[Mafei]

Description

The Android prototype closes SSH when its Activity pauses, cannot save passwords securely, and leaves too little room for the terminal on phones. This first application batch of the approved design adds one compact header with Home and session selection, a phone auxiliary key row with one-shot Ctrl/Alt and guarded touches, native sp-aware terminal fonts, a user-enabled foreground SSH service with a private connection-count notification and Stop All, and optional Android Keystore password encryption. Saving defaults off, occurs only after successful authentication, and supports update/delete in local no-backup storage. Endpoint validation identifies the invalid field.

SSH/tmux lists, duplicate-name and missing-identity errors, read-only mode, explicit takeover, host-key validation, native keyboard and terminal touch remain. Plain SSH reconnects explicitly; tmux recovery is bounded and preserves the server/session identity. Background ownership is best effort and does not survive system process termination. Generated-key creation/enrollment remains a later batch of the approved design.

Base: approved design PR #4 at 667663dbeb6b8439dd26471a3fa0be64ab814d7f, preserving the device-confirmed PR #2 prototype ded417ba852295f3ad76bcca4e6e557d1288ca12. Product changes are restricted to mobile/** and its Android workflow; Linux PR #3 is untouched.

Research and implementation: mobile README and approved design, with primary Android, Termux, ConnectBot and Termius references. No private assets or trademarks were copied.

Exact-head validation

Head: 85dd17a2bd611ef414227440389881f531084a8d.
Android workflow 37828821377, attempt 2: completed / success. All 9/9 configurations passed, 234 acceptance checks, zero skips. The eight successful first-attempt configurations are preserved; API36 tablet completed a full fresh retry on the identical head.

API	Form	Runtime acceptance
31	phone	26 passed, 0 skipped
32	tablet	26 passed, 0 skipped
33	phone	26 passed, 0 skipped
34	tablet	26 passed, 0 skipped
35	phone	26 passed, 0 skipped
36	phone	26 passed, 0 skipped
36	tablet	26 passed, 0 skipped
37	phone	26 passed, 0 skipped
37	tablet	26 passed, 0 skipped

Each accepted row completes 8 native + 9 WebView + 4 supplemental native + 5 real tmux cases. Coverage includes actual InputConnection/native MotionEvent input, keyboard and rotation resize, foreground/background transitions, normal notification permission decisions and Stop All, actual Keystore save/update/delete and saved login, changed-host-key rejection, TCP/owned test-endpoint loss and restoration, exact tmux identity recovery, collision/missing-session failures, read-only mode and explicit takeover.

Rebuilt forms require stable native foreground focus and controls before fixture entry, then exact endpoint readback for 350ms before one native submission. API31 now passes the complete background-return/canceled-auth path that failed on the prior head. Diagnostics expose only fixed field-validity/match booleans, never values. Native focus/security gates and original harness/SSH deadlines remain; no field is repaired and no failed submission is replayed.

The first API36-tablet attempt failed before application startup on a Launcher ANR dialog. That failure remains recorded in attempt 1; the full fresh same-head retry passed. No ANR/security dialog was dismissed and no boot gate was bypassed.

Common checks passed: 64 browser cases, 29 JVM tests, 8 Rust tests, 11 real Kotlin/JNI SSH/tmux cases on x86 and ARM64 Linux, static acceptance/SystemUI selectors, manifest/delivery rejection tests, and dependency audit (zero reported vulnerabilities).

Verified delivery and actual screenshots

Current-head API36 phone ARM64 APK and evidence.
APK SHA-256: 2c010e430bf34fd4dd2dcc0bf189a281b62e635b04cf7c26c99287dca6e32922.

Current-head API37 phone ARM64 APK and evidence.
APK SHA-256: f2c442352c919b934ad1dc5abb68f00e2cc9b1ac347ddb1066db9543d154ca1d.

Current-head API36 tablet APK and wide-window screenshots.
APK SHA-256: 9b9650648ae55d3b52a5d59007663876309a681afa9977c5a566fc2bcd4e670c.

Each ZIP contains the ARM64 APK (Tabby-Android-Prototype-ARM64.apk), checksum, source/runtime/package binding receipts and actual emulator PNGs: terminal.png, terminal-keyboard.png, terminal-rotated.png, connection-notification.png. Runtime images are captured by Android screencap in fixed synthetic-fixture phases, with no password form displayed.

The accepted emulator APK and ARM64 delivery have identical common payload SHA-256 3beebe1421c22f1de3628910b12aa5c865b33eac7e20ca287f837b29563bc0fd and ARM64 library SHA-256 2a10dbca75eeb2148f5f96002a06915aa767aa10cf64565f12b245f82e0cfd94. Delivery is checked for source cleanliness, manifest/component policy, signature, ABI, ELF and ZIP alignment and exclusion of test harness code.

Artifacts expire after 14 days. The cloud host cannot materialize the connector's artifact download URL (proxy/network denial), so no local ZIP extraction, pixel inspection or Library upload is claimed; GitHub retains the verified APK and actual screenshots. The prior complete API36-phone checkpoint at 38e995c1994ed5f5204497a723b2746d7c8a5855 remains preserved separately.

Acceptance limits

The delivered ARM64 APK has not been executed on Android. Runtime acceptance belongs to the x86_64 emulator APK, bound byte-for-byte in common payload and ARM64 library to the delivery. OPPO Find N6 interactions, physical fold changes, a real Chinese IME, Wi-Fi/cellular handover and 16 KiB-page runtime remain unverified. The old basic ARM64 launch confirmation does not cover this candidate.

This is a debug draft candidate. Per-job temporary debug certificates can prevent an in-place update of an installed prototype. No phone APK is installed, no real SSH server/account is contacted, no real credentials are handled, and no phone permissions, battery or security settings are changed. No merge or release is requested.

AI disclosure

Fully vibe-coded by Codex. Synthetic/disposable SSH fixtures only.