Docs: harden #17 — merged-manifest permission, captureBodies default, TimingPhase labels

[mibrahimdev]

Closes #17. Docs-only pass bundling the three documentation gaps from launch review. No code behavior change.

Acceptance criteria → what was written

1. POST_NOTIFICATIONS appears in the consumer's merged manifest

README.md (Android section) now states explicitly that sharingan/src/androidMain/AndroidManifest.xml declares <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />, so manifest merger surfaces it in the consumer's merged manifest. It also documents the verified guarantee that the library never requests the permission at runtime — your app decides whether to ask — and that the sharingan-noop release artifact declares nothing, so the permission doesn't reach release builds.

Verification: grepped the whole :sharingan source tree for requestPermissions / ActivityCompat.request / registerForActivityResult / RequestPermission — zero hits. The only runtime request lives in the sample app (MainActivity), not the library.

2. captureBodies default + start-paused / opt-out

README.md (HTTP section) now documents that body capture is ON by default (captureBodies = true, confirmed at SharinganKtor.kt:30), that captureBodies = false keeps metadata but drops body text, and that Sharingan.setRecording(false) at startup lets a team start paused and capture nothing until they flip it on (or use the Android notification's Pause/Resume). Noted that pause spans every protocol, not just HTTP.

3. TimingPhase.label vocabulary

Added KDoc on TimingPhase (HttpEvent.kt) spelling out the conventional waterfall vocabulary in occurrence order — DNS, Connect, TLS, TTFB, Download — and noting label is a free-form String (any text renders), with the SharinganKtor plugin emitting the TTFB/Download split automatically. Real labels derived from code: the Ktor plugin emits "TTFB"/"Download" (SharinganKtor.kt:104-105); PreviewData exercises the full DNS/Connect/TLS/TTFB/Download set.

Discrepancies between the issue and the real code

• None material. All three issue assumptions matched reality. Two refinements worth noting:
  • The README already mentioned POST_NOTIFICATIONS and the TTFB/Download split; the gaps were precision (merged-manifest wording, the "never requested by the library" guarantee) and discoverability (the free-form label vocabulary), so this PR sharpens existing prose rather than adding net-new claims.
  • The issue framed (2) as "captureBodies … start paused / opt out" as if one knob. In the code these are two distinct mechanisms: captureBodies = false (per-plugin, body-text only) vs. Sharingan.setRecording(false) (global pause, all protocols). Documented both and the distinction.

🤖 Generated with Claude Code