fix(category): gate weak heuristic blocks before the type tags

A refuting review found the confidence gate on heuristic categories
sat after the database-type mapping. HeuristicChecker types its blocks
from the same signals, so in aggressive mode a lone 30-point VoIP-range
match or 40-point rapid-fire match, typed "robocall", still named the
Robocall category and a Robocall rule could decide the call on it.
The gate now runs first, and the later heuristic branch no longer
repeats it.

Test changes: a new CallCategoryResolverTest case covers weak typed
heuristic blocks, a strong one, and the same type from the database at
low confidence. Letting a typed weak block past the gate fails it.

Author: SysAdminDoc

CHANGELOG.md

@@ -46,10 +46,12 @@ All notable changes to CallShield will be documented in this file.
   campaign range as a robocall, and a toll-free one as a telemarketer, so
   the action you picked for that category applies. Those mappings existed
   but never matched, because they looked for internal names the block
-  description had already turned into plain words. They only apply to a
-  block as confident as the default setting requires, so a lone
-  neighbor-spoof match that only aggressive mode blocks stays uncategorized
-  and no category rule can let it through.
+  description had already turned into plain words. A suspicious-pattern
+  block only gets a category when it's as confident as the default setting
+  requires. One that only aggressive mode blocks, such as a lone
+  neighbor-spoof or VoIP-range match, stays uncategorized, so no category
+  rule can let it through. Before, a weak match that the block had typed as
+  a robocall still counted as one.
 
 - CallShield starts faster when a call wakes it. Looking for an interrupted
   backup restore held the main thread about 0.7 seconds on every start

app/src/main/java/com/sysadmindoc/callshield/data/CallCategory.kt

@@ -81,6 +81,16 @@ object CallCategoryResolver {
         if (!result.isSpam) return CallCategory.Unknown
         CategoryCallPolicy.parseMatchSource(result.matchSource)?.let { return it.category }
 
+        // A heuristic block names a category only at the score the default
+        // setting blocks at. Its type comes from the same signals, so this
+        // goes before the type tags: aggressive mode blocks a lone 30-point
+        // VoIP-range match typed "robocall", and a lone 50-point neighbor-spoof
+        // match also fires on local banks and schools. Naming either would let
+        // a category rule decide the call on that alone.
+        if (result.reasonCode == BlockReasonCode.HEURISTIC && result.confidence < HEURISTIC_CATEGORY_MIN_CONFIDENCE) {
+            return CallCategory.Unknown
+        }
+
         // (1) Database type tags are authoritative — they came from
         //     labeled community/FCC/FTC data, not heuristics.
         when (result.type.lowercase().trim()) {
@@ -120,11 +130,8 @@ object CallCategoryResolver {
         // Heuristic reasons: map the strongest signals. A live result carries
         // the raw tokens in `signals`; its description is display text in the
         // app language (and always had the underscores replaced), so it only
-        // helps callers that still pass tokens there. Only at the confidence
-        // the default setting blocks at: aggressive mode blocks on a single
-        // 50-point neighbor-spoof match, which also fires on local banks and
-        // schools, and naming that Scam would let a Scam rule decide it.
-        if (result.reasonCode == BlockReasonCode.HEURISTIC && result.confidence >= HEURISTIC_CATEGORY_MIN_CONFIDENCE) {
+        // helps callers that still pass tokens there.
+        if (result.reasonCode == BlockReasonCode.HEURISTIC) {
             val evidence = (result.signals + desc).joinToString(" ")
             when {
                 "wangiri" in evidence -> return CallCategory.Wangiri

app/src/test/java/com/sysadmindoc/callshield/data/CallCategoryResolverTest.kt

@@ -113,6 +113,29 @@ class CallCategoryResolverTest {
         assertEquals(CallCategory.Scam, CallCategoryResolver.resolve(weak.copy(confidence = 60)))
     }
 
+    @Test
+    fun `a weak heuristic block's type names no category either`() {
+        // HeuristicChecker types its blocks from the same signals: a lone
+        // VoIP-range match (30) or rapid-fire match (40) is typed "robocall",
+        // and aggressive mode blocks both.
+        fun heuristic(
+            type: String,
+            confidence: Int,
+            vararg signals: String,
+        ) = BlockResult
+            .block("heuristic", type = type, description = "", confidence = confidence, signals = signals.toList())
+            .toSpamCheckResult()
+
+        assertEquals(CallCategory.Unknown, CallCategoryResolver.resolve(heuristic("robocall", 30, "voip_spam_range")))
+        assertEquals(CallCategory.Unknown, CallCategoryResolver.resolve(heuristic("robocall", 40, "rapid_fire")))
+        assertEquals(CallCategory.Robocall, CallCategoryResolver.resolve(heuristic("robocall", 70, "rapid_fire", "voip_spam_range")))
+        // The same type from the database is authoritative at any confidence.
+        assertEquals(
+            CallCategory.Robocall,
+            CallCategoryResolver.resolve(SpamCheckResult(isSpam = true, matchSource = "database", type = "robocall", confidence = 30)),
+        )
+    }
+
     @Test
     fun `heuristic with rapid_fire resolves to Robocall`() {
         val result =