feat: simplify Google switch to on-only (state push restored)

Dropped the both-on/off-fire workaround now that HomeGraph reportState works
(new SA key + linked agent). turn_off is a no-op; on-tap prints; tile auto-reverts
via reportState. Verified: turn_on prints, turn_off does nothing. Docs/DECISIONS
updated to mark the HomeGraph auth issue resolved.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -32,16 +32,17 @@ Format: `YYYY-MM-DD: <decision> — <why>`
   (voice/Routine only) — the button was invisible. A template switch
   (`switch.print_daily_briefing`) tiles like the TV. **Confirmed working end-to-end
   2026-06-07: a Google Home tap printed a receipt.** State is forced off and both
-  on/off fire the print (debounce in bridge prevents double-print) because HomeGraph
-  state push is down — keep this until reportState works, then simplify to on-only.
+  on-tap fires the print; state is forced off so the tile auto-reverts via reportState;
+  `turn_off` is a no-op. (Was both-on/off-fire while HomeGraph was down; simplified to
+  on-only 2026-06-07 once state push was restored. Bridge debounce still guards doubles.)
 - **2026-06-07: HomeGraph SA key regenerated.** The old `/config/SERVICE_ACCOUNT.json`
   key was invalid (`invalid_grant` — rotated in the lgtv 06-06 cleanup, never refreshed),
   breaking requestSync/reportState. Seth issued a new JSON key for `claude@seth-freiberg.iam`
   (id `8e3e812b6913…`); deployed to HA (0600), restarted. Auth now succeeds
-  (400→404). **Residual:** requestSync/reportState still 404 ("agent not registered in
-  HomeGraph") even after a Google re-sync — control (EXECUTE) works, but live state
-  push to Google does not yet. Non-blocking for the print button (always-off by design).
-  Revisit if TV/projector live state matters (may need a full unlink+relink).
+  (400→404). After a Google re-link registered the agent, both requestSync and
+  reportState return 200 → **live state push works for all devices.** (A manually
+  admin-triggered request_sync logs a harmless 404: it sends the unlinked owner id
+  `2c22820…`; HA's automatic reporting uses the linked `f948247…` and succeeds.)
 - **2026-06-07: paho-mqtt v1 callbacks (`CallbackAPIVersion.VERSION1`).** paho 2.1.0
   is installed for `claude`; matches the working lgtv bridge. One-time deprecation
   warning at startup is harmless.

docs/ha-setup.md

@@ -13,10 +13,9 @@ A `script`/`scene` exposed to Google gets the **Scene** trait, which Google Home
 does **not** render as a tappable tile (it's voice/Routine-only). A **switch**
 renders as a tile (like the LG TV). So the action is exposed as a template switch.
 
-Because HomeGraph state reporting is currently broken (see below), the switch is
-forced **always-off** and **both on and off fire the print**, so a tap always
-prints regardless of Google's cached state. The bridge debounce prevents any
-double-print. (Once the SA key is fixed, this can be simplified to on-only.)
+The switch state is forced **always-off**; an **on-tap fires the print** and the
+tile auto-reverts to off a few seconds later (via HomeGraph reportState). `turn_off`
+is a no-op. The bridge debounce guards against any stray double-fire.
 
 ## What is deployed on VM HA `/config` (backups in `/config/.backup/`)
 - **`scripts.yaml`** — `script.print_daily_briefing` (presses the button). Kept as
@@ -34,26 +33,21 @@ double-print. (Once the SA key is fixed, this can be simplified to on-only.)
 - `switch.turn_on switch.print_daily_briefing` → bridge `Briefing printed OK` →
   **physical receipt**. (Same for the earlier `script` path.)
 
-## Known issue — HomeGraph auth broken (pre-existing, not from this work)
-HA's `SERVICE_ACCOUNT.json` (project `seth-freiberg`, SA `claude@seth-freiberg.iam`)
-has an **invalid private key** (`invalid_grant: Invalid JWT Signature`) — the key was
-rotated/deleted during the lgtv 2026-06-06 security cleanup but the HA copy was never
-refreshed. Effects:
-- `devices:requestSync` 400 → HA can't proactively push device-list changes; you must
-  re-sync from the Google side ("Hey Google, sync my devices").
-- `devices:reportStateAndNotification` 400 → device states (incl. the TV/projector)
-  don't push to Google in real time.
-**Fix (GCP, your call):** create a new JSON key for `claude@seth-freiberg.iam`
-(HomeGraph API enabled), deploy to `/config/SERVICE_ACCOUNT.json` (chmod 600), restart
-HA. Then `request_sync` and live state work for all devices, and this switch can drop
-the both-directions-fire hack.
+## HomeGraph auth — RESOLVED 2026-06-07
+The old `SERVICE_ACCOUNT.json` key (project `seth-freiberg`, SA
+`claude@seth-freiberg.iam`) was invalid (`invalid_grant`) — rotated in the lgtv
+2026-06-06 cleanup, never refreshed — so `requestSync`/`reportState` 400'd. Seth
+issued a new JSON key (id `8e3e812b6913…`); deployed to `/config/SERVICE_ACCOUNT.json`
+(0600), restarted HA. After a Google re-link registered the agent, both APIs return
+200 → live state push works for all devices. (Note: a manually-triggered
+`google_assistant.request_sync` via the admin API logs a harmless 404 because it sends
+the unlinked owner-context id `2c22820…`; HA's automatic reporting uses the linked
+`f948247…` and succeeds.)
 
-## Your steps (Google Home app, account `slingshooter08`)
-1. Say **"Hey Google, sync my devices"** (linking-based sync; works despite the SA-key
-   issue). **Print Daily Briefing** should appear as a tile.
-2. Remove any **stale/phantom device** — HA only sends 3 devices; if Google shows 4,
-   the extra is leftover from a prior link. (Settings → the duplicate → Remove.)
-3. Tap **Print Daily Briefing** → receipt prints in ~1–2 min.
+## Status: working
+Tapping **Print Daily Briefing** in Google Home (account `slingshooter08`) prints —
+verified end-to-end. If you ever re-add it: "Hey Google, sync my devices" surfaces the
+tile; remove any stale/phantom device if Google's count exceeds HA's 3.
 
 ## Notes
 - A print takes ~1–2 min (gemma4:26b). `posbriefing/status` goes `printing` → `ok`.