diff --git a/.github/scatterlab/README.md b/.github/scatterlab/README.md
index df9ebe38c28a..680a1993d509 100644
--- a/.github/scatterlab/README.md
+++ b/.github/scatterlab/README.md
@@ -256,6 +256,10 @@ controlled는 키스트로크마다 JS를 왕복해 `-_setAttributedString:`을
 
 검증 절차와 회귀 판정 기준은 [ime-qa.md](ime-qa.md).
 
+## Android prebuilt
+
+Android는 fork의 npm tarball에 든 `ReactAndroid/**` 소스를 아예 컴파일하지 않는다 — RNGP가 `com.facebook.react:react-android:<VERSION_NAME>`을 Maven Central에서 force resolve 하기 때문이다. 패치된 AAR을 실어 보내는 경로는 [`android-prebuilt.md`](android-prebuilt.md)에 있다.
+
 ## iOS prebuilt core를 우리가 만든다
 
 0.86에서 iOS prebuilt는 **opt-out 기본값**이고, prebuilt가 켜지면 `podspec_sources`가 헤더만 반환해 **모든 React\* pod의 구현이 `React.xcframework`에서 온다**(81개 podspec 중 69개가 이 스위치를 탄다). 실측: `RCTUITextView` / `RCTUITextField` / `RCTTextInputComponentView` 세 클래스 모두 상류 0.86.2 아티팩트의 Mach-O에 심볼로 존재한다(`nm -gU React`). 즉 **iOS 소스 수정은 prebuilt가 켜진 채로는 조용히 무효**다.
diff --git a/.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh b/.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
new file mode 100755
index 000000000000..b49a29711a61
--- /dev/null
+++ b/.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
@@ -0,0 +1,347 @@
+#!/usr/bin/env bash
+# Smoke test for scripts/android/scatterlab-prebuilt-maven.gradle.
+#
+# The script reads the package name and version relative to its own file, so each case builds
+# a throwaway tree that mimics node_modules/react-native and copies the script into it.
+# GRADLE_USER_HOME is sandboxed per case so a warm cache from one case cannot leak into
+# another - the whole point of the script is what it does when the cache is cold.
+set -euo pipefail
+
+REPO=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+SCRIPT="$REPO/packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle"
+GRADLE="$REPO/gradlew"
+WORK=$(mktemp -d)
+WORK=$(cd "$WORK" && pwd -P)  # resolve symlinks (e.g. macOS /var -> /private/var): Gradle
+                              # canonicalizes GRADLE_USER_HOME, so an unresolved $WORK would
+                              # make case C compare against a path Gradle never reports.
+httpd_pid=""
+cleanup() {
+  # Preserve the script's own exit status: the Gradle daemons started per case keep writing
+  # into their sandboxed GRADLE_USER_HOME after the build returns, so the rm below races them
+  # and can fail. That is housekeeping, not a verdict - it must never turn a passing run red
+  # (or, worse, a failing one green).
+  local rc=$?
+  if [ -n "$httpd_pid" ]; then
+    kill "$httpd_pid" 2>/dev/null || true
+  fi
+  rm -rf "$WORK" 2>/dev/null || true
+  exit "$rc"
+}
+trap cleanup EXIT
+failures=0
+skipped=0
+
+# Lays out <root>/rn/{package.json,scripts/android/<script>} plus a consumer project whose
+# settings.gradle applies the script and whose build.gradle prints the resolved property.
+# The package name defaults to this fork's, since that is what the script keys on; case A
+# passes the upstream name to exercise the no-op path.
+setup_case() {
+  local name=$1 version=$2 pkg_name=${3:-@scatterlab/react-native}
+  local dir="$WORK/$name"
+  mkdir -p "$dir/rn/scripts/android" "$dir/app" "$dir/gradlehome"
+  printf '{"name":"%s","version":"%s"}\n' "$pkg_name" "$version" > "$dir/rn/package.json"
+  cp "$SCRIPT" "$dir/rn/scripts/android/"
+  cat > "$dir/app/settings.gradle" <<EOF
+apply from: '../rn/scripts/android/scatterlab-prebuilt-maven.gradle'
+rootProject.name = 'probe'
+EOF
+  cat > "$dir/app/build.gradle" <<'EOF'
+tasks.register('probe') {
+  doLast {
+    def key = 'react.internal.mavenLocalRepo'
+    println "PROBE_SET=" + project.hasProperty(key)
+    if (project.hasProperty(key)) println "PROBE_VALUE=" + project.property(key)
+  }
+}
+EOF
+  echo "$dir"
+}
+
+# Runs gradle for $dir, forwarding any extra args (e.g. -D system properties). Leaves the
+# output in $LAST_OUTPUT and the exit code in $LAST_EXIT rather than propagating a non-zero
+# exit through `set -e`, since the failure cases under test are expected to fail.
+run_case() {
+  local dir=$1
+  shift
+  set +e
+  LAST_OUTPUT=$( cd "$dir/app" && GRADLE_USER_HOME="$dir/gradlehome" SCATTERLAB_PREBUILT_BASE_URL="${SCATTERLAB_PREBUILT_BASE_URL:-}" "$GRADLE" --offline -q probe "$@" 2>&1 )
+  LAST_EXIT=$?
+  set -e
+}
+
+check() {
+  local label=$1 expected=$2 actual=$3
+  if [[ "$actual" == *"$expected"* ]]; then
+    echo "ok   - $label"
+  else
+    echo "FAIL - $label"
+    echo "       expected to contain: $expected"
+    echo "       got: $actual"
+    failures=$((failures + 1))
+  fi
+}
+
+# Like check, but also requires the build to have exited non-zero - for cases whose whole
+# point is that the build must not silently succeed.
+check_fails() {
+  local label=$1 expected=$2
+  if [[ "$LAST_EXIT" -eq 0 ]]; then
+    echo "FAIL - $label"
+    echo "       expected a non-zero exit, got 0"
+    failures=$((failures + 1))
+    return
+  fi
+  check "$label" "$expected" "$LAST_OUTPUT"
+}
+
+# For environment gaps (no python3, no free local port) rather than behavior failures.
+# Always annotates, so the gap is visible in a folded Actions log instead of hiding inside
+# "all cases passed". Under CI it is a hard failure: these runners are ours, so a missing
+# python3 is a runner defect to learn about on the first dry run, not coverage to lose
+# silently on every release. Locally it stays a skip.
+skip() {
+  local label=$1 reason=$2
+  echo "::warning::android-prebuilt-consumer-test skipped '$label' ($reason)"
+  if [ -n "${CI:-}" ]; then
+    echo "FAIL - $label (skipped under CI: $reason)"
+    failures=$((failures + 1))
+  else
+    echo "SKIP - $label ($reason)"
+    skipped=$((skipped + 1))
+  fi
+}
+
+# A: an upstream install must be a no-op, so this script can ship in a package that is
+#    installed straight from npmjs. The discriminator is the package name, not the version
+#    shape - an upstream nightly or rc must be just as untouched.
+dir=$(setup_case upstream "0.87.1" "react-native")
+run_case "$dir"
+check "upstream package leaves the property unset" "PROBE_SET=false" "$LAST_OUTPUT"
+
+# A2: our package at a version that names no release must stop the build rather than fall
+#     through to Maven Central. This is the shape a nightly or an rc suffix would take.
+dir=$(setup_case unresolvable "0.87.1-scatterlab.4-rc.1")
+run_case "$dir"
+check_fails "an unresolvable fork version aborts" "does not name a prebuilt Android release"
+
+# B: a fork version with no release must stop the build. Falling through to Maven Central
+#    would ship the unpatched upstream AAR with no error. The abort message is asserted on
+#    "Expected: <assetUrl>" text, which the script's fail() always includes regardless of
+#    whether the download got as far as an HTTP status (a real 404) or never resolved a host
+#    at all (no network) - both must fail the build the same way, so this is run twice: once
+#    hitting the real (nonexistent) GitHub release, once with DNS forced unreachable via a
+#    proxy host that can never resolve (RFC 2606 reserves the .invalid TLD for exactly this).
+missing_dir=$(setup_case missing "0.87.1-scatterlab.999")
+run_case "$missing_dir"
+check_fails "missing release aborts (real network)" "prebuilt-android-0.87.1-scatterlab.999"
+
+missing_dir_nodns=$(setup_case missing-nodns "0.87.1-scatterlab.999")
+run_case "$missing_dir_nodns" \
+  -Dhttps.proxyHost=react-native-prebuilt-test.invalid -Dhttps.proxyPort=1
+check_fails "missing release aborts (no network / DNS broken)" "prebuilt-android-0.87.1-scatterlab.999"
+
+# C: a warm cache must be reused as-is, with no network. The cache is staged with the .pom
+#    the script checks for, because an empty directory is exactly what must NOT count as
+#    warm (see case C2). Gradle's --offline does not cover this - the script downloads
+#    through a raw URL.openConnection() that Gradle knows nothing about - so "no network"
+#    is proved by pointing the base URL at a closed loopback port: any download attempt
+#    would be refused and fail the build, and the case passing means none was made.
+dir=$(setup_case cached "0.87.1-scatterlab.998")
+cached_maven="$dir/gradlehome/scatterlab-react-native/0.87.1-scatterlab.998/maven"
+mkdir -p "$cached_maven/com/facebook/react/react-android/0.87.1"
+echo cached-pom > "$cached_maven/com/facebook/react/react-android/0.87.1/react-android-0.87.1.pom"
+SCATTERLAB_PREBUILT_BASE_URL="http://127.0.0.1:1" run_case "$dir"
+check "warm cache is used with no download" "PROBE_VALUE=$cached_maven" "$LAST_OUTPUT"
+
+# C2: a directory that exists but holds no artifact is a broken cache, not a warm one. The
+#     script must re-download rather than hand Gradle a tree it cannot resolve from - here
+#     there is no release to re-download, so "it tried" shows up as the usual abort.
+dir=$(setup_case cached-empty "0.87.1-scatterlab.995")
+mkdir -p "$dir/gradlehome/scatterlab-react-native/0.87.1-scatterlab.995/maven"
+run_case "$dir"
+check_fails "an empty cache directory is not treated as warm" "prebuilt-android-0.87.1-scatterlab.995"
+
+# E: SCATTERLAB_PREBUILT_BASE_URL is a test seam, and the .sha256 sidecar comes from the same
+#    base - so a non-loopback origin would hand over the archive and its own checksum. It must
+#    stop the build, not quietly fall back to the real release (which would mask the
+#    misconfiguration and hide that someone set the variable at all).
+dir=$(setup_case rogue-base-url "0.87.1-scatterlab.994")
+SCATTERLAB_PREBUILT_BASE_URL="http://prebuilt-test-rogue.invalid/releases/download" run_case "$dir"
+check_fails "a non-loopback SCATTERLAB_PREBUILT_BASE_URL is rejected" \
+  "whose host is not a loopback address"
+
+# D: cold-cache success path - the one every first build on a developer machine or CI runner
+#    takes, and the one no case above covers. Serves a fixture release over a real local HTTP
+#    server via SCATTERLAB_PREBUILT_BASE_URL (consulted by the script only when set and
+#    loopback - see the comment on overrideBaseUrl there; unset, the URL is the real GitHub
+#    host), then asserts an artifact lands at the exact Maven path the producer's tar and the
+#    consumer's extract-then-rename have to agree on.
+if ! command -v python3 >/dev/null 2>&1; then
+  skip "cold-cache success path" "python3 not found"
+else
+  cold_version="0.87.1-scatterlab.997"
+  cold_tag="prebuilt-android-$cold_version"
+  cold_asset="react-native-android-maven-$cold_version.tar.gz"
+
+  # Built the same way the producer's "Pack the Maven repository" step does: the archive root
+  # IS the repository root (tar -C <root> -czf ... .), so a drift there is exactly what this
+  # case is meant to catch. Hand-writing the tar differently would test nothing.
+  fixture_root="$WORK/fixture-src"
+  mkdir -p "$fixture_root/com/facebook/react/react-android/0.87.1"
+  echo fixture-pom > "$fixture_root/com/facebook/react/react-android/0.87.1/react-android-0.87.1.pom"
+
+  fixtures_dir="$WORK/fixtures/$cold_tag"
+  mkdir -p "$fixtures_dir"
+  tar -C "$fixture_root" -czf "$fixtures_dir/$cold_asset" .
+  ( cd "$fixtures_dir" && sha256sum "$cold_asset" | awk '{print $1}' > "$cold_asset.sha256" )
+
+  # -u: unbuffered stdout, or the startup line (which the loop below polls for) sits in a
+  # pipe buffer indefinitely once stdout isn't a tty.
+  python3 -u -m http.server 0 --directory "$WORK/fixtures" --bind 127.0.0.1 > "$WORK/httpd.log" 2>&1 &
+  httpd_pid=$!
+  disown "$httpd_pid" 2>/dev/null || true  # suppress bash's "Terminated" job-control notice on kill
+  port=""
+  for _ in $(seq 1 50); do
+    port=$(sed -n 's/.*port \([0-9][0-9]*\).*/\1/p' "$WORK/httpd.log" | head -1)
+    [ -n "$port" ] && break
+    sleep 0.1
+  done
+
+  if [ -z "$port" ]; then
+    skip "cold-cache success path" "fixture server did not start"
+    cat "$WORK/httpd.log" >&2
+  else
+    dir=$(setup_case cold-cache "$cold_version")
+    SCATTERLAB_PREBUILT_BASE_URL="http://127.0.0.1:$port" run_case "$dir"
+    check "cold cache downloads and extracts" \
+      "PROBE_VALUE=$dir/gradlehome/scatterlab-react-native/$cold_version/maven" \
+      "$LAST_OUTPUT"
+    landed="$dir/gradlehome/scatterlab-react-native/$cold_version/maven/com/facebook/react/react-android/0.87.1/react-android-0.87.1.pom"
+    if [ -f "$landed" ]; then
+      echo "ok   - cold cache lands the fixture artifact at its Maven path"
+    else
+      echo "FAIL - cold cache lands the fixture artifact at its Maven path"
+      echo "       expected: $landed"
+      failures=$((failures + 1))
+    fi
+  fi
+
+  kill "$httpd_pid" 2>/dev/null || true
+  httpd_pid=""
+fi
+
+# F: two builds racing a cold cache for the SAME version must not step on each other. The
+#    script now deletes repoDir when the content check fails, which is unsafe unless the
+#    whole check-delete-download-extract-rename sequence is serialized per version - this
+#    proves the lock added for that actually blocks-and-waits rather than just narrowing the
+#    window. The two builds use separate consumer project trees (so Gradle's own per-project
+#    locking cannot serialize them for us and mask a broken lock) but ONE shared
+#    GRADLE_USER_HOME, so they contend over the identical repoDir. The fixture server sleeps
+#    before every response to widen the window between "check the cache" and "install it" -
+#    on a fast loopback server the two builds might not overlap at all, and the case would
+#    pass by accident rather than by exercising anything.
+if ! command -v python3 >/dev/null 2>&1; then
+  skip "concurrent cold-cache builds share one lock" "python3 not found"
+else
+  race_version="0.87.1-scatterlab.993"
+  race_tag="prebuilt-android-$race_version"
+  race_asset="react-native-android-maven-$race_version.tar.gz"
+
+  race_fixture_root="$WORK/race-fixture-src"
+  mkdir -p "$race_fixture_root/com/facebook/react/react-android/0.87.1"
+  echo race-fixture-pom > "$race_fixture_root/com/facebook/react/react-android/0.87.1/react-android-0.87.1.pom"
+  race_fixtures_dir="$WORK/race-fixtures/$race_tag"
+  mkdir -p "$race_fixtures_dir"
+  tar -C "$race_fixture_root" -czf "$race_fixtures_dir/$race_asset" .
+  ( cd "$race_fixtures_dir" && sha256sum "$race_asset" | awk '{print $1}' > "$race_asset.sha256" )
+
+  cat > "$WORK/slow_server.py" <<'PYEOF'
+import http.server, os, sys, time
+
+os.chdir(sys.argv[1])
+
+class SlowHandler(http.server.SimpleHTTPRequestHandler):
+    def do_GET(self):
+        time.sleep(1)
+        super().do_GET()
+
+with http.server.HTTPServer(("127.0.0.1", 0), SlowHandler) as httpd:
+    print("port %d" % httpd.server_address[1], flush=True)
+    httpd.serve_forever()
+PYEOF
+  python3 -u "$WORK/slow_server.py" "$WORK/race-fixtures" > "$WORK/race-httpd.log" 2>&1 &
+  httpd_pid=$!
+  disown "$httpd_pid" 2>/dev/null || true
+  race_port=""
+  for _ in $(seq 1 50); do
+    race_port=$(sed -n 's/.*port \([0-9][0-9]*\).*/\1/p' "$WORK/race-httpd.log" | head -1)
+    [ -n "$race_port" ] && break
+    sleep 0.1
+  done
+
+  if [ -z "$race_port" ]; then
+    skip "concurrent cold-cache builds share one lock" "fixture server did not start"
+    cat "$WORK/race-httpd.log" >&2
+    kill "$httpd_pid" 2>/dev/null || true
+  else
+    race_dir_a=$(setup_case race-a "$race_version")
+    race_dir_b=$(setup_case race-b "$race_version")
+    race_home="$WORK/race-shared-gradlehome"
+    mkdir -p "$race_home"
+
+    set +e
+    ( cd "$race_dir_a/app" && GRADLE_USER_HOME="$race_home" SCATTERLAB_PREBUILT_BASE_URL="http://127.0.0.1:$race_port" "$GRADLE" --offline -q probe ) > "$WORK/race-a.log" 2>&1 &
+    race_pid_a=$!
+    ( cd "$race_dir_b/app" && GRADLE_USER_HOME="$race_home" SCATTERLAB_PREBUILT_BASE_URL="http://127.0.0.1:$race_port" "$GRADLE" --offline -q probe ) > "$WORK/race-b.log" 2>&1 &
+    race_pid_b=$!
+    wait "$race_pid_a"; race_rc_a=$?
+    wait "$race_pid_b"; race_rc_b=$?
+    set -e
+
+    kill "$httpd_pid" 2>/dev/null || true
+    httpd_pid=""
+
+    race_out_a=$(cat "$WORK/race-a.log")
+    race_out_b=$(cat "$WORK/race-b.log")
+    race_expected="PROBE_VALUE=$race_home/scatterlab-react-native/$race_version/maven"
+
+    if [ "$race_rc_a" -ne 0 ] || [ "$race_rc_b" -ne 0 ]; then
+      echo "FAIL - concurrent cold-cache builds both succeed"
+      echo "       exit codes: a=$race_rc_a b=$race_rc_b"
+      echo "       a output: $race_out_a"
+      echo "       b output: $race_out_b"
+      failures=$((failures + 1))
+    else
+      check "concurrent build a resolves the shared cache path" "$race_expected" "$race_out_a"
+      check "concurrent build b resolves the shared cache path" "$race_expected" "$race_out_b"
+    fi
+
+    race_landed="$race_home/scatterlab-react-native/$race_version/maven/com/facebook/react/react-android/0.87.1/react-android-0.87.1.pom"
+    if [ "$(cat "$race_landed" 2>/dev/null)" = "race-fixture-pom" ]; then
+      echo "ok   - concurrent builds land the fixture artifact intact (no half-extracted tree survives)"
+    else
+      echo "FAIL - concurrent builds land the fixture artifact intact"
+      echo "       expected file with content 'race-fixture-pom' at: $race_landed"
+      failures=$((failures + 1))
+    fi
+
+    # Proof the lock actually serialized the two builds rather than both racing the network:
+    # only the process that wins the lock should ever download the tarball. If both did, this
+    # is 2; the http.server access log lines are what leaked through -u stdout above.
+    race_downloads=$(grep -c "GET /$race_tag/$race_asset " "$WORK/race-httpd.log" || true)
+    if [ "$race_downloads" -eq 1 ]; then
+      echo "ok   - the tarball was downloaded exactly once across both concurrent builds"
+    else
+      echo "FAIL - the tarball was downloaded exactly once across both concurrent builds"
+      echo "       expected 1 GET for $race_asset, got $race_downloads"
+      failures=$((failures + 1))
+    fi
+  fi
+fi
+
+[ "$failures" -eq 0 ] || { echo "$failures case(s) failed"; exit 1; }
+if [ "$skipped" -gt 0 ]; then
+  echo "all cases passed ($skipped skipped)"
+else
+  echo "all cases passed"
+fi
diff --git a/.github/scatterlab/allowed-tarball-diff.txt b/.github/scatterlab/allowed-tarball-diff.txt
index bcd801aec75e..77ce3ae7f323 100644
--- a/.github/scatterlab/allowed-tarball-diff.txt
+++ b/.github/scatterlab/allowed-tarball-diff.txt
@@ -44,3 +44,14 @@ Libraries/Components/ScrollView/ScrollViewStickyHeader.js
 # (Simeji and other third-party IMEs) treat that as the document moving under them and
 # drop the composition. See README.md.
 ReactCommon/react/renderer/textlayoutmanager/platform/ios/react/renderer/textlayoutmanager/RCTAttributedTextUtils.mm
+
+# Android text decoration crash: drawSpannedDecoration() passed offsets from the full
+# Spanned into a numberOfLines-truncated Layout, so getPrimaryHorizontal() threw
+# IndexOutOfBoundsException while drawing an underline/strikethrough that the truncation
+# had hidden. Upstream https://github.com/react/react-native/pull/58366 (open).
+# Reaches the app only through this fork's Android prebuilt release - see android-prebuilt.md.
+ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt
+
+# Points the consumer's Gradle build at this fork's Android artifacts. Added file, so the
+# gate sees it as a difference from upstream. See android-prebuilt.md.
+scripts/android/scatterlab-prebuilt-maven.gradle
diff --git a/.github/scatterlab/android-prebuilt.md b/.github/scatterlab/android-prebuilt.md
new file mode 100644
index 000000000000..a56ad7d18d97
--- /dev/null
+++ b/.github/scatterlab/android-prebuilt.md
@@ -0,0 +1,158 @@
+# Android prebuilt
+
+fork가 수정한 **Android** 네이티브 코드를 소비자에게 실어 보내는 경로. iOS prebuilt([README.md](README.md))와 대칭이며, 존재 이유도 같다 — **소스만 고치면 조용히 무효다.**
+
+## 왜 필요한가
+
+iOS는 prebuilt가 켜진 채로 소스를 고치면 무효였다. Android는 그보다 앞선 지점에서 끊긴다: 소비자의 빌드는 fork의 npm tarball에 든 `ReactAndroid/**` 소스를 **아예 컴파일하지 않는다.**
+
+RNGP가 모든 configuration에 대해 좌표를 force resolve 한다:
+
+```kotlin
+// DependencyUtils.kt:132
+configuration.resolutionStrategy.force(
+    "${coordinates.reactGroupString}:react-android:${coordinates.versionString}")
+```
+
+`versionString`은 `ReactAndroid/gradle.properties`의 `VERSION_NAME`이고(`readVersionAndGroupStrings`), 그 값은 업스트림 base로 고정해야 한다(fork 접미사를 붙이면 존재하지 않는 좌표가 된다). 따라서 소비자는 기본적으로 **Maven Central의 업스트림 `com.facebook.react:react-android:<base>` AAR**을 받는다. fork의 Kotlin·C++ 변경은 그 AAR에 없다.
+
+`node_modules`에 든 소스로 빌드하게 만들려면 `includeBuild`로 ReactAndroid 전체를 소비자 빌드에 끌어와야 하는데, NDK·CMake 컴파일이 소비자 CI마다 반복된다. 그래서 iOS와 같은 형태를 택한다 — **fork가 한 번 빌드해 배포하고, 소비자는 받아 쓴다.**
+
+## 결정
+
+| 항목 | 값 | 이유 |
+| --- | --- | --- |
+| 산출물 | `/tmp/maven-local` 트리 전체를 tar | `publishAllToMavenTempLocal`의 고정 출력 경로(`ReactAndroid/publish.gradle:16`) |
+| 릴리스 태그 | `prebuilt-android-<fork-version>` | iOS의 `prebuilt-ios-<fork-version>`과 대칭. `v`로 시작하지 않아 상류 `publish-npm.yml`의 `v0.*.*` 글롭에 안 걸린다 |
+| 에셋 | `react-native-android-maven-<fork-version>.tar.gz` + `.sha256` | |
+| 호스팅 | GitHub Release 에셋 | 릴리스 AAR 160MB · 디버그 AAR 268MB. npm tarball 동봉은 tarball-diff 게이트와 install 시간을 둘 다 깨뜨린다 |
+| 소비 배선 | fork npm 패키지의 gradle 스크립트 + 소비자 `settings.gradle.kts` 한 줄 | 판정·다운로드·검증·abort를 fork가 소유한다. `@react-native/gradle-plugin`에는 넣을 수 없다 — sibling 7개는 업스트림 정확 버전 고정이 불변식이다 |
+| 게이트 | 릴리스가 없으면 **abort** | iOS `FORK_REQUIRES_OWN_PREBUILT`와 동일. 모든 `-scatterlab.N`이 Android 릴리스를 가져야 한다 |
+| 공개 시점 | `build`가 **draft**로 만들고, `verify`가 통과한 뒤에만 공개(`--draft=false`) | draft는 push 권한자에게만 보이고 에셋 URL이 나머지에게 404다. 미검증 릴리스가 그 창에서 노출되지 않는다 |
+| 캐시 | `~/.gradle/scatterlab-react-native/<fork-version>/maven` | 아래 "좌표 충돌" 참조 |
+
+## 좌표 충돌 — 이 설계의 핵심 함정
+
+`VERSION_NAME`이 base로 고정되므로 **모든 fork 버전의 AAR이 같은 좌표를 갖는다**: `com.facebook.react:react-android:0.87.1`. `-scatterlab.2`의 AAR과 `-scatterlab.3`의 AAR은 Gradle이 보기에 구별 불가능한 같은 모듈이다.
+
+따라서 캐시 디렉터리를 **fork 버전으로 스코프**한다. 버전마다 별개의 maven 저장소 루트를 만들고, 그 경로를 `react.internal.mavenLocalRepo`로 넘긴다. 한 루트를 공유하면 새 버전을 받아도 Gradle 모듈 캐시가 옛 AAR을 계속 쓰고, **에러 없이 옛 네이티브 코드가 출고된다.**
+
+iOS의 warm `~/Library/Caches/ReactNative` 함정과 같은 모양이지만, 여기서는 좌표까지 같아 더 조용하다.
+
+## 빌드 — `scatterlab-prebuild-android.yml`
+
+`workflow_dispatch(version, verify_symbol, dry_run)`. `prepare` → `build` → `verify` 3잡, iOS 워크플로와 같은 골격.
+
+같은 버전에 대한 두 번의 dispatch가 겹치지 않도록 `concurrency: group: scatterlab-prebuild-android-<version>`으로 **큐잉**한다(취소가 아니라 대기). 취소를 택하면 먼저 돌던 실행이 에셋만 올리고 draft를 정리하지 못한 채 죽을 수 있는데, 그 상태가 뒤 실행이 잠깐 기다리는 것보다 나쁘다.
+
+러너는 `arc-messenger-dev`(Linux). GitHub-hosted 러너는 org IP allow list 밖이라 인증된 `api.github.com` 쓰기가 403이다.
+
+`prepare`는 빌드 전에 버전 두 개를 맞대본다.
+
+1. `ReactAndroid/gradle.properties`의 `VERSION_NAME`이 `version` 입력에서 뽑은 upstream base와 같은지. AAR 좌표가 이 값으로 나가므로, 어긋나면 존재하지 않는 좌표를 빌드하게 된다.
+2. 체크아웃한 `packages/react-native/package.json`의 `version`이 `version` 입력과 같은지. `dry_run=false`에서는 **하드 실패**다 — 소비자 스크립트가 만드는 다운로드 URL은 그 `package.json` 버전으로 정해지므로, 둘이 다르면 이 태그를 받은 소비자가 다른 버전용 바이너리를 받는다. `dry_run=true`에서는 경고만 남긴다. 그래서 fork의 `version` 필드 bump는 **이 워크플로를 실제로 돌리기 전에 먼저 머지돼 있어야 한다.**
+
+핵심 스텝:
+
+```bash
+env ORG_GRADLE_PROJECT_react.internal.useHermesStable=true \
+    ./gradlew publishAllToMavenTempLocal -PenableWarningsAsErrors=true
+```
+
+- **상류 `.github/actions/build-android`를 재사용하지 않는다.** 그 액션은 `scripts/releases/set-rn-artifacts-version.js`를 부르는데, 이 스크립트가 `VERSION_NAME`을 재작성해 위의 불변식을 정확히 깨뜨린다(실행 금지 목록에 있다).
+- `react.internal.useHermesStable=true`로 Hermes는 빌드하지 않고 Maven Central 안정판을 쓴다. `com.facebook.hermes:hermes-android`는 다른 publishing group이라 아래의 그룹 제외에 걸리지 않는다.
+- `isSnapshot`을 켜지 않는다. 켜면 버전에 `-SNAPSHOT`이 붙어 좌표가 어긋난다.
+- ABI는 기본값(`armeabi-v7a,arm64-v8a,x86,x86_64`)을 그대로 둔다. 소비자의 `reactNativeArchitectures`와 같아야 한다.
+- Debug·Release 두 variant는 `components.default` 멀티 variant 퍼블리시로 한 번에 나온다(`publish.gradle`).
+- ccache를 러너에 유지한다. 없으면 매 실행이 전체 C++ 재컴파일이다.
+- 빌드 산출물은 수 GB다. `if: always()`로 정리한다.
+
+에셋 업로드는 **clobber 하지 않는다.** 소비자 캐시가 버전별로 스코프돼 있어 같은 태그의 에셋을 갈아끼우면 이미 받아 둔 개발자·러너는 영구히 옛 것을 쓴다. 새 `-scatterlab.N`을 낸다.
+
+`build`는 릴리스를 **draft**로 만든다(`gh release create --draft`). draft는 push 권한자에게만 보이고 에셋 다운로드 URL이 그 외에는 404다 — `verify`가 전부 통과할 때까지 미검증 릴리스가 소비자에게 노출되지 않는다. 같은 태그가 이미 **공개**된 릴리스로 있으면 재실행을 abort한다(소비자가 이미 본 릴리스에 검증 안 된 에셋을 얹지 않기 위해서다). draft로 있으면 — 이전 실행이 에셋을 올리다 `verify`에서 실패해 남은 경우다 — 그 draft를 **삭제하고 새로 만든다.** draft는 push 권한 없는 쪽에는 애초에 존재한 적이 없어 지워도 안전하고, 재사용하는 대신 지우고 다시 만들어야 부분 실행에서 올라간 에셋(예: debug AAR만 올라간 상태)이 이번 실행 결과와 섞여 남지 않는다.
+
+## 소비자 배선
+
+로직은 fork의 npm 패키지에 담는다: `packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle`.
+
+동작 순서:
+
+1. `packages/react-native/package.json`을 읽는다. `name`이 `@scatterlab/react-native`가 아니면 **no-op** — 업스트림 react-native로도 이 스크립트가 붙은 채 동작해야 한다. 우리 패키지인데 `version`이 `^\d+\.\d+\.\d+-scatterlab\.\d+$`를 만족하지 않으면(예: rc 접미사) **빌드를 중단한다** — 그대로 두면 업스트림 AAR로 조용히 넘어간다.
+2. 캐시 판정은 디렉터리 존재가 아니라 `~/.gradle/scatterlab-react-native/<version>/maven/com/facebook/react/react-android/<base>/react-android-<base>.pom` 파일의 존재다. 중단된 추출이나 부분 정리로 디렉터리만 남은 트리를 warm으로 오판하지 않기 위해서다. 그 파일이 있으면 그대로 쓴다.
+3. 없거나 깨져 있으면(캐시 디렉터리를 지운 뒤) `https://github.com/scatterlab/react-native/releases/download/prebuilt-android-<version>/react-native-android-maven-<version>.tar.gz`를 받아 `.sha256`으로 검증하고, 최종 경로 옆에 만든 임시 디렉터리에 푼 뒤 rename으로 옮긴다. 부분 추출된 트리가 성공한 캐시로 남으면 안 된다.
+4. 릴리스가 없거나 sha가 어긋나면 **빌드를 중단한다.** 메시지는 `rncore.rb:378`과 같은 형태로 — 무엇이 없고 어떤 워크플로를 돌려야 하는지 적는다.
+5. `gradle.beforeProject`에서 각 프로젝트에 `react.internal.mavenLocalRepo`를 그 경로로 세팅한다.
+
+캐시가 이미 있으면 네트워크를 타지 않으므로 `--offline` 빌드도 그대로 된다. 캐시가 없는데 네트워크가 없으면 abort한다 — 조용히 업스트림으로 떨어뜨리지 않는다.
+
+**`SCATTERLAB_PREBUILT_BASE_URL`** — 다운로드 base URL을 덮어쓰는 환경변수. fork npm 패키지에 그대로 실려 있어 모든 소비자 빌드가 이 코드를 거친다. 오직 소비자 스크립트 스모크 테스트가 로컬 fixture 서버를 가리키기 위한 시임이라, 값의 host가 루프백(`127.0.0.1`, `[::1]`, `localhost`)일 때만 적용된다. `.sha256` 사이드카도 같은 base에서 받으므로, 루프백이 아닌 값을 그냥 받아들이면 아카이브와 그걸 검증할 체크섬을 같은 곳에서 받게 돼 무결성 검사가 아무것도 증명하지 못한다 — 그래서 루프백이 아니면 실제 릴리스로 폴백하지 않고 **빌드를 중단한다.**
+
+그러면 RNGP가(`DependencyUtils.kt:56-87`):
+
+- 그 디렉터리를 maven 저장소로 추가하고,
+- **Maven Central에서 `com.facebook.react` 그룹 전체를 제외한다.**
+
+두 번째가 중요하다 — 우리 저장소가 그 그룹의 아티팩트를 **전부** 들고 있어야 한다. `publishAllToMavenTempLocal`의 산출물이 정확히 그 집합이다.
+
+소비자(zeta) 쪽 변경은 `packages/app/android/settings.gradle.kts` 한 줄이다:
+
+```kotlin
+apply(from = "../../../node_modules/react-native/scripts/android/scatterlab-prebuilt-maven.gradle")
+```
+
+`settings.gradle` 평가 시점에 동기적으로 받는다. `pod install`이 xcframework를 받는 자리와 같다. 별도 태스크로 빼고 CI·postinstall이 먼저 부르게 하는 형태는 택하지 않는다 — 그 단계를 빠뜨린 로컬 빌드가 **에러 없이 업스트림 AAR로 돌아간다.**
+
+## 검증
+
+**워크플로 `verify` 잡** — 릴리스가 소비 가능한지 확인하고, 통과해야만 릴리스를 공개한다:
+
+- 에셋 이름이 정확히 기대한 2개인지 (`gh release view --json assets --jq '.assets[].name'` diff). GitHub은 예상 밖 문자가 든 에셋 이름을 재작성한다. REST의 "get a release by tag"(`gh api repos/.../releases/tags/<tag>`)는 draft를 못 찾으므로 쓰지 않는다 — `gh release view`가 쓰는 GraphQL 경로만 draft를 태그로 찾는다.
+- tarball을 받아 sha256이 맞는지. 릴리스가 이 시점엔 아직 draft라 공개 다운로드 URL이 404다 — `gh release download`로 `GH_TOKEN` 인증된 API를 거쳐 받는다.
+- 그 sha256이 `build` 잡이 산출한 값과 **같은지도** 확인한다. `.sha256` 사이드카는 아카이브가 자기 자신과 일치한다는 것만 증명하고, 이 비교라야 그 아카이브가 **이 실행이 만든** 것이라는 걸 증명한다.
+- 릴리스의 `targetCommitish`가 이 실행의 `$GITHUB_SHA`와 같은지. 같은 태그를 다른 커밋에서 두 번 돌리면 릴리스는 하나만 존재하므로, 이 검사가 없으면 나중 실행의 `verify`가 앞선 실행이 만든(또는 그 반대의) 에셋을 검증 없이 승격시킬 수 있다.
+- 트리에 `com/facebook/react/react-android/<base>/`의 `react-android-<base>-debug.aar`, `-release.aar`, `.module`, `.pom`이 모두 있는지.
+- 위 검사가 전부 통과한 뒤에야 `gh release edit --draft=false`로 릴리스를 공개한다. 실패하면 draft로 남아 소비자에게 노출되지 않는다.
+
+**패치가 실려 있는지 증명하는 게이트** — "내용이 바뀌었는데 식별자가 같다" 계열 사고를 막는 유일한 수단이다. 좌표가 버전 간 동일하므로 여기서는 필수다.
+
+`workflow_dispatch`에 `verify_symbol` 입력을 둔다. `dry_run=false`인 실제 릴리스는 이 값이 **비어 있으면 `prepare`에서 실패한다** — 새 심볼이 없는 릴리스(예: base bump)라면 빈 값이 아니라 리터럴 `(none)`을 넣어야 한다. 값이 있고 `(none)`이 아니면 `build` 잡이 AAR 둘을 대조한다: 먼저 Maven Central의 **업스트림 base release AAR**에서 그 심볼을 찾아 0건인지 확인하고(있으면 실패 — 이 fork가 추가한 게 아니라는 뜻이므로 "패치가 들어 있다"의 증거가 못 된다), 그다음 이번에 빌드한 release AAR에서 같은 심볼을 찾아 1건 이상인지 확인한다. 둘 다 `classes.jar`를 풀어 `javap -p`로 디스어셈블한 뒤 문자열로 센다. `javap` 자체가 실행되지 못한 경우(예: 툴체인 문제)는 "심볼 없음"과 구별되는 별도 에러로 실패한다 — 조용히 0건으로 수렴하지 않는다. `(none)`이거나(`dry_run=true`에서) 빈 값이면 이 검사 전체를 건너뛰고 `::warning::`을 남긴다.
+
+소비자 쪽 확인은 `--info` 실행에서 해석된 AAR 경로가 `~/.gradle/scatterlab-react-native/<version>/maven` 아래인지 보는 것으로 족하다. 새 fork 버전으로 처음 빌드할 때 한 번 본다.
+
+**소비자 스크립트 스모크 테스트** — `.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh`가 `prepare` 잡에서 (`actions/setup-java` 후) 매 워크플로 실행마다 자동으로 돈다. 확인하는 분기: 업스트림 패키지 no-op, 해석 불가능한 fork 버전(예: rc 접미사) abort, 릴리스 없을 때 abort(정상 네트워크·DNS 차단 양쪽), 빈 디렉터리만 있는 캐시는 warm으로 치지 않고 재다운로드, warm 캐시 오프라인 재사용, 루프백이 아닌 `SCATTERLAB_PREBUILT_BASE_URL` 거부, 그리고 로컬 HTTP fixture 서버로 실제 다운로드·추출까지 도는 콜드캐시 성공 경로 — 좌표가 버전 간 동일해 심볼 게이트만으로는 소비자 쪽 fail-closed를 보장 못 하므로, 이 스크립트가 그 나머지를 지킨다. 콜드캐시 케이스는 `python3`나 빈 로컬 포트가 없으면 건너뛴다 — 로컬에서는 `SKIP`으로 통과하지만, CI에서는 이 러너들이 우리 것이라 건너뜀 자체를 실패로 센다.
+
+**단위 테스트** — 수정마다 ReactAndroid의 Robolectric 테스트를 붙인다.
+
+**엔드투엔드** — 소비자에서 release APK를 빌드해 실기기로 증상을 확인한다. 시뮬레이터·에뮬레이터로 대체하지 않는다.
+
+## 출고 순서
+
+iOS와 같은 제약이 하나 더 붙는다.
+
+```
+prebuilt-ios-<N>  릴리스
+prebuilt-android-<N>  릴리스      ← 추가
+npm publish (scatterlab-publish.yml)
+소비자 핀 갱신
+```
+
+두 prebuilt 릴리스가 npm보다 **먼저** 있어야 한다. 뒤집으면 소비자의 `pod install`(iOS)과 Gradle configure(Android)가 각각 abort한다. 그게 의도다 — 패치 없는 네이티브를 조용히 출고하는 것보다 낫다.
+
+"있어야 한다"는 **공개(published)** 상태를 뜻한다. Android는 `verify`가 통과하기 전까지 draft다 — 소비자는 공개 다운로드 URL만 쓰므로, 그 창에는 존재해도 없는 것과 같고 똑같이 abort한다.
+
+이 순서를 `scatterlab-publish.yml`이 검사하지는 **않는다.** iOS와 같은 선택이다 — 강제는 소비자 쪽 abort 한 곳에만 두고, publish는 순서를 모른 채 돈다. publish 후 릴리스를 만들어도 결과는 같고, 그 사이에 설치한 소비자만 abort를 본다.
+
+한 flavor만 성공한 **부분 릴리스**가 iOS에서 위험했던 것과 같은 이유로, Android도 `verify` 잡이 두 variant를 모두 확인한 뒤에야 릴리스를 소비 가능으로 본다.
+
+## 절대 하면 안 되는 것
+
+[README.md](README.md)의 표에 이어서:
+
+| 금지 | 이유 |
+| --- | --- |
+| `scatterlab-prebuild-android.yml`에서 상류 `.github/actions/build-android` 재사용 | 그 액션이 `set-rn-artifacts-version.js`를 불러 `VERSION_NAME`을 재작성한다 |
+| 캐시 디렉터리를 fork 버전으로 스코프하지 않기 | 좌표가 버전 간 동일해 옛 AAR이 조용히 재사용된다 |
+| 릴리스 에셋 clobber | 이미 받아 둔 소비자가 영구히 옛 AAR을 쓴다 |
+| `isSnapshot=true` | 좌표에 `-SNAPSHOT`이 붙어 어긋난다 |
+| maven 트리에서 일부 아티팩트만 골라 올리기 | RNGP가 Maven Central에서 `com.facebook.react` 그룹을 통째로 제외하므로, 빠진 아티팩트는 어디서도 못 찾는다 |
+| 이미 **공개**된 릴리스에 재실행으로 에셋 업로드 | 소비자가 이미 본 릴리스에 검증 안 된 에셋을 얹게 된다. 재실행은 draft 상태일 때만 허용되고(그 draft를 지우고 새로 만든다), 공개된 태그는 새 `-scatterlab.N`으로 간다 |
diff --git a/.github/scatterlab/plans/2026-09-10-android-prebuilt.md b/.github/scatterlab/plans/2026-09-10-android-prebuilt.md
new file mode 100644
index 000000000000..058f0230766d
--- /dev/null
+++ b/.github/scatterlab/plans/2026-09-10-android-prebuilt.md
@@ -0,0 +1,1069 @@
+# Android prebuilt 배포 파이프라인 Implementation Plan
+
+**진행 상태:** Task 1–3은 이 브랜치에 완료·커밋됨(`git log --oneline ff27ad0f0d8..bbda7fb082b`). Task 4(fork PR 올리기)·Task 6(출고, zeta-frontend 배선 포함)은 미착수. Task 5는 별도 단계로 두지 않는다 — Task 6 Step 5로 병합됨 (이유는 그 자리에 적혀 있다).
+
+> **For agentic workers:** Task 1–3은 완료됐으니 그 구간을 다시 실행하지 말 것. Task 4부터 이어서 진행할 때만 REQUIRED SUB-SKILL로 superpowers:subagent-driven-development(recommended) 또는 superpowers:executing-plans를 쓴다. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** fork가 수정한 Android 네이티브 코드가 실제로 소비자 앱에 실리는 경로를 만들고, 첫 화물로 `TextDecorationStyle` IndexOutOfBounds 크래시 수정을 태운다.
+
+**Architecture:** fork CI가 `publishAllToMavenTempLocal`로 패치된 maven 트리를 만들어 GitHub Release에 올린다. fork npm 패키지에 든 Gradle settings 스크립트가 소비자 빌드의 설정 단계에서 그 tarball을 받아 캐시하고, `react.internal.mavenLocalRepo`를 그 경로로 세팅한다. 그러면 RNGP가 Maven Central에서 `com.facebook.react` 그룹을 제외하고 우리 AAR을 쓴다.
+
+**Tech Stack:** Kotlin (ReactAndroid), Groovy (Gradle settings 스크립트), GitHub Actions, bash
+
+**Spec:** [`.github/scatterlab/android-prebuilt.md`](../android-prebuilt.md)
+
+## Global Constraints
+
+이 값들을 어기면 조용히 깨진다. 모든 태스크에 암묵적으로 적용된다.
+
+- 작업 브랜치는 `daewoon/android-prebuilt`, base는 `scatterlab/0.87.1`. `main`에 push 금지.
+- `packages/react-native/ReactAndroid/gradle.properties`의 `VERSION_NAME`은 `0.87.1`로 **고정**. 절대 변경하지 않는다.
+- `react.internal.publishingGroup`은 `com.facebook.react`로 고정.
+- `packages/react-native/package.json`의 `@react-native/*` sibling 7개 핀은 exact `0.87.1`로 고정.
+- `scripts/releases/set-version.js`와 `scripts/releases/set-rn-artifacts-version.js`는 **실행 금지**.
+- `v`로 시작하는 태그 생성 금지. 릴리스 태그는 `prebuilt-android-<version>`.
+- fork 버전 형식은 `0.87.1-scatterlab.N` — 대시 정확히 1개.
+- 커밋 메시지 본문은 한국어. 타입 접두어(`feat`/`fix`/`ci`/`docs`/`chore`)와 코드 식별자·파일 경로·명령어는 원문 유지.
+- push는 항상 브랜치 명시: `git push origin daewoon/android-prebuilt`. `--tags`/`--follow-tags` 금지 (로컬에 상류 `v0.*` 태그 660여 개).
+- `packages/react-native/` 안의 파일을 새로 건드리거나 추가하면 `.github/scatterlab/allowed-tarball-diff.txt`에 그 **tarball 상대 경로**를 추가해야 한다. `packages/react-native/` 접두어는 붙이지 않는다. `ReactAndroid/src/test/**`는 `files` 필드가 제외하므로 tarball에 없다 — 추가하지 않는다.
+- Gradle 실행에는 JDK 17 이상이 필요하다. `JAVA_HOME`이 그보다 낮으면 명시한다:
+  `JAVA_HOME=$(/usr/libexec/java_home -v 21) ./gradlew ...`
+
+**작업 디렉터리:** `~/GitHub/react-native/.claude/worktrees/daewoon+android-prebuilt` (Task 6 Step 5만 zeta-frontend). 이 워크트리 절대경로로 파일을 연다 — 메인 체크아웃(`~/GitHub/react-native`)을 편집하면 다른 세션의 작업을 오염시킨다.
+
+---
+
+## File Structure
+
+| 파일 | 책임 | 태스크 |
+| --- | --- | --- |
+| `packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt` | 잘린 layout 밖 offset을 clamp | 1 |
+| `packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt` | 위 동작의 회귀 테스트 | 1 |
+| `packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle` | 소비자 설정 단계: 버전 판정 · 다운로드 · 검증 · 캐시 · 프로퍼티 주입 · abort | 2 |
+| `packages/react-native/package.json` | `files`에 `scripts/android` 추가 | 2 |
+| `.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh` | 위 스크립트의 3개 분기 스모크 테스트 | 2 |
+| `.github/workflows/scatterlab-prebuild-android.yml` | AAR 빌드 · 릴리스 · 검증 | 3 |
+| `.github/scatterlab/allowed-tarball-diff.txt` | 새로 다른 tarball 경로 등록 | 1, 2 |
+| `CLAUDE.md` | 배포 절차에 Android 단계 추가 | 3 |
+| `packages/app/android/settings.gradle.kts` (zeta-frontend) | 스크립트 apply 한 줄 | 5 |
+
+---
+
+### Task 1: `TextDecorationStyle` clamp 수정 (첫 화물)
+
+상류 PR [#58366](https://github.com/react/react-native/pull/58366)의 체리픽이다. 이슈 [#58356](https://github.com/react/react-native/issues/58356). `drawSpannedDecoration()`이 잘리지 않은 전체 `Spanned`에서 온 `start`/`end`를 `Layout.getPrimaryHorizontal()`에 그대로 넘겨, `numberOfLines`로 잘린 layout에서 `IndexOutOfBoundsException`이 난다.
+
+**Files:**
+- Modify: `packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt`
+- Test: `packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt`
+- Modify: `.github/scatterlab/allowed-tarball-diff.txt`
+
+**Interfaces:**
+- Consumes: 없음 (첫 태스크)
+- Produces: `private fun visibleTextEnd(layout: Layout): Int` — Task 3의 `verify_symbol` 게이트가 이 이름을 심볼로 찾는다.
+
+- [x] **Step 1: 실패하는 테스트를 쓴다**
+
+`TextDecorationStyleTest.kt`의 import 블록을 아래로 교체한다:
+
+```kotlin
+package com.facebook.react.views.text
+
+import android.graphics.Canvas
+import android.graphics.Color
+import android.text.StaticLayout
+import android.text.TextPaint
+import android.text.TextUtils
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.kotlin.any
+import org.mockito.kotlin.eq
+import org.mockito.kotlin.mock
+import org.mockito.kotlin.verify
+import org.robolectric.RobolectricTestRunner
+
+@RunWith(RobolectricTestRunner::class)
+class TextDecorationStyleTest {
+```
+
+기존 `class TextDecorationStyleTest {` 줄은 위 블록이 대신하므로 지운다. 클래스 닫는 `}` 직전에 아래를 넣는다:
+
+```kotlin
+  @Test
+  fun drawSpannedDecorationClampsSpanPastTailEllipsis() {
+    val layout = buildTailEllipsizedLayout()
+    val visibleEnd = layout.getLineStart(0) + layout.getEllipsisStart(0)
+    val baseline = layout.getLineBaseline(0).toFloat()
+    val x1 = layout.getPrimaryHorizontal(0)
+    val x2 = layout.getPrimaryHorizontal(visibleEnd)
+    val canvas = mock<Canvas>()
+
+    // The span covers the whole string, well past what survived the ellipsis; pre-fix this
+    // called layout.getPrimaryHorizontal(TAIL_TEXT.length) and crashed with
+    // IndexOutOfBoundsException, since the ellipsized layout only resolves up to visibleEnd.
+    drawSpannedDecoration(
+        0,
+        TAIL_TEXT.length,
+        canvas,
+        layout,
+        Color.BLACK,
+        TextDecorationStyle.SOLID,
+    ) { _, lineBaseline, thickness ->
+      lineBaseline + thickness + 1f
+    }
+
+    verify(canvas).drawLine(eq(x1), eq(baseline + 1f), eq(x2), eq(baseline + 1f), any())
+  }
+
+  @Test
+  fun drawSpannedDecorationSkipsSpanEntirelyPastTailEllipsis() {
+    val layout = buildTailEllipsizedLayout()
+    val visibleEnd = layout.getLineStart(0) + layout.getEllipsisStart(0)
+    val baseline = layout.getLineBaseline(0).toFloat()
+    val x = layout.getPrimaryHorizontal(visibleEnd)
+    val canvas = mock<Canvas>()
+
+    // The whole span (e.g. a nested Text) starts after the ellipsis, fully hidden: it must
+    // collapse to a zero-length line at the visible boundary, not draw anything past it.
+    drawSpannedDecoration(
+        visibleEnd,
+        TAIL_TEXT.length,
+        canvas,
+        layout,
+        Color.BLACK,
+        TextDecorationStyle.SOLID,
+    ) { _, lineBaseline, thickness ->
+      lineBaseline + thickness + 1f
+    }
+
+    verify(canvas).drawLine(eq(x), eq(baseline + 1f), eq(x), eq(baseline + 1f), any())
+  }
+
+  /**
+   * A single line, tail-ellipsized right after "Hello" because the paragraph break in
+   * [TAIL_TEXT] hides everything after it once `maxLines` is reached.
+   */
+  private fun buildTailEllipsizedLayout(): StaticLayout {
+    val paint = TextPaint().apply { textSize = 32f }
+    val layout =
+        StaticLayout.Builder.obtain(TAIL_TEXT, 0, TAIL_TEXT.length, paint, 400)
+            .setMaxLines(1)
+            .setEllipsize(TextUtils.TruncateAt.END)
+            .build()
+    assertThat(layout.lineCount).isEqualTo(1)
+    assertThat(layout.getEllipsisCount(0)).isGreaterThan(0)
+    return layout
+  }
+
+  private companion object {
+    const val TAIL_TEXT = "Hello\ndecorated world"
+  }
+```
+
+- [x] **Step 2: 테스트가 실패하는 것을 확인한다**
+
+```bash
+cd ~/GitHub/react-native/.claude/worktrees/daewoon+android-prebuilt
+./gradlew :packages:react-native:ReactAndroid:testDebugUnitTest \
+  --tests "com.facebook.react.views.text.TextDecorationStyleTest"
+```
+
+기대: 새 테스트 2개가 `IndexOutOfBoundsException: offset(...) should be less than line limit(...)`로 실패. 기존 `fromString*` 테스트 6개는 통과.
+
+이 에러가 정확히 재현되지 않으면 멈춘다 — 재현 없는 수정은 검증되지 않는다.
+
+- [x] **Step 3: 최소 구현을 넣는다**
+
+`TextDecorationStyle.kt`에서 `drawDecorationLine` 함수가 끝나는 `}` 다음, `drawSpannedDecoration`의 KDoc 앞에 아래를 삽입한다:
+
+```kotlin
+/**
+ * The last offset [layout] can resolve a horizontal position for. Truncation (via `numberOfLines`)
+ * can leave the last line shorter than [Layout.getLineEnd] reports, since [layout] keeps the full
+ * untruncated text and only clips how much of it is laid out. When the last line ends in a tail
+ * ellipsis, anything from the ellipsis onward is unresolvable too; a leading/middle ellipsis
+ * doesn't shorten what's resolvable on that line, so it's left to [Layout.getLineEnd].
+ */
+private fun visibleTextEnd(layout: Layout): Int {
+  val lastLine = layout.lineCount - 1
+  val lineStart = layout.getLineStart(lastLine)
+  val lineEnd = layout.getLineEnd(lastLine)
+  val ellipsisStart = layout.getEllipsisStart(lastLine)
+  val ellipsisCount = layout.getEllipsisCount(lastLine)
+  return if (ellipsisCount > 0 && ellipsisStart + ellipsisCount == lineEnd - lineStart) {
+    lineStart + ellipsisStart
+  } else {
+    lineEnd
+  }
+}
+```
+
+그리고 `drawSpannedDecoration` 안의 아래 블록을
+
+```kotlin
+  val startLine = layout.getLineForOffset(start)
+  val endLine = layout.getLineForOffset(end)
+  for (line in startLine..endLine) {
+    val baseline = layout.getLineBaseline(line).toFloat()
+    val rawX1 =
+        if (line == startLine) layout.getPrimaryHorizontal(start) else layout.getLineLeft(line)
+    val rawX2 = if (line == endLine) layout.getPrimaryHorizontal(end) else layout.getLineRight(line)
+```
+
+이렇게 바꾼다:
+
+```kotlin
+  val visibleEnd = visibleTextEnd(layout)
+  val clampedStart = min(start, visibleEnd)
+  val clampedEnd = min(end, visibleEnd)
+
+  val startLine = layout.getLineForOffset(clampedStart)
+  val endLine = layout.getLineForOffset(clampedEnd)
+  for (line in startLine..endLine) {
+    val baseline = layout.getLineBaseline(line).toFloat()
+    val rawX1 =
+        if (line == startLine) layout.getPrimaryHorizontal(clampedStart)
+        else layout.getLineLeft(line)
+    val rawX2 =
+        if (line == endLine) layout.getPrimaryHorizontal(clampedEnd) else layout.getLineRight(line)
+```
+
+`min`은 이미 `kotlin.math.min`으로 import 되어 있다. 새 import 없다.
+
+- [x] **Step 4: 테스트가 통과하는 것을 확인한다**
+
+```bash
+./gradlew :packages:react-native:ReactAndroid:testDebugUnitTest \
+  --tests "com.facebook.react.views.text.TextDecorationStyleTest"
+```
+
+기대: 8개 전부 PASS.
+
+- [x] **Step 5: tarball diff 게이트에 경로를 등록한다**
+
+`.github/scatterlab/allowed-tarball-diff.txt` 끝에 추가한다:
+
+```
+# Android text decoration crash: drawSpannedDecoration() passed offsets from the full
+# Spanned into a numberOfLines-truncated Layout, so getPrimaryHorizontal() threw
+# IndexOutOfBoundsException while drawing an underline/strikethrough that the truncation
+# had hidden. Upstream https://github.com/react/react-native/pull/58366 (open).
+# Reaches the app only through this fork's Android prebuilt release - see android-prebuilt.md.
+ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt
+```
+
+테스트 파일은 `package.json`의 `files`가 `!ReactAndroid/src/test`로 제외하므로 tarball에 없다. 추가하지 않는다.
+
+- [x] **Step 6: 게이트가 통과하는지 확인한다**
+
+```bash
+cd packages/react-native && npm pack --silent && cd -
+.github/scatterlab/verify-tarball.sh packages/react-native/*.tgz 0.87.1
+```
+
+기대: 통과. `TextDecorationStyle.kt`가 allowlist 밖이라고 실패하면 Step 5의 경로 문자열이 tarball 상대 경로와 다른 것이다 — `tar tzf`로 실제 경로를 확인하고 맞춘다.
+
+- [x] **Step 7: 커밋**
+
+```bash
+rm -f packages/react-native/*.tgz
+git add packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt \
+        packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt \
+        .github/scatterlab/allowed-tarball-diff.txt
+git commit -m "$(cat <<'MSG'
+fix(android): 잘린 layout 밖으로 나간 text decoration offset을 clamp
+
+`numberOfLines`로 잘린 `Layout`에 전체 `Spanned` 기준 offset을 넘겨
+`Layout.getPrimaryHorizontal()`이 `IndexOutOfBoundsException`을 던졌다.
+중첩 `Text`의 `textDecorationLine`이 잘려 안 보이는 위치에 있으면 그리기
+단계에서 앱이 죽는다.
+
+상류 PR https://github.com/react/react-native/pull/58366 체리픽.
+이슈 https://github.com/react/react-native/issues/58356
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+MSG
+)"
+```
+
+---
+
+### Task 2: 소비자 Gradle settings 스크립트
+
+**Files:**
+- Create: `packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle`
+- Modify: `packages/react-native/package.json` (`files` 배열)
+- Modify: `.github/scatterlab/allowed-tarball-diff.txt`
+- Test: `.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh`
+
+**Interfaces:**
+- Consumes: 없음
+- Produces:
+  - 릴리스 에셋 이름 `react-native-android-maven-<version>.tar.gz` 와 `react-native-android-maven-<version>.tar.gz.sha256` — Task 3이 정확히 이 이름으로 올린다.
+  - 릴리스 태그 `prebuilt-android-<version>` — Task 3이 이 태그를 만든다.
+  - tar 아카이브의 루트는 maven 저장소 루트 자체다 (`com/facebook/react/...`가 최상위). Task 3이 `tar -C /tmp/maven-local -czf ... .`로 만든다.
+  - 캐시 경로 `<gradleUserHome>/scatterlab-react-native/<version>/maven`.
+  - 소비자가 apply 할 경로: `<node_modules>/react-native/scripts/android/scatterlab-prebuilt-maven.gradle` — Task 6 Step 5가 이 경로를 쓴다.
+
+- [x] **Step 1: 실패하는 스모크 테스트를 쓴다**
+
+`.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh` 를 만든다:
+
+```bash
+#!/usr/bin/env bash
+# Smoke test for scripts/android/scatterlab-prebuilt-maven.gradle.
+#
+# The script locates the package version relative to its own file, so each case builds a
+# throwaway tree that mimics node_modules/react-native and copies the script into it.
+# GRADLE_USER_HOME is sandboxed per case so a warm cache from one case cannot leak into
+# another - the whole point of the script is what it does when the cache is cold.
+set -euo pipefail
+
+REPO=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
+SCRIPT="$REPO/packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle"
+GRADLE="$REPO/gradlew"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+failures=0
+
+# Lays out <root>/rn/{package.json,scripts/android/<script>} plus a consumer project whose
+# settings.gradle applies the script and whose build.gradle prints the resolved property.
+setup_case() {
+  local name=$1 version=$2
+  local dir="$WORK/$name"
+  mkdir -p "$dir/rn/scripts/android" "$dir/app" "$dir/gradlehome"
+  printf '{"name":"react-native","version":"%s"}\n' "$version" > "$dir/rn/package.json"
+  cp "$SCRIPT" "$dir/rn/scripts/android/"
+  cat > "$dir/app/settings.gradle" <<EOF
+apply from: '../rn/scripts/android/scatterlab-prebuilt-maven.gradle'
+rootProject.name = 'probe'
+EOF
+  cat > "$dir/app/build.gradle" <<'EOF'
+tasks.register('probe') {
+  doLast {
+    def key = 'react.internal.mavenLocalRepo'
+    println "PROBE_SET=" + project.hasProperty(key)
+    if (project.hasProperty(key)) println "PROBE_VALUE=" + project.property(key)
+  }
+}
+EOF
+  echo "$dir"
+}
+
+run_case() {
+  local dir=$1
+  ( cd "$dir/app" && GRADLE_USER_HOME="$dir/gradlehome" "$GRADLE" --offline -q probe 2>&1 )
+}
+
+check() {
+  local label=$1 expected=$2 actual=$3
+  if [[ "$actual" == *"$expected"* ]]; then
+    echo "ok   - $label"
+  else
+    echo "FAIL - $label"
+    echo "       expected to contain: $expected"
+    echo "       got: $actual"
+    failures=$((failures + 1))
+  fi
+}
+
+# A: an upstream version must be a no-op, so this script can ship in a package that is
+#    installed straight from npmjs without a fork suffix.
+dir=$(setup_case upstream "0.87.1")
+check "upstream version leaves the property unset" "PROBE_SET=false" "$(run_case "$dir" || true)"
+
+# B: a fork version with no release must stop the build. Falling through to Maven Central
+#    would ship the unpatched upstream AAR with no error.
+dir=$(setup_case missing "0.87.1-scatterlab.999")
+check "missing release aborts" "prebuilt-android-0.87.1-scatterlab.999" "$(run_case "$dir" || true)"
+
+# C: a warm cache must be used as-is, with no network. --offline makes any download attempt
+#    fail loudly instead of quietly succeeding on a machine that happens to be online.
+dir=$(setup_case cached "0.87.1-scatterlab.998")
+mkdir -p "$dir/gradlehome/scatterlab-react-native/0.87.1-scatterlab.998/maven"
+check "warm cache is used" \
+  "PROBE_VALUE=$dir/gradlehome/scatterlab-react-native/0.87.1-scatterlab.998/maven" \
+  "$(run_case "$dir" || true)"
+
+[ "$failures" -eq 0 ] || { echo "$failures case(s) failed"; exit 1; }
+echo "all cases passed"
+```
+
+- [x] **Step 2: 테스트가 실패하는 것을 확인한다**
+
+```bash
+cd ~/GitHub/react-native/.claude/worktrees/daewoon+android-prebuilt
+chmod +x .github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
+.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
+```
+
+기대: 스크립트 파일이 없어 `cp`에서 실패한다. 3개 케이스 전부 도달 못 함.
+
+- [x] **Step 3: 스크립트를 구현한다**
+
+`packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle` 를 만든다:
+
+```groovy
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+// Points the consumer's build at this fork's Android artifacts.
+//
+// RNGP force-resolves com.facebook.react:react-android:<VERSION_NAME> from Maven Central,
+// and VERSION_NAME has to stay on the upstream base, so the fork's ReactAndroid sources are
+// never compiled by a consumer. This fetches the AAR this fork built and hands its path to
+// RNGP via react.internal.mavenLocalRepo, which also makes RNGP exclude the whole
+// com.facebook.react group from Maven Central. See .github/scatterlab/android-prebuilt.md.
+//
+// Apply from the consumer's settings.gradle(.kts):
+//   apply(from = "<...>/node_modules/react-native/scripts/android/scatterlab-prebuilt-maven.gradle")
+
+import java.security.MessageDigest
+
+def packageJson = new File(buildscript.sourceFile.parentFile, '../../package.json').canonicalFile
+def version = new groovy.json.JsonSlurper().parse(packageJson).version
+
+// Upstream react-native: nothing of ours to fetch. Stay out of the way entirely.
+if (!(version ==~ /^\d+\.\d+\.\d+-scatterlab\.\d+$/)) {
+  return
+}
+
+def tag = "prebuilt-android-${version}"
+def asset = "react-native-android-maven-${version}.tar.gz"
+def assetUrl = "https://github.com/scatterlab/react-native/releases/download/${tag}/${asset}"
+
+// Scoped by fork version on purpose. VERSION_NAME is pinned to the base, so every fork
+// version publishes the SAME coordinate - sharing one repo root would let Gradle keep
+// serving the previous version's AAR with no error at all.
+def repoDir = new File(gradle.gradleUserHomeDir, "scatterlab-react-native/${version}/maven")
+
+def fail = { String why ->
+  throw new GradleException(
+      "[scatterlab] ${why}\n" +
+      "  This version of @scatterlab/react-native carries Android native changes that only\n" +
+      "  exist in this fork's prebuilt artifacts. Run the '[scatterlab] Build Android prebuilt'\n" +
+      "  workflow for ${version}, then build again.\n" +
+      "  Expected: ${assetUrl}")
+}
+
+def download = { String url, File target ->
+  def connection = new URL(url).openConnection()
+  connection.instanceFollowRedirects = true
+  connection.connectTimeout = 30_000
+  connection.readTimeout = 300_000
+  if (connection.responseCode != 200) {
+    fail("${url} returned HTTP ${connection.responseCode}.")
+  }
+  target.withOutputStream { out -> connection.inputStream.withStream { input -> out << input } }
+}
+
+def sha256 = { File file ->
+  def digest = MessageDigest.getInstance('SHA-256')
+  file.eachByte(1024 * 1024) { buffer, length -> digest.update(buffer, 0, length) }
+  digest.digest().encodeHex().toString()
+}
+
+if (!repoDir.isDirectory()) {
+  // Staged next to the final location, not in /tmp: the move below has to be a rename on
+  // the same filesystem, or a half-copied tree can be left behind as a cache hit.
+  repoDir.parentFile.mkdirs()
+  def staging = java.nio.file.Files
+      .createTempDirectory(repoDir.parentFile.toPath(), 'staging')
+      .toFile()
+  try {
+    def tarball = new File(staging, asset)
+    download(assetUrl, tarball)
+
+    def expectedFile = new File(staging, "${asset}.sha256")
+    download("${assetUrl}.sha256", expectedFile)
+    def expected = expectedFile.text.trim().split(/\s+/)[0]
+    def actual = sha256(tarball)
+    if (expected != actual) {
+      fail("${asset} sha256 mismatch: expected ${expected}, got ${actual}.")
+    }
+
+    def extracted = new File(staging, 'maven')
+    extracted.mkdirs()
+    def proc = ['tar', '-xzf', tarball.absolutePath, '-C', extracted.absolutePath].execute()
+    def stderr = new StringBuffer()
+    proc.waitForProcessOutput(new StringBuffer(), stderr)
+    if (proc.exitValue() != 0) {
+      fail("extracting ${asset} failed: ${stderr}")
+    }
+
+    // Move only once the tree is complete: a half-extracted directory must never be left
+    // behind as a cache hit for the next build.
+    if (!extracted.renameTo(repoDir) && !repoDir.isDirectory()) {
+      fail("could not move the extracted repository into ${repoDir}.")
+    }
+  } finally {
+    staging.deleteDir()
+  }
+}
+
+gradle.beforeProject { project ->
+  project.extensions.extraProperties.set('react.internal.mavenLocalRepo', repoDir.absolutePath)
+}
+```
+
+- [x] **Step 4: 테스트가 통과하는 것을 확인한다**
+
+```bash
+.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
+```
+
+기대: `ok - upstream version leaves the property unset`, `ok - missing release aborts`, `ok - warm cache is used`, `all cases passed`.
+
+케이스 B가 HTTP 404 대신 다른 에러로 죽으면 메시지에 `prebuilt-android-...`가 들어가는지만 본다 — 이 테스트가 확인하는 것은 "조용히 통과하지 않는다"이다.
+
+- [x] **Step 5: 스크립트를 npm 패키지에 포함시킨다**
+
+`packages/react-native/package.json`의 `files` 배열에서 `scripts/`로 시작하는 항목들 사이, `scripts/codegen` 다음 줄에 추가한다:
+
+```json
+    "scripts/android",
+```
+
+`files`는 `scripts` 전체가 아니라 개별 경로를 나열한다 — 추가하지 않으면 스크립트가 tarball에 들어가지 않고, 소비자의 `apply from:`이 파일 없음으로 실패한다.
+
+- [x] **Step 6: tarball 게이트에 경로를 등록하고 포함을 확인한다**
+
+`.github/scatterlab/allowed-tarball-diff.txt` 끝에 추가한다:
+
+```
+# Points the consumer's Gradle build at this fork's Android artifacts. Added file, so the
+# gate sees it as a difference from upstream. See android-prebuilt.md.
+scripts/android/scatterlab-prebuilt-maven.gradle
+```
+
+```bash
+cd packages/react-native && npm pack --silent && cd -
+tar tzf packages/react-native/*.tgz | grep 'scripts/android/'
+.github/scatterlab/verify-tarball.sh packages/react-native/*.tgz 0.87.1
+```
+
+기대: `package/scripts/android/scatterlab-prebuilt-maven.gradle` 한 줄이 나오고, 게이트 통과.
+
+- [x] **Step 7: 커밋**
+
+```bash
+rm -f packages/react-native/*.tgz
+git add packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle \
+        packages/react-native/package.json \
+        .github/scatterlab/__tests__/android-prebuilt-consumer-test.sh \
+        .github/scatterlab/allowed-tarball-diff.txt
+git commit -m "$(cat <<'MSG'
+feat(scatterlab): 소비자 빌드가 fork의 Android 아티팩트를 쓰게 하는 settings 스크립트
+
+RNGP 가 `com.facebook.react:react-android:<VERSION_NAME>` 을 Maven Central 에서
+force resolve 하므로 fork 의 `ReactAndroid/**` 는 소비자 빌드에서 컴파일되지
+않는다. 이 스크립트가 릴리스 tarball 을 받아 캐시하고 그 경로를
+`react.internal.mavenLocalRepo` 로 넘긴다 — RNGP 가 그 저장소를 추가하고
+Maven Central 에서 `com.facebook.react` 그룹을 제외한다.
+
+캐시는 fork 버전으로 스코프한다. `VERSION_NAME` 이 base 로 고정돼 모든 fork
+버전의 좌표가 같으므로, 한 루트를 공유하면 옛 AAR 이 에러 없이 재사용된다.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+MSG
+)"
+```
+
+---
+
+### Task 3: 빌드 · 릴리스 워크플로
+
+**Files:**
+- Create: `.github/workflows/scatterlab-prebuild-android.yml`
+- Modify: `CLAUDE.md` (배포 절차)
+
+**Interfaces:**
+- Consumes: Task 1의 `visibleTextEnd` 심볼 (`verify_symbol` 입력의 첫 사용값), Task 2가 정한 태그·에셋 이름·tar 루트 규약
+- Produces: 릴리스 `prebuilt-android-<version>` 에 `react-native-android-maven-<version>.tar.gz` + `.sha256`
+
+- [x] **Step 1: 워크플로를 쓴다**
+
+`.github/workflows/scatterlab-prebuild-android.yml`:
+
+```yaml
+name: '[scatterlab] Build Android prebuilt'
+
+# Builds com.facebook.react:* from THIS fork's sources and attaches the resulting Maven
+# repository to a `prebuilt-android-<version>` release.
+#
+# Why this exists: RNGP force-resolves com.facebook.react:react-android:<VERSION_NAME> from
+# Maven Central and VERSION_NAME must stay on the upstream base, so a consumer never compiles
+# the fork's ReactAndroid sources. Consumed by
+# packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle.
+#
+# Runners: the org has an IP allow list and GitHub-hosted runners are not on it, so every
+# authenticated api.github.com write from a hosted runner fails with HTTP 403.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Fork version the artifacts are for, e.g. 0.87.1-scatterlab.3'
+        required: true
+        type: string
+      verify_symbol:
+        description: 'Identifier this version introduces, asserted to exist in the built AAR (e.g. visibleTextEnd). Leave empty for releases that add no new symbol.'
+        required: false
+        default: ''
+        type: string
+      dry_run:
+        description: 'Build and verify only, do not create a release'
+        required: true
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    runs-on: arc-messenger-dev
+    permissions:
+      contents: write
+    outputs:
+      base: ${{ steps.v.outputs.base }}
+      tag: ${{ steps.v.outputs.tag }}
+      asset: ${{ steps.v.outputs.asset }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve and validate versions
+        id: v
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-scatterlab\.[0-9]+$ ]]; then
+            echo "::error::version must look like 0.87.1-scatterlab.3"
+            exit 1
+          fi
+          BASE="${VERSION%-scatterlab.*}"
+          echo "base=$BASE" >> "$GITHUB_OUTPUT"
+          echo "tag=prebuilt-android-$VERSION" >> "$GITHUB_OUTPUT"
+          echo "asset=react-native-android-maven-$VERSION.tar.gz" >> "$GITHUB_OUTPUT"
+
+          # The AAR coordinate carries the base, not the fork version, so this is the only
+          # place the two are checked against each other.
+          GRADLE_VERSION=$(sed -n 's/^VERSION_NAME=//p' packages/react-native/ReactAndroid/gradle.properties)
+          if [ "$GRADLE_VERSION" != "$BASE" ]; then
+            echo "::error::ReactAndroid/gradle.properties VERSION_NAME is '$GRADLE_VERSION', expected the upstream base '$BASE'."
+            exit 1
+          fi
+
+          COMMITTED=$(node -p "require('./packages/react-native/package.json').version")
+          if [ "$COMMITTED" != "$VERSION" ]; then
+            echo "::warning::packages/react-native/package.json is at $COMMITTED but these artifacts are for $VERSION. They must match the version consumers install, or the URL the consumer script builds will not resolve."
+          fi
+
+  build:
+    needs: prepare
+    runs-on: arc-messenger-dev
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup git safe folders
+        run: git config --global --add safe.directory '*'
+
+      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/yarn-install
+
+      # Without a warm ccache every run is a full C++ rebuild of ReactCommon.
+      - name: Restore the Android ccache
+        uses: actions/cache/restore@v4
+        with:
+          path: ~/.cache/ccache
+          key: scatterlab-ccache-android-${{ hashFiles('packages/react-native/ReactAndroid/**/*.cpp', 'packages/react-native/ReactAndroid/**/*.h', 'packages/react-native/ReactCommon/**/*.cpp', 'packages/react-native/ReactAndroid/**/CMakeLists.txt', 'packages/react-native/ReactCommon/**/CMakeLists.txt') }}
+          restore-keys: scatterlab-ccache-android-
+
+      # The upstream .github/actions/build-android composite is deliberately NOT reused: it
+      # runs scripts/releases/set-rn-artifacts-version.js, which rewrites VERSION_NAME and
+      # breaks the coordinate the consumer resolves.
+      - name: Build and publish the Android artifacts to /tmp/maven-local
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/maven-local
+          # useHermesStable keeps Hermes off this build: com.facebook.hermes is a different
+          # publishing group, so it still resolves from Maven Central on the consumer side.
+          # isSnapshot stays off - it would append -SNAPSHOT to the coordinate.
+          env ORG_GRADLE_PROJECT_react.internal.useHermesStable=true \
+            ./gradlew publishAllToMavenTempLocal -PenableWarningsAsErrors=true
+
+      - name: Assert the Maven tree is complete
+        env:
+          BASE: ${{ needs.prepare.outputs.base }}
+        run: |
+          set -euo pipefail
+          DIR="/tmp/maven-local/com/facebook/react/react-android/$BASE"
+          for f in "react-android-$BASE-debug.aar" "react-android-$BASE-release.aar" \
+                   "react-android-$BASE.module" "react-android-$BASE.pom"; do
+            [ -f "$DIR/$f" ] || { echo "::error::$DIR/$f is missing"; exit 1; }
+          done
+
+      - name: Assert the patch is in the built AAR
+        if: ${{ inputs.verify_symbol != '' }}
+        env:
+          BASE: ${{ needs.prepare.outputs.base }}
+          SYMBOL: ${{ inputs.verify_symbol }}
+        run: |
+          set -euo pipefail
+          # Every fork version publishes the same coordinate, so "the artifact exists" proves
+          # nothing about which sources went into it. This is the only check that does.
+          WORK=$(mktemp -d)
+          unzip -q "/tmp/maven-local/com/facebook/react/react-android/$BASE/react-android-$BASE-release.aar" \
+            classes.jar -d "$WORK"
+          mkdir -p "$WORK/classes" && unzip -q "$WORK/classes.jar" -d "$WORK/classes"
+          COUNT=$(find "$WORK/classes" -name '*.class' -exec javap -p {} + 2>/dev/null | grep -c "$SYMBOL" || true)
+          echo "'$SYMBOL' occurrences in the release AAR: $COUNT"
+          [ "$COUNT" -gt 0 ] || { echo "::error::'$SYMBOL' is not in the built AAR - the sources that went in are not the ones you think"; exit 1; }
+          rm -rf "$WORK"
+
+      - name: Pack the Maven repository
+        id: pack
+        env:
+          ASSET: ${{ needs.prepare.outputs.asset }}
+        run: |
+          set -euo pipefail
+          OUT="$RUNNER_TEMP/assets"
+          mkdir -p "$OUT"
+          # The archive root IS the repository root, so the consumer extracts straight into
+          # its cache directory with no strip-components guesswork.
+          tar -C /tmp/maven-local -czf "$OUT/$ASSET" .
+          ( cd "$OUT" && sha256sum "$ASSET" | awk '{print $1}' > "$ASSET.sha256" )
+          ls -lh "$OUT"
+          echo "dir=$OUT" >> "$GITHUB_OUTPUT"
+
+      - name: Upload the assets as artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: prebuilt-android-${{ inputs.version }}
+          path: ${{ steps.pack.outputs.dir }}
+          if-no-files-found: error
+
+      - name: Create the release and upload the assets
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          VERSION: ${{ inputs.version }}
+          DIR: ${{ steps.pack.outputs.dir }}
+        run: |
+          set -euo pipefail
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" \
+              --target "$GITHUB_SHA" \
+              --title "Android prebuilt for $VERSION" \
+              --notes "com.facebook.react Maven artifacts built from this fork for @scatterlab/react-native@$VERSION. Consumed by scripts/android/scatterlab-prebuilt-maven.gradle." \
+              --prerelease
+          fi
+          # No --clobber: a consumer with a warm cache cannot detect a replaced asset and
+          # would keep the old AAR forever. Publish a new -scatterlab.N instead.
+          gh release upload "$TAG" "$DIR"/*
+
+      - name: Save the Android ccache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: ~/.cache/ccache
+          key: scatterlab-ccache-android-${{ hashFiles('packages/react-native/ReactAndroid/**/*.cpp', 'packages/react-native/ReactAndroid/**/*.h', 'packages/react-native/ReactCommon/**/*.cpp', 'packages/react-native/ReactAndroid/**/CMakeLists.txt', 'packages/react-native/ReactCommon/**/CMakeLists.txt') }}
+
+      # A shared runner: the build products are several GB.
+      - name: Clean the build products
+        if: always()
+        run: rm -rf /tmp/maven-local
+
+  verify:
+    needs: [prepare, build]
+    if: ${{ !inputs.dry_run }}
+    runs-on: arc-messenger-dev
+    steps:
+      - name: Assert the release is consumable
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          ASSET: ${{ needs.prepare.outputs.asset }}
+          BASE: ${{ needs.prepare.outputs.base }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          # GitHub rewrites asset names containing unexpected characters, so compare exactly
+          # rather than trusting the upload.
+          gh api "repos/$REPO/releases/tags/$TAG" --jq '.assets[].name' | sort > /tmp/actual
+          printf '%s\n%s\n' "$ASSET" "$ASSET.sha256" | sort > /tmp/expected
+          diff /tmp/expected /tmp/actual
+
+          URL="https://github.com/$REPO/releases/download/$TAG/$ASSET"
+          curl -sL -o /tmp/asset.tar.gz "$URL"
+          EXPECTED=$(curl -sL "$URL.sha256" | tr -d '[:space:]')
+          ACTUAL=$(sha256sum /tmp/asset.tar.gz | awk '{print $1}')
+          [ "$EXPECTED" = "$ACTUAL" ] || { echo "::error::sha256 mismatch: $EXPECTED vs $ACTUAL"; exit 1; }
+
+          for f in "react-android-$BASE-debug.aar" "react-android-$BASE-release.aar" \
+                   "react-android-$BASE.module" "react-android-$BASE.pom"; do
+            tar tzf /tmp/asset.tar.gz "./com/facebook/react/react-android/$BASE/$f" >/dev/null \
+              || { echo "::error::$f is missing from the archive"; exit 1; }
+          done
+          echo "release $TAG is consumable"
+```
+
+- [x] **Step 2: 워크플로 문법을 검사한다**
+
+```bash
+cd ~/GitHub/react-native/.claude/worktrees/daewoon+android-prebuilt
+python3 -c "import sys,yaml;yaml.safe_load(open('.github/workflows/scatterlab-prebuild-android.yml'));print('yaml ok')"
+command -v actionlint >/dev/null && actionlint .github/workflows/scatterlab-prebuild-android.yml || echo "actionlint 없음 — brew install actionlint 후 재실행 권장"
+```
+
+기대: `yaml ok`, actionlint 있으면 무경고.
+
+`runner` 컨텍스트를 잡 레벨 `env:`에 쓰면 워크플로 파싱이 HTTP 422로 실패하고 증상이 "워크플로가 없다"처럼 보인다. 이 파일은 `RUNNER_TEMP`를 스텝 안에서만 쓴다 — 옮기지 않는다.
+
+- [x] **Step 3: `CLAUDE.md`의 배포 절차에 Android를 넣는다**
+
+`## iOS prebuilt` 섹션 바로 앞에 새 섹션을 넣는다:
+
+```markdown
+## Android prebuilt
+
+Android는 `com.facebook.react:react-android:<VERSION_NAME>`을 Maven Central에서 force resolve 하므로 **fork의 `ReactAndroid/**` 수정은 npm으로 안 간다**. 패치된 AAR을 따로 낸다.
+
+```bash
+gh workflow run scatterlab-prebuild-android.yml --repo scatterlab/react-native --ref scatterlab/0.87.1 \
+  -f version=0.87.1-scatterlab.N -f verify_symbol=<이번에 추가한 식별자> -f dry_run=false
+```
+
+**순서 제약**: prebuilt 릴리스가 npm보다 먼저 있어야 한다. 없으면 소비자 Gradle configure가 abort한다. 설계·함정은 [`.github/scatterlab/android-prebuilt.md`](.github/scatterlab/android-prebuilt.md).
+
+`verify_symbol`이 load-bearing이다. 모든 fork 버전의 AAR 좌표가 동일해서, 이 검사 없이는 "아티팩트가 있다"가 "패치가 들어 있다"를 전혀 보증하지 않는다.
+```
+
+같은 편집에서 `## 배포` 섹션과 `## iOS prebuilt` 섹션의 `0.86.2` 문자열을 현재 라인인 `0.87.1`로 고친다 (작업 브랜치 · 예시 버전). 이 파일이 실행자에게 잘못된 브랜치를 지시하고 있다.
+
+- [x] **Step 4: 커밋**
+
+```bash
+git add .github/workflows/scatterlab-prebuild-android.yml CLAUDE.md
+git commit -m "$(cat <<'MSG'
+ci(scatterlab): Android prebuilt 빌드·릴리스 워크플로
+
+`publishAllToMavenTempLocal` 산출물을 통째로 tar 해서
+`prebuilt-android-<version>` 릴리스에 올린다. 상류
+`.github/actions/build-android` 는 `set-rn-artifacts-version.js` 로
+`VERSION_NAME` 을 재작성하므로 재사용하지 않고 필요한 스텝만 직접 쓴다.
+
+`verify_symbol` 입력으로 빌드된 AAR 안에 이번 수정의 심볼이 있는지 센다.
+모든 fork 버전의 AAR 좌표가 같아서, 이 검사 없이는 아티팩트 존재가 패치
+포함을 전혀 보증하지 않는다.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+MSG
+)"
+```
+
+---
+
+### Task 4: fork PR 올리기
+
+**Files:** 없음 (git 조작만)
+
+**Interfaces:**
+- Consumes: Task 1~3의 커밋
+- Produces: 머지된 `scatterlab/0.87.1` — Task 6이 이 브랜치에서 워크플로를 돌린다
+
+- [ ] **Step 1: 전체 테스트를 다시 돌린다**
+
+```bash
+cd ~/GitHub/react-native/.claude/worktrees/daewoon+android-prebuilt
+./gradlew :packages:react-native:ReactAndroid:testDebugUnitTest \
+  --tests "com.facebook.react.views.text.TextDecorationStyleTest"
+.github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
+cd packages/react-native && npm pack --silent && cd - && \
+  .github/scatterlab/verify-tarball.sh packages/react-native/*.tgz 0.87.1 && rm -f packages/react-native/*.tgz
+```
+
+기대: 셋 다 통과. 하나라도 실패하면 PR을 열지 않는다.
+
+- [ ] **Step 2: push 하고 PR을 연다**
+
+```bash
+git push origin daewoon/android-prebuilt
+gh pr create --repo scatterlab/react-native \
+  --base scatterlab/0.87.1 --head daewoon/android-prebuilt \
+  --title "feat(scatterlab): Android prebuilt 배포 파이프라인 + text decoration 크래시 수정" \
+  --body-file -
+```
+
+본문은 `.github/pull_request_template.md`가 있으면 먼저 읽고 그 섹션 제목·인용문·체크리스트를 원본 그대로 유지한 채 내용만 채운다. 없으면 자유 형식으로 쓰되 아래를 담는다:
+
+- 왜 필요한가: RNGP의 force resolve 때문에 fork의 Android 수정이 소비자에게 안 간다 (`DependencyUtils.kt:132`)
+- 무엇이 들어왔나: 워크플로 · 소비자 스크립트 · 첫 화물(#58366 체리픽)
+- 함정: 좌표가 fork 버전 간 동일하므로 캐시를 버전으로 스코프하고 `verify_symbol`로 실물 확인
+- 출고 순서: prebuilt 릴리스 → npm publish → 소비자 핀
+- `git diff scatterlab/0.87.1...HEAD` 기준으로 쓴다
+
+```
+🤖 Generated with [Claude Code](https://claude.com/claude-code)
+```
+
+---
+
+### Task 5: (Task 6 Step 5로 병합됨)
+
+zeta-frontend 배선(apply 한 줄 추가)은 별도 Task로 먼저 처리하지 않는다. `apply(from = ...)`이 가리키는 `scripts/android/scatterlab-prebuilt-maven.gradle`은 fork npm 패키지 안의 파일이고, **`0.87.1-scatterlab.4`부터 처음** 그 패키지에 실린다. zeta-frontend는 지금 `0.87.1-scatterlab.2`에 핀돼 있어 그 버전에는 이 파일이 없다 — 배선 줄만 먼저 커밋하면 그 순간부터 zeta의 모든 Gradle 평가가 `apply(from = ...)`에서 (우리 스크립트의 안내 메시지 있는 abort가 아니라) 평범한 "file not found"로 즉시 죽는다. 그래서 배선 줄과 핀 갱신은 반드시 한 커밋으로, `0.87.1-scatterlab.4`가 npm에 실제로 publish된 뒤에만 넣는다 — Task 6 Step 5를 본다.
+
+---
+
+### Task 6: 출고
+
+코드가 아니라 절차다. Task 4의 PR이 머지된 뒤에 한다.
+
+브랜치 base가 `0.87.1-scatterlab.3`이므로 이 변경이 나갈 다음 fork 버전은 **`0.87.1-scatterlab.4`**다. 아래 명령의 버전은 전부 그 값이다.
+
+- [ ] **Step 1: dry-run 으로 빌드가 도는지 본다**
+
+```bash
+gh workflow run scatterlab-prebuild-android.yml --repo scatterlab/react-native \
+  --ref scatterlab/0.87.1 \
+  -f version=0.87.1-scatterlab.4 -f verify_symbol=visibleTextEnd -f dry_run=true
+gh run watch --repo scatterlab/react-native
+```
+
+기대: `Assert the patch is in the built AAR` 스텝이 `'visibleTextEnd' occurrences in the release AAR: <1 이상>` 을 찍고 통과. 0이면 빌드에 들어간 소스가 우리가 생각하는 그것이 아니다 — 멈추고 원인을 찾는다.
+
+- [ ] **Step 2: 버전을 올린다**
+
+`packages/react-native/package.json` 의 `version` 만 `0.87.1-scatterlab.4` 으로 바꾼다. `ReactAndroid/gradle.properties` 의 `VERSION_NAME`, sibling 핀, `ReactNativeVersion.*` 은 건드리지 않는다. 커밋 후 PR로 `scatterlab/0.87.1` 에 머지한다 (직접 push 금지).
+
+기대: `git show scatterlab/0.87.1:packages/react-native/package.json | grep '"version"'` 이 `0.87.1-scatterlab.4` 를 보여준다. Step 3 의 `scatterlab-prebuild-android.yml` 은 `--ref scatterlab/0.87.1` 체크아웃의 이 값과 `-f version=` 이 다르면 `prepare` 에서 하드 실패한다.
+
+- [ ] **Step 3: prebuilt 릴리스 두 개를 만든다 (npm 보다 먼저)**
+
+```bash
+gh workflow run scatterlab-prebuild-ios.yml --repo scatterlab/react-native \
+  --ref scatterlab/0.87.1 -f version=0.87.1-scatterlab.4
+gh workflow run scatterlab-prebuild-android.yml --repo scatterlab/react-native \
+  --ref scatterlab/0.87.1 \
+  -f version=0.87.1-scatterlab.4 -f verify_symbol=visibleTextEnd -f dry_run=false
+```
+
+두 `verify` 잡이 모두 통과할 때까지 기다린다. 한쪽만 끝난 부분 릴리스로 다음 단계에 가지 않는다.
+
+- [ ] **Step 4: npm publish**
+
+```bash
+gh workflow run scatterlab-publish.yml --repo scatterlab/react-native --ref scatterlab/0.87.1 \
+  -f version=0.87.1-scatterlab.4 -f dist_tag=latest -f dry_run=false
+```
+
+publish 직후 **약 1분간 install 이 `ETARGET` 으로 실패한다** (packument 와 dist-tags 캐시가 별개). install 이 되는 것을 확인한 뒤 다음으로 간다.
+
+- [ ] **Step 5: zeta-frontend 배선 + 핀을 한 커밋으로 올린다**
+
+`apply(from = ...)`이 가리키는 파일은 `0.87.1-scatterlab.4`부터 fork npm 패키지에 처음 실린다. 배선 줄만 먼저 들어가면 zeta의 모든 Gradle 평가가 "file not found"로 즉시 죽으므로 (Task 5 참조), 배선과 핀 갱신은 Step 4의 publish가 끝난 뒤 **한 커밋**으로 같이 간다. `~/GitHub/zeta-frontend`의 **새 워크트리**에서 한다:
+
+```bash
+cd ~/GitHub/zeta-frontend
+git worktree add .claude/worktrees/daewoon+rn-android-prebuilt -b daewoon/rn-android-prebuilt origin/main
+```
+
+이후 모든 편집은 `~/GitHub/zeta-frontend/.claude/worktrees/daewoon+rn-android-prebuilt/` 절대경로로 한다.
+
+**a) apply 한 줄을 넣는다**
+
+`packages/app/android/settings.gradle.kts` 의 `plugins { id("com.facebook.react.settings") }` 블록 **다음**, `extensions.configure<ReactSettingsExtension>` 앞에 넣는다:
+
+```kotlin
+// fork 가 빌드한 Android 아티팩트를 받아 `react.internal.mavenLocalRepo` 로 넘긴다.
+// 없으면 RNGP 가 Maven Central 의 업스트림 AAR 을 쓰고 fork 의 Android 수정이 조용히 빠진다.
+apply(from = "../../../node_modules/react-native/scripts/android/scatterlab-prebuilt-maven.gradle")
+```
+
+**`pluginManagement` 앞에 두지 않는다.** Gradle 은 `pluginManagement` 가 settings 스크립트의 첫 블록일 것을 요구해서, 앞에 어떤 문장이든 오면 평가 자체가 실패한다.
+
+순서는 문제되지 않는다. 스크립트가 거는 `gradle.beforeProject` 는 settings 평가가 **끝난 뒤** 프로젝트 설정 단계에서 실행되고, RNGP 의 `configureRepositories` 는 그보다 더 뒤인 플러그인 apply 시점에 돈다.
+
+**b) 핀을 전부 갱신한다**
+
+```bash
+cd ~/GitHub/zeta-frontend/.claude/worktrees/daewoon+rn-android-prebuilt
+grep -rn '0.87.1-scatterlab.2' packages/*/package.json
+```
+
+`packages/{app,core,service,ui}/package.json` 의 alias 를 모두 `0.87.1-scatterlab.4` 으로 바꾼다. `packages/core` 는 **peerDependencies 에 alias 없는 정확 버전**으로도 들고 있어 alias 패턴 grep 에서 빠진다 — 함께 고친다. 그다음:
+
+```bash
+yarn install
+grep -c '0.87.1-scatterlab.2' yarn.lock
+```
+
+기대: `0`. 0이 아니면 핀을 빠뜨린 것이고, lockfile 에 두 버전이 남아 패키지가 두 벌 해석된다.
+
+**c) 프로퍼티가 실제로 RNGP에 도달했는지 확인한다**
+
+b)에서 핀을 이미 올렸으므로 이 확인은 지금 바로 통과해야 한다.
+
+```bash
+cd ~/GitHub/zeta-frontend/.claude/worktrees/daewoon+rn-android-prebuilt/packages/app/android
+./gradlew :app:dependencies --configuration prodReleaseRuntimeClasspath 2>&1 | grep -i 'react-android'
+./gradlew :app:dependencies --configuration prodReleaseRuntimeClasspath --info 2>&1 \
+  | grep -i 'scatterlab-react-native' | head
+```
+
+기대: 해석된 `com.facebook.react:react-android` 의 출처 경로에 `scatterlab-react-native/<version>/maven` 이 나온다. Maven Central URL 이 나오면 프로퍼티가 도달하지 않은 것이다 — `apply` 위치가 `pluginManagement` 뒤로 갔거나 `beforeProject` 타이밍 문제다.
+
+**d) 커밋하고 PR을 연다**
+
+```bash
+git add packages/app/android/settings.gradle.kts packages/app/package.json packages/core/package.json \
+  packages/service/package.json packages/ui/package.json yarn.lock
+git commit -m "$(cat <<'MSG'
+build(app): Android 빌드가 fork 의 prebuilt AAR 을 쓰게 하고 핀을 0.87.1-scatterlab.4 로 올린다
+
+RNGP 가 `com.facebook.react:react-android:<VERSION_NAME>` 을 Maven Central
+에서 force resolve 하므로, apply 줄이 없으면 `@scatterlab/react-native` 의
+Android 네이티브 수정이 빌드에 하나도 안 들어간다. 그 파일은 0.87.1-scatterlab.4
+부터 패키지에 실리므로 배선과 핀 갱신을 한 커밋으로 묶는다.
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
+MSG
+)"
+git push origin daewoon/rn-android-prebuilt
+```
+
+PR은 `~/GitHub/zeta-frontend/.github/pull_request_template.md` 를 먼저 Read 해서 섹션 제목(이모지 포함)·인용문·체크리스트를 원본 그대로 유지한 채 내용만 채운다.
+
+- [ ] **Step 6: 실기기로 증상이 사라진 것을 확인한다**
+
+Android release APK 를 빌드해 실기기에 설치하고, **소개글이 4줄 이상이고 4줄째 뒤에 URL 이 있는 크리에이터 프로필**을 연다.
+
+워크트리에는 서명 키스토어가 없다. `packages/app/android/app/build.gradle.kts` 의 `signingConfigs` 블록을 먼저 읽어 어떤 Gradle 프로퍼티를 참조하는지 확인하고, 그 이름들을 `-P<이름>=<값>` 으로 넘겨 메인 체크아웃의 키스토어를 가리킨다:
+
+```bash
+grep -n -A12 'signingConfigs' packages/app/android/app/build.gradle.kts
+```
+
+빌드는 오래 걸리므로 `nohup` 으로 띄우고 로그를 따라간다. Sentry 업로드 스텝이 FAILED 로 끝나도 APK 자체는 나온다 — 그 실패로 멈추지 않는다.
+
+기대: 크래시 없음. 접힌 상태에서 보이는 링크에는 밑줄이 그대로 있고, 잘려 안 보이는 링크의 밑줄은 안 그려진다.
+
+- [ ] **Step 7: Sentry 에서 유입이 멈추는지 본다**
+
+이슈 `ZETA-APP-ZG55` (`https://sentry.luda.ai/organizations/pingpong/issues/340537/`) 의 `dist` 태그 분포를 본다. 새 네이티브 빌드의 `dist` 값에서 신규 이벤트가 0 이어야 한다. 옛 `dist=346` 에서는 계속 들어온다 — 그 빌드는 고쳐지지 않는다.
+
+---
+
+## 남은 것 (이 계획 밖)
+
+- 상류 PR [#58366](https://github.com/react/react-native/pull/58366) 은 우리 것이 아니다. 머지되면 다음 base bump 때 체리픽을 지우고 `allowed-tarball-diff.txt` 에서 `TextDecorationStyle.kt` 줄을 뺀다.
+- 이번 네이티브 출고 전까지 `dist=346` 사용자에게는 크래시가 계속 난다. 코드푸시 우회는 이 계획의 범위가 아니다.
diff --git a/.github/workflows/scatterlab-prebuild-android.yml b/.github/workflows/scatterlab-prebuild-android.yml
new file mode 100644
index 000000000000..8ace0b8e6a4f
--- /dev/null
+++ b/.github/workflows/scatterlab-prebuild-android.yml
@@ -0,0 +1,381 @@
+name: '[scatterlab] Build Android prebuilt'
+
+# Builds com.facebook.react:* from THIS fork's sources and attaches the resulting Maven
+# repository to a `prebuilt-android-<version>` release.
+#
+# Why this exists: RNGP force-resolves com.facebook.react:react-android:<VERSION_NAME> from
+# Maven Central and VERSION_NAME must stay on the upstream base, so a consumer never compiles
+# the fork's ReactAndroid sources. Consumed by
+# packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle.
+#
+# Runners: the org has an IP allow list and GitHub-hosted runners are not on it, so every
+# authenticated api.github.com write from a hosted runner fails with HTTP 403.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Fork version the artifacts are for, e.g. 0.87.1-scatterlab.3'
+        required: true
+        type: string
+      verify_symbol:
+        description: 'Identifier this version introduces, asserted to be absent from the upstream base AAR and present in the one built here (e.g. visibleTextEnd). Required for a real release. Pass the literal (none) - parentheses make it something no identifier can be - only for a release that genuinely adds no new symbol, such as a bare base bump.'
+        required: false
+        default: ''
+        type: string
+      dry_run:
+        description: 'Build and verify only, do not create a release'
+        required: true
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  # Two dispatches for the same version race over a single draft release: the second deletes
+  # the first's draft and uploads its own assets, and the first's `verify` then promotes
+  # artifacts it never built - possibly from a different ref. Queue rather than cancel: a run
+  # killed mid-flight can leave assets uploaded and the draft unpromoted, which is worse than
+  # a run that waits.
+  group: scatterlab-prebuild-android-${{ inputs.version }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    runs-on: arc-messenger-dev
+    permissions:
+      contents: write
+    outputs:
+      base: ${{ steps.v.outputs.base }}
+      tag: ${{ steps.v.outputs.tag }}
+      asset: ${{ steps.v.outputs.asset }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve and validate versions
+        id: v
+        env:
+          VERSION: ${{ inputs.version }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          VERIFY_SYMBOL: ${{ inputs.verify_symbol }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-scatterlab\.[0-9]+$ ]]; then
+            echo "::error::version must look like 0.87.1-scatterlab.3"
+            exit 1
+          fi
+          BASE="${VERSION%-scatterlab.*}"
+
+          # The patch-presence gate in `build` is the only evidence that a release's artifacts
+          # came from the sources its version claims - every fork version publishes the
+          # identical Maven coordinate. Accepting the dispatch form's defaults must therefore
+          # not turn it off: an empty value fails a real release, and opting out has to be
+          # spelled out.
+          if [ "$DRY_RUN" != "true" ] && [ -z "$VERIFY_SYMBOL" ]; then
+            echo "::error::verify_symbol is required for a real release. Pass the identifier this version introduces, or the literal (none) if it genuinely adds no new symbol."
+            exit 1
+          fi
+
+          echo "base=$BASE" >> "$GITHUB_OUTPUT"
+          echo "tag=prebuilt-android-$VERSION" >> "$GITHUB_OUTPUT"
+          echo "asset=react-native-android-maven-$VERSION.tar.gz" >> "$GITHUB_OUTPUT"
+
+          # The AAR coordinate carries the base, not the fork version, so this is the only
+          # place the two are checked against each other.
+          GRADLE_VERSION=$(sed -n 's/^VERSION_NAME=//p' packages/react-native/ReactAndroid/gradle.properties)
+          if [ "$GRADLE_VERSION" != "$BASE" ]; then
+            echo "::error::ReactAndroid/gradle.properties VERSION_NAME is '$GRADLE_VERSION', expected the upstream base '$BASE'."
+            exit 1
+          fi
+
+          # Unlike VERSION_NAME above, this is inputs.dry_run-conditional: iOS warns in both
+          # cases because its tarball is named per version, which is itself a signal that
+          # the artifact matches. Android has no such signal - the coordinate is identical
+          # across all fork versions (see "좌표 충돌" in android-prebuilt.md) - so a real
+          # release build must fail closed here, not just warn.
+          COMMITTED=$(node -p "require('./packages/react-native/package.json').version")
+          if [ "$COMMITTED" != "$VERSION" ]; then
+            if [ "$DRY_RUN" = "true" ]; then
+              echo "::warning::packages/react-native/package.json is at $COMMITTED but these artifacts are for $VERSION. They must match the version consumers install, or the URL the consumer script builds will not resolve."
+            else
+              echo "::error::packages/react-native/package.json is at $COMMITTED but these artifacts are for $VERSION. A real release must be built from the checkout that matches $VERSION, or the consumer downloads this tag and gets the wrong binaries."
+              exit 1
+            fi
+          fi
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      # The only automated coverage of the consumer script's fail-closed behavior (no-op on
+      # upstream, abort on a missing release, warm-cache reuse with no network). This is what
+      # stops an unpatched AAR shipping silently, so it runs on every release build - cheap,
+      # Linux-only, no Android SDK needed.
+      - name: Run the consumer script smoke test
+        run: .github/scatterlab/__tests__/android-prebuilt-consumer-test.sh
+
+  build:
+    needs: prepare
+    runs-on: arc-messenger-dev
+    permissions:
+      contents: write
+    outputs:
+      sha256: ${{ steps.pack.outputs.sha256 }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup git safe folders
+        run: git config --global --add safe.directory '*'
+
+      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/yarn-install
+
+      # Without a warm ccache every run is a full C++ rebuild of ReactCommon.
+      - name: Restore the Android ccache
+        uses: actions/cache/restore@v4
+        with:
+          path: ~/.cache/ccache
+          key: scatterlab-ccache-android-${{ hashFiles('packages/react-native/ReactAndroid/**/*.cpp', 'packages/react-native/ReactAndroid/**/*.h', 'packages/react-native/ReactCommon/**/*.cpp', 'packages/react-native/ReactAndroid/**/CMakeLists.txt', 'packages/react-native/ReactCommon/**/CMakeLists.txt') }}
+          restore-keys: scatterlab-ccache-android-
+
+      # The upstream .github/actions/build-android composite is deliberately NOT reused: it
+      # runs scripts/releases/set-rn-artifacts-version.js, which rewrites VERSION_NAME and
+      # breaks the coordinate the consumer resolves.
+      - name: Build and publish the Android artifacts to /tmp/maven-local
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/maven-local
+          # useHermesStable keeps Hermes off this build: com.facebook.hermes is a different
+          # publishing group, so it still resolves from Maven Central on the consumer side.
+          # isSnapshot stays off - it would append -SNAPSHOT to the coordinate.
+          env ORG_GRADLE_PROJECT_react.internal.useHermesStable=true \
+            ./gradlew publishAllToMavenTempLocal -PenableWarningsAsErrors=true
+
+      - name: Assert the Maven tree is complete
+        env:
+          BASE: ${{ needs.prepare.outputs.base }}
+        run: |
+          set -euo pipefail
+          DIR="/tmp/maven-local/com/facebook/react/react-android/$BASE"
+          for f in "react-android-$BASE-debug.aar" "react-android-$BASE-release.aar" \
+                   "react-android-$BASE.module" "react-android-$BASE.pom"; do
+            [ -f "$DIR/$f" ] || { echo "::error::$DIR/$f is missing"; exit 1; }
+          done
+
+      - name: Assert the patch is in the built AAR and not in the upstream one
+        if: ${{ inputs.verify_symbol != '' && inputs.verify_symbol != '(none)' }}
+        env:
+          BASE: ${{ needs.prepare.outputs.base }}
+          SYMBOL: ${{ inputs.verify_symbol }}
+        run: |
+          set -euo pipefail
+          # Every fork version publishes the same coordinate, so "the artifact exists" proves
+          # nothing about which sources went into it. Neither does "the symbol is in our AAR"
+          # on its own: a typo, or an identifier upstream already has, passes that with no
+          # patch present. What means something is the pair - absent upstream, present here.
+          WORK=$(mktemp -d)
+
+          # Sets COUNT to the number of disassembly lines mentioning $SYMBOL in AAR $1.
+          count_symbol() {
+            local aar=$1 label=$2 dir disasm status
+            dir="$WORK/$label"
+            mkdir -p "$dir/classes"
+            unzip -q "$aar" classes.jar -d "$dir"
+            unzip -q "$dir/classes.jar" -d "$dir/classes"
+
+            # A broken javap (missing JDK, corrupt classes) would otherwise converge to the
+            # same COUNT=0 as "the symbol really isn't there". Check the disassembly itself
+            # ran before trusting a zero count.
+            set +e
+            disasm=$(find "$dir/classes" -name '*.class' -exec javap -p {} + 2>"$dir/javap.err")
+            status=$?
+            set -e
+            if [ "$status" -ne 0 ] || [ -z "$disasm" ]; then
+              echo "::error::javap failed to disassemble the $label AAR's classes (exit $status) - that is a broken toolchain, not evidence '$SYMBOL' is missing"
+              cat "$dir/javap.err" >&2
+              exit 1
+            fi
+            COUNT=$(printf '%s\n' "$disasm" | grep -cF "$SYMBOL" || true)
+          }
+
+          # The baseline. One extra download on the release path, and the only thing that
+          # makes a non-zero count below mean "this fork added it" rather than "it was
+          # always there".
+          # --retry bounds attempt count, not time - an unresponsive Maven Central could
+          # otherwise stall this job indefinitely. --connect-timeout 15 is generous for a TCP
+          # handshake with a working host; --max-time 600 covers the whole curl invocation
+          # (all retries included), enough for this ~160MB release AAR to finish even on a
+          # slow-but-working CI network link (>270KB/s), while still bounding a truly hung
+          # transfer.
+          curl -fsSL --connect-timeout 15 --max-time 600 --retry 3 -o "$WORK/upstream.aar" \
+            "https://repo1.maven.org/maven2/com/facebook/react/react-android/$BASE/react-android-$BASE-release.aar"
+          count_symbol "$WORK/upstream.aar" upstream
+          echo "'$SYMBOL' occurrences in the upstream $BASE release AAR: $COUNT"
+          [ "$COUNT" -eq 0 ] || { echo "::error::'$SYMBOL' is already in the upstream $BASE AAR, so finding it in ours proves nothing about this fork's patch. Pass an identifier this version introduces."; exit 1; }
+
+          count_symbol "/tmp/maven-local/com/facebook/react/react-android/$BASE/react-android-$BASE-release.aar" fork
+          echo "'$SYMBOL' occurrences in the built release AAR: $COUNT"
+          [ "$COUNT" -gt 0 ] || { echo "::error::'$SYMBOL' is not in the built AAR - the sources that went in are not the ones you think"; exit 1; }
+          rm -rf "$WORK"
+
+      - name: Warn if the patch-presence gate was skipped
+        if: ${{ inputs.verify_symbol == '' || inputs.verify_symbol == '(none)' }}
+        run: |
+          echo "::warning::verify_symbol is empty or (none), so this build skips the only check that proves this version's patch is in the built AAR. Every fork version publishes the same Maven coordinate - 'the artifact exists' proves nothing about which sources went in. A real release cannot leave it empty; (none) is for a release that genuinely adds no new symbol."
+
+      - name: Pack the Maven repository
+        id: pack
+        env:
+          ASSET: ${{ needs.prepare.outputs.asset }}
+        run: |
+          set -euo pipefail
+          OUT="$RUNNER_TEMP/assets"
+          mkdir -p "$OUT"
+          # The archive root IS the repository root, so the consumer extracts straight into
+          # its cache directory with no strip-components guesswork.
+          tar -C /tmp/maven-local -czf "$OUT/$ASSET" .
+          ( cd "$OUT" && sha256sum "$ASSET" | awk '{print $1}' > "$ASSET.sha256" )
+          ls -lh "$OUT"
+          echo "dir=$OUT" >> "$GITHUB_OUTPUT"
+          # Carried to `verify` so it can tie the release's asset to the archive this run
+          # actually produced, rather than to whatever happens to be attached to the tag.
+          echo "sha256=$(cat "$OUT/$ASSET.sha256")" >> "$GITHUB_OUTPUT"
+
+      - name: Upload the assets as artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: prebuilt-android-${{ inputs.version }}
+          path: ${{ steps.pack.outputs.dir }}
+          if-no-files-found: error
+
+      - name: Create the release (draft) and upload the assets
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # gh release/api resolve the repository from the local git remote by default;
+          # set this explicitly rather than assume that inference, matching the verify job.
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          VERSION: ${{ inputs.version }}
+          DIR: ${{ steps.pack.outputs.dir }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            # A published release is already visible to consumers - re-running into it
+            # would upload assets nobody re-verifies, and its assets must never be
+            # clobbered (a consumer with a warm cache cannot detect a replaced asset and
+            # would keep the old AAR forever). Cut a new -scatterlab.N instead.
+            IS_DRAFT=$(gh release view "$TAG" --json isDraft -q .isDraft)
+            if [ "$IS_DRAFT" != "true" ]; then
+              echo "::error::release $TAG already exists and is published. Re-running this workflow would upload into a release consumers can already see - cut a new -scatterlab.N instead."
+              exit 1
+            fi
+            # A draft, unlike a published release, has never been consumer-visible - its
+            # asset URLs 404 for anyone without push access - so replacing it is safe. A
+            # re-run lands here when an earlier run uploaded assets and then `verify`
+            # failed. Delete and recreate rather than reusing it in place, so no asset from
+            # that partial earlier run (e.g. only the debug AAR made it up) can survive.
+            gh release delete "$TAG" --yes
+          fi
+          # A draft release never creates a git tag - GitHub only cuts the tag when a
+          # release is published - so most retries reach here with nothing to clean up.
+          # But a tag CAN exist even with no draft (or no release at all) visible above: a
+          # previously published release for this version that was later deleted (deleting
+          # a release does not delete its tag), or a hand-created tag. `gh release create
+          # --target` only takes effect when it has to create the tag - it never moves one
+          # that already exists - so leaving a stale tag here would attach this run's fresh
+          # assets to a release still pointing at old code. Delete the tag only when it
+          # exists; a missing ref is the ordinary case, not a failure.
+          if gh api "repos/$GH_REPO/git/refs/tags/$TAG" >/dev/null 2>&1; then
+            gh api -X DELETE "repos/$GH_REPO/git/refs/tags/$TAG"
+          fi
+          # Draft: invisible to anyone without push access, and its asset URLs 404 for
+          # everyone else. A consumer that races this window gets a 404 and aborts - the
+          # correct fail-closed outcome until the verify job promotes it below.
+          gh release create "$TAG" \
+            --target "$GITHUB_SHA" \
+            --title "Android prebuilt for $VERSION" \
+            --notes "com.facebook.react Maven artifacts built from this fork for @scatterlab/react-native@$VERSION. Consumed by scripts/android/scatterlab-prebuilt-maven.gradle." \
+            --prerelease --draft
+          gh release upload "$TAG" "$DIR"/*
+
+      - name: Save the Android ccache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: ~/.cache/ccache
+          key: scatterlab-ccache-android-${{ hashFiles('packages/react-native/ReactAndroid/**/*.cpp', 'packages/react-native/ReactAndroid/**/*.h', 'packages/react-native/ReactCommon/**/*.cpp', 'packages/react-native/ReactAndroid/**/CMakeLists.txt', 'packages/react-native/ReactCommon/**/CMakeLists.txt') }}
+
+      # A shared runner: the build products are several GB.
+      - name: Clean the build products
+        if: always()
+        run: rm -rf /tmp/maven-local
+
+  verify:
+    needs: [prepare, build]
+    if: ${{ !inputs.dry_run }}
+    runs-on: arc-messenger-dev
+    permissions:
+      contents: write
+    steps:
+      - name: Assert the release is consumable, then publish it
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # This job runs without actions/checkout - it needs no working tree - but
+          # `gh release view/download/edit` resolve the repository from the current
+          # directory's git remote and would abort with "could not determine base
+          # repository". GH_REPO overrides that resolution for commands that otherwise
+          # operate on a local repository (`gh help environment`).
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          ASSET: ${{ needs.prepare.outputs.asset }}
+          BASE: ${{ needs.prepare.outputs.base }}
+          BUILT_SHA256: ${{ needs.build.outputs.sha256 }}
+        run: |
+          set -euo pipefail
+          # The REST "get a release by tag" endpoint (`gh api repos/.../releases/tags/<tag>`)
+          # only resolves published releases - it 404s on a draft. `gh release view` falls
+          # back to a GraphQL lookup that finds drafts by tag too, so use that instead.
+          #
+          # GitHub rewrites asset names containing unexpected characters, so compare exactly
+          # rather than trusting the upload.
+          gh release view "$TAG" --json assets --jq '.assets[].name' | sort > /tmp/actual
+          printf '%s\n%s\n' "$ASSET" "$ASSET.sha256" | sort > /tmp/expected
+          diff /tmp/expected /tmp/actual
+
+          # The checks in this job are otherwise self-consistent - any well-formed archive
+          # passes them - so nothing would tie what gets promoted to what `build` produced.
+          # The release was created with --target "$GITHUB_SHA", so a different value means
+          # a different run's draft is sitting on this tag.
+          TARGET=$(gh release view "$TAG" --json targetCommitish -q .targetCommitish)
+          if [ "$TARGET" != "$GITHUB_SHA" ]; then
+            echo "::error::release $TAG targets $TARGET, not this run's commit $GITHUB_SHA - it was created by a different run"
+            exit 1
+          fi
+
+          # The release is still a draft here, so its public releases/download/ URL 404s
+          # for everyone, us included. `gh release download` goes through the authenticated
+          # API asset endpoint instead, which serves draft assets to GH_TOKEN.
+          DL=$(mktemp -d)
+          gh release download "$TAG" --dir "$DL" -p "$ASSET" -p "$ASSET.sha256"
+          EXPECTED=$(tr -d '[:space:]' < "$DL/$ASSET.sha256")
+          ACTUAL=$(sha256sum "$DL/$ASSET" | awk '{print $1}')
+          [ "$EXPECTED" = "$ACTUAL" ] || { echo "::error::sha256 mismatch: $EXPECTED vs $ACTUAL"; exit 1; }
+          # The sidecar only proves the archive matches its own checksum. This proves it is
+          # the archive this run built.
+          if [ "$ACTUAL" != "$BUILT_SHA256" ]; then
+            echo "::error::the $ASSET on release $TAG has sha256 $ACTUAL, but this run's build job produced $BUILT_SHA256 - the release carries someone else's artifacts"
+            exit 1
+          fi
+
+          for f in "react-android-$BASE-debug.aar" "react-android-$BASE-release.aar" \
+                   "react-android-$BASE.module" "react-android-$BASE.pom"; do
+            tar tzf "$DL/$ASSET" "./com/facebook/react/react-android/$BASE/$f" >/dev/null \
+              || { echo "::error::$f is missing from the archive"; exit 1; }
+          done
+
+          # Only now does the release become visible to consumers.
+          gh release edit "$TAG" --draft=false
+          echo "release $TAG is consumable"
diff --git a/CLAUDE.md b/CLAUDE.md
index e077e05b4f41..8920ade70992 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,6 +1,6 @@
 # CLAUDE.md
 
-`scatterlab/react-native` — `react/react-native`의 fork. 설계 문서는 [`.github/scatterlab/README.md`](.github/scatterlab/README.md), IME 검증 절차는 [`.github/scatterlab/ime-qa.md`](.github/scatterlab/ime-qa.md). 이 파일은 **여기서 작업할 때의 운용 규칙과 함정**만 담는다.
+`scatterlab/react-native` — `react/react-native`의 fork. 설계 문서는 [`.github/scatterlab/README.md`](.github/scatterlab/README.md), Android 아티팩트 배포는 [`.github/scatterlab/android-prebuilt.md`](.github/scatterlab/android-prebuilt.md), IME 검증 절차는 [`.github/scatterlab/ime-qa.md`](.github/scatterlab/ime-qa.md). 이 파일은 **여기서 작업할 때의 운용 규칙과 함정**만 담는다.
 
 ## 이 레포의 목적
 
@@ -10,7 +10,7 @@ zeta가 **자체 수정한 RN을 출고할 수 있는 경로**를 갖기 위한
 - 작업 브랜치: **`scatterlab/0.87.1`** (기본 브랜치, 태그 `v0.87.1`에서 분기)
 - 지난 라인: `scatterlab/0.86.2`, `scatterlab/0.87.0` — 남겨두지만 새 작업은 올리지 않는다
 - 계측 브랜치: `scatterlab/0.86.2-ime-probe` — `SLIME` 로그가 붙은 실험용. 0.86.2 라인에 묶여 있고 **배포 대상 아님**
-- 산출물: npm `@scatterlab/react-native@0.87.1-scatterlab.N` + GitHub Release `prebuilt-ios-<version>`
+- 산출물: npm `@scatterlab/react-native@0.87.1-scatterlab.N` + GitHub Release `prebuilt-ios-<version>` + `prebuilt-android-<version>`(모든 fork 버전에 필수)
 - 소비: npm alias — `"react-native": "npm:@scatterlab/react-native@<version>"`
 
 `main`은 상류 동기화용으로만 둔다. **`main`에 push하지 않는다** — 상류 워크플로가 발화한다.
@@ -23,7 +23,7 @@ zeta가 **자체 수정한 RN을 출고할 수 있는 경로**를 갖기 위한
 | `@react-native/*` sibling 7개 exact 핀 변경 | `@react-native/codegen@<fork버전>`을 npm에서 찾다 install 실패. 8개 패키지를 다 배포해야 함 |
 | `scripts/releases/set-version.js` / `set-rn-artifacts-version.js` 실행 | 전자는 sibling 범위를 전부 재작성, 후자는 `VERSION_NAME`을 재작성. 둘 다 위 두 항을 정확히 깨뜨린다 |
 | `package.json`의 `bin` 변경 | zeta의 codepush 배포가 `node_modules/.bin/react-native` 심링크를 복사한다 |
-| `v*` 태그 생성 | 상류 `publish-npm.yml`의 글롭 `v0.*.*`가 `v0.87.1-무엇이든`도 매치하고, 그 워크플로의 `set_hermes_versions` 잡은 repo 게이트가 없다. 태그는 `prebuilt-ios-` / `sl-` 처럼 `v`로 시작하지 않게 |
+| `v*` 태그 생성 | 상류 `publish-npm.yml`의 글롭 `v0.*.*`가 `v0.87.1-무엇이든`도 매치하고, 그 워크플로의 `set_hermes_versions` 잡은 repo 게이트가 없다. 태그는 `prebuilt-ios-` / `prebuilt-android-` / `sl-` 처럼 `v`로 시작하지 않게 |
 | 버전 접미사에 대시 2개 | `-scatterlab.N` 고정. fork 접미사 제거 정규식이 greedy하다 |
 | 릴리스 에셋 clobber | warm `~/Library/Caches/ReactNative`를 가진 개발자가 낡은 xcframework를 영구히 쓴다. 새 `-scatterlab.N`을 낸다 |
 
@@ -39,7 +39,22 @@ gh workflow run scatterlab-publish.yml --repo scatterlab/react-native --ref scat
 - 인증은 **npm Trusted Publishing (OIDC)** — 토큰 없음. `permissions: id-token: write` + `node-version: 24`(핀 제거 금지, `ubuntu-latest` 기본 npm 10.9.8은 요구치 11.5.1 미달)
 - npm은 **workflow_ref 클레임을 최상위 워크플로 파일명과 대조**하고 패키지당 trusted publisher는 1개다. `npm publish`를 재사용/컴포짓 워크플로로 옮기면 인증이 깨진다
 - **게이트**: tarball이 상류 동일 base 버전과 `allowed-tarball-diff.txt` 밖에서 다르면 실패. 소스를 새로 건드리면 그 파일에 경로를 추가해야 한다
-- publish 직후 **~1분간 install이 `ETARGET`으로 실패**한다(packument와 dist-tags 캐시가 별개). 버전 bump PR은 install 확인 후에
+- publish 직후 **~1분간 install이 `ETARGET`으로 실패**한다(packument와 dist-tags 캐시가 별개). **소비자(zeta) 쪽 핀 bump PR**은 install 확인 후에 — fork 자체의 `version` 필드 bump는 이것과 다른 얘기로, 이 워크플로를 돌리기 **전에** 이미 머지돼 있어야 한다(아래 "Android prebuilt" 참조)
+
+## Android prebuilt
+
+Android는 `com.facebook.react:react-android:<VERSION_NAME>`을 Maven Central에서 force resolve 하므로 **fork의 `ReactAndroid/**` 수정은 npm으로 안 간다**. 패치된 AAR을 따로 낸다.
+
+```bash
+gh workflow run scatterlab-prebuild-android.yml --repo scatterlab/react-native --ref scatterlab/0.87.1 \
+  -f version=0.87.1-scatterlab.N -f verify_symbol=<이번에 추가한 식별자> -f dry_run=false
+```
+
+`--ref`로 체크아웃하는 브랜치의 `packages/react-native/package.json` `version`이 **이미** `-f version=`과 같아야 한다 — 워크플로의 `prepare`가 이 둘을 대조하고, 실제 릴리스(`dry_run=false`)에서 다르면 하드 실패한다. 즉 fork의 버전 bump 커밋은 이 명령을 돌리기 전에 먼저 머지돼 있어야 한다.
+
+**순서 제약**: prebuilt 릴리스가 npm보다 먼저 있어야 한다. 없으면 소비자 Gradle configure가 abort한다. 설계·함정은 [`.github/scatterlab/android-prebuilt.md`](.github/scatterlab/android-prebuilt.md).
+
+`verify_symbol`이 load-bearing이다. 모든 fork 버전의 AAR 좌표가 동일해서, 이 검사 없이는 "아티팩트가 있다"가 "패치가 들어 있다"를 전혀 보증하지 않는다.
 
 ## iOS prebuilt
 
diff --git a/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt b/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt
index 65294940ee5c..95b4ee4e8e5b 100644
--- a/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt
+++ b/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/views/text/TextDecorationStyle.kt
@@ -111,6 +111,26 @@ private fun drawDecorationLine(
   }
 }
 
+/**
+ * The last offset [layout] can resolve a horizontal position for. Truncation (via `numberOfLines`)
+ * can leave the last line shorter than [Layout.getLineEnd] reports, since [layout] keeps the full
+ * untruncated text and only clips how much of it is laid out. When the last line ends in a tail
+ * ellipsis, anything from the ellipsis onward is unresolvable too; a leading/middle ellipsis
+ * doesn't shorten what's resolvable on that line, so it's left to [Layout.getLineEnd].
+ */
+private fun visibleTextEnd(layout: Layout): Int {
+  val lastLine = layout.lineCount - 1
+  val lineStart = layout.getLineStart(lastLine)
+  val lineEnd = layout.getLineEnd(lastLine)
+  val ellipsisStart = layout.getEllipsisStart(lastLine)
+  val ellipsisCount = layout.getEllipsisCount(lastLine)
+  return if (ellipsisCount > 0 && ellipsisStart + ellipsisCount == lineEnd - lineStart) {
+    lineStart + ellipsisStart
+  } else {
+    lineEnd
+  }
+}
+
 /**
  * Shared decoration drawing entry point used by [ReactUnderlineSpan] and [ReactStrikethroughSpan].
  * Computes a density-aware stroke thickness, sets up a dedicated paint (to avoid mutating the
@@ -174,13 +194,19 @@ internal fun drawSpannedDecoration(
         }
   }
 
-  val startLine = layout.getLineForOffset(start)
-  val endLine = layout.getLineForOffset(end)
+  val visibleEnd = visibleTextEnd(layout)
+  val clampedStart = min(start, visibleEnd)
+  val clampedEnd = min(end, visibleEnd)
+
+  val startLine = layout.getLineForOffset(clampedStart)
+  val endLine = layout.getLineForOffset(clampedEnd)
   for (line in startLine..endLine) {
     val baseline = layout.getLineBaseline(line).toFloat()
     val rawX1 =
-        if (line == startLine) layout.getPrimaryHorizontal(start) else layout.getLineLeft(line)
-    val rawX2 = if (line == endLine) layout.getPrimaryHorizontal(end) else layout.getLineRight(line)
+        if (line == startLine) layout.getPrimaryHorizontal(clampedStart)
+        else layout.getLineLeft(line)
+    val rawX2 =
+        if (line == endLine) layout.getPrimaryHorizontal(clampedEnd) else layout.getLineRight(line)
     // Normalize for RTL text where start may be to the right of end.
     val x1 = min(rawX1, rawX2)
     val x2 = max(rawX1, rawX2)
diff --git a/packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt b/packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt
index 10d95f696f1b..3782c620589a 100644
--- a/packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt
+++ b/packages/react-native/ReactAndroid/src/test/java/com/facebook/react/views/text/TextDecorationStyleTest.kt
@@ -7,9 +7,21 @@
 
 package com.facebook.react.views.text
 
+import android.graphics.Canvas
+import android.graphics.Color
+import android.text.StaticLayout
+import android.text.TextPaint
+import android.text.TextUtils
 import org.assertj.core.api.Assertions.assertThat
 import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.kotlin.any
+import org.mockito.kotlin.eq
+import org.mockito.kotlin.mock
+import org.mockito.kotlin.verify
+import org.robolectric.RobolectricTestRunner
 
+@RunWith(RobolectricTestRunner::class)
 class TextDecorationStyleTest {
   @Test
   fun fromStringSolid() {
@@ -50,4 +62,124 @@ class TextDecorationStyleTest {
   fun fromStringEmptyDefaultsToSolid() {
     assertThat(TextDecorationStyle.fromString("")).isEqualTo(TextDecorationStyle.SOLID)
   }
+
+  @Test
+  fun drawSpannedDecorationClampsSpanPastTailEllipsis() {
+    val layout = buildTailEllipsizedLayout()
+    val visibleEnd = layout.getLineStart(0) + layout.getEllipsisStart(0)
+    val baseline = layout.getLineBaseline(0).toFloat()
+    val x1 = layout.getPrimaryHorizontal(0)
+    val x2 = layout.getPrimaryHorizontal(visibleEnd)
+    val canvas = mock<Canvas>()
+
+    // The span covers the whole string, well past what survived the ellipsis; pre-fix this
+    // called layout.getPrimaryHorizontal(TAIL_TEXT.length) and crashed with
+    // IndexOutOfBoundsException, since the ellipsized layout only resolves up to visibleEnd.
+    drawSpannedDecoration(
+        0,
+        TAIL_TEXT.length,
+        canvas,
+        layout,
+        Color.BLACK,
+        TextDecorationStyle.SOLID,
+    ) { _, lineBaseline, thickness ->
+      lineBaseline + thickness + 1f
+    }
+
+    verify(canvas).drawLine(eq(x1), eq(baseline + 1f), eq(x2), eq(baseline + 1f), any())
+  }
+
+  @Test
+  fun drawSpannedDecorationSkipsSpanEntirelyPastTailEllipsis() {
+    val layout = buildTailEllipsizedLayout()
+    val visibleEnd = layout.getLineStart(0) + layout.getEllipsisStart(0)
+    val baseline = layout.getLineBaseline(0).toFloat()
+    val x = layout.getPrimaryHorizontal(visibleEnd)
+    val canvas = mock<Canvas>()
+
+    // The whole span (e.g. a nested Text) starts after the ellipsis, fully hidden: it must
+    // collapse to a zero-length line at the visible boundary, not draw anything past it.
+    drawSpannedDecoration(
+        visibleEnd,
+        TAIL_TEXT.length,
+        canvas,
+        layout,
+        Color.BLACK,
+        TextDecorationStyle.SOLID,
+    ) { _, lineBaseline, thickness ->
+      lineBaseline + thickness + 1f
+    }
+
+    verify(canvas).drawLine(eq(x), eq(baseline + 1f), eq(x), eq(baseline + 1f), any())
+  }
+
+  @Test
+  fun drawSpannedDecorationDoesNotClampWhenMaxLinesTruncatesWithoutEllipsis() {
+    val layout = buildClippedLayout()
+    val baseline = layout.getLineBaseline(0).toFloat()
+    val x1 = layout.getPrimaryHorizontal(0)
+    val x2 = layout.getPrimaryHorizontal(CLIP_TEXT.length)
+    val canvas = mock<Canvas>()
+
+    // ellipsizeMode="clip" (no TruncateAt at all) exercises visibleTextEnd's non-ellipsis
+    // branch, which falls back to Layout.getLineEnd(). Unlike the tail-ellipsis cases above,
+    // Android's StaticLayout only shortens getLineEnd() in response to maxLines when an
+    // ellipsis is set (see TextLayoutManager.calculateHeight's "StaticLayout only seems to
+    // change its height in response to maxLines when ellipsizing" comment) - setMaxLines(1)
+    // alone still resolves the whole string on the one line it caps the layout to. So this
+    // branch is always a no-op clamp in practice: this pins that the span keeps drawing to the
+    // real end of the text instead of being incorrectly cut short.
+    drawSpannedDecoration(
+        0,
+        CLIP_TEXT.length,
+        canvas,
+        layout,
+        Color.BLACK,
+        TextDecorationStyle.SOLID,
+    ) { _, lineBaseline, thickness ->
+      lineBaseline + thickness + 1f
+    }
+
+    verify(canvas).drawLine(eq(x1), eq(baseline + 1f), eq(x2), eq(baseline + 1f), any())
+  }
+
+  /**
+   * A single line, tail-ellipsized right after "Hello" because the paragraph break in
+   * [TAIL_TEXT] hides everything after it once `maxLines` is reached.
+   */
+  private fun buildTailEllipsizedLayout(): StaticLayout {
+    val paint = TextPaint().apply { textSize = 32f }
+    val layout =
+        StaticLayout.Builder.obtain(TAIL_TEXT, 0, TAIL_TEXT.length, paint, 400)
+            .setMaxLines(1)
+            .setEllipsize(TextUtils.TruncateAt.END)
+            .build()
+    assertThat(layout.lineCount).isEqualTo(1)
+    assertThat(layout.getEllipsisCount(0)).isGreaterThan(0)
+    return layout
+  }
+
+  /**
+   * A single line capped by `maxLines` with no ellipsis at all. [CLIP_TEXT] is soft-wrapped
+   * (no hard line break) at a width that would need multiple lines, so unlike
+   * [buildTailEllipsizedLayout]'s hard-broken [TAIL_TEXT], `maxLines` here actually keeps
+   * `lineCount` at 1 - but `getLineEnd(0)` still equals the full string, not a truncated
+   * offset, since only ellipsizing shortens it.
+   */
+  private fun buildClippedLayout(): StaticLayout {
+    val paint = TextPaint().apply { textSize = 32f }
+    val layout =
+        StaticLayout.Builder.obtain(CLIP_TEXT, 0, CLIP_TEXT.length, paint, 100)
+            .setMaxLines(1)
+            .build()
+    assertThat(layout.lineCount).isEqualTo(1)
+    assertThat(layout.getEllipsisCount(0)).isEqualTo(0)
+    assertThat(layout.getLineEnd(0)).isEqualTo(CLIP_TEXT.length)
+    return layout
+  }
+
+  private companion object {
+    const val TAIL_TEXT = "Hello\ndecorated world"
+    const val CLIP_TEXT = "one two three four five six seven eight nine ten"
+  }
 }
diff --git a/packages/react-native/package.json b/packages/react-native/package.json
index 870247eeec31..63f2c799ffeb 100644
--- a/packages/react-native/package.json
+++ b/packages/react-native/package.json
@@ -101,6 +101,7 @@
     "scripts/bundle.js",
     "scripts/cocoapods",
     "scripts/codegen",
+    "scripts/android",
     "scripts/compose-source-maps.js",
     "scripts/find-node-for-xcode.sh",
     "scripts/generate-codegen-artifacts.js",
diff --git a/packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle b/packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle
new file mode 100644
index 000000000000..6f5f94201d7d
--- /dev/null
+++ b/packages/react-native/scripts/android/scatterlab-prebuilt-maven.gradle
@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+// Points the consumer's build at this fork's Android artifacts.
+//
+// RNGP force-resolves com.facebook.react:react-android:<VERSION_NAME> from Maven Central,
+// and VERSION_NAME has to stay on the upstream base, so the fork's ReactAndroid sources are
+// never compiled by a consumer. This fetches the AAR this fork built and hands its path to
+// RNGP via react.internal.mavenLocalRepo, which also makes RNGP exclude the whole
+// com.facebook.react group from Maven Central. See .github/scatterlab/android-prebuilt.md.
+//
+// Apply from the consumer's settings.gradle(.kts):
+//   apply(from = "<...>/node_modules/react-native/scripts/android/scatterlab-prebuilt-maven.gradle")
+
+import java.security.MessageDigest
+
+def packageJson = new File(buildscript.sourceFile.parentFile, '../../package.json').canonicalFile
+def pkg = new groovy.json.JsonSlurper().parse(packageJson)
+
+// Decide by package identity, not by the shape of a version string: an upstream
+// react-native install has nothing of ours to fetch, so stay out of the way entirely.
+if (pkg.name != '@scatterlab/react-native') {
+  return
+}
+
+def version = pkg.version
+if (!(version ==~ /^\d+\.\d+\.\d+-scatterlab\.\d+$/)) {
+  // Our package, but a version this script cannot map to a release. Returning here would
+  // hand the build back to Maven Central and ship the unpatched upstream AAR in silence.
+  throw new GradleException(
+      "[scatterlab] ${packageJson} is @scatterlab/react-native at version '${version}', which\n" +
+      "  does not name a prebuilt Android release (expected e.g. 0.87.1-scatterlab.3).\n" +
+      "  Continuing would resolve the unpatched upstream AAR from Maven Central instead.")
+}
+
+def base = version.replaceFirst(/-scatterlab\.\d+$/, '')
+def tag = "prebuilt-android-${version}"
+def asset = "react-native-android-maven-${version}.tar.gz"
+
+// SCATTERLAB_PREBUILT_BASE_URL redirects the download at the local fixture server of
+// android-prebuilt-consumer-test.sh. It is honoured only for a loopback origin: the .sha256
+// sidecar is fetched from the same base, so any other origin would supply both the archive
+// and the checksum it is verified against, and the integrity gate would prove nothing.
+// Binding loopback on the build machine already means owning that build.
+def overrideBaseUrl = System.getenv('SCATTERLAB_PREBUILT_BASE_URL')
+def overrideHost = null
+if (overrideBaseUrl) {
+  try {
+    overrideHost = new java.net.URI(overrideBaseUrl).host
+  } catch (java.net.URISyntaxException ignored) {
+    overrideHost = null
+  }
+}
+def loopbackOverride = overrideHost in ['127.0.0.1', '[::1]', 'localhost']
+def baseUrl = loopbackOverride
+    ? overrideBaseUrl
+    : 'https://github.com/scatterlab/react-native/releases/download'
+def assetUrl = "${baseUrl}/${tag}/${asset}"
+
+// Scoped by fork version on purpose. VERSION_NAME is pinned to the base, so every fork
+// version publishes the SAME coordinate - sharing one repo root would let Gradle keep
+// serving the previous version's AAR with no error at all.
+def repoDir = new File(gradle.gradleUserHomeDir, "scatterlab-react-native/${version}/maven")
+
+def fail = { String why ->
+  throw new GradleException(
+      "[scatterlab] ${why}\n" +
+      "  This version of @scatterlab/react-native carries Android native changes that only\n" +
+      "  exist in this fork's prebuilt artifacts. Run the '[scatterlab] Build Android prebuilt'\n" +
+      "  workflow for ${version}, then build again.\n" +
+      "  Expected: ${assetUrl}")
+}
+
+if (overrideBaseUrl && !loopbackOverride) {
+  fail("SCATTERLAB_PREBUILT_BASE_URL is set to '${overrideBaseUrl}', whose host is not a" +
+       " loopback address (127.0.0.1, [::1], localhost). It exists only to point the smoke" +
+       " test at a local fixture server; from any other origin the archive and the .sha256" +
+       " it is checked against would come from the same place, so refusing rather than" +
+       " falling back to the real release.")
+}
+
+def download = { String url, File target ->
+  def connection = new URL(url).openConnection()
+  connection.instanceFollowRedirects = true
+  connection.connectTimeout = 30_000
+  connection.readTimeout = 300_000
+  try {
+    def code = connection.responseCode
+    if (code != 200) {
+      fail("${url} returned HTTP ${code}.")
+    }
+    target.withOutputStream { out -> connection.inputStream.withStream { input -> out << input } }
+  } catch (GradleException e) {
+    // fail() already threw the right message (e.g. a non-200 status, or a sha256
+    // mismatch further down) - do not relabel it as a network error.
+    throw e
+  } catch (Exception e) {
+    // Anything before a status even exists - DNS failure, connect timeout, TLS error -
+    // must still go through fail() so the consumer gets the same guidance instead of a
+    // raw stack trace.
+    fail("${url} failed: ${e.class.simpleName}: ${e.message}")
+  }
+}
+
+def sha256 = { File file ->
+  def digest = MessageDigest.getInstance('SHA-256')
+  file.eachByte(1024 * 1024) { buffer, length -> digest.update(buffer, 0, length) }
+  digest.digest().encodeHex().toString()
+}
+
+// "The directory exists" is not "the cache is good": an interrupted extract or a partial
+// cleanup leaves a tree Gradle cannot resolve from, and the property would point at it.
+// The .pom is the cheapest artifact that only exists once the archive really landed.
+def cachedPom = new File(repoDir, "com/facebook/react/react-android/${base}/react-android-${base}.pom")
+
+if (!cachedPom.isFile()) {
+  // Staged/locked next to the final location, not inside it: both the lock file and the
+  // staging dir have to survive repoDir itself being deleted and recreated below, and the
+  // staging move has to be a rename on the same filesystem.
+  repoDir.parentFile.mkdirs()
+
+  // Two Gradle processes resolving the same fork version at once (ordinary on a CI runner
+  // with parallel jobs, or a developer running two builds) can both reach this branch
+  // together. Without serializing, one process's deleteDir() can pull repoDir out from under
+  // another that is still installing or reading it. A lock file beside repoDir - not inside
+  // it, since repoDir is what gets deleted and recreated - serializes the whole
+  // check-delete-download-extract-rename sequence per fork version. lock() blocks rather
+  // than failing: the process already holding it is doing the work this one was about to do.
+  def lockFile = new File(repoDir.parentFile, 'maven.lock')
+  def lockRaf = new java.io.RandomAccessFile(lockFile, 'rw')
+  try {
+    def lock = lockRaf.channel.lock()
+    try {
+      // Re-check now that the lock is held: the previous holder may have just finished
+      // installing the cache, which makes the check above stale. Skipping this would only
+      // narrow the race, not close it.
+      if (!cachedPom.isFile()) {
+        // A cache that fails the check above is corrupt, not fatal - drop it and
+        // re-download so it self-heals. The delete also clears the way for the rename
+        // below.
+        repoDir.deleteDir()
+        def staging = java.nio.file.Files
+            .createTempDirectory(repoDir.parentFile.toPath(), 'staging')
+            .toFile()
+        try {
+          def tarball = new File(staging, asset)
+          download(assetUrl, tarball)
+
+          def expectedFile = new File(staging, "${asset}.sha256")
+          download("${assetUrl}.sha256", expectedFile)
+          def expected = expectedFile.text.trim().split(/\s+/)[0]
+          def actual = sha256(tarball)
+          if (expected != actual) {
+            fail("${asset} sha256 mismatch: expected ${expected}, got ${actual}.")
+          }
+
+          def extracted = new File(staging, 'maven')
+          extracted.mkdirs()
+          def proc = ['tar', '-xzf', tarball.absolutePath, '-C', extracted.absolutePath].execute()
+          def stderr = new StringBuffer()
+          proc.waitForProcessOutput(new StringBuffer(), stderr)
+          if (proc.exitValue() != 0) {
+            fail("extracting ${asset} failed: ${stderr}")
+          }
+
+          // Move only once the tree is complete: a half-extracted directory must never be
+          // left behind as a cache hit for the next build.
+          if (!extracted.renameTo(repoDir) && !cachedPom.isFile()) {
+            fail("could not move the extracted repository into ${repoDir}.")
+          }
+        } finally {
+          staging.deleteDir()
+        }
+      }
+    } finally {
+      lock.release()
+    }
+  } finally {
+    lockRaf.close()
+  }
+}
+
+gradle.beforeProject { project ->
+  project.extensions.extraProperties.set('react.internal.mavenLocalRepo', repoDir.absolutePath)
+}