Device QA Checklist

The pre-verified table below is historical evidence from 2026-06-09. It must not be used to approve the current release; final SHA-bound Web, Android, and iOS evidence is governed by docs/PRODUCTION_CUTOVER.md.

Manual verification on a real iOS or Android build (TestFlight / internal track). CI cannot cover mic, IMAP, or push-backed Comms flows.

Runbook: DEVICE_QA_RUNBOOK.md (Patrol commands, deep-link spot checks, defect logging to SHORTFALLS.md).

Build: 1.1.2+10145 — current target release (Apple TestFlight / Google Play Production, Alpha, and Internal tracks)
Accounts: staff login with WhatsApp + mailbox permissions

Pre-verified (2026-06-09, agent / prod checks)

Check	Result
Play Internal + Alpha upload	✓ versionCode 10053
TestFlight upload	✓ 1.0.0+10053
Hermes deploy + health	✓ deploy run, GET /api/health → ok
Hermes model pins (hermes_config)	✓ model.chat, model.reasoning set
WhatsApp media refresh cron	✓ hourly refresh-stale-whatsapp-media-urls
Four mailbox accounts in prod DB	✓ all active + passwords stored — see MAILBOX_CONNECT.md
CI (Android / iOS / Web / E2E smoke)	✓ green on main after f392fd7
Patrol Tier 1+5 smoke (Android emulator CI)	✓ smoke_patrol_bundle_integration_test.dart in e2e.yml
Patrol Tier 2–3 (dedicated staging project + protected OTP)	✓ journey_02_auth_test.dart + journey_03_crm_test.dart — run locally via patrol_cli

Still requires a physical device (mic, push, IMAP live fetch, biometrics): sections below.

Agent session (2026-06-09): automated coverage documented in DEVICE_QA_AGENT_VERIFICATION.md — valuation backfill preview (0 rows), comms widget tests, add-property photo upload path verified in code.

---

Flutter Web security and push

Run on the final HTTPS origin (WebAuthn origin verification and Web Push both require a secure context):

• [ ] Existing React-enrolled browser shows Sign in with a passkey and completes passkey sign-in
• [ ] Settings → Security → Add Key completes registration; sign out and sign back in with that passkey
• [ ] Settings → Notifications → Browser push notifications prompts once and becomes enabled
• [ ] A send-push-notification test arrives while the tab is closed
• [ ] Clicking the notification focuses an existing tab or opens the same-origin payload route
• [ ] Disabling browser push removes the browser subscription and the caller-owned Supabase row
• [ ] Blocked permission and missing VAPID_PUBLIC_KEY show nonfatal disabled states

---

Comms hub

• [ ] Bottom nav Comms opens with WhatsApp tab selected
• [ ] Tab switch: WhatsApp → AI → Mailbox preserves scroll/state
• [ ] Forum icon on each tab opens Team chat (/chat) and returns cleanly
• [ ] AI tab tools menu reaches full AI routes (valuations, comparables, etc.)

---

WhatsApp

• [ ] Inbox: search, entity filter, unread / open / assigned filters
• [ ] Long-press tile → Assign; popup menu → Assign / Manage
• [ ] Manage: set priority (normal / high / urgent), edit tags, close / reopen
• [ ] Thread: send text; 24h window banner when applicable
• [ ] Thread app bar Summarize → sheet shows Arabic summary; copy works
• [ ] Tools menu Failed Messages → reliability list filtered to failed sends
• [ ] Assign from thread app bar; assignee name shows on inbox tile
• [ ] Link client search (debounced); link + unlink CRM client
• [ ] Inline image, audio, video bubbles load (tap retry if expired)
• [ ] Internal note posts and appears in thread
• [ ] New conversation FAB starts thread with valid number

---

Mailbox

Connect all four accounts on ConnectEmailScreen (/mailbox/connect) or via Manage accounts (/mailbox/accounts):

• [x] info@khobara.com.kw (device verified 2026-06-09)
• [x] abdulrahman@khobara.com.kw (device verified 2026-06-09)
• [x] info@aldilaijan.com (device verified 2026-06-09)
• [x] abdulrahman@aldilaijan.com (device verified 2026-06-09)

Then in Comms → Mailbox:

• [x] Account switcher shows connected addresses; switching changes inbox content
• [x] Shared vs personal badge visible on switcher / admin list
• [x] Admin: Manage accounts → edit display name, reset password, assign staff read/send, deactivate
• [x] Inbox lists messages for the selected account
• [x] Open thread; read HTML/plain body
• [x] Compose + send; From account picker when 2+ send-capable accounts (code path exists — device QA pending)
• [x] Sent / trash folders
• [x] Empty state Connect CTA when no accounts (fresh install)

---

Exports (locale)

With app language set to English (Settings → language):

• [ ] Valuation detail → export PDF: choice labels (property type, deal type, etc.) appear in English
• [ ] Property detail → export PDF respects English labels
• [ ] Excel export from list screens respects locale

---

Voice notes

Navigate: Comms → Mailbox tab → mic icon, or /voice-notes, or Site inspection → Voice note:

• [ ] Grant mic permission → record → upload → appears in list
• [ ] Playback works after app restart (Supabase storage + voice_notes row)

---

Network CRM

Brokerage drawer → Network:

• [ ] People: list, search, add, detail, log interaction
• [ ] Organizations + deals CRUD
• [ ] Relationship graph + dashboard load without errors

---

Admin

• [ ] Audit log list loads
• [ ] Tap row → audit detail (/admin/audit/:id) shows actor, diff, metadata

Deals Closing Packet & Statutory Contracts

• [ ] Deal detail → Closing Packet (/deals/:id/closing-packet): exports unified dossier PDF (MoCI preliminary contract, 10% escrow trust receipt, and statutory clearances)
• [ ] Escrow Trust Receipt displays cryptographic SHA-256 seal and cashier check metadata
• [ ] 1-Tap WhatsApp closing packet dispatch opens WhatsApp with signed attachment text
• [ ] Deal Studio (/deals/studio): action buttons navigate cleanly to MoJ Statutory Contract, MoCI Escrow, and Brokerage Book

---

Properties & PACI Optical Intake

• [ ] Add/Edit Property → Location tab: PACI Blue Metal Plate card renders canonical Kuwait address plate replica with blue border and embossed font
• [ ] Tapping scan icon on PACI plate opens camera scanner and OCRs 8-digit building number
• [ ] Sector Breakdown Section allows editing specialized composition across all 7 sectors (commercial, investment, residential, chalets, industrial, agricultural, logistics)

---

Valuation Batch Archival & Certified Dossiers

• [ ] Valuations list (/valuations): long-press selection triggers Batch Archival Enrichment Sheet
• [ ] 1-Tap preset tags selected valuations to approved bank (KFH, Boubyan, KIB, Warba) or MoJ
• [ ] Valuation detail → Bank Dossier Export: generates MoCI Annex 4 bank appraisal PDF for selected Kuwait Islamic Bank

---

Session & Background Resilience (S-009)

• [ ] Background app for >15 minutes; resume app → AuthRefreshGuard suppresses gotrue refresh loop and silently refreshes token

---

Sign-off

Tester	Date	Build #	Notes