Limit auto-off warm continuation to trailer handoffs #83

Merged

justinzeus merged 1 commit from fm/tv-trailer-narrow into fm/tv-round2-candidate3

2026-11-08 13:30:43 +01:00

justinzeus commented

2026-11-08 13:09:09 +01:00

Owner

Outcome

With Sign in automatically off, ordinary warm returns show the profile picker again. Only the first return after a valid trailer handoff retains the same unprotected person and exact title. Automatic sign-in on is unchanged.

This correction targets the round-two candidate at #82, not main. The same correction is also pushed as 98db417ca29ddb1b8684007abc11d98007958670 onto the original trailer-return branch at #81. Its separate eight-class recheck passed 77 tests with zero failures/errors/skips. The only cherry-pick resolution omitted the constructor migration for candidate-only NavigationCutTest, absent on that original branch. The candidate branch itself has not been updated.

Change and identity constraints

Require a pending handoff matching the live person, server and exact title, within the original strictly-under-ten-minute, same-boot window.
Snapshot the immutable pending record before lifecycle cleanup: onResume can clear it before asynchronous startup or returning UI runs. Recheck identity/title/deadline rather than trusting a cached Boolean.
Clear the pending record on return; the next ordinary background return cannot reuse it.
Preserve PIN, requireLogin, explicit-picker and cold-launch gates. Saved-Activity-Bundle process-death restoration and its credential-installation checks are unchanged.
Update regression coverage and the return-window documentation in docker/README.md; migrate the new UI dependency at existing callers.

Verification

Failing-before native baseline: 10 tests, 2 expected failures (ordinary warm-return view-model navigation and signed-in UI visibility); eight controls passed. The initial attempt lacked the local offline Robolectric SDK cache; preparing :wolfskin-design:cacheRobolectricSdk resolved that harness prerequisite.
Passing-after candidate batch: 85 tests across nine classes, zero failures/errors/skips. Classes: MainActivityResumeTest, SignedInContentTest, MainActivityTrailerRestoreTest, TrailerReturnStateTest, TitleTrailerTest, TestMainActivityViewModel, NavigationCutTest, WolfskinSetupNavigationTest, WolfskinSetupRollbackTest.
Every invocation used docker/gradle.sh and its shared lock, explicit --tests selectors, and -x :wolfskin-design:testDebugUnitTest. No full suite, APK assembly, ADB, TV/emulator action, release or install. The instrumentation caller was migrated but not executed; device testing is out of scope.
Native Compose/Robolectric replay clicked the real trailer control and observed the returned title. Inspected 1920×1080 frame: Locke, Justin’s J avatar, no picker. New cases cover the second ordinary return, expired handoff, changed/unknown boot, protection changes, wrong person/title, explicit picker, cold launch, auto-on behavior and asynchronous cleanup/expiry. Existing saved-task and PIN/requireLogin controls remain.

Evidence: /root/.treehouse/firstmate-7bab20/2/firstmate/data/tv-trailer-narrow/ (red-native.log, red-native-xml/, green.log, green-candidate-xml/, candidate-results.json, native-frames/).

AI-assisted implementation. Tier C identity/navigation change: safety review required before merge. This worker does not merge or release; installing on the TV still requires explicit authorization.

## Outcome With **Sign in automatically** off, ordinary warm returns show the profile picker again. Only the first return after a valid trailer handoff retains the same unprotected person and exact title. Automatic sign-in on is unchanged. This correction targets the round-two candidate at https://git.justinvisser.org/justinzeus/wolfskin/pulls/82, not main. The same correction is also pushed as `98db417ca29ddb1b8684007abc11d98007958670` onto the original trailer-return branch at https://git.justinvisser.org/justinzeus/wolfskin/pulls/81. Its separate eight-class recheck passed **77 tests with zero failures/errors/skips**. The only cherry-pick resolution omitted the constructor migration for candidate-only `NavigationCutTest`, absent on that original branch. The candidate branch itself has not been updated. ## Change and identity constraints - Require a pending handoff matching the live person, server and exact title, within the original strictly-under-ten-minute, same-boot window. - Snapshot the immutable pending record before lifecycle cleanup: `onResume` can clear it before asynchronous startup or returning UI runs. Recheck identity/title/deadline rather than trusting a cached Boolean. - Clear the pending record on return; the next ordinary background return cannot reuse it. - Preserve PIN, requireLogin, explicit-picker and cold-launch gates. Saved-Activity-Bundle process-death restoration and its credential-installation checks are unchanged. - Update regression coverage and the return-window documentation in `docker/README.md`; migrate the new UI dependency at existing callers. ## Verification - Failing-before native baseline: **10 tests, 2 expected failures** (ordinary warm-return view-model navigation and signed-in UI visibility); eight controls passed. The initial attempt lacked the local offline Robolectric SDK cache; preparing `:wolfskin-design:cacheRobolectricSdk` resolved that harness prerequisite. - Passing-after candidate batch: **85 tests across nine classes, zero failures/errors/skips**. Classes: `MainActivityResumeTest`, `SignedInContentTest`, `MainActivityTrailerRestoreTest`, `TrailerReturnStateTest`, `TitleTrailerTest`, `TestMainActivityViewModel`, `NavigationCutTest`, `WolfskinSetupNavigationTest`, `WolfskinSetupRollbackTest`. - Every invocation used `docker/gradle.sh` and its shared lock, explicit `--tests` selectors, and `-x :wolfskin-design:testDebugUnitTest`. No full suite, APK assembly, ADB, TV/emulator action, release or install. The instrumentation caller was migrated but not executed; device testing is out of scope. - Native Compose/Robolectric replay clicked the real trailer control and observed the returned title. Inspected 1920×1080 frame: **Locke**, Justin’s **J** avatar, no picker. New cases cover the second ordinary return, expired handoff, changed/unknown boot, protection changes, wrong person/title, explicit picker, cold launch, auto-on behavior and asynchronous cleanup/expiry. Existing saved-task and PIN/requireLogin controls remain. Evidence: `/root/.treehouse/firstmate-7bab20/2/firstmate/data/tv-trailer-narrow/` (`red-native.log`, `red-native-xml/`, `green.log`, `green-candidate-xml/`, `candidate-results.json`, `native-frames/`). AI-assisted implementation. Tier C identity/navigation change: safety review required before merge. This worker does not merge or release; installing on the TV still requires explicit authorization.

justinzeus added 1 commit 2026-11-08 13:09:10 +01:00