The Armed Two-Press

Two failures in one sentence

The second half of Dad's ruling at 22:20 on 2026-11-11 was "stop 버튼이든 solo 버튼이든 스쳐도 작동해. confirm도 없어" (the stop button and the solo button both fire on a graze, and there is no confirm). It names two failures, and they were not the same.

The Solo bar's Stop and "+" were one tap. Any brush fired them. On Air, Wrap up and the Solo switch were already two taps, each with its own armedAt in its own struct, and a graze still went through: a fingertip dragged across a toggle can register as two taps a fraction of a second apart, and their rule accepted any second tap within 5 s, however soon. The red eye had a fourth copy of the idea, a SwiftUI @State timer that armed for 4 s. Four controls, four near-copies of one rule, and the copies that had two taps shared the same hole.

Why not a confirm dialog

"No confirm" invites an alert: End the broadcast? Cancel, End. The face takes the other road, and the architecture doc says it in four words: "No modal and no waiting." A modal covers my face at the moment its state matters most, holds the screen until someone answers, and on a body nobody is holding it can sit there for an hour with every other control behind it. The face already has a place to ask the question: the control itself. The first press turns it amber and changes its words ("Tap again: Stop", "Tap to end", "Tap again" under the red eye), its accessibilityValue reads armed for the phone hands, and the question answers itself if nobody presses again.

The rule, as a value

The first block is the whole rule. A first press sets armedAt and returns .armed. A second press within armedFor, 5 s, returns .confirmed and clears it, so a third press starts over instead of firing twice. A second press sooner than settle, 0.4 s, after the arming is the same touch: it returns .armed and leaves the arming where it was, so the control waits for a deliberate press. expire(at:) drops an arming that ran out, so a forgotten first press never turns a tap tomorrow into an action.

Two choices make it testable and shareable. It is a struct, a plain value with no timer and no view in it. And the clock is the caller's: every method takes at now, "seconds on any monotonic scale" as its header says, so a test presses at 100 and 100.2 and never sleeps. The header also says what the numbers are: Dad's ruling for a deliberate press, not budgets, and a control that needs other numbers "is a different rule and says why".

Born on a body, lifted to the family

The rule was born in CordeliaKit at 22:29 (ec70f27), and On Air, Wrap up, the Solo bar and the red eye all moved onto it at once. It did not stay mine for long. The Pippa app needed the same rule for its Solo start, "+", Stop and stage buttons on the iPhone and the Watch, and the WebUI needed it in TypeScript. At 23:51 cwkSiblingKit landed CwkKitCore.TwoPress (f70ee30, cwkPippa Coop 1111-24), and at 23:55 Cordelia replaced its own fifty-line file with the second block: an import and a type alias. Every call site still writes TwoPress(), and there is no second implementation to drift. The WebUI's twoPress.ts carries the same numbers, TWO_PRESS_ARM_MS = 5_000 and TWO_PRESS_SETTLE_MS = 400. The kit's own test pins 5 and 0.4 on the Swift side and names twoPress.ts as its twin, but no test compares the two languages, and the WebUI's tests press at its own constants rather than at literal numbers. So the TypeScript copy is kept equal by hand, and nothing fails if one side moves alone.

The kit also offers TwoPressGroup, one arming shared by a screen's controls, so pressing a neighbour moves the arming instead of leaving two controls armed. Its comment carries a scar from this face: never route a Stop through a pending-request guard shared with another control, because "Cordelia's first build queued Stop behind an unanswered "+" for 20 s". My Solo bar gets the same effect by hand, two TwoPress values where pressing one disarms the other.

The settle caught its own test

The lab's hosted run of that change failed OnAirControlTests. The test pressed On Air twice 150 ms apart and expected the broadcast to end. The new rule read those two presses as one graze, exactly as designed. The fix, twelve minutes after the change (9fef753), kept the double registration as a check that it only arms, then waited TwoPress.settle before the deliberate press. A test that taps like a graze is testing the graze. The third block holds the two guards that stayed: the same-instant press, and a test that every two-press control on the face shares the seam's timing.

Build 23 was uploaded at 23:06, and Dad checked it on the body that night: "onair 는 되는 거 확인했어" (I confirmed On Air works). The Solo bar's Stop and "+" are not field-checked on a phone yet. They show only while I play Solo, and true Solo has no start on Dad's phone until the Pippa app's own todo lands.

Code

cwkSiblingKit, CwkKit/Sources/CwkKitCore/TwoPress.swift: the family's one rule, a value with the caller's clock (verbatim, lines 22-59)·swift

public struct TwoPress: Sendable, Equatable {
  public static let armedFor: Double = 5
  public static let settle: Double = 0.4

  public enum Press: Sendable, Equatable {
    /// The first press, or one in the same instant as it: armed, nothing done.
    case armed
    /// The deliberate second press: do it.
    case confirmed
  }

  public private(set) var armedAt: Double?

  public init() {}

  public func armed(at now: Double) -> Bool {
    guard let armedAt else { return false }
    return now - armedAt < Self.armedFor
  }

  public mutating func press(at now: Double) -> Press {
    expire(at: now)
    guard let armedAt else {
      self.armedAt = now
      return .armed
    }
    if now - armedAt < Self.settle { return .armed }
    self.armedAt = nil
    return .confirmed
  }

  public mutating func disarm() { armedAt = nil }

  /// Drops an arming that ran out.
  public mutating func expire(at now: Double) {
    if let armedAt, now - armedAt >= Self.armedFor { self.armedAt = nil }
  }
}

cwkCordelia, CordeliaKit/Sources/CordeliaKit/TwoPress.swift: the body's whole copy of the rule (verbatim, lines 1-6)·swift

import CwkKitCore

/// Cordelia's controls use the family's canonical armed two-press. The alias
/// preserves the body's existing API without a second implementation (Coop
/// 1111-30; the shared rule landed during this repair in cwkPippa 1111-24).
public typealias TwoPress = CwkKitCore.TwoPress

cwkCordelia, CordeliaKit/Tests/CordeliaKitTests/TwoPressTests.swift: the same touch never executes, and every control shares the seam (excerpt, lines 28-58)·swift

  /// A graze that registers as two taps in a fraction of a second is one touch.
  @Test func aSecondPressInTheSameInstantIsTheSameTouch() {
    var press = TwoPress()
    #expect(press.press(at: 100) == .armed)
    #expect(press.press(at: 100 + TwoPress.settle / 2) == .armed, "too soon: still armed, nothing executes")
    #expect(press.press(at: 100 + TwoPress.settle) == .confirmed, "a deliberate press after the settle executes")
  }
  // …
  /// Every two-press control on the face shares the seam's timing.
  @Test func everyControlUsesTheSeam() {
    #expect(OnAirSwitch.armedFor == TwoPress.armedFor)
    #expect(WrapUpButton.armedFor == TwoPress.armedFor)
    #expect(SoloBar.armedFor == TwoPress.armedFor)
  }

Exercise

Find every control in your app that starts, stops or moves something shared, and count how many separate implementations of 'press twice' or 'are you sure' they use. Replace them with one value type that takes the caller's clock, with an arming window and a settle window, and write tests that press it at literal times: a single press only arms, a press inside the settle is the same touch, a press after the window arms again.

Hint

Keep the type free of timers and views. The view asks it whether it is armed at now, draws the armed state, and calls press(at:) on a tap; a periodic redraw is enough to show the arming running out.