diff --git a/android/screenshots/01-login-2fa-trust-device.png b/android/screenshots/01-login-2fa-trust-device.png
new file mode 100644
index 0000000..567c435
Binary files /dev/null and b/android/screenshots/01-login-2fa-trust-device.png differ
diff --git a/android/screenshots/02-account-security-section.png b/android/screenshots/02-account-security-section.png
new file mode 100644
index 0000000..6ad0c6f
Binary files /dev/null and b/android/screenshots/02-account-security-section.png differ
diff --git a/android/screenshots/03-trusted-devices.png b/android/screenshots/03-trusted-devices.png
new file mode 100644
index 0000000..dac0ed8
Binary files /dev/null and b/android/screenshots/03-trusted-devices.png differ
diff --git a/android/screenshots/04-recovery-codes-show-once.png b/android/screenshots/04-recovery-codes-show-once.png
new file mode 100644
index 0000000..bb16a82
Binary files /dev/null and b/android/screenshots/04-recovery-codes-show-once.png differ
diff --git a/android/screenshots/05-recovery-code-login.png b/android/screenshots/05-recovery-code-login.png
new file mode 100644
index 0000000..8cb6ac0
Binary files /dev/null and b/android/screenshots/05-recovery-code-login.png differ
diff --git a/android/screenshots/README.md b/android/screenshots/README.md
new file mode 100644
index 0000000..d221aeb
--- /dev/null
+++ b/android/screenshots/README.md
@@ -0,0 +1,29 @@
+# Android app — trusted devices & recovery codes (live smoke test)
+
+Screenshots from a live end-to-end smoke test of the trusted-device + MFA feature on
+the Android client (app PR `RunicGateway/Android-app#23`), captured against the local
+Node server (`127.0.0.1:3000`) and a `uomysticmoon` MariaDB, on an API 36 emulator.
+See `../PLAN.md §4.1.1` for the design and `../../website/TRUSTED_DEVICES_MFA.md` for
+the canonical contract.
+
+| # | Screenshot | Shows |
+|---|---|---|
+| 1 | [`01-login-2fa-trust-device.png`](01-login-2fa-trust-device.png) | The `401 { totpRequired }` login step: the **authentication code** field, the **"Use a recovery code instead"** toggle, and the **"Trust this device (skip codes for 30 days)"** checkbox (ticked). |
+| 2 | [`02-account-security-section.png`](02-account-security-section.png) | The new **Security** section on the account screen linking to Trusted devices and Recovery codes. |
+| 3 | [`03-trusted-devices.png`](03-trusted-devices.png) | The **Trusted Devices** screen listing this device (`Google sdk_gphone64_x86_64` — the `device_name` sent at login) with revoke / trust-this-device / untrust-all. |
+| 4 | [`04-recovery-codes-show-once.png`](04-recovery-codes-show-once.png) | The **Recovery Codes** screen after a password-stepped regenerate: the one-time batch shown once with copy / share, and the updated remaining count. |
+| 5 | [`05-recovery-code-login.png`](05-recovery-code-login.png) | Signing in with a **single-use recovery code** instead of the authenticator code. |
+
+## Verified flows (all passed)
+
+1. **2FA login + "Trust this device"** → `200`, trust token stored; server logged `device trusted`.
+2. **Trust survives logout** — after signing out, a **password-only** sign-in skipped the
+   TOTP step entirely (server: a clean `200` with **no** preceding `401 totpRequired`).
+   This is the headline behaviour: the trust token is *only* consulted at a fresh login,
+   so it must outlive logout (see PLAN §4.1.1).
+3. **Trusted Devices** — list, and the device's `last_used` stamp advancing after the
+   trust-skip login.
+4. **Untrust all** — cleared the server rows **and** the local token; the next
+   password-only sign-in correctly required the TOTP step again (server: `401`).
+5. **Recovery codes** — generate (password step-up, shown once) and a successful
+   **recovery-code login** (server: `mobile login via recovery code` → `200`).