[lalalune]

Complete the reviewed open-PR integration: preserve account/allowance, Maps, emulator instrumentation, separate dictation and interruptible voice, listener invocation, native timing and bounded reset-recovery changes from #521–#523 and their constituent PRs. Also integrate reviewed #528 drawer clearance, #529 local-draft/control cleanup and #530 safe preview entity decoding. Integrate reviewed #527: saved automatic mail-image preference, isolated inline links, and collapsed fallback links not already represented in the message. Preserve latest main #526's Eliza pin fb6232523074e020dacc849cca5ed390d28b8d67 and llama.cpp 56e70ff2a0ca; do not roll back to the earlier #524 pin.

Voice staging now rejects stale source revisions and mismatched artifact hashes. Because the latest main upstream builder does not include elizaOS/eliza#36287's provenance fields, scripts/build-pinned-voice.mjs invokes that unmodified builder from authenticated clean sources, checks identities before and after the build, verifies fresh output hashes, and adds both source revisions to its build record. Unrecorded development staging requires the original matching build record. No vendor checkout is patched. Tests reject stale/missing provenance, wrong artifacts, failed builds and changed source identities.

Keep #526's recorded engine and embedding-JNI candidate hashes. Retain the earlier #524 Paradee-JNI builds as explicitly historical references at 87d9bd96477f. Voice qualification remains false and the old reviewed embedding-host receipt remains refused pending requalification. The native engine gitlink, FFI, JNI and native CMake/build inputs are unchanged between these two Eliza revisions; the shared builder's provenance fields and private agent-event subscriptions differ. Alpha does not yet consume the new event subscription feed. Refresh current inventory/status references and preserve historical evidence boundaries.

Validation for final head 008f1fb:

• 37 focused reconciliation checks passed: wrapper failure/provenance/artifact tests, documentation consistency, Paradee runtime/staging integrity, and embedding-host refusal.
• Independent reviewer ran the real resident dependency audit at fb623252: all 98 findings across 3675 versions match latest main; 13 audit tests and the offline audit pass. Existing dispositions are preserved; the removed pacote advisory stays removed.
• Executed the exact pinned builder and inputs in a temporary layout with Node 24: imports/TypeScript loaded and its invalid-argument path ran as expected, without starting a native build. Four wrapper tests were rerun after input authentication was added.
• Corrected stale Maps browser navigation expectations; all nine focused cases pass. Replaced the Inbox withdrawal test’s fixed timer turns with awaited readiness; 12 repeated runs and three delayed-WebCrypto runs pass.
• The Calendar day-column browser test now seeds on a fixed Monday; reproduced the Thursday/weekend failure and passed three fixed-date repeats. Combined email/storage browser suites pass all 13 cases, plus typecheck, HTML isolation and both Inbox fixtures.
• Prior combined repository verification passes: 1288/1288 tests and production bundle checks.
• Earlier integration checks covered voice/listener/reset and login-surface/Cloud-sign-in contracts. Prior combined Android workflow passed both standalone and launcher debug/release builds, lint, and flag-off audits. Prior combined resident-source preparation passed. That browser run reported one stale production Settings expectation (268 other cases passed) before concurrent updates cancelled its development shards. The expectation is fixed and the complete nine-case production Settings suite passes on the final candidate, including saved off/on state without Gmail and unreadable preferences failing closed. Broad hosted browser runs remain in progress; no complete final-head browser pass is claimed. Final-head repository verification and Android builds are pending. Release APKs are unsigned and have no packaged resident/voice runtime; they are explicitly non-distributable. No local full Android rebuild or full native build was performed for this reconciliation.

APK builds, emulator HOME-role tests, full AOSP boot, real integrations and device/user acceptance remain separate evidence. This integration does not promote build records into runtime or device acceptance.

Additional review evidence: #528 passes 11 drawer/accessibility cases, three extra short-screen/inset checks and six coverage tests. #529 passes 37 focused cases plus both initial setup timeouts twice on isolated reruns, 14 production voice cases, owning unit checks and typecheck. #530 passes three decoder cases, three rendered cases and both Inbox contracts. Combined tree differs from the reviewed #530 stack only in the deterministic Calendar date and stronger production Settings tests.

Additional local review validation at source tree 008f1fb: all three production Settings tests pass, including image preference persistence and refusal to overwrite unreadable preferences. All seven focused drawer, mail controls and mail preview browser tests pass. All three mail preview unit tests pass. The production bundle audit passes. These browser tests use controlled fixtures and establish no live Gmail or physical-device acceptance. Hosted full checks remain authoritative for the merge head.