Harden radio runtime, provisioning, and portal login admission

[awatchar]

Summary

• enforce validated ptt.maximumTxSeconds across hold, toggle, and accepted exported TALK control; repeated TALK-on cannot extend the deadline
• invalidate stale APRS transport callbacks on stop/reconfiguration and make location-listener/service/audio/SCO/wakelock teardown best-effort and late-callback safe
• resolve the requested Android correctness-lint categories while preserving and documenting dedicated-device exports and the intended always-on process watchdog
• make Fresh Provisioner fail closed on Release manifest/APK identity/signer, repeat complete verification immediately before adb install, and bind signed-release tags to exact reviewed origin/main
• add production fail-closed Cloudflare D1 fixed-window admission for client and configured/decoy account buckets using HMAC-only keys

Automated verification

• Android: 121 app tests + 11 Humla tests; debug and unsigned release APK assembly pass
• Targeted lint IDs: 0 for MissingPermission, ProtectedPermissions, UnspecifiedRegisterReceiverFlag, MissingQuantity, MissingSuperCall, WakelockTimeout, ExportedReceiver and ExportedService
• Full lint remains visible at the accepted legacy baseline: 21 errors / 330 warnings (GestureBackNavigation 1, Range 6, UseAppTint 14)
• Portal: 124 tests, TypeScript check and Next.js production build pass
• Existing updater: 33/33; Fresh Provisioner: 16/16; PowerShell AST/cellular policy/YAML checks pass
• Independent Sol review: no remaining code blocker and no leaked production credential

Deployment and hardware gates

• Do not merge/deploy yet: production login intentionally fails closed until CLOUDFLARE_D1_DATABASE_ID, CLOUDFLARE_D1_API_TOKEN, and LOGIN_RATE_LIMIT_KEY_SECRET are installed in Vercel and smoke-tested.
• Hardware-only PTT timing, APRS stop/reconfigure, teardown/wakelock observation and Fresh Provisioner install remain deferred because no device is attached.

Refs #19
Refs #20
Refs #21
Refs #22
Refs #23
Refs #24

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
minimum	Ready	Preview	Aug 24, 2026 2:50am

[awatchar]

Final automated gates are green on head 65d9b06c:

• Android CI: PASS (5m19s), including app/Humla tests, debug + unsigned release assembly, updater 33/33 and Fresh Provisioner 16/16
• Portal CI: PASS (51s), 124 tests + TypeScript + production build
• Vercel: ignored-build policy PASS (no Preview deployment)
• Independent Sol review: no remaining code blocker; no leaked production credential

Merge remains intentionally blocked until the three production D1 variables are provisioned and login smoke acceptance passes. Hardware-only acceptance remains deferred because no radio is attached.

[awatchar]

Production gate completed after merge commit 25e3f511:

• Created an account-owned Cloudflare token scoped only to D1 Write.
• Added CLOUDFLARE_D1_DATABASE_ID, CLOUDFLARE_D1_API_TOKEN, and LOGIN_RATE_LIMIT_KEY_SECRET as Sensitive Vercel variables for Production and Preview.
• Temporarily enabled Preview builds, deployed exact PR head 566e4da1, then restored Only build production.
• Preview smoke: attempts 1-10 returned generic 401; attempt 11 returned 429.
• Production deployment is Ready. Root returns 200, /api/session returns configured=true/authenticated=false, and the shared D1 client bucket returns 429 as expected.
• No production credential was printed, committed, or placed in GitHub.

Hardware-only acceptance remains deferred for #19, #21, #22, and #23.