fix: isolate Android emulator userdata

android/Dockerfile

@@ -111,6 +111,7 @@ COPY --from=android-sdk --chown=gradle:gradle \
 
 CMD ["/opt/android-sdk/emulator/emulator", \
     "-avd", "who_need_help_test", \
+    "-no-metrics", \
     "-no-window", \
     "-no-audio", \
     "-no-boot-anim", \

docs/verification.md

@@ -59,7 +59,8 @@ results from product limits and unknown production properties.
 - `mix format --check-formatted`: passed in the final run.
 - Android local Docker build targets `testDebugUnitTest`, `lintDebug`,
   `assembleDebug`, and `assembleDebugAndroidTest` passed. The isolated runners
-  then passed 7/7 instrumentation tests on API 30, API 34, and API 37. The
+  then passed 7/7 instrumentation tests on API 24, API 30, API 34, and API 37.
+  Each API also passed the separate external process-death probe. The
   sixth test verifies that the foreground service survives Home plus Activity
   destruction and remains user-stoppable. The seventh forces the first
   main-frame request to disconnect, checks the native recovery dialog, presses
@@ -68,14 +69,19 @@ results from product limits and unknown production properties.
   and `assembleStagingAndroidTest`; the API 37 staging smoke asserted the
   rendered `/` and `/safety` DOM from the temporary HTTPS origin with no
   observed load/TLS errors. Evidence is retained at
-  `output/android-instrumentation/api30/20260720050057-122714`,
+  `output/android-instrumentation/api24/20260720134554-2360359`,
-  `output/android-instrumentation/api34/20260720050900-333071`,
+  `output/android-instrumentation/api30/20260720135239-2511867`,
-  `output/android-instrumentation/api37-0/20260720051712-538500`, and
+  `output/android-instrumentation/api34/20260720133058-2058554`,
+  `output/android-instrumentation/api37-0/20260720133350-2117132`, and
   `output/android-staging-smoke/20260720052802-802174`.
-  The final matrix used the measured 1 GiB emulator userdata partition. The
+  The AVD configuration requests a 1 GiB userdata partition. Emulator 36.6.11
-  former 4 GiB default made API 34 fail before boot because the Docker writable
+  nevertheless checked for approximately 7.37 GiB while initializing API 34;
-  layer had 4.23 GiB available while the emulator attempted to create a
+  two attempts exited before ADB because only 6.1-6.3 GiB remained in the
-  7.20 GiB partition; host memory and kernel logs showed no OOM event.
+  container writable layer. The runner now mounts the AVD directory on an
+  isolated run-scoped Docker volume, verifies that the emulator remains
+  running before waiting for ADB, and removes both the container and volume on
+  exit. The complete four-API matrix passed with that layout, and a post-run
+  check found no retained `who-need-help-android-avd-*` volumes.
 - Release Android guard: a staging/release build with a non-HTTPS
   `WNH_BASE_URL` failed at its dedicated preflight; the successful staging
   build used the explicit temporary HTTPS origin.

scripts/android-instrumentation-test.sh

@@ -39,6 +39,7 @@ esac
 api_label=$(printf '%s' "$android_api" | tr '.' '-')
 image="who-need-help-android:instrumentation-api${api_label}-$run_id"
 container="who-need-help-android-instrumentation-api${api_label}-$run_id"
+avd_volume="who-need-help-android-avd-api${api_label}-$run_id"
 output="$ROOT/output/android-instrumentation/api${api_label}/$run_id"
 geo_pid=""
 death_runner_pid=""
@@ -114,6 +115,7 @@ cleanup() {
   fi
 
   docker rm -f "$container" >/dev/null 2>&1 || true
+  docker volume rm -f "$avd_volume" >/dev/null 2>&1 || true
   docker image rm "$image" >/dev/null 2>&1 || true
   exit "$status"
 }
@@ -130,12 +132,22 @@ docker build \
   -t "$image" \
   "$ROOT/android"
 
+docker volume create "$avd_volume" >"$output/avd-volume.txt"
+
 docker run -d \
   --name "$container" \
   --device /dev/kvm \
   --network none \
+  --mount \
+    "type=volume,source=$avd_volume,target=/home/gradle/.android/avd/who_need_help_test.avd" \
   "$image" > "$output/container-id.txt"
 
+if [ "$(docker inspect --format '{{.State.Running}}' "$container")" != "true" ]; then
+  docker logs "$container" >"$output/emulator.log" 2>&1 || true
+  echo "Android emulator exited before ADB became available; inspect $output/emulator.log." >&2
+  exit 1
+fi
+
 docker exec "$container" adb wait-for-device
 
 booted=""