One-shot NTP app phases

project-docs/decisions/0003-privileged-install-track.md

@@ -0,0 +1,18 @@
+# ADR 0003: Privileged install track
+
+## Decision
+
+Ordinary sideloading will not make NTP Check a privileged app. The main app remains a normal diagnostic app. A future separate privileged/root build track may be designed, but it must not be mixed into the default release.
+
+## Notes
+
+A privileged Android app generally has to be installed on a privileged partition such as `/system/priv-app/...` and allowed through `privapp-permissions` XML. On many devices, clock-setting APIs may also require platform signing or ROM control. Root/Magisk or a custom ROM can make this possible, but it is device-specific and not appropriate for v1.
+
+## Consequence
+
+Default release behavior is:
+
+- measure NTP offset
+- warn when local time appears wrong
+- open Android Date & Time settings
+- never silently attempt clock changes