Community capture and Home source consolidation

Status: LOCAL_DONE Validation: PASS

Opening: 2026-10-14, codex/community-first at c0752909; continuation of PR135 under the maintainer's explicit request. Main/dev and the occupied primary dirty evidence adapter remain preserved. No deployment or device operation is implied.

Frozen behavior before implementation

B-BR-CF08 / BUC-CF06: remove developer capture UI and gallery/test-policy issuance from both Android variants. The ordinary camera→OCR→explicit review→signed upload/outbox→server receipt journey remains free and independent of GPS. Require canonical station selection, account proof, camera permission, immutable receipt/evidence deadlines and existing quotas/privacy. Previously saved developer reviews refuse with recovery, never become ordinary evidence. Server legacy receipt consumption remains compatible; removing the app mode does not rewrite audit history.

B-BR-CF09 / BUC-CF07: Home has an ANP / Community source selector. Each source uses the existing average/minimum/maximum filter. ANP retains its selected survey-week provenance; community summarizes the latest live STANDARD price projection for each active station in the selected municipality, one equal-weight station sample per product/unit. Do not average raw observations, helpfulness votes, historical prices or only the first feed page. Exclude expired, unknown/disputed, future-anchor and nonstandard-condition rows. Exact integer milli-BRL statistics; arithmetic mean rounds to the nearest milli-BRL, half upward. Currency, products and units never mix. No samples means unavailable, never an ANP substitution.

Community data updates by bounded foreground refresh on entry/resume, manual retry and every 15 seconds while Home displays Community. Cancel when hidden or switching source/city; late results cannot replace a newer city/request. Label the community sample count and update time separately from the weekly ANP source. This is near-real-time polling of committed projections, not a live ANP feed or a guarantee of immediate worker completion. Home must work for Community even without downloaded ANP history; offline/error states do not present cached community values as fresh.

The public station price contract merges official and community product/unit keys, including community-only stations; source sections stay typed and independent. Loading/pagination uses bounded queries and stable station UUID tie-breaks. Feed pagination cannot determine a city's aggregate; mutable live feeds may move between pages, so refresh resets pagination and clients deduplicate station IDs. Public outputs contain no contributor identity/GPS/private media.

Bounded execution

• CFR01: remove app development capture ingress; test ordinary no-GPS capture/legacy recovery and debug/release/static compilation.
• CFR02: typed community station price loading and community-only product keys; immediate SQL/HTTP/codec negative/expiry/source tests.
• CFR03: one bounded municipal summary query and public endpoint, full-population/sample isolation and deterministic pagination tests against disposable PostGIS.
• CFR04: Home source selector, shared three filters, lifecycle-scoped community refresh with cancellation/error/city guards, localized source/freshness states; JVM/lint/build acceptance.
• CFR05: final evidence, source checks, atomic commits and cumulative PR135 update. No main merge/deploy/wiki; PRM22 remains DEFERRED. Native/staging execution remains OWED.

CFR01 checkpoint

LOCAL_DONE / INTEGRATION_PENDING: removed debug/release DeveloperCaptureMode/Controls and DevelopmentPhotoCapture issuance adapters, their switch/gallery ingress and developer-only strings. Normal nominal search now has ordinary station-city/query/result names. Removed obsolete station-area gate UI. Camera always requests the normal v2 policy and refuses developer receipts; saved developer reviews still cannot enter either submission path. Ordinary camera tests replace the obsolete mode-specific campaigns and run in shared debug/release sources, preserving signed review/subset/received/partial/precision/changed-station assertions. Focused CaptureOcrViewModel, NormalCameraContribution and PhotoCaptureHttpClient JVM campaign PASS (Gradle 1m13s). Full variant/lint checks belong to final acceptance. No GPS prompt or developer authorization is added to the normal journey.

CFR02 checkpoint

LOCAL_DONE / INTEGRATION_PENDING: RED codec regression reproduced rejection of a valid community section; GREEN typed BackendCommunitySection keeps independent ANP/community provenance, integer money, counts/revisions/freshness/expiry and Room JSON round-trip, refusing malformed/fractional money. Domain and focused codec suites PASS (9s). Server groups now union community-only product/unit keys through an explicit batch port; production reads one station projection batch instead of one lookup per ANP group. Missing ANP remains null. New HTTP batch/outage test and affected read/HTTP race units PASS; new actual PostGIS station-only/filter/expiry/invalid-ID test PASS (1.523s). No official facts or existing receipt policies changed.

CFR03 checkpoint

LOCAL_DONE / INTEGRATION_PENDING: new anonymous no-store /v1/community/summary consolidates the full municipal projection population in one SQL snapshot, returning at most eight product/unit groups. Equal station weighting, half-up integer milli-BRL mean, min/max and sample count; source/city/unit/condition/expiry/future/hidden-representative exclusions are explicit. No extra service, job or migration. Real PostGIS: 65-station population agrees with complete cheapest/recent/best/worst keyset traversals without duplicates/omissions; exclusions, immediate committed update and independent expiry PASS. Separate exact-half rounding/CNG isolation/uncommitted-versus-committed snapshot PASS. Actual generated-query tracer proves one round trip over 1,500 stations; actual EXPLAIN includes aggregation (2.278s). Full affected read/HTTP/official HTTP race/PostGIS suites PASS (15.468s/6.578s/2.730s); sqlc vet/drift and API-contract reference tests PASS. HTTP invalid scope/missing reader/redacted outage return errors, not empty success. App feed already resets/deduplicates live pages; municipal summary is independent of pagination. ANP facts remain unchanged.

CFR04 checkpoint

LOCAL_DONE / INTEGRATION_PENDING: Home ANP / Community source selector keeps the existing average/minimum/maximum filter and separate source lists. Community works without an ANP cache, uses the full-city endpoint, shows exact milli-BRL/sample counts/units and the actual latest observation update time. ANP retains its survey-week controls; those controls and ANP sync readiness do not gate Community. Foreground-only 15-second refresh, manual retry, cancellation/session leases and city/request generations prevent obsolete responses or old lifecycle cleanup from affecting a new screen. Failed/expired/empty community data never falls back to ANP. Typed station-price UI now renders live community values and suppresses expired/stale values instead of the former unconditional UNKNOWN placeholder. True premium-grade wire support is aligned with the existing eight-product mapper, preserving its distinction from additived gasoline.

Domain/data/application/app full JVM campaign PASS: domain 539, application 353, data 368, app 323 = 1,583 discovered / 1,581 executed, zero failures/errors; two existing explicit opt-in data skips. Unchanged 90% domain instruction gate PASS at 21,157/23,458 = 90.1910%. Full lint/debug/release/native-test APK compilation PASS (2m57s). Final Home presentation adjustment revalidated all 12 Home JVM cases, lint/debug/native compile (49s) and release separately (1m4s). A parallel incremental lint rerun encountered an internal NoSuchFileException while release Hilt regenerated files; resolved by sequential no-parallel/max-workers=1 execution with a fresh lint process. No lint rule disabled or test weakened. Two intermediate named-argument/import compilation errors were fixed before acceptance. Native selector/three-statistic regression added and compiled; execution remains OWED.

Real process follow-up PASS (10.841s): ordinary signed no-GPS capture→private upload→worker validation→consensus projection→anonymous Home summary has the correct ETHANOL mean/min/max 5899 and one station, then community-only station groups carry that same amount with official=null. Existing signed helpfulness/report campaign follows; no extra challenge quota. Full earlier actual normal/debug compatibility API-worker/private S3 campaign PASS (37.135s). Backend fast gate, SQL generation/vet/drift, API references, mobile static and govulncheck (no vulnerabilities) PASS.

CFR05 final source handoff

Tested behavior revision: 8e6f8387. Base remains origin/main 68483db9; maintained origin/dev 757c09ae is included, occupied checkouts remain untouched. PR135 is OPEN, targeting main; update the same PR with this continuation, preserving all commits. Required Quick verification/current-head/base review remains an integration gate; no main merge or wiki publication is authorized by this continuation.

Final Android debug APK: 25,772,180 bytes, SHA-256 b6e78a6e889b14a045027702e2ed6fc8f13d002c5458986c73ff4dc852289ecd. Unsigned release: 4,486,228 bytes, SHA-256 49c91e09731bedd2410de52d6b3e57eb195beaafb0a8652d819058cd4b711198. Actual DEX inspection of both artifacts PASS: DeveloperCaptureMode, DeveloperCaptureControls, DevelopmentPhotoCapture and development_preview request flag are absent. Source search confirms no app issuance API or mode controls remain. Legacy server receipt tests are compatibility evidence, not an app mode.

Final validation commands: the Android union is :domain:test :domain:jacocoTestCoverageVerification :application:test :data:testDebugUnitTest :app:testDebugUnitTest :app:lintDebug :app:assembleDebug :app:assembleRelease :data:assembleDebugAndroidTest :app:assembleDebugAndroidTest; final affected Home/lint/debug/native compilation uses --no-daemon --no-parallel --max-workers=1, then :app:assembleRelease --no-parallel --max-workers=1 separately. Backend bash scripts/check-backend-fast.sh, govulncheck ./..., sqlc vet, sqlc diff, API-contract tests and actual race/PostGIS/process campaigns passed as recorded above. Mobile static, repository baseline/secret guard and git diff --check PASS. No dependency added, no coverage threshold reduced, no quota increased.

Disposable fixture owner: cfr-home-20261014, unique loopback PostGIS/private MinIO, synthetic records only. Stop/remove only this owned project after validation. Raw logs remain outside Git at /tmp/cfr-*; no credentials/photos/contributor GPS entered the repository.

Operational rollout remains the prepared PRM21-T02 sequence: compatible schema/worker/API (including summary endpoint) before the APK. Old staging without /v1/community/summary produces recoverable service-unavailable UI, never fake ANP substitution. App/DB rollback must preserve Room13 and immutable valid receipts/drafts; no destructive downgrade. Actual staging installation, device/native execution, live provider retention/intake/capacity and operator proof remain OWED. This source acceptance does not claim the user's installed app or VPS already runs this candidate. PRM22 stays DEFERRED with no new proximity authorization.