2 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	01778d4f05	Put focus_owner on the shared palette, and stop curfew hiding todo ... focus_owner had drifted entirely off the frozen palette -- a cool blue #5B9DD9 accent on a #1B1D21 field -- while its own doc comment claimed it matched the other com.kuhy.* apps. It did not: every other app is on the gold #B8862E. lib/theme.dart now aliases design_system-v0.1.0, so the ~80 call sites keep reading the same names but the values come from one place and cannot drift again. The six constants duplicated verbatim in main.dart are deleted -- the old comment said they had been "lifted out" into theme.dart, but the originals were never removed, so there were two copies of a wrong palette. Separately: dev.kuhy.todo was in the day allowlist but not the night one, so a release build installed at 23:07 was hidden by the enforcer ~80ms later. It is now in night_allowed_packages. That is a deliberate loosening of the curfew's "answer the phone, reach a bank, handle an emergency" rule -- writing an idea down at night is the one thing that app does -- and it is recorded as such in both config files. Deploying the shell mirror of that list surfaced two pre-existing latent bugs in phone_focus_mode/config.sh: comment lines inside the double-quoted WHITELIST string referenced the night list (defined ~70 lines below) and an ALWAYS_BLOCKED that is never defined anywhere, so under set -u the entire deploy aborted with "unbound variable". Both are now written plainly, with a note saying why a dollar sign or a double quote must never appear inside that string. Verified on the Pixel 6a: analyze clean, 94/94 tests, colour literals 15 -> 2 (both Colors.transparent sentinels), and an ad-hoc assertion confirming kAccent is really ffb8862e rather than merely compiling. The installed APK shows CURFEW and the action links in gold, "Allowed apps 29 (16 at night)" (was 15) and "restored 1"; todo then launched and rendered at 23:19, inside the curfew window, with all 108 notes intact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XS1m7b1piBtAL22USLW6jL	2026-08-14 23:21:06 +02:00
Krzysztof kuhy Rudnicki	82e206116a	Make the geofence tell the truth, and the phone explain itself ... The enforcer failed in both directions: nothing blocked at home, and everything blocked at the office. The comparison was never inverted -- `metres <= threshold` was always right. Three separate causes: Only ACCESS_COARSE_LOCATION was declared. Android 12+ fuzzes coarse to a ~1-2 km grid against a 150 m fence, so a fix taken at home routinely landed outside it, read as AWAY, and restored every app the geofence exists to hide. FINE is now declared and self-granted by the device owner, along with coarse and background, re-asserted every pass so a reinstall cannot silently drop it. There were three states but two behaviours. LOCATION_UNKNOWN applies the identical sweep to AT_HOME -- correct fail-closed design, indistinguishable from outside. And nothing ever requested a fix: the pass read whatever another app happened to cache, so at the office with no navigation running the cache was empty. Passes now acquire a fix inside a location-typed foreground service, bounded at 20 s, and treat anything older than 30 min as no fix. That window is deliberately longer than the 15-minute cadence; a shorter one marks the newest cache stale on every pass of an idle phone and blocks everything. None of it was diagnosable. `adb logcat -d -s FocusOwner:V` came back empty while dumpsys showed 82 alarms had fired, and `run-as` is refused on the release build device owner requires. So the pass now writes a ring-buffered JSONL record read back in-app: reason, distance vs the fence, fix age/provider/accuracy, curfew state, and every hidden app with the rule that hid it. Coordinates are never recorded -- a distance is enough to debug a geofence, and this is a home address. Also fixed along the way: - Hysteresis keyed off `isEnforcing`, which is true under AWAY too because YouTube stays hidden, so the threshold was permanently radius+hysteresis. It now keys off whether the previous pass was inside the fence. - The scheduler's curfew-boundary alarms were documented but never scheduled; both callers invoked `scheduleNext()` bare, so 05:00 could land 15 min late. - Installing over the app cancelled its pending alarms, so `adb install -r` silently stopped enforcement until someone opened the app. MY_PACKAGE_REPLACED now re-arms it, verified on device without launching the app. - A wrong-typed log record threw instead of being skipped, and the exception escaped far enough to leave the page stuck busy -- which disables the release-device-owner button, the one control that must work when everything else has gone wrong. - `lib/enforcement.dart` was a second decision layer with no always-blocked concept, cited by KDoc as pinned by a `PolicyParityTest` that never existed. It would have made the new screen report YouTube visible while it is hidden. Deleted; the UI renders the Kotlin record rather than re-deciding. - Anchoring home accepted a stale or unknown-precision fix. A wrong home offsets the fence everywhere and forever, which is what produced a 766 m reading while standing at home. Policy: Play Store is allowed by day (not during curfew) so infakt can be installed and updated; the sweep is default-deny for third-party packages, so anything installed from Play is hidden on the next at-home pass. Tachiyomi's per-source extension apks are covered by a new prefix allowlist rather than an exact list that goes stale whenever an extension is installed. `export.py` stopped subtracting the allowlist from `blockable_system_packages`. Sweepable is not hideable: that list decides which system packages are eligible for a decision, and `isAllowed` is what protects them. Removing an allowed system package from the sweep freezes it in its last state -- it would have stranded Play hidden permanently the moment it was allowlisted. Verified on the Pixel 6a: FINE granted POLICY_FIXED, `applied AT_HOME` with a 0 m distance from a +/-11 m GPS fix, YouTube/Chrome/Firefox absent from `pm list packages -e`, Play Store, infakt, RunnerUp and all five Tachiyomi packages present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HjxL9kdAzZmGqQA5tMNrZ8	2026-08-14 13:43:05 +02:00