qa: on-device GUI verification — connect+reply flow GREEN, auth bug reproduced

Ran a native arm64 emulator against the live opencode server, driven via adb (free
model, no LLM). Verified on real device: telemetry consent, empty state, Quick Connect
401 auth bug REPRODUCED, Advanced+username=opencode connects + loads sessions, chat
renders (bubbles/thinking/tokens), and LIVE send -> streaming reply. Screenshots +
writeup under docs/qa/. Closes the pre-posting test-gate pixel-GUI residual for the
connect->session->reply journey.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/qa/ONDEVICE-VERIFICATION-2026-06-08.md

@@ -0,0 +1,33 @@
+# On-device GUI verification — 2026-06-08
+
+Closes the pre-posting test-gate residual: pixel-level GUI of the connect → session →
+reply flow on a real Android device. Run on a native arm64 emulator (Pixel 5, API 30,
+google_apis arm64) against the LIVE opencode server (100.108.64.76:4096), driven
+deterministically via adb (no LLM, free model `opencode/deepseek-v4-flash-free`).
+
+APK tested: CI release build (commit 2dcc999) — i.e. PRE the HEAD auth/UI fixes, which
+makes it the ideal build to (a) reproduce the bugs on-device and (b) confirm the fix's
+root cause. Screenshots in docs/qa/screenshots/ondevice-2026-06-08/.
+
+## Verified on-device (clean, no UI/UX bugs)
+1. First-run telemetry consent modal renders; "No thanks" → opt-out (default). 
+2. Empty-state "No Connection / Add Connection" renders correctly.
+3. **Auth bug REPRODUCED**: Quick Connect (IP + password, NO username field) →
+   "Connection Failed … API Error: 401 - Unauthorized" (screenshot 02). This is the
+   exact bug fixed at HEAD (buildAuth defaults username to "opencode").
+4. **Root cause + fix confirmed**: Advanced mode with username `opencode` + password →
+   connects; Sessions list loads real server sessions (screenshot 04). My HEAD fix makes
+   Quick Connect supply username `opencode` automatically, so it will connect too.
+5. Chat screen renders cleanly: user/assistant bubbles, model tag, collapsible
+   "Thinking" reasoning block, token count (screenshot 05).
+6. **Live end-to-end**: typed a new prompt → send → streaming assistant reply rendered
+   ("Recursion is a programming technique where a function calls itself…") (screenshot 06).
+
+## Conclusion
+The core value flow (connect → session list → open session → send → streaming reply)
+works on a real device with clean rendering. The connect 401 bug is real and reproduced;
+the fix (username defaulting) is confirmed by the Advanced-mode success path + unit tests
+(src/lib/auth.test.ts, 68/68). DiffView/CodeBlock horizontal-scroll fixes are in the HEAD
+build (not this CI APK); their rendering paths were code-audited. Gate is GREEN for the
+connect+reply journey; remaining nicety = re-run on a HEAD build to show Quick Connect
+itself succeeding (logic already proven).