Cadence app audit — executive summary for SergeEXEC_SUMMARY.md · raw .md

Cadence app audit — executive summary for Serge

What was audited and how

The audit examined the Flutter source, timer engine, persistence, alarms and audio, tablet interface, Android and iOS packaging, privacy and permissions, tests, store requirements, competitors, naming, pricing and launch plan. It used read-only source inspection, clean builds, analyzer and test runs, coverage and mutation checks, focused failure probes, rendered store searches, official policy pages and independent challenge passes; the audited app remained unchanged at commit 03a176e72ef0075eec86b8915cbe6e93042a3b9d, version 0.4.12+18 (REPORT.md, proof/00_baseline/SUMMARY.md).

Verdict

The app is a credible professional kitchen-timer product, but this build is not safe to submit or rely on during service yet. The core does not need a rewrite: fix the five shipping failures below, finish the store setup, and verify the result on real Android and Apple tablets (REPORT.md sections 1, 3 and 6).

Findings by severity

Severity Count
Blocker 8
High 49
Medium 117
Low 48
Information only 4

These are the recounted final severities, including challenged or refuted rows retained to prevent the same false leads from returning; the older summary inside findings/REGISTER.md is stale (REPORT.md section 1, audited 2026-08-04).

The five things that block shipping

  1. The Android release is signed with Flutter's debug certificate, so release signing must be fixed in android/app/build.gradle.kts (REPORT.md B1).

  2. The iOS alarm safety net never initialises, so timers cannot dependably alert outside the open app until lib/alarm_backstop.dart and its iOS resources are fixed (REPORT.md B2).

  3. Every one of the 15 App Store icon files is still a stock Flutter logo because iOS icon generation is disabled in pubspec.yaml (REPORT.md B3, evidence dated 2026-08-04).

  4. The zone-to-sound migration can replace a kitchen's chosen alarm tones when it runs again, so the migration in lib/engine/store.dart must become atomic and repeat-safe (REPORT.md B4).

  5. Moving the device clock backward can keep active timers silent for the size of that clock change, so duration tracking in lib/engine/engine.dart must use a suspend-aware monotonic clock (REPORT.md B5).

Decisions waiting on a human

  • Name — REQUIRES SERGE / HUMAN REVIEW: the provisional recommendation is PassPilot Kitchen Timer; Serge and Henry may choose another shortlist entry in one line, but Cadence and Toque are out (research/03_business_decisions.md, revised 2026-08-04).
  • Final name clearance: the UK trademark search was blocked, public searches cannot see unpublished App Store reservations, and the final choice must be typed into App Store Connect's New App field before branding work starts (research/03_business_decisions.md Decision 1).
  • Account holder: the free launch should use individual store accounts, but Henry and Serge must choose whose verified legal identity owns each account and record their ownership arrangement (research/03_business_decisions.md Decision 2).
  • EU trader status: the account holder must resolve trader or non-trader treatment for the EU listings; free price alone does not answer that question, and trader status can make contact details public on either store (research/03_business_decisions.md Decision 2).
  • Permanent bundle identifier: choose it only after the name and domain are approved, and before uploading any build (research/03_business_decisions.md, Bundle identifier dependency).

Henry has already settled two other decisions: launch free with no advertising or paywall, and launch the French and English listings together in France, the United Kingdom, the United States, India, Canada, Australia and Ireland (research/03_business_decisions.md Decisions 3–4, revised 2026-08-04).

What is already good

The timer engine is not a prototype held together by the interface: lib/engine/engine.dart has 94.47% line coverage and the persistence engine has 94.40% (proof/00_baseline/coverage.txt, produced 2026-08-04). The analyzer is clean, and the baseline test suite completed without a failure (proof/00_baseline/SUMMARY.md, produced 2026-08-04).

The requested permissions all have direct product reasons: alarms, notifications, audio, vibration and keeping the kitchen display awake (store_readiness/01_google_play.md; store_readiness/02_apple_app_store.md). Most importantly, the app requests no internet permission and contains no network layer, so restaurant data does not leave the tablet through the app; that is a real privacy and reliability selling point, not marketing language (proof/01_findings/S13/network_grep_lib.txt; REPORT.md S10-F14).

The product idea is also differentiated. It puts several cooking timers on one board, uses colour and spoken announcements, and supports repeated batches without accounts, servers, advertising or checkout code (findings/S10_product.md; aso/01_competitors.md).

Where to go next

Start with ACTION_LIST.md, which turns the audit into an ordered repair sequence. Use REPORT.md for the exact fix and red/green test behind each finding, store_readiness/01_google_play.md and store_readiness/02_apple_app_store.md for submission work, research/03_business_decisions.md for the decisions above, and aso/ for the French and English listings after the final name is chosen.

Human decisions

Decisions Serge must see

Source-extracted from research/03_business_decisions.md; no decision text is rewritten here.

03 Business Decisionsresearch/03_business_decisions.md · raw .md

Decision 1 — Name: a distinctive word plus the product word

Recommendation

Provisional recommendation: PassPilot Kitchen Timer.

REQUIRES SERGE / HUMAN REVIEW — this is a naming and branding decision, not an engineering one. Serge and Henry can overrule it in one line by choosing another row below. No candidate is legally cleared until the unresolved UK check and a professional similarity search are completed, the domains are registered, and App Store Connect accepts the name.

Cadence remains blocked

The bare name Cadence is still unavailable for two independent reasons.

  • Apple's live catalogue still contains an app named exactly Cadence, published by Sho Asano with bundle identifier com.shoasano.scheduleapp, in the France, United States, United Kingdom, Germany and Canada storefronts. Evidence: proof/03_market/captures/itunes_lookup_cadence_id6767622803_{fr,us,gb,de,ca}.json and proof/03_market/captures/appstore_product_cadence_id6767622803_fr.{html,txt,png}, retrieved 2026-08-04.
  • EUTM 019227648, CADENCE, owned by Cadence Design Systems, is registered in Nice classes 9 and 42; its specifications include unqualified downloadable software and software services. It was registered on 2026-01-15 and expires on 2035-08-04. The earliest ordinary non-use attack point is therefore January 2031. Evidence: proof/03_market/captures/tm_euipo_esearch_019227648.{txt,png} and proof/03_market/captures/rev_tm_euipo_cadence.{txt,png}, retrieved 2026-08-04.

Cadence Kitchen Timer is a different trademark question from the bare word because a compound is assessed as a whole. It is not a safe workaround: Cadence remains the distinctive first element, Kitchen Timer describes the goods, and the cited EUTM covers the same software category. The residual European infringement and opposition risk is high, even though public store searches found no app with that exact full compound.

Shortlist and checks

Public store searches were run for every candidate on both stores in the French, British English, U.S. English and Indian English storefronts. Every search found no exact full-name match. Apple evidence: proof/03_market/captures/rev_name_apple_<candidate>_{fr,gb,us,in}.{txt,html}. Google Play evidence: proof/03_market/captures/rev_name_play_<candidate>_{fr,gb,us,in}.{txt,html,png}. All were retrieved 2026-08-04 through utilities/chrome.py.

Candidate Store-name result EUIPO / INPI / USPTO result UKIPO result Domains checked Decision
PassPilot Kitchen Timer No exact match in either store across all checked storefronts PassPilot: no result in EUIPO, INPI or USPTO public searches Search attempted; UKIPO returned HTTP 403, so this jurisdiction is unresolved passpilot.dev and passpilotkitchentimer.com returned RDAP 404 and appeared unregistered at capture time Recommend for human review. Distinctive in both languages and explicitly says what the product is.
MiseFlow Kitchen Timer No exact match MiseFlow: no result in EUIPO, INPI or USPTO public searches Search attempted; unresolved because UKIPO returned HTTP 403 miseflow.dev is registered; miseflowkitchentimer.com appeared unregistered Viable runner-up, but the unavailable short domain is a real brand cost and “mise” is less immediately clear outside kitchens.
KitchenCue Timers No exact match EUIPO and INPI returned no result, but USPTO registration 3309406, exact word mark KITCHENCUE, is live in class 9 for culinary educational media Search attempted; unresolved because UKIPO returned HTTP 403 kitchencue.dev and kitchencuetimers.com appeared unregistered Reject. The exact U.S. culinary mark is too close.
Cadence Kitchen Timer No exact full-name match EUIPO and INPI return many Cadence records; USPTO returns many records; EUTM 019227648 is the direct software problem Search attempted; unresolved because UKIPO returned HTTP 403 cadencekitchentimer.dev and cadencekitchentimer.com appeared unregistered Reject. The descriptive suffix does not remove the dominant Cadence risk.

Trademark evidence: proof/03_market/captures/rev_tm_euipo_{passpilot,miseflow,kitchencue,cadence}.{txt,html,png}, rev_tm_inpi_{passpilot,miseflow,kitchencue,cadence}.{txt,html,png}, rev_tm_uspto_{passpilot,miseflow,kitchencue,cadence}.{txt,html,png}, and rev_tm_ukipo_{passpilot,miseflow,kitchencue,cadence}_blocked.{txt,html,png}, retrieved 2026-08-04. Domain evidence: proof/03_market/captures/rev_domain_*.{txt,html,png}, retrieved 2026-08-04. An RDAP negative result is a point-in-time availability check, not a reservation.

The public-store result has one unavoidable limit. An App Store Connect name reservation that has never produced a published app is invisible to public search. The definitive availability test is to type the chosen name into the New App name field in App Store Connect; do that before commissioning the icon, screenshots or website.

Residual risk on the recommendation: PassPilot Kitchen Timer has no public exact/root result in the three registers that returned valid searches, but UKIPO clearance is still missing, public searches do not decide confusing similarity or unregistered rights, and the name is not reserved in either store or as a domain.

03 Business Decisionsresearch/03_business_decisions.md · raw .md

Decision 2 — Seller entity: publish as an individual first

Recommendation

Do not form a company for the free launch. Use an individual account on each store, with the founders recording privately who owns the app and who controls the accounts. If a company becomes necessary later, the recommended fallback is a UK private limited company, provided the founders accept the UK registered-office and ongoing filing obligations.

What a free individual launch actually costs and publishes

Store Unavoidable programme cost What the public sees for a free individual app Other launch gate
Google Play US$25 once Under Google's general personal-account rule: legal name, country derived from the legal address, and developer email. Monetisation triggers publication of the full legal address. Google also warns that regional rules can require extra public details, including a full address; an EU trader must therefore expect the DSA contact-information rule to override the free-app baseline. A personal account created after 2023-11-13 must run a closed test with at least 12 opted-in testers for 14 continuous days before applying for production access. The rule depends on account type and creation date, not price.
Apple App Store US$99 per membership year, shown in local currency where available The individual's personal legal name is the seller. App Store Connect requires a DSA trader-status declaration even outside the EU. Free does not automatically mean non-trader: Apple says business purpose and intention to commercialise are relevant. If declared a trader for an EU app, Apple publishes an address or P.O. Box, phone and email and requests payment-account details.

Sources, all retrieved 2026-08-04: Google registration fee, proof/03_market/captures/policy_google_eea_general_conditions.html; Google personal-account public fields and monetisation trigger, policy_google_play_verify_identity.txt, source https://support.google.com/googleplay/android-developer/answer/13628312; Google test gate, policy_google_personal_testing_reqs.txt, source https://support.google.com/googleplay/android-developer/answer/14151465; Apple fee, seller name and conversion route, policy_apple_enrollment.txt, source https://developer.apple.com/support/enrollment/; Apple DSA requirements, policy_apple_asc_dsa_trader.txt, source https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-trader-requirements.

This corrects the earlier incorporation argument. For a free Google personal listing, the baseline is legal name, country and email—not a full address. That removes the earlier claim that free publication by itself exposes the home address. It does not remove the separate EU trader issue: the DSA requires a trader's name, address, phone and email to be public, and Google's own identity page warns that regional rules can add a full address. Free price is only one fact in the trader assessment, so the founders must resolve the trader declaration before treating either store as an address-free route. DSA source: Article 30 of Regulation (EU) 2022/2065, proof/03_market/captures/policy_eurlex_dsa_2022_2065.txt, retrieved 2026-08-04, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065.

Company fallback comparison

Only use this table if payment, liability, joint ownership, contracting or a store-name requirement later makes an entity worthwhile.

Structure Fully online and timing Formation cost Stripe Fit for Henry and Serge
UK private limited company Online; Companies House says registration is usually completed within 24 hours £100 United Kingdom is supported Supports multiple shareholders and directors, including a two-founder cap table. It needs a UK registered office, identity verification, accounts and tax filings. Recommended fallback because it is the fastest, cheapest jointly owned company in this comparison.
Estonian OÜ through e-Residency Company registration is online and takes about 15 minutes to 1 hour once the e-Residency card exists; obtaining and collecting the physical card means the full journey is not entirely online €150 per e-Residency application, €265 company registration, normally €200–€400/year for an Estonian contact person, with accounting extra Estonia is supported Can hold two founders, gives an EU company and remote administration, but each active founder needs the digital-ID route and cross-border tax still follows where people actually work and manage it.
Stripe Atlas Online; Atlas says the Delaware company can accept payments within 2 business days US$500 once, including the first registered-agent year, then US$100/year A Stripe account is part of the route Handles co-founders cleanly, but creates a U.S. company, federal and state filings, and cross-border founder tax work that is excessive for a free kitchen timer.
French micro-entreprise / auto-entrepreneur French creation formalities are online through the single portal; the official page gives no guaranteed processing time Cost depends on activity; the structure avoids company statutes and capital France is supported One natural person only; no shared equity and Apple treats a sole proprietor as an individual seller. Simple for one founder, wrong for jointly owned publishing.
French EI Online through the same portal; the official page gives no guaranteed processing time The official comparison states €21.74 for a commercial EI France is supported One natural person only and no separate legal person. It does not solve joint ownership or Apple's individual seller name.
French SASU Online through the same portal, with no official guaranteed processing time; statutes, capital, beneficial-owner filing and a legal notice are required Official filing components shown in the comparison are €33.83 registration plus €19.33 beneficial-owner filing, plus the variable legal-notice cost France is supported One shareholder only. To put both founders in the equity, use a SAS rather than a SASU, with more drafting and administration than the UK fallback.

Sources, retrieved 2026-08-04: UK online incorporation, timing and cost, proof/03_market/captures/rev_entity_uk_incorporation.txt, source https://www.gov.uk/limited-company-formation/register-your-company; Estonian process, time and service costs, rev_entity_estonia_start.txt, source https://www.e-resident.gov.ee/start-a-company/; e-Residency and registration fees, https://learn.e-resident.gov.ee/hc/en-gb/articles/360000625118-Costs-fees; Stripe Atlas timing and fees, rev_entity_stripe_atlas.txt, source https://stripe.com/atlas; Stripe country support, rev_entity_stripe_global.txt, source https://stripe.com/global; French online portal, rev_entity_fr_guichet.txt, source https://entreprendre.service-public.fr/vosdroits/R61572; French structure and filing-cost comparison, rev_entity_fr_ei.txt, source https://entreprendre.service-public.fr/vosdroits/F23844; SASU structure, rev_entity_fr_sasu.txt, source https://entreprendre.service-public.fr/vosdroits/F37383.

Cost of incorporating later

  • Apple: first ask Apple Developer Support to convert the individual membership to an organisation; Apple's enrolment page explicitly directs existing individuals to contact support. If Apple requires a transfer instead, create and verify the organisation membership, meet the app-transfer criteria, and transfer the app. The app stays downloadable and retains ratings, reviews and updates, but its bundle identifier stays permanent. Source: proof/03_market/captures/policy_apple_enrollment.txt and policy_apple_asc_transfer_app.txt, retrieved 2026-08-04; https://developer.apple.com/help/app-store-connect/transfer-an-app/overview-of-app-transfer/.
  • Google: the DSA account-type selection cannot be changed later, so create and verify an organisation account and submit an app transfer. Users, statistics, comments, ratings and subscriptions transfer; historical earnings reports and test groups do not, so the closed-test group must be rebuilt. Google says support reviews transfer requests within 2 business days. Source: proof/03_market/captures/policy_google_play_dsa_trader.txt and policy_google_app_transfer.txt, retrieved 2026-08-04; https://support.google.com/googleplay/android-developer/answer/6230247.

Starting free makes both migrations simpler because there are no products, subscriptions, receipts or entitlement servers to move.