inFakt is SMS-only 2FA, so the wipe cannot strand the account

This was the last blocker on the Device Owner decision. Checked in the
web panel: "Aplikacja weryfikacyjna" is unconfigured, so no TOTP seed
exists for a wipe to destroy, and only "Wrazliwe" actions are gated --
"Logowanie" is unchecked, so plain login needs the password alone. The
registered SMS number lives on the SIM, which survives.

The browser-login approval tap is a Firebase push prompt
(FirebaseInstanceIdReceiver on the device). Push tokens are per-install,
so a reinstall re-registers; and if that ever misbehaved, SMS is still
the fallback.

Corrects the wipe checklist, which assumed TOTP secrets were "likely"
inside the KeePassDX database and treated the .kdbx as a seed backup.
Neither holds: the canonical .kdbx is on the PC, and there are no seeds.
Earlier advice in this session to fetch inFakt backup codes was likewise
for the OTP-app variant this account does not use.

What still does not survive is unchanged and unrelated to 2FA: the
banking pairing ("Usun powiazanie z telefonem") and the local app PIN,
re-paired via SMS like mBank.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JxNrcMDcizNB3XrrYpZF23

docs/device-owner-wipe-checklist.md

@@ -46,9 +46,19 @@ Present and relevant:
 | mObywatel | `pl.nask.mobywatel`           | No — full re-activation                  |
 
 **No dedicated TOTP app is installed**, so the usual "authenticator seeds are
-destroyed by the wipe" trap does not apply — unless your TOTP secrets live
-inside the KeePassDX database, which is likely. If so, the `.kdbx` file _is_
-your seed backup, and step 2 covers it.
+destroyed by the wipe" trap does not apply.
+
+Checked 2026-08-09, and it does not apply via KeePassDX either: the `.kdbx`
+lives in KeePassDX's private storage (not on `/sdcard`, so `phone_backup.sh`
+cannot reach it), but the canonical copy is on the PC. And **inFakt — the one
+account whose loss would have blocked this wipe — is SMS-only 2FA**:
+"Aplikacja weryfikacyjna" is unconfigured, so no seed exists to lose, and
+_Logowanie_ is not among the 2FA-gated actions. See
+`phone_focus_mode/docs/youtube-block-unrooted.md`.
+
+`pl.infakt.infakt` belongs in the table above: the account is server-side and
+survives, but its **banking pairing does not** — re-pair via SMS, same as
+mBank.
 
 ## Phase A — break the circular dependency first
 

docs/superpowers/evidence/infakt-2fa-wipe-safety-2026-08-09.json

@@ -0,0 +1,39 @@
+{
+  "intent": "Settle whether a Device Owner factory reset would lock the user out of inFakt, which was the last blocker on that decision.",
+  "scope": [
+    "phone_focus_mode/docs/youtube-block-unrooted.md",
+    "docs/device-owner-wipe-checklist.md",
+    "Documentation only -- no code, no device state changed"
+  ],
+  "changes": [
+    "Recorded that inFakt 2FA is SMS-only and that no TOTP seed exists, so a wipe cannot destroy one.",
+    "Corrected the wipe checklist, which assumed TOTP secrets were 'likely' inside the KeePassDX database and treated the .kdbx as a seed backup. Neither holds: the user keeps the canonical .kdbx on the PC, and inFakt has no authenticator configured.",
+    "Added pl.infakt.infakt to the set of apps whose banking pairing does not survive the wipe."
+  ],
+  "verification": [
+    {
+      "command": "inFakt web panel, Weryfikacja dwuetapowa (screenshot supplied by the user)",
+      "result": "pass",
+      "evidence": "2FA = Wlaczona with SMS to the registered number. 'Aplikacja weryfikacyjna' shows a 'Skonfiguruj' link, i.e. NOT configured -- no TOTP seed. Under 'Akcje objete weryfikacja dwuetapowa' only 'Wrazliwe' is checked; 'Logowanie' and 'Wystawianie faktur' are unchecked, so plain login needs the password alone."
+    },
+    {
+      "command": "adb shell dumpsys package pl.infakt.infakt | grep -i c2dm/firebase",
+      "result": "pass",
+      "evidence": "FirebaseInstanceIdReceiver registered for com.google.android.c2dm.intent.RECEIVE, so the browser-login approval tap is a push prompt. Push tokens are per-install, so a reinstall re-registers rather than stranding the account."
+    },
+    {
+      "command": "adb shell dumpsys account | grep -i infakt",
+      "result": "pass",
+      "evidence": "No device account entry -- nothing stored locally that a wipe would destroy beyond the pairing and app PIN."
+    }
+  ],
+  "risks": [
+    "The push-reinstall behaviour is inferred from the Firebase receiver plus vendor docs, not from a stated 'reinstalling does not lock you out'. It is safe to act on because the second factor is SMS and the SIM survives -- if push re-registration misbehaved, SMS still works.",
+    "Earlier in this session the user was advised to download inFakt backup codes. That advice applies to the extended OTP-app variant, which this account does not use; with SMS-only 2FA the recovery path is the SIM. Corrected rather than left standing.",
+    "The 2FA settings page warns that saving changes logs out all current mobile sessions, so it should not be edited casually.",
+    "Still unresolved and unchanged: inFakt's banking side is device-paired and holds a live session with funds and an active card. Re-pairing after a wipe goes through SMS."
+  ],
+  "rollback": [
+    "git revert -- documentation only, nothing on the device depends on it."
+  ]
+}

phone_focus_mode/docs/youtube-block-unrooted.md

@@ -8,12 +8,12 @@ No root, no Device Owner, no factory reset.
 Unregisters a package for one user while leaving the APK on the read-only
 system image.
 
-| Mechanism | Survives reboot? |
-| --- | --- |
-| `pm suspend` | No — measured |
-| `pm disable-user` | No — measured |
-| `dpm setApplicationHidden` | Yes — but needs Device Owner, i.e. a wipe |
-| **`pm uninstall --user 0`** | **Yes — measured, twice** |
+| Mechanism                   | Survives reboot?                          |
+| --------------------------- | ----------------------------------------- |
+| `pm suspend`                | No — measured                             |
+| `pm disable-user`           | No — measured                             |
+| `dpm setApplicationHidden`  | Yes — but needs Device Owner, i.e. a wipe |
+| **`pm uninstall --user 0`** | **Yes — measured, twice**                 |
 
 Reversible with `pm install-existing --user 0 <pkg>`: no download, no data
 loss, because the APK never left the device.
@@ -44,9 +44,9 @@ silent no-op.
 
 Independent of the VPN, and that is the point: stopping RethinkDNS does
 **not** restore YouTube in Firefox. Verified by force-stopping
-`com.celzero.bravedns` and loading youtube.com, which produced *"uBlock
+`com.celzero.bravedns` and loading youtube.com, which produced _"uBlock
 Origin has prevented the following page from loading — `||youtube.com^` —
-found in: My filters"*.
+found in: My filters"_.
 
 The filters, in uBlock's dashboard → **My filters**:
 
@@ -100,11 +100,11 @@ account-linked session — most of the pull. It does not stop typing
 
 Previously rejected approaches, from `focus_owner/docs/`:
 
-- **Home-hosted DoT resolver.** Android's Private DNS fails *closed*, so PC
+- **Home-hosted DoT resolver.** Android's Private DNS fails _closed_, so PC
   off = phone has no internet at all. Rejected: the phone must work with the
   PC off.
 - **Hosted DNS (NextDNS, AdGuard, ControlD).** No provider ingests the 185k
-  domain blocklist; free tiers fail *open* past ~300k queries/month.
+  domain blocklist; free tiers fail _open_ past ~300k queries/month.
 
 The remaining candidate is a **local-VPN content blocker** — an on-device
 `VpnService` that filters without any network dependency, so it works with the
@@ -116,11 +116,11 @@ one active VPN at a time, so this would conflict with any real VPN.
 
 Measured, not assumed:
 
-| Layer | Undo cost |
-| --- | --- |
-| App removal | **One tap.** Google Play shows a live **Install** button for YouTube (checked on device 2026-08-09; not installed). |
-| RethinkDNS rules | A few taps — the VPN toggle in Settings or the quick-settings tile. |
-| uBlock filters | **Proceed** on the block page, or disabling the extension. |
+| Layer            | Undo cost                                                                                                           |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------- |
+| App removal      | **One tap.** Google Play shows a live **Install** button for YouTube (checked on device 2026-08-09; not installed). |
+| RethinkDNS rules | A few taps — the VPN toggle in Settings or the quick-settings tile.                                                 |
+| uBlock filters   | **Proceed** on the block page, or disabling the extension.                                                          |
 
 Nothing here is tamper-resistant, and nothing here can be: on an
 unrooted device without Device Owner, no app can prevent the user
@@ -138,6 +138,28 @@ Also note nothing re-asserts the purge automatically.
 `phone-auto-sync.timer` is inactive and its `ExecStart` points at a path
 that does not exist, so `distraction_purge.sh` is manual today.
 
+## infakt, before any factory reset
+
+Checked 2026-08-09 in the web panel and on the device, because infakt was
+the one app whose loss would have blocked the Device Owner wipe.
+
+- **2FA is SMS-only.** "Aplikacja weryfikacyjna" reads _Skonfiguruj_, i.e.
+  not configured, so **no TOTP seed exists** and a wipe cannot destroy
+  one. The registered number survives on the SIM.
+- **"Logowanie" is unchecked** under _Akcje objęte weryfikacją_ — only
+  _Wrażliwe_ actions prompt. Plain login needs the password alone.
+- The app uses Firebase push (`FirebaseInstanceIdReceiver`) for the
+  browser-login approval tap. Push tokens are per-install, so a reinstall
+  re-registers and prompts arrive at the new install.
+
+So login is safe: reinstall, sign in with the password.
+
+What does **not** survive: the banking pairing (_Usuń powiązanie z
+telefonem_) and the local app PIN. Re-pair via SMS after the wipe.
+
+Do not save anything on that settings page casually — it warns that
+changing it logs out all current mobile sessions.
+
 ## Redoing this after a factory reset
 
 The purge is per-user state and does not survive a wipe. Re-run