[armstrongsam25]

Owner emergency-stop controls carry the server-offered revision and authenticated connection across web, Windows, Android, Apple and Watch. Safety writes cannot enter offline replay. A disconnected, replaced or retired owner connection invalidates the displayed controls; only an explicit correlated status read restores them. Failure and timeout recovery remains reachable during mandatory first-run provider setup.

Supports AstralDeep/AstralDeep#363. The shared manifest includes stop, resume and recheck, with 141 actions and unchanged frame count. No new primitive or runtime dependency. Extracted-source provenance is refreshed in the same commits.

Android's explicit TLS deployment profile validates matching API/WebSocket origins, registered mobile callback identity and AppAuth PKCE. Cookie-custody WebSocket upgrades send exactly one canonical validated Origin. Its dedicated session transport preserves strict no-retry credential writes and the caller's pool; bounded HTTP/2 reads handle completed bodies without waiting for another stream frame. Windows fixes retain GUI ownership of asynchronous image delivery and speech objects and retire layout items before widget transfer.

Validation of final revision 4f9af8657287616d0479bd52ef6e565e1fa87ff2:

• Windows: 2,197 passed, 14 skipped; hosted changed executable lines across the full PR are 58/58 covered. Ruff passed. Frozen-package qualification passed 25 tests with two skips and a native smoke test.
• Android: lint, build and Kover passed with 445 app tests and 173 core tests; coverage variant also passed 445 app tests and assembled instrumentation APKs. Provider-verified final hosted reports cover 97/98 changed executable Kotlin lines (98.98%). Both added recovery lines and branches are covered. The new settled-card disconnect/authentication regression failed before the repair and passed afterward.
• Protocol, provenance, Safety and Apple portable fixtures: 24 passed, one existing immutable-source replay skip. Full-history Gitleaks 8.30.1 scan and diff checks passed.
• Apple source review independently checked connection/owner retirement, strict response correlation, stale callbacks, refusal and timeout recovery. New XCTest regressions are committed. All final hosted Apple jobs pass: strict formatting, AstralCore/drift, iOS and macOS continuity/unit coverage, both first-login/voice UI jobs, watchOS continuity and the aggregate.
• Real Android staging passed 11 primary phases with ordinary PKCE login and actual rendered controls: first-run Safety access, durable Stop, stale-revision denial, explicit fresh read and Resume, offline refusal and reconnect without replay. A separately recorded nine-phase continuation passed actual native sign-out, explicit second-owner authentication, and second-owner Stop/Resume while the first owner's stop remained unchanged. Cleanup resumed the first owner using its exact revision; both owners finished running with no network fault rules left behind.
• Real Qt staging passed seven final reconnect phases using the stock client and real authenticated backend: settled Running and Stopped cards retired their controls after actual socket loss/new registration, rejected retained callbacks, and queued no Safety writes. Explicit fresh status reads restored rendered Stop/Resume controls; the other owner remained unchanged. Earlier real Qt and web staging also covered first-run access, owner isolation, stale-revision denial, offline refusal and persistence across a backend restart.
• All 17 final-head required hosted checks pass: CI, Android and Apple. The existing optional Android next-major canary is skipped. Hosted Python passed 3,442 tests with one skip and 33 subtests; web passed 393 tests.

Local native tests and new Android staging used ac1dcbf603abccaf62cd2b87ffb3c75a69f69313. The final revision only wraps one Swift XCTest line for strict formatting; every product/runtime, Windows, Android, web, protocol and tooling input is byte-identical. Those executions retain their original source identities, with recorded equivalence to the final revision. Hosted results above execute the final revision directly.

The staging record retains failed observer attempts (navigation, browser onboarding and a parsed-element truth-value bug) and the earlier human_authentication_required refusal. The synthetic Android browser displays a private-hostname identity warning. Its actual certificate fingerprint matched an independent strict TLS handshake against the exact CA installed in that browser's process; hostname, chain and validity checks passed, with no warning bypass.

The owner explicitly waives live Mac verification. No CI-failure exception is used: every required hosted check passes on the final head. No production deployment or release publication is included.