Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.

Opus playback never worked: feed() called dequeueInputBuffer() on a
codec in async-callback mode, which always throws, so every packet
was silently dropped. Feed input through the async callback with a
bounded pending queue instead.

Make bring-up transactional: roll back partially opened streams and
the server shell on failure, join reader threads on stop, and close
the owning ADB streams before releasing sinks. Replace the
openAbstract watchdog thread with a real timeout in the vendored
AdbConnection.open(), which also removes the half-open stream from
the lookup table on failure.

Harden the activity: release owned Surfaces, gate callbacks on a
destroyed flag and a session generation, serialize reconnect, and
handle target replacement via singleTask + onNewIntent. Propagate
device-list write failures instead of swallowing them, bound the
clipboard payload and the video pending queue against hostile
peers, and discard incomplete recordings instead of keeping corrupt
files.

Use the mediaPlayback foreground-service type; Android 15 stops
dataSync services after six hours. Drop the unused
ACCESS_NETWORK_STATE permission.

- MuxRecorder claimed minSdk 35; it is 31.
- Adb claimed API 34 is the current Android max, next to
  compileSdk 35.
- Server claimed the openAbstract budget is wall-clock bounded below
  the e2e deadline; the deadline is per stream, so the worst case is
  not. Describe what actually holds instead.
- Pixhash contradicted itself about java.desktop availability.

MuxRecorder had a Listener interface that nothing implemented; every
callback fired into a no-op. Delete it. stop() now returns whether a
keyframe ever landed and the muxer ran, so Mirror can stop claiming
"recording saved" when no file was written.

MotionEvent.getPressure() is calibrated around 1.0 but may exceed it
on some digitizers. Masking with 0xffff wrapped hard presses around
to a light touch; clamp instead.

reconfigure() tears the codec down outside the lock, so an in-flight
MediaCodec callback can reach submit() while `codec` is null. The NPE
lands on the callback handler thread, which has no catch and kills
the process. Drop the frame instead, like any back-pressure casualty.

Also rewrite the back-pressure comment: it described a keyframe-aware
drop policy this class cannot implement (the keyframe flag never
reaches it). The real policy protects config frames only.

Native Java app for Android 12+ that mirrors another Android
device over wireless ADB, forwarding video, audio, touch input,
and clipboard. Bundles a pinned scrcpy-server.jar and the
vendored libadb-android stack. Supports h264/h265/av1 video and
raw/opus audio with in-app codec selection. No NDK, no Kotlin.
Includes JVM unit tests and a Docker-based emulator e2e rig.