justinzeus/wolfskin
1
0
Fork 0
Code Issues 2 Pull requests 4 Releases 3 Packages Activity

Restore bounded trailer tasks after process death

Browse source
This commit is contained in:
justinzeus 2026-11-08 06:46:24 +01:00
parent b6665d016b
commit 1bdae30e11
32 changed files with 1082 additions and 247 deletions
Download patch file Download diff file Expand all files Collapse all files

41
docker/README.md
View file

@ -449,11 +449,11 @@ only when the Advanced debug fixture switch is enabled; release excludes it.
### Household setup and sign-in recovery
With **Wolfskin screens** enabled, `MainContent` intercepts both upstream setup
destinations before their stock server/user selectors can render. Cold start,
restart with automatic sign-in disabled, the old drawer's user action, legacy
sign-out-equivalent state, setup fallbacks and intent failures all use Wolfskin's
own picker. Entering it does not call `SwitchUserViewModel.init` or clear the
remembered server/user preference.
destinations before their stock server/user selectors can render. Cold launches
that require sign-in, protected-profile restarts, the old drawer's user action,
legacy sign-out-equivalent state, setup fallbacks and intent failures all use
Wolfskin's own picker. Entering it does not call `SwitchUserViewModel.init` or
clear the remembered server/user preference.
Setup reuses the supplied/current/recent household server, recovering the most
recently used Room server if the legacy picker erased the preference. Saved people
@ -469,6 +469,35 @@ session. A failed selection offers Wolfskin **Try again** and **Sign in** action
hidden/unsaved profiles can use username/password sign-in through the setup
picker's Settings gear. An outage never replaces the saved household endpoint.
Returning from an external app such as SmartTube keeps the originating title and
person when the same unprotected identity remains live and its signed-in app
entry is still active, even with automatic sign-in off. Live protection is checked
at stop and again when the stopped entry starts.
If Android kills Wolfskin while the trailer is in front, the same saved Android
task can continue for **strictly less than ten minutes from the handoff, on the
same boot**. Only an exported YouTube-handler launch from an authenticated,
unprotected title creates this return record. It stores server/person IDs, the
exact title route, elapsed time and boot counter in the Activity's saved Bundle:
no token, password, PIN or new last-person preference. Saving/recreating does not
renew the deadline; missing boot evidence keeps the picker.
Before installing a saved token, restoration re-reads the profile and requires
the exact most-recent server/person, a present token, no PIN and no require-login,
then rechecks the deadline. The recommendations worker may already have restored
that same unprotected canonical identity before setup leaves Loading; continuing
it does not install credentials again. A different current person, sign-out,
removed/tokenless profile or explicit picker cannot be replaced by the return
path. PIN/require-login people remain gated. A fresh task, fresh explicit intent,
wrong route or expired/missing record follows ordinary startup policy.
After identity acceptance, a one-use confirmation lets only that person skip the
new shell's launch chooser and reach the saved title. Ordinary cold automatic
sign-in still opens the chooser. `MainActivityTrailerRestoreTest` and
`TrailerReturnStateTest` cover the process-death window and identity gates;
`MainActivityResumeTest` and `SignedInContentTest` cover live return and protection
changes while away.
Turning **Wolfskin screens** off retains the unchanged upstream
`SwitchServerContent` and `SwitchUserContent` setup screens for rollback. Debug
fixtures still seed the existing fixture picker after authentication.
@ -484,7 +513,7 @@ late reply cannot navigate back to an earlier person.
The fixture-mode marker belongs to the singleton `WolfskinSession`, alongside its
server and shell state, not to the user-scoped ViewModel. Switching people replaces
the upstream app entry and ViewModel but retains the same-server, same-mode shell:
the picker stays closed on Home after the first OK. A cold start still opens it,
the picker stays closed on Home after the first OK. A fresh task still opens it,
and the nav avatar explicitly reopens it. `PersonPickerSessionTest` drives the real
shell and user-entry replacement for launch/avatar Left and Right, the initial
person, gear and back, and fast Left-Left-OK; each selection emits one person action.