2 commits

Author	SHA1	Message	Date
ScreenTinker	8ad2258e7c	feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player ... Best-effort "last gasp" so Offline is annotated with WHY it went away — completing the liveness story. Categories: crashed (client uncaught-exception), clean_exit (client confident lifecycle-end, best-effort), silent (SERVER-inferred by absence — the honest catch-all for violent/external death incl. force-stop/MDM). SERVER: - device:exit socket handler + token-authed beacon POST /api/device/exit (reliable-on-unload). Both gated by liveness.sanitizeExitReason (honesty: only crashed/clean_exit accepted; 'silent'/unknown rejected). - offline_reason/offline_reason_at/offline_detail columns (additive migration). Clear-on-online (a reason is always THIS session's); offline transition COALESCEs to 'silent'. Pure annotation — offline detection and #148/liveness are untouched. Offline dashboard emits carry offline_reason + client_type. CLIENTS (canonical {reason,detail} shape): - /player: window error/unhandledrejection + pagehide(persisted=false) -> sendBeacon. - .wgt: same + BACK-key exit -> socket.emit + sendBeacon. - APK: global UncaughtExceptionHandler -> crashed (blocking beacon, chains to default); Service.onDestroy -> clean_exit (socket + bounded beacon). New ExitSignal.kt. onStop/onPause NOT wired (background != exit). Proven (Phase 3): per-category classification, nothing misclassified, external kill -> silent (never clean_exit), backgrounding emits no false exit, #148/reconnect-vs-exit intact. 382/382 suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 15:32:40 -05:00
ScreenTinker	4cf156d4a0	feat(server): v4 liveness CORE pass — uniform heartbeat-ack + ack-gap + dashboard liveness + identity ... Server-side keystone: the server now honors the v4 liveness contract uniformly across the MIXED fleet (v4 + old pre-v4 + disconnected), all three clients depending on it. - UNIFORM heartbeat-ack: emitted from the single shared device:heartbeat handler (uniform by construction; no per-client/per-path branch), BEFORE the auth guard so a known device's watchdog stays armed. Harmless to old clients (they ignore it). - RECONNECT-WINDOW ack-gap fix (ackableHeartbeat): ack a KNOWN device (authed socket OR a device_id that resolves) even mid-reconnect; NOT anonymous/never-authenticated sockets (degrade-safe); identity-agnostic. No state mutation before requireDeviceAuth (auth surface unchanged; device_ids are uuidv4). - DASHBOARD LIVENESS (deriveLiveness): server-derived, VERSION-AGNOSTIC Healthy/Degraded/Offline from signals every client sends (socket presence, heartbeat age, reconnect frequency); no client status-push. - IDENTITY CAPTURE (capture-don't-act): client_type/client_version/platform/contract_version columns; degrades to legacy/unknown for old clients; NEVER breaks register. - A-BUCKET FIX (QA): recordReconnect + persistIdentity gated on !isPlaylistRefresh (a ~45-60s refresh is not a reconnect/new identity — matches #134), and the identity write is change-detected — closing the WAL write-amplification (A1) and the benign-refresh -> false-"Degraded" (A2) regressions. New lib/liveness.js (pure helpers, unit-tested). 30 new tests (uniform ack, ack-gap, mixed fleet, identity capture, cross-client conformance, refresh-gate reproduce-then-prove); 366/366 total. OTA artifact-availability is a separate concern (out of scope). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 11:18:55 -05:00