My dad needs to reach me and be certain he reached me. He gets one button on a plain web page. My phone rings at full volume — silent mode, Do Not Disturb, in a bag — and he sees whether I stopped it.
My phone runs a small Android app: a foreground service that long-polls a Cloudflare Durable Object, and a full-screen alarm activity that lifts Do Not Disturb, raises the alarm stream to max and starts a siren. My dad gets a single web page with one button and a confirmation.
That asymmetry is the whole design. Everything hard happens on my side, once. He never installs anything, never holds a key, never scans a code — the page he opens is the bare address.
| Rule | Why it exists |
|---|---|
| One ring id goes to every connected phone | A device that polls first must not swallow the ring meant for mine — this was a real bug. |
No phone listening → 409 refused:offline | Never park a ring that fires minutes later, out of nowhere. |
Line off posts stage=off | So the page says "not connected" immediately instead of waiting out a timeout. |
| One press per 20 s per caller | A public URL should not be a siren anyone can hold down. |
stage=start and stage=stop acks | Dad sees what happened, not a guess. |
| DND lifted and volume maxed before the siren | Order matters: raise first, then make noise. |
The hub marked a ring consumed on first delivery, so whichever device polled first took it. Dad pressed RING and my emulator rang. Fixed with per-install client ids and a delivered-to list; two pollers now receive the same id.
Offline only appeared after a 90-second poll timeout, and any connected device kept the flag warm. Now the line tells the hub the moment it goes off.
A press with nothing listening was parked for three minutes and fired when the line came back. That is the exact opposite of "don't suddenly ring it". It is refused outright now.
The app dialled the IPv6 address and died there:
ConnectException: Failed to connect to dadfinder…/2606:4700:3033::6815:1c25:443
The carrier hands out an IPv6 route that does not work, and the socket never fell back. The app now
pins IPv4 before any socket opens. Verified with Wi-Fi off: Line is on — Connected.
RingActivity.onPause() re-posted the full-screen intent, so a heads-up banner stacked on
top of the alarm. Fixed by retaining the shown timestamp across pause and resume.
From the emulator, with Do Not Disturb set to total silence:
dnd filter was 3, liftedalarm volume 0 -> 7 / max 7
siren playingack stop -> 200
Real: the relay contract, the refusals, the acknowledgement path, the timing and the failure modes above all happened on real hardware — a real Worker, a real Android phone, a real emulator in flight mode.
Simulated: the two phone screens, the siren and the network. The simulator contains no endpoint that could ring anyone, holds no access key and contains no endpoint that could ring anyone.
Limits: no iOS build, no SMS fallback, and nothing can survive a force-stop from Settings — the card in the app says so rather than pretending otherwise.
Simulator: /demos/dadfinder.html · Build spec: prompts/dadfinder-prompt.md