Harden T56 one-shot provisioning

app/src/main/java/se/lublin/mumla/radio/PendingConfigTrialPolicy.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2026 The Mumla contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+package se.lublin.mumla.radio;
+
+import se.lublin.humla.util.HumlaException;
+
+/** Fail-closed policy that tolerates only bounded transient config-trial dial failures. */
+final class PendingConfigTrialPolicy {
+    static final int MAX_CONNECTED_NETWORK_FAILURES = 3;
+
+    private PendingConfigTrialPolicy() {
+    }
+
+    static boolean shouldReject(HumlaException.HumlaDisconnectReason reason,
+                                boolean networkConnected, int connectedNetworkFailures) {
+        if (reason == null) {
+            return false;
+        }
+        switch (reason) {
+            case REJECT:
+            case OTHER_ERROR:
+                return true;
+            case CONNECTION_ERROR:
+                return networkConnected
+                        && connectedNetworkFailures >= MAX_CONNECTED_NETWORK_FAILURES;
+            case USER_REMOVE:
+            default:
+                return false;
+        }
+    }
+}

app/src/main/java/se/lublin/mumla/radio/RadioShellActivity.java

@@ -26,6 +26,7 @@
 import android.os.Looper;
 import android.os.SystemClock;
 import android.text.TextUtils;
+import android.util.Log;
 import android.view.Gravity;
 import android.view.KeyEvent;
 import android.view.View;
@@ -68,6 +69,7 @@
 
 /** Single-screen radio client driven by the Last Known Good Minimum config. */
 public final class RadioShellActivity extends AppCompatActivity {
+    private static final String TAG = RadioShellActivity.class.getSimpleName();
     public static final String EXTRA_CONNECT_ON_PTT =
             "se.lublin.mumla.extra.CONNECT_ON_PTT";
     public static final String EXTRA_TOGGLE_IDENTITY =
@@ -96,6 +98,7 @@ public final class RadioShellActivity extends AppCompatActivity {
     private boolean retryAfterConfiguredCertificateTrust;
     private boolean configReceiverRegistered;
     private boolean pendingConfigTrial;
+    private int pendingConfigConnectionFailures;
     private boolean pendingConfigIoInFlight;
     private boolean connectionRetrySuspended;
     private boolean joinedConfiguredRoom;
@@ -230,9 +233,22 @@ public void onDisconnected(HumlaException error) {
                 statusView.postDelayed(RadioShellActivity.this::maybeConnect, 400);
                 return;
             }
-            if (pendingConfigTrial && shouldRejectPendingTrial(error)) {
-                failPendingConfiguration();
-                return;
+            if (pendingConfigTrial && error != null) {
+                boolean networkConnected = RadioConfigUpdater.isNetworkConnected(
+                        RadioShellActivity.this);
+                if (error.getReason() == HumlaException.HumlaDisconnectReason.CONNECTION_ERROR
+                        && networkConnected) {
+                    pendingConfigConnectionFailures++;
+                    Log.w(TAG, "Pending config trial connection failure "
+                            + pendingConfigConnectionFailures + "/"
+                            + PendingConfigTrialPolicy.MAX_CONNECTED_NETWORK_FAILURES);
+                }
+                if (PendingConfigTrialPolicy.shouldReject(error.getReason(), networkConnected,
+                        pendingConfigConnectionFailures)) {
+                    Log.w(TAG, "Pending config trial rejected after bounded connection checks");
+                    failPendingConfiguration();
+                    return;
+                }
             }
             if (reconnectAfterDisconnect) {
                 reconnectAfterDisconnect = false;
@@ -720,6 +736,7 @@ private static boolean isAudibleTalkState(TalkState state) {
 
     private void beginPendingConfigurationTrial(RadioConnectionConfig candidate) {
         pendingConfigTrial = true;
+        pendingConfigConnectionFailures = 0;
         applyConfigurationToUi(candidate);
         setStatus(COLOR_BUSY, getString(R.string.radio_config_testing));
 
@@ -747,6 +764,7 @@ private void commitPendingConfiguration() {
                 runOnUiThread(() -> {
                     pendingConfigIoInFlight = false;
                     pendingConfigTrial = false;
+                    pendingConfigConnectionFailures = 0;
                     if (service != null) {
                         service.reloadTrackingConfig();
                     }
@@ -789,6 +807,7 @@ private void failPendingConfiguration() {
             runOnUiThread(() -> {
                 pendingConfigIoInFlight = false;
                 pendingConfigTrial = false;
+                pendingConfigConnectionFailures = 0;
                 if (destroyed) {
                     return;
                 }
@@ -817,22 +836,6 @@ private void failPendingConfiguration() {
         }, "minimum-radio-config-rollback").start();
     }
 
-    private boolean shouldRejectPendingTrial(HumlaException error) {
-        if (error == null) {
-            return false;
-        }
-        switch (error.getReason()) {
-            case REJECT:
-            case OTHER_ERROR:
-                return true;
-            case CONNECTION_ERROR:
-                return RadioConfigUpdater.isNetworkConnected(this);
-            case USER_REMOVE:
-            default:
-                return false;
-        }
-    }
-
     private void maybeConnect() {
         boolean explicitlyRequested = connectOnPttRequest;
         if (destroyed || config == null || service == null || connectRequested

app/src/test/java/se/lublin/mumla/radio/PendingConfigTrialPolicyTest.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2026 The Mumla contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ */
+
+package se.lublin.mumla.radio;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+import se.lublin.humla.util.HumlaException;
+
+public final class PendingConfigTrialPolicyTest {
+    @Test
+    public void transientConnectedFailuresKeepCandidateForRetry() {
+        assertFalse(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.CONNECTION_ERROR, true, 1));
+        assertFalse(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.CONNECTION_ERROR, true, 2));
+    }
+
+    @Test
+    public void repeatedConnectedFailureRejectsCandidate() {
+        assertTrue(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.CONNECTION_ERROR, true, 3));
+    }
+
+    @Test
+    public void offlineFailureWaitsForNetworkReturn() {
+        assertFalse(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.CONNECTION_ERROR, false, 99));
+    }
+
+    @Test
+    public void permanentErrorsFailClosed() {
+        assertTrue(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.REJECT, true, 0));
+        assertTrue(PendingConfigTrialPolicy.shouldReject(
+                HumlaException.HumlaDisconnectReason.OTHER_ERROR, true, 0));
+    }
+}