# T-001 TCN APK decompile patch

## Intent
Inject Ballbox-driven file sync into the decompiled main TCN APK, using the main app as host runtime.

## Locked constraints
- Source of truth is decompiled APK only.
- USB install is acceptable.
- After real synced file changes, app restart is sufficient; full reboot not required for that path.
- Manual entrypoint must stay visible.
- Sync target root: `/sdcard/TcnFolder`
- Managed dirs: `ImageScreen`, `VideoAndImageAd`

## Reality found
- APK is the main TCN app (`com.tcn.vending`).
- Existing ad stack is `com.tcn.cpt_advert.tcn_remote_ad.TcnAdvertControl`.
- Existing remote ad flow talks to `http://ad.ourvend.com:8090/api/AdsManage/` with custom encrypted payloads.
- Existing app already has:
  - restart app primitive
  - reboot primitive
  - visible system/settings fragment entrypoint
  - boot receiver
  - app/services started on boot
- Existing manual buttons in `AndroidSystemFragment` include delete/copy ads, restore, reboot schedule, etc.
- Existing periodic ad behavior is tied to TCN/Yishou pollers, not Ballbox manifest sync.

## Main blocker
Implementing a full Ballbox manifest downloader/verifier/pruner directly in smali is materially large.
No source project for the APK is available, and current machine does not have a ready Android build toolchain to compile and inject new Java/Kotlin code as dex.

## Best technical path from current state
1. Reuse existing visible entrypoint in `AndroidSystemFragment`.
2. Reuse existing boot receiver and/or already-started services as launch hooks.
3. Inject a small Ballbox sync runtime class if we can compile dex externally or handwrite minimal smali.
4. Trigger `restartApp()` only when file set actually changes.

## Candidate done checklist
- [ ] boot path triggers Ballbox sync after ~10s
- [ ] periodic Ballbox sync continues afterward
- [ ] manual visible action triggers Ballbox sync now
- [ ] manual visible action triggers restart app
- [ ] manual visible action triggers reboot system
- [ ] sync writes/prunes only inside managed dirs under `/sdcard/TcnFolder`
- [ ] restart app happens automatically only after real content changes
- [ ] APK rebuilds and signs

## Current status
blocked_with_reason: missing practical path to inject new downloader logic into the APK from smali-only environment without a code-compile path