[dalkedev]

Replace the bundled HTTP Toolkit Android hook backend with an original, experimental Scope Java engine on Frida. This PR remains draft: actual Android/Frida/TLS/unpinning/Stop acceptance is NOT RUN.

The engine admits fallback only after validating a peer chain against the configured Scope CA, preserving hostname/expiry checks and unrelated original trust/pin errors. Readiness requires every requested installed capability. The worker validates a complete single public X.509 CA before Frida import/contact. Recognized lazy check$okhttp configurations fail explicitly; the ordinary-Java acceptance target is real OkHttp 3.14.9.

Rust validates worker receipts, persists attempted-spawn/PID recovery, allows bounded cleanup and drains final output before accepting termination. Stop ends the worker-spawned app. Missing acknowledgments or ambiguous state retain recovery; saved PIDs are never killed during restart reconciliation. Root hiding and automatic system-CA installation are removed; system-proxy HTTPS needs manually configured app trust. Legacy cleanup, the unchanged attributed Frida bridge/licenses and source history remain. Core HTTP(S) proxy/archive behavior is unchanged.

The original lab APK uses checksum-locked OkHttp/Okio, a deliberately wrong pin, default/isolated public-CA controls and bounded loopback TLS fixtures. See engine coverage and the acceptance recipe.

Diagnostic memory optimization and testing

The follow-up bounds stdout/stderr framing before JSON parsing to 64 KiB, with fixed input/frame buffers. Oversized/invalid stdout latches a terminal failure; later ready/stopped receipts cannot erase it. Receipts are never truncated and parsed. Stderr drains oversized lines and resumes, preserving generation isolation. Stored log strings are limited to 4 KiB UTF-8 including the truncation marker, with at most 200 entries and bounded allocation capacity.

For the same synthetic profile (205 entries × 16 KiB, retain latest 200), stored payload fell 3,276,800 → 819,200 bytes (75% less); candidate String capacities also total 819,200. This is diagnostic storage, not total RSS or Android throughput. Normal Python messages were already bounded; malformed/custom stdout and unbounded stderr motivated the additional host limits.

A proposed class-wrapper cache was rejected: Frida already caches wrappers, warm class-factory misses were zero before/after and Node timings were mixed. No JNI/Android speedup is claimed. TLS decisions and certificate validity/path checks remain uncached.

Observed validation and provenance

• PASS locally: 94 headless Rust core/device/MCP tests (45 device), 16 JS engine tests, 23 Python device tests. Unchanged earlier evidence: UI 56/build, license 8/release 3, integrity scripts 17 and host fixture helpers 10.
• PASS: ten independent production-path acceptance probes, including exact/over-limit frames, fragmented UTF-8/CRLF/EOF, sticky failure after apparently valid termination, I/O errors, stderr resumption/stale generations, capacities and real child-pipe cleanup. Additional guards revalidate the same peer/CA after expiry changes and reread changed CA input.
• PASS: actual APK compilation/signing and apksigner v2/v3. Host TLS accepts the valid fixture CA and rejects foreign/wrong-host/expired peers. These are host/build results, not Android execution.
• PASS: independent component/whole-branch reviews for the migration, plus scoped review of bounded diagnostics. All reported findings were fixed with regressions and scoped re-reviews.
• Preserved failures: initial Windows CRLF serialization assertion was reproduced and fixed; old aggregate run is CANCELLED (macOS PASS, Windows FAIL, Linux superseded), never relabelled PASS. One unchanged local fake-ADB fixture returned Text file busy; isolated and final full checks passed without weakening behavior.
• Historical PASS at 4edeb09: three-platform package/smoke CI and four CodeQL analyses. These results precede the diagnostic optimization.
• PASS at optimized head f738ab4bb8f235f2a1055602f162b4b36aa52852: full Windows/macOS/Linux checks, including package, real desktop/MCP smoke, public resources and uploads; all four CodeQL analyses. Logs confirm JS engine 16/Python device 23 on each platform and host fixture helpers 10 on Linux; macOS confirms all 45 device Rust tests. This supersedes the earlier hosted evidence for the current source.

NOT RUN: actual Android hook/TLS/pin/hostname/Stop/proxy behavior, API/ABI compatibility and interactive desktop acceptance. The controlled emulator prerequisite progressed beyond an initial crash with ordinary private directory preparation, but ADB aborts on read-only standard user storage in this executor. A functioning lab executor is required; no host security/home/trust-store change was made. Host doubles, certificate fixtures and a signed APK do not establish Android behavior.

No merge, ready transition, release, tag move, manual workflow dispatch or engine/service change is included.