fix(agent): enrollment screen refuses when already enrolled; retry loop re-checks identity

[quadseven]

Refs #105. Part of #121.

Why

The enrollment screen kept trying after the device was already enrolled, and force-quitting was the only way out. Measured on the second Pixel: it held a valid identity at 22:55:15 and the screen was still presenting at 22:57:52, logging code-used refusals. To the operator that looks like enrollment failed, for an enrollment that had succeeded two minutes earlier. Two defects compose: EnrollActivity never asked whether the device was enrolled, and the retry loop never re-checked.

Summary

 EnrollActivity.onCreate
+  if flow.isEnrolled()
+    say "This device is already enrolled."; disable form; return
 EnrollmentFlow
+  isEnrolled() = store.hasIdentity()
   present(code)
+    if enrolled: return Enrolled        # before the keystore or the network
   collect(requestId)
+    if enrolled: return Enrolled        # a stray poll cannot overwrite it

Back still leaves the screen; nothing traps the operator.

Evidence

• Before: with both guards removed, anAlreadyEnrolledDeviceIsToldSoInsteadOfPresenting and aCertificateArrivingByAnotherRouteEndsThePoll fail.
  After: the agent JVM harness gives 335 tests passed (MUSTER_JDK pointing at an arm64 JDK 17).

Merge Danger

Door: two-way. Reverting restores the old retry behavior.

Blast Radius: the enrollment screen. A device that already holds an identity can no longer present a code from this screen; re-enrolling it means clearing the app's data. That is what #105 asked for, and re-presenting reuses the same key, so it could only re-join as the same device.

Acceptance criteria

• An enrolled device opening the enrollment screen is told it is enrolled
• A spent code is never re-presented, and a certificate arriving while the screen is open ends the retry loop
• Verified on a handset: enroll, then reopen the enrollment screen (needs a handset; tracked on The enrollment screen keeps trying after the device is enrolled, and force-quit is the only way out #105)

Size: S

Out of scope

Resuming a poll across an activity restart, which is filed separately.

https://claude.ai/code/session_01UkWktkaYXZwdwzUvZQrN9q

[grug-tribe]

Walkthrough

This PR resolves muster#105, where an already-enrolled device was being shown the enrollment form and could re-present a spent pairing code. The enrollment flow now checks for an existing identity at three points—when the screen opens, before each present, and before each collect poll—returning Enrolled immediately instead of touching the network or keystore. The EnrollActivity disables (rather than hides) the form and informs the operator, so the screen still reads as the enrollment screen and the back button remains functional. Tests cover both the upfront refusal and the mid-poll exit.

Review effort: moderate (~15 min)

Changed files (3)

File	Summary	Changes
agent/android/app/src/main/java/app/muster/agent/EnrollActivity.kt	Added an isEnrolled guard that disables the form and shows a message when the device is already enrolled.	+12/-0
agent/android/app/src/main/java/app/muster/agent/EnrollmentFlow.kt	Added isEnrolled() and early Enrolled returns in present() and collect() so an existing identity short-circuits before network or keystore use.	+24/-2
agent/android/app/src/test/java/app/muster/agent/EnrollmentFlowTest.kt	Added two tests: presenting while enrolled returns Enrolled without network, and a certificate arriving mid-poll exits the collect loop.	+36/-0

Shape of the change

graph TD
  subgraph "agent"
    N0["EnrollActivity.kt"]
    N1["EnrollmentFlow.kt"]
    N2["EnrollmentFlowTest.kt"]
  end

Loading

Last walked at 3c0785b60008.