Record hosted mobile proof cleanup

docs/release-control/v6/internal/records/cloud-hosted-tier-runtime-readiness-storage-guardrails-production-2026-04-24.md

@@ -335,6 +335,56 @@ summary_skip=0
 summary_total=4
 ```
 
+## 2026-04-26 Hosted Mobile Proof Cleanup
+
+Later on 2026-04-26, a disposable hosted Android mobile instance-switching
+proof account and two proof tenants were created on the live production control
+plane so the Android candidate could be tested against real Pulse Cloud
+workspaces:
+
+- Account: `a_FMEHPC44FJ`
+- Primary tenant: `t-X4KX4WM1ZT`
+- Secondary tenant: `t-G18JTM0W30`
+
+The Android proof could not complete because the physical phone's wireless ADB
+transport dropped and the newly advertised wireless-debugging port refused
+connection. Before stopping the slice, the disposable hosted state was cleaned
+from production rather than leaving stale proof residue behind.
+
+The two workspaces were first deleted through the temporary
+`mobile-proof delete-workspace` helper inside the live control-plane container,
+which moved both tenants from `active` to `deleted`. A live SQLite backup and
+server-side tenant-directory archive were then taken before removing only the
+exact proof-marked account, tenant, and hosted entitlement rows:
+
+- Backup:
+  `/root/tenants-pre-ga-mobile-hosted-proof-cleanup-20260426T090206Z.db`
+- Archive:
+  `/data/tenants.archived-mobile-hosted-proof-cleanup-20260426T090206Z`
+
+Post-cleanup verification showed no rows remaining for the proof account,
+tenants, or hosted entitlements. The temporary mobile-proof helper binary was
+also removed from both `/root` on the host and `/usr/local/bin` inside the
+control-plane container.
+
+The live production audit returned to the clean current baseline:
+
+```text
+audit_ok=true
+tenant_total=4
+tenant_active=4
+tenant_deleted=0
+tenant_registry_unhealthy_active=0
+docker_managed_total=4
+docker_managed_running=4
+docker_managed_unhealthy=0
+storage_guardrails_enabled=true
+storage_ok=true
+proof_tenant_stale_count=0
+proof_account_stale_count=0
+hosted_paid_orphan_entitlement_count=0
+```
+
 ## Conclusion
 
 `cloud-hosted-tier-runtime-readiness` can be treated as `passed` for the current

docs/release-control/v6/internal/records/mobile-product-purpose-ga-blocker-2026-04-24.md

@@ -112,4 +112,25 @@ Results:
 
 This adds current Android supportability and repair-path evidence, but it does not clear the live pairing, reconnect, fail-closed revocation, push-routing, approval-action, instance-switching, or iOS physical-device proof requirements.
 
+Also on 2026-04-26, the Android hosted instance-switching proof harness was
+hardened in `pulse-mobile` commit `1b48ce6` after the first live run exposed
+two proof-script assumptions rather than an app crash:
+
+- `npm run release:proof:android:instance-switching` now has a package script.
+- The proof can run with `--reset-app-data` so fresh hosted pairing proof starts
+  from a clean app state on the physical phone.
+- The proof accepts the real Access summary state where one instance is active
+  and another is highlighted, instead of requiring two full instance cards to
+  be visible at the same scroll position.
+- Mobile script tests passed: 113 tests.
+
+The live hosted proof itself did not complete. The physical Android phone's
+previous ADB serial (`192.168.0.119:40467`) disappeared, and the newly
+advertised wireless-debugging endpoint (`192.168.0.119:45873`) refused
+connection after restarting the local ADB server. The disposable hosted proof
+account and tenants were deleted and cleaned from Pulse Cloud before stopping
+the attempt. This keeps the proof harness ready for the next reachable physical
+Android session, but it does not add live hosted pairing or instance-switching
+evidence for GA.
+
 The source and simulator-era product framing are coherent with the resolved companion role, but the release gate remains blocked. Passing this gate still requires fresh physical-device walkthrough/proof on the current candidate, including the native status, alerts, push/device trust, Relay-backed Open Pulse handoff, contextual recovery, and stale/revoked access behavior.