Tidy up after the follower moved out, and fix two things it exposed

THE MIRROR IS GONE. SwarmFollowerBg wrote somebody else's glucose into AAPS's
own table so AAPS would draw it, which needed a high-water mark, tags to stop
those rows being re-published as your own, an invented EffectiveProfileSwitch,
a guard in the drain and a build-flavour fence around the lot. The follower
reads the vault directly now, so all of it is deleted — along with the three
preference keys and two strings that existed only to serve it. The drain's cgm
filter goes back to `isValid`, because the only rows in that table are ones this
phone measured.

initAndroid hands the JavaVM and Context to ndk_context at startup, in both
apps. Without it iroh's connectivity watcher panics asking Android for a
ConnectivityManager; the panic is raised in a tokio task, tokio catches it, the
task disappears, and the phone stops noticing that the network changed. That has
been happening on a phone driving a pump for as long as this has existed, and it
was only visible because `panic = "abort"` briefly turned the silence into a
crash.

The follower polled every fifteen minutes with the screen open. EVERY_SECONDS
was defined and never used — reported from the phone as a reading stuck six
minutes old in somebody's hand. The UI now asks every two minutes while it is
visible, and the periodic job stays underneath for the background. Driven from
the UI rather than chained inside the worker on purpose: a worker that
re-enqueues its own unique name with REPLACE cancels itself, which is a stall
that looks exactly like a quiet network.

CI is one repository again. No second checkout, no AAPS build, and nothing that
could produce a pump APK even by accident.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: alex-poor

.github/workflows/follower.yml

@@ -1,135 +1,79 @@
-# Build the FOLLOWER apk, and only ever the follower.
+# Build the follower app.
 #
-# WHAT THIS MUST NEVER BUILD: the `full` flavour. That is the app that drives an
-# insulin pump, and this repository does not distribute it — see the README.
-# Every gradle invocation here names `Aapsclient` explicitly for that reason,
-# and the check job fails the run if a `full` artifact appears anyway.
+# ONE REPOSITORY, NO ANDROIDAPS. The follower used to be a flavour of AAPS with
+# the dosing stripped out, which meant this workflow checked out a second repo,
+# built a whole loop app, and had to actively refuse to publish the pump variant.
+# The follower is now its own application containing no AAPS code at all, so
+# none of that applies: there is nothing here that could build a loop.
 #
-# The follower is a different proposition: a separate `applicationId`, no pump
-# drivers compiled in, and structurally unable to dose (decision D22). It is a
-# viewer for somebody else's glucose. Handing that to a person as a file they
-# can install is reasonable in a way that handing them a loop is not.
-#
-# The APK contains AndroidAPS, which is AGPL-3.0. Distributing a binary
-# therefore obliges us to publish the corresponding source: the fork and branch
-# it was built from are recorded in the release notes, at the exact commit.
+# That is also what makes it publishable. F-Droid builds one repository from
+# source, and this is one repository whose only unusual need is a Rust toolchain
+# to compile the record core into a .so — which is built here, never committed.
 
 name: follower apk
 
 on:
   workflow_dispatch:
-    inputs:
-      aaps_ref:
-        description: "Branch or commit of the AAPS fork to build against"
-        default: diaswarm-addon
   push:
     tags: ["follower-v*"]
+  pull_request:
+    paths: ["follower/**", "crates/**", ".github/workflows/follower.yml"]
 
 permissions:
   contents: write   # only to attach the apk to a release
 
-env:
-  AAPS_REPO: alex-poor/AndroidAPS
-  NDK_VERSION: "28.2.13676358"
-
 jobs:
   build:
     runs-on: ubuntu-latest
-    # Whether a signing key is configured, decided once. A step's own `env:`
-    # block is NOT visible to that step's `if:`, so testing the secret there
-    # silently never fires and every build comes out unsigned.
     env:
       HAS_KEY: ${{ secrets.FOLLOWER_KEYSTORE_B64 != '' }}
     steps:
-      - name: Check out diaswarm
-        uses: actions/checkout@v4
-        with:
-          path: diaswarm
-
-      # The follower is a build of this fork of AAPS, not of upstream: the
-      # screen it draws comes from the fork's own overview. AGPL means whatever
-      # is built here has to be publicly readable, so this checkout failing is
-      # a licence problem, not just a build problem.
-      - name: Check out the AAPS fork
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.AAPS_REPO }}
-          ref: ${{ github.event.inputs.aaps_ref || 'diaswarm-addon' }}
-          path: aaps
+      - uses: actions/checkout@v4
 
-      - name: JDK 21
-        uses: actions/setup-java@v4
+      - uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: "21"
 
       - name: NDK
         run: |
           set -euo pipefail
-          # Prefer whatever the runner already ships: an NDK is ~1 GB and the
-          # version matters only to cargo-ndk, which is not fussy.
           NDK="${ANDROID_NDK_LATEST_HOME:-}"
-          if [ -z "$NDK" ] || [ ! -d "$NDK" ]; then
-            SDKM="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
-            # `yes |` dies of SIGPIPE the moment sdkmanager stops reading, and
-            # under `pipefail` that fails the step even though the licences were
-            # accepted. Feed it a fixed number of yeses instead.
-            printf 'y\n%.0s' {1..50} | "$SDKM" --licenses >/dev/null 2>&1 || true
-            "$SDKM" "ndk;${NDK_VERSION}" >/dev/null
-            NDK="$ANDROID_HOME/ndk/${NDK_VERSION}"
-          fi
+          [ -n "$NDK" ] && [ -d "$NDK" ] || { echo "::error::no NDK on the runner"; exit 1; }
           echo "using NDK at $NDK"
           echo "ANDROID_NDK_HOME=$NDK" >> "$GITHUB_ENV"
 
-      # Pinned by rust-toolchain.toml in the diaswarm repo; the targets and
-      # cargo-ndk are what turn the record core into the .so the plugin packages.
       - name: Rust for Android
-        working-directory: diaswarm
         run: |
           set -euo pipefail
-          rustup show active-toolchain
           rustup target add aarch64-linux-android armv7-linux-androideabi
           cargo install cargo-ndk --locked
 
-      - name: Cache gradle and cargo
-        uses: actions/cache@v4
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
             ~/.cargo/registry
             ~/.cargo/git
-            diaswarm/crates/*/target
-          key: follower-${{ runner.os }}-${{ hashFiles('diaswarm/**/Cargo.lock', 'aaps/**/*.gradle*') }}
+            crates/*/target
+          key: follower-${{ runner.os }}-${{ hashFiles('**/Cargo.lock', 'follower/**/*.gradle*') }}
           restore-keys: follower-${{ runner.os }}-
 
+      # The record core is asserted byte-identical to tools/canon.py over real
+      # data; if that is broken there is no point building an app around it.
       - name: Test the record core
-        working-directory: diaswarm/crates/diaswarm-core
+        working-directory: crates/diaswarm-core
         run: cargo test
 
-      # Unsigned on purpose: the `release` build type carries no signingConfig,
-      # so nothing here can accidentally reuse the debug keystore that the loop
-      # build depends on.
-      - name: Build the follower
-        working-directory: aaps
-        env:
-          DIASWARM_PLUGIN_DIR: ${{ github.workspace }}/diaswarm/plugin
-        run: ./gradlew :app:assembleAapsclientRelease -PappVersionSuffix=follower --console=plain
-
-      - name: Refuse to ship a pump build
-        run: |
-          set -euo pipefail
-          if compgen -G "aaps/app/build/outputs/apk/full/**/*.apk" > /dev/null; then
-            echo "::error::a 'full' (pump) APK was produced — this workflow must build the follower only"
-            exit 1
-          fi
-          ls -la aaps/app/build/outputs/apk/aapsclient/release/
+      - name: Build
+        working-directory: follower
+        run: ./gradlew assembleRelease --console=plain
 
       # Signed only when a key is configured. Without one the run still produces
-      # an unsigned artifact, which is installable by nobody and reviewable by
-      # anybody — the right outcome for a fork or a pull request.
+      # an artifact — unsigned, so installable by nobody and reviewable by
+      # anybody, which is right for a fork or a pull request.
       - name: Sign
-        id: sign
         if: env.HAS_KEY == 'true'
         env:
           KEYSTORE_B64: ${{ secrets.FOLLOWER_KEYSTORE_B64 }}
@@ -140,22 +84,21 @@ jobs:
           set -euo pipefail
           BT=$(ls -1d "$ANDROID_HOME"/build-tools/*/ | sort -V | tail -1)
           echo "$KEYSTORE_B64" | base64 -d > /tmp/follower.jks
-          IN=aaps/app/build/outputs/apk/aapsclient/release/app-aapsclient-release-unsigned.apk
-          [ -f "$IN" ] || IN=$(ls aaps/app/build/outputs/apk/aapsclient/release/*.apk | head -1)
-          "${BT}zipalign" -p 4 "$IN" /tmp/follower-aligned.apk
+          IN=$(ls follower/build/outputs/apk/release/*.apk | head -1)
+          "${BT}zipalign" -f -p 4 "$IN" /tmp/aligned.apk
           "${BT}apksigner" sign \
             --ks /tmp/follower.jks --ks-pass "env:KS_PASS" \
             --ks-key-alias "$KEY_ALIAS" --key-pass "env:KEY_PASS" \
-            --out diaswarm-follower.apk /tmp/follower-aligned.apk
+            --out diaswarm-follower.apk /tmp/aligned.apk
           shred -u /tmp/follower.jks
           "${BT}apksigner" verify --print-certs diaswarm-follower.apk | tee signer.txt
+          ls -l diaswarm-follower.apk
 
       - name: Name the unsigned build for what it is
         if: env.HAS_KEY != 'true'
-        run: cp $(ls aaps/app/build/outputs/apk/aapsclient/release/*.apk | head -1) diaswarm-follower-UNSIGNED.apk
+        run: cp $(ls follower/build/outputs/apk/release/*.apk | head -1) diaswarm-follower-UNSIGNED.apk
 
-      - name: Upload
-        uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4
         with:
           name: diaswarm-follower
           path: |
@@ -168,21 +111,14 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          AAPS_SHA=$(git -C aaps rev-parse HEAD)
           cat > notes.md <<EOF
-          Follower app — shows somebody else's glucose. **It cannot dose.**
-
-          Separate \`applicationId\` (\`info.nightscout.aapsclient\`), no pump drivers
-          compiled in, installs alongside AAPS rather than over it.
-
-          **This is not the loop app, and this repository does not distribute one.**
+          Shows somebody else's glucose. **It cannot dose, and contains no loop code.**
 
-          Built from:
-          * diaswarm \`${GITHUB_SHA}\`
-          * AndroidAPS \`${AAPS_REPO}@${AAPS_SHA}\`
+          This is not AndroidAPS and does not contain it. To share your own data you
+          need the AAPS add-on, which you build yourself — this repository does not
+          distribute a loop and never will.
 
-          AndroidAPS is AGPL-3.0. The corresponding source for this binary is the
-          two commits above; both repositories are public.
+          Built from \`${GITHUB_SHA}\`.
           EOF
           gh release create "${GITHUB_REF_NAME}" diaswarm-follower*.apk \
             --repo "${GITHUB_REPOSITORY}" --title "${GITHUB_REF_NAME}" --notes-file notes.md

crates/diaswarm-android/Cargo.lock

@@ -18,6 +18,8 @@ jni = "0.21"
 serde_json = "1"
 p2panda-core = "=0.7.1"
 diaswarm-spaces = { path = "../diaswarm-spaces" }
+# Hands Android's Context to the iroh stack — see `initAndroid`.
+ndk-context = "0.1.1"
 
 # WHAT SHIPS ON A PHONE, and it was 39 MB per ABI before this.
 #

crates/diaswarm-android/Cargo.toml

@@ -28,6 +28,46 @@ use std::path::{Path, PathBuf};
 use diaswarm_core::vault::{hex, Identity, Vault};
 use diaswarm_core::{epoch_of, header, Emitted, Record};
 
+/// Give the network stack Android's `Context`, once, before anything else.
+///
+/// **WITHOUT THIS, A TASK DIES EVERY RUN AND NOTHING SAYS SO.** iroh watches for
+/// network changes by asking Android for a ConnectivityManager through
+/// `ndk_context`, which panics with "android context was not initialized" if
+/// nobody has handed one over. That panic happens inside a tokio task, so tokio
+/// catches it, the task disappears, and the swarm carries on — without ever
+/// noticing that wifi dropped and mobile data took over. It was doing exactly
+/// that on a phone driving a pump for as long as this has existed, and it was
+/// only found because turning on `panic = "abort"` for a smaller binary turned
+/// the silence into a crash on launch.
+///
+/// The Context is held as a global ref for the life of the process on purpose:
+/// `ndk_context` keeps the raw pointer, so letting the JNI local reference lapse
+/// would leave it dangling.
+///
+/// Safe to call more than once; the second call does nothing rather than
+/// re-registering a second Context.
+#[no_mangle]
+pub extern "system" fn Java_nz_diaswarm_jni_SwarmNative_initAndroid<'a>(
+    env: JNIEnv<'a>,
+    _class: JClass<'a>,
+    context: jni::objects::JObject<'a>,
+) {
+    static DONE: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+    if DONE.swap(true, std::sync::atomic::Ordering::SeqCst) {
+        return;
+    }
+    let Ok(vm) = env.get_java_vm() else { return };
+    let Ok(global) = env.new_global_ref(context) else { return };
+    unsafe {
+        ndk_context::initialize_android_context(
+            vm.get_java_vm_pointer() as *mut std::ffi::c_void,
+            global.as_raw() as *mut std::ffi::c_void,
+        );
+    }
+    // The pointer above outlives this scope, so the reference has to as well.
+    std::mem::forget(global);
+}
+
 /// Which version of `spec/records.md` this build implements.
 ///
 /// The plugin should refuse to publish if this disagrees with what it expects:

crates/diaswarm-android/src/lib.rs

@@ -33,6 +33,9 @@ object Endpoint {
     fun start(context: Context) {
         if (handle != 0L) return
         SwarmNative.check()
+        // BEFORE THE ENDPOINT, because the network stack reaches for it as soon
+        // as it starts watching for connectivity changes.
+        SwarmNative.initAndroid(context.applicationContext)
         val h = SwarmNative.swarmJoin(
             SwarmPaths.store(context).absolutePath,
             SwarmPaths.nodeKey(context).absolutePath

follower/src/main/kotlin/nz/diaswarm/follower/Endpoint.kt

@@ -36,6 +36,22 @@ fun FollowerApp(onScan: () -> Unit, scanned: String?, onScanHandled: () -> Unit)
     // about.
     LaunchedEffect(Unit) { while (true) { delay(15_000); tick++ } }
 
+    // AND ACTUALLY FETCH WHILE SOMEBODY IS WATCHING. The periodic job's floor is
+    // fifteen minutes, which is useless to a person looking at the screen: a
+    // reading arrives every minute or five and they would see it a quarter of an
+    // hour later. This was exactly the symptom — an app open in the hand,
+    // showing a number six minutes old and never moving.
+    //
+    // Driven from the UI rather than chained from inside the worker on purpose.
+    // A worker that re-enqueues its OWN unique name with REPLACE cancels itself,
+    // which is a silent stall that looks precisely like a quiet network.
+    LaunchedEffect(Unit) {
+        while (true) {
+            Sync.now(context)
+            delay(SyncWorker.EVERY_SECONDS * 1000)
+        }
+    }
+
     scanned?.let { text ->
         LaunchedEffect(text) {
             Invites.queue(context, text)

follower/src/main/kotlin/nz/diaswarm/follower/FollowerApp.kt

@@ -46,11 +46,7 @@ class MainActivity : ComponentActivity() {
         super.onResume()
         // Ask now rather than waiting for the poll: somebody opening the app is
         // the one moment they are definitely waiting for an answer.
-        WorkManager.getInstance(this).enqueueUniqueWork(
-            SyncWorker.UNIQUE + "-now",
-            ExistingWorkPolicy.KEEP,
-            OneTimeWorkRequestBuilder<SyncWorker>().build()
-        )
+        Sync.now(this)
     }
 
     private fun scanOptions() = ScanOptions().apply {

follower/src/main/kotlin/nz/diaswarm/follower/MainActivity.kt

@@ -55,6 +55,34 @@ class SyncWorker(context: Context, params: WorkerParameters) : Worker(context, p
     companion object {
         const val TAG = "diaswarm"
         const val UNIQUE = "diaswarm-sync"
+
+        /**
+         * How often to ask while somebody is looking at the screen.
+         *
+         * A CGM produces a reading every one to five minutes, so asking faster
+         * mostly discovers that nothing changed — and still costs a connection.
+         */
         const val EVERY_SECONDS = 120L
     }
 }
+
+/** The one place that asks for a pass, so there is one policy and not three. */
+object Sync {
+
+    private const val NOW = "diaswarm-sync-now"
+
+    /**
+     * Ask for a pass now.
+     *
+     * `KEEP`, so a pass already running is left to finish: it is about to do
+     * this work anyway, and cancelling it mid-fetch to start again is how a
+     * refresh loop becomes a refresh stall.
+     */
+    fun now(context: android.content.Context) {
+        androidx.work.WorkManager.getInstance(context).enqueueUniqueWork(
+            NOW,
+            androidx.work.ExistingWorkPolicy.KEEP,
+            androidx.work.OneTimeWorkRequestBuilder<SyncWorker>().build()
+        )
+    }
+}

follower/src/main/kotlin/nz/diaswarm/follower/SyncWorker.kt

@@ -20,6 +20,17 @@ package nz.diaswarm.jni
 object SwarmNative {
 
     /** Must match the spec version the plugin was written against. See [check]. */
+    /**
+     * Hand Android's `Context` to the network stack, once, before anything else.
+     *
+     * iroh watches for network changes through Android's ConnectivityManager;
+     * without a Context it panics inside a tokio task, the task vanishes, and
+     * the swarm keeps running with no idea that wifi dropped. Pass the
+     * APPLICATION context — an Activity would be leaked for the life of the
+     * process, because the native side keeps the reference for ever.
+     */
+    external fun initAndroid(context: android.content.Context)
+
     external fun specVersion(): Int
 
     /**