[egerev]

Active Android orders currently depend on separate status requests. This adds a private durable observation/wake seam, agent-chosen restart-safe check timers and explicit acknowledged responsibility handoff, plus a minimal USB-only NotificationListener source.

Notifications remain untrusted references. Exact order bindings are checked; an unidentified order stays an explicit app-level observation for active candidates. Repeated events coalesce. A downstream timeout or lost reply stays unknown until positive receipt reconciliation and never triggers a resend. New tasks preserve earlier obligations. Question/reply transport retains every native correlation ID and cannot answer approval RPCs.

The source modules expose injectable core/caller callbacks; existing core/API/native/device admission is unchanged. Missing receiver is a visible hold. DK-6 owns that integration. Root owns installation/access, OEM USB peer verification and the released Grok callback/receipt proof. These live criteria remain OPEN on ANYM-997; this PR makes no installed push or delivery claim.

Validation:

• Failing-first: new event module initially failed collection; question test failed before its helper and caught discarded non-observation correlation before correction.
• 24 focused synthetic tests pass, including duplicate/concurrent events, restart/send uncertainty, access/order/device mismatch, timer cessation/fallback, explicit handoff, native IDs and concurrent new tasks.
• JVM journal restart/bounds/peer-fence fixture passes; full Java listener compiles against Android36.
• D8 min26 and aapt2 package an unsigned source-check APK; no signing/installation/device action.
• Ruff passes. Gradle assemble and installed-path proof remain unrun.

Change path: AUTO (additive source seam; no live authority, provider, access, global messaging schema, CI or applied migration changes)
Review record: none (owner 11-11: no reviews)
Spec: ANYM-997
Tiden branch: proposal/2026-11-13-android-order-events
Spec impact:

• ANYM-997: source event/timer/USB transport added; core integration and actual installed notification/Grok delivery remain open [named (Spec)].
  Settle text: none

Undo: revert this additive source commit before integration. Any later root rollout disconnects only this companion's forward and revokes its own notification access, preserving host obligations and existing native/provider sessions.