Prepare Android alpha20 keyboard and privacy hardening

[RioPlay]

Goal

Ship a bounded Android alpha20 preview with the frozen, locally verified keyboard hardening and presentation work. This is not completion of the full A–M redesign.

Scope

• Central editor capabilities, dynamic actions, minimal sensitive-field behavior, lifecycle reset and degraded-editor safeguards.
• Daily editing access, System/Light/Dark/OLED appearance, specialist and split-landscape layouts, Backspace/selection and completion-spacing fixes.
• Checksum-bound model readiness, recreation-safe import feedback, friendly model presentation, and staged individual/category settings resets.
• Per-take dictation insertion latch: a host false/exception never re-arms insertion after edits; selectable local recovery remains available.
• Fast PR CI, full exact-revision main/manual emulator/release gates, isolated process-recovery host, and preservation checks after both signed upgrade and reinstall.
• Android-only plans, compatibility matrix, baseline methodology and release notes. Desktop source/dependencies/releases are unchanged.

Constraints and non-goals

No telemetry, runtime network permission, ambient capture, passive typing collection, clipboard inspection/history, model-identity changes or preference migration. Explicit Copy recovery does not introduce automatic clipboard writes. No full G recovery controller, replacement Tools composition, language expansion, stable release or unobserved physical-device/accessibility claims.

Verification

The exact frozen product/test source passed on the owned API 35 x86_64 emulator:

• 236/236 ordinary instrumentation cases (0 failures/errors/skips).
• 2/2 separate cross-app/process-recovery host cases.
• 50/50 JVM and 26/26 Python tooling cases.
• App lint: 0 errors / 51 warnings; host lint: 0 errors / 5 warnings.
• Unsigned release build; package/version, non-debuggable manifest, no Internet permission, no test model/audio assets or debug host/classes, ARM64+x86_64, 16 KB / 4-byte alignment.
• Independent source/fixture/workflow review; previous keyboard restored.

Commands:

python -m unittest discover -s mobile/android/tools -p 'test_*.py'
# From mobile/android; app and host run sequentially.
.\gradlew.bat testDebugUnitTest lintDebug connectedDebugAndroidTest assembleRelease --no-daemon
.\gradlew.bat -PincludeLifecycleHost=true :app:installDebug :lifecycleHost:connectedDebugAndroidTest :lifecycleHost:lintDebug --no-daemon

Local debug SHA-256: 46fe66dd5b34c7c1b8488d84d313d8a7059e255c4a7a05fe822fee683a65e5f5.
Local unsigned release SHA-256: 26e7e9296728e71ad6cafea17f95b02ee9653445137190bb0f89ab6d788af4c0.

The first full run was 233/234 with a diagnosed IME-selection fixture race. Its failure/source/logcat remain archived; stable setup/restore and failure-preserving Activity cleanup were reviewed before the passing 236-case run. A passing PR fast path does not substitute for full main/manual release CI. Local APKs are not the protected release input.

Release acceptance and stop

See docs/plans/active/android-alpha20-release-readiness.md for the complete contract and evidence. After required checks/review, merge, run full CI at the exact main SHA, then tag android-v0.1.0-alpha20. Use only that CI run's unsigned artifact for protected signing, signed upgrade/reinstall checks and prerelease publication (latest=false). Release promotion is authorized; signing/publication also requires confirmation of the independently protected offline signing-key backup. Do not expose key material.

Stop feature editing at the frozen candidate. Preserve explicit limits: owned-emulator evidence is not phone comfort, real Obtainium, named-third-party, TalkBack/Switch Access or final A–M acceptance. Cross-editor dictation recovery and the full Tools/accessibility redesign remain planned.