[moikdev]

Two changes. Fixes #115 and #119.

1. One system Back closes one palette menu and keeps the caller's query, selection range, filter and route. Searchable menus are keyboard-first: with their keyboard shown, Back hides it, and the next Back closes only the menu.
2. On phones, action menus open as a sheet docked above the keyboard, replacing the popover that was squeezed between header and footer. The Emoji footer becomes one short Copy | Actions row.

Cause of #115 (traced, not inferred): on Back key-down, the menu host's pre-IME key handler dismissed the menu. The same press then reached the activity dispatcher, where the Emoji route callback found no open menu and cleared the 4-character query. The stage trace records both handlers for that single press.

Change:

• PaletteMenus.key no longer handles KEYCODE_BACK; the Back dispatcher owns the full press. The menu BackHandler re-registers on each opening. While a menu owns focus, the Emoji field ignores only the blur collapse of a committed range to its end.
• Below a 600 dp palette width, searchable menus dock across the palette's bottom edge over a dimmed backdrop.
  • Header: the title, an "Actions" subtitle and a 48 dp Close actions button.
  • Rows: at least 52 dp with 16 sp labels; the action search stays on the bottom edge.
  • Above 130% font, or on a short palette, the handle and subtitle drop out, and the sheet grows up to the palette's full height and scrolls.
  • Wide, tablet and landscape layouts keep the popover.
• Phone Emoji footer: Copy keeps "Copy to Clipboard" as its accessible name. "Tap a symbol to select" shows only when nothing is selected.
• Debug-only, opt-in PaletteBackTrace records primitive stage metadata, never text.

Phone Actions: before → after

Tinycast_Tablet_API_36 / API 36, phone 1080×2340 / 420 dpi, stock Gboard. The same final test APK 0134ca0c… runs on the previous PR head app 867f9917 (fb5fce28) and the final app 6b7d5fa9 (e80ac97b).

	Before (previous head)	After
Emoji, 100%
Emoji, 200%
Launcher, 200%
Emoji footer, 200%

Narrow 320 dp at 200%, with a long extension action (touch-readability runner). The previous head on the left; the final app on the right, after the v7 regression was fixed:

Keyboard-first Back in the sheet (phone 200%)

Sheet with keyboard	First Back: keyboard hidden, sheet kept	Second Back: sheet closed, ac still selected

Category menu Back (tablet 1920×1200 / 240 dpi / 100%; popover unchanged)

Menu open (final app)	Control 1dc1a1ce after one Back	Final app after one Back

Android 8.0 / API 26, phone, 200%: the sheet and keyboard-first Back work. Newer emoji render as missing glyphs, a pre-existing font limit.

Verification

Sources: report, summary.

• Device: 77 passes / 0 failures across 19 whole cohorts, with 282 restoration checks, all on the exact clean-built e80ac97b / 0134ca0c pair.
  • Profiles: API 36 tablet, landscape and phone at 100% and 200%; API 26 at 100% and 200%.
  • Contracts: sheet geometry, Back, Escape and backdrop dismissal, keyboard-first Back, priority, and regressions.
  • In the Back contracts, every menu-dismissal, canceled, keyboard-hiding and query-clear Back asserts its dispatcher owners.
• Touch readability: 24/24 on phone and narrow at 100% and 200%. The previous-head control passes narrow 200% 6/6.
• 7 matched controls: 0 passes / 9 intended failures, 113 restoration checks.
• Final preservation: 16/16, including all 573 original app files byte-equal.
  • This follows a recorded recovery. The readability runner leaves its candidate APKs installed and replaces its evidence directory; the first post-run check failed 3/16. Both original APKs and the exact file set were restored.
• All 453 executions retained, including 56 failures:
  • An incremental Gradle build was stale: new footer, old menu code. It was caught by checking the APK contents; every later build ran clean and verified the sheet code.
  • v7 regressed narrow 200%: a 348 px action didn't fit a 338 px list. Fixed in 6b7d5fa9 by dropping the handle and subtitle at large font.
• Host checks (local, fresh after clean at 6b7d5fa9): JVM 343/343; Python 135 per mode; debug and benchmark builds; lint 0 errors / 56 warnings each. All 11 upstream assets and notices are unchanged.

Audits: Claude Opus 5.5 / high instead of the unavailable gpt-6.1-sol, with maintainer approval. Earlier rounds covered the Back fix at 782f22e8/746a4540 (round 2, round 3). Fresh audits of the full change at this head, plus exact-head hosted CI, are required before an expected-head merge.

Not covered:

• Gesture Back; every test injects Back key events.
• Physical devices, OEM navigation, predictive-back animation, TalkBack, hardware and third-party keyboards.
• API 27–35.
• Menu arrow/Tab/Enter/Ctrl+K navigation re-run on the final pair (only Escape was).
• Sheet behavior on folder filters, the reviewed-text chooser and Settings.
• Menu keyboard button shows a stale Hide state after Back on API 26 #118 (API 26 keyboard button; intermittent stale state), Resolve API26 keyboard, IME and caller-selection compatibility failures #69/Make palette controls readable and reliable for touch and large fonts #71/Render native Markdown and metadata with correct List.Detail visibility #89 and signing/migration.

🤖 Generated with Claude Code

[moikdev]

Audit round 1 — head 58eb26dcc2acfa2fd29b2b2ce7507cd3c4ef258d

Model substitution (explicit): project rules call for gpt-6.1-sol / high. Neither connection could run it: one returned 402 deactivated_workspace, the other hit its ChatGPT usage limit. The first gpt-6.1-sol attempt failed before it produced a report. With the maintainer's approval, both audits below ran on Claude Opus 5.5, high effort, independently and read-only, each from its own throwaway clone.

Hosted CI: Android / build succeeded at this exact head (run 42116817500).

Correctness/security — APPROVE.

• No blockers or majors.
• Verified: the Back route on API 26–35 and API 36; menus are hosted only inside activity windows; key(menus.activation) neither leaks nor duplicates callbacks; PaletteBackTrace is inert in release and never records text; no private data in the evidence.
• Minors:
  • Back on searchable menus with the keyboard up is now keyboard-first, and this is untested.
  • The Emoji selection-retention rule is broader than the launcher's.
  • No API 33–35 device evidence.
• Nits: the "registered later" wording; trace stage strings are built even in release.

UX/test coverage — CHANGES REQUESTED.

• Major (M1): Diagnose Emoji menu Back clearing the caller query #115 requires the keyboard-shown behavior to be defined. On searchable menus (Emoji Actions, launcher Actions) Back is now keyboard-first, and this is neither documented nor tested.
• E1: the report wrongly says the Back cohorts used an owned test IME; they used the stock system keyboards.
• Minor:
  • The test records but does not assert one handler per press.
  • The test logs window-observer restoration but does not assert it.
  • "IME intent" wording overstates what is tested.
  • Priority is shown only on a fixture route.
  • The range diagnostic is counted as a Back contract although it exercises no Back.
  • No JVM test for PaletteMenus Back.
• Nits: the main probe's stale scope string; the before/after table's first frame comes from the repaired app; the API 26 200% footer clipping is not captioned.
• All counts (53/14/213, 3/45, 81 = 63/18, 16 preservation checks, 74 restorations) and all 50 screenshot hashes were confirmed.

Next: narrow the Emoji selection rule to the launcher's collapse-to-end condition. Then define and test keyboard-first Back on searchable menus (Emoji and launcher Actions), assert the handler stages and observer restoration, add the JVM test, correct the docs, re-run the affected matrix, and request fresh audits.

[moikdev]

Audit round 2 — head 782f22e81206d77a7e3e9fe810cf43e6bfffa5b8

Both audits ran independently and read-only, each from its own clone, on Claude Opus 5.5 / high. That substitutes for the unavailable gpt-6.1-sol, with the maintainer's approval.

Changes since round 1:

• 867f9917: keyboard-first Back for searchable menus. The Emoji range rule is narrowed to the launcher's collapse-to-end condition, trace strings are built lazily, and dispatcher owners and observer restoration are asserted.
• ded3f817: fixture-only fix for the API 26 keyboard-intent race.
• 782f22e8: final-pair evidence.

Correctness/security — APPROVE.

• All five round-1 findings were verified as fixed.
• Keyboard-first Back cannot loop, and key(menus.activation) neither leaks nor duplicates callbacks.
• The mark/drop owner logic cannot false-pass, and the trace is privacy-safe.
• Declining a JVM test is reasonable, because the stubs return 0 for keyCode.
• All counts, 41 PNG hashes and the privacy check were verified.
• One minor finding: on API 26 the menu's keyboard button shows a stale Hide state after keyboard-first Back. Plus several nits.

UX/coverage — changes requested, docs only.

• Code and tests are approvable. M1 is resolved: the new tests fail if Back closes the menu or if the keyboard never shows, and both controls fail exactly at the menu-still-shown assertion.
• Requested:
  • caption the API 26 / 200% footer clipping (E4);
  • describe the stale API 26 keyboard button as functional, not cosmetic;
  • back the 15/16 preservation explanation with data and say the app start is inferred;
  • list that menu navigation keys and gesture Back were not re-run;
  • narrow the "every Back asserts owners" wording;
  • caption the profile mix in the Actions table;
  • list the reviewed-text chooser as unexecuted.

Addressed at 577ef51d and 4d7a34b6. Docs and PR body only; git diff 782f22e8..HEAD -- app scripts is empty.

• All of the requested wording and caption changes are made.
• Committed v6/profile-marker-record.json, with the old and new marker hashes, decoded timestamps and the UTC timeline.
• Committed v6/capture-hashes.json, with all 2,213 runner capture hashes.
• Opened Menu keyboard button shows a stale Hide state after Back on API 26 #118 for the API 26 stale keyboard button, which now needs another tap or reads the wrong state to TalkBack.

Checks:

• Hosted CI Android / build succeeded at 782f22e8 (run 42127439424).
• The local device and host results are in the PR body.
• Exact-head CI and a fresh UX re-check at 4d7a34b6 are pending.

[moikdev]

Audit round 3 — UX re-checks; final head 746a45401831527c28665dab5fafae223f0d1270

Claude Opus 5.5 / high, independent and read-only, substituting for the unavailable gpt-6.1-sol with the maintainer's approval.

• Re-check at 4d7a34b6 — changes requested, docs only.
  • Code, tests, the 9 pinned images, the 41 published hashes, the marker decoding and Menu keyboard button shows a stale Hide state after Back on API 26 #118 were all verified.
  • Two minors remained: the tracker's owner-assertion wording, and a misleading marker-timing phrase in the PR body. Plus nits: 2.35 s rather than 3 s, bytes 8–15, an unverifiable per-cohort claim, the clipping frame link, and the priority-table profile line.
• Delta re-check at 746a4540 — APPROVE.
  • All six items are resolved.
  • per_cohort_marker_sha256 was published and supports the fact: 30 modern cohorts, all with the same before value.
  • All 10 pinned images return 200 and match their captions. No private data in the delta.
• Correctness/security: approved at 782f22e8 in round 2. git diff 782f22e8..746a4540 -- app scripts is empty, so the reviewed code is the head code.

Pending: exact-head hosted CI (run 42130634209), then an expected-head merge with the maintainer's go-ahead.