FullCharge: Offer the reconnect gesture on adapters without a hold signal

The gesture was hidden everywhere but stock Pixel, via a boolean that
dated from when its only arming basis was the limit hold. That basis
reads the charging-policy hardware state (EXTRA_CHARGING_STATUS == 4),
which only Pixel and GrapheneOS decode at all, so it genuinely cannot
arm elsewhere. The any-level basis added later needs no hardware signal,
but the boolean gated the feature before that path was ever consulted.

Replace it with ReconnectSupport (NONE / ANY_LEVEL_ONLY / FULL). Samsung
(both generations), OnePlus/ColorOS, Xiaomi HyperOS 3 and LineageOS have
a real cap that reads back synchronously and no observable hold, so they
get ANY_LEVEL_ONLY, where the any-level basis is implied rather than
opt-in: honouring a stored "off" would leave the master toggle on with
no basis that could ever arm. The settings screen drops the sub-switch
there and states the behaviour instead. GrapheneOS stays NONE because
the ROM samples the key at plug-session start and the gesture's write
lands strictly after the replug it would need to beat. Xiaomi HyperOS 2
stays NONE because Adaptive is its only protective mode and its hold is
unobserved on that generation, so there would be nothing to lift on
every tick; being enforcementIsConditional is not itself disqualifying,
since Pixel arms on Adaptive today and OnePlus/HyperOS 3 now will too.

GestureBasis gains the synchronous settings readback as a second
conclusive source. Without it these adapters would arm off the write
journal alone, so a limit removed in the OEM's own settings would keep
arming the gesture. Null there means the adapter has no sync source and
still hands the question to the journal; a sync-readback adapter always
contributes an observation, substituting an explicit Unknown, because
syncReadback() returns null for both "no source" and "read failed" and
answering a failed readback from the journal it exists to override is
the exact error the source was added to prevent. A non-Verified hardware
decode deliberately keeps falling through, being an ordinary reading.

The readback runs on the dispatch path, so a timeout degrades to no
evidence rather than propagating: TimeoutCancellationException is a
CancellationException, and DispatchCoordinator rethrows those, which
would kill the battery-evaluation consumer for the life of the service
and strand a later session with no restore ticks.

Author: d4rken

.claude/rules/architecture.md

@@ -21,7 +21,7 @@ single shared store, every write reaches every collector, so the deduplication h
 
 - `AdapterRegistry` selects an OEM adapter from **immutable device information**. Live adapters declare a
   capability surface (`sessionOverridePolicy`, `defaultProtectivePolicy`, `verification`,
-  `reconnectGestureSupported`) that the session/recovery/UI layers consume instead of hardcoding Pixel behavior.
+  `reconnectGestureSupport`) that the session/recovery/UI layers consume instead of hardcoding Pixel behavior.
 - `AccessResolver` independently probes direct WSS and Shizuku.
 - `ChargingRepository` selects the strongest backend per operation: **Shizuku for reads, direct WSS for durable
   writes, then Shizuku for verification** when both are available.
@@ -89,10 +89,29 @@ Opt-in, with two arming bases:
 - **Limit hold (default)**: the public battery broadcast **simultaneously** reports external power, charging-policy
   hardware state `4`, a non-charging battery status, and an expected limit-range level. Once latched during a plug
   period it survives option flips (the evidence was the hardware hold itself).
-- **Any level (opt-in sub-option)**: plugged AND Amply's *persistent* configured policy
-  (`ChargingPreferences.lastPersistentPolicy`, never updated by temporary session writes) is protective. Percent,
-  battery status, and hardware hold are deliberately ignored. This basis is revoked immediately — including an open
-  reconnect window — when the option is switched off or the persistent policy stops being protective.
+- **Any level (opt-in sub-option)**: plugged AND the configured policy is conclusively protective. Evidence comes
+  from `GestureBasis.evidence()` in order: the hardware decode, then the synchronous settings readback
+  (`ChargingRepository.syncReadback()`, null on async-hardware adapters), then Amply's *persistent* write journal
+  (`ChargingPreferences.lastPersistentPolicy`, never updated by temporary session writes). Percent, battery status,
+  and hardware hold are deliberately ignored. This basis is revoked immediately — including an open reconnect
+  window — when the option is switched off or the policy stops being conclusively protective.
+
+Which bases exist is per-adapter, via `ChargingAdapter.reconnectGestureSupport` (`ReconnectSupport`):
+
+- `FULL` — Pixel only. It is the only adapter reporting the charging-policy hardware state the limit-hold basis
+  needs while also applying writes mid-plug-session.
+- `ANY_LEVEL_ONLY` — Samsung (both generations), OnePlus/ColorOS, Xiaomi HyperOS 3, LineageOS. A real cap that
+  reads back synchronously, but no observable hold signal, so the limit-hold basis can never arm. The any-level
+  basis is **implied on** here: the sub-option is not consulted and the settings screen hides it, because honouring
+  an "off" would leave the master switch on with no basis that could ever arm. The settings readback is what keeps
+  these off journal-only evidence, so a limit removed in the OEM's own settings revokes the basis.
+- `NONE` — everything else, for two distinct reasons. GrapheneOS (and any future `policyLatchesAtPlug` adapter)
+  because the gesture's write lands strictly after the replug the ROM already sampled, so it cannot take effect
+  until the *next* replug. Xiaomi HyperOS 2 because Adaptive is its only protective mode *and* that
+  mode's hold is unobserved on the generation (13T, 59%→100% with it configured), so the gesture
+  would have nothing to lift on every tick. Being `enforcementIsConditional` is NOT itself
+  disqualifying: Pixel arms on Adaptive today, and OnePlus/HyperOS 3 will too, since adaptive
+  charging does hold below full before the usual unplug.
 
 A powered→unpowered transition opens a reconnect window of **2–10 seconds** (`elapsedRealtime`-based): the 2s
 debounce floor filters momentary power cuts (car ignition, connector jostle), and a rejected too-fast/too-late replug

.claude/skills/oem-adapters/SKILL.md

@@ -24,7 +24,9 @@ Two live adapters, gated by `ro.build.version.oneui` ranges plus `protect_batter
 
 Writes apply **synchronously** (`VerificationStrategy.SYNC_READBACK`): `apply()` requires read-back equality, no
 pending-settle window, boot recovery converges on settings readback, and no reapply-inversion trick is needed.
-The reconnect gesture is Pixel-only (`reconnectGestureSupported`). One UI 6/7 and 9+ fall through to the
+The reconnect gesture runs in `ReconnectSupport.ANY_LEVEL_ONLY` mode: One UI publishes no charging-policy hold
+signal, so the limit-hold basis can never arm and the any-level basis is implied on (the sub-option is hidden).
+One UI 6/7 and 9+ fall through to the
 diagnostics-only lab adapter. An external `protect_battery=0` makes One UI forget the user's prior mode (it falls back
 to the OEM default on re-enable), so Amply restores the exact prior policy itself rather than trusting Samsung's
 bookkeeping. Verified devices + coverage: see the qualification ledger (`device-qualification` skill).
@@ -92,7 +94,8 @@ NOT any AOSP `settings` namespace: `charging_control_enabled` (0/1), `charging_c
 unprivileged** (`LineageSettingsClient` via ContentResolver, shared by both backends); **writes require Shizuku**
 (`content insert`; the shell UID holds `lineageos.permission.WRITE_SETTINGS`, which `WRITE_SECURE_SETTINGS` cannot
 cover — `preferShizukuForWrites`, and the WSS auto-grant is skipped). `SYNC_READBACK` with read-back equality;
-session override = Unrestricted; protective default = FixedLimit(80); reconnect gesture unsupported.
+session override = Unrestricted; protective default = FixedLimit(80); reconnect gesture
+`ANY_LEVEL_ONLY` (reachable only once the enforcement gate enables control, since it rides `canApply`).
 
 LineageOS's own `ChargingControlController` observes these keys and re-drives the `vendor.lineage.health.
 IChargingControl` HAL, so an external write is honored. But the HAL is **device-dependent** (the setting can flip

app/src/debug/java/eu/darken/amply/screenshots/ScreenshotContent.kt

@@ -117,6 +117,8 @@ internal fun ReconnectGestureContent() = PreviewWrapper {
     ChargingSettingsScreen(
         gestureEnabled = true,
         anyLevelEnabled = false,
+        // The Play Store shot shows a Pixel, which has both arming bases, so the sub-option renders.
+        anyLevelOnly = false,
         canEnableGesture = true,
         // A two-policy device, so the shot stays on the gesture options themselves.
         availablePolicies = listOf(ChargePolicy.FixedLimit(80), ChargePolicy.Unrestricted),

app/src/main/java/eu/darken/amply/charging/core/ChargingRepository.kt

@@ -79,6 +79,8 @@ data class ChargingState(
      */
     val defaultProtectivePolicy: ChargePolicy? = null,
     val reconnectSupported: Boolean = false,
+    /** The limit-hold basis cannot arm here, so surfaces must not offer it as a choice. */
+    val reconnectAnyLevelOnly: Boolean = false,
     /** True when the adapter's configured state is directly readable — Shizuku adds nothing for verification. */
     val syncVerification: Boolean = false,
     /** True when applying a policy needs Shizuku (system-namespace adapter WSS can't write). */
@@ -740,7 +742,8 @@ class ChargingRepository @Inject constructor(
             supportedPolicies = selection.support.licensedPolicies
                 ?: adapter?.supportedPolicies.orEmpty(),
             defaultProtectivePolicy = adapter?.defaultProtectivePolicy,
-            reconnectSupported = adapter?.reconnectGestureSupported == true,
+            reconnectSupported = adapter?.reconnectGestureSupport?.available == true,
+            reconnectAnyLevelOnly = adapter?.reconnectGestureSupport?.impliesAnyLevel == true,
             syncVerification = adapter?.verification == VerificationStrategy.SYNC_READBACK,
             writeRequiresShizuku = adapter?.preferShizukuForWrites == true,
             controlEnabled = selection.support.controlEnabled,

app/src/main/java/eu/darken/amply/charging/core/adapter/ChargingAdapter.kt

@@ -62,6 +62,30 @@ enum class VerificationStrategy {
     SYNC_READBACK,
 }
 
+/**
+ * How much of the reconnect gesture an adapter can support.
+ *
+ * [ANY_LEVEL_ONLY] is not a degraded [FULL]: it is the honest description of a device that enforces
+ * a cap but publishes no observable hold signal, so Amply can know the cap is *configured* and never
+ * that it is *holding right now*. Surfaces must not offer the limit-hold sub-option there — it
+ * could never arm — and the gesture runs on the any-level basis regardless of the user's setting.
+ */
+enum class ReconnectSupport {
+    /** No gesture. Either no cap to lift (Adaptive-only adapters) or the write cannot land in time
+     * (adapters with `policyLatchesAtPlug`, where the gesture's write always misses the plug event). */
+    NONE,
+
+    /** Any-level arming only — the hardware hold signal this adapter cannot report is not required. */
+    ANY_LEVEL_ONLY,
+
+    /** Both bases, including arming off an observed hardware limit hold. */
+    FULL,
+    ;
+
+    val available: Boolean get() = this != NONE
+    val impliesAnyLevel: Boolean get() = this == ANY_LEVEL_ONLY
+}
+
 interface ChargingAdapter {
     val id: String
     val displayName: CaString
@@ -76,8 +100,18 @@ interface ChargingAdapter {
 
     val verification: VerificationStrategy get() = VerificationStrategy.ASYNC_HARDWARE
 
-    /** Whether the powered→unpowered reconnect gesture's hardware preconditions exist on this adapter. */
-    val reconnectGestureSupported: Boolean get() = false
+    /**
+     * Which arming bases the powered→unpowered reconnect gesture can actually use here.
+     *
+     * The gesture's *limit-hold* basis reads Android's charging-policy hardware state
+     * (`EXTRA_CHARGING_STATUS` == 4), which only [PixelChargingAdapter] and
+     * [GrapheneOsChargingAdapter] decode at all — every other adapter inherits
+     * [decodeHardware]'s null and can never satisfy it. That is why this started life as a
+     * Pixel-only boolean. The *any-level* basis needs no hardware signal (see [GestureBasis]), so
+     * on an adapter whose protective policy is a real cap it works fine; three states instead of
+     * two is what lets those devices have the gesture without claiming a hold they cannot observe.
+     */
+    val reconnectGestureSupport: ReconnectSupport get() = ReconnectSupport.NONE
 
     /**
      * Prefer Shizuku over direct WSS for writes. Two adapter classes set it: keys in the `system`

app/src/main/java/eu/darken/amply/charging/core/adapter/GrapheneOsChargingAdapter.kt

@@ -73,6 +73,11 @@ class GrapheneOsChargingAdapter @Inject constructor() : ChargingAdapter {
     override val verification = VerificationStrategy.SYNC_READBACK
     override val policyLatchesAtPlug = true
 
+    // Structural, not a missing signal: this ROM samples the key at plug-session start, and the
+    // gesture's override write lands strictly after the replug broadcast it would have to beat. It
+    // would read back correctly and change nothing until the *next* replug. See the class doc.
+    override val reconnectGestureSupport = ReconnectSupport.NONE
+
     // Not because the namespace needs it (global is WSS-writable elsewhere) but because the key is
     // @Protected: a direct write throws SecurityException no matter which permissions Amply holds,
     // while the shell UID is exempt. Reads share the restriction; readSyncDirectFirst's direct

app/src/main/java/eu/darken/amply/charging/core/adapter/LineageChargingAdapter.kt

@@ -78,6 +78,10 @@ class LineageChargingAdapter @Inject constructor(
     override val defaultProtectivePolicy = ChargePolicy.FixedLimit(80)
     override val sessionOverridePolicy = ChargePolicy.Unrestricted
     override val verification = VerificationStrategy.SYNC_READBACK
+
+    // Reachability is still decided by the enforcement gate: with control off, `canApply` is
+    // false and no surface offers the gesture, so this never widens what an unqualified build does.
+    override val reconnectGestureSupport = ReconnectSupport.ANY_LEVEL_ONLY
     override val preferShizukuForWrites = true
     override val enforcementEvidenceRequired = true
 

app/src/main/java/eu/darken/amply/charging/core/adapter/OnePlusChargingAdapter.kt

@@ -48,6 +48,9 @@ class OnePlusChargingAdapter @Inject constructor() : ChargingAdapter {
 
     override val defaultProtectivePolicy = ChargePolicy.FixedLimit(LIMIT_PERCENT)
     override val verification = VerificationStrategy.SYNC_READBACK
+
+    // FixedLimit(80) is a real cap and reads back synchronously; ColorOS publishes no hold signal.
+    override val reconnectGestureSupport = ReconnectSupport.ANY_LEVEL_ONLY
     override val preferShizukuForWrites = true
 
     override fun probe(device: DeviceInfo): AdapterSupport {

app/src/main/java/eu/darken/amply/charging/core/adapter/PixelChargingAdapter.kt

@@ -28,7 +28,7 @@ class PixelChargingAdapter @Inject constructor() : ChargingAdapter {
         ChargePolicy.Adaptive,
         ChargePolicy.Unrestricted,
     )
-    override val reconnectGestureSupported = true
+    override val reconnectGestureSupport = ReconnectSupport.FULL
     override val observedSettingUris
         get() = listOf(
             Settings.Secure.getUriFor(KEY_MODE),

app/src/main/java/eu/darken/amply/charging/core/adapter/SamsungChargingAdapters.kt

@@ -28,6 +28,10 @@ abstract class SamsungChargingAdapter : ChargingAdapter {
 
     override val verification = VerificationStrategy.SYNC_READBACK
 
+    // No `EXTRA_CHARGING_STATUS` hold signal on One UI, so the limit-hold basis could never
+    // arm; the cap itself is real and read-backable, which is all the any-level basis needs.
+    override val reconnectGestureSupport = ReconnectSupport.ANY_LEVEL_ONLY
+
     override fun probe(device: DeviceInfo): AdapterSupport {
         val oneUi = device.oneUiVersion
         val matched = device.manufacturer.equals("Samsung", ignoreCase = true) &&