Qualify Android checkpoint recovery after interrupted atomic replacement

Android currently lacks repeatable native process-interruption acceptance at the real checkpoint replacement boundary. This is a bounded acceptance child of #396, linked to the Gold native foundations epic.

A feasibility probe on source 08c1dbed2ebeafa5d665cc212bd3ca213662712f passed on an owned API 35 Play arm64 revision 9 emulator, using stock WebView 124.0.6367.219 only as the native screen script engine. The UI renders native controls. It invokes the public craft.snapshots.get/set interface, and leaves generated storage backends unchanged. An authored debug-only Android wrap.sh preload intercepts the actual libc rename from Files.move.

Retained feasibility receipt: /tmp/craft-396-android-probe-rO6mZL/verification.json, SHA256 4b1bc33a6d8fa25f68f5de90c89870545383cf0ac9a78e2fc0bf95c7fd18a638. The earlier harness command-quoting failure is retained separately.

Acceptance:

• Promote the authored probe into a maintained public-runner native fixture with documented prerequisites and fixed deadlines.
• Require a confirmed worker-thread pre-rename hold with the entire new checkpoint staged, the entire previous checkpoint unchanged, no premature acknowledgement, and a responsive native UI.
• Force-stop that process, verify it is gone, then require a new process/session to recover the complete previous checkpoint through the public API.
• Require an acknowledged retry to survive another process restart.
• Run a pass-through negative control that rejects the held-boundary condition and recovers the newer acknowledged generation, distinguishing interruption from ordinary save/reload.
• Preserve exact source, compiler, SDK/image/provider, APK, generated-backend, command, screenshot and payload identities. Bound all commands and dispose owned app, emulator, process groups and workspace on every exit.
• Add the real fixture to required mobile CI and verify original remote artifacts from the exact source commit. Add meaningful runner failure/cancellation regressions where needed.
• Run owning source checks and retain evidence without replacing the checkpoint implementation or adding a shipped fault hook.

This does not establish every interruption point, OS eviction, power-loss durability, native game acceptance, or the full ordering/background/quota/cancellation matrix in #396. Already-admitted native writes do not acquire a new cancellation rollback guarantee. Keep #396 open until its full contract and delivery are qualified. Source publication and downstream adoption remain separately qualified through existing release gates.

Pushed the reviewed acceptance tooling to main as Chris, without coauthors:

• 9ae225e6: authored debug native fixture and real rename interposition.
• 3fccd068: recovery runner, real subprocess failure/cancellation regressions and documentation.
• eca85e88: required Android checkpoint CI lane and selector/gate checks.

These integrate current main 349915ad normally. All 13 reviewed files and the three checkpoint generated/template comparisons remain unchanged. The original passing pre-integration receipt is retained separately.

Fresh exact-source local execution on API35 Play arm64 revision9 passed. A valid pass-through worker record rejected the held-boundary predicate, acknowledged generation2 and recovered its entire payload in a new process. The held run confirmed PID3998/TID4297, complete generation2 staged, intact generation1 destination, pending acknowledgement2 with only acknowledgement1, and responsive native controls. After force-stop, PID4599 recovered complete generation1 through the public API and from disk. Acknowledged generation3 survived another relaunch into PID4859. All80 commands exited0 with no timeouts and disposed groups; app, emulator and workspace cleanup were acknowledged. Stock provider124.0.6367.219 supplies only the script engine; the displayed controls are native.

Original receipt /tmp/craft-440-rebase-native/run-cpTiyw/verification.json, SHA256 369935b4ed22cd9654d4cade649e733dd846682f18600320ef5d32198d68ddfd. Independent review rechecked every artifact/source/compiler identity and the full checkpoint bytes. Rebase comparison receipt /tmp/craft-440-rebase-verification.json, SHA256 c0f793d693538b19622ce8e8f67a76fa9b5763cfd522760d84928cc84689ad6c.

Checks passed: SDK836 (10 existing platform skips), Android218, iOS385, release422; normal frozen install; package builds and43 export checks; repository and focused strict types; pinned Zig formatting. Pickier:0 errors,26 existing warnings. Initial acquisition/CI-scope regression failures remain retained, and the final suites pass.

Exact main CI and Mobile E2E are pending. Keep this issue open until the hosted x86_64 lane and its original artifacts are qualified. Parent #396 remains open for its full contract. No production runtime, public export, dependency or generated storage backend was changed, and this acceptance-tooling slice does not require a new SDK release. The independently running423/424 releases retain their own exact-source qualification.

The first hosted x86_64 row is now qualified on exact source eca85e883e875b088be9fba8627ce8e5779b0c8b.

Focused Mobile E2E41420962639 completed successfully: harness89 tests/250 assertions, the actual Android checkpoint job, and the required summary all passed. Other suites were intentionally outside this maintained focused scope. The automatic full source CI and Mobile CI remain pending, separately tracked.

Original artifact 13130481398:10,287,016 bytes, SHA256 d2ce7d98d8f692609803cd6e7fb69d9da26c70128f71eda113ff3ebf175d89d0. Independently verified GitHub metadata/digest, all97 safe ZIP entries and CRCs, all96 retained artifact identities,56 source inputs plus5 authored inputs against exact Git, generated backend comparisons, APK/interposer architecture, full payload bytes, actual native screenshots and owned cleanup.

Actual environment: API35 Play x86_64 revision9, stock Google provider124.0.6367.219, NDK27.2.12479018/clang18.0.3. The valid pass-through control recovered complete generation2 in a fresh process and rejected the held-boundary predicate. The real held rename used PID3952/worker4362, with full262,173-byte new staging, intact generation1, pending save2/ACK1 and responsive Pulse1. After force-stop, newPID4612 recovered complete generation1; acknowledged generation3 survived another restart into PID4916. All four process/session identities differ. All80 actual commands respected their original bounds and acknowledged process cleanup; app/emulator/workspace disposal passed. No WebView rendered the UI.

Raw receipt SHA256 108e0185309bb42359cd46a0efe6d8f635a65631747d7be03cf45a89eb16e684. Full local independent audit: /tmp/craft-440-ci-eca85e88/41420962639/qualification.json; original ZIP, unmodified receipt, screenshots and original job logs are retained beside it.

This adds hosted acceptance to the separate local arm64 proof. Keeping this ticket open while its automatic source checks are pending. Parent #396, broader native game/platform qualification, and publication/adoption remain separate; no interrupted-write rollback or power-loss guarantee was invented.

All bounded acceptance criteria for this fixture are now satisfied on exact source eca85e883e875b088be9fba8627ce8e5779b0c8b.

Automatic source CI41419413531 passed all20 required jobs. Its one diagnostic job was explicitly skipped. The automatic Mobile run41419413557 also passed the actual Android checkpoint job, along with every other native lane except iOS Metal. This supplements the separately qualified successful focused run41420962639 and local arm64 execution.

The automatic Android original artifact13136189004 is10,430,004 bytes, SHA256 15361fe01888a7c3034ac3222b54257eef34fe81262a57c6c1cf92ed56a5b98d. Independent verification matched public API metadata and digest, all97 safe ZIP entries/CRCs,96 artifact files,56 source inputs and5 authored inputs, full checkpoint payloads, generated backend identities, all80 bounded commands, four distinct processes/sessions, native Pulse/pending ACK, negative control and complete ownership cleanup. The raw verification receipt hashes to 4f85b957c1d15bb44cd497f1a2710d8087d697229dfd3aa7b004970eb840f207. Original artifacts and phase audit are retained under /tmp/craft-440-ci-eca85e88/41419413557/.

The full Mobile run conclusion is failure, not green: its iOS native Metal job timed out on the single pre-build xcrun simctl list runtimes --json command at the unchanged120000ms bound. No fixture build, device or renderer started. The661-byte original failure artifact13138511360 hashes to 450b2d389723db35d892d58bb84601613d857fd6c98784fa4f238996463525e5; owned process/workspace cleanup was acknowledged. No rerun, increased deadline, skipped gate or inferred Metal root cause is claimed.

Closing this Android acceptance-tooling leaf. Parent #396 remains open for its complete ordering/background/quota/cancellation and delivery contract. This does not qualify power-loss durability, OS eviction, native game acceptance, every interruption boundary, SDK publication or downstream adoption. The slice changes no shipped runtime or public exports and needs no SDK patch release.