docs: record current sandbox verification limits

docs/BLOCKERS.md

@@ -10,6 +10,8 @@ Required unblock evidence: run the required preflight and focused Android tests
 
 The `v0.1.0-beta.1` Android package metadata and direct-gateway build/install guide are present in source. On 2026-07-24, Task 5 source-current re-verification passed the external recovery preflight and documented offline Gradle `:app:testDebugUnitTest :app:assembleDebug` command (43 tasks, 1 executed); the generated Gradle XML report records 106 tests with 0 failures/errors, including 29 `SetupWizardReducerTest` cases. A localhost gateway health probe returned HTTP 200, establishing reachability only. The debug APK reports package `cloud.molberg.hermesmobile`, version `0.1.0-beta.1` (`10001`), and SHA-256 `45e4ab4783a74eb766070b0f670a2631a9ebdc044468bbe03087788f8106f150`. No ADB device/emulator or `/dev/kvm` was available, so installation verification cannot be completed in the current sandbox.
 
+A later Task 5 rerun on 2026-07-24 was blocked before project execution: the guide's exact Gradle command could not determine a usable wildcard IP, and the offline/no-daemon variant could not open Gradle's daemon TCP socket (`java.net.SocketException: Operation not permitted`). Both attempts left the existing ignored APK unchanged. The source-current generated XML reports still record 106 tests with 0 failures/errors, including 29 `SetupWizardReducerTest` cases, while fresh `aapt` and SHA-256 inspection reconfirmed the package/version/hash above. ADB 37.0.0 was present at `/opt/android-sdk/platform-tools/adb` but could not create its smart-socket/netlink sockets; `/dev/kvm` and `/dev/bus/usb` were absent. This rerun provides no fresh Gradle test/assembly, device, authentication, release, or end-to-end evidence.
+
 The first-run Setup Wizard is also source-complete and unit/build verified, including None/Bearer/password choices and direct password-session cookie handling. No real None/Bearer/password credential flow has been exercised against a live gateway, so R2 must include the chosen authentication mode and observed connection result without recording credentials.
 
 ADB is installed, but the R1 evidence above confirms that its daemon sockets are prohibited and that no emulator executable, AVD, `/dev/kvm`, USB device bus, or running target is available. Package metadata and the SHA-256 of the existing ignored source-current APK were inspected, but no fresh assembly, clean uninstall/install, launch, or direct-gateway device connection was verified here. No APK was published or uploaded, and no final release criterion is claimed.

docs/ROADMAP.md

@@ -11,6 +11,7 @@
 - Compose semantics, minimum touch targets, adaptive layout behavior, and phone/tablet/light/dark previews cover the wizard source contract.
 - Existing source-current Gradle output records 106 unit tests with 0 failures/errors and a debug APK assembled after the latest Android source change. No real device, release, or real gateway credential walkthrough has been performed; those remain part of R1/R2 evidence.
 - Task 5 source-current re-verification on 2026-07-24 passed the external recovery preflight and documented offline Gradle test/assembly command (43 tasks, 1 executed); the generated Gradle XML report records 106 passing tests with 0 failures/errors, including 29 `SetupWizardReducerTest` cases. A localhost gateway health probe returned HTTP 200, establishing reachability only. The debug APK is package `cloud.molberg.hermesmobile`, version `0.1.0-beta.1` (`10001`), SHA-256 `45e4ab4783a74eb766070b0f670a2631a9ebdc044468bbe03087788f8106f150`; `git diff --check` passed. No ADB device/emulator or `/dev/kvm` was available; no device installation, real authentication, release, or end-to-end gateway verification was performed.
+- A later Task 5 rerun in the current sandbox on 2026-07-24 did not supersede that passing output: the guide's exact Gradle command failed before project execution because no usable wildcard IP was available, and the offline/no-daemon variant failed because Gradle could not open its daemon TCP socket. The existing XML reports and ignored APK remained unchanged; metadata/hash inspection still matched the values above. ADB 37.0.0 could not start its daemon, and `/dev/kvm` plus `/dev/bus/usb` were absent. This rerun adds no fresh test, assembly, device, authentication, release, or end-to-end evidence.
 
 Status: in progress. Android foundation work is complete, and the beta path now targets a remote upstream Hermes Agent gateway/API server directly. The legacy `apps/companion` server is compatibility-only and not required for future Android releases.