Use the reviewed schedule gate contract
Driver App can replace the authenticated account shell with an outside-schedule screen after a local calculation. The gate uses session schedule data, a client configuration switch, and device-local day and time. It does not refresh or confirm server eligibility before deciding.
This contract is source-api-only. Gate visibility, candidate time, Go back,
and local auth state are not server schedule or session receipts.
Availability
| Gate state | Current public boundary |
|---|---|
| Validation disabled | Client interval gate is skipped; server eligibility remains separate |
| No enabled interval | Client does not establish an interval-derived block |
| Inside interval | Authenticated shell may mount; not work authorization |
| Outside interval | Local block can render outside-schedule copy and a candidate next time |
| Past candidate | Cross-day search can select an already-past same-day interval |
| Missing candidate | Unguarded formatting can fail before a safe fallback or Go back renders |
| Go back | Invokes local session logout intent, not server-aware logout |
Prerequisites
- Use versioned schedule data with an explicit owner, timezone, and freshness receipt before treating the gate as an eligibility input.
- Freeze clock, timezone, locale, week boundary, and schedule fixture for tests.
- Validate missing, empty, disabled-day, multiple-lapse, past-time, and no-next- candidate states before rendering.
- Keep authenticated Root, storage, notifications, permissions, realtime, location, orders, and logout effects outside documentation runtime.
- Provide a safe, always-rendered recovery path independent of next-time format.
Responsibility boundaries
| Owner | Responsibility |
|---|---|
| Root schedule gate | Evaluate local configured intervals and choose gate/account branch |
| Gate UI | Render safe copy, candidate when valid, and recovery action |
| Device/OS | Supply local clock, timezone, and locale; not schedule authority |
| Account/operator | Own current Driver schedule, timezone, revision, and correction |
| Session client | Clear local session state on Go back and surface completion/error |
| Server session owner | Authorize and invalidate server sessions under the guarded logout contract |
| Order domain | Decide work/order eligibility independently of gate presence |
Inputs and result
The local algorithm checks enabled intervals for the device's current weekday and time. Outside an interval, it computes a candidate next opening and passes it to the gate formatter. The cross-day search has a known past-candidate boundary, and a missing candidate reaches an unguarded formatter.
The safe result contract must distinguish loading, validation disabled, no enabled interval, inside, outside with valid candidate, outside with past candidate, and outside with no candidate. Only a valid candidate may be formatted; it is guidance, not a guaranteed unlock time.
Go back calls the local session logout path, which removes local values and changes local authentication state. It does not invoke the separate server-aware logout/session guard, and does not prove cleanup or navigation completion.
Security and privacy
- Do not publish private schedule arrays, configuration keys, timestamps, identifiers, tokens, endpoints, payloads, or account/order information.
- Do not use client/device time as server authorization.
- Guard every missing or malformed candidate before formatting.
- Keep local logout distinct from server session invalidation, active-order guards, token revocation, notification cleanup, and downstream effects.
- Avoid exposing precise work patterns in public evidence; use synthetic generic schedules and frozen time only after independent review.
Limits and failure states
| State | Required interpretation |
|---|---|
| Gate absent | Client did not block; not server eligibility |
| Gate visible | Local outside-interval result; schedule may be stale |
| Candidate shown | Locally derived guidance, not guaranteed next opening |
| Candidate past | Algorithm limitation; do not infer unlock time |
| Candidate missing | Render can fail; safe fallback and Go back are not guaranteed |
| Device timezone differs | Gate can diverge from operator/server schedule |
| Schedule changes elsewhere | No automatic refresh/currentness receipt |
| Go back invoked | Local logout intent only |
| Signed-out-looking UI | No server session invalidation or full cleanup proof |
Troubleshooting
The next time is already past
Treat it as a local algorithm defect. Do not wait for or act on that time; ask the schedule owner to confirm the current schedule and timezone.
The gate is blank or unusable
A missing next candidate can fail formatting before recovery renders. Do not infer that access is allowed. Report the missing-candidate state and use an approved external recovery path.
The gate is absent outside expected hours
Validation may be disabled, no enabled interval may exist, or local schedule, clock, and timezone may be stale. Gate absence is not work authorization.
Go back does not end the session everywhere
It owns local logout only. Reconcile server session state through the reviewed session contract; do not repeat order or logout effects from documentation.
Related guides: Understand the Driver schedule gate · Review the account schedule · Sign out · Use the authenticated bootstrap contract · Driver App architecture