// WHICH SCREEN THE SHELL SHOWS — the one rule, as a pure function.
//
// It lives in lib/ rather than inside App.jsx because it is a RULE, not a rendering: it decides whether a
// handset can reach the product at all, and it has been wrong on a real device. app/ holds views, lib/
// holds things that can be tested under bare without a renderer — and this is the half worth testing.
//
// ⛔ THE PREVIOUS RULE STRANDED A FRESH INSTALL. It was `!signing || pairing -> pair`, with no third
// state, and Pair's only exit was a SUCCESSFUL adopt. So a phone with no identity had exactly one way out
// of the pairing screen — complete the ceremony — while the screen's own footer promised "you can keep
// using the app without pairing". There was no control that did that, and no rule that would have
// honoured one. Reported on a handset 2026-08-25: "it also will not go past the initial pairing modal".
//
// The node behind that screen is RUNNING: favela-web is up, read-only and loopback-only, serving real
// pages (hyper-social #54 §7 — "a fresh install DOES start favela-web; what hides it is App.jsx routing
// to the native Pair screen"). So this is not a new capability, it is letting the user reach what the
// phone is already doing.
//
// The three inputs are deliberately independent:
// signing the node holds a signing key (lib/node.js only boots hpp when an identity config exists)
// pairing the user ASKED for the ceremony — from favela-web's settings (render.js pairSection)
// readOnly the user chose to continue unpaired, this run
//
// `pairing` beats `readOnly`, always: an explicit request for the ceremony must never be swallowed by a
// skip the user made earlier. That case is real — a device that HOLDS the identity but is missing from
// the room's __members__ has to re-pair, and App.jsx's own note records that removing this route once
// already broke exactly that.
export function initialScreen ({ signing = false, pairing = false, creating = false, readOnly = false } = {}) {
// Asked for, explicitly — from favela-web's settings. Checked FIRST so a skip can never swallow it.
//
// ⛔ PAIRING BEATS CREATING when both are somehow set. Not arbitrary: pairing joins an identity that
// already exists, creating mints a new one, and minting is the irreversible half — a PLC genesis is a
// permanent append to a global log. An ambiguous state must resolve to the recoverable route.
if (pairing) return 'pair'
if (creating) return 'create'
// No identity, and the user has not declined: the ceremony, unprompted. A fresh install has no settings
// page to reach a button on, so this stays the first thing the phone shows.
if (!signing && !readOnly) return 'pair'
return 'web'
}