Kid-mode IA filter + PIN lock (deferred)

Status: ✅ IA filter + ChildModeGuard BUILT (Wave-2 A2, commit 793d714) · 🔜 Parent PIN exit-gate DEFERRED

Scope

What shipped (A2)

When the authenticated member's MemberKind is child, the app renders a 4-tab child IA — Home, Earn, Rewards, Profile — with the Household tab hidden. This is enforced in two places:

1. MainShellPage (app/lib/inside/routes/authenticated/shell/page.dart) — the AutoTabsRouter.pageView uses _kChildRoutes (4 routes) and _kChildDestinations (4 nav items) when isChild is true. The tab set is keyed on the authenticated member's kind from CurrentMemberRepository.watch, not on the viewing-as / selected lens (AccountSwitcherCubit). A loading gate (ConnectionState.waiting) renders SizedBox.shrink() so a child never sees the Household tab even briefly before their kind is resolved.

2. ChildModeGuard (app/lib/inside/routes/guards/child_mode_guard.dart) — closes the deep-link bypass: a direct router.push(HouseholdRoute()) or a /household deep link would otherwise still match the route declaration and mount HouseholdPage. The guard redirects child members to MainShellRoute (which lands on HomeTabRoute) and settles the resolver with next(false). Fails open on transient resolution errors; RLS is the authoritative server-side gate.

What is deferred

The parent PIN exit-gate — a mechanism requiring a parent PIN to exit the child IA and return to the adult view — is not yet built. The sovereign-engine ADR (docs/decisions/2026-07-18-sovereign-engine-and-relationship-track-review.md) reaffirms the biometric/PIN adult gate as a scoped follow-up. Any copy that previously said "a parent PIN is required to exit kid-mode" describes the planned follow-up, not the current state.

Open questions (remaining, PIN gate scope only)

• Is the PIN stored server-side (per household) or device-local? What is the forgotten-PIN recovery flow?
• Does kid-mode auto-activate on a timer (e.g. after 5 minutes of inactivity)?
• Can different children have different allowed surfaces within kid-mode?
• How does kid-mode interact with profile-switching on a shared device?

Source files

• app/lib/inside/routes/authenticated/shell/page.dart — MainShellPage, _kChildRoutes, _kChildDestinations
• app/lib/inside/routes/guards/child_mode_guard.dart — ChildModeGuard

Relationship

Profile switching — PIN gate (deferred) applies on the profile picker.