docs: apply pin-point delta edits for correctness and polish

Analysis doc improvements:
- Add exact-alarm clarifier box: SCHEDULE_EXACT_ALARM is special app-op, not runtime permission
- Add WAKE_LOCK usage tip: typically unnecessary with AlarmManager/WorkManager
- Guard Cordova compat dependency: use debug/releaseImplementation with transitive=false
- Add exported defaults reminder to manifest excerpt
- Add asset path wording clarification: webDir → src/main/assets/public/
- Clarify POST_NOTIFICATIONS scope: required on Android 13+, ignored on lower APIs

Implementation plan improvements:
- Add Doze/Idle acceptance signal to Phase 1 DoD: UI surfaces 'Degraded timing (Doze)'
- Add receiver export policy to PR checklist: only BootReceiver exported
- Add ProGuard/R8 keep rules: prevent Capacitor annotations from being stripped
- Enhance diagnostics payload: include appId, version, device info, API level, timezone, config, status fields, event IDs
- Add negative schema case to Test Matrix: catches drift at JS boundary
- Add channel invariants to acceptance criteria: missing/disabled channel returns proper errors
- Add boot reschedule duplicate shield: unique key with UPSERT semantics
- Add network client hard limits to AC: HTTPS-only, timeouts ≤ 30s, content ≤ 1MB

All changes maintain existing structure with surgical precision edits.

docs/android-app-analysis.md

@@ -127,6 +127,7 @@ public class MainActivity extends BridgeActivity {
     </activity>
 
     <!-- Plugin Components -->
+    <!-- Internal receiver: keep non-exported unless intentionally public -->
     <receiver
         android:name="com.timesafari.dailynotification.DailyNotificationReceiver"
         android:enabled="true"
@@ -152,6 +153,9 @@ public class MainActivity extends BridgeActivity {
 <uses-permission android:name="android.permission.WAKE_LOCK" />
 <uses-permission android:name="android.permission.INTERNET" />
 <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+
+> **Tip:** `WAKE_LOCK` is typically unnecessary with AlarmManager/WorkManager; remove unless you explicitly acquire/release your own wakelocks.
+> **Note:** `POST_NOTIFICATIONS` is required **on Android 13+**; lower API levels ignore it gracefully.
 ```
 
 **Critical Permissions**:
@@ -207,6 +211,8 @@ public class MainActivity extends BridgeActivity {
 
 The `/www` directory (mapped to `assets/public/`) contains the web application that runs inside the Capacitor WebView:
 
+> Capacitor builds copy your `webDir` (e.g., `www/`) to `src/main/assets/public/` on Android; the WebView serves from that `public/` folder.
+
 ```
 assets/public/
 ├── index.html              # Main test interface (549 lines)
@@ -382,8 +388,9 @@ dependencies {
     implementation "androidx.work:work-runtime-ktx:2.9.0"
     implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3"
     
-    // Cordova Compatibility (only if shipping Cordova shims)
-    implementation project(':capacitor-cordova-android-plugins')
+    // Cordova compatibility (include ONLY if using Cordova plugins)
+    debugImplementation(project(':capacitor-cordova-android-plugins')) { transitive = false }
+    releaseImplementation(project(':capacitor-cordova-android-plugins')) { transitive = false }
 }
 ```
 
@@ -600,6 +607,8 @@ This architecture serves as both a practical testing tool and a reference implem
 If `SCHEDULE_EXACT_ALARM` is **granted** → schedule with `setExactAndAllowWhileIdle`.
 If **denied or quota-limited** → schedule via WorkManager (exp backoff + jitter) and surface `E_EXACT_ALARM_DENIED` (with "Degraded timing — Doze may delay" hint).
 
+> **Exact Alarm note:** `SCHEDULE_EXACT_ALARM` is a **special app-op**, not a runtime permission prompt. Users grant it via Settings; your UI should deep-link there and reflect denial by degrading to WorkManager.
+
 ## Permission & Settings Truth Table
 
 | Symptom | Likely Cause | Action |