[egerev]

Native Android secret input currently has no verified protected transport to the USB host. Add durable metadata-only protected-input receipts and a dedicated one-shot raw setText source transport for exact focused password EditText targets, with owner-supplied private references and no new vault.

The transport is unavailable without the actual trusted protected_window supplied by core. It preserves the original native RPC/item/question identity, commits uncertainty before reading or sending a value, and holds failures without replay. The journal also supports correlated manual owner completion. Existing bare secrets rejection and legacy PIN refusal stay in place.

Validation: failing-first collection for both new modules; final 123 focused/legacy tests passed, including raw socket timeout/lost-reply/cancel/restart/target/ref-revocation controls; Ruff passed. Fixtures use synthetic values only. Ordinary Tiden run1513 reported123passed on the proposal branch. No model, phone, vault or real credential was accessed.

Remaining acceptance: A's installed native/read/capture fence, executor isolation from native-shell reads, compatible existing UI server and actual target proof, then root's exclusive integrated acceptance. The manual path requires the same actual fence. Source fixtures do not establish automatic PIN support; no runtime/config/grant/device change is included. Undo: disconnect/revert this source and retain unresolved receipt tombstones.

Spec: ANYM-998
Tiden branch: proposal/2026-11-13-android-protected-input
Change path: AUTO (isolated source and fixtures; protected-window/owner prerequisites remain enforced)
Review record: none (owner 11-11: no reviews)
Spec impact:

• ANYM-998: named (Spec), partial source implementation; add anchors for protected_input.py and protected_input_transport.py; actual native fence/isolation/installed automatic acceptance remain open.
  Settle text: Source receipts and dedicated guarded raw EditText transport are implemented without a vault or enabled runtime. Actual native capture fence, executor isolation/protected reference provisioning, compatible installed target and automatic PIN acceptance remain open.