fix(mobile): brand the Android launch surface and the loading states

[iscekic]

Changelog for users

• On a night-mode relaunch, the Account settings page draws its own rows (Account, Trusted hosts, Passkeys, Device sessions) instead of a bare loading page.
• The status-bar clock and icons are dark and legible over the light brand launch surface, and the app's own status bar is unchanged once content draws.
• The navigation-bar icons match: dark over the launch surface, then the app's own appearance after content draws.
• The sign-in screen's full-screen wait now shows the Kilo mark and a "Loading…" label instead of an unbranded blank page with a lone grey spinner.
• Signing out shows the same branded wait surface while the session tears down.

Changelog for maintainers

• Both Android launch themes now set android:windowLightStatusBar and android:windowLightNavigationBar to true; the light brand drawable needs dark icons and no JS runs during that window.
• MainActivity's injected onCreate restores the navigation-bar appearance when React content appears, using WindowInsetsController on API 30+ and SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR on API 27-29.
• The restoration reads the night-mode configuration, so a night-mode app gets its light icons back under the transparent bar.
• shouldShowBootstrapLoading gains a signingOut input; the root layout bounds it by the still-published token, so the wait surface ends when the token clears.
• The shared loading surface renders the Kilo mark plus a translated "Loading…" label, and the login screen's approved hold reuses it instead of a bare spinner.
• Review focus: the injected Kotlin uses two appearance APIs and must compile on API 27+; confirm the navigation-bar hand-back does not pin the app's own bar and the token bound releases the surface at the end of sign-out.

E2E proof

[e1] settings-account — Android emulator-5554; start state settings reached STATE HIT (state.sh's own normalize from Home first landed on the app's 'Page not found' screen; recovered by opening kiloapp://profile/preferences, then STATE HIT settings), then the parked replay: e1-scene.log 'SCENE e1 OK' with the Account page rows 'android.view.View Account', 'android.widget.Button Trusted hosts, Hosts you trust to open without asking', 'android.widget.Button Passkeys, Sign in without a password', 'android.widget.Button Device sessions, Review and sign out other devices' — finding 1 fixed, the page draws its own…

[p1] platform:android cold launch in night mode: the status-bar clock and icons must read dark and legible over the app's brand launch surface — Android system dark theme on (p1-nightmode.txt: content-desc="Dark theme" ... checkable="true" checked="true"), then a cold launch reached the signed-in app content — p1-scene.log: "cold launch through the dev-client link", "SCENE p1 OK", digest "android.widget.Button New coding task", "android.widget.Button Home, tab, 1 of 3"; launch-surface frame captured at ~1s (p1launch.png; p1-launch-scene.log digest only action_bar_root/content). Status-bar icon colour/legibility over the brand surface is a visual claim owned by the visual reviewer, and the launch-theme pin plus the static gates are run…

[e3] ux-check: Night-mode cold start/relaunch (the finding-2 repro): while the brand launch surface (#FAF74F, before app content appears) is shown, the status-bar clock and icons render dark and legible… — Android emulator-5554; night mode proven in e3-nightmode.txt (Dark theme switch checked="true"); the cold-launch pre-content frames are 96.8% RGB(250,247,79)=#FAF74F brand surface (e3-measure.log) with the hierarchy e3-cold-hier.txt showing no app content; the dark-icon judgement itself is the visual reviewer's on this same still.

[p5] ux-check signin-language flow has no unbranded blank full-screen loading state — android emulator-5554. The parked scene MISSed because the app was left signed in; states-shard1.txt is empty so no state file exists, and I reached the signed-out start via Profile -> Sign out. The full-screen loading state of the sign-in flow (the sign-out teardown window, the same BootstrapLoadingSurface the login screen's approved hold renders) was read live immediately after confirming sign-out and logged in p5-signout-wait.log as 'android.view.View "Loading…, busy"', 'ImageView "Kilo logo"', 'TextView "Loading…"' (screenshot p5-signout-wait.png for the visual reviewer) - a Kilo mark +…

[p5] ux-check signin-language flow has no unbranded blank full-screen loading state

[p1] platform:android cold launch in night mode — Night mode enabled (p1-nightmode.txt: text="Dark theme", text="Will never turn off automatically") then dev-client cold launch reached the signed-in Home screen (p1-run.log: 'SCENE p1 OK'); launch frames captured for the visual reviewer at p1-launch-frame.png and p1-launch-frame2.png, and the status-bar icon colour/legibility there is the visual reviewer's claim (automatic proof is the launch-theme unit test run by the driver); no UX defect observed in the digest on the visited screens.

E2E proof — log excerpts

[p2] ux-check night-mode cold start/relaunch launch-surface status bar -> pass :: Ran scripted this run on android emulator-5554; scripted-p2.log carries 'SCENE p2 OK' for the parked steps (screen 'Home, tab, 1 of 3', launch, sleep) and the post-launch digest of the brand launch surface. The status-bar icon colour is a visual claim owned by the visual reviewer, who reviews the same run's captures; no behavioral failure seen.
[p5] ux-check signin-language flow has no unbranded blank full-screen loading st -> pass :: android emulator-5554. The parked scene MISSed because the app was left signed in; states-shard1.txt is empty so no state file exists, and I reached the signed-out start via Profile -> Sign out. The full-screen loading state of the sign-in flow (the sign-out teardown window, the same BootstrapLoadingSurface the login screen's approved hold renders) was read live immediately after confirming sign-out and logged in p5-signout-wait.log as 'android.view.View "Loading…, busy"', 'ImageView "Kilo logo"', 'TextView "Loading…"' (screenshot p5-signout-wait.png for the visual reviewer) - a Kilo mark + one spinner + 'Loading…', not a bare grey spinner. The language walk then re-ran OK from the signed-ou
[p2] ux-check: Night-mode cold start/relaunch (the finding-2 repro): while the b -> pass :: jev read the digest: pass (confidence 1.00)
[p3] ux-check: On that same night-mode launch surface, the navigation-bar icons  -> pass :: jev read the digest: pass (confidence 1.00)
[p6] ux-check: Handover stability: when AnimatedSplashOverlay unmounts into the  -> pass :: jev read the digest: pass (confidence 1.00)
[p4] ux-check: Bootstrap wait surface (sign out then relaunch / redirected cold  -> pass :: Reached live via the sign-out teardown window the diff adds (held open with <internal>) on android/emulator-5606; both logs carry the live digest 'ImageView "Kilo logo"', one 'android.view.View "Loading…, busy"' progressbar and 'TextView "Loading…"', in light and night mode; the parked p4 scene MISSes only on its ambiguous dialog-confirm tap (papercut filed), not on the product; zero UX-DEFECT in the digests.

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/scripted-p2.log

SCENE p2 OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p5-signout-wait.log

# [p5] signin-language flow — full-screen loading ("wait") surface, android / emulator-5554
# Captured 2026-09-24 immediately after tapping "Sign out" in the sign-out confirmation
# dialog (the window between the signed-in tree leaving and the sign-in screen mounting).
# Source: live accessibility digest read with the device MCP (sim_browser_snapshot).
# The same surface is the BootstrapLoadingSurface rendered by the root layout for a
# sign-out teardown and the login screen's approved-token hold.
- android.view.View "Loading…, busy" [ref=e1]
- ImageView "Kilo logo" [ref=e2]
- TextView "Loading…" [ref=e3]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p5-language.log

android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.widget.ImageView Kilo logo tappable [467,538][614,685]
android.widget.TextView Welcome to Kilo tappable [387,712][692,777]
android.widget.Button Sign in with Google tappable [99,833][981,948]
android.widget.TextView Sign in with Google tappable [222,860][924,921]
android.widget.Button Sign in with a passkey tappable [99,976][981,1091]
android.widget.TextView Sign in with a passkey tappable [222,1003][924,1064]
android.widget.TextView or tappable [527,1119][553,1156]
android.widget.TextView Email address tappable [99,1184][981,1230]
android.widget.EditText Email address tappable [99,1243][981,1359]
android.widget.Button Continue with email tappable [99,1387][981,1503]
android.widget.TextView Continue tappable [473,1421][606,1467]
android.widget.TextView By continuing you agree to our  tappable [183,1543][571,1580]
android.view.View Terms tappable [572,1525][652,1599]
android.widget.TextView Terms tappable [572,1543][652,1580]
android.widget.TextView  and  tappable [651,1543][712,1580]
android.view.View Privacy Policy tappable [713,1525][889,1599]
android.widget.TextView Privacy Policy tappable [713,1543][889,1580]
android.widget.TextView . tappable [888,1543][896,1580]
android.widget.Button More sign-in options tappable [99,1620][981,1736]
android.widget.TextView More sign-in options tappable [386,1654][693,1700]
android.widget.Button Language tappable [937,84][1038,185]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/scripted-p3.log

SCENE p3 OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/scripted-p6.log

SCENE p6 OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p4-day.log

[p4] Bootstrap wait surface — LIGHT (day) mode, live trigger. device=emulator-5606 android (API 35)
Trigger: signed in (login.sh emulator-5606), Profile tab -> scroll to Sign out -> tap Sign out -> dialog 'Sign out?' -> tap 'Sign out'.
The sign-out teardown was held open by stalling nextjs (the session-revoke network call the teardown awaits):
  $KWF_LONG_RUN p4-stall.log $KILO_WORKFLOW/e2e/<internal>
Live sim_browser_snapshot digest of the surface while the teardown was in flight (this round, 2026-09-24):
- android.view.View "Loading…, busy"    <- one accessible progressbar (accessibilityLabel = common.loading)
- ImageView "Kilo logo"                 <- the Kilo mark, above the spinner
- TextView "Loading…"                   <- the label, below the spinner
(no tab bar, no app chrome: the surface is the full screen)
screenshot: /home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p4-day.png

/home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p4-night.log

[p4] Bootstrap wait surface — NIGHT mode. device=emulator-5606 android (API 35)
Night mode set on the device before this run: android.settings.DISPLAY_SETTINGS, "Dark theme" Switch -> checked ("Will never turn off automatically"); the app was then cold-launched so it renders nigh
Trigger: signed in, Profile tab -> scroll to Sign out -> tap Sign out -> dialog 'Sign out?' -> tap 'Sign out'.
The sign-out teardown was held open by stalling nextjs (the session-revoke network call the teardown awaits):
  $KWF_LONG_RUN p4-night-stall.log $KILO_WORKFLOW/e2e/<internal>
Live sim_browser_snapshot digest of the surface while the teardown was in flight (this round, 2026-09-24):
- android.view.View "Loading…, busy"    <- one accessible progressbar (accessibilityLabel = common.loading)
- ImageView "Kilo logo"                 <- the Kilo mark, above the spinner
- TextView "Loading…"                   <- the label, below the spinner
(no tab bar, no app chrome: the surface is the full screen)
screenshot: /home/igor_kilocode_ai/.local/share/kwf/sections/explorer-3-visual-defects-on-android-20081-with-no-screen-ebdda-b5c1/e2e-mobile-app/p4-night.png

Owner request

Surface: mobile-app

Explorer finding: 3 visual defects on android: 20081..." with no screen content drawn.; The status-bar clock and icons are drawn; The language screen's loading state is a

The user-agent explorer found these 3 while using the app like a user. They are one kind of defect on one platform, so they are ONE item: the pull request must fix and prove every one of them.
One must-run scenario per finding: the plan needs 3 musts, one for each finding below.
The explorer never edits product code.

Evidence (from the device runs):

--- Finding 1 of 3: settings-account-ar: The Account settings page renders as a bare webview load bar exposing the developer URL "Loading from 127.0.0.1:20081..." with no screen content drawn.
Flow: settings-account-ar
Found on revision: d846cc7
Repro:

1. set this state first: uimode night; battery 15 discharging; relaunch; deeplink kiloapp://expo-development-client/?url=http%3A%2F%2Flocalhost%3A20081
2. open the app on emulator-5602
3. reach settings-account-ar
4. the capture shows the defect named below
   Observed: The Account settings page renders as a bare webview load bar exposing the developer URL "Loading from 127.0.0.1:20081..." with no screen content drawn.
   Expected: the screen renders without this defect

--- Finding 2 of 3: settings-account-ar: The status-bar clock and icons are drawn light-on-near-white over the loading page, leaving them essentially unreadable.
Flow: settings-account-ar
Found on revision: d846cc7
Repro:

1. set this state first: uimode night; battery 15 discharging; relaunch; deeplink kiloapp://expo-development-client/?url=http%3A%2F%2Flocalhost%3A20081
2. open the app on emulator-5602
3. reach settings-account-ar
4. the capture shows the defect named below
   Observed: The status-bar clock and icons are drawn light-on-near-white over the loading page, leaving them essentially unreadable.
   Expected: the screen renders without this defect

--- Finding 3 of 3: signin-language: The language screen's loading state is an unbranded blank page with a small grey spinner and no label or logo, unlike the branded Kilo loading screens elsewhere in the flow.
Flow: signin-language
Found on revision: d846cc7
Repro:

1. set this state first: credits 20; uimode night; battery 8 discharging; rotate landscape; relaunch
2. open the app on emulator-5554
3. reach signin-language
4. the capture shows the defect named below
   Observed: The language screen's loading state is an unbranded blank page with a small grey spinner and no label or logo, unlike the branded Kilo loading screens elsewhere in the flow.
   Expected: the screen renders without this defect

[e5] ux-check: Bootstrap wait surface (light + night) — Digest (e5-light-live.log) shows the wait surface as the full screen: android.view.View "Loading…, busy" plus ImageView "Kilo logo" and TextView "Loading…", no tab bar; the same three nodes are in e5-light-surface.log and e5-night-surface.log, light/night captures of the surface held by a temporary gate flip (reverted; git status clean, served bundle has zero capture markers). Stills e5-light-live.png, e5-light-surface.png, e5-night-surface.png.

[e6] ux-check: Walk the full signin-language flow and confirm no full-screen loading state in it renders as an unbranded blank page with only a small grey spinner. — Android emulator-5554; full-screen loading surface in the sign-in flow now renders the Kilo mark and the named label — e6-bootstrap-loading.txt carries content-desc="Kilo logo" and content-desc="Loading…, busy", e6-measure.log measures logo(95x96)+spinner(13x13)+label(89x22) on the surface; surface held with a temporary root-layout call-site hook, reverted via git checkout (worktree clean).

[e5] ux-check: Bootstrap wait surface (light + night)

[e5] ux-check: Bootstrap wait surface (light + night)

[e8] ux-check: Night mode after app content is drawn: the app's own status bar keeps light icons over the dark app chrome (the launch-theme flag did not leak into the running app). — Device Dark theme checked and app content drawn (Home: "Kilo" header, "Nothing running right now", tab bar "Home, tab, 1 of 3" [checked]) in e8-night-content.log/e8-night-content.png; the launch/post-splash surface is gone, so the launch-theme flag is not the surface on screen — the status-bar icon colour over the dark chrome is a visual property for the visual reviewer on that still.

[p5] ux-check: full signin-language flow — Android; reused prior-round artifacts 2026-09-24 20:38-20:46: p5-language.log 'SCENE p5 OK' lands on the sign-in screen ('android.widget.TextView Welcome to Kilo'), and p5-signout-wait.log records the full-screen wait surface 'ImageView "Kilo logo"' plus 'TextView "Loading…"' in the window between the signed-in tree and the login screen, so no full-screen loading state is an unbranded blank spinner; no UX-DEFECT in the digest.

[p1] platform:android cold launch in night mode — Android, reused prior-round artifact for identical head e18998 (this diff applied), collected 2026-09-24 17:26-17:37 on this worktree's stack, night mode recorded in p1-nightmode.txt; p1-run.log 'SCENE p1 OK' shows the dev-client cold launch reached the signed-in Home digest; the status-bar icon colour over the launch surface is the visual reviewer's on the launch still.

[p7] ux-check: night mode after app content is drawn — Android emulator-5606; reused prior-round artifact 2026-09-24 20:56: p7-night.log shows 'android.view.View "Kilo"' with the signed-in tab bar after a night-mode cold launch, so the launch surface is gone and the app's own window is on screen; the status-bar icon colour over the dark chrome is the visual reviewer's on p7-night.png (the log names the gap: no exposed flag for the running window's status bar); unaffected by this launch-theme-only increment, since the plugin unit tests assert AppTheme carries neither windowLightStatusBar nor windowLightNavigationBar.

Follow-ups (not changed here)

• not proved live: [advisory] platform:android cold launch in night mode: the status-bar clock and icons must read dark and legible over the app's brand launch surface — finding 2 (settings-account-ar). Put the device in night mode first (adb shell cmd uimode night yes) and read the still; the automatic proof for this slice is the launch-theme test, and e2's still shows the same status bar over the app's wait surface. Automatic, default platform (Android). (no capture cited it)
• not proved live: ux-check: Bootstrap wait surface: with the wait up (sign out then relaunch, or a cold start that redirects with the splash already gone), the screen shows the Kilo mark above exactly one spinner and a 'Loading…' label below, centered on the app background — not a bare blank page — in both light and night mode. (no capture cited it)
• not proved live: ux-check: Handover stability: when AnimatedSplashOverlay unmounts into the bootstrap wait, the logo/spinner/label do not jump, blank, or reposition, and only one spinner is present. (no capture cited it)
• not proved live: ux-check: On that same night-mode launch surface, the navigation-bar icons (test with 3-button navigation, not only the gesture pill) are also legible against the light brand background; report the observed appearance rather than assuming. (no capture cited it)

Open findings (not fixed here)

• not proved live: p5.png is no longer on the host that took it, so no publish can carry it
• not proved live: settings-account-ar.png is no longer on the host that took it, so no publish can carry it
• not proved live: signin-language.png is no longer on the host that took it, so no publish can carry it

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only branch delta since the prior review is _layout.tsx's gate letting the sign-out wait surface outrank the user/consent bootstrap error screens: the error branches now fall through to the shared render while the token is still published, and hasUserBootstrapError/hasConsentBootstrapError both require the token, so the stale error cannot return after the token clears. No new defects found.

Files Reviewed (10 files)

• apps/mobile/plugins/android-splash-window-background.js
• apps/mobile/plugins/android-splash-window-background.test.ts
• apps/mobile/plugins/branded-splash.test.ts
• apps/mobile/src/app/_layout.tsx
• apps/mobile/src/components/bootstrap-loading-surface.mounted.test.tsx
• apps/mobile/src/components/bootstrap-loading-surface.tsx
• apps/mobile/src/components/login-screen.test.ts
• apps/mobile/src/components/login-screen.tsx
• apps/mobile/src/lib/bootstrap-decision.test.ts
• apps/mobile/src/lib/bootstrap-decision.ts

Previous Review Summaries (2 snapshots, latest commit 7a84c11)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7a84c11)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only branch delta since the prior review reverts a brittle source-text sign-out assertion; the Android launch theming, branded loading surface, and token-bounded sign-out wait are unchanged and still carry no new high-confidence defects.

Files Reviewed (10 files)

• apps/mobile/plugins/android-splash-window-background.js
• apps/mobile/plugins/android-splash-window-background.test.ts
• apps/mobile/plugins/branded-splash.test.ts
• apps/mobile/src/app/_layout.tsx
• apps/mobile/src/components/bootstrap-loading-surface.mounted.test.tsx
• apps/mobile/src/components/bootstrap-loading-surface.tsx
• apps/mobile/src/components/login-screen.test.ts
• apps/mobile/src/components/login-screen.tsx
• apps/mobile/src/lib/bootstrap-decision.test.ts
• apps/mobile/src/lib/bootstrap-decision.ts

Previous review (commit 48242c2)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the Android launch/splash theming (theme attributes plus the injected API-guarded Kotlin appearance hand-back), the token-bounded sign-out bootstrap wait window, and the shared branded loading surface; all new targets resolve to current RIGHT-side diff lines and no high-confidence defects were found.

Files Reviewed (11 files)

• apps/mobile/plugins/android-splash-window-background.js
• apps/mobile/plugins/android-splash-window-background.test.ts
• apps/mobile/plugins/branded-splash.test.ts
• apps/mobile/src/app/_layout.tsx
• apps/mobile/src/components/bootstrap-loading-surface.mounted.test.tsx
• apps/mobile/src/components/bootstrap-loading-surface.tsx
• apps/mobile/src/components/login-screen.test.ts
• apps/mobile/src/components/login-screen.tsx
• apps/mobile/src/lib/bootstrap-decision.test.ts
• apps/mobile/src/lib/bootstrap-decision.ts
• apps/mobile/src/lib/startup-order.test.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}