tasks.yaml

# Redoubt — task board
#
# Source of truth for the port. Human narrative lives in ROADMAP.md; the working
# agreement for agents lives in AGENTS.md. Validate this file with:
#
#     python3 docs/android/board.py --check
#
# Schema (every field required unless marked optional):
#   id           LW-M<milestone>-<nn>, stable forever, never renumbered
#   title        imperative, <= 70 chars
#   milestone    M0..M7
#   depends_on   task ids that must be DONE before this one starts
#   owns         paths in THIS repo (or the settings submodule) the task may write.
#                Two tasks in the same wave must never share an owned path.
#   shared_edit  append-only, line-oriented files (the patch lists) that several
#                tasks legitimately touch at once. Exempt from collision checking.
#                Rule: only ever add or change the line for YOUR OWN patch.
#                (optional, default [])
#   tree_paths   files inside the extracted Firefox tree that this task's patches
#                touch. Also collision-checked — two patches editing the same tree
#                file must be ordered, not parallel.  (optional, default [])
#   reads        paths the task needs to read but must not modify (optional)
#   what         2-5 sentences. Names concrete files, functions, line numbers.
#   acceptance   machine-checkable criteria, all must hold
#   verify       one shell command, or "manual: <what a human must do>"
#   effort_h     rough range in hours for one competent agent/engineer
#   skills       python|make|c++|js|kotlin|gradle|rust|shell|android|design|docs|ops
#   agent_safe   yes = a fresh agent with no prior context can do it from this file
#   isolation    none | worktree  (worktree when the task mutates the source tree)
#   risk         one line: what goes wrong if this is done carelessly
#   retired      optional. Date and reason the task can no longer be done as
#                written (the code it targets is gone upstream). A retired task
#                is never offered by --ready and counts as done for the tasks
#                that depend on it. The id stays; the history stays readable.
#
# NOTE ON THE settings SUBMODULE
#   settings/ is a git submodule (github.com/CPlusPlus17/Redoubt/settings). Tasks that own
#   paths under settings/ produce a PR in THAT repo plus a submodule bump here.
#   They are marked with `submodule: settings`.

meta:
  project: Redoubt
  strategy: full parity — Gecko built from source, one shared patch set with desktop
  decided: 2026-08-14
  track: esr153 for Android while desktop stays on release (see LW-M0-07)
  forge: github.com/CPlusPlus17/Redoubt (public; self-hosted Actions runner
    'redoubt-fedora', label librewolf-android; workflows in .github/workflows/.
    Corrected 2026-09-06 — this said codeberg.org, and .forgejo/ is dead here.
    Upstream is read-only from github.com/mozilla-firefox/firefox)
  patch_scope_snapshot: 22 common / 23 desktop / 8 straddlers of 53 patch files
    (heuristic — LW-M1-01 produces the authoritative split)

tasks:

  # ---------------------------------------------------------------- M0
  # Foundations. Everything here is agent-safe, needs no Gecko build, and
  # (apart from the stated deps) runs in parallel. This is the widest wave.

  - id: LW-M0-01
    title: Add a TARGETS variable to the Makefile and thread it to the patcher
    milestone: M0
    depends_on: []
    owns: [Makefile]
    reads: [scripts/librewolf-patches.py]
    what: |
      Makefile:136-140 builds $(lw_source_dir) by calling
      `python3 scripts/librewolf-patches.py $(version) $(release)` with no notion
      of a platform. Add `TARGETS ?= desktop` and pass `--targets=$(TARGETS)`.
      Add the variable to the $(lw_source_dir) prerequisite list so changing it
      forces a re-extract. Do not change patcher behaviour in this task — only
      the plumbing, so `make dir` with no TARGETS is byte-identical to today.
    acceptance:
      - "`make dir` with no arguments produces the same tree as before this change"
      - "`make -n dir TARGETS=desktop,android` shows the patcher invoked with --targets=desktop,android (the runtime half is gated on LW-M0-02, which adds the flag to the patcher)"
      - "the TARGETS value participates in the $(lw_source_dir) prerequisites — directly or via a TARGETS-derived stamp — so changing it forces a re-extract"
    verify: "make -n dir TARGETS=desktop,android | grep -- '--targets=desktop,android'"
    effort_h: "1-2"
    skills: [make]
    agent_safe: yes
    isolation: none
    risk: Silently changing the default target breaks every existing desktop builder.

  - id: LW-M0-02
    title: Split patches.txt into common/desktop/android lists
    milestone: M0
    depends_on: [LW-M0-01, LW-M0-05]
    owns:
      - assets/patches/common.txt
      - assets/patches/desktop.txt
      - assets/patches/android.txt
      - assets/patches.txt
      - scripts/librewolf-patches.py
      - Makefile
    what: |
      Add `--targets` to scripts/librewolf-patches.py (optparse block at :22-25).
      LW-M0-01 left a conditional in the Makefile that suppresses the flag when
      TARGETS is the default, precisely because the patcher rejects it today —
      once this task lands, that conditional can be removed and the flag passed
      unconditionally. Do that, and delete the comment that explains it.
      Replace the single read of ../assets/patches.txt at :115-117 with: always
      apply common.txt, then apply desktop.txt and/or android.txt per --targets.
      Keep assets/patches.txt as a generated compatibility shim (common+desktop
      concatenated) until LW-M7-01 retires it. Seed the three lists from the
      current 51 entries using the heuristic in PATCH-SCOPE.md; LW-M1-01 corrects
      it. The separately-applied patches at :121 (xmas) and :145 (pref-pane) stay
      where they are for now — LW-M1-09 and LW-M1-10 move them.

      Two pre-existing defects found by LW-M0-04 land in your lap because you own
      this file. `--no-execute` is NOT side-effect-free today: the version.txt
      rewrite (`:224-226` after the M0-04 change) runs unconditionally and really
      writes `browser/config/version.txt`, and `open('../assets/patches.txt')` is
      read relative to cwd even though `enter_srcdir()` did not chdir under -n. Fix
      both — a dry run that mutates the tree makes this task's own verify command
      impossible to write. Also gate the `srcdir + '/configure.py'` existence check
      at the bottom of the script on `no_execute`.

      Finally, in the Makefile (which you now own): add `assets/l10n-pin.txt` to the
      `$(lw_source_dir)` prerequisite list so bumping the pin re-triggers patching,
      and drop the `ifneq ($(TARGETS),desktop)` conditional around `patcher_cmd`
      that LW-M0-01 left as a bridge.

      Also stale in your file: the comment at librewolf-patches.py:124-127 still
      cites ".rej-only detection" as a live reason for keeping the OpenAI deletions
      in Python. LW-M0-11 fixed that detector. The size argument still stands —
      only the detector claim is outdated. Correct the comment, keep the code.

      Two more Makefile items, both found by LW-M0-07. First, a pre-existing bug:
      `ff_source_tarball` is assigned TWICE (once with `$(FF_BETA_SUFFIX)`, once
      without); the second assignment wins, so FF_BETA_SUFFIX has no effect on the
      tarball name and `make test-beta` cannot work. Second, `targets_stamp` is
      version-agnostic and its recipe does `rm -f librewolf-targets-*`, so now that
      Android pins its own version, every TARGETS switch re-extracts a tree that
      was already correct — about 10GB of churn. TRACK.md has a two-line fix; it
      renames the stamp, so it must land with a note that the first `make dir`
      after it re-extracts once.

      (Non-issue, recorded so nobody re-investigates: assets/mozconfig and
      assets/mozconfig.new look like duplicates but mozconfig is a SYMLINK to
      mozconfig.new. The patcher copies mozconfig.new and the Makefile lists
      assets/mozconfig as the prerequisite; make follows the link, so this is
      correct as-is. Leave it alone.)
    acceptance:
      - "common.txt + desktop.txt == the current patches.txt set (as a set, order preserved within each)"
      - "`make dir` (default targets) applies exactly the same patches in the same order as before"
      - "--targets=android applies common.txt + android.txt and no browser/-only patch"
      - "patcher exits non-zero on an unknown target name"
      - "`--no-execute` writes nothing to disk and works from any cwd"
      - "assets/l10n-pin.txt is a prerequisite of $(lw_source_dir)"
    verify: "cd /tmp && python3 $OLDPWD/scripts/librewolf-patches.py --no-execute --targets=android 153.0.4 1 | grep -c 'patch -p1'"
    effort_h: "3-5"
    skills: [python, shell]
    agent_safe: yes
    isolation: none
    risk: Order within the common list is load-bearing — see AGENTS.md "patch ordering".

  - id: LW-M0-03
    title: Write assets/mozconfig.android carrying the desktop hardening flags
    milestone: M0
    depends_on: []
    owns: [assets/mozconfig.android]
    reads: [assets/mozconfig, assets/mozconfig.new]
    what: |
      assets/mozconfig.new is the desktop config. Produce the Android equivalent:
      `ac_add_options --enable-application=mobile/android`, `--target=aarch64-linux-android`,
      Android NDK/SDK paths, and every hardening flag the desktop config carries —
      --enable-hardening, --enable-stl-hardening, --enable-replace-malloc,
      --enable-jemalloc, and the -ftrivial-auto-var-init=zero -fwrapv CFLAGS. Also
      set --enable-appservices-in-tree (needed by LW-M2-05) and the LibreWolf
      branding/official-build options the desktop config uses. Document every flag
      you had to DROP and why, as comments in the file — that list is the input to
      LW-M5-03.
    acceptance:
      - "file exists and every hardening option present in assets/mozconfig.new is either present or commented with a reason"
      - "no reference to browser/ or desktop-only branding paths"
      - "--enable-appservices-in-tree present"
    verify: "python3 docs/android/board.py --diff-mozconfig"
    effort_h: "3-6"
    skills: [shell, android]
    agent_safe: yes
    isolation: none
    risk: A silently dropped hardening flag is the exact parity loss this project exists to avoid.

  - id: LW-M0-04
    title: Pin the l10n fetch to a commit and verify its hash
    milestone: M0
    depends_on: []
    owns: [scripts/librewolf-patches.py, assets/l10n-pin.txt]
    what: |
      scripts/librewolf-patches.py:161-165 downloads
      codeload.github.com/mozilla-l10n/firefox-l10n/zip/refs/heads/main — an
      unpinned, unverified moving target fetched into every release build. Replace
      the ref with a commit sha read from a new assets/l10n-pin.txt, and verify the
      downloaded zip against a sha256 recorded in the same file. Fail the build on
      mismatch. This fixes desktop too and should land on desktop first.
    acceptance:
      - "no refs/heads/ URL remains in the script"
      - "a corrupted download makes the patcher exit non-zero"
      - "assets/l10n-pin.txt records both the commit sha and the archive sha256"
    verify: "! grep -r 'refs/heads/main' scripts/librewolf-patches.py"
    effort_h: "2-4"
    skills: [python, shell]
    agent_safe: yes
    isolation: none
    risk: A wrong pin breaks localisation silently — en-US still works, everything else regresses.

  - id: LW-M0-05
    title: Move the out-of-patch OpenAI deletions into the patch set
    milestone: M0
    depends_on: [LW-M0-04]
    owns: [scripts/librewolf-patches.py, patches/remove-openai.patch]
    reads: [patches/remove-openai.patch]
    what: |
      scripts/librewolf-patches.py:97-98 runs two `rm -rf` against
      toolkit/components/ml/ outside any patch, so `make check-patchfail` cannot
      see them and an upstream rename fails open (files silently stay). Fold both
      deletions into patches/remove-openai.patch (which already exists and covers
      the rest), or, if a patch cannot express a directory deletion cleanly, keep
      the rm but make it assert the paths existed. Landmine L4 in AGENTS.md.
    acceptance:
      - "the two bare `rm -vf`/`rm -vrf` calls at :97-98 are gone or now fail loudly on a missing path"
      - "a fresh `make dir` still leaves no toolkit/components/ml/vendor/openai"
      - "`make check-patchfail` covers the deletion"
    verify: "! grep -n 'rm -vrf toolkit/components/ml/vendor/openai' scripts/librewolf-patches.py"
    effort_h: "1-3"
    skills: [python]
    agent_safe: yes
    isolation: none
    risk: Deleting more than upstream ships breaks the ml component's moz.build.

  - id: LW-M0-11
    title: Make check-patchfail respect patch's exit code
    milestone: M0
    depends_on: [LW-M0-05]
    owns: [scripts/check-patchfail.sh, patches/remove-openai.patch]
    what: |
      FOUND BY LW-M0-05, WITH A WORKING COUNTER-DEMO. check-patchfail.sh:32-47
      discards `patch`'s exit code entirely and detects failure only by
      `grep -n 'rej$'` on the output. When a hunk's target file is missing, patch
      prints "Skipping patch. / 1 out of 1 hunk ignored", writes NO .rej file, and
      exits 1 — and check-patchfail reports success. stderr is not captured into
      patch.tmp either. Any pure-deletion or pure-addition patch is therefore
      silently fail-open, which is landmine L4's shape in the tool that is supposed
      to catch L4. Make the exit code authoritative, capture stderr, and keep the
      .rej scan as a second signal rather than the only one.

      While in the area: remove-openai.patch misses two NIGHTLY_BUILD-guarded
      references to vendor/openai/dist/openai-dev.mjs (jar.mn:43,
      license.html:1535). Harmless on release, breaks packaging on a nightly-channel
      build after the rm. Fix or document. Note jar.mn currently applies with
      fuzz 2 — pre-existing, do not paper over it.
    acceptance:
      - "a patch whose target file is missing makes check-patchfail report failure"
      - "patch's stderr appears in the output it scans"
      - "the existing .rej detection still fires (do not replace one narrow signal with another)"
      - "a run against the pristine 153.0.4 tree still reports success"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [shell]
    agent_safe: yes
    isolation: worktree
    risk: This tool is the safety net for every other patch task; while it fails open, every green result it gives is unreliable.

  - id: LW-M0-12
    title: Add container-engine indirection and Android image targets
    milestone: M0
    depends_on: [LW-M0-02, LW-M0-06]
    owns: [Makefile]
    what: |
      FOUND BY LW-M0-06. The docker-build-image / docker-run-build-job /
      docker-remove-image targets call `docker` directly, and docker is not
      installed on every maintainer machine — podman is what LW-M0-06 actually
      built the Android image with. Add a `CONTAINER_ENGINE ?= docker` indirection
      so podman works without editing the Makefile, and add the Android
      counterparts (android-build-image, android-run-build-job,
      android-remove-image) pointing at assets/Dockerfile.android.

      Note docker-build-image pipes the Dockerfile on stdin with no build context;
      assets/Dockerfile.android COPYs nothing, so it works either way. Keep that
      property or state that you changed it.
    acceptance:
      - "`make docker-build-image CONTAINER_ENGINE=podman` works"
      - "the default with no CONTAINER_ENGINE set is unchanged for existing docker users"
      - "the android image targets build assets/Dockerfile.android"
    verify: "make -n android-build-image CONTAINER_ENGINE=podman"
    effort_h: "1-2"
    skills: [make, ops]
    agent_safe: yes
    isolation: none
    risk: Low, but leaving it undone means every podman-using maintainer edits the Makefile locally and eventually commits it.

  - id: LW-M0-14
    title: Derive ff_source_dir from the tarball, not from the version string
    milestone: M0
    depends_on: [LW-M0-02, LW-M0-07, LW-M0-11, LW-M0-12]
    owns: [Makefile, scripts/check-patchfail.sh]
    what: |
      BLOCKER, found by LW-M0-09 and independently confirmed: `make dir
      TARGETS=android` cannot succeed. The ESR tarball
      firefox-153.0esr.source.tar.xz extracts to `firefox-153.0/`, but the Makefile
      computes `ff_source_dir := firefox-$(version)` = `firefox-153.0esr`, so the
      recipe runs `mv firefox-153.0esr librewolf-153.0esr-1` and fails — AFTER a
      766MB download and a ~10GB extract.

      Derive the extracted directory from the tarball itself rather than assuming
      it matches the version string, or strip the `esr` suffix. Deriving is better:
      it also survives whatever Mozilla does next.

      DO NOT USE `tar tf | head -1`. An earlier version of this task said the
      tarball's first member is `firefox-153.0/CLOBBER`. It is not — the first
      member is `./`, on both the ESR and the release tarball, so
      `tar tf | head -1 | cut -d/ -f1` yields `.` and that value is used as an
      `rm -rf` operand. Strip a leading `./` and explicitly reject "", "." and ".."
      before using the result. Do the derivation in the RECIPE shell, not with
      `$(shell ...)`: a parse-time call runs on every `make help` and `make -n`,
      and on a fresh checkout it runs before the tarball exists and evaluates to
      empty.
      scripts/check-patchfail.sh:50 has the identical assumption
      (`cd firefox-$(cat ../version)`) — fix both, and note LW-M1-11 will also touch
      that file.

      Keep the desktop path byte-identical: for a release tarball the derived name
      already equals firefox-$(version).
    acceptance:
      - "`make dir TARGETS=android` gets past the mv and into the patcher"
      - "`make -n dir` for desktop is unchanged"
      - "check-patchfail works against an esr tarball"
      - "the directory name is derived or normalised, not special-cased for the string 'esr'"
    verify: "make -n dir TARGETS=android"
    effort_h: "2-4"
    skills: [make, shell]
    agent_safe: yes
    isolation: none
    risk: Every Android CI run and every Android build is red until this lands, and the failure costs a 766MB download each time.

  - id: LW-M0-15
    title: Add the four missing host toolchains to the Android image
    milestone: M0
    depends_on: [LW-M0-06, LW-M2-01]
    owns: [assets/Dockerfile.android]
    what: |
      FOUND BY LW-M2-01, which got a green build only by installing these by hand.
      The image has the Android toolchains right but omits four host tools that are
      hard configure stops, so a fresh container cannot build without manual setup.
      All four go in $MOZBUILD_STATE_PATH, where bootstrap_path()
      (bootstrap.configure:301-306) finds them even with --enable-bootstrap at its
      default:
        1. clang — symlink $MOZBUILD_STATE_PATH/clang to the NDK's
           prebuilt/linux-x86_64 (toolchain.configure:760 is
           bootstrap_search_path("clang/bin")). Without it configure picks
           /usr/bin/gcc and dies on a CPU mismatch. NDK clang 21.0.0 then serves
           target, host, assembler and wasm.
        2. Node.js 22.16.0 — required by node.configure. The jammy package is
           12.22.9 and NODE_MIN_VERSION is 12.22.12, so the distro package is
           unusable, not merely old.
        3. cbindgen 0.29.4 — `cargo install --root $MOZBUILD_STATE_PATH/cbindgen`
           plus a symlink so the binary sits at cbindgen/cbindgen.
        4. WASI sysroot + wasm32 compiler-rt — RLBox is on by default for all
           little-endian targets (toolkit/moz.configure:2829-2833), so
           aarch64-android needs it. Fetch Mozilla's own artifacts
           (`mach artifact toolchain --from-build sysroot-wasm32-wasi` and
           `wasm32-wasi-compiler-rt-21`) and copy the builtins into the NDK as
           lib/clang/21/lib/wasm32-unknown-wasi/libclang_rt.builtins.a — note the
           rename from the artifact's flat libclang_rt.builtins-wasm32.a.

      DO NOT take configure's suggestion of --without-wasm-sandboxed-libraries.
      LW-M2-01 explicitly refused it: turning off RLBox to make configure quiet is
      a silent parity loss, and it is exactly the failure this project exists to
      avoid.

      Do NOT add python3.10-venv. `python3 -m venv` is broken in the image
      (ensurepip missing on jammy) and it does not matter — mach uses the vendored
      third_party/python/virtualenv.
    acceptance:
      - "a fresh container from the rebuilt image reaches `./mach build` with no manual toolchain setup"
      - "RLBox stays enabled — --without-wasm-sandboxed-libraries appears nowhere"
      - "`python3 docs/android/board.py --diff-mozconfig` still passes"
    verify: "podman build -f assets/Dockerfile.android -t librewolf-android-build ."
    effort_h: "3-6"
    skills: [ops, android, shell]
    agent_safe: yes
    isolation: none
    risk: Leaving these out means every builder and the CI job rediscovers four configure stops by hand.

  - id: LW-M0-16
    title: Add nasm to the Android image and correct the BUILD.md claim
    milestone: M0
    depends_on: [LW-M0-15, LW-M2-03]
    owns: [assets/Dockerfile.android, docs/android/BUILD.md]
    what: |
      FOUND BY THE SKEPTICAL VERIFICATION OF LW-M2-03, and confirmed independently:
      `make android-aar` cannot run from a clean checkout. The x86_64 ABI needs
      nasm; `grep -ci nasm assets/Dockerfile.android` is 0, and the built image has
      neither nasm on PATH nor $MOZBUILD_STATE_PATH/nasm. The three-ABI fat AAR was
      only produced with an ad-hoc `librewolf-android-build-nasm` image made by
      podman commit on this host — it exists in NO repo file, so nobody else can
      reproduce the deliverable.

      Worse, the requirement is currently recorded only in a comment inside
      scripts/android-fat-aar.sh, while docs/android/BUILD.md:415 still states
      "**No `nasm`/`yasm`** is needed: they are x86-only" as an unqualified bullet —
      in the very section that hands off to the image owner with "Suggested layers".
      That was true for the aarch64-only build and is false for the fat AAR.
      Whoever maintains the image will read BUILD.md, not another task's script.

      Add nasm to assets/Dockerfile.android following the established pattern
      (pinned, with the tree file:line the pin came from), rebuild, and correct
      BUILD.md. Then DELETE the ad-hoc image so nobody depends on it again.
    acceptance:
      - "assets/Dockerfile.android installs nasm, pinned, with a source comment"
      - "the rebuilt librewolf-android-build image passes scripts/android-fat-aar.sh's x86_64 preflight"
      - "BUILD.md no longer claims nasm is unnecessary, and says which ABI needs it"
      - "no ad-hoc podman-commit image is required to reproduce make android-aar"
    verify: "podman run --rm librewolf-android-build bash -lc 'command -v nasm'"
    effort_h: "1-3"
    skills: [ops, android]
    agent_safe: yes
    isolation: none
    risk: The headline M2 deliverable is currently reproducible only on one machine, and the doc actively misleads whoever would fix it.

  - id: LW-M0-13
    title: Teach enable-patch and disable-patch the split lists
    milestone: M0
    depends_on: [LW-M0-02]
    owns: [scripts/enable-patch.sh, scripts/disable-patch.sh]
    what: |
      FOUND BY LW-M0-02. Both scripts edit only assets/patches.txt, which after the
      split is a generated compatibility shim that no longer drives any build. So a
      maintainer who runs `enable-patch.sh` gets a patch that silently never reaches
      a build — fail-open, exactly landmine L4's shape. LW-M0-02 added a non-fatal
      drift warning in the patcher that surfaces it; this task fixes it. The scripts
      must ask which list a patch belongs to (or infer it and say what it inferred),
      edit that list, and regenerate the shim. Note they currently `sort` the shim,
      which is why LW-M0-02's drift check compares sets rather than sequences.
    acceptance:
      - "enable-patch.sh adds to the correct target list and the patch actually applies on the next build"
      - "disable-patch.sh removes from whichever list holds the patch"
      - "the shim stays consistent, and the patcher's drift warning stays silent after either script runs"
    verify: "./scripts/enable-patch.sh --help && ! python3 scripts/librewolf-patches.py --no-execute 153.0.4 1 2>&1 | grep -qi 'out of sync'"
    effort_h: "2-3"
    skills: [shell]
    agent_safe: yes
    isolation: none
    risk: A maintainer trusting these scripts ships a build missing the patch they just enabled, with no error anywhere.

  - id: LW-M0-06
    title: Build a pinned Android toolchain image (assets/Dockerfile.android)
    milestone: M0
    depends_on: []
    owns: [assets/Dockerfile.android]
    reads: [assets/Dockerfile]
    what: |
      Mirror assets/Dockerfile for Android: JDK, Android SDK + build-tools, NDK,
      Rust with the four Android targets (aarch64/armv7/x86_64/i686-linux-android),
      and the mach bootstrap deps. Pin every version explicitly and record the
      tree file:line each pin came from, so the next rebase can re-check.

      READ THE PINS FROM (verified — mobile/android/gradle.py holds NO version
      constants, it is a 52-line gradle invocation helper):
      python/mozboot/mozboot/android.py, python/mozboot/mozboot/android-packages.txt,
      build/moz.configure/android-sdk.configure, build/moz.configure/android-ndk.configure,
      gradle/libs.versions.toml, mobile/android/android-components/.config.yml, and
      taskcluster/kinds/toolchain/rust.yml (linux64-rust-android is the version
      Mozilla's Android builds actually use — Cargo.toml's floor is only a floor).

      Two traps: the JDK must physically live at $MOZBUILD_STATE_PATH/jdk/... because
      java.configure:29-34 ignores JAVA_HOME; and the `emulator` SDK package is NOT
      optional despite looking test-only, because android-sdk.configure:376 runs
      check_android_tools("emulator") unconditionally for mobile/android and dies
      without it.
    acceptance:
      - "every pinned version is traceable to a tree file:line recorded in a comment"
      - "`rustup target list --installed` shows all four Android targets, verified by running it inside the built image"
      - "sdkmanager --licenses runs non-interactively — the build never blocks on a prompt"
      - "the NDK revision is asserted after download, not merely requested"
    verify: "podman build -f assets/Dockerfile.android -t librewolf-android-build ."
    note: >-
      Full network hermeticity is deliberately NOT required here — the house style
      in assets/Dockerfile hits Ubuntu archives, sh.rustup.rs and codeberg. A
      hermetic image is a separate piece of work if it is ever wanted.
    effort_h: "4-8"
    skills: [ops, android, shell]
    agent_safe: yes
    isolation: none
    risk: An NDK mismatch produces a tree that configures fine and fails deep in the link.

  - id: LW-M0-07
    title: Decide and document the Android release track (esr153)
    milestone: M0
    depends_on: [LW-M0-01]
    owns: [docs/android/TRACK.md, version.android, release.android, Makefile]
    reads: [version, release]
    what: |
      DONE — see TRACK.md for the evidence. Decision upheld (Android on esr153,
      desktop on release) but three of the four figures this task originally
      carried were wrong: the current tarball is release 153.0.4, NOT esr153
      (`MOZ_ESR` is unset per init.configure:1151), so adoption costs a second
      source tree rather than nothing; ESR ships ~26 dots a year, not ~12; and the
      real argument is hard rebases falling 26/yr to 1/yr. Recorded costs: median
      14-day / max 21-day security lag, and NO Firefox for Android ESR exists, so
      Android-only advisories must be watched and backported by hand.
    acceptance:
      - "TRACK.md states the decision, the yearly rebase cost of each option, and the reversal cost"
      - "version.android/release.android exist and are read by the android make targets"
      - "the desktop version/release files are untouched"
    verify: "manual: maintainer sign-off recorded in TRACK.md"
    effort_h: "2-4"
    skills: [docs, make]
    agent_safe: yes
    isolation: none
    risk: Coupling Android to the desktop version file forces a lockstep rebase cadence nobody has staff for.

  - id: LW-M0-08
    title: Write a file-level patch-scope linter
    milestone: M0
    depends_on: [LW-M0-02]
    owns: [scripts/lint-patch-scope.py]
    reads: [assets/patches/common.txt, assets/patches/desktop.txt, assets/patches/android.txt]
    what: |
      Parse the `--- a/x +++ b/x` headers of every patch and assert that patches in
      common.txt touch no desktop-only file, desktop.txt touches no mobile/ file,
      and android.txt touches no browser/ file. The rule must be FILE-level, not
      prefix-level: ui-patches/neterror.patch looks like pure toolkit/ but edits
      toolkit/themes/shared/desktop-jar.inc.mn. Conversely devtools/ must be
      ALLOWED in common — devtools/moz.build:11-16 ships server/ and shared/ on
      Android. Ship the allow/deny lists as data at the top of the file with a
      comment per entry.
    acceptance:
      - "linter flags a common patch that touches browser/ or *desktop*.inc.mn"
      - "linter does NOT flag a common patch that touches devtools/server/"
      - "exits 0 on the current tree once LW-M1-01 has landed, non-zero before"
    verify: "python3 scripts/lint-patch-scope.py"
    effort_h: "3-5"
    skills: [python]
    agent_safe: yes
    isolation: none
    risk: A prefix-based rule passes on neterror.patch and lets desktop-only code into the Android build.

  - id: LW-M0-09
    title: Add the android-test CI workflow skeleton
    milestone: M0
    depends_on: [LW-M0-01, LW-M0-06]
    owns: [.forgejo/workflows/android-test.yaml]
    reads: [.forgejo/workflows/source-test.yaml, .forgejo/workflows/source-release.yaml]
    what: |
      Copy the shape of source-test.yaml onto Android: run on the epsilon runner,
      run `make dir TARGETS=android` (NOT `common,android` — `common` is not a
      target and the patcher rejects it), then the scope and order checks. Do NOT
      attempt a Gecko build in this task — the job must stay under the runner's
      timeout. LW-M2-08 adds the real build job once caching exists.

      Two steps must be ADVISORY, not blocking, or the job is red on day one for
      reasons unrelated to Android: lint-patch-scope.py is specified to exit
      non-zero until LW-M1-01 reclassifies, and check-patchfail.sh is target-blind
      until LW-M1-11 (note LW-M1-11 depends on THIS task, so it cannot be a
      prerequisite). `make dir TARGETS=android` is the real gate — the patcher
      exits 1 on the first failing patch on its own.
    acceptance:
      - "workflow runs on push and PR"
      - "`make dir TARGETS=android` is the blocking gate and fails the job when a patch fails"
      - "steps that are known-red until a later task are advisory, with a comment naming the task that makes them blocking"
      - "no signing secrets referenced"
    verify: "manual: open a PR and confirm the job runs on the epsilon runner"
    effort_h: "2-4"
    skills: [ops, shell]
    agent_safe: yes
    isolation: none
    risk: A build step here blows the runner budget and the job gets disabled instead of fixed.

  - id: LW-M0-10
    title: Create patches/android/ and its README
    milestone: M0
    depends_on: [LW-M0-02]
    owns: [patches/android/README.md, patches/android/.gitkeep]
    what: |
      All Android-only patches live in patches/android/. Write the README that
      states the naming convention (one concern per patch, kebab-case, no version
      in the name), that every patch must carry a header comment naming the
      upstream file and why LibreWolf diverges, and that a patch which also needs
      to touch shared Gecko code belongs in common/ instead with the Android half
      gated at runtime, not duplicated.
    acceptance:
      - "directory exists and is referenced by assets/patches/android.txt"
      - "README states naming, header-comment, and no-duplication rules"
    verify: "test -f patches/android/README.md"
    effort_h: "1"
    skills: [docs]
    agent_safe: yes
    isolation: none
    risk: Without a stated convention the Android patch dir turns into the desktop one's mess twice as fast.

  # ---------------------------------------------------------------- M1
  # Patch-set surgery. LW-M1-01 gates everything; the eight straddler tasks are
  # then fully parallel because each owns disjoint patch files.

  - id: LW-M1-01
    title: Produce the authoritative common/desktop/android patch split
    milestone: M1
    depends_on: [LW-M0-02, LW-M0-08]
    owns:
      - assets/patches/common.txt
      - assets/patches/desktop.txt
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
    reads: [patches/]
    what: |
      The snapshot in PATCH-SCOPE.md (22 common / 23 desktop / 8 straddlers) comes
      from a path heuristic and is a starting point, not an answer. Open every one
      of the 53 patch files and classify it by what it actually does, not by which
      directory it edits. Record a one-line justification per patch in
      PATCH-SCOPE.md and mark each row reviewed. Straddlers stay unassigned here —
      they are handed to LW-M1-02..09.
    acceptance:
      - "all 53 patches classified, every row carries a justification and a reviewer"
      - "scripts/lint-patch-scope.py exits 0"
      - "counts in PATCH-SCOPE.md match the three .txt files"
    verify: "python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check-scope && python3 docs/android/board.py --check"
    effort_h: "6-10"
    skills: [python, c++, js]
    agent_safe: yes
    isolation: none
    risk: A patch misfiled as common lands desktop assumptions in the Android build and shows up as a runtime crash months later.

  - id: LW-M1-02
    title: Split disable-data-reporting-at-compile-time into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/disable-data-reporting-at-compile-time.patch
      - patches/disable-data-reporting-common.patch
      - patches/disable-data-reporting-desktop.patch
      - patches/android/disable-data-reporting-android.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - browser/moz.configure
      - browser/components/tabbrowser/content/tabbrowser.js
      - python/mach/mach/telemetry.py
      - python/sites/mach.txt
      - toolkit/components/glean/src/init/mod.rs
      - toolkit/components/telemetry/core/Telemetry.cpp
      - toolkit/library/rust/gkrust-features.mozbuild
    what: |
      The common half (mach telemetry, Glean init, Telemetry.cpp, the gkrust
      feature list) is exactly what Android needs; the browser/moz.configure and
      tabbrowser.js hunks are desktop-only. Split into two patches that apply
      cleanly in sequence and produce a byte-identical desktop tree. Note that
      browser/moz.configure carries the MOZ_DATA_REPORTING off switch — find the
      mobile/android equivalent and record whether it needs the same treatment
      (input to LW-M4-01).
    acceptance:
      - "desktop tree after both patches is byte-identical to the tree after the original patch"
      - "common patch applies to a tree with mobile/android as the only front end"
      - "a note in the common patch header points at the mobile/android data-reporting switch"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [c++, rust, python]
    agent_safe: yes
    isolation: worktree
    risk: Dropping a gkrust feature hunk silently re-enables Glean in the Rust build.

  - id: LW-M1-03
    title: Split eme-permission into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/eme-permission.patch
      - patches/eme-permission-common.patch
      - patches/eme-permission-desktop.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - dom/media/eme/MediaKeySystemAccessManager.cpp
      - browser/components/permissions/ContentPermissionPrompt.sys.mjs
      - browser/modules/EMEPermissionPrompt.sys.mjs
    what: |
      MediaKeySystemAccessManager.cpp is the enforcement point and is common; the
      two browser/ files are the desktop prompt UI. Split them.

      RESOLVED BY LW-M1-03, and the premise this task was written on was WRONG.
      "Android has no equivalent surface yet" is false: Fenix has implemented this
      exact permission type end to end all along — GeckoViewPermission.sys.mjs:119-219
      is type-agnostic and forwards any perm.type to the embedder (the structural
      difference from webgl-permission, whose observers exist only under browser/),
      GeckoSession.java carries PERMISSION_MEDIA_KEY_SYSTEM_ACCESS across JNI, and
      Fenix has both a doorhanger and a settings entry (PhoneFeature.kt:38,
      SitePermissionsRules.kt:92-94, default ASK_TO_ALLOW). No Android patch needed.

      The one deliberate silent deny is Clear Key, and it is identical on both
      platforms — the pref is read as
      Preferences::GetBool("librewolf.eme.gmp-clearkey.enabled", false), so the
      built-in fallback already equals LibreWolf's default. That is exactly why
      webgl-permission needed an Android patch and this does not: webgl's shared
      default was the permissive-looking true.

      The real remaining gap is narrower: there is no Android surface for the
      LibreWolf-specific Clear Key denial (desktop's learn-more link to
      librewolf.eme.warning.infoURL). That is a UI follow-up, not a scope question.
    acceptance:
      - "desktop tree byte-identical after the two patches"
      - "common patch applies with no browser/ present"
      - "chosen Android behaviour recorded in the common patch header"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [c++, js]
    agent_safe: yes
    isolation: worktree
    risk: Enforcement without any user-visible signal reads as a broken video player.

  - id: LW-M1-04
    title: Split moz-official into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/moz-official.patch
      - patches/moz-official-common.patch
      - patches/moz-official-desktop.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - dom/media/gmp/ChromiumCDMAdapter.cpp
      - media/gmp-clearkey/0.1/gmp-clearkey.cpp
      - browser/base/content/browser-init.js
      - browser/base/content/browser-main.js
      - browser/base/jar.mn
    what: |
      The two media/ files (clearkey, CDM adapter) are common and matter on
      Android; the three browser/base files are desktop chrome. Split, keeping the
      desktop tree identical. Check whether mobile/android has its own equivalent
      of the browser-init hunk — if it does, that becomes an android patch, and if
      it does not, say so in the header rather than leaving it ambiguous.
    acceptance:
      - "desktop tree byte-identical after the two patches"
      - "common patch applies with no browser/ present"
      - "header records whether an Android equivalent of the browser-init hunk is needed"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "2-3"
    skills: [c++, js]
    agent_safe: yes
    isolation: worktree
    risk: The clearkey hunks interact with librewolf.eme.gmp-clearkey.enabled — losing them changes DRM behaviour.

  - id: LW-M1-05
    title: Split msix into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/msix.patch
      - patches/msix-common.patch
      - patches/msix-desktop.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - python/mozbuild/mozbuild/mach_commands.py
      - python/mozbuild/mozbuild/repackaging/msix.py
      - browser/installer/windows/msix/AppxManifest.xml.in
    what: |
      msix.patch looks like the most obviously desktop-only patch in the tree and
      is not: it edits python/mozbuild/mozbuild/mach_commands.py, a file the
      Android build traverses. Either split out the mach_commands hunk as common,
      or confirm the hunk is inert for Android and mark the whole patch desktop
      with that finding written in PATCH-SCOPE.md. Do not guess — read the hunk
      and check whether the code path is reachable from `mach build` on Android.
    acceptance:
      - "a written finding: either the split exists, or the hunk is proven inert with the reasoning recorded"
      - "desktop tree byte-identical either way"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "1-3"
    skills: [python]
    agent_safe: yes
    isolation: worktree
    risk: This is the straddler most likely to be dismissed on sight; dismissing it wrongly breaks `mach` on Android.

  - id: LW-M1-06
    title: Split remove-pingsender into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/remove-pingsender.patch
      - patches/remove-pingsender-common.patch
      - patches/remove-pingsender-desktop.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - toolkit/components/telemetry/moz.build
      - toolkit/components/telemetry/app/TelemetrySend.sys.mjs
      - python/mozbuild/mozbuild/artifacts.py
      - browser/installer/package-manifest.in
      - browser/installer/windows/nsis/shared.nsh
      - browser/app/macbuild/Contents/MacOS-files.in
    what: |
      The toolkit/ and python/ hunks are common; the three packaging files are
      desktop installers. Split them. The Android packaging equivalent
      (mobile/android's package manifest / Gradle assets) may also need pingsender
      excluded — check and file it as an android patch under patches/android/ if
      so.
    acceptance:
      - "desktop tree byte-identical after the two patches"
      - "common patch applies with no browser/ present"
      - "a stated answer on whether Android packaging ships pingsender"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [js, python]
    agent_safe: yes
    isolation: worktree
    risk: Removing the moz.build entry without the send-path hunk leaves a build referencing a binary that no longer exists.

  - id: LW-M1-07
    title: Split ui-patches/neterror into common and desktop
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/ui-patches/neterror.patch
      - patches/ui-patches/neterror-common.patch
      - patches/ui-patches/neterror-desktop.patch
      - patches/android/neterror-jar.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - toolkit/content/errors/net-error-illustrations.mjs
      - toolkit/content/net-error-card.mjs
      - toolkit/themes/shared/aboutNetError.css
      - toolkit/themes/shared/illustrations/warning.svg
      - toolkit/themes/shared/desktop-jar.inc.mn
    what: |
      This is the patch that breaks prefix-based scope rules: everything is under
      toolkit/ but toolkit/themes/shared/desktop-jar.inc.mn is desktop-only. Split
      the jar manifest hunk into the desktop patch and find the Android jar
      manifest that must carry the same additions (mobile/android/themes or the
      geckoview jar.mn) so the illustration and CSS actually ship on Android.
    acceptance:
      - "desktop tree byte-identical after the two patches"
      - "common patch touches no *desktop*.inc.mn"
      - "the Android jar manifest entry exists, or a written finding says none is needed"
    verify: "python3 scripts/lint-patch-scope.py"
    effort_h: "2-4"
    skills: [js, shell]
    agent_safe: yes
    isolation: worktree
    risk: Shipping the .mjs without the jar entry gives a blank error page on Android with no console error.

  - id: LW-M1-08
    title: Split webgl-permission into common and desktop — the L1 landmine
    milestone: M1
    depends_on: [LW-M1-01]
    owns:
      - patches/webgl-permission.patch
      - patches/webgl-permission-common.patch
      - patches/webgl-permission-desktop.patch
      - patches/android/webgl-prompt-default.patch
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths:
      - dom/canvas/ClientWebGLContext.cpp
      - dom/ipc/BrowserParent.cpp
      - dom/ipc/BrowserParent.h
      - dom/ipc/PBrowser.ipdl
      - modules/libpref/init/StaticPrefList.yaml
      - modules/libpref/moz.build
      - browser/modules/WebGLPermissionPromptHelper.sys.mjs
      - browser/modules/ObserverForwarder.sys.mjs
      - browser/base/content/popup-notifications.inc.xhtml
      - browser/themes/shared/jar.inc.mn
      - browser/themes/shared/notification-icons.css
    what: |
      Landmine L1, read AGENTS.md before starting. Applying the common half to
      Android compiles librewolf.webgl.prompt defaulting to true;
      IsWebGLAllowed_impl then fails closed, RecvShowWebGLPermissionPrompt
      early-returns because GeckoView has no XUL <browser>, and the only observers
      that would answer live in the browser/ half. Result: ALL WebGL dies silently
      and a smoke test of "installs and browses" still passes. The split must ship
      `lockPref("librewolf.webgl.prompt", false)` for Android in the SAME commit,
      or set the StaticPrefList default per-platform.
    acceptance:
      - "desktop tree byte-identical after the two patches"
      - "on Android, a WebGL page renders — verified against a real canvas, not just absence of a console error"
      - "librewolf.webgl.prompt is false on Android by default and the mechanism is in this commit, not a later one"
    verify: "manual: load webglreport.com on the Android build and confirm a live context"
    effort_h: "4-8"
    skills: [c++, kotlin, js]
    agent_safe: yes
    isolation: worktree
    risk: The failure mode is silent and passes the obvious gate — this is the single most likely way to ship a broken build.

  - id: LW-M1-09
    title: Split xmas and fold it into the target-aware patch lists
    milestone: M1
    depends_on: [LW-M1-01, LW-M1-06]
    owns:
      - patches/xmas.patch
      - scripts/librewolf-patches.py
    shared_edit: [assets/patches/common.txt, assets/patches/desktop.txt,
                  assets/patches/android.txt, assets/patches.txt]
    tree_paths: [moz.build, lw/moz.build, browser/installer/package-manifest.in]
    what: |
      xmas.patch is applied separately at scripts/librewolf-patches.py:121 with the
      comment that not all builders use this repo the same way. Its moz.build and
      lw/moz.build hunks are common (they are what puts lw/ into the build); the
      package-manifest.in hunk is desktop. Split it, move the common half into
      common.txt so it is no longer special-cased, and keep the desktop half in
      desktop.txt. Preserve the existing apply order relative to its neighbours.
    acceptance:
      - "no separate patch() call for xmas remains in librewolf-patches.py"
      - "desktop tree byte-identical to before"
      - "lw/ is present in the Android tree's build"
    verify: "! grep -n \"patch('../patches/xmas.patch')\" scripts/librewolf-patches.py"
    effort_h: "2-4"
    skills: [python, shell]
    agent_safe: yes
    isolation: worktree
    risk: lw/moz.build is how librewolf.cfg reaches the package — get this wrong and prefs vanish on both platforms.

  - id: LW-M1-12
    title: Reconcile the shim and delete the split monoliths
    milestone: M1
    depends_on: [LW-M1-02, LW-M1-03, LW-M1-04, LW-M1-05, LW-M1-06, LW-M1-07, LW-M1-08, LW-M1-09]
    owns:
      - assets/patches.txt
      - assets/patches/common.txt
      - assets/patches/desktop.txt
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
      - patches/android/README.md
      - patches/disable-data-reporting-at-compile-time.patch
      - patches/eme-permission.patch
      - patches/moz-official.patch
      - patches/msix.patch
      - patches/remove-pingsender.patch
      - patches/ui-patches/neterror.patch
      - patches/webgl-permission.patch
    what: |
      CENTRAL CLEANUP, needed because all eight straddler splits hit the same
      problem and none of them can fix it alone. Each split leaves its monolithic
      patch file on disk, because check-patchfail.sh and fuzzfail.sh read only the
      generated assets/patches.txt shim — deleting the monolith before the shim is
      regenerated makes their own verify fail on a missing `-i` target. So after a
      split lands, check-patchfail is still exercising the MONOLITH, not the two
      halves, and librewolf-patches.py prints its out-of-sync warning.

      Do it once, after all eight land: regenerate the shim with
      `sed -e 's/#.*//' -e 's/[[:space:]]*$//' assets/patches/common.txt assets/patches/desktop.txt | grep . > assets/patches.txt`
      (the exact command check_compat_shim() prints), delete the eight monoliths,
      and reconcile PATCH-SCOPE.md's counts and its live-list table — every split
      moves one entry from desktop into common and adds a file, so both the
      `N common / N desktop-only / N straddlers = N` line and the per-list table
      need recomputing. `board.py --check-scope` enforces that they agree.

      While in PATCH-SCOPE.md, fix one justification LW-M1-06 disproved: the
      LW-M1-06 row says pingsender/moz.build "still appends
      pingsender_unix_common.cpp to UNIFIED_SOURCES outside that guard", implying
      compiled code on Android. Textually true but nothing compiles — with
      GeckoProgram skipped there is no linkable in that context and no
      FINAL_LIBRARY, so emitter.py:1038-1042 returns before emitting any source.
      The classification (common) is right; the mechanism is that the directory
      stops being traversed. Fix the reason, keep the verdict.

      Also correct the LW-M1-07 row, which LW-M1-07 disproved. It claims the
      common half "yields a broken image reference" on Android. It does — but
      upstream already does the same: unpatched net-error-illustrations.mjs points
      at security-error.svg and no-connection.svg, packaged only by
      desktop-jar.inc.mn:148,151. The patch swaps one desktop-only-packaged
      illustration for another, so it is NOT a new Android regression and NOT
      L1-shaped (L1 changes behaviour; this changes nothing reachable — the whole
      component is gated on security.certerrors.felt-privacy-v1, set only in
      browser/app/profile/firefox.js:2965, and Fenix answers every load error with
      its own ErrorPages document anyway).

      Record the trap-within-the-trap while you are there, because it will bite the
      next person who adds a mobile jar entry: it must go in
      toolkit/themes/mobile/global/jar.mn and NEVER in
      shared/minimal-toolkit.jar.inc.mn — desktop-jar.inc.mn:10 includes the latter,
      so an entry there lands in the desktop jar too and breaks byte-identity.

      Finally, assets/patches/android.txt's header still says "DELIBERATELY EMPTY".
      It is not — several Android patches now live there.

      COUNT CHANGES you must fold in, beyond the per-split arithmetic:
      LW-M1-05 resolved msix to a plain desktop-only patch, NOT a straddler, so the
      straddler count drops by one independently of any split. The desktop.txt
      header's "Seven entries edit both shared Gecko code and browser/" is wrong on
      two counts now. And LW-M1-09 folded xmas into the lists, so only
      pref-pane-small is still applied from its own call site — board.py now
      derives that set from librewolf-patches.py rather than hardcoding it, but the
      prose in PATCH-SCOPE.md still describes the old two-patch situation.
    acceptance:
      - "assets/patches.txt equals common+desktop and librewolf-patches.py prints no out-of-sync warning"
      - "no monolithic straddler patch file remains on disk"
      - "check-patchfail exercises the split halves, not the monoliths — verified by checking the applied list"
      - "`python3 docs/android/board.py --check-scope` exits 0"
    verify: "python3 docs/android/board.py --check-scope && ./scripts/check-patchfail.sh"
    effort_h: "2-3"
    skills: [shell, docs]
    agent_safe: yes
    isolation: none
    risk: Until this lands, every green check-patchfail is testing the pre-split monoliths and proves nothing about the halves that actually ship.

  - id: LW-M1-16
    title: Restore make fixfuzz and stop mutating the user's global git config
    milestone: M1
    depends_on: [LW-M1-11, LW-M1-15]
    owns: [scripts/fuzzfail.sh, scripts/git-patchtree.sh]
    what: |
      TWO THINGS, and the first is a REGRESSION we caused.

      (1) `make fixfuzz` now regenerates NOTHING. LW-M1-15 made git-patchtree.sh
      refuse a bare invocation (exit 2), and fuzzfail.sh:304-312 calls it inside a
      subshell with `|| exit 1`, so all 23 fuzzy patches come back under "patches
      that need a human, not a fuzz rebuild". Reproduced end to end against a real
      803MB tarball replica: EXIT=1, zero .nofuzz written. The two files are owned
      by different tasks, which is exactly why it slipped — this task owns BOTH so
      it can land as a pair. Teach fuzzfail.sh git-patchtree.sh's new interface.

      Note the board's own verify for LW-M1-15 (`make -n fixfuzz`) CANNOT see this,
      because -n does not execute. Any verify you write here must actually run the
      regeneration against at least one genuinely fuzzy patch and confirm a
      .nofuzz appears.

      (2) PRE-EXISTING, and it damages the user's environment outside the repo:
      fuzzfail.sh runs `git config --global commit.gpgsign false` before the
      regeneration and `git config --global commit.gpgsign true` after
      (HEAD:scripts/fuzzfail.sh:32,34 — this predates all Android work). Three
      faults: a repo script must never write the user's GLOBAL config; it restores
      a HARDCODED `true` rather than the user's prior value, so anyone who had it
      unset or false gets commit signing silently switched on for every repo they
      own; and an interrupt between the two leaves signing globally OFF.
      Use `git -c commit.gpgsign=false ...` on the individual commands, or set
      GIT_CONFIG_GLOBAL for the subshell, or a repo-local config. Never a global
      write.

      While here: `make clean` and .gitignore both miss the `tmpdir92.*` prefix
      that LW-M1-11's mktemp scratch dirs use, so an interrupted run leaves
      multi-GB directories that show up as untracked for everyone. One was found
      holding 4.6GB. You do not own the Makefile or .gitignore — report what they
      need.
    acceptance:
      - "`make fixfuzz` regenerates a .nofuzz for at least one genuinely fuzzy patch, proven by running it"
      - "no script writes the user's global git config under any code path, including error paths"
      - "an interrupted run leaves the user's git config exactly as it found it"
      - "./scripts/check-patchfail.sh still exits 0"
    verify: "! grep -rn 'config --global' scripts/ && ./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [shell]
    agent_safe: yes
    isolation: none
    risk: Right now make fixfuzz silently does nothing, and running it can flip a global git setting the user never chose.

  - id: LW-M1-15
    title: Make git-patchtree safe to run and Android-aware
    milestone: M1
    depends_on: [LW-M1-11]
    owns: [scripts/git-patchtree.sh]
    what: |
      FOUND BY LW-M1-11, which had to refuse to regenerate rather than write a wrong
      .nofuzz. git-patchtree.sh hardcodes `firefox-$(cat version)` in the repo root
      — the SAME directory `make dir` uses and other people read — and `rm -rf`s it.
      Three consequences: `make fixfuzz` destroys a tree someone may be building in;
      two fuzzfail runs collide there; and because it always rebuilds against the
      desktop tarball and the desktop `version` file, it cannot produce a correct
      .nofuzz for an Android patch at all.

      Give it a private scratch directory with a cleanup trap (check-patchfail.sh
      and fuzzfail.sh now both use `mktemp -d` under the repo root — follow that
      pattern, and note /tmp here is a 31GB tmpfs while the extract is 4.7GB, which
      is why they do not use $TMPDIR). Then teach it the target/version split so an
      Android patch regenerates against the ESR tarball, per LW-M0-07's model.

      Once this lands, remove fuzzfail.sh's refusal-to-regenerate guard — but that
      file belongs to LW-M1-11, so coordinate rather than editing it.

      RESOLVED — landed in commit 2e7dabe, recorded 2026-08-26. All four acceptance
      criteria are implemented in scripts/git-patchtree.sh: a private
      `mktemp -d "$repo_root/tmpdir92.XXXXXX"` with a cleanup trap (:483), the
      ./version vs ./version.android split with "both when they have diverged" refused
      rather than silently answered, and --use-desktop-tarball kept as the noisy
      escape hatch. LW-M1-16 subsequently made fuzzfail.sh forward --targets here
      rather than refuse to regenerate, so the guard this task was meant to lift is
      already lifted.

      Cost of not recording it: AGENTS.md's landmine L5 still read "Still open ...
      LW-M1-15 owns the fix", that sentence was quoted into an agent brief as a live
      blocker, and a coder spent a cycle on a script that needed no changes — then
      reported it "fixed, concurrency-safe" having made zero modifications. The board
      having no status field is what let a completed task read as open.
    acceptance:
      - "running it never touches firefox-$(cat version) in the repo root"
      - "two concurrent runs both succeed"
      - "an android patch regenerates against the ESR tarball and version.android"
      - "`make fixfuzz` still works for desktop exactly as before"
    verify: "make -n fixfuzz && ./scripts/check-patchfail.sh"
    effort_h: "2-4"
    skills: [shell]
    agent_safe: yes
    isolation: none
    risk: Today `make fixfuzz` can delete a 4.7GB tree someone else is mid-build on, with no warning.

  - id: LW-M1-14
    title: Fix the malformed hunk headers in always-fetch-latest-toolchain
    milestone: M1
    depends_on: []
    owns: [patches/always-fetch-latest-toolchain-artifact.patch]
    what: |
      FOUND BY LW-M1-10, verified twice. Both hunks in this patch declare line
      counts that do not match their bodies:
        @@ -9,8 +9,9 @@     declares old=8  new=9   body is old=9  new=10
        @@ -452,28 +452,30 @@ declares old=28 new=30  body is old=15 new=17
      GNU patch tolerates it (it works from the body), so `make check-patchfail` is
      green and nobody has noticed. `git apply --check` fails hard:
      "patch fragment without header at :16", exit 128.

      That matters because it silently rules out every git-based tool on the patch
      set — including scripts/git-patchtree.sh, which is already in this repo — and
      because any strict diff parser that trusts hunk headers will mis-read the
      file. LW-M1-10's parser had to work around it by using ---/+++ adjacency.

      Regenerate the headers from the actual bodies. Do not re-diff against a
      different tree; the content is correct, only the counts are wrong. This is a
      DESKTOP fix as much as an Android one.
    acceptance:
      - "`git apply --check` succeeds against a tree containing the target file"
      - "GNU patch still applies it identically — same resulting file bytes"
      - "`./scripts/check-patchfail.sh` still exits 0"
      - "no other patch in the set has the same defect (check them all while you are here)"
    verify: "./scripts/check-patchfail.sh"
    effort_h: "1-2"
    skills: [shell]
    agent_safe: yes
    isolation: none
    risk: Low to fix, but while it stands no git-based patch tooling can be used on this repo at all.

  - id: LW-M1-13
    title: Stop applying the desktop pref-pane on Android builds
    milestone: M1
    depends_on: [LW-M1-10, LW-M1-12]
    owns: [scripts/librewolf-patches.py, assets/patches/desktop.txt, assets/patches.txt]
    what: |
      LIVE SCOPE BUG, found by LW-M1-10 and confirmed:
      `python3 scripts/librewolf-patches.py --no-execute --targets=android` applies
      patches/pref-pane/pref-pane-small.patch, which touches FIVE browser/ files
      (preferences/{jar.mn,preferences.js,preferences.xhtml,main.js} and
      browser/themes/shared/jar.inc.mn). It is applied from its own call site rather
      than from a list, so neither lint-patch-scope.py nor the target selection
      can see it — the same invisibility as landmine L4, in the one patch still
      outside the list mechanism.

      Worse, the flag that was supposed to control it is dead: `-P` /
      `--no-settings-pane` is parsed into `options.settings_pane` at
      librewolf-patches.py:39 and NEVER READ anywhere in the script.

      The four pref-pane file copies that follow it (category-librewolf.svg,
      librewolf.css, librewolf.inc.xhtml, librewolf.js into browser/) are
      unconditional too, and are L4-class out-of-patch mutations.

      Move pref-pane-small into desktop.txt like every other patch, move the four
      copies behind the same target check, and either wire up `--no-settings-pane`
      or delete it. Note LW-M1-10's checker models this patch as OUT_OF_LIST_TAIL
      and it shares four files with six list patches, so moving it changes the apply
      sequence — run check-patch-order.py after, and update its model.
    acceptance:
      - "`--targets=android` applies no browser/-only patch and performs no browser/ file copy"
      - "the desktop apply sequence is unchanged — same patches, same order"
      - "-P/--no-settings-pane either works or is gone"
      - "scripts/check-patch-order.py exits 0 and no longer needs an OUT_OF_LIST_TAIL for this patch"
    verify: "! python3 scripts/librewolf-patches.py --no-execute --targets=android 153.0esr 1 | grep -E '^\\*\\*\\* -> patch .*browser/|cp .*themes/browser'"
    effort_h: "2-3"
    skills: [python, shell]
    agent_safe: yes
    isolation: none
    risk: An Android build currently carries five desktop chrome files it cannot use, invisible to every scope check we have.

  - id: LW-M1-10
    title: Encode the patch-ordering constraints as a test
    milestone: M1
    depends_on: [LW-M1-01]
    owns: [scripts/check-patch-order.py]
    reads: [assets/patches/common.txt]
    what: |
      Four pairs share a file and only apply in one order:
      autoconfig-setEnv before profile-directory (prefcalls.js);
      firefox-in-ua before moz-configure (toolkit/moz.configure);
      fpp-canvas-fix before webgl-permission-common (ClientWebGLContext.cpp);
      mozilla_dirs before xdg-dir (nsXREDirProvider.cpp). Derive the constraints
      from the patch headers rather than hardcoding a list, then assert the order
      satisfies them.

      CRITICAL, from LW-M1-01: since the review, mozilla_dirs/xdg-dir is a
      CROSS-LIST pair — mozilla_dirs is common, xdg-dir is desktop. The constraint
      still holds because common.txt applies first, but a checker that compares
      positions only within a single list will not see the pair at all and will
      pass a genuinely broken ordering. Model the real apply sequence
      (common, then the target lists in order), not per-file position.
      scripts/enable-patch.sh already does this via applies_before() — read it.

      The workflow already calls this script when it exists (LW-M0-09 pre-wired it,
      blocking), so no cross-owner edit is needed.
    acceptance:
      - "test fails when any of the four pairs is swapped"
      - "test catches the cross-list mozilla_dirs/xdg-dir pair, verified by swapping it"
      - "test derives pairs from patch contents, so a new shared-file pair is caught automatically"
    verify: "python3 scripts/check-patch-order.py"
    effort_h: "3-5"
    skills: [python]
    agent_safe: yes
    isolation: none
    risk: Re-ordering during the split is easy and the resulting failure is a confusing mid-patch reject, not a clear error.

  - id: LW-M1-11
    title: Extend check-patchfail to the android target
    milestone: M1
    depends_on: [LW-M1-01, LW-M0-09, LW-M0-11]
    owns: [scripts/check-patchfail.sh, scripts/fuzzfail.sh]
    what: |
      scripts/check-patchfail.sh walks assets/patches.txt. Teach it to take a
      target and walk the right list(s), so `check-patchfail --targets=android`
      reports Android-relevant rejects only. Same for fuzzfail.sh. Keep the
      no-argument behaviour identical for desktop builders.

      ALSO FIX THE CONCURRENCY BUG, found the hard way during the M1 wave:
      check-patchfail.sh hardcodes `tmpdir92` and `rm -rf`s it on start, so two
      concurrent runs destroy each other's tree — one agent had to run the script
      from a private workspace to avoid corrupting another's. Use a unique
      directory (mktemp -d, or include $$) and clean it up on exit including on
      failure. Same for fuzzfail.sh if it shares the pattern.

      TWO THINGS FROM LW-M0-11, both load-bearing. (1) fuzzfail.sh:22-30 still has
      the L5 blind spot check-patchfail just lost — .rej-only detection, stderr
      uncaptured. Carry the same fix across: exit status authoritative, `2>&1`,
      `< /dev/null`. (2) check-patchfail now forwards `"$@"` verbatim to `patch`, so
      you MUST shift your own `--targets=...` argument off before the loop or patch
      will choke on it.
    acceptance:
      - "`./scripts/check-patchfail.sh` with no args behaves exactly as before"
      - "`--targets=android` reports on common+android only"
      - "exit code is non-zero when any patch in the selected set fails"
    verify: "./scripts/check-patchfail.sh && ./scripts/check-patchfail.sh --targets=android --use-desktop-tarball"
    effort_h: "2-3"
    skills: [shell]
    agent_safe: yes
    isolation: none
    risk: Changing default behaviour breaks the desktop rebase workflow maintainers run weekly.

  # ---------------------------------------------------------------- M2
  # Build bring-up. Mostly serial — this is the critical path.

  - id: LW-M2-01
    title: Get an unpatched arm64 GeckoView build green
    milestone: M2
    depends_on: [LW-M0-03, LW-M0-06]
    owns: [docs/android/BUILD.md]
    what: |
      Before any LibreWolf patch, prove the toolchain: extract the stock Firefox
      tarball, use assets/mozconfig.android, and get `./mach build` to completion
      for aarch64-linux-android inside the LW-M0-06 image. Record every deviation
      you needed (env vars, extra packages, mach bootstrap steps) in BUILD.md.
      This is the baseline every later failure is bisected against.
    acceptance:
      - "`./mach build` completes on a stock 153 tree"
      - "BUILD.md reproduces the result from a clean image in one documented sequence"
      - "build wall-clock and peak RAM recorded"
    verify: "manual: follow docs/android/BUILD.md on a clean machine and reach a completed build"
    effort_h: "8-16"
    skills: [android, shell, ops]
    agent_safe: yes
    isolation: worktree
    risk: Skipping the unpatched baseline means every later error is ambiguous between our patches and the toolchain.

  - id: LW-M2-02
    title: Build the common patch set on Android
    milestone: M2
    depends_on: [LW-M2-01, LW-M1-01]
    owns: [patches/android/build-fixes.patch]
    what: |
      Run `make dir TARGETS=common,android` and build. Every compile error is
      either a patch that was misclassified (send it back to LW-M1-01) or a real
      Android incompatibility that needs an android patch. Do not fix errors by
      dropping patches from common.txt without recording the reason — a dropped
      common patch is a parity loss and must be listed in the M5 parity matrix.
    acceptance:
      - "build completes with the full common patch set applied"
      - "every patch dropped or amended is listed with a reason in PATCH-SCOPE.md"
      - "no patch is disabled silently"
    verify: "manual: build log shows the full common list applied and mach exiting 0"
    effort_h: "16-40"
    skills: [c++, rust, android]
    agent_safe: yes
    isolation: worktree
    risk: The tempting fix for every error is to drop the patch; that quietly dismantles the parity goal.

  - id: LW-M2-03
    title: Produce a fat AAR from the three ABI builds
    milestone: M2
    depends_on: [LW-M2-02]
    owns: [scripts/android-fat-aar.sh, Makefile]
    what: |
      Build aarch64, armv7 and x86_64 (and decide on x86 — probably drop it) and
      merge them into a single AAR using the tree's own fat-AAR support
      (mobile/android/gradle, MOZ_ANDROID_FAT_AAR_ARCHITECTURES). Wrap it in a
      script and a `make android-aar` target. Record the per-ABI and merged build
      times — this number sets the CI budget in LW-M2-08.
    acceptance:
      - "one AAR contains all shipped ABIs"
      - "`make android-aar` reproduces it from a clean tree"
      - "a written decision on whether x86 (32-bit) ships"
    verify: "unzip -l geckoview-*.aar | grep -c 'jni/.*/libxul.so'"
    effort_h: "8-16"
    skills: [android, gradle, make]
    agent_safe: yes
    isolation: worktree
    risk: Per-ABI builds triple wall-clock; getting this wrong makes every later iteration painfully slow.

  - id: LW-M2-04
    title: Build an installable APK from the Fenix Gradle stage
    milestone: M2
    depends_on: [LW-M2-03]
    owns: [scripts/android-apk.sh, Makefile]
    what: |
      Feed the fat AAR into the in-tree mobile/android/fenix Gradle build and
      produce a debug-signed APK that installs and loads a page. Keep the app id
      and branding stock at this stage — LW-M4-07 changes them, and changing them
      now makes the first failure ambiguous.

      Add `--enable-android-subproject=fenix` to assets/mozconfig.android HERE, not
      earlier: mobile/android/moz.configure:85-100 shows it changes what the build
      produces, and LW-M0-03 deliberately left it off so M0-M1 stay a GeckoView-only
      build. You own that edit for this task.
    acceptance:
      - "APK installs on a device or emulator and loads https://redoubtbrowser.org"
      - "`make android-apk` produces it end to end"
      - "the APK's GeckoView is our build, verified via about:buildconfig"
    verify: "manual: adb install the APK, open about:buildconfig, confirm our mozconfig options"
    effort_h: "8-16"
    skills: [gradle, kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: Confirming "it opened" without checking about:buildconfig can validate a prebuilt GeckoView by accident.

  - id: LW-M2-05
    title: Enable --enable-appservices-in-tree and verify the search dumps
    milestone: M2
    depends_on: [LW-M2-02]
    owns: [assets/mozconfig.android, patches/android/appservices.patch]
    what: |
      Mobile search configuration is not read from services/settings/dumps the way
      desktop reads it — it comes from
      third_party/application-services/components/remote_settings/dumps/. Building
      application-services, nimbus-fml and uniffi from source is what makes those
      dumps ours to control, which LW-M4-06 depends on. Get the in-tree build
      working and confirm the dumps land in the APK.
    acceptance:
      - "build completes with --enable-appservices-in-tree"
      - "no prebuilt application-services artifact is downloaded during the build"
      - "the remote_settings dumps present in the APK come from the in-tree path"
    verify: "manual: build log shows application-services compiled, not fetched"
    effort_h: "6-12"
    skills: [rust, android]
    agent_safe: yes
    isolation: worktree
    risk: Without this the search config is Mozilla's and LW-M4-06 has nothing to modify.

  - id: LW-M2-06
    title: Add android-dir/build/package Makefile targets
    milestone: M2
    depends_on: [LW-M2-04]
    owns: [Makefile, assets/Dockerfile.android]
    what: |
      Mirror the desktop dir/build/package targets for Android:
      `android-dir` (extract + patch with TARGETS=common,android),
      `android-build` (mach build for the configured ABIs),
      `android-package` (fat AAR + Gradle + unsigned APK), plus
      `android-clean`. Keep them independent of the desktop targets so a machine
      can build one without the other.

      THREE THINGS FROM LW-M0-12, which stubbed android-run-build-job because it
      cannot work yet. (1) This host — and any Fedora/RHEL builder — runs SELinux
      Enforcing, so a podman `-v $(pwd):/output` mount is denied write access
      without a `:z` (shared) or `:Z` (private, relabels exclusively) suffix. The
      desktop docker-run-build-job deliberately was NOT changed, to keep existing
      docker users byte-identical; the Android run-job needs the label. (2) The
      artifact shape differs — desktop ends in `cp -v ./*.xz`, Android produces a
      GeckoView AAR plus an unsigned APK under obj-*/gradle/. (3) The image's
      /source is a clone of upstream codeberg, so these targets must land upstream
      before the run-job can see them.

      You also own assets/Dockerfile.android for this task, to fix two stale
      comments in it: :245 documents the run command as
      `make build-android package-android`, which contradicts the target names
      here, and :243 says assets/mozconfig.android does not exist yet. It does.
    acceptance:
      - "each target runs standalone from a clean checkout"
      - "desktop targets are unchanged"
      - "`make help` documents the new targets"
      - "android-run-build-job works under SELinux Enforcing, and the label choice is explained"
      - "the Dockerfile's documented target names match the ones you implement"
    verify: "make -n android-package"
    effort_h: "3-5"
    skills: [make]
    agent_safe: yes
    isolation: none
    risk: Entangling the android and desktop target graphs makes both slower and each break the other.

  - id: LW-M2-07
    title: Build the automated smoke-test harness
    milestone: M2
    depends_on: [LW-M2-04]
    owns: [scripts/android-smoke.sh, docs/android/SMOKE.md]
    what: |
      A scripted gate that installs the APK on an emulator and checks more than
      "it launched": page load, WebGL context creation (the L1 canary), a WebRTC
      getUserMedia probe, video playback, extension install, and a dump of ~30
      security-relevant prefs read back from about:config. Every M2+ task runs
      this before claiming done.
    acceptance:
      - "one command, exits non-zero on any failed check"
      - "includes a live WebGL check that fails if librewolf.webgl.prompt regresses"
      - "prints the pref dump as a diffable file"
    verify: "./scripts/android-smoke.sh --emulator"
    effort_h: "8-16"
    skills: [shell, android, kotlin]
    agent_safe: yes
    isolation: none
    risk: A weak smoke test is worse than none — it certifies broken builds as good.

  - id: LW-M2-09
    title: Make the Fenix unit suite runnable in the build container
    milestone: M2
    depends_on: [LW-M2-07, LW-M2-08]
    owns:
      - assets/Dockerfile.android
      - docs/android/BUILD.md
      - docs/android/fenix-test-allowlist.yaml
    what: |
      AGENTS.md now requires `./mach gradle fenix:testDebugUnitTest` to pass for any
      Kotlin-layer change, and it cannot cleanly: **libmegazord.so is absent from the
      container**, so ~90 tests fail with UnsatisfiedLinkError / NoClassDefFoundError
      regardless of what the patch under test does.

      Measured across two independent runs: LW-M4-10's baseline was 5434 tests /
      121 failed; after LW-M4-14's fix it is 5418 / 92. The 29-test delta is the
      real signal (31 fixed, minus 16 deleted, plus fork-ordering noise) and the
      remaining 92 are environmental. Every Kotlin task so far has had to hand-wave
      that residue, and the next one will have to re-derive the same explanation.

      Fix it properly: either build/ship the megazord native library in the image so
      the appservices-backed tests run, or maintain a documented expected-failure
      allowlist that the harness subtracts, so a task's report can state a clean
      pass/fail. An allowlist is acceptable but must be a checked-in list with the
      reason per entry, not a number in a comment — a count drifts silently.

      Until this lands, "the unit tests pass" means "no NEW failures beyond the
      documented residue", and every task has to prove that by differencing against a
      baseline it ran itself. That is expensive and error-prone, which is why this
      exists.

      RESOLVED 2026-08-25. Allowlist, not a shipped library — and the reason is
      structural, not effort: libmegazord.so is a cross-compiled *Android* ELF, so
      the host JVM cannot load it at all. A host-native build would need a separate
      appservices target the tree does not configure. Shipping it in the image was
      never on the table.

      Measured against the current objdir and independently reconfirmed from the
      JUnit XML rather than from a run log: 5418 tests, 90 failed, 87 environmental
      across 3 classes, 3 real. Every count matches.

      Two corrections to what first landed.

      (a) The allowlist was prose. This entry asks for a list "that the harness
      subtracts", and nothing subtracted it — a maintainer had to eyeball a
      `uniq -c` against a markdown table. It is now
      docs/android/fenix-test-allowlist.yaml plus `board.py --check-fenix-tests`,
      which reads the JUnit XML rather than the console log. A log is only as good
      as whoever remembered to tee it, and a grep over a log that was never captured
      prints nothing — which is exactly what a clean run prints.

      The gate's sharpest rule is the one that was not obvious: a listed class that
      DID NOT RUN AT ALL is an error, not a pass. A partial run — one class, an
      aborted task, the wrong Gradle module — contains nothing beyond the allowlist
      precisely because it barely ran, and the first draft printed "ok" for it.

      (b) The error type is not a stable key. The evidence file recorded
      NoClassDefFoundError for the 16 ReviewPrompt tests; the XML for that same run
      says UnsatisfiedLinkError for all 16, with UniffiLib in the stack rather than
      in the type. Both are one failure at different points in a JVM's life:
      mobile/android/fenix/app/build.gradle sets forkEvery = 80, so the first touch
      in a fresh JVM raises UnsatisfiedLinkError and any later touch in that JVM
      raises NoClassDefFoundError. Which one a test reports depends on where the
      80-test fork boundary falls, and that moves whenever the patch set changes the
      test count — it already moved between the LW-M4-14 baseline (5435) and this
      run (5418). An allowlist keyed on error type would go red on a rebase that
      changed nothing. Keyed on class name.

      Left open deliberately: DefaultDistributionProviderCheckerTest is a NEW real
      failure since the LW-M4-14 baseline (2026-08-22) and nobody has bisected which
      patch caused it. It is in known_real so the gate is usable, not because it is
      understood. LensCameraFragmentTest and HomeSettingsFragmentTest predate it.
    acceptance:
      - "`./mach gradle fenix:testDebugUnitTest` reports a clean result, or a documented allowlist makes it one"
      - "the allowlist, if used, is checked in with a per-entry reason"
      - "BUILD.md tells a maintainer how to run the suite and what a clean result looks like"
    verify: "python3 docs/android/board.py --check-fenix-tests"
    effort_h: "4-8"
    skills: [gradle, android, ops]
    agent_safe: yes
    isolation: none
    risk: A required gate that cannot return a clean answer trains people to ignore it — the exact failure mode the ratchet in --check-policies exists to avoid.

  - id: LW-M2-08
    title: Add caching and the real build job to CI
    milestone: M2
    depends_on: [LW-M2-03, LW-M0-09, LW-M0-16, LW-M2-06]
    owns: [.github/workflows/android-test.yaml, assets/Dockerfile.android]   # 2026-09-05: was .forgejo/ -- the repository is on GitHub and that copy is dead (android-test.yaml header)
    what: |
      Add sccache (or the tree's ccache support) and artifact caching so an
      incremental Android build fits the runner budget, then extend
      android-test.yaml with a real build job.

      MEASURED BY LW-M2-01 on a stock single-ABI aarch64 build, 32-core/62GB host
      that was NOT idle: `./mach build -j16` = 21m56s, objdir 21GB, disk 25.6GB
      read / 53.0GB written. **Peak container memory 37.97GB, peak anonymous
      30.88GB.** Memory is the binding constraint, not CPU — efficiency was only
      42%. Size the runner on RAM, and note LW-M2-03's three-ABI fat AAR multiplies
      this. The build is also NOT hermetic: mach runs Gradle
      (config/baseconfig.mk:46,57-59), which downloads Gradle 9.5.1 and the whole
      Maven graph, so the Gradle cache needs its own caching story.
    acceptance:
      - "warm CI build completes inside the runner timeout, with the measured number recorded"
      - "cache is keyed on the mozconfig and toolchain versions, not just the branch"
      - "a cache miss degrades to a slow build, never to a wrong one"
    verify: "manual: two consecutive CI runs, second one warm, times recorded in the PR"
    effort_h: "6-12"
    skills: [ops, shell]
    agent_safe: yes
    isolation: none
    risk: A stale cache keyed too loosely ships artifacts built from the wrong toolchain.

  # ---------------------------------------------------------------- M3
  # Pref delivery. This is where LibreWolf's identity actually reaches Android,
  # and the part with no desktop precedent to copy.

  - id: LW-M3-01
    title: Split librewolf.cfg into common/desktop/android
    milestone: M3
    depends_on: [LW-M1-01]
    submodule: settings
    owns:
      - settings/librewolf.cfg
      - settings/common.cfg
      - settings/desktop.cfg
      - settings/android.cfg
    what: |
      settings/librewolf.cfg is 763 lines: 178 defaultPref, 60 lockPref, 26 bare
      pref, 2 clearPref, 1 setEnv, and 12 librewolf.* prefs. Split it three ways.
      (Since the Firefox 157 merge common.cfg + desktop.cfg carry 272 defaultPref,
      80 lockPref, 25 bare pref, 2 clearPref, 2 setEnv and 13 librewolf.* prefs;
      board.py CFG_EXPECTED records the current totals.)
      Known desktop-only sections: lines 73-79 (sanitize-on-shutdown —
      Sanitizer.sys.mjs is desktop-only) and lines 253-254
      (privacy.window.maxInnerWidth/Height). NOTE the stated reason for the latter
      was wrong in mechanism, though the conclusion held: they are NOT read only by
      desktop code — they are StaticPrefs read in core DOM at
      nsContentUtils.cpp:3036-3047, and one caller of
      CalcRoundedWindowSizeForResistingFingerprinting is shared toolkit
      (nsWindowWatcher.cpp:2446, reachable from window.open() with an explicit
      size). They stay desktop because the cap never binds on a phone and
      LibreWolf's value is LOOSER than Gecko's 1400x900 default, so Android keeps
      the tighter Mozilla cap. Moving them back to common is safe if anyone
      disagrees. Note
      that privacy.resistFingerprinting.letterboxing at :255 ships FALSE on
      desktop, so it is not a parity item; do not list it as one. Every moved pref
      needs a one-line reason.
    acceptance:
      - "common.cfg + desktop.cfg reproduces today's librewolf.cfg semantically (same effective prefs on desktop)"
      - "every pref in desktop.cfg has a stated reason it cannot apply on Android"
      - "counts recorded and matching: 272 defaultPref, 80 lockPref, 13 librewolf.* prefs (178, 60 and 12 before the Firefox 157 merge)"
    verify: "python3 docs/android/board.py --check-cfg-split && python3 docs/android/board.py --check"
    effort_h: "8-14"
    skills: [js, python]
    agent_safe: yes
    isolation: none
    risk: A desktop pref moved to common is inert; a common pref moved to desktop is a silent privacy regression on Android.

  - id: LW-M3-08
    title: Spike — make autoconfig itself work on Android
    milestone: M3
    depends_on: [LW-M1-09, LW-M2-04]
    owns: [docs/android/AUTOCONFIG-SPIKE.md, patches/android/autoconfig-resource-fallback.patch]
    what: |
      RUN THIS BEFORE LW-M3-02 BUILDS ANYTHING. If it succeeds, LW-M3-02 and
      LW-M3-03 shrink to almost nothing and landmine L2 largely dissolves.

      The plan assumed autoconfig is unreachable on Android. Tracing it exactly
      (LW-M1-09 found the packaging half, the rest verified against the tree) the
      blocker is ONE code path, not the mechanism:
        - nsReadConfig.cpp:170 loads prefcalls.js with isBinDir=FALSE, which uses
          `resource://gre/defaults/autoconfig/` — a resource: URI that resolves
          inside the APK. It already works, and
          mobile/android/installer/package-manifest.in:136 already packages
          `@BINPATH@/defaults/autoconfig/prefcalls.js`.
        - nsReadConfig.cpp:192 loads the actual .cfg with isBinDir=TRUE, which goes
          through NS_GetSpecialDirectory(NS_GRE_DIR) at :261. That is the dead end:
          nsXREDirProvider.cpp:390-395 returns nothing for NS_GRE_DIR under
          MOZ_WIDGET_ANDROID, commented "internal files are inside the APK, a zip
          file, so this folder doesn't really make sense."

      So the .cfg cannot be found, but everything else already works. Try making
      the isBinDir path fall back to `resource://gre/` when NS_GRE_DIR is
      unavailable, and package librewolf.cfg + local-settings.js into the Android
      manifest (note it is an explicit file list with no root wildcard, so each
      file must be named — PdfJsDefaultPrefs.js proves the defaults/pref channel
      works that way).

      WHY THIS MATTERS SO MUCH — and it is now stronger than when this task was
      written. `MOZ_DEFAULT_PREFS` as shipped carries no lock: `GeckoLoader` emits
      only bare `pref()` lines with no `locked` attribute (the parser does support
      the attribute — modules/libpref/parser/src/lib.rs:30 — but the channel never
      uses it). So the fallback plan cannot express the 38 `lockPref`s in common.cfg,
      and landmine L2's own prescribed mitigation is unavailable through that channel.

      Autoconfig's `lockPref` calls `Preferences::Lock` directly. If the .cfg is
      evaluated natively, locking works, Android ships the SAME file as desktop
      rather than a compiled derivative, and the 26 bare `pref()` calls keep their
      real user-branch semantics instead of being silently downgraded to defaults.
      If this spike succeeds it is not an optimisation — it is the difference
      between parity and approximation.

      Time-box it. If it does not work, say why precisely and hand LW-M3-02 the
      reason — a failed spike with a clear diagnosis is a good outcome here.
    acceptance:
      - "a definitive answer on whether librewolf.cfg can be evaluated natively on Android"
      - "if yes: a pref set only by the .cfg is observable in about:config on a real build"
      - "if yes: a lockPref'd pref demonstrably survives the Fenix settings screen that would otherwise overwrite it"
      - "if no: the exact failing call and why, written up for LW-M3-02"
    verify: "manual: pref dump from a running build, before and after opening settings"
    effort_h: "6-12"
    skills: [c++, android, js]
    agent_safe: yes
    isolation: worktree
    risk: Skipping this spike means building a whole cfg compiler and lock generator that may be unnecessary.

  - id: LW-M3-02
    title: Land the autoconfig channel on Android
    milestone: M3
    depends_on: [LW-M3-01, LW-M3-08]
    owns:
      - patches/android/autoconfig-resource-fallback.patch
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
      - docs/android/AUTOCONFIG-SPIKE.md
      - scripts/check-patch-order.py
    reads: [settings/common.cfg, settings/android.cfg]
    what: |
      REWRITTEN AFTER LW-M3-08 SUCCEEDED. This task was "write a compiler that
      turns librewolf.cfg into MOZ_DEFAULT_PREFS lines". That is no longer the
      plan, and building it would have been ~20 hours spent on the wrong thing.

      The spike proved autoconfig itself works on Android. Land it:
        1. patches/android/autoconfig-resource-fallback.patch — currently ON DISK
           but in NO list (declared pending in PATCH-SCOPE.md). It makes
           nsReadConfig's isBinDir lookup fall back to `resource://gre/` when
           NS_GRE_DIR is empty, which is the single dead end on Android
           (nsXREDirProvider.cpp:390-395 returns nothing there by design).
        2. Package librewolf.cfg and local-settings.js BY NAME in
           mobile/android/installer/package-manifest.in. It is an explicit file
           list with no root wildcard — PdfJsDefaultPrefs.js at :113 is the
           precedent, and prefcalls.js at :136 already ships.
        3. Declare the new ordering constraint in scripts/check-patch-order.py:
           xmas-common before autoconfig-resource-fallback, both touching
           lw/moz.build. The spike's verification confirmed check-patch-order
           flags this pair and demands it be declared.
        4. Remove the pending declaration from PATCH-SCOPE.md and fix its counts.

      TWO CORRECTIONS the spike's own artefacts still carry, fix them as you land:
      the patch comment claims isBinDir decides skipFirstLine — it does not
      (nsReadConfig.cpp:343 feeds `isEncoded` to that argument; isBinDir feeds
      isPrivileged only), and AUTOCONFIG-SPIKE.md section 12 says the patch is in
      android.txt when section 8 correctly says it is not.

      Until this lands, both check-patchfail runs pass VACUOUSLY with respect to
      that patch — nothing applies it, so a rebase would not notice it breaking.
    acceptance:
      - "the autoconfig patch is in assets/patches/android.txt, not merely on disk — both check-patchfail runs must actually apply it"
      - "librewolf.cfg and local-settings.js are packaged by name in the Android manifest"
      - "the xmas-common -> autoconfig-resource-fallback ordering constraint is declared in check-patch-order.py"
      - "a pref set only by librewolf.cfg is observable in about:config on a fresh profile of a RUNNING build"
      - "PATCH-SCOPE.md no longer lists the patch as pending and its counts agree with the lists"
    verify: "python3 docs/android/board.py --check-scope && python3 scripts/check-patch-order.py && ./scripts/check-patchfail.sh --targets=android --use-desktop-tarball"
    effort_h: "8-14"
    skills: [python, js]
    agent_safe: yes
    isolation: none
    risk: Silently skipping a construct it cannot parse drops prefs with no error — fail loud, always.

  - id: LW-M3-03
    title: Decide what remains of the MOZ_DEFAULT_PREFS channel
    milestone: M3
    depends_on: [LW-M3-02, LW-M2-04]
    owns:
      - docs/android/AGENTS.md   # the L2 precedence table is this task's deliverable
    tree_paths:
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Core.kt
    what: |
      GeckoLoader.java:83-103 reads MOZ_DEFAULT_PREFS at startup, BEFORE the
      profile and before Fenix's own runtime Pref.commit() calls. Ordering matters
      and every earlier draft of this plan had it backwards: defaultPref survives
      startup, but anything Fenix writes at runtime overwrites a defaultPref — so
      lockPref is mandatory for those. Wire the LW-M3-02 startup artifact into the
      GeckoRuntimeSettings construction and confirm with a pref dump.

      RESOLVED 2026-08-25 — and the answer is NOTHING. Do not wire the channel.
      patches/android/pref-delivery.patch is cancelled, not deferred; the row for it
      in patches/android/README.md should go.

      This entry's framing was written before LW-M3-08 ran and is now wrong in its
      premise. It says "wire the LW-M3-02 startup artifact into the
      GeckoRuntimeSettings construction". Four measured facts kill that:

      (a) NOTHING WE SET IS READ THAT EARLY. Autoconfig fires at
      nsAppRunner.cpp:6002. Of the 255 pref names across settings/*.cfg, none is read
      before that point — none is `mirror: once`, none is a javascript.options.*
      startup pref, none appears at a pre-autoconfig read site. The env channel buys
      us zero prefs today.

      (b) IT CANNOT BOOTSTRAP AUTOCONFIG ANYWAY. general.config.filename is read at
      Preferences.cpp:3933; MOZ_DEFAULT_PREFS is parsed at :3963 — the same function,
      thirty lines later. Putting general.config.filename in the env var means
      nsReadConfig is never constructed and autoconfig silently never runs. That is
      the one job the channel looked obviously suited for, and it cannot do it.

      (c) TEACHING IT TO LOCK WOULD BREAK US. The parser does accept the `locked`
      attribute in Default-kind data (parser/src/lib.rs:494-517) — the earlier claim
      that no such token exists was wrong and is corrected in settings/android.cfg.
      But a locked default arriving at stage 2 makes every later defaultPref a silent
      no-op: Pref::SetDefaultValue returns without writing when IsLocked()
      (Preferences.cpp:876-902), and common.cfg is overwhelmingly defaultPref. Only
      lockPref would still land, because prefcalls.js unlocks first. "Improving" this
      channel is a foot-gun aimed at most of LibreWolf's configuration.

      (d) IT IS NOT OUR CHANNEL. GeckoLoader populates it from
      RuntimeSettings.getPrefsMap() — every Pref<> GeckoView declares, ~77 names,
      emitted on every start whether or not anyone set them. Writing into it means
      contending with GeckoView for its own transport. Autoconfig runs later and wins
      cleanly (LW-M3-08 proved a lockPref'd value survives on a running build).

      Nothing in the LibreWolf overlay sets MOZ_DEFAULT_PREFS today — verified by
      grep over assets/, scripts/, patches/ and the Makefile. The correct outcome of
      this task is to keep it that way and write down why, which is done: AGENTS.md's
      L2 section now carries the five-stage precedence table this was derived from.

      What this task DID surface, and what actually matters, is that we are stage 4
      of 5 — GeckoView:ResetUserPrefs and ~65 Pref.commit() calls run AFTER autoconfig
      on every cold start, the latter from GeckoEngine.kt:1986-2074 with no user
      interaction. So an unlocked defaultPref is not safe on Android. That is
      LW-M3-04's mandate and it is now measured rather than estimated: 89 Pref<>
      declarations, 113 names in the reset universe, 36 of them constructed as
      ROOT + name + ".suffix" and therefore invisible to a literal grep.

      Upstream bug found in passing, worth reporting: GeckoLoader.escapeDoubleQuotes
      (.../gecko/mozglue/GeckoLoader.java:79-81) is a no-op — `replaceAll("\"",
      "\\\"")` returns its input under Matcher replacement semantics, confirmed by
      running it. Any pref name or String value containing a double quote emits
      malformed text, and the parser error-recovers by scanning to the next `;`,
      swallowing the rest of that pref. We do not use the channel, so it cannot bite
      us; it can bite GeckoView embedders who set a String pref from user data.
    acceptance:
      - "prefs from common.cfg are observable in about:config on first run, before any UI interaction"
      - "a pref Fenix sets at runtime is demonstrated to override an unlocked defaultPref (documents the need for LW-M3-04)"
      - "startup time regression measured and under 50ms"
    verify: "! grep -rqI --include='*.py' --include='*.sh' --include='*.patch' --include='*.mk' MOZ_DEFAULT_PREFS assets scripts patches && ! grep -q MOZ_DEFAULT_PREFS Makefile"
    effort_h: "6-12"
    skills: [kotlin, java, android]
    agent_safe: yes
    isolation: worktree
    risk: Getting the ordering backwards produces a build where prefs look right at startup and drift the moment the user opens settings.

  - id: LW-M3-09
    title: Fix the bare pref() calls that ResetUserPrefs wipes on Android
    milestone: M3
    depends_on: [LW-M3-02]
    submodule: settings
    owns: [settings/common.cfg, settings/android.cfg, docs/android/parity/bare-prefs.md]
    what: |
      FOUND BY LW-M3-08, and it is landmine L2b. Autoconfig now works on Android,
      but `GeckoView:ResetUserPrefs` fires at startup AFTER autoconfig has run and
      clears the USER branch — and a bare `pref()` in a .cfg writes the user branch,
      not the default one (prefcalls.js:12-18).

      Measured on the running build: only 16 of 25 bare `pref()` calls persisted.
      The clearest casualty is `browser.contentblocking.category`, which reads
      `standard` in about:config despite `pref(..., "strict")` at common.cfg:117 —
      i.e. Android silently gets Fenix's tracking-protection default instead of
      LibreWolf's. On desktop the same line works, so this is a genuine
      platform-specific privacy regression that no build error reveals.

      We ship 24 bare `pref()` calls in common.cfg. For each, decide: promote to
      `defaultPref` (survives, but is then overridable by the user, which for some
      of these is the intent), promote to `lockPref` (survives and beats Fenix, but
      over-locking makes visible settings toggles dead — see LW-M3-04's must-not-lock
      allowlist), or leave as `pref()` because being user-branch and resettable is
      genuinely what is wanted. Record the reason per pref.

      DESKTOP MUST NOT CHANGE. A bare `pref()` promoted to `defaultPref` changes
      desktop semantics too — the value stops being written to the user branch on
      every startup. Where the desktop behaviour is load-bearing, the promotion
      belongs in android.cfg with the bare `pref()` kept in common.cfg, not a
      blanket rewrite. `board.py --check-cfg-split` enforces the conservation
      counts, so it will catch a careless bulk edit.

      TWO THINGS THE VERIFICATION FOUND, both to fix before this is done.
      (1) docs/android/parity/bare-prefs.md claims a "controlled A/B, one variable"
      but the two APKs were not built from the same base — the recurring
      "a run labelled measured that was a different run than described" failure.
      Re-measure properly or restate the claim to match what was actually done.
      (2) The declared verify is VACUOUS, proven by execution:
      `board.py --check-cfg-split && android-smoke.sh --pref-dump` passes whether or
      not the fix works, because --pref-dump prints prefs without asserting any. The
      verify must assert the VALUE — browser.contentblocking.category must read
      LibreWolf's value on a running Android build, not merely appear in a dump.

      Note LW-M3-10 now owns the reason none of this reaches a device yet: the
      patcher copies common+desktop to every target, so android.cfg is not shipped.
      This task's fix is correct and currently inert; do not let that hide a
      measurement failure.

      STILL OPEN after the second attempt. The pref work is right; the WRITE-UP is
      not. docs/android/parity/bare-prefs.md attributes
      privacy.restrict3rdpartystorage.url_decorations to "downstream of the category
      lock" and says arm D isolates it — but the verifier found a contradicting run
      the agent had kept and excluded from the conclusion. That is the third variant
      of the same failure in this project: a measured-sounding claim built on a
      selected subset of the runs.

      Fix the attribution or state it as unresolved. An honest "we observed X and
      cannot yet explain it" is worth more than a mechanism that does not survive
      the agent's own data.

    acceptance:
      - "every one of the 24 bare pref() calls has a stated disposition and reason"
      - "the 9 measured casualties are fixed, verified on a running build not by reading"
      - "browser.contentblocking.category reads LibreWolf's value in about:config on Android"
      - "desktop's effective prefs are unchanged — proven, not asserted"
      - "python3 docs/android/board.py --check-cfg-split exits 0"
    verify: "python3 docs/android/board.py --check-cfg-split && ./scripts/android-smoke.sh --pref-dump"
    effort_h: "6-10"
    skills: [js, android]
    agent_safe: yes
    isolation: worktree
    risk: Android currently ships Fenix's tracking-protection default while the config says strict, and nothing warns.

  - id: LW-M3-10
    title: Ship the common+android cfg composition, not the desktop one
    milestone: M3
    depends_on: [LW-M3-02, LW-M3-09]
    owns: [scripts/librewolf-patches.py]
    what: |
      WAS A LIVE GAP; CLOSED 2026-08-21 in commit 75026bc — see the RESOLVED note at the
      end of this entry. As written: `scripts/librewolf-patches.py` did
      `cp -v ../../settings/librewolf.cfg .` UNCONDITIONALLY, and
      settings/librewolf.cfg is by construction `common.cfg + desktop.cfg`. So the
      autoconfig channel LW-M3-02 landed works perfectly — and delivers the DESKTOP
      composition to Android.

      Two consequences, both currently shipping:
        - everything in settings/android.cfg is absent. That includes LW-M3-09's
          L2b fixes (the lockPref overrides that stop ResetUserPrefs wiping
          browser.contentblocking.category) and LW-M3-06's policy translations
          (media.eme.enabled false, network.lna.block_trackers true). The Android
          build has none of them.
        - desktop-only prefs ARE shipped. The M3-02 verification observed
          `privacy.resistFingerprinting.letterboxing` present in about:config on
          Android, which is one of the prefs LW-M3-01 moved to desktop.cfg
          precisely because it is meaningless there.

      Compose per target: `common + desktop` for desktop (byte-identical to today's
      settings/librewolf.cfg — prove it), `common + android` for android. Note the
      fragments are concatenated and evaluated IN ORDER, so android.cfg's overrides
      must come after common.cfg's; that ordering is the whole mechanism by which
      the L2b fix works, and board.py --check-cfg-split rule C is written around it.

      Watch the first line: common.cfg starts with the sacrificial `null;` that
      autoconfig's skipFirstLine eats. Whatever you concatenate must keep exactly
      one of those at the top and none in the middle — --check-cfg-split rule E
      checks the fragments for this, but not your generated output.
      RESOLVED 2026-08-21 (commit 75026bc), recorded 2026-08-25 after a survey found
      three separate files still asserting the gap was open.
      scripts/librewolf-patches.py:398-401 now branches: android-only targets get
      `cat common.cfg android.cfg > librewolf.cfg`, everything else keeps the desktop
      composition. The extracted tree's lw/librewolf.cfg is 1119 lines with the
      ANDROID fragment beginning at :707.

      The stale citation is worth naming because it was copied forward twice: this
      entry, docs/android/parity/bare-prefs.md and settings/android.cfg all cited
      `librewolf-patches.py:376` as the unconditional copy. Line 376 is now a comment
      in an unrelated function. A line number quoted in three documents outlives the
      code it pointed at, which is an argument for citing the branch by name.

      Also corrected here: bare-prefs.md's headline row said "does any of this reach
      a device from make today? no" as late as its 2026-08-25 third pass. That pass
      was explicitly write-up-only, so it never revisited the delivery question and
      carried a four-day-stale "no" into a document whose whole purpose is to say
      what reaches a device.
    acceptance:
      - "the desktop tree's lw/librewolf.cfg is byte-identical to today's settings/librewolf.cfg"
      - "the android tree's is common.cfg + android.cfg, in that order"
      - "on a running Android build, a pref set only in android.cfg is observable in about:config"
      - "letterboxing and the other desktop-only prefs are ABSENT from the android build"
      - "python3 docs/android/board.py --check-cfg-split exits 0"
    verify: "python3 docs/android/board.py --check-cfg-split && ./scripts/android-smoke.sh --pref-dump"
    effort_h: "3-6"
    skills: [python, js, android]
    agent_safe: yes
    isolation: worktree
    risk: Every Android-specific pref decision made in M3 is currently absent from the build, and the desktop-only ones are present.

  - id: LW-M3-11
    title: Make the packaged librewolf.cfg actually evaluate on Android
    milestone: M3
    depends_on: [LW-M3-08, LW-M3-10]
    owns: [patches/android/autoconfig-resource-fallback.patch]
    what: |
      The autoconfig-resource-fallback.patch (LW-M3-08) is present in the build
      tree, MOZ_WIDGET_ANDROID is defined, and the `opened` log string is in the
      compiled libxul.so. Yet on both the debug and release APKs the MCD log
      (MOZ_LOG=MCD:5) shows:

        D/MCD general.config.filename = librewolf.cfg
        D/MCD evaluating .cfg file librewolf.cfg with obscureValue 0
        D/MCD error evaluating .cfg file librewolf.cfg 80520012

      with NO `opened resource://gre/defaults/autoconfig/...` line and the
      `Autoconfig is sandboxed by default` console warning. 0x80520012 is
      NS_ERROR_FILE_NOT_FOUND. The LW-M3-08 canary proof
      (lockPref("librewolf.cfg.version","8.6")) returns cfg_applied=false on
      both builds: the canary is unset, no lockPref from the .cfg is active,
      and privacy.resistFingerprinting is not true.

      LW-M3-08's AUTOCONFIG-SPIKE.md Proof 1 shows a different MCD trace (both
      `opened` lines at 0x0, no error) from a hand-composed .cfg with sentinel
      prefs. That trace is not reproducible on the current builds: the same
      code, the same omni.ja contents, the same MOZ_LOG level, produces a
      FILE_NOT_FOUND on the .cfg and no `opened` line at all. The spike's
      verdict ("YES, librewolf.cfg can be evaluated natively on Android") is
      not supported by the current evidence.

      Determine, on a running build, why openAndEvaluateJSFile returns
      NS_ERROR_FILE_NOT_FOUND for librewolf.cfg when fromResourceURI is true
      and the resource:// branch is taken. The spike's §2.1 established that
      NS_GetSpecialDirectory(NS_GRE_DIR) succeeds on Android (returns the APK
      lib/ dir), so the pre-patch file-branch failure is understood; the
      post-patch resource:// branch failure is not. The `opened` log line
      sits after channel->Open, so its absence means the failure is in
      NS_NewURI or NS_NewChannel, or the code is not reaching the resource://
      branch despite fromResourceURI=true (a build or preprocessor issue).
      Pin the exact failing call with MOZ_LOG evidence from a running build,
      then fix it.
    acceptance:
      - "on a running debug APK, MOZ_LOG=MCD:5 shows `opened resource://gre/defaults/autoconfig/librewolf.cfg: 0x0` and no `error evaluating` line"
      - "on a running release APK, the same two conditions hold"
      - "lockPref(\"librewolf.cfg.version\",\"8.6\") from the packaged .cfg is observable as a locked pref in about:config on both builds"
      - "a defaultPref from the packaged .cfg (e.g. privacy.resistFingerprinting true) is observable in the running build's prefs on both builds"
      - "no `Autoconfig is sandboxed by default` console warning in logcat on either build"
    verify: "adb logcat -d | grep -E 'D/MCD|Autoconfig' && ./scripts/android-smoke.sh --pref-dump"
    effort_h: "8-16"
    skills: [cpp, android, mozilla]
    agent_safe: yes
    isolation: worktree
    risk: Every M3 cfg-gated pref decision (android.cfg L2b locks, policy translations, privacy defaults) is inert on a running Android build until this is fixed.

  - id: LW-M3-04
    title: Generate the must-lock pref list from the Fenix sources
    milestone: M3
    depends_on: [LW-M3-03]
    owns: [scripts/gen-android-locks.py, docs/android/must-not-lock.txt]
    tree_paths:
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/ContentBlocking.java
    what: |
      Any pref Fenix writes at runtime must be locked or our value is transient.
      Glob GeckoRuntimeSettings.java AND ContentBlocking.java for Pref<> field
      declarations — around 50 hits including cookie behaviour, query stripping and
      tracking protection — plus the three SafeBrowsingProvider child trees. Emit
      the lock list. Maintain a must-not-lock allowlist for prefs the settings
      fragment legitimately exposes to the user; locking those makes visible
      toggles do nothing.

      EXTENDED 2026-08-27. The generated must-lock list was only half the job. The other
      half — deciding what to do about each pref — was being answered by a COMMENT.

      board.py --check-policies used to pass if the string "[ANDROID: LOCK]" appeared near
      the pref. So of the 26 GeckoView-declared prefs we ship on Android, 23 were
      effectively defaultPref and the gate was green over every one of them. The marker was
      never meant to be the answer — settings/common.cfg:53-56 says so outright: it "is a
      hint for LW-M3-04, which generates the authoritative list ... it is not a substitute
      for it". The gate had been treating the hint as the answer for as long as it existed.

      All 23 were classified against the code, each verdict adversarially re-checked
      (0 of 23 refuted). docs/android/must-not-lock.txt is now a decision register with
      three sections and a reason per entry, and --check-policies HARD ERRORS on any
      unlocked GeckoView-declared pref that is not classified. Tested in both directions.

      The alarming headline did not survive contact: 14 of the 23 are genuinely safe
      unlocked — no stage-5b writer reaches them, or the commit provably no-ops on the
      equality guard. One needed a real lock and got one (network.lna.block_trackers:
      overwritten every cold start, only a hidden debug switch as UI, so locking cost
      nothing). Eight are owned by a visible setting and must NOT be locked.

      THE FINDING THAT NEEDS ITS OWN TASK — OUR DoH CONFIG DOES NOT APPLY ON ANDROID.
      common.cfg:259-260 set network.trr.mode=5 and a quad9 URI. Both are overwritten on
      every cold start: Core.kt:190-191 -> GeckoEngine.kt:2032-2033 -> setTrustedRecursive
      Resolver{Mode,Uri} -> GeckoRuntimeSettings.java:2265/2323 -> commit(). The equality
      guard at RuntimeSettings.java:106 cannot short-circuit, because PrefWithoutDefault is
      built with super(name, null) (:186-187), so Fenix's OWN default (mode 0, empty URI)
      commits over ours. Verified by reading every link.

      Locking is NOT the fix: Settings > Privacy > DNS over HTTPS owns both prefs
      (preferences.xml:137-141 -> DohSettingsProvider.kt:94-110), so a lock would leave the
      provider list and custom-URL field interactive while silently discarding every
      choice. The fix is Fenix-side — change the default or hide the entry point — and it
      is not in any task's scope today. Both values currently leave DoH off, so this is a
      semantic loss rather than a live leak, but the .cfg lines are cosmetic on Android and
      have read as effective since M3.
    acceptance:
      - "generated list covers both Java files and the SafeBrowsingProvider trees"
      - "every entry on the must-not-lock allowlist names the settings UI that owns it"
      - "regenerating on an unchanged tree produces no diff"
    verify: "python3 scripts/gen-android-locks.py --check"
    effort_h: "6-10"
    skills: [python, kotlin]
    agent_safe: yes
    isolation: none
    risk: Over-locking breaks visible settings toggles; under-locking silently loses the pref on first settings open.

  - id: LW-M3-05
    title: Add a runtime pref-audit test with an expected-prefs baseline
    milestone: M3
    depends_on: [LW-M3-04, LW-M2-07]
    owns: [docs/android/expected-prefs.txt, scripts/android-pref-audit.sh]
    what: |
      Launch the app, exercise the settings UI (open every screen, toggle nothing),
      then dump the effective values of every pref we ship and diff against a
      checked-in baseline. This is the regression net for the whole M3 milestone
      and the thing that catches a Mozilla change quietly reverting one of our
      values on rebase. Run it in CI.
    acceptance:
      - "test fails when any shipped pref differs from the baseline"
      - "baseline is generated by a documented command, not hand-written"
      - "runs in CI on every PR"
    verify: "./scripts/android-pref-audit.sh"
    effort_h: "5-8"
    skills: [shell, android, kotlin]
    agent_safe: yes
    isolation: none
    risk: Without this, a rebase can revert a privacy pref and nothing notices until a user reports it.

  - id: LW-M3-06
    title: Map policies.json entries to Android equivalents
    milestone: M3
    depends_on: [LW-M3-01]
    owns: [docs/android/POLICIES.md, settings/android.cfg]
    submodule: settings
    reads: [settings/distribution/policies.json]
    what: |
      The policy engine does not exist on Android. Go through policies.json entry
      by entry — DisableTelemetry, DisableFirefoxStudies, HttpsOnlyMode,
      EncryptedMediaExtensions, the uBO ExtensionSettings preinstall — and for each
      state the Android mechanism: an equivalent pref, a Kotlin-layer change, or
      "no equivalent, here is the residual gap". The gaps feed the M5 parity matrix.
    acceptance:
      - "every policies.json key has a row with its Android mechanism or a stated gap"
      - "prefs that cover a policy are present in android.cfg"
      - "the uBO preinstall row points at LW-M3-07"
    verify: "python3 docs/android/board.py --check-policies && python3 docs/android/board.py --check-cfg-split"
    effort_h: "4-6"
    skills: [js, docs]
    agent_safe: yes
    isolation: none
    risk: Assuming a policy has an Android analogue without checking leaves a hole labelled "done".

  - id: LW-M3-07
    title: Preinstall uBlock Origin on Android
    milestone: M3
    depends_on: [LW-M3-06, LW-M2-04, LW-M6-11, LW-M7-07]
    owns:
      - patches/android/ubo-preinstall.patch
      - patches/android/ubo-readiness.patch
      - scripts/tests/test-ubo-readiness.js
      - assets/ubo-extension.json
      - scripts/fetch-ubo-extension.py
      - scripts/tests/test-ubo-extension.py
      - scripts/librewolf-patches.py
      - scripts/check-patch-order.py
      - docs/android/PATCH-SCOPE.md
      - docs/android/evidence/lw-m3-07/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/LibreWolfUboPreinstaller.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/LibreWolfUboPreinstallMiddleware.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Components.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Core.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/HomeActivity.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/LibreWolfUboPreinstallerTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/LibreWolfUboPreinstallMiddlewareTest.kt
      - mobile/android/android-components/components/support/webextensions/src/main/java/mozilla/components/support/webextensions/WebExtensionSupport.kt
      - mobile/android/android-components/components/support/webextensions/src/test/java/mozilla/components/support/webextensions/WebExtensionSupportTest.kt
      - mobile/android/fenix/app/src/main/res/values/strings.xml
      - mobile/android/fenix/app/src/main/assets/extensions/ublock_origin.xpi
      - mobile/android/fenix/app/src/main/assets/extensions/ubo-extension.json
      - toolkit/components/extensions/parent/ext-webRequest.js
      - mobile/shared/modules/geckoview/GeckoViewWebExtension.sys.mjs
      - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebExtensionController.java
      - mobile/android/geckoview/api.txt
    reads: [assets/uBOAssets.json, patches/custom-ubo-assets-bootstrap-location.patch]
    what: |
      Desktop preinstalls uBO via the ExtensionSettings policy. Android has no
      policy engine, so this is a Kotlin/addons-provider change: ship the XPI as an
      asset and install it on first run, or point the addon collection at ours.
      The librewolf.uBO.assetsBootstrapLocation pref from
      custom-ubo-assets-bootstrap-location.patch must keep working — check whether
      that patch is in common.txt and whether its code path is reachable on
      Android.

      REOPENED 2026-09-08 for the owner's feature-completeness goal. Replace the
      fabricated provider with a hash-pinned genuine XPI, ordinary Gecko-verified
      file installation and a narrow trusted local install-permission callback.
      Gate engine-session creation until first installation/reconciliation succeeds
      so incoming URLs cannot race protection. Persist successful initialization;
      preserve user removal, disabling and existing installations on later starts.
      Keep the Gecko filter-assets pref independent of the XPI installation path.
      The following dated findings describe the old patch, not completed work.

      NOT DONE — patch written, measured, and PARKED 2026-08-27. It is on disk and applies
      cleanly (check-patchfail --targets=android exit 0) with its ordering measured against
      four partners (docs/android/evidence/lw-m3-07/order-free.txt, byte-identical either
      way). It is deliberately in NO list: docs/android/PATCH-SCOPE.md's Pending section
      carries the declaration, so --check-scope warns about it by name on every run.

      Parked because shipping it would make a FALSE PRIVACY CLAIM, which is worse than the
      feature being absent. Three defects, each read out of the files:

      (a) WRONG ADD-ON ID. The patch declares uBlock0@uvrove.com. The real ID — used by this
      repo's own settings/distribution/policies.json:50 — is uBlock0@raymondhill.net. The
      made-up ID appears nowhere else in the project or upstream. scripts/android-smoke.sh
      hard-coded the SAME made-up ID, so the gate could never have gone green against genuine
      uBO and WOULD have gone green against an add-on carrying the invented one. The gate is
      corrected; the patch is not.

      (b) NO PAYLOAD. It reads webextensions/ublock_origin.xpi from the APK assets. No .xpi
      exists anywhere in the repo, nothing fetches one (scripts/update-ubo-assets.sh only
      rewrites uBO's assets.json — the filter-list config, not the extension), and the patch
      adds no packaging step: it touches four Kotlin/XML files and no build.gradle.

      (c) IT NEVER INSTALLS ANYTHING. LibreWolfAddonsProvider only decorates the AMO
      catalogue provider, and localUboAddon() returns an Addon carrying a fabricated
      Addon.InstalledState(enabled = true, supported = true). There is no installAddon or
      installWebExtension call in the patch. Today assetsExist() fails so nothing is offered;
      the moment anyone drops an XPI into assets/, the Add-ons UI reports uBlock Origin as
      installed and enabled with no content blocking behind it.

      To un-park: fix the ID, source and package a hash-pinned XPI (same supply-chain
      question as the tarball — see the GPG revocation finding), perform a real install on
      first run, then restore the assets/patches/android.txt line and the four
      REVIEWED_ORDER_FREE rows in scripts/check-patch-order.py, which are kept and still
      valid.

      Worth keeping in view: none of the ten gates caught any of this. They check that a
      patch applies, is registered, is ordered and is scoped — not that the asset it
      references exists or that the identifier it declares is real.
    acceptance:
      - "uBO is present and enabled on first launch with no network fetch from Mozilla's collection"
      - "librewolf.uBO.assetsBootstrapLocation is honoured on Android"
      - "the user can uninstall it (we preinstall, we do not force)"
      - "first navigation waits for real installation; errors are visible and retryable"
      - "ordinary add-on signature verification and untrusted permission prompts remain enforced"
      - "user removal and disabling survive restart and application upgrade"
      - "blocking, custom filter bootstrap and update behavior are verified on a built APK"
    verify: "./scripts/android-smoke.sh --check-ubo"
    effort_h: "8-14"
    skills: [kotlin, android, js]
    agent_safe: yes
    isolation: worktree
    risk: Pinning to Mozilla's addon collection reintroduces exactly the remote dependency we removed elsewhere.

  # ---------------------------------------------------------------- M4
  # De-Mozilla-ing the Kotlin layer. Highly parallel — each task owns its own
  # patch file and a disjoint set of Fenix subsystems.

  - id: LW-M4-01
    title: Remove Glean telemetry from the Fenix layer
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/no-glean.patch]
    what: |
      Gecko-level telemetry is already handled by the common
      disable-data-reporting patch, but Fenix has its own Glean integration in the
      Kotlin layer with its own upload path. Remove or neuter it. Prefer removing
      the dependency outright over setting an "enabled=false" flag — a flag is one
      upstream default flip away from shipping data. Verify with a network capture,
      not by reading code.
    acceptance:
      - "no outbound connection to incoming.telemetry.mozilla.org in a 10-minute capture covering first run and settings"
      - "the Glean dependency is absent from the APK, or its upload path is provably unreachable"
      - "build has no dead references to removed classes"
    verify: "./scripts/android-smoke.sh --network-capture > /tmp/cap.txt && ! grep -qE '(incoming\\.)?telemetry\\.mozilla\\.org' /tmp/cap.txt"
    effort_h: "8-16"
    skills: [kotlin, gradle, android]
    agent_safe: yes
    isolation: worktree
    risk: A disabled-by-flag Glean is one upstream default change away from shipping data from a privacy browser.

  - id: LW-M4-02
    title: Remove the Adjust install-attribution SDK
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/no-adjust.patch]
    what: |
      Fenix ships Adjust for install attribution. Remove the dependency and every
      call site, including the install-referrer receiver. This is a proprietary
      third-party SDK in a privacy browser and the removal must be complete, not
      configuration-gated.
    acceptance:
      - "no Adjust classes in the APK (verified by dexdump, not by grep on sources)"
      - "no INSTALL_REFERRER receiver in the merged manifest"
      - "build green with no stubs left behind"
    verify: "./scripts/android-smoke.sh --check-no-adjust"
    effort_h: "4-8"
    skills: [kotlin, gradle]
    agent_safe: yes
    isolation: worktree
    risk: Grepping sources misses transitively-included classes; check the built APK.

  - id: LW-M4-03
    title: Disable Nimbus experiments and the experimenter endpoint
    milestone: M4
    depends_on: [LW-M2-05]
    owns: [patches/android/no-nimbus.patch]
    tree_paths: [mobile/android/fenix/app/nimbus.fml.yaml]
    what: |
      Nimbus is the remote-config channel that decides feature flags at runtime,
      including the fission.webContentIsolationStrategy default that LW-M5-01
      fixes. Disable the remote fetch entirely and make the FML defaults the only
      source. Do not merely point it at a dead URL — a browser that periodically
      calls an experiment server is a fingerprinting surface even when the response
      is empty.
    acceptance:
      - "no request to any experimenter/nimbus endpoint in a 10-minute capture"
      - "FML-generated defaults still compile and are the effective values"
      - "no remote-settings collection for experiments is synced"
    verify: "./scripts/android-smoke.sh --network-capture > /tmp/cap.txt && ! grep -q experimenter /tmp/cap.txt"
    effort_h: "6-12"
    skills: [kotlin, rust, android]
    agent_safe: yes
    isolation: worktree
    risk: Leaving the fetch alive but empty preserves a periodic beacon and an upstream-controlled config channel.

  - id: LW-M4-13
    title: Finish the Nimbus removal — test casualty and the second client
    milestone: M4
    depends_on: [LW-M4-03, LW-M2-04]
    owns: [patches/android/no-nimbus.patch, patches/android/no-nimbus-toolkit.patch]
    what: |
      Corrective task from the skeptical verification of LW-M4-03, which proved the
      effective fission isolationStrategy is 2 on all four channels by building the
      tree's own nimbus-fml generator from vendored sources. Two real gaps remain.

      (1) TEST CASUALTY, unreported by the implementing task.
      mobile/android/fenix/app/src/test/java/org/mozilla/fenix/nimbus/NimbusSystemTest.kt
      imports `org.mozilla.fenix.experiments.maybeFetchExperiments` and has five
      tests asserting exactly the fetch behaviour the patch removes. They will not
      compile. Either update them to assert the new behaviour (better — a test that
      pins "we do not fetch experiments" is worth having) or remove them with a
      stated reason. Do not leave a build that cannot run its own unit tests.

      (2) THERE IS A SECOND EXPERIMENT CLIENT and the patch does not touch it.
      docs/android/POLICIES.md section 6 already flags it: `toolkit/components/nimbus`
      is added unconditionally at toolkit/components/moz.build:147, so the Gecko/JS
      Nimbus (ExperimentAPI.sys.mjs and friends) is built on Android too. The patch
      addressed only the Kotlin/FML client. Determine whether the JS side can fetch
      or sync anything on Android — note LW-M1-01 deliberately kept
      `app.shield.optoutstudies.enabled` in common.cfg BECAUSE
      toolkit/components/nimbus reads it — and close it if so, in
      patches/android/no-nimbus-toolkit.patch.

      Prove the no-network claim by capture, not by reading: acceptance line 1 of
      LW-M4-03 ("no request to any experimenter/nimbus endpoint in a 10-minute
      capture") is still unmet by measurement. An APK now exists (LW-M2-04), so
      this is finally testable.
    acceptance:
      - "the Fenix unit test suite compiles and NimbusSystemTest either passes or is gone with a reason"
      - "a 10-minute capture from first run shows no experimenter/nimbus request — observed, not inferred"
      - "a stated, evidenced answer on whether toolkit/components/nimbus can reach the network on Android"
      - "the effective fission isolationStrategy is unchanged from 2 by this task, or the change is justified"
    verify: "./scripts/check-patchfail.sh --targets=android --use-desktop-tarball"
    effort_h: "4-8"
    skills: [kotlin, js, android]
    agent_safe: yes
    isolation: worktree
    risk: A half-removed Nimbus leaves a second live experiment channel while the docs claim experiments are off.

  - id: LW-M4-04
    title: Remove the Socorro crash reporter and its upload path
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/no-crashreporter.patch]
    what: |
      Remove the Mozilla crash-reporting integration in the Kotlin layer and
      confirm the Gecko-side reporter is off in the Android build. Decide and
      document whether LibreWolf offers any crash reporting at all — the honest
      default is none, with a documented manual logcat route for bug reports.

      ORDERING WORK THIS TASK MUST FINISH, and it is currently the only thing
      keeping `scripts/check-patch-order.py` red. no-crashreporter.patch shares
      files with three patches that are already an ORDERED chain
      (no-adjust -> no-glean -> no-gms), so its position in that chain is a real
      question, not a formality. Read your own hunks against theirs and either add
      CONSTRAINTS rows fixing your position, or REVIEWED_ORDER_FREE rows with the
      reason the regions cannot collide. The checker prints the row to paste.
      Do not resolve it by deleting a row.

      Two of your other pairs are already classified as order-free: against
      about-config (:120-127 vs your :7-25 and :71-84) and isolated-process
      (:131-139 vs the same) — three disjoint regions of GeckoProvider.kt. Those
      were done for you so the rest of the batch had a clean baseline; the
      build.gradle ones were not, because they are not obviously disjoint.
    acceptance:
      - "no crash upload to crash-reports.mozilla.com under an induced crash"
      - "the decision on LibreWolf-side crash reporting is written down"
      - "a crash still produces something a user can attach to a bug report"
    verify: "manual: induce a content crash, capture network, confirm no upload"
    effort_h: "4-8"
    skills: [kotlin, c++, android]
    agent_safe: yes
    isolation: worktree
    risk: Removing all diagnostics makes user bug reports unactionable; removing only the upload is the balance.

  - id: LW-M4-05
    title: Strip Play Integrity, Firebase and push messaging
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/no-gms.patch]
    what: |
      Fenix links Google Play services for Play Integrity (used by the addon
      collection and account attestation), Firebase Cloud Messaging (used by
      Firefox Sync push) and location services. Remove them so the APK has zero GMS
      dependencies — this is also a hard requirement for F-Droid inclusion
      (LW-M6-03). Sync push degrades to polling or is disabled; state which.
    acceptance:
      - "no com.google.android.gms references in the built APK"
      - "app functions on a device with no Play services installed"
      - "the Sync push degradation is documented and the UI does not promise push"
    verify: "./scripts/android-smoke.sh --check-no-gms"
    effort_h: "8-16"
    skills: [kotlin, gradle, android]
    agent_safe: yes
    isolation: worktree
    risk: A leftover GMS dependency disqualifies the build from F-Droid and breaks on de-Googled devices.

  - id: LW-M4-06
    title: Ship the LibreWolf search configuration on Android
    milestone: M4
    depends_on: [LW-M2-05, LW-M3-03, LW-M3-10, LW-M2-07]   # 2026-09-02: both done; serialises the two files this task now shares with them (librewolf-patches.py, android-smoke.sh)
    owns: [patches/android/search-config.patch, scripts/librewolf-patches.py, scripts/android-smoke.sh, docs/android/evidence/lw-m4-06/]   # 2026-09-02: the android-specific JSON was never needed -- the shared asset is copied by the patcher (android_search_config); the harness owns its --check-search half
    reads: [assets/search-config-v2.json, assets/search-config-icons.json]
    what: |
      librewolf-patches.py:107-112 replaces desktop's search-config-v2.json and
      icons and adds Mojeek. Android reads its search config from
      third_party/application-services/components/remote_settings/dumps/ instead,
      which LW-M2-05 made buildable from source. Produce the Android equivalent:
      same engine set, same default, Mojeek present, no Mozilla search partner
      codes.
    acceptance:
      - "the engine list on Android matches desktop's, including Mojeek"
      - "the default engine matches desktop's"
      - "no partner/attribution code in any search URL, verified from a real query"
    verify: "./scripts/android-smoke.sh --check-search"
    effort_h: "8-14"
    skills: [json, rust, android]
    agent_safe: yes
    isolation: worktree
    risk: Android silently falling back to Mozilla's dump ships partner codes from a privacy browser.

  - id: LW-M4-07
    title: Apply Redoubt branding and choose the applicationId
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/branding.patch, themes/android/]
    reads: [themes/browser, patches/pref-pane/category-librewolf.svg]
    what: |
      App name, launcher icons (adaptive, all densities), splash, the in-app about
      screen, and the applicationId. The brand colour is #00acff, from
      patches/pref-pane/category-librewolf.svg. The applicationId is a
      one-way decision — it is the identity users' installs are tied to and cannot
      be changed later without breaking every upgrade path. Recommend
      org.redoubtbrowser and get maintainer sign-off IN THIS TASK.
      IN-APP IMAGERY WAS MISSED, and a signed beta candidate shipped because of it.
      Found 2026-09-13 by inspecting the 2026-09-08 signed APK rather than the
      sources. Acceptance line 2 says "no Firefox or Mozilla trademark in the app
      name, icon, or store listing" -- the launcher icon and app name were correct,
      so the line was satisfied as written, and the app was still full of Mozilla
      marks:

        * the home screen's wordmark is the full-colour Firefox flame
          (ic_wordmark_logo) with the word "Firefox" beside it
          (ic_wordmark_text_normal). Both nodes render on the home screen.
        * ic_firefox, expressive_firefox, firefox_icon, mozac_ic_logo_firefox_24
          and firefox_pictorgram_shield_check_rgb_2 are Mozilla's logos.
        * EIGHT alternative app icons ship with a Settings picker, including the
          classic 2004 Firefox logo and the flame -- so a user could set their
          launcher icon to the Firefox logo on a browser called Redoubt.

      Why no gate caught it: none of them looks at images. LW-M4-12's
      --check-strings cleaned the string table and the rendered settings text and
      passes honestly -- re-checked, only six Firefox mentions survive and all are
      documented exceptions. It has no view of drawables, and --check-scope,
      check-patch-order and check-patchfail care whether patches apply, not what
      they contain.

      FIXED: 76 replacements generated by scripts/gen-android-brand.py, checked in
      under assets/android-brand/, copied over the originals by
      librewolf-patches.py android_brand_images() -- which asserts every
      destination exists first, because a cp into a renamed path would succeed,
      change nothing, and ship the Firefox art with every light still green.
      scripts/android-brand-check.py is the new gate and runs in CI after `make
      dir`; it fails when upstream adds brand art the replacement set does not
      cover, which is the failure that matters on a rebase.

      Read acceptance line 2 as covering IMAGERY, not just the launcher icon and
      the name.
    acceptance:
      - "applicationId decided, signed off, and recorded in docs/android/TRACK.md"
      - "no Firefox or Mozilla trademark in the app name, icon, or store listing"
      - "icons render correctly on API 26+ adaptive and legacy launchers"
    verify: "manual: install and inspect the launcher icon, app name, and about screen"
    effort_h: "8-16"
    skills: [design, kotlin, gradle]
    agent_safe: no
    isolation: worktree
    risk: The applicationId cannot be changed after the first public release without abandoning every existing install.

  - id: LW-M4-08
    title: Apply the remote-settings blocker to the Android build
    milestone: M4
    depends_on: [LW-M3-03]
    owns:
      - patches/android/rs-blocker-android.patch
      - scripts/android-smoke.sh   # --check-no-remote-settings; stand off it elsewhere for this task
    reads: [patches/rs-blocker.patch]
    what: |
      Desktop's rs-blocker.patch plus librewolf.services.settings.allowedCollections
      and allowedCollectionsFromDump restrict which remote-settings collections
      sync. Confirm whether rs-blocker.patch is in common.txt and whether its code
      path is live on Android — Android has additional collections (the
      application-services ones) that desktop does not. Extend the allowlist to
      cover exactly the collections Android needs and no more.

      MEASURED BY THE BATCH-7 COMBINED CAPTURE, and it makes this task bigger than
      written. A first-run capture of an APK with all 13 android patches applied
      still shows **3 Remote Settings hosts, 14 events, with real TLS**:
      firefox.settings.services.mozilla.com, firefox-settings-attachments.cdn.mozilla.net
      and content-signature-2.cdn.mozilla.net. They are the single largest remaining
      component of the "zero outbound requests on first run" claim.

      THE REASON THE EXISTING PATCH DOES NOT COVER IT: rs-blocker.patch touches only
      services/settings/*.mjs (RemoteSettings.worker.mjs, RemoteSettingsClient.sys.mjs,
      RemoteSettingsWorker.sys.mjs, SharedUtils.sys.mjs, Utils.sys.mjs) plus
      SearchEngineSelector.sys.mjs — the JS stack. **Fenix uses the RUST
      RemoteSettingsService**, which that patch never reaches. So
      librewolf.services.settings.allowedCollections (common.cfg:698) is inert on
      Android for the collections Fenix actually syncs, and the desktop mechanism
      does not transfer. Plan for a Rust-side change, not an allowlist tweak.

      RESOLVED 2026-08-25. Rust-side, as this entry predicted. Three hunks in
      third_party/application-services/components/remote_settings/: fetch_changes()
      returns an empty Changes, sync() is a no-op, make_request() returns an error.
      make_request really is the single choke point for the client — all four call
      sites (client.rs:658 changeset, :675 root, :686 attachment, :699 cert) go
      through it, and service.rs's fetch_changes was the one path that built its own
      Request, which is why it needed a hunk of its own. Verified: no viaduct call
      remains in the crate outside #[cfg(test)].

      The server deliberately STAYS Prod. Pointing it at a dead URL is the obvious
      move and is strictly worse: client.rs:307 gates the packaged-dump path on
      is_prod_server(), which client.rs:715-721 implements as a literal prefix match
      against the production URL, so any Custom server silently disables every
      packaged dump and makes the browser MORE network-dependent.

      Four of the five collections Fenix uses are packaged in the binary
      (client.rs packaged_collections!: regions, search-config-v2,
      search-config-icons, search-telemetry-v2, plus three unused). The fifth,
      search-config-overrides-v2, has no dump and does not need one:
      components/search/src/selector.rs:57-60 only creates a client for it under
      `if apply_engine_overrides`, and SearchEngineSelectorRepository.kt:59 passes
      false. Checked in both files, not taken on trust.

      IT COMPILES — established during verification, not by the task, which shipped
      without a build. cargo check inside the build container: 10 warnings, 0
      errors, finished in 42.85s
      (docs/android/evidence/lw-m4-08/cargo-check-patched.txt). The warnings are
      dead-code/unused-import fallout and cannot break this build:
      build/moz.configure/rust.configure:797 adds -Dwarnings only under
      --enable-warnings-as-errors, and obj-x86_64/config.status:645 shows this tree
      builds with `--cap-lints warn`. A Rust patch nobody has built is precisely the
      failure --check-scope, check-patch-order and `patch --dry-run` all pass in
      silence.

      STILL UNPROVEN AT RUNTIME, and that is the real gap: no emulator in this
      environment, so --check-no-remote-settings has never run against a live debug
      APK and the 3 hosts / 14 events have not been re-measured. The gate is written
      and fails closed on a dead capture, but "the code path is gone and it
      compiles" is not the same claim as "the capture is clean". Whoever next has a
      device runs it.

      Consequence to state plainly rather than discover later: with sync dead, the
      packaged collections are frozen at whatever ships in the binary until the next
      release — search config, engine icons and region data no longer update
      out-of-band. That is the same posture desktop takes, and it is the point, but
      it means a stale search config is a release-cadence problem now, not a
      remote-settings problem.
      MEASURED 2026-09-06, on a device at last (the paragraph above says this was the
      real gap). An emulator run of --first-run-capture against a build carrying the
      current patch set recorded 10 outbound events before any navigation, all Remote
      Settings: firefox.settings.services.mozilla.com, firefox-settings-attachments
      .cdn.mozilla.net and content-signature-2.cdn.mozilla.net, 690 KB received.
      Evidence: docs/android/evidence/lw-m7-06/.

      That is NOT the blocker failing. Both halves are in the tree and working --
      rs-blocker-android.patch returns an error from the Rust make_request and an empty
      changeset from fetch_changes; the common rs-blocker.patch gates the JS client per
      collection. What reaches the network is what the allowlist ALLOWS: read off the
      running build, librewolf.services.settings.allowedCollections carries all 33
      desktop entries (security-state/*, main/tracking-protection-lists,
      blocklists/addons, ...) and allowedCollectionsFromDump all 11. The cfg layer is
      applied on Android -- that was checked in the same dump, not assumed.

      So acceptance line 2 is the whole remaining task, and it is a DECISION, not
      debugging: "the two librewolf.services.settings.* prefs have Android-correct
      values". They currently hold desktop's values because settings/common.cfg:709-715
      ships one list for both targets, and that file's own comment says "these two lists
      are Android's as well; LW-M4-08 owns their Android contents".

      Whoever takes this decides, per collection, whether Android should sync it at all,
      and writes the reason down. The consequence either way is already known: M4's
      headline claim -- no outbound request between install and first navigation
      (LW-M4-10) -- cannot hold while any collection is allowed to sync. Either Android
      ships a narrower list, or that claim is dropped and the honest number is published
      instead. It cannot be both, and BETA.md carries it as entry criterion E12.

      One more thing the capture named: FenixApplication.kt:736 registers a 2-HOURLY
      WorkManager sync ("DefaultRemoteSettingsChecker: Register sync work for Remote
      Settings", in logcat on every launch). Narrowing the allowlist does not stop the
      worker running; it stops it having anything to fetch.
    acceptance:
      - "a network capture shows only allowlisted collections syncing"
      - "the two librewolf.services.settings.* prefs have Android-correct values"
      - "blocking a needed collection is caught by the smoke test, not by users"
    verify: "./scripts/android-smoke.sh --check-no-remote-settings"
    effort_h: "4-8"
    skills: [js, android]
    agent_safe: yes
    isolation: worktree
    risk: Over-blocking breaks search config and addon blocklists; under-blocking leaves the telemetry-adjacent channels open.

  - id: LW-M4-09
    title: Enable about:config on release builds
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/about-config.patch]
    what: |
      VERIFIED: GeckoProvider.kt:123 reads
      `.aboutConfigEnabled(Config.channel.isBeta || Config.channel.isNightlyOrDebug)`,
      so about:config is off on release. LibreWolf users expect it on. Remove the
      channel gate. Keep the existing warning interstitial — the goal is access,
      not the removal of the safety copy.

      NOT DONE: the declared verify stays RED, reproduced independently —
      `./scripts/android-smoke.sh --check-aboutconfig` exits 1 against a
      release-configured APK. Either the patch does not achieve what it claims on a
      release build, or the check is wrong about what it is looking for. Settle
      which by opening about:config on a running release build by hand first, then
      make the automated check agree with that observation — in that order, so the
      check is not fitted to a broken build.
    acceptance:
      - "about:config reachable on a release-configured build"
      - "the warning interstitial still appears"
      - "editing a pref there persists across restart"
    verify: "./scripts/android-smoke.sh --check-aboutconfig"
    effort_h: "2-4"
    skills: [kotlin]
    agent_safe: yes
    isolation: worktree
    risk: Low — but it interacts with LW-M3-04 locks, which make some prefs visibly uneditable.

  - id: LW-M4-10
    title: Strip onboarding, promos and first-run network calls
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/no-onboarding.patch]
    what: |
      Fenix first-run includes onboarding cards, a default-browser prompt, a Mozilla
      account pitch, and pocket/sponsored content on the home screen. Remove them.
      The bar is a first run that makes zero network requests until the user types
      a URL — verify with a capture, not by clicking through.
    acceptance:
      - "zero outbound requests between install and the user's first navigation"
      - "no sponsored tiles or Pocket content on the home screen"
      - "no Mozilla account promotion in the first-run flow"
    verify: "./scripts/android-smoke.sh --first-run-capture"
    effort_h: "6-12"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: A single leftover call on first run is the most quotable failure a privacy browser can have.

  - id: LW-M4-14
    title: Fix the 31 Fenix unit tests that no-onboarding.patch breaks
    milestone: M4
    depends_on: [LW-M4-10]
    owns: [patches/android/no-onboarding.patch]
    what: |
      BLOCKER found by the skeptical verification of LW-M4-10, and measured rather
      than inferred: `./mach gradle fenix:testDebugUnitTest` over the six affected
      classes gives 188 tests completed, **31 failed**. Attribution is exact — the
      verifier reverse-applied ONLY no-onboarding.patch, leaving the five sibling
      M4 patches in place, and the same command gave BUILD SUCCESSFUL with 0
      failures; then re-applied it and confirmed all 8 touched files round-trip to
      identical md5s.

      The implementing report does not mention unit tests at all. This is the
      second time this exact casualty class has shipped: LW-M4-03 broke five tests
      in NimbusSystemTest and did not notice, which is why LW-M4-13 exists. The
      lesson clearly has not stuck, so the fix here is not just the 31 tests —
      add the unit-test run to the definition of done for any Kotlin-layer patch,
      and say in docs/android/AGENTS.md that "the build compiles" excludes tests
      unless you ran them.

      Fix the tests to assert the NEW behaviour where that is meaningful (a test
      pinning "no onboarding cards are shown" is worth having), and delete with a
      stated reason only where the behaviour is genuinely gone.

      VERIFIED 2026-08-22 on a full M4-patched tree (lw-m4-10/src under the
      librewolf-android-build image; JVM-only `./mach gradle fenix:testDebugUnitTest`,
      no device). All three acceptance lines, measured:
      (1) Full patch set applied: the six affected classes are green — SettingsTest
          103/0, ContinuousOnboardingFeatureTest 24/0, TermsOfUsePromptRepositoryTest
          15/0, ContentRecommendationsFeatureHelperTest 4/0, PocketMiddlewareTest 10/0,
          ReviewPromptMiddlewareTest 16/0 (172 tests, 0 failures). The patch deletes
          16 of the 188 original tests (onboarding removed, so they are no longer
          meaningful) and rewrites the survivors to assert the new behaviour.
      (2) Attribution re-checked the verifier's way — reverse-applying ONLY
          no-onboarding.patch with the five sibling M4 patches left in place: the same
          six classes are green on the upstream code (188 tests, 0 failures), and all
          14 touched files round-trip to identical md5s when the patch is re-applied.
          With only the main hunks present (test hunks not applied) the same six
          classes give 31 failures, so the 31 are caused by this patch's production
          change and fixed by its test hunks. The ~90-94 other failures in every run
          (UnsatisfiedLinkError 'megazord' / UniffiLib NoClassDefFoundError, e.g.
          SearchSuggestionsProvidersBuilderTest 70, ReviewPromptMiddlewareTriggerCriteriaTest
          16) are present with and without the patch: environmental, the residue
          LW-M2-09 documents, not caused by this patch.
      (3) AGENTS.md's definition of done names the unit-test run explicitly — "a Gradle
          build compiling is NOT the tests passing".
      Evidence in ~/lw-m4-14/evidence: runA-main-only.log, runB-full-patch.log,
      runC-reverse-applied.log, per-class XML (xml-runB/, xml-runC/), and
      md5-full-patch-applied.txt.
    acceptance:
      - "`./mach gradle fenix:testDebugUnitTest` passes for the six affected classes with the full M4 patch set applied"
      - "the attribution is re-checked by reverse-applying this patch alone, as the verifier did"
      - "AGENTS.md's definition of done names the unit-test run explicitly"
    verify: "manual: ./mach gradle fenix:testDebugUnitTest in a tree with the android patch set applied"
    effort_h: "3-6"
    skills: [kotlin, gradle]
    agent_safe: yes
    isolation: worktree
    risk: A patch set whose own unit tests fail cannot be rebased with confidence — the tests are the only thing that would catch an upstream behaviour change.

  - id: LW-M4-15
    title: Build and prove the toolkit Nimbus patch, or drop it
    milestone: M4
    depends_on: [LW-M4-13]
    owns: [patches/android/no-nimbus-toolkit.patch]
    what: |
      FOUND BY THE SKEPTICAL VERIFICATION OF LW-M4-13, from the APK itself: the JS
      patch was never built or run. The verifier unzipped `assets/omni.ja` out of
      the measurement APK and found `chrome/toolkit/res/nimbus/ExperimentAPI.sys.mjs`
      still in its UNPATCHED form, and the agent's own source tree carries zero
      LibreWolf markers in that file. So every probe that was said to exercise the
      second experiment client actually exercised stock code.

      The patch is supported only by static evidence (it applies clean, `node --check`
      passes). That is not nothing, but it is not what the task claimed.

      Either build an APK that genuinely contains it and re-run the probes, or drop
      the patch and record that the Gecko/JS Nimbus client is unaddressed — which is
      a legitimate outcome if it turns out it cannot reach the network on Android,
      but it must be demonstrated, not assumed. Note LW-M1-01 deliberately kept
      `app.shield.optoutstudies.enabled` in common.cfg BECAUSE toolkit/components/nimbus
      reads it, so "it is inert on Android" is not the default assumption.

      Also persist the evidence: the verifier found only the STOCK side of the
      decisive per-collection `adb run-as` differential survived on disk; the patched
      side rests on the agent's word alone.
    acceptance:
      - "omni.ja in the built APK contains the patched ExperimentAPI.sys.mjs — verified by unzipping it"
      - "the no-network probes are re-run against THAT build, not a stock one"
      - "both sides of the per-collection differential are persisted as artefacts"
    verify: "manual: unzip assets/omni.ja from the APK and grep the patched marker in ExperimentAPI.sys.mjs"
    effort_h: "3-6"
    skills: [js, android]
    agent_safe: yes
    isolation: worktree
    risk: The second experiment client is currently documented as closed and is not.

  - id: LW-M4-16
    title: Remove the two residual GMS strings so --check-no-gms passes
    milestone: M4
    depends_on: [LW-M4-05]
    owns: [patches/android/no-gms.patch]
    what: |
      LW-M4-05's own verify does not pass, and the implementing agent honestly did
      not claim it did: `./scripts/android-smoke.sh --check-no-gms --apk <apk>` exits
      1 with "2 distinct GMS strings ... and 0 apk entries". Acceptance line 1 ("no
      com.google.android.gms references in the built APK") is literally unmet.

      Note the gate was NOT softened to accommodate this — scripts/android-smoke.sh
      predates the task's work window by hours and still requires total==0. That is
      the right outcome: the harness held.

      Identify the two survivors, determine whether they are live code paths or
      inert strings (a class name in a manifest attribute, a ProGuard rule, a
      resource), and either remove them or — if they are provably unreachable —
      make the check's contract explicit about what it counts and why those two are
      acceptable. Do NOT simply relax the threshold to 2; a gate that moves to meet
      the code is not a gate.

      This matters beyond tidiness: zero GMS is a hard requirement for F-Droid
      inclusion (LW-M6-03).

      STILL OPEN, and the proposed fix must NOT be applied as offered. The
      skeptical verification produced a CONCRETE FALSE PASS from it:
      /home/mgysin/lw-m4-16/android-smoke-no-gms.diff introduces `_DEX_INSN_WIDTH`,
      a linear-sweep disassembler whose opcode width table is wrong, so the reader
      scan desynchronises and can report a clean APK that is not. It also gates the
      scan on dex files whose STRING TABLE contains a GMS literal — 1 of 36 dexes on
      the combined APK.

      That is precisely the failure this task's brief warned against: a gate that
      moves to meet the code is not a gate. The honest options remain (a) remove the
      two survivors, or (b) keep them and have the check name them individually with
      the reason each is unreachable. A hand-rolled dex disassembler is neither, and
      it converts a currently-honest red into a possibly-dishonest green.

      SECOND ATTEMPT ALSO FELL SHORT, in a more interesting way. Route (a) was
      correctly established as unavailable — the two survivors are the static-field
      VALUES of GMS_ACTION_PICK_IMAGES / GMS_EXTRA_PICK_IMAGES_MAX on
      androidx.activity's ActivityResultContracts$PickVisualMedia, and a complete
      dexdump of all 36 dexes (63,646 class records, verified against the per-dex
      header counts) shows zero const-string materialising either literal, zero
      sget/sput on either field, and no Lcom/google/android/gms/ descriptor
      anywhere. They are genuinely inert in the shipped version.

      But the proposed ALLOWLIST was broken with a real artefact. The verifier built
      an APK from androidx.activity 1.8.2 — the version where getGmsPicker is LIVE
      code that hands off to the Play Services photo picker — and that live path
      references NO gms descriptor at all; the two allowlisted strings are its only
      trace. So the unmodified gate correctly FAILS that APK while the proposed
      allowlist PASSES it. A dependency downgrade, or upstream reinstating the
      fallback, silently turns GMS back on with the gate green. A positive control
      (an unrelated GMS literal in a second dex) does fail correctly, so the
      allowlist is not vacuous — its blind spot is exactly one case, and it is the
      historically real one.

      HARDENING THE ALLOWLIST NEEDS: also assert the declaring class exposes no
      getGmsPicker/isGmsPickerAvailable member, or pin the androidx.activity
      version so a downgrade is itself a build failure. Either makes the exemption
      safe; naming the strings alone does not.

      AND NOTE THE ARTEFACT PROBLEM, now LW-M6-07: the "release build is provably
      zero-GMS" conclusion came from an APK that does not boot. R8 stripped the JNA
      field names Nimbus needs, so the gate was green because the classes were
      deleted. Re-derive any release-build GMS claim on a build that actually runs.

      CLOSED 2026-08-22 — the ground moved. The fresh full-patch-list release build
      (lw-fresh-2026-08-22, HEAD 5d8af8f) has GMS = 0: `--check-no-gms` passes on a
      build that boots (0 com/google/android/gms dex strings, 0 apk entries). The two
      residual strings this task existed to remove are gone, so the allowlist it was
      hardening is unnecessary — the gate now holds on its own, with no exemption and
      no threshold change. Satisfied on the reference artefact; see the 4-day report.

      THIRD ATTEMPT NEEDED. The second attempt landed NOTHING in
      patches/android/no-gms.patch and its headline claim was disproved twice over:
        - It concluded "the F-Droid artefact is already provably zero-GMS" because
          --check-no-gms exits 0 on the R8-minified RELEASE build. That build
          CRASHES ON LAUNCH, so the clean result is meaningless. Also
          scripts/android-apk.sh only ever runs `fenix:assembleDebug`
          (:694, :844 — `assembleRelease` appears nowhere), so the release APK is
          not what this repo builds.
        - Its proposed allowlist was BROKEN WITH A REAL ARTEFACT: the verifier
          dexed androidx.activity:activity:1.8.2 with the pinned container's d8 and
          built an APK carrying a live GMS reference the allowlist would pass.
      The debug APK the repo actually builds still fails with the same two strings.

      So both previous remedies would have produced a false green, by different
      routes. The task is unchanged and the constraint is now sharper: whatever you
      propose must be demonstrated against an APK that BOOTS, must be the artefact
      scripts/android-apk.sh actually produces, and must survive someone trying to
      smuggle a live GMS reference past it.

      RESOLVED 2026-08-25, and two things this entry used to say are now known to
      be wrong.

      (b) The brief offered "make the class check stricter" OR "pin the
      androidx.activity version" as if either alone made the exemption safe.
      Measurement says neither does:
        - the VERSION check alone is defeated by a forged marker — control nc2 is
          the real 1.8.2 dex carrying a marker claiming 1.13.0;
        - the CLASS check alone is vacuous on any minified build, because R8
          deletes the class and both literals outright, so the gate takes its
          unconditional-zero path and never asks about the version.
      Both, or neither is sound. They cover each other's blind spot and that is
      the argument for having both.

      (c) The old "CLOSED 2026-08-22 — GMS = 0" note was true only of the RELEASE
      artefact, and now demonstrably for the WRONG REASON: R8 had deleted the
      class. It read as vindication and was closer to the opposite — a release
      green says "R8 deleted it", not "the dependency is safe". That is the
      LW-M6-07 trap in miniature.

      THE FLOOR IS 1.10.0, NOT THE PINNED 1.13.0 — established by bisecting every
      stable androidx.activity from 1.8.0 to 1.13.0 plus the 1.10.0 prerelease
      series, parsing each class file's own member tables. GMS_ACTION_PICK_IMAGES /
      GMS_EXTRA_PICK_IMAGES_MAX plus getGmsPicker/isGmsPickerAvailable are live
      through 1.10.0-alpha01 and inert from 1.10.0-alpha02. Assuming 1.13.0 would
      have been safe but wrong: it would fail a legitimate 1.10–1.12 tree.

      Seven control APKs (5 negative, 2 positive) in
      docs/android/evidence/lw-m4-16/controls/, dexed with the pinned container's
      d8 — the same route that broke the previous allowlist.
    acceptance:
      - "./scripts/android-smoke.sh --check-no-gms exits 0 against a freshly built DEBUG APK (the variant scripts/android-apk.sh produces — a release green is not evidence, see below)"
      - "if any string is kept, the check documents precisely why it is unreachable"
      - "the threshold is not relaxed to make a failing build pass"
    verify: "./scripts/android-smoke.sh --check-no-gms --apk <path-to-built-apk>"
    effort_h: "2-4"
    skills: [kotlin, gradle, android]
    agent_safe: yes
    isolation: worktree
    risk: F-Droid inclusion requires zero GMS; shipping with two survivors means discovering this at submission.

  - id: LW-M4-11
    title: Disable search suggestions and the top-sites contile feed
    milestone: M4
    depends_on: [LW-M2-04, LW-M2-07, LW-M4-06]   # relaxed 2026-08-26: was [LW-M4-06]; re-added 2026-09-02 together with LW-M2-07 only to serialise the harness file the three now share
    owns: [patches/android/no-suggest.patch, scripts/android-smoke.sh, docs/android/evidence/lw-m4-11/]   # 2026-09-02: --check-no-suggest lives in the harness
    what: |
      Android defaults differ from desktop: search suggestions and the Contile
      sponsored top-sites feed are on. Match desktop's posture — suggestions off by
      default, contile removed entirely rather than switched off, since a switched
      off remote feed is still a code path an upstream default can revive.
    acceptance:
      - "typing in the URL bar produces no network request before Enter"
      - "no contile/sponsored tile request in any capture"
      - "the suggestion setting is still user-toggleable"
    verify: "./scripts/android-smoke.sh --check-no-suggest"
    effort_h: "3-6"
    skills: [kotlin]
    agent_safe: yes
    isolation: worktree
    risk: Search suggestions leak every keystroke; this is the highest-traffic leak in a stock Fenix.

  - id: LW-M4-12
    title: Localise the Fenix UI and strip Firefox branding from its strings
    milestone: M4
    depends_on: [LW-M2-04]
    owns: [patches/android/l10n-strings.patch, docs/android/L10N-ANDROID.md]
    reads: [l10n/, assets/l10n-pin.txt]
    what: |
      FOUND BY LW-M0-03 — a parity gap nobody owned. `--with-l10n-base` works on
      Android but covers almost nothing: mobile/android/locales/en-US holds only
      two .ftl files. The entire Fenix UI is localised through
      mobile/android/fenix/l10n.toml with `basepath = "."`, synced from
      mozilla-l10n/android-l10n into in-tree values-*/strings.xml. So the repo's
      l10n/ overrides and the pin from LW-M0-04 have ZERO effect on Fenix strings,
      and the shipped UI will say "Firefox" throughout. Desktop solves this with
      the appstrings.properties sed at librewolf-patches.py and the l10n/ overlay;
      Android needs its own mechanism. Decide it, build it, and pin the
      android-l10n source the same way LW-M0-04 pinned firefox-l10n.

      NOT DONE. Two concrete problems:
        - The declared verify does not run: `./scripts/android-smoke.sh
          --check-strings` exits 3, "NOT IMPLEMENTED and is not a pass". The report
          hands the stub to LW-M2-07, but the stub's own text names THIS task:
          "LW-M4-12. Needs a traversal of the whole Fenix UI, not a scrape of two
          screens". Implementing it is in scope here; LW-M2-07 owns the file, so
          agree the change with it rather than reassigning the work.
        - assets/patches/android.txt describes a DESIGN THAT WAS ABANDONED. Its
          l10n-strings entry says the patch adds "one `apply from:` line at the end
          of the root build.gradle" and that it shares that file with
          build-fixes.patch and no-gms.patch. The delivered patch touches no
          build.gradle at all. Fix the entry to describe what shipped.
    acceptance:
      - "no user-visible 'Firefox' or 'Mozilla' string in the Fenix UI on a built APK, verified from the running app not from grep"
      - "the android-l10n source is pinned and hash-verified, like assets/l10n-pin.txt"
      - "at least three non-en-US locales render correctly"
      - "L10N-ANDROID.md documents the mechanism and how to re-sync on rebase"
    verify: "./scripts/android-smoke.sh --check-strings"
    effort_h: "8-16"
    skills: [android, python, docs]
    agent_safe: yes
    isolation: worktree
    risk: Shipping Mozilla's strings verbatim puts their trademark in our UI and is the most visible possible sign the port is a reskin.

  # ---------------------------------------------------------------- M5
  # Security parity. The point of the whole project.

  - id: LW-M5-01
    title: Lock fission.webContentIsolationStrategy to isolate-high-value
    milestone: M5
    depends_on: [LW-M3-04, LW-M4-03]
    owns: [patches/android/fission-isolation.patch, settings/android.cfg]
    submodule: settings
    tree_paths:
      - mobile/android/fenix/app/nimbus.fml.yaml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Core.kt
    what: |
      VERIFIED AGAINST THE 153.0.4 TREE. Gecko's own default is
      fission.webContentIsolationStrategy = 1 (StaticPrefList.yaml:6660-6662).
      Fenix overwrites it with 0 (ISOLATE_NOTHING) on release: the FML default at
      nimbus.fml.yaml:521-529 is 0, raised to 2 only for the nightly and developer
      channels (:530-535), and Core.kt:207-208 applies the FML value
      UNCONDITIONALLY. The `shouldUseNimbus` flag (default false), whose
      description promises that StaticPrefList applies when it is off, is only
      honoured at GeckoProvider.kt:137 and only gates `.fissionEnabled()` — never
      the isolation strategy. Fix both call sites, not just the pref: a locked
      pref that Core.kt overwrites at runtime is landmine L2 all over again.
      Measure RAM and startup on a low-end device before choosing 1 over 2.

      STATUS 2026-08-22 (patch + decision + upstream report done; runtime
      verification parked under rule G):
      DECISION - locked to 2 (ISOLATE_HIGH_VALUE), not 1. Rationale: 1
      (ISOLATE_EVERYTHING) puts every site-origin in its own content process and
      costs more RAM and startup; on a 3-4 GB device 2 is the Android-tuned floor.
      2 also matches the no-nimbus FML default and the value android-components
      hardcodes for non-Fenix consumers (StaticPrefList.yaml:6658 comment). Gecko's
      own default is 1, but that is the desktop/stronger posture, not what a
      memory-constrained phone should ship by default.
      MECHANISM - patches/android/fission-isolation.patch hard-codes
      WebContentIsolationStrategy.ISOLATE_HIGH_VALUE at Core.kt:207-208, replacing
      the FxNimbus FML read. A constant cannot be lowered by a Nimbus experiment, a
      Fenix settings write, or an upstream default flip (same rationale as
      isolated-process.patch, LW-M5-02). This is the code-level guarantee for
      acceptance #2: Core.kt:207-208 has no remaining path that reads a lower
      value. Listed in assets/patches/android.txt after no-nimbus.patch. Divergence
      from no-nimbus.patch line 316 (which expected this patch to "share
      nimbus.fml.yaml"): it instead hard-codes in Core.kt - the only file it
      touches - so it is order-free with the rest of the set (measured:
      no-nimbus <-> fission-isolation both orders, 0 rejects; fuzz 0).
      UPSTREAM - the shouldUseNimbus/isolationStrategy inconsistency is drafted as
      a reproduction in docs/android/UPSTREAM-FIREFOX.md. PENDING owner sign-off and
      filing (per the M5 ground rules, public wording is not filed or published
      without sign-off); NO bug link recorded yet.
      PARKED (rule G - environment, not logic): acceptance #1 (value in
      about:config after settings), the runtime half of #2 (set the FML value to 0
      and show Core.kt still applies 2), and #3 (RAM/startup) all require a rebuild
      (multi-hour container build: android-fat-aar.sh pass 1 + android-apk.sh pass 2)
      plus a stable device. The only device here is a 3072 MB API-30 AVD (lw30),
      NOT a 4 GB device - say so and record what is measured, per the goal. Next
      steps: (a) rebuild with the 43-patch list and re-prove the artefact (patch
      list, fresh libxul, cfg canary); (b) on the AVD, drive about:config and read
      fission.webContentIsolationStrategy after opening settings; (c) attempt to
      lower it via a Nimbus/pref path and show it stays 2; (d) record
      cold-start ms + per-process RSS on the 3072 MB AVD, flagged as not the 4 GB
      target.
    acceptance:
      - "the effective value is 1 or 2 at runtime (justify which), verified in about:config after settings has been opened"
      - "Core.kt:207-208 can no longer lower it — verified by exercising the path, not by reading it"
      - "RAM and startup cost measured on a 4GB device and recorded"
      - "the shouldUseNimbus/isolationStrategy inconsistency is reported upstream as a bug, with the bug link recorded here"
    verify: "./scripts/android-smoke.sh --pref-dump | grep 'fission.webContentIsolationStrategy'"
    effort_h: "4-8"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: Process-per-site on a memory-constrained device can OOM-kill tabs; measure before shipping.

  - id: LW-M5-02
    title: Enable isolatedProcess and the app zygote
    milestone: M5
    depends_on: [LW-M2-04]
    owns: [patches/android/isolated-process.patch]
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/gecko/GeckoProvider.kt
    what: |
      VERIFIED AGAINST THE 153.0.4 TREE — and it is easier than the plan first
      assumed. GeckoProvider.kt:134-135 ALREADY calls .isolatedProcessEnabled()
      and .appZygoteProcessEnabled(); no new call sites are needed. They read
      Settings.isIsolatedProcessEnabled / isAppZygoteEnabled
      (Settings.kt:980-992), which default to the FML feature
      `isolated-content-processes` — and both of its variables default to FALSE
      (nimbus.fml.yaml:1040-1052). The only UI exposing them is
      SecretSettingsFragment.kt:410,416, the hidden debug menu. So this task is
      flipping two defaults and making them stick, not adding plumbing. Check
      whether the app zygote has a minimum API level before defaulting it on.

      VERIFIED 2026-08-22 on the fresh release build (org.mozilla.firefox, HEAD
      5d8af8f, x86_64, API 30) — closing the patch's "NOT VERIFIED: RELEASE
      variant" gap:
      (1) `adb shell ps -A -Z` on a stock install shows the content processes
          under isolated uids u0_i0..u0_i2 in the isolated_app SELinux domain,
          each forked from the app zygote (org.mozilla.firefox_zygote,
          app_zygote domain, uid u0_a142); the main process stays untrusted_app.
          Both isolatedProcess and the app zygote are live on the release build.
      (2) The values survive a Nimbus/prefs fetch: the profile already carries
          pref_key_nimbus_experiments_fetched=true and isolation holds; and
          injecting pref_key_enable_isolated_process=false and
          pref_key_enable_app_zygote_process=false (which the app reads into its
          prefs), then cold-launching, left isolation intact. That is because the
          patch sets the GeckoRuntimeSettings.Builder args to literal true at the
          call site, not from FML/prefs — so Nimbus cannot lower them. Confirmed
          on a COLD start, not a stale first-run state.
      (3) Startup cost: cold start TotalTime 333ms / 238ms (am start -W).
      (4) Functional regression, WITH isolation active: page-load-http and
          page-load-https PASS (https is a validated secure context), video
          decodes; librewolf.webgl.prompt=False so L1 is not the cause of the
          one webgl pixel mismatch (a documented SwiftShader/emulator GL limit).
          The getusermedia and extension smoke checks did not complete: the host
          emulator crashes on the camera/GL path (s_glUnmapBufferAEMU: could not
          get host gpu pointer!) in both -gpu host and -gpu swiftshader_indirect
          modes, with no app FATAL/ANR/kill in logcat. Recorded as
          environment-blocked; re-run those two checks on a stable GPU host.
    acceptance:
      - "content processes run under isolated uids on a stock install, verified with `adb shell ps -A -Z`"
      - "the app zygote process is present, or its absence is explained by an API-level floor"
      - "the values survive a Nimbus fetch — they are not merely set once at first run"
      - "no functional regression in the smoke test, and startup cost measured"
    verify: "adb shell ps -A -Z | grep -c isolated"
    note: >-
      REVISED BY LW-M7-43 (owner decision 2026-10-06, "Accept, turn isolation
      off"). The isolation default this task set was reverted: from 157.0-3,
      isolated-process.patch pins isolatedProcessEnabled(false) and
      appZygoteProcessEnabled(false), still as literals. With isolation on, Gecko
      refuses the MediaCodec decoder in content (upstream bug 1810736), so
      157.0-2 played no H.264 or AAC. The verification above describes the build
      that shipped through 157.0-2, not the current default.
    effort_h: "4-8"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: isolatedProcess restricts what content processes may do; some GeckoView features break subtly under it.

  - id: LW-M5-03
    title: Close the hardening-flag gap between the two mozconfigs
    milestone: M5
    depends_on: [LW-M2-02, LW-M0-03, LW-M2-05]
    owns: [assets/mozconfig.android, docs/android/parity/hardening-flags.md]
    what: |
      LW-M0-03 recorded every hardening flag that had to be dropped for Android to
      build. Go through that list one by one: re-attempt each flag now that the
      build works, and for the ones that genuinely cannot apply, write the reason
      into parity/hardening-flags.md.

      GOOD NEWS FROM LW-M2-01, which built green with the mozconfig UNMODIFIED —
      nothing was dropped, so this task starts from full parity rather than from a
      deficit. Its two UNVERIFIED notes are now both resolved favourably:
      -fstack-clash-protection IS applied on aarch64 (NDK clang is 21.0.0, above
      the 18.1.0 floor), and STL hardening resolves to the stronger
      _LIBCPP_HARDENING_MODE_EXTENSIVE rather than the _LIBCPP_ENABLE_ASSERTIONS
      fallback. MOZ_REPLACE_MALLOC, MOZ_REPLACE_MALLOC_STATIC, MOZ_MEMORY and
      MOZ_RUST_SIMD are all confirmed set in the built config. Your job is now to
      look for hardening we could ADD, and to confirm RLBox stays on.
    acceptance:
      - "every dropped flag is either restored or has a stated technical reason"
      - "the build is green with the final flag set"
      - "parity/hardening-flags.md lists the residual gaps with no hedging"
    verify: "python3 docs/android/board.py --diff-mozconfig --strict"
    effort_h: "6-12"
    skills: [c++, android, shell]
    agent_safe: yes
    isolation: worktree
    risk: >-
      A "doesn't build" is often "needs one more flag" — accepting the first
      failure understates what is achievable.

  - id: LW-M5-04
    title: Validate RFP and fingerprinting protection on Android
    milestone: M5
    depends_on: [LW-M3-05]
    owns: [docs/android/RFP-ANDROID.md, scripts/android-rfp-check.sh]
    what: |
      RFP behaves differently on Android: screen dimensions, device pixel ratio,
      touch capability, sensor APIs and the UA string all differ from desktop, and
      the desktop-tuned values in librewolf.cfg may not produce a coherent Android
      fingerprint. Run the standard fingerprinting probes, compare against desktop
      LibreWolf and against Tor Browser for Android, and document where our Android
      fingerprint stands. Note letterboxing is NOT a gap — desktop ships it false.
      STATUS 2026-08-22: the comparison is written (RFP-ANDROID.md sec 1-2): RFP
      master switch is on for Android (common.cfg:300, shared with desktop); the
      desktop-only sub-features (window-size trio, letterboxing) are correctly NOT
      in the Android composition (desktop.cfg only; letterboxing is false anyway
      and does not work on GeckoView, desktop.cfg:139) - so they are not gaps,
      per the what. android.cfg decision (acceptance item 2): NO adjustment
      landed, documented - RFP is already on, no cfg lever fixes the coherence
      question, and pulling in desktop-only prefs would be a regression. The
      gate (scripts/android-rfp-check.sh) checks the configured coherence and its
      --self-test PASSES (rejects RFP-off and letterboxing-enabled configs).
      PENDING (acceptance substance, needs a device): the live fingerprint probes
      (UA, screen, DPR, canvas, RFP coherence) vs desktop LibreWolf + Tor Browser
      Android - the "MORE identifiable" risk is only confirmable/ruleable out on a
      real device; parked per rule G, not faked. Acceptance/verify unchanged.
    acceptance:
      - "a written comparison against desktop LibreWolf and Tor Browser Android"
      - "any Android-specific RFP pref adjustment landed in android.cfg with a reason"
      - "a repeatable script, not a one-off manual session"
    verify: "./scripts/android-rfp-check.sh"
    effort_h: "8-16"
    skills: [js, android, docs]
    agent_safe: yes
    isolation: none
    risk: Copying desktop RFP values unexamined can make Android users MORE identifiable, not less.

  - id: LW-M5-05
    title: Verify HTTPS-only, DoH and OCSP behaviour matches desktop
    milestone: M5
    depends_on: [LW-M3-05]
    owns: [docs/android/parity/network-posture.md, scripts/android-network-check.sh]
    what: |
      HttpsOnlyMode is a policy on desktop and a pref on Android (see LW-M3-06).
      Verify the whole network-posture set actually takes effect on Android:
      HTTPS-only enforcement including the interstitial, DoH provider and fallback
      behaviour, OCSP hard-fail, and TLS version floor. Each one gets a live test
      against a server that exercises it, not a pref read.
      STATUS 2026-08-22: the one script (scripts/android-network-check.sh) is
      built with all four checks and a PASSING negative control (--self-test
      rejects HTTPS-only-off / DoH-off / CRLite-off / TLS-1.0 and accepts the real
      cfg). The configured posture is measured (network-posture.md sec 1: HTTPS-only
      upgrade_local=true + suggestions, main switch not force-on; DoH mode 5 +
      Quad9 + dns4all fallback; CRLite mode 2 + OCSP off; TLS floor at Gecko
      default, 0-RTT off, safe negotiation on). Divergence from desktop RECORDED
      (sec 2): on Android only DoH is code-locked ([ANDROID: LOCK]
      GeckoRuntimeSettings); HTTPS-only, CRLite/OCSP, TLS floor are cfg-only and
      the cfg layer is not packaged on Android (android-apk.sh:1202, LW-M3-08 gap).
      The acceptance as written - "a live test against a server that exercises it,
      not a pref read" - is PENDING: it needs a device plus test servers, neither
      available here (only a 3072 MB AVD); parked per rule G, not faked. Naming
      note (item e): the task says "OCSP hard-fail" but LibreWolf's mechanism is
      CRLite mode 2 with OCSP disabled; the gate tests CRLite-enforce + OCSP-off.
      Acceptance/verify unchanged.
    acceptance:
      - "each of the four behaviours has a live test with a recorded result"
      - "any divergence from desktop is either fixed or listed in parity/network-posture.md"
      - "the tests run from one script"
    verify: "./scripts/android-network-check.sh"
    effort_h: "6-10"
    skills: [js, android, shell]
    agent_safe: yes
    isolation: none
    risk: A pref that is set but not honoured reads as done in a pref dump and fails in the field.

  - id: LW-M5-06
    title: Write the security parity matrix and the public wording
    milestone: M5
    depends_on: [LW-M5-01, LW-M5-02, LW-M5-03, LW-M5-04, LW-M5-05, LW-M3-06]
    owns: [docs/android/PARITY.md]
    reads:
      - docs/android/parity/hardening-flags.md
      - docs/android/parity/network-posture.md
      - docs/android/RFP-ANDROID.md
      - docs/android/POLICIES.md
      - docs/android/PATCH-SCOPE.md
    what: |
      One table: every desktop security and privacy property, its Android status
      (equivalent / partial / absent), and the mechanism. The irreducible gaps as
      currently understood are the Gecko content-process sandbox (MOZ_SANDBOX is
      off, toolkit.mozbuild:37 never traverses security/sandbox, every
      security.sandbox.* pref is inert) and the loss of the desktop signing key
      identity. The agreed public wording is: "Redoubt ships the same
      privacy configuration and the same Gecko-level security patches as LibreWolf
      desktop, on a platform whose process containment is weaker — and we publish
      exactly where." Do not soften it.
      STATUS 2026-08-22: docs/android/PARITY.md WRITTEN (committed). 16 rows, each
      a mechanism or an explicit gap - no blanks, no undetailed "partial". The
      Gecko content-sandbox gap is stated in section 1, not buried. The two
      irreducible gaps (section 3) and the agreed public wording (section 5, quoted
      verbatim from ROADMAP.md) are present; the wording is MARKED as needing owner
      sign-off and NOT to be published. Statuses are backed by the five reads-docs
      (hardening-flags, network-posture, RFP-ANDROID, POLICIES, PATCH-SCOPE) plus
      SANDBOX-SPIKE / IDENTITY / ROADMAP, each row naming its evidence type. The
      live/honoured rows (5,7,8,9,15) are PENDING and parked per rule G - no
      device, no test server; both check scripts' configured layers pass and both
      --self-test negative controls passed. Acceptance: "every row a mechanism or
      gap" met; "sandbox stated plainly" met; "maintainer sign-off on the wording"
      is recorded and marked as an open owner action - the sign-off itself is the
      pending human verify step (manual maintainer review) and cannot be performed
      here.
    acceptance:
      - "every row has a mechanism or an explicit gap, no blanks and no 'partial' without detail"
      - "the sandbox gap is stated plainly, not buried"
      - "maintainer sign-off on the public wording"
    verify: "manual: maintainer review, recorded in the PR"
    effort_h: "4-8"
    skills: [docs]
    agent_safe: yes
    isolation: none
    risk: Overclaiming parity is the reputational failure mode this project must not have.

  - id: LW-M5-07
    title: Spike — is any Gecko content sandbox reachable on Android?
    milestone: M5
    depends_on: [LW-M2-02]
    owns: [docs/android/SANDBOX-SPIKE.md]
    what: |
      Time-boxed research, not an implementation. toolkit.mozbuild:37 never
      traverses security/sandbox on Android and MOZ_SANDBOX is off, so all
      security.sandbox.* prefs are inert. Establish whether that is a policy
      decision or a technical impossibility: what does Chrome on Android do, what
      does seccomp-bpf allow under Android's own sandbox, has Mozilla an open bug,
      and what would it cost. Deliver a recommendation, including "not worth it".
      STATUS 2026-08-22: spike COMPLETE (docs/android/SANDBOX-SPIKE.md, committed;
      all claims evidence-graded M/S/U/I, none from memory). Answer: neither a
      policy decision nor a technical impossibility - a never-finished port that
      upstream is closer to deleting than shipping (bugs 1660102 [meta seccomp in
      GeckoView, NEW, last touched 2025-05], 2040639 [remove Android sandbox
      scaffolding, NEW 2026-05, "enabling it yields build errors"], 1565196
      [isolatedProcess meta, 65 deps]; Chrome android-sandbox.md as the empirical
      reference). Recommendation (sec 8): do NOT pursue MOZ_SANDBOX on Android -
      the marginal gain over Android's own isolated_app + RLBox is kernel
      attack-surface reduction only (ioctl + a couple hundred syscalls bionic's
      permissive app filter allows), undercut by the LibreWolf-specific multiplier:
      no telemetry/crash reports to catch a SIGSYS on a vendor-kernel fleet
      (assets/mozconfig.android disables crashreporter; Glean/Adjust stripped).
      Cost (sec 7): 4-8 engineer-weeks to a first booting build on one device,
      6-12 engineer-months to ship-safe, then permanent maintenance. Time-boxed:
      it is a research doc, not an implementation, per the what. Cross-task
      findings reported in sec 9 (the app-zygote ASLR regression for LW-M5-02; the
      upstream isolatedProcess blocker list; the sec 10 wording input for
      LW-M5-06). Acceptance met: written answer + upstream refs, explicit
      recommendation + cost, time-boxed.
    acceptance:
      - "a written answer with references to the upstream code and bugs"
      - "an explicit recommendation and a cost estimate if pursued"
      - "time-boxed to the stated effort — do not let this become an implementation"
    verify: "manual: maintainer reads and accepts the recommendation"
    effort_h: "8-16"
    skills: [c++, android, docs]
    agent_safe: yes
    isolation: none
    risk: This is the most interesting problem on the board and the easiest place to lose a month.

  # ---------------------------------------------------------------- M6
  # Release engineering. Key custody tasks are deliberately not agent-safe.

  - id: LW-M6-01
    title: Generate the Android signing key and write the custody policy
    milestone: M6
    depends_on: [LW-M4-07]
    owns: [docs/android/SIGNING.md]
    what: |
      Generate the release keystore offline, on hardware, with at least two
      maintainers present. The key must NEVER exist in CI, in a container image, or
      in any repository — signing happens on a maintainer machine as a separate
      step after CI produces an unsigned APK. Document custody, backup (offline,
      geographically separated), the rotation story, and what happens if the key is
      lost. Android has no key-recovery mechanism outside Play App Signing, which
      we are not using.
    acceptance:
      - "keystore exists offline with a documented custody chain and at least two holders"
      - "no key material or passphrase in any repo, CI secret, or image"
      - "SIGNING.md states the loss and rotation procedure"
    verify: "manual: two-maintainer ceremony, recorded"
    effort_h: "4-8"
    skills: [ops]
    agent_safe: no
    isolation: none
    risk: Losing this key strands every installed user with no upgrade path — the same failure as changing the applicationId.

  - id: LW-M6-07
    title: Make the R8-minified release build actually boot
    milestone: M6
    depends_on: [LW-M2-04]
    owns: [patches/android/r8-keep-rules.patch, scripts/android-apk.sh]
    what: |
      RELEASE BLOCKER, found incidentally by the skeptical verification of LW-M4-16
      and confirmed independently from the crash logcat. **The R8-minified release
      build crashes on launch.** Twice, reproducibly:

        FATAL EXCEPTION: main
        java.lang.Error: Structure.getFieldOrder() on class
        org.mozilla.experiments.nimbus.internal.RustBuffer$ByValue does not provide
        enough names [0] ([]) to match declared fields [3] ([capacity, data, len])
          at com.sun.jna.Structure.getFields(r8-map-id-7758...:144)

      JNA derives a native struct's layout by REFLECTING over field names. R8's
      minification renames them, so getFieldOrder() returns an empty list and every
      uniffi/Nimbus call through JNA dies before the browser starts. The
      `r8-map-id-` frames prove it is the minified build; the debug build is fine.

      WHY NOBODY NOTICED, and this is the part worth internalising: every APK the
      project has built and tested is `fenix:assembleDebug`
      (scripts/android-apk.sh:694,844 — `assembleRelease` appears nowhere in that
      file), and the two release APKs that do exist were built with
      `-PdisableOptimization`, i.e. with R8 turned off. So the configuration we
      would actually SHIP has never been booted, and the smoke harness has never
      run against it.

      Worse, it produced a confidently wrong conclusion elsewhere: LW-M4-16
      reported the release artefact "provably zero-GMS" because --check-no-gms
      exits 0 on it. It does — because R8 deleted the classes. The gate is green on
      that artefact for exactly the reason it cannot ship.

      FIX: add the JNA/uniffi keep rules (`-keepclassmembers class * extends
      com.sun.jna.Structure { <fields>; }` and whatever the Nimbus/appservices
      generated bindings need — check what Mozilla's own release config keeps),
      then boot it. Teach scripts/android-apk.sh to build a release variant so this
      is testable at all, and make the smoke harness run against the RELEASE APK
      before any signing work (LW-M6-01) begins.
    acceptance:
      - "an R8-minified release APK launches and loads a page — observed, not inferred"
      - "./scripts/android-smoke.sh passes against the RELEASE apk, not only the debug one"
      - "scripts/android-apk.sh can build a release variant without -PdisableOptimization"
      - "any --check-no-gms result is re-derived on a booting release build, since the previous one was an artefact of R8 deletion"
    verify: "./scripts/android-smoke.sh --emulator --apk <release-apk>"
    effort_h: "6-12"
    skills: [kotlin, gradle, android]
    agent_safe: yes
    isolation: worktree
    risk: The shipping configuration has never been booted; every measurement so far describes a build we would not release.

  - id: LW-M6-02
    title: Make the Android build reproducible and verify it
    milestone: M6
    depends_on: [LW-M2-08]
    owns: [scripts/android-verify-repro.sh, docs/android/REPRODUCIBLE.md]
    what: |
      Two independent builds of the same source must produce identical unsigned
      APKs. Eliminate the usual sources of nondeterminism: build timestamps, paths,
      Gradle ordering, zip entry order and NDK/toolchain drift. This is a hard
      requirement for F-Droid's reproducible-builds channel and it is the only
      thing that lets a third party check we ship what we publish.
    acceptance:
      - "two builds on different machines produce byte-identical unsigned APKs"
      - "a documented command a third party can run to verify a published release"
      - "any residual nondeterminism is listed with the reason"
    verify: "./scripts/android-verify-repro.sh"
    effort_h: "12-24"
    skills: [ops, gradle, shell]
    agent_safe: yes
    isolation: none
    risk: Reproducibility is far cheaper to build in now than to retrofit after the first release.

  # 2026-10-05 (owner decision, revised the same day): hosted in the owner's
  # Hetzner Object Storage bucket, https://<bucket>.<location>.your-objectstorage.com/repo
  # (assets/fdroid/deploy.conf), because GitHub Pages' 1 GB limit kept only 1-3
  # releases and the owner wants to keep all of them. The earlier GitHub Pages
  # design (index in site/fdroid/repo/, APKs fetched by pages.yaml) is retired.
  # Retention: newest 5 releases in repo/, every older one in archive/, nothing
  # deleted. scripts/fdroid-repo.sh deploy uploads with a pinned rclone, APKs
  # first, index last; the human page stays at redoubtbrowser.org/fdroid.html.
  # Per-ABI APKs only; AntiFeatures: Tracking. Tooling and a throwaway-key proof
  # against a local S3 server (MinIO) with F-Droid 2.0.1 on an API 34 emulator,
  # archive included, are done (docs/android/FDROID.md, evidence/lw-m6-03/hetzner/).
  # Owner-held and NOT done: the Hetzner project, bucket (Public) and S3
  # credentials, init (the repository key), the first deploy and publish-page,
  # and the fingerprint in two places (prepared, uncommitted:
  # ~/redoubt-artifacts/channels/fdroid-site-placeholder.diff). The no-double-
  # notify half is update-check.patch's installer-of-record check (LW-M6-06),
  # in the first build after 157.0-2. Acceptance 3 was shown with throwaway keys
  # (Beta 5 -> 157.0-2 through F-Droid, Pages design); it stays open for the real key.
  - id: LW-M6-03
    title: Set up the Redoubt F-Droid repository
    milestone: M6
    depends_on: [LW-M6-01, LW-M6-02, LW-M4-05]
    owns: [docs/android/DISTRIBUTION.md, docs/android/FDROID.md, scripts/fdroid-repo.sh, scripts/tests/test-site-check-fdroid.py, assets/fdroid/, site/fdroid.html, site/fdroid-qr.svg, .github/workflows/pages.yaml, scripts/site-check.py, docs/android/evidence/lw-m6-03/]
    reads: [patches/android/update-check.patch, docs/android/SIGNING.md, scripts/android-verify-signature.sh]
    what: |
      Run our own F-Droid repo rather than going through f-droid.org's main repo —
      it avoids their build-server signing model and lets us keep our own key.
      Requires zero GMS (LW-M4-05) and reproducibility (LW-M6-02). Publish the repo
      URL and its fingerprint and document how a user verifies both.
      2026-10-05: binary-only repository of the GitHub release's per-ABI APKs in
      the owner's Hetzner Object Storage bucket (all releases kept, older ones in
      the archive section); the owner runs scripts/fdroid-repo.sh
      init/add/update/deploy/verify/publish-page (docs/android/FDROID.md).
    acceptance:
      - "repo index is signed and installable from a clean F-Droid client"
      - "the repo fingerprint is published in at least two independent places"
      - "an update from an older version installs cleanly"
    verify: "python3 scripts/tests/test-site-check-fdroid.py && python3 scripts/site-check.py site && ./scripts/fdroid-repo.sh verify (owner, after deploy) && manual: add the repo to F-Droid on a clean device and install"
    effort_h: "8-16"
    skills: [ops, android]
    agent_safe: no
    isolation: none
    risk: A repo signed with a key that later changes forces every user to reinstall manually.

  # 2026-10-05: the "Play Store is out of scope" sentence below is reversed by
  # owner decision (LW-M6-12, docs/android/PLAY.md section 1); the rest stands.
  - id: LW-M6-04
    title: Publish to Accrescent and provide direct APK plus Obtainium metadata
    milestone: M6
    depends_on: [LW-M6-01, LW-M6-03]
    owns: [docs/android/DISTRIBUTION.md]
    what: |
      Accrescent requires signature scheme v3 and its own review process; direct
      APK downloads need a stable URL and a published hash; Obtainium needs a
      predictable release-asset naming scheme on the GitHub releases page. Set up
      all three so users are not funnelled into a single channel. Note the Play
      Store is out of scope — its signing model conflicts with LW-M6-01.
      REVERSED 2026-10-05 by the owner: Google Play is in scope, as LW-M6-12,
      with the existing release key uploaded to Play App Signing (same
      fingerprint on every channel; Google holds a copy). The conflict with
      LW-M6-01 is accepted, not resolved — SIGNING.md "Google holds a copy".
    acceptance:
      - "APKs are signed with v2 and v3, verified by apksigner"
      - "Obtainium resolves the GitHub release and offers the update"
      - "each channel's fingerprint is documented and identical"
    verify: "apksigner verify --verbose --print-certs librewolf-*.apk"
    effort_h: "8-16"
    skills: [ops, android]
    agent_safe: no
    isolation: none
    risk: Different signing per channel means a user cannot switch channels without uninstalling.

  - id: LW-M6-05
    title: Build the Android release pipeline
    milestone: M6
    depends_on: [LW-M6-02, LW-M2-08]
    owns: [.github/workflows/android-release.yaml]   # 2026-09-05: was .forgejo/, which does not exist -- the verify below grepped a missing file and passed
    reads: [.forgejo/workflows/source-release.yaml]
    what: |
      CI builds and publishes UNSIGNED artifacts plus their hashes; a maintainer
      signs offline and uploads the signed APK. Mirror source-release.yaml's shape,
      including the "only publish signed releases" discipline from commit 71177a3.
      The pipeline must make the unsigned/signed boundary structurally obvious so
      nobody can accidentally publish an unsigned build.
    acceptance:
      - "no signing key referenced anywhere in the workflow"
      - "unsigned artifacts carry published sha256 sums"
      - "publishing a release without a signature is blocked, not merely discouraged"
    verify: "test -f .github/workflows/android-release.yaml && ! grep -riE 'keystore|storepass|keypass' .github/workflows/android-release.yaml"
    effort_h: "6-12"
    skills: [ops, shell]
    agent_safe: yes
    isolation: none
    risk: One convenience commit putting the key in CI undoes the entire custody model in LW-M6-01.

  # 2026-10-05: acceptance 3 ("F-Droid and Accrescent installs do not
  # double-notify") now also covers Redoubt's own F-Droid repository, which serves
  # the direct APKs: update-check.patch hides the check when the installer of
  # record is a store client (UpdateCheck.isOffered; evidence/lw-m6-03/patch/).
  # Unit-tested (Robolectric, 158 tree), not yet built into an APK.
  - id: LW-M6-06
    title: Implement in-app update checking without an app store
    milestone: M6
    depends_on: [LW-M6-04, LW-M4-11, LW-M2-04]   # 2026-09-02: LW-M4-11/LW-M2-04 added only to serialise android-smoke.sh / android-apk.sh, which this task now shares
    owns: [patches/android/update-check.patch, docs/android/DISTRIBUTION.md, scripts/android-apk.sh, scripts/android-smoke.sh, docs/android/evidence/lw-m6-06/]   # 2026-09-02: android-apk.sh forwards the key; --check-update-privacy lives in the harness
    what: |
      Users installing the direct APK have no store to update them. Provide a
      version check against a signed, static endpoint on redoubtbrowser.org that tells
      the user a new version exists and links to the download — do not build a
      silent self-updater, and do not add a phone-home that runs without consent.
      Make the check opt-in or clearly disclosed, and never send anything beyond
      the current version.
    acceptance:
      - "the check sends no identifier beyond the version string"
      - "it is disclosed in the UI and can be turned off"
      - "F-Droid and Accrescent installs do not double-notify"
    verify: "./scripts/android-smoke.sh --check-update-privacy"
    effort_h: "8-16"
    skills: [kotlin, ops]
    agent_safe: yes
    isolation: worktree
    risk: An always-on update ping is a periodic beacon with an IP address attached — exactly what users came here to avoid.

  # ---------------------------------------------------------------- M7
  # Launch and sustain. Mostly docs and process; all parallel.

  - id: LW-M7-01
    title: Write the esr153 rebase runbook and retire the compat shim
    milestone: M7
    depends_on: [LW-M1-11, LW-M0-07, LW-M1-12, LW-M1-13]
    owns: [docs/android/REBASE.md, assets/patches.txt]
    what: |
      The rebase runbook for an ESR dot release: fetch and verify the tarball,
      run check-patchfail for both targets, fix rejects, run the pref audit and
      smoke test, build, sign, publish. Include the "what changed upstream that
      could silently revert one of our prefs" check — that is the failure mode a
      rebase actually produces. Also retire the assets/patches.txt compatibility
      shim from LW-M0-02 once all downstream builders have moved.
    acceptance:
      - "a new maintainer can complete a dot-release rebase from the runbook alone"
      - "the runbook names the pref-audit and smoke-test gates explicitly"
      - "the shim is removed and no builder references it"
    verify: "manual: a maintainer who did not write it completes one rebase using only the runbook"
    effort_h: "6-10"
    skills: [docs, shell]
    agent_safe: yes
    isolation: none
    risk: An undocumented rebase makes the whole project bus-factor-1, which is the exact criticism levelled at the alternatives.

  - id: LW-M7-02
    title: Publish the Android pages on redoubtbrowser.org
    milestone: M7
    depends_on: [LW-M5-06, LW-M6-04]
    owns: [docs/android/WEBSITE.md]
    what: |
      Download page with every channel and its fingerprint, the security parity
      statement from LW-M5-06 verbatim (not a marketing rewrite of it), an install
      guide per channel, and the "how to verify what you downloaded" instructions.
      The parity statement being on the download page rather than buried in docs is
      the whole point.
    acceptance:
      - "the parity wording appears on the download page itself"
      - "every channel lists its fingerprint and verification command"
      - "no claim on the page contradicts PARITY.md"
    verify: "manual: maintainer review against PARITY.md"
    effort_h: "6-12"
    skills: [docs, design]
    agent_safe: yes
    isolation: none
    risk: A download page that overclaims undoes the honesty the parity matrix was written to preserve.

  - id: LW-M7-03
    title: State the project's relationship to LibreWolf and IronFox honestly
    milestone: M7
    depends_on: [LW-M7-02]
    owns: [docs/android/POSITIONING.md]
    what: |
      RE-SCOPED. This task used to say "Update the FAQ and close out issue 2169",
      which assumed we are the LibreWolf project. We are not — this is an
      independent fork (see docs/android/IDENTITY.md). We cannot edit their FAQ or
      close their issues, and should not imply otherwise.

      The real task is the harder one: say clearly what this project is and is not.
      Three relationships need stating without spin:

      1. **To LibreWolf.** We ship their privacy configuration
         (settings/librewolf.cfg and the patch set, MPL-2.0) on Android. We are not
         them, they have not endorsed this, and users must not be able to mistake
         one for the other. Credit the work plainly — the config IS the product,
         and pretending otherwise would be both dishonest and ungrateful.
      2. **To IronFox.** They occupy this space already and LibreWolf's own FAQ
         points Android users there. Say what differs — honestly, including where
         IronFox is ahead. A comparison that only flatters us reads as marketing
         and ages badly.
      3. **To Firefox.** Standard downstream disclosure: not affiliated with or
         endorsed by Mozilla, and no Mozilla trademarks in the UI (LW-M4-12).

      Also record what happened with the upstream bug reports
      (docs/android/UPSTREAM-REPORTS.md) — if LibreWolf took them, say so and
      thank them; if not, the defects are still worth documenting as things this
      fork fixed.
    acceptance:
      - "a reader can tell in one sentence that this is not the LibreWolf project"
      - "the IronFox comparison names at least one thing IronFox does better"
      - "attribution to LibreWolf is prominent, not buried in a licence footer"
      - "no claim on the page contradicts docs/android/PARITY.md"
    verify: "manual: maintainer review against PARITY.md and IDENTITY.md"
    effort_h: "3-5"
    skills: [docs]
    agent_safe: yes
    isolation: none
    risk: A fork that blurs its relationship to the project it forked loses the trust that made the config worth shipping.

  - id: LW-M7-04
    title: Set up Android issue triage on github.com/CPlusPlus17/Redoubt/issues
    milestone: M7
    depends_on: []
    owns: [docs/android/TRIAGE.md, .github/ISSUE_TEMPLATE/android-bug.yml, .github/ISSUE_TEMPLATE/config.yml]
    what: |
      Labels, an issue template that asks for device, Android version, APK source
      and channel, and a triage rotation. Do this BEFORE launch — the first week of
      reports is when the process is most needed and least likely to get written.
      TRIAGE.md proposes space-separated, capitalised Android labels. A live
      API audit on 2026-09-08 found only GitHub's default lowercase labels;
      the earlier claim that this vocabulary already existed was incorrect.
      Publish the proposed labels with the form and verify their presence.
      Keep incomplete reports (Needed Info) separate from complete but
      unreproduced reports so the latter do not expire for missing details.
    acceptance:
      - "labels follow the tracker's existing naming style and the Android issue template is live"
      - "the template asks for device, OS version, APK source and channel"
      - "a named triage owner for the launch window"
    verify: "manual: file a test issue and confirm the template"
    effort_h: "2-4"
    skills: [ops, docs]
    agent_safe: yes
    isolation: none
    risk: Launching without triage buries real security reports in duplicate build questions.

  - id: LW-M7-05
    title: Extend the security disclosure process to Android
    milestone: M7
    depends_on: [LW-M5-06]
    owns: [docs/android/SECURITY.md]
    what: |
      Android adds failure modes desktop does not have: APK signature issues,
      distribution-channel compromise, and a device-specific attack surface. Extend
      the existing disclosure process to cover them, and state the response SLA for
      a Gecko security release given the ESR track — users need to know how fast a
      critical fix reaches them on Android.
    acceptance:
      - "the process covers signature and channel compromise"
      - "a stated turnaround target for critical Gecko security releases on Android"
      - "a contact path that does not require a GitHub account"
    verify: "manual: maintainer review"
    effort_h: "3-5"
    skills: [docs, ops]
    agent_safe: yes
    isolation: none
    risk: Choosing ESR means a slower critical-fix path than desktop; not saying so is the problem, not the delay.

  - id: LW-M7-07
    title: Correct REBASE.md and finish retiring the compat shim
    milestone: M7
    depends_on: [LW-M7-01]
    owns:
      - docs/android/REBASE.md
      - scripts/librewolf-patches.py
      - scripts/enable-patch.sh
      - scripts/disable-patch.sh
    what: |
      Corrective task from the skeptical verification of LW-M7-01. Three defects,
      all fixed:

      (1) REBASE.md:578-582 taught a workaround for a trap in board.py
      --check-policies, and explained it wrongly — it claimed `.` (0x2E) sorts
      before `/` (0x2F), under a heading saying the claim had been confirmed by
      running it. pathlib.Path compares part tuples, so `/` is never compared as a
      character; executed, firefox-153.0 wins over firefox-153.0.4, the exact
      inverse. The ROOT CAUSE was fixed instead of the doc: --check-policies now
      errors when more than one firefox-* tree exists, honours LW_TREE, and prints
      the tree it read. The workaround was deleted rather than corrected.

      (2) Appendix A's one-block quick reference contradicted section 6d's naming
      rule, so a maintainer following the copy-paste path walked into the trap 6d
      existed to prevent. Every command block must be runnable standalone — 6c also
      consumed a /tmp file only 6b produced.

      (3) The shim was half-retired: assets/patches.txt was deleted but
      librewolf-patches.py still called check_compat_shim() and warned on every
      invocation, and enable-patch.sh/disable-patch.sh recreated the file
      unconditionally with no existence guard.

      Follow-ups outside this task's ownership, now also done: the standing
      "regenerate the shim" instruction in assets/patches/common.txt and the dead
      shim-drift block in scripts/check-patchfail.sh were removed separately.
    acceptance:
      - "no command block in REBASE.md depends on a workaround for a bug that is now fixed"
      - "every REBASE.md command block runs standalone as written"
      - "the patcher emits no shim warning and the helpers do not recreate assets/patches.txt"
      - "an enable/disable round trip leaves the three lists byte-identical and creates no shim"
    verify: "! python3 scripts/librewolf-patches.py -n 153.0esr 1 --targets=android 2>&1 | grep -qi 'shim' && test ! -e assets/patches.txt"
    effort_h: "3-5"
    skills: [docs, python, shell]
    agent_safe: yes
    isolation: none
    risk: A runbook that teaches a workaround for a fixed bug is worse than no runbook — it survives the fix and misleads.

  - id: LW-M7-06
    title: Run a closed beta before the public release
    milestone: M7
    depends_on: [LW-M6-04, LW-M2-07, LW-M3-05]
    owns: [docs/android/BETA.md]
    what: |
      Ship to a small group across a deliberate device spread — low-RAM devices
      especially, since LW-M5-01's isolation strategy is the most likely source of
      OOM reports. Define entry criteria (smoke test and pref audit green,
      reproducible build verified), what feedback is collected, and the exit
      criteria for going public.
    acceptance:
      - "entry and exit criteria written before the beta starts"
      - "at least one 4GB-or-less device and one Android 10-or-older device covered"
      - "a written go/no-go decision at the end"
    verify: "manual: go/no-go recorded in BETA.md"
    effort_h: "4-8"
    skills: [ops, docs]
    agent_safe: no
    isolation: none
    risk: The memory cost of fission plus isolatedProcess is invisible on a flagship and decisive on a budget phone.
  - id: LW-M6-08
    title: Bind beta artifacts and signing checks to verified release inputs
    milestone: M6
    depends_on: [LW-M6-06, LW-M6-07, LW-M6-02, LW-M7-06]
    owns:
      - patches/android/deterministic-version-code.patch
      - scripts/android-apk.sh
      - scripts/android-verify-repro.sh
      - scripts/android-verify-signature.sh
      - scripts/android-smoke.sh
      - scripts/tests/test-android-signing.py
      - scripts/tests/test-android-version-code.py
      - scripts/tests/test-android-smoke.py
      - docs/android/evidence/lw-m6-01/sign.sh
      - docs/android/evidence/lw-m6-01/RELEASE-HANDOFF.md
      - docs/android/evidence/lw-m6-08/
      - docs/android/evidence/lw-m7-06/beta-audit-2026-09-08/
      - docs/android/BETA.md
      - docs/android/BUILD.md
      - docs/android/STATUS.md
      - docs/android/PATCH-SCOPE.md
      - docs/android/REPRODUCIBLE.md
      - docs/android/SIGNING.md
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/android-components/plugins/config/src/main/java/ConfigPlugin.kt
    what: |
      Revalidate the beta against its actual APKs. Version codes currently use
      the wall clock even when MOZ_BUILD_DATE is pinned, and the normal APK
      build omits the Glean timestamp pin used only by the repro script.
      Make both build paths deterministic, compile the change and exercise
      the real candidate. Harden the offline handoff so a wrong signature or
      missing artifact cannot be reported as success. Never use the release
      key on the build host; record pending custody and publication separately.
    acceptance:
      - "version codes derive from the pinned UTC build date; a later UTC build hour advances them"
      - "normal and reproducibility builds pin the same Glean timestamp"
      - "R8-on candidate matches two independent unsigned builds"
      - "signing integration checks accept the full set and reject wrong keys, schemes, corrupt APKs and missing inputs"
      - "BETA.md links candidate-specific evidence and accurately records unmet entry criteria"
    verify: "python3 scripts/tests/test-android-signing.py && python3 docs/android/board.py --check"
    effort_h: "4-8"
    skills: [android, kotlin, gradle, shell, python, docs]
    agent_safe: yes
    isolation: worktree
    risk: Old evidence and same-hour rebuilds can hide a different candidate or nondeterministic version code.
  - id: LW-M6-09
    title: Move the Actions runner into a dedicated QEMU virtual machine
    milestone: M6
    depends_on: [LW-M6-08, LW-M6-05]
    owns:
      - scripts/ci-vm/
      - scripts/ci-vm-boxb/
      - docs/android/CI-VM.md
      - docs/android/evidence/lw-m6-09/
      - docs/android/BETA.md
      - docs/android/STATUS.md
    what: |
      Replace the Fedora host runner with a freshly registered runner inside
      an unprivileged KVM/QEMU guest. Keep host home files, release keys and
      host credentials outside the virtual machine and QEMU mount namespace.
      Preserve existing workflow labels, validate an actual Actions preflight,
      and disable and unregister the old host runner after guest validation.
      This migration does not change the recorded origin of already signed APKs.
    acceptance:
      - "the VM boots persistently with its own disk and no host directory shares"
      - "the guest runner has fresh credentials and cannot read host signing material"
      - "rootless Podman works and the existing Android release preflight passes in the VM"
      - "the host runner is disabled and unregistered after successful cutover"
      - "the runbook records recovery, resource limits and signing provenance honestly"
    verify: 'python3 docs/android/board.py --check && for script in scripts/ci-vm/*.sh; do bash -n "$script" || exit; done'
    effort_h: "4-8"
    skills: [ops, shell, python, docs]
    agent_safe: yes
    isolation: none
    risk: Sharing the host home or retaining the old runner would preserve CI access to signing material.
  - id: LW-M6-10
    title: Reconcile beta signing custody after the QEMU migration
    milestone: M6
    depends_on: [LW-M6-09]
    owns:
      - docs/android/SIGNING.md
      - docs/android/evidence/lw-m6-01/RELEASE-HANDOFF.md
      - docs/android/evidence/lw-m6-08/beta-readiness.md
      - docs/android/evidence/lw-m6-10/
      - docs/android/BETA.md
      - docs/android/STATUS.md
    what: |
      Recheck the returned release-signed candidate and reconcile stale custody
      descriptions with the deployed QEMU runner. Prepare a candidate-specific
      owner decision about signing before migration without claiming it was
      offline. Preserve the existing E7 requirement until the owner supplies
      matching custody evidence or explicitly accepts an exception. Record any
      earlier distributed release-key version code before declaring upgrade
      compatibility. Never access or operate the release private key.
    acceptance:
      - "current signing and runner evidence agrees with the custody documentation"
      - "all four returned APKs match the candidate and published signing identity"
      - "missing owner custody and distribution-history facts remain explicit"
      - "an owner exception is recorded only after explicit approval"
    verify: "python3 docs/android/board.py --check"
    effort_h: "1-2"
    skills: [ops, docs]
    agent_safe: yes
    isolation: none
    risk: A new CI boundary cannot retroactively prove the circumstances of earlier signing.
  - id: LW-M6-11
    title: Publish the approved Android beta APKs on GitHub Releases
    milestone: M6
    depends_on: [LW-M6-10, LW-M6-06]
    owns:
      - docs/android/BETA.md
      - docs/android/STATUS.md
      - docs/android/DISTRIBUTION.md
      - docs/android/evidence/lw-m6-11/
    what: |
      The owner requests adding the approved signed APKs to a GitHub release.
      Publish the first Android prerelease with all four exact approved APKs
      and their signed checksum manifest. Publish matching source tags and the
      pinned settings commit so recursive source checkout works. Preserve the
      default branches. Verify uploaded assets before publishing the draft.
      Record that this public beta channel supersedes the earlier private-link
      plan; it is not the later stable-release GO/NO-GO decision.
    acceptance:
      - "the GitHub prerelease contains exactly the four approved APKs and signed checksum manifest"
      - "remote asset digests match local approved files and downloaded assets verify"
      - "the release source tag and settings gitlink are publicly available"
      - "release notes state APK selection, requirements, verification and beta limitations"
      - "publication evidence and the public beta channel are recorded"
    verify: "python3 docs/android/board.py --check"
    effort_h: "1-2"
    skills: [ops, docs]
    agent_safe: yes
    isolation: none
    risk: A release tag pointing at older source or a missing submodule would misrepresent the published APKs.

  # 2026-10-05: owner decision, reverses LW-M6-04's "Play out of scope".
  - id: LW-M6-12
    title: Publish Redoubt on Google Play with the existing release key
    milestone: M6
    retired: |
      2026-10-14: reversed by the owner before anything was uploaded. The release
      key is never uploaded to Google, and Redoubt is not on Google Play. If Play
      is ever pursued, it needs a new task with a separate, Play-only key, so Play
      and GitHub/F-Droid installs stay different apps. The AAB tooling this task
      added stays in the tree, unused (SIGNING.md and PLAY.md, "Google Play").
    depends_on: [LW-M6-01, LW-M6-05, LW-M6-06, LW-M6-11]
    owns:
      - docs/android/PLAY.md
      - docs/android/play/
      - docs/android/evidence/lw-m6-12/
      - docs/android/evidence/lw-m6-01/sign-aab.sh
      - scripts/android-aab.py
      - scripts/bundletool.sh
      - site/privacy-policy.html
    reads:
      - docs/android/PARITY.md
      - docs/android/DISTRIBUTION.md
      - patches/android/update-check.patch
    what: |
      The owner decided on 2026-10-05 to publish on Google Play with the EXISTING
      release key uploaded to Play App Signing (PEPK), so one fingerprint covers
      every channel and Google holds a copy of the key. Add a Play bundle to the
      release path (scripts/android-apk.sh --bundle, android-release.yaml input
      bundle, unsigned AAB artifact, update check always compiled out, versionCode
      = the build's universal code), the owner's upload-key signer (sign-aab.sh),
      a pinned bundletool, a privacy policy page, the store listing and graphics,
      and the owner runbook docs/android/PLAY.md. Record what Google holding the
      key means in SIGNING.md and SECURITY.md. The owner creates the account, runs
      PEPK, holds the upload key and uploads; agents use throwaway keys only.
    acceptance:
      - "android-apk.sh --bundle produces an unsigned AAB for org.redoubtbrowser whose dex carries no update-check key and whose versionCode is >= every APK of the same build"
      - "sign-aab.sh signs with a registered upload key, refuses the app signing key, and leaves the payload byte-identical"
      - "APKs generated from the signed AAB by the pinned bundletool install and launch on an emulator, with no update-check row in Settings"
      - "PLAY.md gives the owner every one-time and per-release step, with each Play requirement cited to an official page and date"
      - "the Play listing is live and the Play-served APK verifies with the published fingerprint (owner, after upload)"
    verify: "python3 docs/android/board.py --check && python3 docs/android/play/check-listing.py && python3 scripts/site-check.py"
    effort_h: "8-16"
    skills: [ops, android, gradle, docs]
    agent_safe: no
    isolation: worktree
    risk: Google holds a copy of the app signing key and can sign updates every install accepts; a Google-generated or hybrid key would split the channels for good.

  - id: LW-M7-08
    title: Audit Android feature completeness against LibreWolf
    milestone: M7
    depends_on: [LW-M6-11]
    owns:
      - docs/android/FEATURE-PARITY.md
      - docs/android/evidence/lw-m7-08/
    reads:
      - docs/android/PARITY.md
      - docs/android/POLICIES.md
      - docs/android/PATCH-SCOPE.md
      - settings/
      - patches/
    what: |
      The owner requests "get feature complete with librewolf" after installing
      the first Android beta and identifying the missing default uBlock Origin
      installation. Derive the complete functional/default/control inventory
      from current LibreWolf documentation and this repository's desktop build.
      Check the current Android source and artifacts instead of accepting stale
      parity reports. Assign implementation and runtime verification work for
      every gap; distinguish platform differences without counting an explained
      gap or untested behavior as implemented. This audit is a step toward the
      full goal, not a substitute for completing and verifying the features.
    acceptance:
      - "the inventory covers LibreWolf features, defaults, controls, policies and desktop patch counterparts"
      - "each item has current evidence and explicit implementation and verification status"
      - "missing behavior has a concrete follow-up task and acceptance evidence"
      - "platform constraints and earlier owner decisions remain explicit"
    verify: "python3 docs/android/board.py --check"
    effort_h: "3-6"
    skills: [docs, android, kotlin, js]
    agent_safe: yes
    isolation: none
    risk: Stale reports or a narrow privacy-only checklist can hide missing user features.

  - id: LW-M7-09
    title: Match LibreWolf privacy defaults in the Android settings layer
    milestone: M7
    depends_on: [LW-M6-11]
    owns:
      - patches/android/privacy-defaults.patch
      - docs/android/evidence/lw-m7-09/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/utils/SettingsTest.kt
      - mobile/android/fenix/app/src/main/res/xml/tracking_protection_preferences.xml
      - mobile/android/fenix/app/src/main/res/xml/delete_browsing_data_quit_preferences.xml
      - mobile/android/fenix/app/src/main/res/xml/autofill_preferences.xml
      - mobile/android/fenix/app/src/main/res/xml/save_logins_preferences.xml
      - mobile/android/fenix/app/src/main/res/xml/logins_preferences.xml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataOnQuitFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/doh/DohSettingsProvider.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/doh/DefaultDohSettingsProviderTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/TrackingProtectionFragment.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/TrackingProtectionFragmentTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataOnQuitFragmentTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/logins/fragment/SavedLoginsSettingFragment.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/logins/fragment/SavedLoginsSettingFragmentTest.kt
    reads:
      - settings/common.cfg
      - settings/desktop.cfg
      - settings/android.cfg
      - settings/distribution/policies.json
      - docs/android/FEATURE-PARITY.md
    what: |
      The published beta uses Fenix defaults for HTTPS-only, tracking policy,
      cleanup on quit and password/autofill controls, overriding or contradicting
      LibreWolf's Gecko configuration. Implement real Android defaults matching
      the desktop behavior: unlocked HTTPS-only on, strict tracking policy,
      cookie/site-data/cache cleanup while retaining history and permissions,
      disabled save/autofill by default, and explicit DoH off with the desktop
      provider choices. Preserve explicit user choices and use idempotent
      migration only for values proven to have been seeded by older code.
      Do not call cleanup complete on Android process death without a real
      lifecycle test, or claim a settings control works from its displayed state.
    acceptance:
      - "fresh settings select desktop-equivalent HTTPS, ETP, cleanup and password/autofill defaults"
      - "DoH stays off by default and configured provider choices match the desktop baseline"
      - "untouched older defaults upgrade while explicit user choices survive two starts"
      - "compiled unit tests exercise policy selection, cleanup categories and persisted choices"
      - "built-APK behavior verifies HTTPS, tracking, cleanup and save/autofill defaults"
    verify: "python3 docs/android/board.py --check"
    effort_h: "8-16"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: A category label or pref value can disagree with the effective engine policy.

  - id: LW-M7-10
    title: Reject unmeasured network and fingerprinting parity results
    milestone: M7
    depends_on: [LW-M6-11, LW-M5-04, LW-M5-05]
    owns:
      - scripts/android-network-check.sh
      - scripts/android-rfp-check.sh
      - scripts/tests/test-android-parity-gates.py
      - docs/android/evidence/lw-m7-10/
    what: |
      Both old honoured-layer wrappers return success after adb get-state and
      print instructions without running behavior probes. Make missing probes
      explicitly pending, including when a device is connected. Correct static
      configuration parsing, stale packaging claims and self-tests that accept
      rejection of their positive control. Configuration results must describe
      their limited scope and must not claim effective Android settings or live
      network/fingerprinting behavior. Add black-box regression tests for the
      observed false-success cases. Live behavior belongs to LW-M7-11.
    acceptance:
      - "a connected adb device without actual probes cannot report honoured success"
      - "positive and negative configuration controls are enforced"
      - "commented preferences and missing files cannot make the gate pass"
      - "configuration-only output cannot be mistaken for verified live behavior"
    verify: "python3 scripts/tests/test-android-parity-gates.py && python3 docs/android/board.py --check"
    effort_h: "2-4"
    skills: [python, shell]
    agent_safe: yes
    isolation: none
    risk: A green wrapper can conceal a privacy regression on the shipped browser.

  - id: LW-M7-11
    title: Exercise LibreWolf feature behavior in the built Android candidate
    milestone: M7
    depends_on: [LW-M7-10, LW-M3-07, LW-M7-09]
    owns:
      - scripts/android-smoke.sh
      - scripts/tests/test-android-smoke.py
      - docs/android/SMOKE.md
      - docs/android/evidence/lw-m7-11/
    what: |
      Extend the existing isolated emulator harness with real feature probes,
      starting with first-navigation uBO blocking and an allowed control, then
      lifecycle and user-choice persistence. Exercise HTTPS-only, strict tracking,
      data cleanup and form defaults through actual browser behavior and UI.
      Add network and RFP probes with positive and negative controls. Bind every
      result to the exact APK digest, source state and test inputs. Do not treat
      pref values or an installed add-on registry entry as behavior evidence.
      Preserve earlier smoke assertions and report any unimplemented probe as
      pending or failed rather than silently passing it.
    acceptance:
      - "fresh-profile first navigation blocks a bundled-list resource and loads an allowed control"
      - "uBO disable, removal, private-mode choice, restart and upgrade behavior are measured"
      - "privacy defaults and user controls are verified through built-APK behavior"
      - "network and RFP behavior probes include meaningful positive and negative controls"
      - "results identify the APK and all material test inputs and limitations"
    verify: "python3 scripts/tests/test-android-smoke.py && python3 docs/android/board.py --check"
    effort_h: "12-24"
    skills: [python, android, js]
    agent_safe: yes
    isolation: none
    risk: A delayed add-on registry check misses an unprotected first navigation.

  - id: LW-M7-12
    title: Integrate and verify the LibreWolf feature candidate in isolated CI
    milestone: M7
    depends_on: [LW-M7-11, LW-M3-05]
    owns:
      - scripts/check-patch-order.py
      - docs/android/PATCH-SCOPE.md
      - docs/android/expected-prefs.txt
      - docs/android/evidence/lw-m7-12/
    shared_edit: [assets/patches/android.txt]
    what: |
      Integrate the uBO installer, Gecko readiness bridge, privacy defaults and
      runtime harness. Register new patch ordering with actual shared-file review.
      Compile inside the isolated QEMU runner with recorded source/asset hashes,
      run the complete Fenix suite through the checked-in subtraction gate, and
      build development-signed release-type APKs for smoke and behavior checks.
      Preserve old release tags/assets and keep release signing with the owner.
      This candidate verifies the implemented feature increment; other inventory
      gaps remain open until their implementation and behavior are verified.
      Prepare a separate candidate5 APK/full-unit-test checkpoint bound to the
      explicitly reviewed product composition and a supplied successful
      native build receipt. Preserve prior candidate evidence and all prior test
      selections; include actual Task29/31/35/36 API/state source tests. Resolve
      all four APK shortcut resources with a pinned build aapt2; keep native
      instrumentation and runtime acceptance separate from this unit checkpoint.
    acceptance:
      - "the complete Android patch sequence applies with declared ordering and scope"
      - "Gecko and Fenix compile from the recorded final source and pinned assets"
      - "the full Fenix XML gate passes without increasing the failure allowlist"
      - "release-type APKs pass smoke, pref audit and implemented feature behavior checks"
      - "evidence binds each result to its source, toolchain, APK and test inputs"
    verify: "python3 -m unittest discover -s docs/android/evidence/lw-m7-12/candidate5 -p 'test_*.py' && python3 docs/android/board.py --check"
    effort_h: "8-16"
    skills: [android, shell, python]
    agent_safe: yes
    isolation: worktree
    risk: A successful build of an earlier source snapshot does not validate the final candidate.

  - id: LW-M7-13
    title: Restore cookie-banner rejection from a verified offline rules snapshot
    milestone: M7
    retired: |
      2026-10-02: Firefox 156 removed the cookie banner service. Firefox 157 has
      no toolkit/components/cookiebanners, no cookie-banner-rules-list dump and no
      cookiebanners.* prefs, so there are no rules to package. cookie-banner-rules.patch
      and its tests were deleted at the 157 integration (PATCH-SCOPE.md, "Android
      patches retired at the 157 integration"). Owner decision the same day:
      uBlock Origin's cookie-notice lists replace the service (LW-M7-41).
    depends_on: [LW-M7-12]
    owns:
      - patches/android/cookie-banner-rules.patch
      - scripts/tests/test-cookie-banner-rules.js
      - scripts/tests/test-cookie-banner-snapshot.py
      - docs/android/evidence/lw-m7-13/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - toolkit/components/cookiebanners/CookieBannerListService.sys.mjs
      - services/settings/dumps/main/moz.build
      - services/settings/dumps/main/cookie-banner-rules-list.json
      - toolkit/components/cookiebanners/test/unit/test_cookiebannerlistservice.js
    reads:
      - docs/android/evidence/lw-m7-08/translation-cookie-data-audit.md
    what: |
      The Android APK has no cookie-banner rules despite effective reject-only
      modes. Package the source snapshot verified against the complete official
      collection and add an Android-only local loader that verifies its pin and
      validates records before importing them through the production service.
      On Android do not construct or subscribe to a cookie Remote Settings client.
      Keep both Remote Settings allowlists and blockers unchanged. Preserve
      desktop behavior and the existing rejection-only policy. Record provenance
      and update rules only with a reviewed application release.
    acceptance:
      - "the APK includes the exact pinned, validated rules and imports them without cookie collection traffic"
      - "missing, corrupt, malformed or mismatched rule data cannot report successful initialization"
      - "a supported banner performs a real rejection or opt-out cookie action"
      - "accept-only banners remain unaccepted and existing consent and domain exceptions are respected"
      - "normal and private behavior survives the intended lifecycle and runtime evidence includes an allowed control"
    verify: "python3 scripts/tests/test-cookie-banner-snapshot.py && python3 docs/android/board.py --check"
    effort_h: "6-12"
    skills: [js, python, android]
    agent_safe: yes
    isolation: worktree
    risk: Hiding a banner or enabling a pref is not evidence of rejecting consent.

  - id: LW-M7-14
    title: Add origin-bound WebGL and canvas permissions with Android controls
    milestone: M7
    depends_on: [LW-M7-12]
    owns:
      - patches/android/canvas-webgl-permissions.patch
      - docs/android/evidence/lw-m7-14/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - dom/canvas/ClientWebGLContext.cpp
      - dom/canvas/CanvasUtils.cpp
      - dom/canvas/CanvasUtils.h
      - modules/libpref/init/StaticPrefList.yaml
      - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
      - mobile/shared/actors/GeckoViewPermissionChild.sys.mjs
      - mobile/shared/actors/GeckoViewPermissionParent.sys.mjs
      - mobile/shared/components/geckoview/GeckoViewPermission.sys.mjs
      - mobile/shared/modules/geckoview/GeckoViewStorageController.sys.mjs
      - mobile/android/geckoview/api.txt
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoSession.java
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/StorageController.java
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/CanvasPermissionTest.kt
      - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/permission/PermissionRequest.kt
      - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/permission/OriginBoundPermission.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/permission/GeckoPermissionRequest.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/permission/GeckoSitePermissionsStorage.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt
      - mobile/android/android-components/components/browser/state/src/main/java/mozilla/components/browser/state/ext/PermissionRequest.kt
      - mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsFeature.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/permission/OriginBoundPermissionRequestTest.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/permission/OriginBoundPermissionsStorageTest.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/permission/GeckoSitePermissionsStorageTest.kt
      - mobile/android/android-components/components/browser/state/src/test/java/mozilla/components/browser/state/ext/PermissionRequestTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/BaseBrowserFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsFeature.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/trustpanel/TrustPanelFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/trustpanel/ui/ProtectionPanel.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/quicksettings/QuickSettingsSheetDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/sitepermissions/SiteSettingsFragment.kt
      - mobile/android/fenix/app/src/main/res/xml/site_permissions_preferences.xml
      - mobile/android/fenix/app/src/main/res/values/strings.xml
      - mobile/android/fenix/app/src/main/res/values/origin_bound_permissions_ids.xml
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsFeatureTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsDialogFragmentTest.kt
    reads:
      - docs/android/evidence/lw-m7-08/permissions-bridge-source-audit.md
    what: |
      Implement the audited Android document-actor permission bridge so WebGL
      and canvas decisions bind to the requesting principal and current document.
      Extend the Android Components and Fenix permission models, prompts and
      site controls; add their exact owned source/test paths to this task before
      editing them. Use real engine session expiry for temporary normal grants,
      preserve private isolation, and expose permanent/session decisions and
      quiet blocked attempts for revocation. Cover OffscreenCanvas and workers;
      never trust an unverified origin string or grant the top-level principal
      for a frame request. Enable Android WebGL prompting only in the complete
      implementation, with successful rendering after allow/reload and denial
      after block/revoke. Preserve desktop behavior and existing Android
      permissions. Native changes require all three ABI builds.
    acceptance:
      - "WebGL1/2 and canvas readback are protected by default and usable after an explicit matching-origin allow"
      - "blocked, quiet and granted states have real Android prompt/site controls and can be revoked"
      - "temporary decisions survive required reload but expire on normal process restart, and private decisions remain private"
      - "cross-origin frames, opaque origins, workers and stale documents cannot grant another principal"
      - "all native ABIs and affected Kotlin targets compile, meaningful unit suites pass and built-APK rendering/readback controls pass"
    verify: "python3 docs/android/board.py --check"
    effort_h: "20-40"
    skills: [cpp, js, kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: An incomplete permission bridge can disable all WebGL or persist permission for the wrong origin.

  - id: LW-M7-15
    title: Bound CI memory after a measured host OOM interruption
    milestone: M7
    depends_on: [LW-M7-12, LW-M6-09]
    owns:
      - scripts/ci-vm/inside.sh
      - scripts/ci-vm/verify-guest.sh
      - docs/android/CI-VM.md
      - docs/android/evidence/lw-m7-15/
    what: |
      The host kernel killed the 24 GiB QEMU process during the combined Fenix
      suite, and systemd restarted the VM. Preserve the failed-run evidence.
      Reduce guest RAM to 16 GiB with the existing disk swap, verify the resource
      and isolation contract after a controlled restart, and run long manual
      validation jobs under the guest service manager with terminal exit receipts.
      Leave unrelated host applications alone. Measure the subsequent build and
      tests before claiming the new allocation is sufficient.
    acceptance:
      - "host OOM and interrupted-suite evidence is preserved without a false test pass"
      - "the VM boots with 16 GiB RAM, unchanged isolation and usable disk swap"
      - "validation jobs survive SSH disconnects and record terminal status"
      - "subsequent full-suite and APK-build resource results are recorded"
    verify: "python3 docs/android/board.py --check"
    effort_h: "2-4"
    skills: [ops, shell]
    agent_safe: yes
    isolation: none
    risk: An oversized guest can kill the CI process and stall the user's host.

  - id: LW-M7-16
    title: Restore translations with pinned assets and scoped user downloads
    milestone: M7
    depends_on: [LW-M7-12]
    owns:
      - patches/android/translation-assets.patch
      - assets/translations/
      - scripts/package-translation-assets.py
      - scripts/tests/test-translation-assets.py
      - scripts/tests/test-translation-assets.js
      - scripts/librewolf-patches.py
      - Makefile
      - docs/android/evidence/lw-m7-16/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - toolkit/components/translations/AndroidTranslationAssets.sys.mjs
      - toolkit/components/translations/moz.build
      - toolkit/components/translations/jar.mn
      - toolkit/components/translations/translations.d.ts
      - toolkit/components/translations/TranslationsUtils.mjs
      - toolkit/components/translations/actors/TranslationsParent.sys.mjs
      - toolkit/components/translations/actors/TranslationsChild.sys.mjs
      - toolkit/components/translations/actors/TranslationsEngineChild.sys.mjs
      - mobile/shared/modules/geckoview/GeckoViewTranslations.sys.mjs
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/TranslationsController.java
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/TranslationsTest.kt
      - toolkit/components/translations/tests/unit/xpcshell.toml
      - toolkit/components/translations/tests/unit/test_android_translation_assets.js
      - toolkit/components/translations/android-data/catalog.json
      - toolkit/components/translations/android-data/bergamot-translator.wasm.zst
    reads:
      - docs/android/evidence/lw-m7-08/translation-cookie-data-audit.md
    what: |
      Package a reviewed complete v2 translations catalog and verified compatible
      WASM 4 resource. Serve metadata and inference assets from that catalog and
      verified local cache without constructing Remote Settings clients, altering
      either allowlist or bypassing generic download blockers. Only explicit
      Translate and language-download operations authorize their exact selected
      pinned assets, with cancellation and stale-document protection; passive
      detection, offers, automatic translation and status calls remain cache-only.
      Preserve version/targeting/pivot selection, real UI status and deletion,
      desktop behavior and existing translation error reporting.
    acceptance:
      - "the APK contains the exact complete reviewed v2 catalog and compatible WASM 4, with recorded origins, hashes, sizes and licenses"
      - "passive metadata, settings, automatic translation and engine payload calls cannot fetch assets or sync translation collections"
      - "only an active explicit operation downloads its selected pinned HTTPS assets; other URLs, redirects, stale documents and cancelled operations are rejected"
      - "compressed and decompressed integrity and size bounds are enforced before use; corrupt, partial and failed data never becomes a usable atomic cache entry"
      - "real unmocked direct and pivot translations work, survive offline restart, and reflect deletion and download failures in existing UI status"
      - "concurrent operations, timeout/cancel/delete and normal/private document lifecycles are tested; source tests, target build and actual APK gates pass"
    verify: "python3 scripts/tests/test-translation-assets.py && python3 docs/android/board.py --check"
    effort_h: "16-28"
    skills: [js, python, android]
    agent_safe: yes
    isolation: worktree
    risk: A shared download permission could turn passive translation detection into unsolicited asset transfer.

  - id: LW-M7-17
    title: Map every desktop patch and policy to current Android behavior
    milestone: M7
    depends_on: [LW-M7-08, LW-M7-12]
    owns:
      - docs/android/evidence/lw-m7-17/
    reads:
      - assets/patches/desktop.txt
      - settings/distribution/policies.json
      - docs/android/FEATURE-PARITY.md
      - docs/android/PATCH-SCOPE.md
      - docs/android/POLICIES.md
    what: |
      Read every registered desktop patch and every shipped policy key, including
      copied preference-pane assets and policy subkeys. Map each effect to an
      actual Android implementation, desktop integration boundary or explicit
      remaining gap. Recheck stale mechanism claims against current source and
      preserve the distinction between implemented code and tested APK behavior.
      Pin inputs and mechanically check complete coverage of the lists; a path
      classification alone must never mark a functional requirement complete.
    acceptance:
      - "every current desktop patch and policy key has an input-bound effect mapping"
      - "all meaningful policy subkeys and preference-pane controls are accounted for"
      - "Android counterpart claims cite inspected source or matching runtime evidence"
      - "missing functionality and unverified behavior remain explicit open items"
    verify: "python3 docs/android/board.py --check"
    effort_h: "4-8"
    skills: [android, js, python]
    agent_safe: yes
    isolation: none
    risk: Classifying a patch as desktop-only can conceal a missing mobile feature.

  - id: LW-M7-18
    title: Verify Android graphics consent, rendering and permission lifetime
    milestone: M7
    depends_on: [LW-M7-11, LW-M7-14, LW-M7-12]
    owns:
      - scripts/android-graphics-smoke.py
      - docs/android/evidence/lw-m7-18/
    reads:
      - scripts/android-smoke.sh
      - patches/android/canvas-webgl-permissions.patch
      - docs/android/evidence/lw-m7-14/android-ui-handoff.md
    what: |
      Add a separate installed-release graphics runner using actual Fenix quiet
      review and per-origin permission controls. Establish default protection,
      explicit Allow/Block/session/Remember/private choices, real WebGL1/2 and
      canvas pixels, frame/port isolation and revoke/reset behavior. Read engine
      state only as corroborating evidence; never inject preferences, write the
      permission manager, install an APK or mutate the guest during development.
      The runner consumes an already enabled Marionette transport and a dedicated
      test profile. Add meaningful grader/selector/transport-negative tests inside
      the owned evidence directory. Missing devices or incomplete prerequisites
      must report pending rather than success. Root integrates the legacy WebGL
      assertion and runs the built-APK checks after all native ABI builds.
    acceptance:
      - "default blocking, actual UI consent and exact rendered pixels are independently required"
      - "real UI reset/block restores protection and frame/port scopes remain distinct"
      - "session, remembered and private choices are tested through real controls and lifecycle changes"
      - "ambiguous selectors, missing pixels or absent devices cannot produce PASS"
      - "release acceptance performs no preference injection or permission-manager writes"
    verify: "python3 docs/android/evidence/lw-m7-18/test-android-graphics-smoke.py && python3 docs/android/board.py --check"
    effort_h: "8-14"
    skills: [python, android, js]
    agent_safe: yes
    isolation: worktree
    risk: Synthetic grants or weak UI selectors could label an unusable or overbroad permission bridge as safe.

  - id: LW-M7-21
    title: Resolve feature compilation with source-bound evidence
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-13, LW-M7-14, LW-M7-16, LW-M7-17, LW-M7-18, LW-M7-20, LW-M7-23, LW-M7-26, LW-M7-29, LW-M7-30, LW-M2-03]
    owns:
      - scripts/android-fat-aar.sh
      - scripts/tests/test-android-fat-aar-maven.py
      - patches/android/translation-assets.patch
      - patches/android/firefox-suggest-policy.patch
      - patches/android/canvas-webgl-permissions.patch
      - patches/android/cookie-banner-controls.patch
      - scripts/android-smoke.sh
      - scripts/android-graphics-smoke.py
      - scripts/tests/test-android-smoke.py
      - docs/android/evidence/lw-m7-16/source-files.json
      - docs/android/evidence/lw-m7-16/README.md
      - docs/android/evidence/lw-m7-14/source-sha256.txt
      - docs/android/evidence/lw-m7-14/validation.json
      - docs/android/evidence/lw-m7-23/source-files.json
      - docs/android/evidence/lw-m7-26/source-files.json
      - docs/android/evidence/lw-m7-26/scoped-pristine.tar.gz
      - docs/android/evidence/lw-m7-26/README.md
      - docs/android/evidence/lw-m7-29/source-files.json
      - docs/android/evidence/lw-m7-17/
      - docs/android/evidence/lw-m7-21/
      - docs/android/FEATURE-PARITY.md
    tree_paths:
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/FenixApplicationTest.kt
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/TranslationsController.java
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestAdmission.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestAdmissionTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SearchEngineFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsDialogFragment.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/quicksettings/protections/cookiebanners/DefaultCookieBannerDetailsControllerTest.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/permission/OriginBoundPermissionsStorageTest.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/cookiebanners/GeckoCookieBannersStorageTest.kt
      - mobile/android/android-components/components/service/firefox-accounts/src/test/java/mozilla/components/service/fxa/AccountServicesDisabledTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsFeatureTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/cookiebannerhandling/CookieBannerSettingsTest.kt
    what: |
      Fix compiler failures in integrated feature code against the actual pinned
      Gecko API. Preserve unsuccessful build receipts and source lineage, replay
      affected source tests, and require actual target builds before claiming a
      fix compiled. Keep the feature inventory aligned with measured behavior.
      Correct actual target-test compiler/stubbing failures with preserved failed
      XML and source receipts; test-only fixes still require a complete rerun.
    acceptance:
      - "the corrected source compiles in the isolated target build"
      - "affected source tests pass and revised source hashes match the guest"
      - "failed and successful evidence remains distinguishable by source and run"
    verify: "python3 scripts/tests/test-translation-assets.py && python3 docs/android/board.py --check"
    effort_h: "2-6"
    skills: [android, java, python]
    agent_safe: yes
    isolation: worktree
    risk: Refreshing hashes alone cannot establish that corrected code compiled.

  - id: LW-M7-24
    title: Match ordinary home-section defaults to LibreWolf policy
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-17, LW-M5-01]
    owns:
      - patches/android/home-section-defaults.patch
      - docs/android/evidence/lw-m7-24/
    shared_edit:
      - assets/patches/android.txt
    tree_paths:
      - mobile/android/fenix/app/nimbus.fml.yaml
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/utils/HomeSectionDefaultsTest.kt
    what: |
      Turn off default ordinary top sites, recent tabs, bookmarks and history
      home sections, matching FirefoxHome TopSites/Highlights policy effects.
      Preserve existing explicit section choices, actual stored history and
      bookmarks, and the real home customization controls. Apply the defaults
      consistently to all build channels. This does not implement unrelated
      Firefox Suggest, default bookmark seeding or sponsored-content controls.
    acceptance:
      - "new profiles default all four ordinary home sections off on every channel"
      - "explicit opposite choices persist through Settings recreation and restart"
      - "home settings remain usable and stored history/bookmarks are preserved"
      - "target compilation, full Fenix gate and actual fresh/restart UI checks pass"
    verify: "python3 docs/android/board.py --check"
    effort_h: "2-4"
    skills: [android, kotlin]
    agent_safe: yes
    isolation: worktree
    risk: Changing defaults must not erase user data or silently reset deliberate choices.

  - id: LW-M7-19
    title: Make Android add-on state durable and reconcile it before cold startup
    milestone: M7
    depends_on: [LW-M3-07, LW-M7-12]
    owns:
      - patches/android/addon-state-durability.patch
      - scripts/tests/test-addon-state-durability.py
      - scripts/tests/test-addon-state-durability.js
      - docs/android/evidence/lw-m7-19/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - toolkit/mozapps/extensions/internal/AndroidAddonState.sys.mjs
      - toolkit/mozapps/extensions/internal/moz.build
      - toolkit/mozapps/extensions/internal/AddonTestUtils.sys.mjs
      - toolkit/mozapps/extensions/internal/XPIProvider.sys.mjs
      - toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
      - toolkit/mozapps/extensions/internal/XPIInstall.sys.mjs
      - toolkit/mozapps/extensions/test/xpcshell/xpcshell.toml
      - toolkit/mozapps/extensions/test/xpcshell/test_android_addon_state.js
      - toolkit/mozapps/extensions/test/xpcshell/test_addonStartup_save_failures.js
    reads:
      - docs/android/evidence/lw-m7-12/runtime-fifth-attempt/
    what: |
      Immediate force-stop after an acknowledged disable leaves the database
      disabled but the delayed startup cache enabled. On restart the stale cache
      loads an active extension policy despite the disabled registry. Serialize
      Android database/cache writes and await actual completed atomic flushed
      writes at operation completion. Reconcile old inconsistent profiles before
      scheduling extension backgrounds. Cover enable, disable, removal, pending
      uninstall cancellation and updates without uBO special cases, signature or
      type bypasses, sleeps, or changing desktop persistence behavior.
    acceptance:
      - "successful Android enable/disable/removal/install/update completion observes matching durable database and startup cache state"
      - "immediate restart and migration of a stale enabled cache cannot load a disabled or removed extension policy or listener"
      - "overlapping writes and operations, failed writes, retries and cancelled uninstall preserve coherent state without false success"
      - "actual JavaScript tests and target Gecko tests cover state and failure boundaries; desktop behavior and public API signatures are preserved"
      - "target APK compilation and real extension blocking/allowed controls pass before and after immediate force-stop, enable, removal and update"
    verify: "python3 scripts/tests/test-addon-state-durability.py && python3 docs/android/board.py --check"
    effort_h: "10-18"
    skills: [js, android, python]
    agent_safe: yes
    isolation: worktree
    risk: A disabled registry entry can retain a live extension policy if the startup cache is stale.

  - id: LW-M7-25
    title: Adjust native CI allocation after measured guest swapping
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-15, LW-M7-21]
    owns:
      - assets/mozconfig.android
      - scripts/ci-vm/inside.sh
      - scripts/ci-vm/verify-guest.sh
      - scripts/ci-vm/guest-provision.sh
      - docs/android/CI-VM.md
      - docs/android/evidence/lw-m7-25/
      - docs/android/evidence/lw-m7-12/run-extended-native.sh
      - docs/android/evidence/lw-m7-12/followup-source/
    what: |
      Native compilation exhausted useful memory in the 16 GiB guest; Rust held
      roughly 12 GiB resident while guest full memory pressure exceeded 20 percent
      and SSH status commands timed out. Preserve the interrupted build, verify
      source integrity, and use 20 GiB guest RAM with a separate bounded native
      compiler wrapper. Keep the existing smaller Fenix/test limits. Recheck
      isolation and host headroom, then resume incremental native compilation.
      After measured gkrust OOM, disable diagnostic symbols while preserving
      optimization, LTO and hardening; archive the failure and rebuild every ABI.
    acceptance:
      - "interrupted native logs and resource observations are retained without claiming a build pass"
      - "20 GiB guest RAM, existing swap and host/guest isolation checks are verified after restart"
      - "native compiler memory is bounded separately and source hashes match before and after its run"
      - "actual subsequent build outcome and memory pressure are recorded"
    verify: "python3 docs/android/board.py --check"
    effort_h: "2-4"
    skills: [ops, shell]
    agent_safe: yes
    isolation: none
    risk: Native compiler working memory must fit without recreating the earlier host OOM.

  - id: LW-M7-20
    title: Make Android accounts and Sync opt-in with a restart boundary
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-14, LW-M7-17]
    owns:
      - patches/android/sync-opt-in.patch
      - docs/android/evidence/lw-m7-20/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/android-components/components/service/firefox-accounts/src/main/java/mozilla/components/service/fxa/AccountServices.kt
      - mobile/android/android-components/components/service/firefox-accounts/src/main/java/mozilla/components/service/fxa/manager/FxaAccountManager.kt
      - mobile/android/android-components/components/service/firefox-accounts/src/main/java/mozilla/components/service/fxa/sync/WorkManagerSyncManager.kt
      - mobile/android/android-components/components/feature/syncedtabs/src/main/java/mozilla/components/feature/syncedtabs/commands/SyncedTabsCommandsFlushScheduler.kt
      - mobile/android/android-components/components/feature/syncedtabs/src/main/java/mozilla/components/feature/syncedtabs/commands/SyncedTabsCommandsFlushWorker.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/HomeActivity.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/BackgroundServices.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/BaseBrowserFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/relay/RelayFeatureIntegration.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/accounts/FxaWebChannelIntegration.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/AccountServicesPreference.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/account/TurnOnSyncFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/account/AuthIntentReceiverActivity.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/account/AuthCustomTabActivity.kt
      - mobile/android/fenix/app/src/main/res/values/account_services_strings.xml
      - mobile/android/android-components/components/service/firefox-accounts/src/test/java/mozilla/components/service/fxa/AccountServicesTest.kt
      - mobile/android/android-components/components/service/firefox-accounts/src/test/java/mozilla/components/service/fxa/AccountServicesDisabledTest.kt
      - mobile/android/android-components/components/service/firefox-accounts/src/test/java/mozilla/components/service/fxa/sync/AccountServicesWorkerTest.kt
      - mobile/android/android-components/components/feature/syncedtabs/src/test/java/mozilla/components/feature/syncedtabs/commands/AccountServicesFlushWorkerTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/AccountServicesPreferenceTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/HomeActivityAccountSettingsTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/helpers/FenixRobolectricTestApplication.kt
    reads:
      - patches/pref-pane/librewolf.js
      - docs/android/evidence/lw-m7-17/coverage.json
    what: |
      Default Android account services off through actual FxA, Sync worker and
      Relay gates. Provide explicit enable/disable-and-restart controls, commit
      the choice synchronously, preserve account data and engine choices, and
      use the process boundary to terminate blocking native work. Gate startup,
      persisted workers/providers and deep-link callbacks before service work;
      visiting a login link must never opt in. Preserve existing custom server
      configuration and logout controls. Register exact source/test paths before
      implementation; root owns target builds and runtime validation. Retain
      actual failed Kotlin XML/source evidence and correct primitive Boolean
      test matchers without changing production behavior or weakening assertions;
      require a fresh affected/full target suite after any fixture correction.
      Initialize persisted account admission only in the existing main-process
      branch before content providers. Explicitly close non-main admission
      without preference reads or account construction. Preserve the actual
      isolated-child startup crash and add production attach and admission tests
      before claiming the rebuilt APK can navigate.
      Restore custom-tab handleNewIntent early return before account-settings
      extra inspection, preserving existing no-op tests. Add explicit regular
      HomeActivity and external/auth custom-tab account-settings intent coverage;
      keep the observed target failures and new APK/full-suite gates explicit.
    acceptance:
      - "fresh and persisted-off starts do not initialize FxA, Sync or Relay service work"
      - "explicit enable/disable commits the selected state and genuinely restarts; failed persistence leaves the current running state and reports an error"
      - "switch-off cancels account work and terminates native operations without logout or deleting account/engine data"
      - "workers, delayed callbacks and deep links cannot opt in or revive service work while off"
      - "explicit opt-in supports actual login/sync/logout with existing custom endpoints and survives process death"
      - "affected targets compile, meaningful unit gates pass and source-bound APK lifecycle/network tests pass"
    verify: "python3 docs/android/evidence/lw-m7-20/check-source.py && python3 docs/android/board.py --check"
    effort_h: "8-16"
    skills: [android, kotlin]
    agent_safe: yes
    isolation: worktree
    risk: An inert frontend setting or cancelled WorkManager job can leave synchronous native account traffic running.

  - id: LW-M7-23
    title: Add normal and private cookie-banner controls and domain exceptions
    milestone: M7
    retired: |
      2026-10-02: Firefox 156 removed the cookie banner service and GeckoView's
      Cookie Banner Handling API ("there is no replacement", bug 2058143), so
      there are no engine modes or domain exceptions left to expose.
      cookie-banner-controls.patch and its tests were deleted at the 157
      integration. Owner decision the same day: uBlock Origin's cookie-notice
      lists replace the service, opt-out in uBO's own settings (LW-M7-41).
    depends_on: [LW-M7-12, LW-M7-13, LW-M7-14, LW-M7-20]
    owns:
      - patches/android/cookie-banner-controls.patch
      - scripts/tests/test-cookie-banner-controls.py
      - scripts/tests/test-cookie-banner-controls.js
      - docs/android/evidence/lw-m7-23/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - docshell/base/CanonicalBrowsingContext.h
      - docshell/base/CanonicalBrowsingContext.cpp
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/cookiebannerhandling/CustomCBHSwitchPreference.kt
      - mobile/android/fenix/app/src/main/res/xml/preferences.xml
      - mobile/android/fenix/app/src/main/res/values/preference_keys.xml
      - mobile/android/fenix/app/src/main/res/values/strings.xml
      - mobile/android/fenix/app/src/main/res/values/cookie_banner_controls_ids.xml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/cookiebannerhandling/CookieBannerSiteController.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/cookiebannerhandling/CookieBannerSiteDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/quicksettings/protections/cookiebanners/CookieBannerPanelDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/quicksettings/QuickSettingsSheetDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/trustpanel/TrustPanelFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/trustpanel/ui/ProtectionPanel.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/cookiebanners/GeckoCookieBannersStorage.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/cookiebanners/GeckoCookieBannersStorageTest.kt
      - mobile/shared/modules/geckoview/GeckoViewStorageController.sys.mjs
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/cookiebannerhandling/CookieBannerSiteControllerTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/cookiebannerhandling/CookieBannerSettingsTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/quicksettings/protections/cookiebanners/CookieBannerDetailsController.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/quicksettings/protections/cookiebanners/DefaultCookieBannerDetailsControllerTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/quicksettings/protections/ProtectionsView.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/quicksettings/ProtectionsViewTest.kt
      - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/cookiehandling/CookieBannersStorage.kt
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/StorageController.java
      - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
      - toolkit/components/cookiebanners/nsICookieBannerService.idl
      - toolkit/components/cookiebanners/nsCookieBannerService.h
      - toolkit/components/cookiebanners/nsCookieBannerService.cpp
      - toolkit/components/cookiebanners/CookieBannerDomainPrefService.h
      - toolkit/components/cookiebanners/CookieBannerDomainPrefService.cpp
      - toolkit/components/cookiebanners/test/unit/xpcshell.toml
      - toolkit/components/cookiebanners/test/unit/test_cookiebanner_private_session.js
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/CookieBannerPrivateSessionTest.kt
      - mobile/android/geckoview/api.txt
    what: |
      Expose persisted, independently effective normal/private global controls and
      rejection-only site exception/reset controls through both Fenix site panels.
      Match Gecko's desktop registrable-domain scope across subdomains and schemes,
      label that scope and normal/private lifetime, preserve existing stored choices,
      and never clear cookies or other site data when changing a banner exception.
      Await storage acknowledgments and surface failures. Fence private operations
      with a canonical-context generation checked at native mutation, including
      nested initialization, teardown/reopen and autostart. Preserve legacy APIs.
      Keep security-only Remote
      Settings allowlists and packaged local rules unchanged. Add actual source and
      Kotlin unit tests; target compilation and installed-APK behavior are separate
      mandatory gates coordinated by the integration task.
    acceptance:
      - "both global controls persist independent choices and change effective engine modes between disabled and reject-only"
      - "normal exceptions survive restart, private exceptions stay isolated and expire with the last private context"
      - "site controls label registrable-domain and scheme scope, acknowledge writes, reset to global behavior and surface failures"
      - "switching or resetting banner handling does not clear ordinary or private site data"
      - "source tests, target compilation, full Fenix subtraction gate and actual installed-APK controls pass"
    verify: "python3 scripts/tests/test-cookie-banner-controls.py && python3 docs/android/board.py --check"
    effort_h: "8-16"
    skills: [android, kotlin, js, cpp, python]
    agent_safe: yes
    isolation: worktree
    risk: A preference-only switch or unacknowledged domain write can misrepresent effective protection and private isolation.

  - id: LW-M7-22
    title: Verify packaged cookie-banner rules through actual page behavior
    milestone: M7
    retired: |
      2026-10-02: the packaged rules (LW-M7-13) and controls (LW-M7-23) it was to
      verify cannot exist on Firefox 157, which removed the cookie banner service.
      scripts/android-cookie-banner-smoke.py now belongs to LW-M7-41 and checks
      the uBO cookie-notice lists instead; its 153 runner, which
      docs/android/evidence/lw-m7-22/test-cookie-banner-smoke.py tests, is in git
      history (the version before LW-M7-41).
    depends_on: [LW-M7-12, LW-M7-13, LW-M7-18, LW-M7-23]
    owns:
      - docs/android/evidence/lw-m7-22/
    reads:
      - scripts/android-graphics-smoke.py
      - scripts/android-smoke.sh
      - patches/android/cookie-banner-rules.patch
      - docs/android/evidence/lw-m7-13/
      - patches/android/cookie-banner-controls.patch
      - docs/android/evidence/lw-m7-23/
    what: |
      Add an installed-release cookie-banner runner using packaged Cookiebot and
      accept-only Didomi global rules. Require actual page callback counters,
      cookies and server requests plus a separate explicit click control; hidden
      banners alone never pass. Await the existing list-service readiness promise,
      inspect effective preferences and reject test-rule or transport injection.
      Exercise available real Fenix controls, normal/private lifetime and restart
      behavior. Keep missing normal controls, domain mapping and native duh.de
      cookie-injector coverage explicitly pending. Never write rules, preferences
      or engine exceptions, install an APK, or mutate a guest during development.
      Root runs the installed candidate and integrates any existing smoke changes.
    acceptance:
      - "packaged rules are ready and actual reject callbacks/cookies/requests agree"
      - "accept-only banners remain unaccepted and a later explicit click proves the control"
      - "real UI modes/exceptions, consent and normal/private lifecycle have runtime evidence"
      - "native domain-rule injection is measured or remains an explicit pending requirement"
      - "missing APK/device, tainted configuration and cosmetic hiding cannot pass"
    verify: "python3 docs/android/evidence/lw-m7-22/test-cookie-banner-smoke.py && python3 docs/android/board.py --check"
    effort_h: "6-12"
    skills: [python, android, js]
    agent_safe: yes
    isolation: worktree
    risk: Cosmetic hiding or fabricated rules can conceal missing native rejection and injection.

  - id: LW-M7-26
    title: Apply Firefox Suggest defaults to Android services and controls
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-14, LW-M7-16, LW-M7-20, LW-M7-23]
    owns:
      - patches/android/firefox-suggest-policy.patch
      - docs/android/evidence/lw-m7-26/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/FenixApplicationTest.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestAdmission.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/GlobalFxSuggestDependencyProvider.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestStorage.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionScheduler.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestIngestionWorker.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestSuggestionProvider.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/datasource/CombinedOnlineSuggestionDataSource.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/client/SuggestMerinoClient.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SearchEngineFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/search/awesomebar/SearchSuggestionsProvidersBuilder.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/FirefoxSuggestPolicy.kt
      - mobile/android/fenix/app/src/main/res/xml/search_settings_preferences.xml
      - mobile/android/fenix/app/src/main/res/values/firefox_suggest_policy_strings.xml
      - mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/FxSuggestAdmissionTest.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/datasource/OnlineSuggestionAdmissionTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/search/FirefoxSuggestPolicyTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/helpers/FenixRobolectricTestApplication.kt
    reads:
      - settings/distribution/policies.json
      - docs/android/evidence/lw-m7-17/coverage.json
    what: |
      Mirror the inspected desktop FirefoxSuggest default-pref semantics: false
      WebSuggestions, SponsoredSuggestions and ImproveSuggest/OnlineEnabled,
      with explicit choices preserved because the policy has no Locked field.
      Expose actual Android master/web/sponsored/online controls and gate lazy
      provider/storage construction, startup and periodic ingestion, restored
      workers, queued online requests and late results using effective choices.
      Keep ordinary search-engine query suggestions, local history/bookmarks,
      custom search engines and home section/shortcut seeding separate. Inspect
      desktop in-flight handling before defining cancellation parity. Retain
      exact source lineage and meaningful tests; root owns target execution.
      Guard persisted Suggest initialization with the existing main-process
      check before preference access; explicitly close non-main admission in
      memory. Preserve parent choices and other A-C embedder defaults. Retain
      the actual isolated-child crash and test combined production attachment,
      with separately explicit host-fixture initialization before per-test setup.
    acceptance:
      - "fresh defaults are effectively off on every channel and stored explicit choices survive upgrades"
      - "visible master and leaf controls drive actual local Suggest and online Merino admission"
      - "disabled startup and restored workers do not construct Suggest storage/native clients or perform ingestion"
      - "queued requests and stale provider references cannot bypass a changed choice; late results are discarded"
      - "ordinary query suggestions, local history/bookmarks and custom search remain functional"
      - "meaningful unit tests, affected target compilation and source-bound APK/network controls pass before completion"
    verify: "python3 docs/android/evidence/lw-m7-26/check-source.py && python3 docs/android/board.py --check"
    effort_h: "6-12"
    skills: [android, kotlin]
    agent_safe: yes
    isolation: worktree
    risk: A hidden master flag or eager Merino client can perform work while visible suggestion controls are off.

  - id: LW-M7-28
    title: Exercise durable add-on choices through actual Fenix controls
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-19, LW-M7-18]
    owns:
      - scripts/android-addon-state-smoke.py
      - docs/android/evidence/lw-m7-28/
    reads:
      - scripts/android-graphics-smoke.py
      - scripts/android-smoke.sh
      - patches/android/addon-state-durability.patch
      - docs/android/evidence/lw-m7-19/
      - patches/android/ubo-preinstall.patch
    what: |
      Add a standalone installed-release runner using actual Fenix add-on enable,
      disable, private permission and removal controls. Observe registry, policies
      and live listeners read-only alongside independent parser-served blocked and
      allowed resource requests. Force-stop immediately after the UI acknowledges
      a choice, restart and check the first navigation. Keep removal last and
      preserve incoherent state as evidence. Bind the exact APK and packaged uBO
      filter source, reject missing/stale/partial evidence, and never install,
      wipe, change preferences or mutate AddonManager through the harness. Audit
      the actual update route and document a reproducible signed older-to-newer
      case; keep full acceptance pending when signed fixtures are unavailable.
      Root owns real devices, guest builds and target integration.
    acceptance:
      - "actual UI acknowledgments precede immediate process restart and first-navigation checks"
      - "registry, live policy/listeners and parser-origin blocked/allowed requests agree for enable, disable and private permission"
      - "confirmed removal remains absent after restart without reinstall or state repair"
      - "a verified signed older-to-newer update preserves its real UI choice or remains explicitly pending"
      - "wrong APK, missing UI acknowledgment, stale document and missing parser/network evidence cannot pass"
    verify: "python3 docs/android/evidence/lw-m7-28/test-addon-state-smoke.py && python3 docs/android/board.py --check"
    effort_h: "8-14"
    skills: [python, android, js]
    agent_safe: yes
    isolation: worktree
    risk: An acknowledged registry change can conceal a stale startup cache or active blocking listener after process death.

  - id: LW-M7-30
    title: Stop seeding bundled default home shortcuts
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-17, LW-M7-24]
    owns:
      - patches/android/no-default-shortcuts.patch
      - docs/android/evidence/lw-m7-30/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/fenix/app/src/main/res/raw/default_pinned_shortcuts.json  # initial_shortcuts.json before Firefox 158
    what: |
      Mirror LibreWolf's empty browser.newtabpage.activity-stream.default.sites
      input in the actual Fenix default shortcut seed resource. Keep the empty
      data schema accepted by DefaultTopSitesBinding. Preserve existing stored
      shortcuts, bookmarks, user-created additions and explicit home controls.
      This does not establish NoDefaultBookmarks behavior in the separate
      bookmark database. Record resource/source lineage and require packaged
      APK plus fresh/upgrade/manual-add behavior before completion. Resolve the
      packaged raw/initial_shortcuts entry through the actual APK resource table
      when release optimization renames its ZIP member. Reject missing, ambiguous
      or invalid mappings; equal bytes at an unrelated path are not evidence.
    acceptance:
      - "the packaged default shortcut resource contains an empty data array"
      - "fresh region changes do not insert default shortcuts"
      - "existing and user-created shortcuts/bookmarks survive and manual additions work"
      - "actual APK resource and home behavior are verified with source-bound evidence"
    verify: "python3 docs/android/evidence/lw-m7-30/check-source.py && python3 -m unittest discover -s docs/android/evidence/lw-m7-30 -p 'test_*.py' && python3 docs/android/board.py --check"
    effort_h: "1-3"
    skills: [android]
    agent_safe: yes
    isolation: worktree
    risk: Hiding the home section does not prevent the independent startup seeding path.

  - id: LW-M7-32
    title: Prepare controlled HTTPS origins for native cookie rejection tests
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-22, LW-M7-23, LW-M7-25]
    owns:
      - docs/android/evidence/lw-m7-32/
    what: |
      Prepare a dedicated ephemeral TLS fixture authority and loopback-only
      HTTPS-to-HTTP bridge for cookies.fixture.test and the packaged duh.de
      injection rule. Keep private fixture keys outside repository evidence.
      Map only the dedicated emulator, trust the public CA only in its test
      profile, and retain original mapping/trust state for cleanup. The cookie
      runner must independently verify its private challenge, exact HTTPS URL,
      clean certificate chain and CA hash before any controlled navigation.
      Provide an explicit setup/cleanup helper bound to a selected rootable
      AOSP emulator boot, exact installed APK and fresh expected profile.
      Keep hosts changes in a temporary bind mount; verify Gecko DNS and
      exact imported public-CA identity; remove only owned setup changes.
      Never count host bridge checks as APK native rejection or alter policy
      preferences/rules to obtain a pass. Run no emulator beside native builds.
    acceptance:
      - "the bridge binds only loopback and forwards only to the fixed local cookie fixture"
      - "exact-origin clean TLS and CA/challenge validation pass in the dedicated test browser"
      - "private fixture keys are absent from repository evidence and release signing remains untouched"
      - "device mapping/trust are scoped to the disposable emulator/profile and cleanup is recorded"
    verify: "python3 -m unittest discover -s docs/android/evidence/lw-m7-32 -p 'test_*.py' && python3 docs/android/board.py --check"
    effort_h: "2-4"
    skills: [python, android, ops]
    agent_safe: yes
    isolation: worktree
    risk: Reaching a live public origin or bypassing certificate validation would invalidate native cookie proof.

  - id: LW-M7-34
    title: Prepare unmodified official uBlock Origin update fixtures
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-28]
    owns:
      - docs/android/evidence/lw-m7-34/
    reads:
      - assets/ubo-extension.json
      - docs/android/evidence/lw-m7-28/source-audit.md
      - scripts/android-addon-state-smoke.py
    what: |
      Retain two unmodified official AMO uBlock Origin versions, their original
      metadata, download locations, hashes, manifest identity and parser filter
      inputs. Bind the newer version to the packaged pin. Verify local bytes
      without treating signature files or HTTPS provenance as Gecko signature
      verification. Prepare the real Fenix file-picker older-to-newer route and
      record actual Gecko signed state, UI completion, retained choices and
      restart behavior when a source-bound candidate is available. Keep periodic
      update scheduling and permissions-increasing updates separate. Never edit
      XPI bytes, bypass signature checks or install through privileged test APIs.
    acceptance:
      - "two original official artifacts match retained metadata, exact hashes and one add-on identity"
      - "the newer fixture matches the packaged uBO pin and both contain the actual parser rule"
      - "ordinary Gecko signature verification and a real UI older-to-newer transition are recorded"
      - "enabled/private choices survive update and restart with independent parser/network evidence"
      - "fixture preparation alone leaves target update acceptance pending"
    verify: "python3 docs/android/board.py --check"
    effort_h: "3-6"
    skills: [python, android, js]
    agent_safe: yes
    isolation: none
    risk: ZIP signature entries or an unchanged installed version can be mistaken for an executed verified update.

  - id: LW-M7-27
    title: Prepare isolated Android native test drivers and result grading
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-14, LW-M7-16, LW-M7-19, LW-M7-23, LW-M7-25, LW-M7-31, LW-M7-35, LW-M7-36, LW-M7-37]
    owns:
      - docs/android/evidence/lw-m7-27/
    what: |
      Provide source-bound plan/preflight and explicit build/run drivers for a
      separate x86_64 Android test objdir. Derive enabled test tools and the
      GeckoView-example Gradle subproject from the pinned production config,
      preserving native optimization, LTO and hardening flags. Build the real
      test_runner and GeckoView instrumentation using supported mach commands.
      Grade named addon durability/save-failure and extension-permission
      persistence/uninstall regressions, packaged cookie data/private
      lifetime, translations and canvas tests without accepting empty, stale,
      partial, skipped or failed results. Do not execute on the guest or mutate
      production objdirs/devices as part of preparing these drivers. Test prefs
      and debug signing belong only to the separate test environment and never
      establish release APK acceptance. Consume the corrected Task35 native
      inventory and pin integrated Task31/35 source. Run current-profile I/O
      and update controls in the ordinary GeckoView instrumentation process,
      then force-stop only the test package, verify process exit, and invoke
      the guarded shutdown class in its own fresh instrumentation process.
      Retain explicit pending Android exclusions; never reuse native4 or
      other artifacts whose source bindings omit the integrated changes.
      Include Task36 native-service cases with their explicit injected save
      boundary and real GeckoView API methods. Pin composed final shared
      source after Tasks29/31/35/36 without replacing earlier tests or treating
      injected save completion as native persistence coverage. Refresh current
      source/test manifests and audited fixture pins for the five reviewed
      test-only corrections, preserving earlier receipts, all native selections
      and the four supplemental bindings. Add the separately reviewed Task37
      nine cookie-service xpcshell cases and five FrameLoader GeckoView methods,
      preserving all earlier selections, explicit Android exclusions and the
      final isolated guarded shutdown. Bind the exact Task37 native/test-support
      source receipt and reviewed composed manifest, with historical input
      scope explicit until a newer production/test overlay is reviewed. Skipped
      FrameLoader crash coverage is pending, never accepted as a full pass.
    acceptance:
      - "plan/preflight binds the supplied source manifest, audited harness sources and exact production-to-test config diff"
      - "explicit drivers use a separate x86_64 test objdir and real supported test_runner and instrumentation build tasks"
      - "graders require all named tests to finish without skips or unexpected failures and bind fresh logs to source/artifact receipts"
      - "local grader regressions cover empty, stale, partial, duplicate, skipped, failed and incomplete result rejection"
      - "Task35 shutdown requires its exact isolated class and opt-in, a verified process boundary, and complete fresh results; skipped shutdown is not accepted"
      - "target build/run status remains explicitly unrun until the separate drivers are actually invoked"
    verify: "python3 -m unittest discover -s docs/android/evidence/lw-m7-27 -p 'test_*.py' && python3 docs/android/board.py --check"
    effort_h: "4-8"
    skills: [android, python, testing]
    agent_safe: yes
    isolation: worktree
    risk: A test-enabled artifact or parser false green must not be mistaken for release APK acceptance.

  - id: LW-M7-31
    title: Make Android legacy extension-permission completion durable
    milestone: M7
    depends_on: [LW-M7-19, LW-M7-28, LW-M7-12]
    owns:
      - patches/android/extension-permission-durability.patch
      - scripts/tests/test-extension-permission-durability.py
      - scripts/tests/test-extension-permission-durability.js
      - scripts/android-addon-private-durability-check.py
      - scripts/android-addon-state-smoke.py
      - docs/android/evidence/lw-m7-31/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - toolkit/components/extensions/ExtensionPermissions.sys.mjs
      - mobile/shared/modules/geckoview/GeckoViewWebExtension.sys.mjs
      - toolkit/components/extensions/test/xpcshell/test_ext_permissions_android_durability.js
      - toolkit/components/extensions/test/xpcshell/xpcshell.toml
    reads:
      - scripts/android-addon-state-smoke.py
      - patches/android/addon-state-durability.patch
      - docs/android/evidence/lw-m7-28/
    what: |
      Audit the actual public private-permission completion route and the separate
      non-Nightly legacy JSON permission store. If scheduled writes can outlive
      acknowledged Android permission changes, serialize and await actual flushed
      atomic persistence without changing the modern KV backend or desktop policy.
      Exercise add/remove/removeAll, overlapping IDs, failures and retries through
      actual source tests. Define target Gecko tests and an installed-release
      callback-to-immediate-restart regression with real first-navigation private
      blocking controls. Do not mutate a guest or claim runtime loss or target
      acceptance from source findings; root owns target execution and integration.
    acceptance:
      - "Android legacy public permission completion follows actual successful persistence and propagates write failure"
      - "overlapping changes and same-value retries cannot acknowledge stale or lost permission data"
      - "modern KV backend behavior and desktop scheduled persistence remain intact"
      - "source and native test definitions cover real public APIs and failed writes without fabricating release evidence"
      - "actual target compilation and callback-to-process-restart/private behavior regression pass before acceptance"
    verify: "python3 scripts/tests/test-extension-permission-durability.py && python3 docs/android/board.py --check"
    effort_h: "6-12"
    skills: [js, python, android]
    agent_safe: yes
    isolation: worktree
    risk: A private permission can be acknowledged while its legacy JSON write is still only scheduled.

  - id: LW-M7-29
    title: Install explicitly selected pinned local Firefox Suggest data
    milestone: M7
    depends_on: [LW-M7-26]
    owns:
      - docs/android/evidence/lw-m7-29/
      - patches/android/firefox-suggest-data.patch
      - assets/firefox-suggest/
      - scripts/package-firefox-suggest.py
      - scripts/tests/test-firefox-suggest-assets.py
      - scripts/librewolf-patches.py
      - Makefile
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - third_party/application-services/components/remote_settings/src/lib.rs
      - third_party/application-services/components/remote_settings/src/client.rs
      - third_party/application-services/components/remote_settings/src/storage.rs
      - third_party/application-services/components/remote_settings/src/pinned_suggest.rs
      - third_party/application-services/components/remote_settings/dumps/main/redoubt-suggest-catalog.json
      - third_party/application-services/components/remote_settings/dumps/main/quicksuggest-amp.json
      - third_party/application-services/components/remote_settings/dumps/main/quicksuggest-amp.timestamp
      - third_party/application-services/components/remote_settings/dumps/main/quicksuggest-other.json
      - third_party/application-services/components/remote_settings/dumps/main/quicksuggest-other.timestamp
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/sponsored-suggestions-de-phone
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/data-wikipedia-en
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/icon-111a1ffa7f487e807bec4a71460454933db0fe2e7c77bade620375b41530e9a0
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/icon-161351842074695
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/icon-c5684e5a98855b2ad5af82e1a2d4ee2328e6a8518e12c94dc113240fed29e8fe
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/icon-e1612973a8b621ef95218b9b0b99674cb3e03c410fde57bcf5277ecc61ba1651
      - third_party/application-services/components/remote_settings/test-data/redoubt-suggest/icon-f46c92ccdc88eb3d4f0fdedc24374aa01fc4ffaf395169b818af92b0020d87b2
      - third_party/application-services/components/suggest/tests/pinned_suggest.rs
      - mobile/android/android-components/components/feature/fxsuggest/src/main/java/mozilla/components/feature/fxsuggest/FxSuggestStorage.kt
      - mobile/android/android-components/components/feature/fxsuggest/src/test/java/mozilla/components/feature/fxsuggest/PinnedSuggestIngestionTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/FxSuggest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SearchEngineFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SuggestDataCatalog.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SuggestDataInstaller.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/search/SuggestDataPreferences.kt
      - mobile/android/fenix/app/src/main/res/values/firefox_suggest_data_strings.xml
      - mobile/android/fenix/app/src/main/res/values/firefox_suggest_policy_strings.xml
      - mobile/android/fenix/app/src/main/res/xml/search_settings_preferences.xml
      - mobile/android/fenix/app/src/main/assets/firefox-suggest-catalog.json
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/search/SuggestDataCatalogTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/search/SuggestDataInstallerTest.kt
    reads:
      - patches/android/rs-blocker-android.patch
      - patches/android/search-config.patch
      - patches/android/firefox-suggest-policy.patch
      - scripts/package-translation-assets.py
      - scripts/librewolf-patches.py
    what: |
      Implement explicit language/phone-region downloads from a small pinned
      catalog, validate exact CDN bytes and graph dependencies, and install
      one complete Suggest collection per native transaction. Failed/cancelled
      imports preserve previously usable data. Explicit selection remains usable
      across app/device locale differences without altering global RS context.
      Keep off admission and all generic RS network denial; root owns execution.
      The preceding preparation scope and evidence remain retained:
      Prepare the bounded offline local Suggest input plan after Task26 controls.
      Retain known official collection metadata and request provenance, classify
      exact provider/configuration/icon dependencies, and size required reviewed
      attachments without bulk bundling. Inspect the actual native packaged-data
      API, record-ID attachment lookup, timestamp and metadata validation, and
      define fail-closed staging plus meaningful positive/negative ingestion gates.
      Inspect a narrow explicit selected-download/cache-import alternative to
      bulk APK payloads using the actually replayed Android RS client APIs.
      Keep the generic Remote Settings network blocker unchanged. Extend exact
      ownership and source paths before any later packaging implementation.
    acceptance:
      - "explicit Download fetches only the selected pinned payload and icons; enabling Suggest alone never downloads data"
      - "native validation and atomic per-collection cache import reject corruption, missing/extra input and cancellation while preserving old usable data on failure"
      - "selected language/region data survives locale mismatch and restart; UI accurately reports availability and download size"
      - "affected native/Kotlin targets compile, meaningful unit suites and source-bound APK download/ingest/off/restart tests pass before completion"
      - "official collection snapshots and their provenance, timestamps, hashes and byte counts are retained"
      - "AMP/Wikipedia type dependencies include global configuration and icons with attachment pins; exact payload-reference receipts and retained test fixture bytes match the catalog"
      - "the input plan matches the actual native collection and packaged-attachment API and states cache/upgrade limitations"
      - "concrete bounded packaging and ingestion tests are specified without claiming native compilation or runtime success"
      - "offline evidence validation and board validation pass"
    verify: >
      python3 docs/android/evidence/lw-m7-29/check-input-plan.py &&
      python3 docs/android/evidence/lw-m7-29/check-source.py &&
      python3 docs/android/evidence/lw-m7-29/check-catalog-review.py &&
      python3 scripts/tests/test-firefox-suggest-assets.py &&
      python3 docs/android/board.py --check
    effort_h: "12-20"
    skills: [android, kotlin, rust]
    agent_safe: yes
    isolation: worktree
    risk: Metadata alone cannot populate local Suggest, and packaged attachment lookup uses record IDs rather than the documented filenames.

  - id: LW-M7-35
    title: Add durable automatic extension update controls on Android
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-19, LW-M7-20, LW-M7-23, LW-M7-26, LW-M7-31, LW-M3-04]
    owns:
      - patches/android/extension-update-controls.patch
      - scripts/tests/test-extension-update-controls.py
      - scripts/tests/test-extension-update-controls.js
      - docs/android/evidence/lw-m7-35/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - modules/libpref/Preferences.cpp
      - mobile/android/geckoview/src/androidTest/assets/web_extensions/test-support/test-api.js
      - mobile/android/geckoview/src/androidTest/assets/web_extensions/test-support/test-schema.json
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/PrefSaveFileAsyncTest.kt
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/PrefSaveFileAsyncShutdownTest.kt
      - modules/libpref/nsIPrefService.idl
      - modules/libpref/test/unit/test_savePrefFileAsync.js
      - modules/libpref/test/unit/xpcshell.toml
      - mobile/shared/modules/geckoview/GeckoViewWebExtension.sys.mjs
      - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebExtensionController.java
      - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/WebExtensionUpdateSettingsTest.kt
      - mobile/android/geckoview/api.txt
      - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/webextension/WebExtensionRuntime.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngine.kt
      - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/GeckoEngineTest.kt
      - mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt
      - mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/update/AddonUpdater.kt
      - mobile/android/android-components/components/feature/addons/src/test/java/mozilla/components/feature/addons/update/AddonUpdaterWorkerTest.kt
      - mobile/android/android-components/components/feature/addons/src/test/java/AddonManagerTest.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/addons/ExtensionUpdatePreference.kt
      - mobile/android/fenix/app/src/main/res/xml/preferences.xml
      - mobile/android/fenix/app/src/main/res/values/extension_update_controls.xml
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/addons/ExtensionUpdatePreferenceTest.kt
      - toolkit/components/extensions/test/xpcshell/test_ext_android_update_settings.js
      - toolkit/components/extensions/test/xpcshell/xpcshell.toml
    reads:
      - patches/pref-pane/librewolf.js
      - docs/android/evidence/lw-m7-31/
      - docs/android/evidence/lw-m7-21/policy-source/input-plan.json
    what: |
      Add a visible native-pref-backed automatic extension update switch matching
      the desktop combined extensions.update.enabled and autoUpdateDefault control.
      Preserve effective defaults and explicit choices; reflect locks and reject
      locked changes. Acknowledge successful changes only after the current prefs
      snapshot is persisted with its actual write result. On this Android patch
      path, replace shared write-snapshot coalescing with owned snapshots on the
      existing serial pref writer so failure, queued writes, explicit backups and
      shutdown cannot create false completion. Separate restored/periodic addon
      work from explicit user updates, admit automatic work before metadata/update
      requests and check install eligibility again after asynchronous boundaries.
      Preserve ordinary signed XPI installs, per-addon policy and upgrade prompts.
      Do not restrict language packs here or claim target compilation/runtime from
      source tests. Root owns source composition, native builds and device evidence.
    acceptance:
      - "the real switch reads both effective prefs and locks, preserves absent/default values, and sets both on explicit choice"
      - "successful choice completion follows actual current-file persistence; failures, same-choice retries and concurrent writes are correctly reported"
      - "restored automatic workers cannot fetch metadata or updates while off, and late automatic installs recheck current eligibility"
      - "explicit update/install routes and signed permission prompts preserve their separately audited semantics"
      - "actual source and target tests cover write errors, ordering, locks, mixed prefs and update admission without fabricated target passes"
      - "target compilation, relevant Kotlin/native tests and installed APK toggle/restart/network/update acceptance pass before completion"
    verify: "python3 scripts/tests/test-extension-update-controls.py && python3 docs/android/board.py --check"
    effort_h: "12-20"
    skills: [android, kotlin, js, cpp, testing]
    agent_safe: yes
    isolation: worktree
    risk: A visible switch or queued callback may acknowledge Off while metadata requests or stale updates remain admitted.

  - id: LW-M7-36
    title: Add durable authoritative global privacy controls
    milestone: M7
    depends_on:
    - LW-M7-35
    - LW-M7-14
    - LW-M7-16
    - LW-M7-25
    owns:
    - patches/android/global-privacy-controls.patch
    - scripts/tests/test-global-privacy-controls.py
    - scripts/tests/test-global-privacy-controls.js
    - docs/android/evidence/lw-m7-36/
    shared_edit:
    - assets/patches/android.txt
    tree_paths:
    - mobile/shared/components/geckoview/GeckoViewGlobalPrivacy.sys.mjs
    - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
    - mobile/shared/components/geckoview/moz.build
    - mobile/shared/modules/geckoview/test/xpcshell/test_global_privacy_settings.js
    - mobile/shared/modules/geckoview/test/xpcshell/xpcshell.toml
    - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoGlobalPrivacyController.java
    - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/GlobalPrivacySettingsTest.kt
    - mobile/android/geckoview/api.txt
    - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/Engine.kt
    - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/preferences/GlobalPrivacyController.kt
    - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngine.kt
    - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/preferences/GeckoGlobalPrivacyController.kt
    - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/preferences/GeckoGlobalPrivacyControllerTest.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/GlobalPrivacySettingsFragment.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/GlobalPrivacySettingsModel.kt
    - mobile/android/fenix/app/src/main/res/navigation/nav_graph.xml
    - mobile/android/fenix/app/src/main/res/xml/preferences.xml
    - mobile/android/fenix/app/src/main/res/xml/global_privacy_settings.xml
    - mobile/android/fenix/app/src/main/res/values/global_privacy_controls.xml
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/GlobalPrivacySettingsModelTest.kt
    reads:
    - patches/pref-pane/librewolf.js
    - patches/android/canvas-webgl-permissions.patch
    - docs/android/evidence/lw-m7-35/
    - docs/android/AGENTS.md
    what: Expose RFP, inverse WebGL prompt, WebGL quiet popup, inverse DNS IPv6 disable and referrer host policy0/1/2
      through a dedicated native allowlisted get/set/reset contract. Read effective/default/has-user/lock state; validate
      before mutation, serialize operations, use Task35 savePrefFileAsync before mutation and for durable acknowledgment
      afterward. Report failed saves and concurrent supersession honestly without a Fenix preference mirror. Preserve
      site permissions and native runtime reset ownership. Exclude webgl.disabled, letterboxing and settings-submodule
      edits. Root owns source integration, builds, guest and target execution.
    acceptance:
    - the five controls read real native state and preserve explicit choices, defaults, enum1 and locks
    - unknown, invalid and locked writes are rejected before mutation; saves and resets serialize and acknowledge
      actual persistence results
    - failed save or superseded native state is surfaced without invented rollback, durable success or SharedPreferences
      state
    - UI explains host/base-domain referrer comparisons, IPv6 DNS boundary, WebGL bypass/quiet behavior and RFP private/exemption
      context
    - meaningful actual-module/API/UI tests and pinned scoped replay evidence are retained; site grants remain untouched
    - target compilation, native/Kotlin suites and source-bound APK fresh-document/restart/network tests pass before
      completion
    verify: python3 scripts/tests/test-global-privacy-controls.py && python3 docs/android/board.py --check
    effort_h: 12-20
    skills:
    - android
    - kotlin
    - js
    - testing
    agent_safe: true
    isolation: worktree
    risk: Gecko effective state, stored user state under locks and confirmed disk state differ; UI acknowledgment
      must preserve those distinctions.

  - id: LW-M7-37
    title: Await cleanup and recover interrupted sessions with retention
    milestone: M7
    depends_on:
    - LW-M7-09
    - LW-M7-12
    - LW-M7-16
    - LW-M7-23
    - LW-M7-29
    - LW-M7-35
    - LW-M7-36
    owns:
    - patches/android/session-cleanup.patch
    - scripts/tests/test-session-cleanup.py
    - scripts/tests/test-session-cleanup.js
    - docs/android/evidence/lw-m7-37/
    shared_edit:
    - assets/patches/android.txt
    tree_paths:
    - dom/base/nsFrameLoader.cpp
    - dom/base/nsFrameLoader.h
    - dom/chrome-webidl/FrameLoader.webidl
    - netwerk/cookie/nsICookieManager.idl
    - netwerk/cookie/CookieService.h
    - netwerk/cookie/CookieService.cpp
    - netwerk/cookie/CookiePersistentStorage.h
    - netwerk/cookie/CookiePersistentStorage.cpp
    - netwerk/cookie/CookieStorage.h
    - netwerk/cookie/CookieStorage.cpp
    - netwerk/cookie/test/unit/test_cookie_session_cleanup.js
    - netwerk/cookie/test/unit/xpcshell.toml
    - mobile/shared/modules/geckoview/GeckoViewStorageController.sys.mjs
    - mobile/shared/modules/geckoview/GeckoViewSessionCleanup.sys.mjs
    - mobile/shared/modules/geckoview/moz.build
    - mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
    - mobile/shared/modules/geckoview/test/xpcshell/test_session_cleanup.js
    - mobile/shared/modules/geckoview/test/xpcshell/xpcshell.toml
    - toolkit/components/cleardata/PrincipalsCollector.sys.mjs
    - toolkit/components/cleardata/tests/unit/test_principals_collector.js
    - toolkit/components/cleardata/tests/unit/xpcshell.toml
    - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/StorageController.java
    - mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/SessionCleanupTest.kt
    - mobile/android/geckoview/src/androidTest/assets/web_extensions/test-support/test-api.js
    - mobile/android/geckoview/src/androidTest/assets/web_extensions/test-support/test-schema.json
    - mobile/android/geckoview/api.txt
    - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/DataCleanable.kt
    - mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngine.kt
    - mobile/android/android-components/components/browser/engine-gecko/src/test/java/mozilla/components/browser/engine/gecko/GeckoEngineTest.kt
    - mobile/android/android-components/components/browser/session-storage/src/main/java/mozilla/components/browser/session/storage/SessionStorage.kt
    - mobile/android/android-components/components/browser/session-storage/src/main/java/mozilla/components/browser/session/storage/AutoSave.kt
    - mobile/android/android-components/components/browser/session-storage/src/test/java/mozilla/components/browser/session/storage/SessionStorageTest.kt
    - mobile/android/android-components/components/browser/session-storage/src/test/java/mozilla/components/browser/session/storage/AutoSaveTest.kt
    - mobile/android/android-components/components/feature/recentlyclosed/src/main/java/mozilla/components/feature/recentlyclosed/RecentlyClosedMiddleware.kt
    - mobile/android/android-components/components/feature/recentlyclosed/src/test/java/mozilla/components/feature/recentlyclosed/RecentlyClosedMiddlewareTest.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataController.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataFragment.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataOnQuitFragment.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/BrowsingDataCleanupCoordinator.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/BrowsingDataCleanupJournal.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/BrowsingDataCleanupMiddleware.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Components.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Core.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/MenuDialogFragment.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
    - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/HomeActivity.kt
    - mobile/android/fenix/app/src/main/res/xml/delete_browsing_data_quit_preferences.xml
    - mobile/android/fenix/app/src/main/res/values/browsing_data_cleanup.xml
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/DefaultDeleteBrowsingDataControllerTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataFragmentTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataOnQuitFragmentTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/BrowsingDataCleanupCoordinatorTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/deletebrowsingdata/BrowsingDataCleanupJournalTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/BrowsingDataCleanupMiddlewareTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/FenixApplicationTest.kt
    - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/HomeActivityTest.kt
    reads:
    - docs/android/evidence/lw-m7-21/cleanup-source-audit/
    - patches/android/ubo-preinstall.patch
    - patches/android/translation-assets.patch
    - docs/android/evidence/lw-m7-35/
    - docs/android/evidence/lw-m7-36/
    what: First implement independently testable frame-destruction completion and a cleanup-owned cookie token/scopes/checked database operation; leave all writer/cache admission and journal-success wiring blocked until their real completion contracts exist. Implement selected-category completion through actual native and storage callbacks, distinguish manual deletion from session cleanup, and propagate clear-data failed-category masks. Honor desktop cookie ALLOW/domain retention semantics for session cookies and storage while preserving complete origin attributes and unselected data. Persist the selected session cleanup journal before browsing starts; reconcile explicit master/category changes without resetting choices. Recover a previous pending session before restored, incoming-intent or background browsing navigation. Retain failed work for visible retry and do not call exit-success on errors. Investigate and prove a native content-quiescence boundary before successful Quit; a Java close dispatch is not completion evidence. Declare any additional native closure or storage acknowledgment paths before editing them. Root owns composition, target builds and runtime. No settings-submodule or guest changes.
    acceptance:
    - Actual callback and storage outcomes govern selected-category completion; partial failures and cancellation retain pending work and never report successful cleanup or exit
    - Manual deletion preserves its explicit-clear semantics; session cleanup honors desktop cookie ALLOW/DENY/SESSION matching with actual complete origin attributes and preserves unselected categories
    - Pending session cleanup is durably armed before browsing, tracks explicit master/category choices, and recovers before first navigation after interruption; no immediate process-death deletion is claimed
    - Restored tabs, incoming intents and background engine entry points remain held during recovery; successful Quit has a proven content-quiescence boundary preventing late repopulation
    - Actual native/module and Kotlin tests cover failures, retained-site controls, origin attributes, storage write ordering, explicit Off, retry, interruption and recovery without test-only production shims
    - Target compilation, relevant native/Kotlin suites and source-bound APK seeded-data/manual/Quit/failure/restart acceptance pass before completion
    verify: python3 scripts/tests/test-session-cleanup.py && python3 docs/android/board.py --check
    effort_h: 20-32
    skills:
    - android
    - kotlin
    - js
    - testing
    agent_safe: true
    isolation: worktree
    risk: A dispatch or window-close request is not a storage/content completion barrier; failure or late writes can leave cleanup incomplete or erase retained data.

  - id: LW-M7-40
    title: Turn off Shake to Summarize, IP Protection, Merino icons and Lens
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-37]
    owns:
      - patches/android/disable-157-cloud-features.patch
      - docs/android/evidence/lw-m7-40/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SecretSettingsFragment.kt
      - mobile/android/fenix/app/src/main/res/xml/secret_settings_preferences.xml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/ipprotection/IPProtection.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/home/intent/HomeDeepLinkIntentProcessor.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/home/topsites/store/PopularSite.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/LibreWolfCloudFeaturesTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/home/intent/HomeDeepLinkIntentProcessorTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/ipprotection/store/IPProtectionPromptRepositoryTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/summarization/onboarding/FenixSummarizationFeatureConfigurationTest.kt
    reads:
      - docs/android/TRACK.md
      - scripts/check-patch-order.py
    what: |
      Owner decision 2026-10-02, taken with the move to Firefox 157: four new
      Fenix features that send browsing data to Mozilla or Google services are
      off for good. Settings.shakeToSummarizeFeatureFlagEnabled (MLPA page
      summaries), googleLensIntegrationEnabled (lens.google.com/upload) and
      enableAddShortcutsImprovement (Merino image-CDN icons) read a constant
      false; isIPProtectionAvailable is false, FenixApplication no longer
      initialises IPProtectionFeature, IPProtection's eligibility is a constant
      Ineligible and the settings_ip_protection deep link is unmapped.
      PopularSite drops the Merino icon URL. Their Secret Settings switches go.
    acceptance:
      - "the four flags read false whatever is written to them, in every build type"
      - "PageSummaryFeature is never registered and no shake listener, summarize menu item, CFR or highlight appears"
      - "IPProtectionFeature.initialize is never called and the IP Protection settings row, menu entry and onboarding sheet stay hidden"
      - "no code path constructs a request to mlpa-prod-prod-mozilla.freetls.fastly.net, prod-images.merino.prod.webservices.mozgcp.net or lens.google.com"
      - "the patch applies at fuzz 0 in list order, compiles under -Werror, and --check-fenix-tests adds no new failure"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 docs/android/board.py --check-fenix-tests"
    effort_h: "3-6"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: A default instead of a constant comes back on with the next Nimbus default, stale preference or Secret Settings tap.

  - id: LW-M7-41
    title: Enable uBlock Origin's cookie-notice lists by default on Android
    milestone: M7
    depends_on: [LW-M7-12, LW-M7-13, LW-M7-22, LW-M7-23, LW-M3-07]
    submodule: settings
    owns:
      - assets/uBOAssets.android.json
      - scripts/gen-ubo-assets-android.py
      - scripts/android-cookie-banner-smoke.py
      - scripts/tests/test-ubo-cookie-lists.py
      - scripts/tests/test-ubo-cookie-lists-migration.js
      - patches/android/ubo-cookie-lists-migration.patch
      - settings/android.cfg
      - docs/android/evidence/lw-m7-41/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - toolkit/components/extensions/ExtensionStorageIDB.sys.mjs
      - toolkit/components/extensions/Extension.sys.mjs
    reads:
      - assets/uBOAssets.json
      - assets/ubo-extension.json
      - scripts/update-ubo-assets.sh
      - patches/custom-ubo-assets-bootstrap-location.patch
      - patches/android/ubo-preinstall.patch
    what: |
      Firefox 156 removed the cookie banner service; owner decision 2026-10-02
      replaces it on Android with uBlock Origin's "EasyList/uBO - Cookie Notices"
      lists (fanboy-cookiemonster, ublock-cookies-easylist), on by default and
      opt-out in uBO's own settings. uBO selects lists without "off" on first run,
      so scripts/gen-ubo-assets-android.py derives assets/uBOAssets.android.json
      from LibreWolf's catalog with those two lists on and no self-update URL,
      and settings/android.cfg points librewolf.uBO.assetsBootstrapLocation at
      it through a commit-pinned raw URL (owner decision 2026-10-02: a branch
      URL is a mutable trust anchor). uBO refreshes its catalog from the
      catalog's own assets.json entry, and no such entry can be both immutable
      and keep the lists on, so the entry has no remote URL and uBO keeps the
      catalog it bootstrapped; re-pin procedure in docs/android/TRACK.md.
      scripts/android-cookie-banner-smoke.py checks the built APK or tree.
      Owner decision for Beta 5: existing profiles (upgraded from Beta 3 or
      earlier, or whose first run was offline and so fell back to the catalog
      in uBO's XPI) get both lists turned on ONCE, after which the user's
      choice holds for good. patches/android/ubo-cookie-lists-migration.patch
      hooks ExtensionStorageIDB.selectBackend, and while the migration is
      pending Extension.sys.mjs leaves uBO's backend unannounced at startup so
      that uBO's first storage.local call of the session waits on it (upstream
      announces it for every migrated extension, and then selectBackend is never
      called: measured on Beta 4): if uBO's stored selectedFilterLists names
      neither list it appends both, and only after that write committed sets
      librewolf.uBO.cookieListsMigrated; a selection naming one or both, or a
      fresh profile whose first selection already has them, only sets the pref.
    acceptance:
      - "the Android catalog differs from assets/uBOAssets.json only in the two lists' off flag and its self-entry, which names no remote URL"
      - "librewolf.uBO.assetsBootstrapLocation names a Redoubt commit, not a branch, and that commit serves the current catalog"
      - "both list keys exist in the cookie-notice group of the pinned uBO XPI's own assets.json"
      - "the packaged librewolf.cfg leaves librewolf.uBO.assetsBootstrapLocation at the Android catalog URL"
      - "the lists stay ordinary uBO lists: no managed setting re-applies them, so a user who turns one off keeps it off"
      - "a fresh install shows both lists ticked in uBO's Filter lists pane"
      - "a profile whose stored uBO selection names neither list has both appended once, before uBO reads its selection; no other entry or uBO key changes"
      - "librewolf.uBO.cookieListsMigrated is set only after that write committed (or when the selection already names one of the lists), and once set nothing re-applies the lists"
      - "a fresh profile is not written to while uBO runs: its first selection is only inspected, and an offline first run is migrated on the next start"
      - "the migration patch applies at fuzz 0 in list order and compiles in a real Android build"
      - "on a device, an upgraded profile whose uBO selection names neither list has both selected and ticked in uBO's Filter lists pane after its first start, and a later opt-out survives restarts and a reinstall of the same build"
    verify: "python3 scripts/tests/test-ubo-cookie-lists.py && python3 scripts/gen-ubo-assets-android.py --check && python3 docs/android/board.py --check-cfg-split && ./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py"
    effort_h: "3-6"
    skills: [python, js, android]
    agent_safe: yes
    isolation: worktree
    risk: Turning lists on through uBO's managed settings would re-apply them at every start and make the choice impossible to undo. The migration writes uBO's storage from outside uBO; doing it anywhere uBO may already have read its selection would be overwritten or race it, which is why it runs inside the storage backend selection and never while uBO runs.

  - id: LW-M7-42
    title: Let login fields inside open shadow roots reach Android Autofill
    milestone: M7
    depends_on: [LW-M7-01]
    owns:
      - patches/android/autofill-shadow-dom.patch
      - docs/android/evidence/lw-m7-42/
    shared_edit: [assets/patches/android.txt]
    tree_paths:
      - mobile/shared/actors/GeckoViewAutoFillChild.sys.mjs
    reads:
      - toolkit/modules/FormLikeFactory.sys.mjs
      - toolkit/components/passwordmgr/LoginManagerChild.sys.mjs
      - toolkit/components/passwordmgr/LoginHelper.sys.mjs
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/Autofill.java
    what: |
      Password managers (Proton Pass, Bitwarden, KeePassDX, any Android
      AutofillService) see nothing on reddit.com/login: its username and
      password inputs live in open shadow roots (faceplate-text-input).
      GeckoViewAutoFillChild registers fields only through
      DOMFormHasPassword/DOMInputPasswordAdded, which are not composed, and
      scanDocument's querySelectorAll, which stops at shadow roots; onFocus
      resolves only registered fields. Stock Fenix 157 behaves the same.
      patches/android/autofill-shadow-dom.patch adds a fallback in onFocus, next
      to upstream's datalist one: an unregistered login field (password, or a
      username-type field LoginHelper infers as username/email or
      LoginManagerChild's heuristics pick as the username, in a FormLike that
      holds a password field, as upstream requires) in a shadow tree
      whose roots are all open is registered through addElement with a
      FormLike whose elements include every open shadow root's fields under
      its root, so the Focus message carries the node to Java. Light DOM,
      closed shadow roots and non-login inputs keep the upstream path. Built
      on android/firefox-158 against 158.0b3.
    acceptance:
      - "focusing a shadow-DOM username or password field fires an AutofillService onFillRequest whose structure carries webDomain and both fields with username/password hints"
      - "a plain light-DOM login form still produces the same fill request (regression)"
      - "fields in closed shadow roots and non-login inputs (search, one-time-code, email fields with no password field in their FormLike) are not registered"
      - "the patch applies at fuzz 0 in list order, check-patchfail is clean for both targets, and the Gecko pass that builds omni.ja compiles it"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check-scope"
    effort_h: "3-6"
    skills: [js, android]
    agent_safe: yes
    isolation: worktree
    risk: Registering too much (a site's search box or OTP field offered as a login) or touching the light-DOM path that every working login form relies on; both are fenced by returning early for anything that is not a login field in an all-open shadow tree.

  - id: LW-M7-43
    title: Make H.264 and AAC video play again (no decoder when isolated)
    milestone: M7
    depends_on: [LW-M5-02, LW-M2-07, LW-M3-02]
    owns:
      - docs/android/evidence/video-playback/
    shared_edit:
      - patches/android/isolated-process.patch
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
      - docs/android/PARITY.md
      - docs/android/ROADMAP.md
      - docs/android/TRIAGE.md
      - docs/android/play/listing-en-US.md
      - README.md
      - site/privacy.html
      - scripts/android-smoke.sh
      - docs/android/SMOKE.md
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/gecko/GeckoProvider.kt
    reads:
      - docs/android/SANDBOX-SPIKE.md
      - dom/media/platforms/android/AndroidDecoderModule.cpp
      - dom/media/platforms/PDMFactory.cpp
      - dom/media/ipc/RemoteMediaManagerChild.cpp
    what: |
      Owner report 2026-10-06: videos do not play in Redoubt 157.0-2, for example
      on redgifs.com and pornhub.com. Reproduced on an API 34 x86_64 emulator
      against stock Firefox 157.0 on the same AVD
      (docs/android/evidence/video-playback/README.md). On a local page, all 18
      H.264 and AAC cases fail in 157.0-2 and pass in Firefox: progressive MP4,
      MP4 without audio, AAC-only, AV1+AAC, and hls.js over TS and fMP4. The six
      VP9 and AV1 cases with Opus pass in both. canPlayType('avc1') returns "" and
      MediaSource.isTypeSupported('avc1') returns false only in Redoubt. redgifs
      then falls back to a native .m3u8 src and gets MEDIA_ERR_SRC_NOT_SUPPORTED,
      and pornhub's player never attaches a source.
      Cause: isolated-process.patch (LW-M5-02). In an isolated content process,
      AndroidDecoderModule::IsJavaDecoderModuleAllowed() is false
      (AndroidDecoderModule.cpp:349-352). Content then has no MediaCodec
      decoder, and no other process has one: the GPU process starts only ffvpx
      on Android, RDD is off, and the utility process starts no MediaCodec module
      (media.utility-android-media-codec.enabled=false, bug 1771196). This is
      upstream bug 1810736, which SANDBOX-SPIKE.md §9(b) named as LW-M5-02's
      acceptance risk. --check-video did not catch it: its VP8/Opus fixture is
      decoded in-process by ffvpx.
      Fix: isolated-process.patch now pins isolatedProcessEnabled(false) and
      appZygoteProcessEnabled(false), still as literals. Public claims that
      rely on isolated processes are corrected.
      Owner decision, 2026-10-06, verbatim: "Accept, turn isolation off". The
      fix ships as hotfix 157.0-3, not with 158.
      Harness: android-smoke.sh --check-video (and the baseline suite) now also
      runs an H.264+AAC progressive MP4 (video-h264) and an MSE case
      (video-mse: isTypeSupported avc1+mp4a true, and an appended fragmented
      MP4 advances currentTime). Both FAIL on the 157.0-2 APK and PASS on the
      fix on the API 34 emulator
      (docs/android/evidence/video-playback/harness/).
    acceptance:
      - "on a device, H.264 progressive MP4, H.264 over MSE/hls.js and AAC play in a fresh profile of a build with the fix, and still fail in 157.0-2"
      - "the build with the fix differs from 157.0-2's behaviour only by the GeckoProvider.kt literals; no pref is changed"
      - "no Redoubt-specific pref (media.*, autoplay, RFP/FPP, uBO) is needed for or against playback; checked by pref toggles in a fresh 157.0-2 profile"
      - "README, site/privacy.html, the Play listing, PARITY.md, PATCH-SCOPE.md and android.txt no longer claim isolated content processes"
      - "isolated-process.patch applies in list order and compiles in a real Android build"
      - "android-smoke.sh --check-video fails video-h264 and video-mse on 157.0-2 and passes all three video rows on the fix"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope"
    effort_h: "4-8"
    skills: [android, media, kotlin]
    agent_safe: no
    isolation: worktree
    risk: Turning isolation off is a containment regression; content again runs under the app's uid and can read the profile. The owner accepted that trade on 2026-10-06 ("Accept, turn isolation off"). Re-enable when upstream decodes H.264 from an isolated content process; --check-video now has H.264 and MSE fixtures, so the harness sees this class of failure.

  - id: LW-M7-44
    title: Disabling uBlock Origin while it starts must not pause browsing
    milestone: M7
    depends_on: [LW-M3-07, LW-M7-11, LW-M7-12]   # LW-M7-11 owns the harness, LW-M7-12 PATCH-SCOPE.md
    owns:
      - docs/android/evidence/lw-m7-44/
    shared_edit:
      - patches/android/ubo-preinstall.patch
      - docs/android/PATCH-SCOPE.md
      - scripts/android-smoke.sh
      - scripts/tests/test-android-smoke.py
      - docs/android/SMOKE.md
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/LibreWolfUboPreinstaller.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/LibreWolfUboPreinstallerTest.kt
    reads:
      - toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
      - mobile/shared/modules/geckoview/GeckoViewWebExtension.sys.mjs
      - toolkit/components/extensions/parent/ext-management.js
    what: |
      Observed 2026-10-06 on 157.0-2 during the video investigation
      (docs/android/evidence/video-playback/README.md, item 4): turning uBO off
      through AddonManager made Redoubt show "uBlock Origin setup failed /
      Browsing is paused". The guard is LibreWolfUboPreinstaller (LW-M3-07). It
      runs once per process start and holds every engine session until uBO's
      live blocking listener is registered. When that wait fails, it re-reads
      the registry for 5 s and continues only for a strictly newer enabled copy
      (an AMO update). Every other outcome failed closed, including the user's
      own disable or removal. Any disable stops the extension, and that rejects
      Gecko's wait ("Blocking extension stopped before becoming ready").
      Outside the readiness wait, nothing trips the guard. A disable after
      startup, a restart with uBO disabled or removed (Ready(installed, false)),
      uBO's own power button (internal filtering state, the extension keeps
      running) and an AMO update all leave browsing alone.
      Fix: after the settle window, a copy whose Gecko disabledFlags include
      USER, or the removal of a copy that was already provisioned, ends the wait
      as Ready without filtering. A restart would accept the same state. The
      wait still fails closed for blocklist, signature and app disablement, for a
      same-version reload (a private-browsing permission change reloads uBO,
      and the reload's transient userDisabled has cleared by the end of the
      window), and for a removal during the very first installation (a restart
      requires an explicit retry there too). Only the user, through the add-ons
      manager, or chrome-privileged code can set userDisabled. Web content cannot.
      Other WebExtensions cannot either: management.setEnabled covers only themes
      and policy installs, and nothing runs in a tab before the wait ends.
      Owner decision 2026-10-06, verbatim: "yes, put it in 158, no warning
      needed". The fix ships with Firefox 158 (158.0-1), not as a 157 hotfix. A
      non-user disable (blocklist, signature) that a restart accepts as
      Ready(enabled=false), so browsing continues unfiltered, needs no warning;
      none is added.
    acceptance:
      - "LibreWolfUboPreinstallerTest covers a user disable during the first-run and later-start waits, removal of a provisioned copy, and the retained failure for a reload, a non-user disable and a first-run removal"
      - "on a device, android-smoke.sh --check-ubo-user-disable passes: a reload during the wait still shows the failure dialog, and a disable during the wait loads the held page unfiltered with no dialog"
      - "the same check fails the user-disable phase on 157.0-2"
      - "ubo-preinstall.patch applies in list order and compiles in a real Android build"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope && python3 scripts/tests/test-android-smoke.py"
    effort_h: "3-6"
    skills: [android, kotlin, webextensions]
    agent_safe: no
    isolation: worktree
    risk: A user disable during the startup wait now opens the held first page without filtering, as the user asked. The guard's purpose is unchanged, because any failure that is not the user's choice still pauses browsing. Restarts already accepted every disabled copy, blocklisted or signature-disabled ones included. That pre-existing leniency is unchanged here; the owner decided on 2026-10-06 that it needs no warning.

  - id: LW-M7-45
    title: Delete browsing data on quit also after swipe-away, kill or crash
    milestone: M7
    depends_on: [LW-M7-12]
    owns:
      - patches/android/delete-on-quit-swipe.patch
      - docs/android/evidence/lw-m7-45/
    shared_edit:
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
      - scripts/check-patch-order.py
      - scripts/android-smoke.sh
      - docs/android/SMOKE.md
    tree_paths:
      - mobile/android/fenix/app/src/main/AndroidManifest.xml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/FenixApplication.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/Core.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/MenuDialogFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/lw/DeleteOnQuitGuard.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/lw/DeleteOnQuitStartGateMiddleware.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/lw/DeleteOnQuitGuardTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/lw/DeleteOnQuitStartGateMiddlewareTest.kt
    reads:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/deletebrowsingdata/DeleteBrowsingDataController.kt
      - mobile/android/android-components/components/feature/privatemode/src/main/java/mozilla/components/feature/privatemode/notification/AbstractPrivateNotificationService.kt
      - patches/android/privacy-defaults.patch
      - patches/android/ubo-preinstall.patch
      - mobile/android/android-components/components/browser/state/src/main/java/mozilla/components/browser/state/engine/middleware/CreateEngineSessionMiddleware.kt
    what: |
      Owner report 2026-10-06: "when swiping away the app, the delete all on
      close does not trigger. closing it with the close button, works".
      Upstream Fenix runs "Delete browsing data on quit" only from the menu's
      Quit item (DefaultDeleteBrowsingDataController.clearBrowsingDataOnQuit,
      then finishAndRemoveTask). Swipe-away, OOM kill, crash, force-stop and
      reboot skip it, and the next cold start restores the session. Redoubt
      has the feature on by default (cookies + cache, privacy-defaults.patch).
      Owner decision 2026-10-06, verbatim: "lets build both as fallback".
      (b) The guarantee: a marker file (noBackupFilesDir/redoubt_session_end,
      written temp + fsync + rename, then fsync of the directory) reads
      "clean" only after Quit's deletion was confirmed. On a cold start with
      the setting on and any other marker, the selected categories are
      deleted before restoreBrowserState() and restoreDownloads(): Gecko
      clearData is dispatched from Application.onCreate, the permissions DB
      is deleted asynchronously with the engine deletions (Fenix's
      PermissionStorage needs the main thread), and the local stores
      (session file, thumbnails, Places, recently closed, downloads DB) are
      deleted on the IO dispatcher while the main thread waits at most 5 s.
      Both restores and every engine-session creation wait for the
      cold-start gate. The attempt is written before deleting; after 3
      unfinished attempts the start continues without deleting and logs an
      error.
      (a) Best effort: a started service with stopWithTask="false" (no
      notification) runs the same deletion from onTaskRemoved without
      blocking, but only when the removed task was the app's last one with a
      live activity (see the multi-task follow-up below). Android usually
      kills the process right after a swipe, so (a) is measured, not relied
      on.
      Owner decisions 2026-10-06 (review of 8d2a68d7), verbatim:
        - trigger rule: "Every non-Quit exit". Keep: any exit that is not
          Quit, including an OOM kill, a crash or a reboot, triggers the
          deletion at the next start.
        - link starts: "Yes, hard gate". Cold starts through a VIEW
          intent/link, a custom tab, a PWA or a widget/search shortcut must
          not dispatch any page load until the deletion is confirmed, the
          same gate as the restore.
        - keep the best-effort onTaskRemoved service.
      Follow-up (same task): DeleteOnQuitStartGateMiddleware (first in the
      BrowserStore middleware list, Core.kt) holds every
      EngineAction.CreateEngineSessionAction while the gate is closed and
      replays them in order once it opens; every page load needs an engine
      session. With HISTORY selected, the tabs of the following restore lose
      engineSessionState (back/forward history), the cold-start equivalent of
      upstream's PurgeHistoryAction. Any activity start
      (ActivityLifecycleCallbacks) marks the session running, not only the
      process's first ON_START.
      The guarantee is bounded: the gate opens when Gecko and every store
      confirmed or 20 s after the deletion started, whichever comes first.
      If Gecko has not confirmed by then, or a local step failed, restore
      and page loads proceed (fail open, logged "deletion incomplete") and
      the deletion is retried after the next exit that is not Quit. Not
      behind the gate: a custom-tabs client's mayLaunchUrl speculative
      connect (TCP/TLS only), extension background pages (uBO's filter-list
      updates), and favicon downloads (android-components HttpIconLoader,
      cookies included for normal tabs, so one that runs before Gecko
      processed the cookie deletion can carry an old-session cookie to the
      icon's host).
      Multi-task follow-up (review finding, 2026-10-06): onTaskRemoved fires
      for ANY task of the app -- a PWA's document task
      (FLAG_ACTIVITY_NEW_DOCUMENT), a custom tab's own task
      (ExternalAppBrowserActivity, taskAffinity=""), or the main task while
      a custom tab or PWA stays open. The first version then deleted the
      tabs and cookies of a session the user was still in and wrote "clean",
      so a later kill skipped the cold-start deletion.
      DeleteOnQuitActivityCallbacks now track each live activity's task
      (LiveTasks); onTaskRemoved deletes and may mark "clean" only when no
      other task holds a live activity (the removed task has left
      ActivityManager.appTasks; a task never listed there, such as a custom
      tab in the caller's task, counts as remaining; a recents entry without
      a live activity does not). Otherwise, and when the task list cannot be
      read, it does nothing: the marker stays "running" and the service
      keeps running for the next removal.
    acceptance:
      - "with the setting on and all categories selected, cookies, localStorage, history and open tabs are gone after a cold start that follows a recents swipe, am force-stop, or kill -9 of the main process, and the deletion is logged before the session restore"
      - "menu Quit still deletes, and the next cold start skips the start-up deletion (marker clean)"
      - "with the setting off nothing is deleted after any of those exits"
      - "a deletion that dies mid-way is retried at most 3 times, then the start continues"
      - "a normal background/foreground cycle deletes nothing"
      - "a cold start through a VIEW intent link or a custom tab after a swipe creates no engine session before the deletion is confirmed (logcat order), and the page's request carries no cookie (server log)"
      - "with HISTORY selected and TABS not, the restored tabs have no back/forward history after an unclean exit"
      - "any activity start after Quit sets the marker back to running"
      - "with a PWA or custom tab task and the main task open, swiping one of them deletes nothing live and leaves the marker running; swiping the last one deletes (live or at the next cold start)"
      - "the patch applies to Firefox 157.0 and 158.0b4 in list order, compiles under -Werror, and DeleteOnQuitGuardTest and DeleteOnQuitStartGateMiddlewareTest pass"
      - "android-smoke.sh --check-delete-on-quit passes on a build with the patch and fails on one without it"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope"
    effort_h: "6-10"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: With the default settings (cookies + cache on), every cold start after a swipe, an OOM kill in the background or a reboot now logs the user out of every site. That is what the setting says (owner decision "Every non-Quit exit"), but it is new behaviour for anyone who never used Quit, including the first start after the update. The guarantee is bounded at 20 s (fail open, retried after the next unclean exit).

  - id: LW-M7-46
    title: Show no notice for WebGL and canvas blocked by default
    milestone: M7
    depends_on: [LW-M7-14, LW-M7-18, LW-M7-12]   # LW-M7-18 owns the graphics harness, LW-M7-12 PATCH-SCOPE.md
    owns:
      - docs/android/evidence/lw-m7-46/
    shared_edit:
      - patches/android/canvas-webgl-permissions.patch
      - docs/android/PATCH-SCOPE.md
      - docs/android/expected-prefs.txt
      - scripts/android-graphics-smoke.py
      - scripts/tests/test-android-graphics-smoke.py
      - scripts/android-smoke.sh
      - docs/android/SMOKE.md
    tree_paths:
      - modules/libpref/init/StaticPrefList.yaml
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/BaseBrowserFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsFeature.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/browser/permissions/OriginBoundPermissionsFeatureTest.kt
    reads:
      - mobile/android/android-components/components/concept/engine/src/main/java/mozilla/components/concept/engine/preferences/BrowserPreferencesRuntime.kt
      - mobile/shared/components/geckoview/GeckoViewPreferences.sys.mjs
    what: |
      Owner request 2026-10-09, verbatim: "the disabled webgl popovers all the
      time, we disabled it be choice, so do not show this warning". With
      librewolf.webgl.prompt.hide=true (LW-M7-14), a WebGL or canvas attempt
      that is blocked by default is a quiet request, and Fenix showed the
      snackbar "Canvas or WebGL was protected. Review in site permissions."
      (origin_permissions_quiet_notice, BaseBrowserFragment onQuietRequest)
      on every page that tried. Fix, in canvas-webgl-permissions.patch:
      OriginBoundPermissionsFeature calls onQuietRequest only when the new
      Gecko pref librewolf.webgl.prompt.notice reads boolean true (read per
      request through Engine.getBrowserPref; missing, other types or errors
      count as false), and only while the request is still pending. The pref
      defaults to false in StaticPrefList.yaml (mirror: never), so the
      build shows nothing; about:config can turn the notice back on. A quiet request
      is otherwise unchanged: denied, pending, listed in the site controls
      (trust panel, WebGL and canvas permissions, "Blocked attempt") until
      the page goes away, then consumed and rejected. Non-quiet prompts are
      unchanged. The graphics harness now requires the pref to read false,
      fails any UI dump that shows the notice, and opens the permissions
      through the site controls; its check
      quiet-review-opens-permissions-in-normal-and-private-tabs is replaced
      by quiet-no-notice and no-quiet-notice-in-normal-and-private-tabs.
      First planned for 158.0-2. Owner decision 2026-10-09, verbatim: "Beta 2
      from the RC now" - merged into android/firefox-158 (cebb03c6) and shipped
      in the 158.0-1 Beta 2 prerelease built from the 158.0 RC, then in the
      final 158.0-1 (release-158.0/PREBASE.md section 11).
    acceptance:
      - "OriginBoundPermissionsFeatureTest: a quiet request with the pref false (the default) calls no notice, stays pending with no decision, and is consumed and rejected when its page goes away; with the pref true the notice is shown as before; a stop or a consumed request before the pref answers shows nothing; only a boolean true enables the notice"
      - "on a device, a page that tries WebGL shows no snackbar, getContext('webgl') returns null, and after allowing the site through the site controls WebGL works after the reload; a canvas readback shows no snackbar and stays protected"
      - "android-graphics-smoke.py passes on a build with the change (librewolf.webgl.prompt.notice=false, no notice in any dump); a build without the change shows the notice, which the dump check detects"
      - "canvas-webgl-permissions.patch applies in list order to 158.0b4 and 158.0 and compiles in a real Android build"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope && python3 scripts/tests/test-android-graphics-smoke.py && python3 scripts/tests/test-android-smoke.py"
    effort_h: "3-5"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: Users no longer learn that a site tried WebGL or canvas; a site that needs WebGL just looks broken until the user opens the site controls. That is the owner's choice; librewolf.webgl.prompt.notice=true restores the notice.

  - id: LW-M7-47
    title: Tell the owner about every Firefox release and advisory; prebuild dots
    milestone: M7
    depends_on: []
    owns:
      - scripts/firefox-release-watch.py
      - scripts/tests/test-firefox-release-watch.py
      - scripts/tests/fixtures/firefox-release-watch/mfsa/
      - .github/workflows/firefox-release-watch.yaml
      - docs/android/RELEASE-WATCH.md
    shared_edit:
      - docs/android/REBASE.md
      - docs/android/TRACK.md
      - docs/android/SECURITY.md
    reads:
      - .github/workflows/android-release.yaml
      - .github/workflows/android-test.yaml
      - docs/android/DISTRIBUTION.md
    what: |
      Owner decision 2026-10-09, verbatim: "lets do 1,2,7"; item 1: never
      miss a Mozilla security release again. Firefox 157.0.1 shipped
      2026-10-06 and the watcher opened #3 the same day, but #3 had no
      assignee and no mention, its title said "rebase", the owner does not
      watch the repository (GET /repos/CPlusPlus17/Redoubt/subscription: 404),
      and the daily cron ran hours late. Nobody acted for three days.
      scripts/firefox-release-watch.py now runs hourly. It assigns every issue
      it opens (and an open unassigned one) to RELEASE_WATCH_NOTIFY (default:
      the repository owner) and @-mentions them. It reads the newest MFSA files
      of mozilla/foundation-security-advisories (stdlib parser, matched against
      PyYAML on all 272 files of 2024-2026). For an advisory fixed in a Firefox
      newer than the latest GitHub release, it comments impact and CVEs on the
      release issue. It also adds labels `security` and `priority: critical|high`,
      a "[security: <impact>]" title and a pin for critical/high. With no open
      release issue it opens an advisory issue instead. Open security issues get
      a reminder every 24 h. The new `autobuild` job, for a dot release on the
      current major (RELEASE_WATCH_AUTOBUILD dot|all|off) whose android patch
      check passed at this commit, creates auto/firefox-<v> (version files
      only, via the git data API). If box B has no queued or running build, it
      dispatches android-release.yaml (mode=full, update_check=true,
      build_date=now). Unsigned only; it never signs, publishes or merges.
      Optional ntfy push via the secret RELEASE_WATCH_NTFY_URL, off unless set.
      docs/android/RELEASE-WATCH.md.
    acceptance:
      - "every issue the watcher opens is created with the notify login as assignee and starts with an @-mention of it; an open unassigned watcher issue is assigned on the next run, a closed one is not"
      - "an MFSA whose fixed_in names Firefox or Firefox for Android newer than the latest android-<v>-<n> release is commented once on the open release issue for that version (labels security, priority for critical/high, title prefix never lowered, pin for critical/high), else opens one advisory issue; ESR, iOS, Focus and Thunderbird advisories are ignored"
      - "the release dedup still finds an issue renamed with a [security: ...] prefix"
      - "an open security issue the shipped release is behind gets at most one reminder per 24 h, counting advisory comments"
      - "autobuild dispatches android-release.yaml at most once per version, only with a patch-check result marker for the run's commit saying android=pass, never while android-release.yaml or android-test.yaml has a queued or running run, and comments once when android failed"
      - "the workflow defaults to permissions {}; only the autobuild job has contents: write and actions: write"
      - "with RELEASE_WATCH_NTFY_URL unset nothing is sent to ntfy; a failed push does not fail the run"
      - "--dry-run writes nothing to GitHub in every mode; scripts/tests/test-firefox-release-watch.py passes offline; actionlint reports nothing for the workflow"
    verify: "python3 scripts/tests/test-firefox-release-watch.py && python3 docs/android/board.py --check"
    effort_h: "6-10"
    skills: [python, ops, docs]
    agent_safe: yes
    isolation: worktree
    risk: Hourly runs that misjudge a version would ping the owner every day for nothing or, with autobuild, hold box B for hours on a useless build; a dedup bug would open an issue per hour.

  - id: LW-M7-48
    title: Isolated content processes again, with H.264/AAC (feasibility study)
    milestone: M7
    depends_on: [LW-M7-43, LW-M5-02]
    owns:
      - docs/android/ISOLATION-MEDIA-STUDY.md
      - docs/android/evidence/lw-m7-48/
    shared_edit:
      - docs/android/SANDBOX-SPIKE.md
      - docs/android/PARITY.md
    reads:
      - dom/media/platforms/android/AndroidDecoderModule.cpp
      - dom/media/platforms/PDMFactory.cpp
      - dom/media/ipc/RemoteMediaManagerChild.cpp
      - dom/media/platforms/ffmpeg/FFmpegDecoderModule.h
      - dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp
      - dom/media/hls/HLSDecoder.cpp
      - mobile/android/geckoview/src/main/java/org/mozilla/gecko/media/RemoteManager.java
      - mobile/android/geckoview/src/main/java/org/mozilla/gecko/process/GeckoProcessManager.java
      - mobile/android/geckoview/src/main/AndroidManifest_overlay.jinja
      - modules/libpref/init/StaticPrefList.yaml
    what: |
      Owner decision 2026-10-09, verbatim: "lets do 1,2,7". Item (2): a
      feasibility study (analysis, no product code) for restoring Android
      isolated content processes (LW-M5-02, turned off by LW-M7-43 in 157.0-3)
      without breaking H.264/AAC video (upstream bug 1810736).
      Result (docs/android/ISOLATION-MEDIA-STUDY.md, cited to file:line in the
      Firefox 158.0 tarball): Firefox 158 already has a second MediaCodec path,
      the NDK AMediaCodec driven by ffvpx in the RDD process (bug 1934009, 143).
      Upstream made it the default for its own isolated-process test variant on
      2026-10-06 (bug 1988531 part 1, 159), with 11 prefs and no code change.
      Designs compared: (a) Utility/GPU decode, (b) handing the :media binder
      to isolated content, (c) per-site hybrid (rejected: the attacker picks
      the weaker process), (d) wait, (e) upstream's NDK-in-RDD prefs.
      Recommended: (e), prototyped behind a build flag, shipped no earlier than
      Firefox 159 (draining fix, bug 1987001), with --check-video passing with
      isolation on and a new --check-isolation step (ps -Z isolated_app for
      content, CCodec allocations only in :rdd, no isolated_app avc denials).
      Known residual: native HLS (<video src=.m3u8>) stays off under isolation
      (HLSDecoder.cpp:360-363, bug 2043165); hls.js/MSE plays.
      Spike 2026-10-09 (emulator, isolated 157.0-2 APK sha256 ef2e5204...62ed1,
      evidence/lw-m7-48/): with only the 11 prefs, H.264, AAC, AV1+AAC and
      hls.js/MSE play from isolated_app content (20/20 across two runs);
      H.264/VP9 are allocated in :rdd, AAC in :utility, nothing in content;
      no new isolated_app SELinux denial. Native HLS fails, as predicted. The
      GPU-process variant also plays H.264. Two unexplained muted-autoplay
      stalls (no error) are open for the prototype stage.
    acceptance:
      - "the study cites file:line in the 158 source and bug numbers for every claim, graded S/U/M/I"
      - "each design states the changes, size, risk, whether content stays isolated, the rebase cost and the upstream direction"
      - "the recommendation has an effort estimate, a staged plan (spike, prototype behind a flag, harness, ship) and the evidence that proves the security property"
      - "the spike result is measured on an APK whose sha256 is recorded, or the study says plainly that it was not run"
      - "SANDBOX-SPIKE.md and PARITY.md link the study; no product code, patch or shipped pref changes"
    verify: "python3 docs/android/board.py --check && test -s docs/android/ISOLATION-MEDIA-STUDY.md"
    effort_h: "8-16"
    skills: [android, media, c++]
    agent_safe: yes
    isolation: worktree
    risk: The study's recommendation moves codec parsing (including software VP9/AV1) from content into the RDD process, which on Android runs with the app's uid and no Gecko sandbox. Against 157.0-3 that is no loss, since content has the app's uid today; against 157.0-2 it is slightly weaker. The NDK decoder is not upstream's release default yet (bug 1981478 NEW), so device-specific MediaCodec failures reach Redoubt before Fenix.

  - id: LW-M7-49
    title: Measure HTTPS-only, revocation, TLS floor and RFP on a build
    milestone: M7
    depends_on: [LW-M7-11]
    owns:
      - scripts/android-device-probe.py
      - docs/android/DEVICE-CHECKS.md
      - docs/android/evidence/lw-m7-49/
    shared_edit:
      - scripts/android-smoke.sh
      - scripts/tests/test-android-smoke.py
      - docs/android/SMOKE.md
      - docs/android/PARITY.md
      - docs/android/parity/network-posture.md
      - docs/android/RFP-ANDROID.md
      - scripts/android-network-check.sh
      - scripts/android-rfp-check.sh
    what: |
      Owner decision 2026-10-09, verbatim: "lets do 1,2,7". Item 7: measure
      the PARITY.md 'Partial' rows that need a device: HTTPS-only,
      certificate revocation (OCSP/CRLite), TLS version floor, fingerprinting
      (RFP) coherence. (Items 1 and 2 are separate tasks taken by parallel
      agents; this id is highest+3 of the ids in use on 2026-10-09, LW-M7-46.)
      Measure on the API 34 x86_64 emulator, against the published 157.0-3
      x86_64 APK re-signed with the throwaway key, using only servers the
      harness runs on the host loopback. Add opt-in smoke checks
      (--check-tls-floor, --check-revocation, --check-rfp-coherence; extend
      --check-https-only with a silent-upgrade and an exception-scope row),
      each with an offline grader test and a tainted negative-control run
      that makes it fail. Write a ~10-minute phone checklist for what an
      emulator cannot show (real CRLite filters, a real device's screen,
      fonts, GPU and time zone, public TLS-only servers) and update PARITY.md
      with dated results, emulator-measured and device-pending kept apart.
    acceptance:
      - "each new check passes on 157.0-3 and fails in an LW_SMOKE_EXTRA_PREFS negative-control run that weakens the posture it measures"
      - "python3 scripts/tests/test-android-smoke.py passes, including a passing and a failing case for every new grader"
      - "PARITY.md rows 5, 7, 8 and 9 cite dated evidence under docs/android/evidence/lw-m7-49/ and name what is still device-pending"
      - "DEVICE-CHECKS.md maps each phone step to a PARITY row; nothing third-party is added to site/"
    verify: "python3 scripts/tests/test-android-smoke.py && python3 docs/android/board.py --check"
    effort_h: "6-10"
    skills: [python, android, tls]
    agent_safe: yes
    isolation: worktree
    risk: An emulator result read as a device result. The emulator has no real CRLite filter state unless Remote Settings synced, a fake GPU and screen, and a harness-chosen time zone; the document must keep those apart.

  - id: LW-M7-50
    title: Isolated content with H.264/AAC via RDD, behind a build switch
    milestone: M7
    depends_on: [LW-M7-43, LW-M7-46]   # LW-M7-43 pinned isolation off (GeckoProvider.kt); LW-M7-46 is the 158 branch's last task
    owns:
      - docs/android/evidence/lw-m7-50/
      - docs/android/ISOLATION-MEDIA.md
      - docs/android/expected-prefs-isolation-media.txt
      - docs/android/expected-prefs-no-isolation.txt   # 158.0-2: API < 31 side
      - assets/patches/overlay-dev-app.txt
      - patches/android/isolation-media-process.patch
      - patches/android/isolation-media-prefs.patch   # 158.0-2: the gate pref + the eleven, from the process model
      - patches/android/isolation-media-codecs-in-content.patch
      - patches/android/isolation-media-drain-backport.patch
      - patches/android/dev-app.patch
      - scripts/android-sign-dev.sh
    shared_edit:
      - assets/patches/android.txt   # 158.0-2: the four isolation-media entries (overlay-isolation-media.txt/.cfg removed)
      - docs/android/PARITY.md        # 158.0-2: row 2a, content isolation Partial (Android 12+)
      - scripts/librewolf-patches.py
      - Makefile
      - scripts/android-apk.sh
      - scripts/check-patchfail.sh
      - scripts/check-patch-order.py
      - scripts/lint-patch-scope.py
      - docs/android/board.py
      - docs/android/PATCH-SCOPE.md
      - scripts/android-smoke.sh
      - scripts/tests/test-android-smoke.py
      - docs/android/SMOKE.md
      - .github/workflows/android-release.yaml   # review fix: refuse overlay trees in release builds
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/gecko/GeckoProvider.kt   # 158.0-2: SDK_INT >= 31 gate
      - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java   # 158.0-2: gate pref into MOZ_DEFAULT_PREFS
      - mobile/android/geckoview/src/main/java/org/mozilla/gecko/process/GeckoProcessManager.java   # 158.0-2: isContentIsolated()
      - modules/libpref/Preferences.cpp   # 158.0-2: lock the gate, set+lock the eleven when true
      - dom/media/ipc/RemoteDecoderModule.cpp
      - dom/media/platforms/PDMFactory.cpp
      - modules/libpref/init/StaticPrefList.yaml   # the gate pref media.redoubt-isolation-media.enabled and the test hook media.redoubt-test.skip-content-codec-filter
      - dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp
      - dom/media/platforms/ffmpeg/FFmpegAudioDecoder.h
      - dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
      - dom/media/platforms/ffmpeg/FFmpegDataDecoder.h
      - dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp
      - dom/media/platforms/ffmpeg/FFmpegVideoDecoder.h
      - mobile/android/fenix/app/src/release/res/values/static_strings.xml
      - mobile/android/fenix/app/src/release/res/values/colors.xml
    reads:
      - docs/android/ISOLATION-MEDIA-STUDY.md   # LW-M7-48, on main (b5d6ed97)
      - mobile/android/fenix/app/build.gradle
      - dom/media/ipc/RemoteMediaManagerChild.cpp
      - dom/media/hls/HLSDecoder.cpp
      - dom/media/platforms/ffmpeg/FFmpegDecoderModule.h
    what: |
      Follow-up of the LW-M7-48 study (design (e), docs/android/ISOLATION-MEDIA-STUDY.md
      on main). Owner decisions 2026-10-10, verbatim: plan "Prototype now, ship ON
      in a 158 dot release if it tests clean"; trade-off "Keep software codecs in
      the page process"; phone testing "Yes, separate dev app".
      Built on feature/isolation-media, cut from android/firefox-158 so it can go
      into a 158 dot release, behind a build switch that is OFF by default:
      scripts/librewolf-patches.py --overlays=isolation-media[,dev-app]
      (Makefile OVERLAYS=). Without the switch the patcher, the Makefile stamp,
      lists and command are unchanged and the patched tree is identical.
      isolation-media: isolated content + app zygote back on; upstream's eleven
      isolated-process media prefs locked (bug 1988531 part 1, e0286afb5f68),
      recorded in expected-prefs-isolation-media.txt; a Redoubt-only Gecko change
      that sends only H.264/HEVC/AAC to RDD/Utility (NDK MediaCodec) and keeps
      VP8/VP9/AV1/Opus/Vorbis/FLAC/MP3/WAV software decoding in the isolated
      content process; native HLS fails closed (MSE/hls.js plays); the bug
      1987001 drain fix backported from Firefox 159 (14 of 15 hunks clean, one
      adapted). dev-app: org.redoubtbrowser.dev, "Redoubt Dev", amber icon, no
      update check, signed only with a dev key (scripts/android-sign-dev.sh
      refuses the release fingerprint). android-smoke.sh --check-isolation
      measures isolated content, where each codec runs, the locked prefs, SELinux
      denials against the LW-M7-48 baseline, and the profile directory.
      Review fixes (2026-10-11): the allowlist is enforced in RDD/Utility/GPU too
      (PDMFactory::CreateDecoder refuses everything but H.264/HEVC/AAC there), and
      --check-isolation proves it with a test-hook pref that makes content ask for
      VP9/Opus remotely (row isolation-remote-refusal); ISOLATION-MEDIA.md gains an
      attack-surface section; the Makefile takes OVERLAYS only from the command
      line, and android-apk.sh / android-release.yaml refuse overlay trees for
      release builds (android-apk.sh unless --allow-overlays).
      Phone test 2026-10-11 (owner's Pixel 10 Pro, Android 17, arm64 dev APK of
      2fa22e51), owner's words: "1. worked 2. no problems"; content isolated_app,
      H.264 in :rdd, no SELinux denials.
      OWNER DECISION 2026-10-11, verbatim: "158.0-2, Android 12+ only". Isolation
      and its media prefs ON by default in Redoubt 158.0-2 for Android 12 (SDK 31)
      and newer; Android 8-11 keep today's behaviour (no isolation, no
      isolation-media prefs) until the API 30 flake is understood. Built on
      release/158.0-2-isolation (cut from feature/isolation-media, which stays as
      is): the isolation-media overlay becomes the last four entries of android.txt
      with a runtime gate in one place (GeckoProvider: SDK_INT >= 31), from which
      GeckoView derives media.redoubt-isolation-media.enabled (the allocator's
      content process type) and Gecko locks it and, only when true, sets and
      locks the eleven prefs; the codec allowlist reads the same pref. The prefs
      fragment overlay-isolation-media.cfg is gone. dev-app stays an overlay.
      158.0-1 (2026-10-13) is built from android/firefox-158 without any of this.
      Review fixes (956b05ea): the bug 1987001 drain backport changed software
      ffvpx on every Android version, so every changed path is now conditional on
      the gate pref (false: 158.0's code); REBASE.md 6f records the
      GeckoRuntime.init() ordering caveat; first API 31 emulator measurement.
    acceptance:
      - "a build without --overlays is unchanged: the patched tree is identical to android/firefox-158's, and the x86_64 APK matches Beta 2's contents apart from build-id-derived bytes"
      - "check-patchfail --targets=android with and without --overlays=isolation-media,dev-app, and --targets=desktop, pass against the 158.0 RC build2 tarball; check-patch-order, lint-patch-scope and board.py --check/--check-scope/--check-cfg-split/--diff-mozconfig --strict pass"
      - "the switch-ON x86_64 build compiles (-Werror) and on the API 34 emulator --check-isolation passes: content isolated_app from the app zygote, H.264 in :rdd, AAC in :utility, VP8/VP9/AV1/Opus decoded in content, the 11 prefs locked, no isolated_app denial beyond the baseline"
      - "--check-video passes 3 times with isolation on; the matrix (long clips, short clips, AAC-only, muted autoplay and click, hls.js TS/fMP4) passes 3 rounds; native HLS fails closed with error 4"
      - "the dev app installs next to a throwaway-signed org.redoubtbrowser and both run"
      - "RDD and Utility refuse every decoder but H.264/HEVC/AAC on their own: with the test hook on, --check-isolation row isolation-remote-refusal sees :rdd refuse video/vp9 and :utility refuse audio/opus, and the clip still plays decoded in isolated content"
      - "an OVERLAYS value from the environment is a make error; android-apk.sh refuses an overlay tree for --variant=release without --allow-overlays; android-release.yaml refuses an overlay tree"
      - "API 30 (OMX) emulator: the full suite passes; intermittent media/page-load failures are measured against controls and attributed (2026-10-11: they reproduce with upstream's prefs alone; open before shipping ON)"
      - "the owner runs the arm64 dev APK on the phone (docs/android/ISOLATION-MEDIA.md section 6) before a dot release turns the overlay on (DONE 2026-10-11: \"1. worked 2. no problems\")"
      - "158.0-2: isolation is decided once, at runtime, from the SDK level (GeckoProvider.isolatedContentEnabled(): SDK_INT >= 31); the media prefs and the codec allowlist follow media.redoubt-isolation-media.enabled, which GeckoView derives from its process manager and Gecko locks; no Redoubt pref file sets any of the twelve names"
      - "158.0-2: the isolation-media patches are regular android.txt entries (overlay-isolation-media.txt/.cfg removed); dev-app remains an overlay; check-patchfail android, android --overlays=dev-app and desktop, check-patch-order (new shared-file pairs measured order-free), lint-patch-scope, board.py --check/--check-scope/--check-cfg-split/--diff-mozconfig --strict and scripts/tests pass against the 158.0 RC build2 tarball"
      - "158.0-2: x86_64 release variant (throwaway key) and dev variant (dev key) and the arm64 dev APK compile with C/C++ -Werror (Rust lints capped to warnings, documented)"
      - "158.0-2 on API 34: --check-isolation passes 3 times with isolation ON (row isolation-mode: gate true and locked), --check-video 3 times, and the full smoke suite passes"
      - "158.0-2 on API 30: --check-isolation passes with isolation OFF (gate false and locked; content untrusted_app; no :rdd; the eleven prefs at their 158.0-1 values, unlocked; H.264/AAC on Java MediaCodec; Opus in Utility; no allowlist refusal with the test hook on), the same decoders and processes as Beta 2 on that AVD; --check-video 3 times; graphics acceptance passes"
      - "158.0-2: the arm64 dev APK from release/158.0-2-isolation is installed over org.redoubtbrowser.dev on the owner's phone and its content processes run as isolated_app (2026-10-11: built and signed, sha256 58edf016...bf85, superseded by the 956b05ea build b00b29c8...3685; the phone was offline both times, install pending)"
      - "158.0-2: the drain backport is behind the gate: with media.redoubt-isolation-media.enabled false every changed FFmpeg decoder path takes 158.0's branch (patch header, ISOLATION-MEDIA.md 2d); API 30 --check-isolation and --check-video pass with the same decoders as Beta 2; API 31 emulator --check-isolation 2/2 and --check-video 2/2 with isolation ON"
    verify: "./scripts/check-patchfail.sh --targets=android && ./scripts/check-patchfail.sh --targets=android --overlays=dev-app && python3 scripts/check-patch-order.py && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope && python3 scripts/tests/test-android-smoke.py && ./scripts/android-smoke.sh --serial <emulator> --apk <dev apk> --check-isolation"
    effort_h: "16-24"
    skills: [cpp, android, kotlin]
    agent_safe: yes
    isolation: worktree
    risk: Ships ON for Android 12+ in 158.0-2 (owner decision 2026-10-11). Android 8-11 stay unisolated until the API 30 flake is understood; of API 31-33 only the API 31 emulator was measured, no real device. RDD and Utility run with the app uid and parse H.264/HEVC/AAC there (ISOLATION-MEDIA.md section 7); a codec exploit in RDD reaches the profile. Device-specific MediaCodec behaviour reaches Redoubt before Fenix (upstream bug 1981478 is not default anywhere). Native-HLS-only pages stop playing. VP9/AV1 decode in software in content (battery). The drain backport is upstream code on 158, not upstream's 158 (gated, Android 12+ only).

  - id: LW-M7-38
    title: Remove "Report broken site"; its report went nowhere
    milestone: M7
    depends_on: [LW-M4-01, LW-M7-50]   # LW-M4-01 no-glean (why the report is discarded); LW-M7-50 is main's last task
    owns:
      - patches/android/no-webcompat-reporter.patch
    shared_edit:
      - assets/patches/android.txt
      - docs/android/PATCH-SCOPE.md
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/compose/MoreSettingsSubmenu.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/BrowserMenuBuilder.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/menu/BrowserMenuBuilderTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/components/menu/compose/MoreSettingsSubmenuTest.kt
    reads:
      - docs/android/evidence/lw-m7-51/
      - patches/android/no-glean.patch
      - settings/distribution/policies.json
    what: |
      First written on the 2026-09-24 branch claude/librewolf-gaps-ublock-setup-k0ri3t
      (5497ba60, 153 ESR); ported to Firefox 158 under LW-M7-51.
      OWNER DECISION 2026-10-14, verbatim: "go" -- review the branch and port what is
      still worth having onto current main, cleanly, under the owner identity; then
      the branch can be deleted.
      LibreWolf's DisableFeedbackCommands policy removes the product feedback
      commands. Fenix 158's "Report broken site" (More submenu) opens the
      WebCompatReporter form, whose Send submits Gecko's broken-site-report Glean
      ping, which Redoubt cannot upload (no-glean.patch), so a report is silently
      discarded while the UI says it was sent; with Settings.isTelemetryEnabled
      false the entry instead opens webcompat.com/issues/new?url=<page address>.
      no-webcompat-reporter.patch removes the entry from MoreSettingsSubmenu (the
      menu every user sees) and from BrowserMenuBuilder's default configuration
      (the customizable menu, off by default). Reporter code, navigation targets
      and WebCompatFeature's site interventions are unchanged.
    acceptance:
      - "no menu reachable in a release build shows Report broken site: the More submenu of the main menu on a web page, with the toolbar at the top and at the bottom"
      - "BrowserMenuBuilderTest: no default layout contains ReportBrokenSite; MoreSettingsSubmenuTest: the entry does not render even with isWebCompatEnabled = true"
      - "webcompat@mozilla.org interventions stay installed (WebCompatFeature unchanged)"
      - "the patch applies at fuzz 0 in list order on the 158.0 tarball, compiles under -Werror, and the two test classes pass"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/lint-patch-scope.py && python3 docs/android/board.py --check-scope"
    effort_h: "1-2"
    skills: [kotlin, android]
    agent_safe: yes
    isolation: worktree
    risk: A user who relied on the entry to reach webcompat.com now has to go there by hand. Instrumented UI tests (ThreeDotMenuMainRobot, MainMenuTest) still expect the entry; they are not part of the unit gate.


  - id: LW-M7-39
    title: DRM off by default through a Settings switch that can turn it on
    milestone: M7
    depends_on: [LW-M3-06, LW-M7-41, LW-M7-50]   # LW-M3-06 put media.eme.enabled=false in android.cfg; LW-M7-41 owns android.cfg; LW-M7-50 isolates content on Android 12+
    submodule: settings
    owns:
      - patches/android/drm-permission-default.patch
      - patches/android/isolation-eme.patch
      - docs/android/evidence/lw-m7-39/
    shared_edit:
      - assets/patches/android.txt
      - scripts/check-patch-order.py    # one CONSTRAINT (isolation-eme after the codecs patch), ten order-free pairs
      # also edited, owned by tasks of the same wave: scripts/android-smoke.sh (--check-eme),
      # scripts/tests/test-android-smoke.py (EmeGateTests), docs/android/FEATURE-PARITY.md (F20)
      - docs/android/SMOKE.md
      - docs/android/PATCH-SCOPE.md
      - docs/android/POLICIES.md        # row 12
      - docs/android/ISOLATION-MEDIA.md # section 9
      - docs/android/expected-prefs.txt # media.eme.enabled true
      - settings/android.cfg            # no media.eme.enabled line (Redoubt-settings branch android-drm-permission, bddc198f)
    tree_paths:
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/PhoneFeature.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/sitepermissions/SitePermissionsManagePhoneFeatureFragment.kt
      - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/utils/Settings.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/settings/PhoneFeatureTest.kt
      - mobile/android/fenix/app/src/test/java/org/mozilla/fenix/utils/SettingsTest.kt
      - dom/media/eme/KeySystemConfig.cpp
      - dom/media/eme/MediaKeySystemAccess.cpp
      - dom/media/eme/mediadrm/MediaDrmRemoteCDMParent.cpp
      - dom/media/eme/mediadrm/MediaDrmRemoteCDMParent.h
      - dom/media/gmp/GMPServiceParent.cpp
      - dom/media/ipc/RemoteCDMChild.cpp
      - dom/media/ipc/RemoteCDMProxy.cpp
      - mobile/android/geckoview/src/main/java/org/mozilla/gecko/media/MediaDrmProxy.java
      - modules/libpref/init/StaticPrefList.yaml
    reads:
      - docs/android/evidence/lw-m7-51/
      - docs/android/ISOLATION-MEDIA-STUDY.md
      - dom/media/eme/MediaKeySystemAccessManager.cpp
      - dom/media/eme/MediaKeys.cpp
      - mobile/android/app/geckoview-prefs.js
      - patches/eme-permission-common.patch
    what: |
      First written on the 2026-09-24 branch claude/librewolf-gaps-ublock-setup-k0ri3t
      (a11a2306, 153 ESR); rewritten for Firefox 158 under LW-M7-51.
      OWNER DECISION 2026-10-14, verbatim: "go" -- review the branch and port what is
      still worth having onto current main, cleanly, under the owner identity; then
      the branch can be deleted.
      OWNER DECISION 2026-10-15, verbatim: "lets analyse this in more detail and try to fix"
      (the crash that held the port back on 2026-10-14).
      LibreWolf desktop ships DRM off but unlocked (EncryptedMediaExtensions policy,
      default-branch media.eme.enabled=false; the "Play DRM-controlled content"
      checkbox turns it on). android.cfg set the same pref (LW-M3-06), but Gecko
      checks it before asking the app (MediaKeySystemAccessManager.cpp, "EME has
      been preffed off"), so Fenix's Settings > Site settings > DRM-controlled
      content could never turn DRM on (158.0-2: Allowed still rejects). Fenix 158
      already has the switch: GeckoView sets media.eme.require-app-approval, so Gecko
      asks the app after the key system is found supported. drm-permission-default.patch
      makes that permission default to Blocked (Blocked marked Recommended), and the
      settings submodule drops android.cfg's media.eme.enabled line.
      2026-10-14: held back. On Android 12+ (158.0-2 isolates content) every
      requestMediaKeySystemAccess() for Widevine crashed the isolated content process
      in a loop, whatever the setting said: Gecko asks android.media.MediaDrm from
      content (MediaKeySystemAccess::GetKeySystemStatus, KeySystemConfig::Supports,
      CreateWivineL3KeySystemConfigs) BEFORE the app, SELinux denies isolated_app the
      DRM HAL, MediaDrm throws, and a Java exception through @WrapForJNI is fatal.
      2026-10-15 analysis and fix (docs/android/ISOLATION-MEDIA.md section 9): the CDM
      and encrypted decoding already run in RDD for isolated content in 158.0
      (RemoteCDMProxy -> MediaDrmRemoteCDMParent, NDK); only the support query was left
      in content. Upstream moves it to the parent in Firefox 159 (bug 2067689).
      isolation-eme.patch does the same for 158: the parent asks the NDK once and
      publishes the locked pref media.redoubt-eme.widevine-support, isolated content
      reads it and offers H.264/AAC decrypt-and-decode (what RDD plays), the Java
      queries answer "unsupported" instead of throwing, upstream bug 2075686
      (RemoteCDMProxy session close) is backported, and MediaDrm's expiration 0
      ("never") reaches the page as NaN instead of 1970 (Shaka closed the session at
      once and playback stalled), and the RDD CDM's Init waits for its MediaCrypto
      (first plays on a fresh profile failed 2 of 9 while provisioning was pending).
      Gate false (Android 8-11): 158.0's path. Both patches
      are listed. Drop isolation-eme.patch at the 159 rebase after re-measuring with
      --check-eme and play.html.
      2026-10-16 (owner decision "go": fix first, rebuild, re-accept, then sign 158.0-3):
      the 158.0-3 acceptance found every Widevine play stopping at ~8 s on API 31. The
      Android 12 and first Android 13 NDK drops MediaDrm events with empty data
      (NdkMediaDrm.cpp "if (dataSize > 0)", ">= 0" from Android 13 QPR1 and 14), so the
      KEY_REQUIRED that follows the service certificate never reached the RDD CDM and
      no license was requested. isolation-eme.patch item 7: on SDK 31-33 the RDD CDM
      makes that key request itself after a service certificate response, and skips
      the event once if it arrives anyway (ISOLATION-MEDIA.md section 9c item 7, 9f).
    acceptance:
      - "fresh install: requestMediaKeySystemAccess('com.widevine.alpha') rejects with NotSupportedError, with no prompt and no content-process crash, on Android 12+ (isolated) and below; Settings > Site settings > DRM-controlled content reads Blocked, marked Recommended"
      - "after choosing Allowed there, the same call resolves and a Widevine stream (docs/android/evidence/lw-m7-39/scripts/play.html) plays on the API 34 (isolated) and API 30 emulators; after Ask to allow, the page shows the DRM permission prompt; Blocked rejects again"
      - "scripts/android-smoke.sh --check-eme passes on API 34 and API 30 and fails on 158.0-2 (eme-prefs), and with media.eme.enabled set true on 158.0-2 it fails eme-no-crash (the crash loop)"
      - "--check-isolation and --check-video pass on API 34 and API 30; the default smoke suite passes as on 158.0-2 (webgl excepted on API 34, harness limit)"
      - "media.eme.enabled runs true (expected-prefs.txt) and no Redoubt pref file sets it on Android; desktop.cfg still sets it false"
      - "PhoneFeatureTest and SettingsTest pass and fail with the production hunks reverted (2026-10-14: 0 and 14 failures); both patches apply at fuzz 0 after every listed patch on the target tarball and compile under -Werror"
      - "Android 12-13 (2026-10-16, docs/android/evidence/lw-m7-39/api31-33-fix/): on the API 31, 32 and 33 emulators the same flow passes and five first plays on fresh profiles reach the end of the ~60 s stream; every EME session makes exactly one license request after the service certificate (counted in MOZ_LOG EME and at the page); no tab or RDD deaths; API 34 and API 30 unchanged; the unfixed 158.0-3 stops at ~8 s with no license request on API 31 and 32"
    verify: "./scripts/check-patchfail.sh --targets=android && python3 scripts/check-patch-order.py && python3 docs/android/board.py --check-cfg-split && python3 docs/android/board.py --check-scope"
    effort_h: "2-4"
    skills: [kotlin, android, c++]
    agent_safe: yes
    isolation: worktree
    risk: isolation-eme.patch is a Redoubt change to Gecko's EME path for Firefox 158 only; carrying it into 159 on top of upstream's bug 2067689 would query Widevine twice and fight upstream's gfxVar. Drop it at the rebase and re-measure. A profile that stored "Allowed" or "Ask to allow" for DRM-controlled content earlier (no effect until now) gets DRM on after the update.

  - id: LW-M7-51
    title: Port the 2026-09-24 gaps branch onto Firefox 158 main
    milestone: M7
    depends_on: [LW-M7-38, LW-M7-39]
    owns:
      - docs/android/evidence/lw-m7-51/
    shared_edit:
      - docs/android/tasks.yaml
      - docs/android/PARITY.md           # row 6, DoH
      - docs/android/FEATURE-PARITY.md   # F17 (LW-M7-38), F20 (LW-M7-39)
    reads:
      - docs/android/evidence/lw-m7-45/
      - docs/android/evidence/lw-m7-41/
      - docs/android/evidence/lw-m7-49/
      - docs/android/evidence/lw-m7-01/release-158.0-2/
    what: |
      OWNER DECISION 2026-10-14, verbatim: "go" -- review the branch and port what is
      still worth having onto current main, cleanly, under the owner identity; then
      the branch can be deleted.
      The branch claude/librewolf-gaps-ublock-setup-k0ri3t (tip a11a2306, 11 commits
      of 2026-09-24, 153 ESR era, author noreply@anthropic.com) was never merged.
      Each commit gets a verdict (already on main, obsolete, superseded, ported or
      held back) in docs/android/evidence/lw-m7-51/README.md. Rewritten for 158
      rather than cherry-picked: LW-M7-38 (no Report broken site, listed) and LW-M7-39
      (DRM switch, held back on disk: on 158 it crash-loops isolated tabs on Android
      12+), and PARITY row 6 (DoH), whose text still described Beta 1. Not ported:
      the uBO fixes (main fixed the same defects differently: LW-M3-07 388df549,
      LW-M7-41, LW-M7-44), the interrupted-session cleanup (main's LW-M7-45 covers
      it), the 153.3 ESR rebase and the Beta 3 notes (obsolete). The branch's
      LW-M7-37 id is main's different LW-M7-37; its LW-M7-38/39 ids were free on main
      and keep their meaning.
    acceptance:
      - "a verdict per branch commit, with the main commit or document that supersedes it"
      - "ported work is rewritten against 158.0, registered (android.txt, PATCH-SCOPE, tasks.yaml) and signed under the owner identity; nothing is pushed and the old branch is not deleted by this task"
      - "gates on the 158.0 tarball pass: check-patchfail android + desktop, check-patch-order, lint-patch-scope, board --check/--check-scope/--check-cfg-split/--diff-mozconfig --strict, site-check, scripts/tests"
      - "an x86_64 build of the final branch state compiles (C/C++ -Werror, Rust lints capped) and on the API 34 emulator: no Report broken site in the menu, no new first-run hosts against 158.0-2, the default smoke suite (webgl excepted, API 34 harness limit), --check-isolation and --check-video pass"
    verify: "python3 docs/android/board.py --check && python3 docs/android/board.py --check-scope && python3 scripts/check-patch-order.py"
    effort_h: "4-8"
    skills: [kotlin, android, review]
    agent_safe: yes
    isolation: worktree
    risk: LW-M7-39 stays open; DRM remains impossible to enable from Settings until it lands.