fix(widget): a widget tap no longer auto-scans again after sign-out and sign-in

The home-screen widget's "open Claim and scan" request was a counter in
_PostboxGameState that only ever grew: nothing reset it on sign-out. So
after any widget launch or tap, every later sign-in for the rest of the
process (including a different account, or a new account after deletion)
opened on the Claim tab and started a GPS scan unasked.

The counter now lives in WidgetAutoScanRequests, which drops a pending
scan on a real sign-out (Authenticated -> Unauthenticated) but keeps one
made while signed out, so a cold start from the widget, or a tap on the
login screen, still scans once the player has signed in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: code418

lib/deep_links.dart

@@ -32,6 +32,34 @@ bool isWidgetClaimDeepLink(Uri? uri) =>
     uri.host == 'claim' &&
     uri.queryParameters['source'] == 'widget';
 
+/// Counts home-screen-widget taps that should open Claim and auto-scan.
+///
+/// The app keys its Home on [epoch], so each bump remounts Home on the Claim
+/// tab with a scan running. A tap asks for ONE scan: once a signed-in Home
+/// has used it, signing out must drop it, or the next sign-in (possibly a
+/// different account) would land on Claim and start a GPS scan unasked. A
+/// tap made while signed out (including a cold start from the widget) still
+/// carries through the login, which is what the tap asked for.
+class WidgetAutoScanRequests {
+  WidgetAutoScanRequests({bool launchedFromWidget = false})
+      : _epoch = launchedFromWidget ? 1 : 0;
+
+  int _epoch;
+  bool _signedIn = false;
+
+  /// 0 when no scan is pending; otherwise changes on every tap.
+  int get epoch => _epoch;
+
+  void tapped() => _epoch++;
+
+  void signedIn() => _signedIn = true;
+
+  void signedOut() {
+    if (_signedIn) _epoch = 0;
+    _signedIn = false;
+  }
+}
+
 /// Whether [routeName] is the engine's named-route echo of one of the app's
 /// own claim deep links: `postbox://claim?source=widget` has no path, so it
 /// arrives as `/?source=widget`. See [unknownRoute].

lib/main.dart

@@ -163,13 +163,14 @@ class _PostboxGameState extends State<PostboxGame> with WidgetsBindingObserver {
   final UserRepository _userRepository = UserRepository();
   final HomeWidgetService _homeWidgetService = HomeWidgetService();
   StreamSubscription<Uri?>? _widgetClickSub;
-  // Monotonic counter of widget-deep-link activations. Each increment is used
-  // as part of the Home widget's key so a widget tap while the app is warm
+  // Widget-deep-link activations. Each tap bumps the epoch, which is used as
+  // part of the Home widget's key so a widget tap while the app is warm
   // (already authenticated) forces a fresh Home + Claim mount rather than
   // re-using the existing _HomeState — the previous _pages/_selectedIndex
   // were initialised from `late final` fields and would otherwise ignore the
-  // new autoScan/initialIndex props.
-  int _autoScanEpoch = _pendingWidgetAutoScan ? 1 : 0;
+  // new autoScan/initialIndex props. Reset on sign-out (see the class).
+  final WidgetAutoScanRequests _autoScan =
+      WidgetAutoScanRequests(launchedFromWidget: _pendingWidgetAutoScan);
 
   @override
   void initState() {
@@ -182,7 +183,7 @@ class _PostboxGameState extends State<PostboxGame> with WidgetsBindingObserver {
     try {
       _widgetClickSub = HomeWidget.widgetClicked.listen((uri) {
         if (isWidgetClaimDeepLink(uri)) {
-          setState(() => _autoScanEpoch++);
+          setState(_autoScan.tapped);
         }
       });
     } catch (_) {
@@ -240,6 +241,7 @@ class _PostboxGameState extends State<PostboxGame> with WidgetsBindingObserver {
           home: BlocConsumer<AuthenticationBloc, AuthenticationState?>(
             listener: (context, state) {
               if (state is Authenticated) {
+                _autoScan.signedIn();
                 unawaited(NotificationService.init());
                 unawaited(_homeWidgetService.refresh());
                 // Force a fresh Remote Config fetch on login (bypassing the
@@ -258,6 +260,8 @@ class _PostboxGameState extends State<PostboxGame> with WidgetsBindingObserver {
                   unawaited(publishUserPropertiesFromFirestore(uid));
                 }
               } else if (state is Unauthenticated) {
+                // Read by the builder that runs right after this listener.
+                _autoScan.signedOut();
                 unawaited(NotificationService.reset());
                 unawaited(_homeWidgetService.refresh());
                 // Forget any admin-claim result cached against the previous
@@ -285,15 +289,16 @@ class _PostboxGameState extends State<PostboxGame> with WidgetsBindingObserver {
                 // ConsentGate is a pass-through for anyone who has made the
                 // analytics choice (new users decide in the intro); existing
                 // installs get a one-time consent prompt before Home.
-                if (_autoScanEpoch > 0) {
+                final autoScanEpoch = _autoScan.epoch;
+                if (autoScanEpoch > 0) {
                   // Keying on the epoch forces a fresh Home + Claim mount on
                   // each widget tap. Without the key, Flutter reconciles the
                   // existing _HomeState whose `late final _pages` was built
                   // with autoScan=false, so the new props are ignored and no
                   // scan fires.
                   return ConsentGate(
                     child: Home(
-                      key: ValueKey('claim-widget-$_autoScanEpoch'),
+                      key: ValueKey('claim-widget-$autoScanEpoch'),
                       initialIndex: 1,
                       autoScan: true,
                     ),

test/widget_test.dart

@@ -150,6 +150,48 @@ void main() {
     });
   });
 
+  group('WidgetAutoScanRequests', () {
+    test('a sign-out drops a tap that a signed-in Home already used', () {
+      // Otherwise the next sign-in (maybe another account) opens on Claim
+      // and starts a GPS scan nobody asked for.
+      final r = WidgetAutoScanRequests()..signedIn();
+      expect(r.epoch, 0);
+      r.tapped();
+      expect(r.epoch, 1);
+      r.signedOut();
+      expect(r.epoch, 0);
+      r.signedIn();
+      expect(r.epoch, 0);
+    });
+
+    test('a cold start from the widget while signed out survives login', () {
+      final r = WidgetAutoScanRequests(launchedFromWidget: true);
+      expect(r.epoch, 1);
+      r.signedOut(); // the initial Unauthenticated state, not a sign-out
+      expect(r.epoch, 1);
+      r.signedIn();
+      expect(r.epoch, 1);
+    });
+
+    test('a tap made on the login screen survives login', () {
+      final r = WidgetAutoScanRequests()
+        ..signedIn()
+        ..signedOut()
+        ..tapped();
+      r.signedIn();
+      expect(r.epoch, 1);
+    });
+
+    test('every warm tap changes the epoch so Home remounts', () {
+      final r = WidgetAutoScanRequests()..signedIn();
+      final seen = <int>{};
+      for (var i = 0; i < 3; i++) {
+        r.tapped();
+        expect(seen.add(r.epoch), isTrue);
+      }
+    });
+  });
+
   group('unknown deep-link routes', () {
     // Regression for a FATAL production crash (Crashlytics
     // _WidgetsAppState._onUnknownRoute, "Null check operator used on a null