M7: polish + E2E + docs (layout pass, theming, states, e2e driver, schema, setup.md, security)

docs/14-milestones.md

@@ -179,18 +179,46 @@ has explicit **acceptance criteria**. Work top-to-bottom; don't skip M0/M1.
 
 ## M7 — Polish + E2E + docs
 **Goal:** ship-quality.
-- [ ] Telegram-style layout pass (per reference image): header, bubbles, date
+- [x] Telegram-style layout pass (per reference image): header, bubbles, date
       separators, ✓✓, model/token footer, banner, bottom bar.
-- [ ] Theming (dark default, accent), onboarding/pairing UX, empty/loading/
+- [x] Theming (dark default, accent), onboarding/pairing UX, empty/loading/
       reconnecting/degraded states with honest copy.
-- [ ] Full E2E suite (`13-testing.md` scenarios 1–12) automated where possible.
-- [ ] Docs: `docs/protocol/frames.schema.json` finalized; `docs/setup.md`
+- [x] Full E2E suite (`13-testing.md` scenarios 1–12) automated where possible.
+- [x] Docs: `docs/protocol/frames.schema.json` finalized; `docs/setup.md`
       (user-facing pairing + FCM/ntfy + remote access); root README.
-- [ ] Security hardening checklist (`09-pairing-security.md`) verified.
+- [x] Security hardening checklist (`09-pairing-security.md`) verified.
 - **Demo:** end-to-end on phone + desktop simultaneously; cron into a channel;
   push; media; search.
 - **Accept:** all feature-checklist items pass on-device; E2E green; docs
   complete; `hermes-agent/` still never committed.
+- **Status (2026-08-20):** Layout pass verified on-device (MIX 2S): header
+  with avatar + "Bot" subtitle + overflow menu (rename channel, forget
+  pairing), centered date-separator pill, bubbles with in-bubble timestamps,
+  user ✓/✓✓ driven by the new `read.receipt` frame (gateway emits it when the
+  agent takes the message; late-joining clients also get the current `status`
+  state on hello.ack), model/token footer, letter-avatar channel rail/drawer
+  with active highlight, restyled bottom bar. Theming centralized in
+  `ui/theme/Theme.kt` (dark default, single accent; all hard-coded colors
+  replaced). States: dedicated connecting screen, reconnecting +
+  degraded/restarting banners (new `status` frame), send-failure rollback
+  with tap-to-retry. E2E: `tests/e2e.py` driver automates scenarios 1–12
+  against the live gateway — 9 PASS / 2 PARTIAL (push device-notification
+  leg + gateway-kill leg are manual) / 1 SKIP (commentary is
+  model-dependent) / 0 FAIL; `ws_probe.py` gained `--assert-turn/
+  reasoning/tools/commentary/read-receipt/status` plus `--search`,
+  `--channel-*`, `--watch` modes. Docs: `frames.schema.json` finalized
+  (mirrors code exactly; 17 unimplemented frames moved to
+  `x-planned-frames`; 6 deltas + 3 drift fixes), `docs/setup.md` added
+  (pairing + FCM/ntfy + remote access + troubleshooting), root README
+  quickstart + status updated. Security: inbound JSON-frame rate limit
+  (20/s, burst 40, binary upload chunks exempt) with `rate_limited` error +
+  close; Android token moved to EncryptedSharedPreferences with one-time
+  plain→encrypted migration; `.pre-commit-config.yaml` commits the
+  hermes-agent guard; `09-pairing-security.md` M7 verification table (5
+  items verified, 3 documented gaps: in-app QR scan, WSS cert pinning,
+  mechanical log redaction). Known: commentary scenario is model-dependent
+  (SKIP); FCM path needs a Firebase project to exercise; M6's formal
+  desktop parity pass + macOS/Windows packaging remain open.
 
 ---