workbox-build` ship releases that pull
-  `cookie >= 0.7.0` and `serialize-javascript >= 7.0.5` upstream.
+- **`web/package.json` overrides — re-checked 2026-08-19.**
+  `cookie` is still doing work: `@sveltejs/kit` declares `^0.6.0`, and
+  the override is what forces 0.7.2. `serialize-javascript` is now
+  marginal — the consumer is `@rollup/plugin-terser` at `^7.0.3` (not
+  `workbox-build`, as this note used to claim), so the pin only holds
+  the floor above 7.0.4. `ws` is redundant: `happy-dom` already
+  declares `^8.21.0`, above the `^8.20.1` pin. Drop `ws` first if
+  trimming; keep `cookie` until Kit moves.
 - **Voice list growth.** If we add voices > 2 (esp. > 10), revisit
   the precache strategy — currently we precache only the default
   voice. The 7d runtime cache covers the rest, but cold-start cost
@@ -69,3 +177,13 @@ iOS Safari. No code; verification only.
 - "New version available" reload toast for SW autoUpdate. Today the
   swap is silent; if users complain about content jumping mid-game,
   add a non-blocking notice.
+
+## Open questions (carried from the Android pass)
+
+- `boardTextScale` rungs are 0.9 / 1 / 1.15 / 1.3. Enough range for
+  users who already run system font at 200%?
+- The exit confirm fires at root regardless of round state. Worth
+  plumbing "is a round live" to native so an idle app just exits?
+- `textZoom` is pinned as an accessibility override. It is only
+  defensible alongside the in-app size control — if that setting is
+  ever cut, cut the pin too.