Release signing passwords are now injected from ~/.secrets through environment variables; the established keystore and signing certificate are unchanged.
Vault restore keeps real and decoy slot records equal-length.
Vault destruction reports failed preference commits or Codex-cache deletions instead of claiming success.
Malformed Codex compression and no-progress streams fail closed.
Gradle dependency verification now checks publisher signatures alongside existing hashes.
Forged update-open intents are ignored without the app-issued one-time token.
Marker-only Sync continuation chunks are rejected.
Release tool selection remains pinned but accepts explicit Java and NDK paths with fail-closed checks.
Verification
Focused Codex, vault alignment, destruction, and release-signing checks passed.
Full Android unit tests, lint, release assembly, native provenance, manifest, and Kepr helper gates are run before save.