fix(linux): the Pomodoro timer shows in the top bar from the snap too

From the snap, nothing showed in the top bar: AppArmor refused the
item's bus name (dbus_bind org.freedesktop.StatusNotifierItem-<pid>-1),
which snapd's desktop plug doesn't grant, contrary to what the research
found. The item is now laid out as libayatana-appindicator lays itself
out, within what snapd v2.77's desktop-legacy plug allows: at
/org/ayatana/NotificationItem/halkyon_learn, the only path from which
the label's signal (XAyatanaNewLabel) may come, and registered with the
watcher by that path under the connection's own name, binding no name
at all. Checked against GNOME's watcher here: it registers as the
system's own indicators do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

AGENTS.md

@@ -143,7 +143,7 @@ A spaced-repetition learning app: studysets of flashcards, reviewed on an FSRS s
   - **Tree, tags, modes, settings and files** (ADR 0004): a studyset's `parent` and sibling `position` form the tree, and studysets in a cycle or without their parent show at the top level (`topLevel`); its `archivedAt`, `starredAt` and `updatedAt` are columns, and every change of a studyset writes `updatedAt` with it (the library lists starred studysets first, then the most recently changed); a card's tags are `card_tag` rows, one per assignment, never updated, and a duplicate counts once; `review_log.mode` is `review`, `reverse` (its own schedule) or `cram` (never moves a schedule), and a schedule replays the reviews of one mode; `person_settings` is meant as one row per person, and extra rows fold into the one with the smallest id; an `asset` row stands for a file in private cloud storage, found by its hash. **Never derive a row's id from a person or anything else guessable**: ids are unique across the whole table, so someone could claim it first in their own space and break the owner's sync.
   - **Files** (ADR 0004, rule 5): `AssetEndpoint` (`requireLogin`) takes uploads into the caller's own space by SHA-256 (`startUpload` gives Serverpod's upload description, or null when the file is there already and claims it anew; `finishUpload` keeps it only if its content has that hash) and serves an asset row's file to its space's owner and members only, `NotFoundException` otherwise, also for a deleted row (the sync engine hides tombstones). Files live in the private database storage at `spaces/<space>/<sha256>`, at most 20 MB each, and within limits (`file_limits.dart`, from the environment: an anonymous person 100 MB, an identified one 500 MB or what a `file_allowance` row grants them, the instance 15 GB), checked when an upload starts (unfinished uploads count, or they could fill the disk unnoticed) and again when it finishes (only what is kept counts), refused with `FileLimitExceededException`; `deletePerson` deletes the person's files and allowance, and `FilePruningFutureCall` deletes daily those no live row refers to (or never finished), 7 days after they were last claimed. In the app, `AssetRepository` (`core/asset/`) keeps files by hash in the person's folder (`files/`, uploads waiting marked in `files/uploads/`), uploads after each sync that went through, and downloads on demand, checking the hash; every hash is checked to be one before it becomes part of a path. Content names a file by the URL `asset:<asset row id>` (`assetUrl`, `RichContent.assetIds`): images are the editor's `image` block, sounds an `audio` block (`core/editor/file_blocks.dart`), and any other URL is never fetched. `StoredFileImage` loads through the repository like Flutter's `NetworkImage`, keyed by the person's repository too, so no image crosses people.
   - **PDFs** (`feature/pdf_source/`): a `pdf_source` row per PDF in a studyset (payload: title, file name, the asset of its file, page count, reading deadline; last writer wins) and an append-only `pdf_reading` log (`reached` with a page, `reset`): the furthest page is the furthest reached since the last reset, so devices never conflict. A PDF's file is an asset of up to 50 MB (other files 20 MB): the server takes up to 50 MB and deletes a stored file over 20 MB that doesn't start with `%PDF-`. Deleting a PDF deletes its asset row too unless another PDF has the same file (asset rows are otherwise never deleted). Cards and notes tied to a page keep it in their payload (`source`, `core/content/pdf_page_ref.dart`; card schema 4, note schema 2); a screenshot is an `image` block with `pdf` and `page` attributes.
-  - **The Pomodoro timer** (`feature/pomodoro/`): the profiles follow the person (`PersonSettings.pomodoro`, settings schema 4), the running timer is the device's own (`PomodoroRun` in `<person folder>/pomodoro.json`, `PomodoroRunStore`). `PomodoroRun` is a pure state machine on the time: a phase that ends leads to the next, running if its profile starts it by itself, else paused at its full length; a timer kept while the app was closed catches up (`caughtUpTo`). `PomodoroBloc` sits above the router (`PersonApp`), and `PomodoroPresenter` hands every change to `PomodoroPlatform` as a `PomodoroNotice` in the app's language, and its buttons back. **Android:** the app's own Kotlin (`PomodoroService.kt`; MethodChannel `app.halkyon.learn/pomodoro`, EventChannel `…/buttons`): a `specialUse` foreground service with a countdown notification (chronometer), Pause/Resume, Skip, Stop, on Android 16 a Live Update (`NotificationCompat.ProgressStyle`, the cycle's phases as segments, `setRequestPromotedOngoing`); an exact alarm (`USE_EXACT_ALARM`) alerts at the phase's end with the app closed; Do Not Disturb through the interruption filter, the one before kept in shared preferences and restored. With the app swiped away its buttons open it (a service may not start an activity from a notification's button since Android 12, so the notification is posted again with activity intents), and Stop works alone, leaving a mark the app takes at its next start (`takeStoppedOutside`) to forget its timer; a profile's next phase only starts by itself while the app runs. Dart's timers sleep with the device, so `PomodoroBloc` also looks every 15 s while a phase runs, and the alarm's receiver wakes it (`phaseEnds`); a kept timer is caught up before it first shows, or its ended phase would alert again. No notification plugin: flutter_local_notifications had Live Updates only in a prerelease needing compileSdk 37 (checked 2026-10-07). **Linux:** `LinuxPomodoroPlatform`, over package:dbus: where the top bar shows icons (GNOME with the AppIndicator extension, built into Ubuntu; KDE) the timer counts down there with its buttons in the icon's menu (`StatusNotifierItem`, written in Dart on the bus name `org.freedesktop.StatusNotifierItem-<pid>-1`, `/StatusNotifierItem` and `/MenuBar`, which the snap's `desktop` plug allows; registered again when the watcher restarts); elsewhere the timer shows in the app alone, and on GNOME the Pomodoro card suggests the extension until dismissed, asking GNOME Shell to install or switch it on (`InstallRemoteExtension`, `EnableExtension`) or opening its page (decided 2026-10-07: no notification stands in; xdg-desktop-portal's Background status is for Flatpaks only). An alert with sound comes through `org.freedesktop.Notifications` when a phase ends while the app runs, and GNOME's `show-banners` goes off while focusing, through `gsettings`; the value before and the dismissed suggestion are kept in `<app support>/`. Calls to the bus go one at a time (`SerialQueue`).
+  - **The Pomodoro timer** (`feature/pomodoro/`): the profiles follow the person (`PersonSettings.pomodoro`, settings schema 4), the running timer is the device's own (`PomodoroRun` in `<person folder>/pomodoro.json`, `PomodoroRunStore`). `PomodoroRun` is a pure state machine on the time: a phase that ends leads to the next, running if its profile starts it by itself, else paused at its full length; a timer kept while the app was closed catches up (`caughtUpTo`). `PomodoroBloc` sits above the router (`PersonApp`), and `PomodoroPresenter` hands every change to `PomodoroPlatform` as a `PomodoroNotice` in the app's language, and its buttons back. **Android:** the app's own Kotlin (`PomodoroService.kt`; MethodChannel `app.halkyon.learn/pomodoro`, EventChannel `…/buttons`): a `specialUse` foreground service with a countdown notification (chronometer), Pause/Resume, Skip, Stop, on Android 16 a Live Update (`NotificationCompat.ProgressStyle`, the cycle's phases as segments, `setRequestPromotedOngoing`); an exact alarm (`USE_EXACT_ALARM`) alerts at the phase's end with the app closed; Do Not Disturb through the interruption filter, the one before kept in shared preferences and restored. With the app swiped away its buttons open it (a service may not start an activity from a notification's button since Android 12, so the notification is posted again with activity intents), and Stop works alone, leaving a mark the app takes at its next start (`takeStoppedOutside`) to forget its timer; a profile's next phase only starts by itself while the app runs. Dart's timers sleep with the device, so `PomodoroBloc` also looks every 15 s while a phase runs, and the alarm's receiver wakes it (`phaseEnds`); a kept timer is caught up before it first shows, or its ended phase would alert again. No notification plugin: flutter_local_notifications had Live Updates only in a prerelease needing compileSdk 37 (checked 2026-10-07). **Linux:** `LinuxPomodoroPlatform`, over package:dbus: where the top bar shows icons (GNOME with the AppIndicator extension, built into Ubuntu; KDE) the timer counts down there with its buttons in the icon's menu (`StatusNotifierItem`, written in Dart and laid out as libayatana-appindicator lays itself out, within the snap's rules, `desktop-legacy` of snapd v2.77: the item at `/org/ayatana/NotificationItem/<id>`, the only path the label's signal `XAyatanaNewLabel` may come from, registered with the watcher by that path, since a snap may bind no `org.freedesktop.StatusNotifierItem-*` name; the menu at `/MenuBar`; registered again when the watcher restarts); elsewhere the timer shows in the app alone, and on GNOME the Pomodoro card suggests the extension until dismissed, asking GNOME Shell to install or switch it on (`InstallRemoteExtension`, `EnableExtension`) or opening its page (decided 2026-10-07: no notification stands in; xdg-desktop-portal's Background status is for Flatpaks only). An alert with sound comes through `org.freedesktop.Notifications` when a phase ends while the app runs, and GNOME's `show-banners` goes off while focusing, through `gsettings`; the value before and the dismissed suggestion are kept in `<app support>/`. Calls to the bus go one at a time (`SerialQueue`).
   - **Imported cards** say where they came from in their first revision's payload (`origin`, card schema 3, e.g. `anki`); the dashboard doesn't count them as written. The Anki import (`feature/anki/`) reads `.apkg`/`.colpkg` packages of every format on an isolate of its own (`AnkiPackageReader`), zstd through our fork of `pure_zstd` (Anki's frames don't record their size), and its fixtures come from Anki itself (`tool/anki/make_fixtures.py`).
   - **Every client migration keeps a device's rows** (`test/core/sync/device_migration_test.dart` replays each on a database with a row in every synced table of ours; SQLite rebuilds tables to add foreign keys, which Serverpod's runner does with foreign keys off). A new synced table needs a row in that test, which fails until it has one.
   - **Every synced table indexes `spaceId`** (`indexes: <table>_space_idx: fields: spaceId`, e.g. `studyset.spy.yaml`): deleting a space cascades into every synced table, and Postgres doesn't index foreign keys by itself, so account deletion and pruning would otherwise read whole tables.

halkyon_learn_flutter/lib/src/feature/pomodoro/data/linux_pomodoro_platform.dart

@@ -63,7 +63,7 @@ class LinuxPomodoroPlatform(
   );
 
   /// The timer in the top bar, where the desktop shows such icons.
-  late final _indicator = StatusNotifierItem(_bus, id: 'halkyon-learn')
+  late final _indicator = StatusNotifierItem(_bus, id: 'halkyon_learn')
     ..chosen.listen((key) {
       if (PomodoroAction.values.asNameMap()[key] case final action?) {
         _actions.add(action);

halkyon_learn_flutter/lib/src/feature/pomodoro/data/status_notifier_item.dart

@@ -1,5 +1,4 @@
 import 'dart:async';
-import 'dart:io';
 import 'dart:math' as math;
 import 'dart:typed_data';
 
@@ -14,19 +13,21 @@ typedef IndicatorEntry = ({String key, String label, bool enabled});
 /// Ubuntu's built in, and KDE show), menu through `com.canonical.dbusmenu`.
 ///
 /// Written over package:dbus rather than libayatana-appindicator, which a
-/// build would need besides (and the snap the `unity7` plug): the bus name
-/// `org.freedesktop.StatusNotifierItem-…`, the item at `/StatusNotifierItem`
-/// and the menu at `/MenuBar` are what the snap's `desktop` plug allows. A
-/// desktop without a watcher (stock GNOME without the extension) shows
-/// nothing, and [show] says so.
+/// build would need besides. Laid out as libayatana lays itself out, within
+/// what the snap's rules allow (snapd v2.77's `desktop-legacy` plug, checked
+/// 2026-10-07): the item at `/org/ayatana/NotificationItem/<id>`, the only
+/// path the label's signal (`XAyatanaNewLabel`) may come from, registered
+/// with the watcher by that path under the connection's own name, since the
+/// item may bind no name of its own; the menu at `/MenuBar`. [id] names the
+/// path, in letters, digits and underscores. A desktop without a watcher
+/// (stock GNOME without the extension) shows nothing, and [show] says so.
 class StatusNotifierItem(final DBusClient _bus, {required final String id}) {
   static const _watcher = 'org.kde.StatusNotifierWatcher';
 
   late final _item = _Item(id);
   late final _menu = _Menu();
-  final _name = 'org.freedesktop.StatusNotifierItem-$pid-1';
 
-  /// Whether the item and its menu are on the bus, under their name.
+  /// Whether the item and its menu are on the bus.
   var _exported = false;
 
   /// Whether the top bar's watcher knows the item.
@@ -50,7 +51,6 @@ class StatusNotifierItem(final DBusClient _bus, {required final String id}) {
     if (!_exported) {
       await _bus.registerObject(_item);
       await _bus.registerObject(_menu);
-      await _bus.requestName(_name);
       _exported = true;
       _watcherChanges = _bus.nameOwnerChanged
           .where((change) => change.name == _watcher)
@@ -76,7 +76,7 @@ class StatusNotifierItem(final DBusClient _bus, {required final String id}) {
       ).callMethod(
         _watcher,
         'RegisterStatusNotifierItem',
-        [DBusString(_name)],
+        [DBusString(_item.path.value)],
         replySignature: DBusSignature(''),
       );
       _registered = true;
@@ -101,7 +101,7 @@ const _menuInterface = 'com.canonical.dbusmenu';
 final _menuPath = DBusObjectPath('/MenuBar');
 
 class _Item(final String _id) extends DBusObject {
-  this : super(DBusObjectPath('/StatusNotifierItem'));
+  this : super(DBusObjectPath('/org/ayatana/NotificationItem/$_id'));
 
   var _title = '';
   var _label = '';

halkyon_learn_flutter/test/feature/pomodoro/data/linux_pomodoro_platform_test.dart

@@ -187,13 +187,17 @@ void main() {
 
       await platform.show(notice(run));
 
-      final [name] = watcher.registered;
-      expect(name, startsWith('org.freedesktop.StatusNotifierItem-'));
+      // Registered by its path, as libayatana-appindicator does: the snap's
+      // rules let the item bind no name, and send the label's signal only
+      // from there.
+      final [registered] = watcher.registered;
+      expect(registered, '/org/ayatana/NotificationItem/halkyon_learn');
+      final name = app.uniqueName;
       expect(notifications.notified, isEmpty);
       final item = DBusRemoteObject(
         shell,
         name: name,
-        path: DBusObjectPath('/StatusNotifierItem'),
+        path: DBusObjectPath(registered),
       );
       expect(
         await item.getProperty('org.kde.StatusNotifierItem', 'XAyatanaLabel'),